x65 patching technical discussion

[Acidmrp]

Ok, I do the beginning. Please Post only technical articles here.

@Mod please make this sticky

File Handling

fopen
typedef int (*g_fopen)(const char * cFileName, unsigned int iFileFlags, unsigned int iFileMode, unsigned int *ErrorNumber);
g_fopen fopen = (g_fopen)(0xA1230050); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE52CC090E5

fclose

typedef void (*g_fclose)(int FileHandler, unsigned int *ErrorNumber);
g_fclose fclose = (g_fclose)(0xA122FFA4); // S65 FW47
// Pattern: 38402DE90150A0E10040A0E1????????00C090E5


fflush

typedef void (*g_fflush)(int FileHandler, unsigned int *ErrorNumber);
g_fflush fflush = (g_fflush)(0xA122FFD4); // S65 FW47
// Pattern: 38402DE90150A0E10040A0E1????????08C090E5


lseek

typedef unsigned int (*g_lseek)(int FileHandler, unsigned int offset, unsigned int origin, unsigned int *ErrorNumber);
// g_lseek lseek = (g_lseek)(0xA1230004); // S65 FW47
// Pattern: FF412DE928509DE50280A0E10170A0E10360A0E10040A0E1


fread

typedef void (*g_fread)(int FileHandler, char *cBuffer, int iByteCount, unsigned int *ErrorNumber);
g_fread fread = (g_fread)(0xA1230090); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE530C090E5


fwrite

typedef void (*g_fwrite)(int FileHandler, const char * cBuffer, int iByteCount, unsigned int *ErrorNumber);
g_fwrite fwrite = (g_fwrite)(0xA1230178); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE55CC090E5


SetFileSize

typedef void (*g_SetFileSize)(int FileHandler, unsigned int iNewFileSize, unsigned int *ErrorNumber);
g_SetFileSize SetFileSize = (g_SetFileSize)(0xA12300D0); // S65 FW47
// Pattern: 7C402DE90160A0E10250A0E10040A0E1????????0030E0E300 308DE544C090E5


Constants

Seek

#define S_SET 0
#define S_CUR 1
#define S_END 2


Permissions

#define P_WRITE 0x100
#define P_READ 0x80


Access

#define A_ReadOnly 0
#define A_WriteOnly 1
#define A_ReadWrite 2
#define A_NoShare 4
#define A_Append 8
#define A_Exclusive 0x10
#define A_MMCStream 0x20
#define A_Create 0x100
#define A_Truncate 0x200
#define A_FailCreateOnExist 0x400
#define A_FailOnReopen 0x800

#define A_TXT 0x4000
#define A_BIN 0x8000


Sample - File Read


int iFileHandler
unsigned int iError;
unsigned int iFileSize;
unsigned int iFilePos;
char *cFileOutput = (char*)0xA8100000;

// file read example:
iFileHandler = fopen("0:\\test.bin\0", A_ReadOnly, P_READ, &iError);

if (iFileHandler != -1) {
// get the file size:
iFileSize = lseek(iFileHandler, 0, S_END, &iError);

if (iFileSize > 0) {

// seek the beginning of the file:
iFilePos = lseek(iFileHandler, 0, S_SET, &iError);

// read complete file:
fread(iFileHandler, cFileOutput, iFileSize, &iError);
}

// close the file
fclose(iFileHandler, &iError);
} else {
// File not found
}


Sample - File Write


int iFileHandler
unsigned int iError;
unsigned int iFileSize;
unsigned int iFilePos;
char *cFileOutput = (char*)0xA8100000;

// create file if it does not exist:
iFileHandler = fopen("0:\\outfile.txt\0", A_Create, P_WRITE, &iError);
fclose(iFileHandler, &iError);

iFileHandler = fopen("0:\\outfile.txt\0", A_WriteOnly, P_WRITE, &iError);
if (iFileHandler != -1) {
// search the end of the file
iFileSize = lseek(iFileHandler, 0, S_END, &iError);
// add an line
fwrite(iFileHandler, "new line\x0D\x0A", 10, &iError);

// close the file
fclose(iFileHandler, &iError);
}

[arsh0r]

i also collected some functiones in my databse here: http://d23.2chaos.de/index.php?page=functions&lang=en&mid=2
i added acid's functions. they are so cool, thx acid

[arsh0r]

@acid: i want to read a unicode text file. to make sure it is only loaded to ram once i want to check the first 2 bytes of the file (if it is unicode: first word in file is 0xFFFE). i did it like this:
...
if (iFileHandler != -1 && cFileOutput[0] != 0xFE && cFileOutput[1] != 0xFF) {
// get the file size:
...
compiles with no problems, but when i test it on the phone it crashes. if i remove "&& cFileOutput[1] != 0xFF" it works. it doesn't seem to like "cFileOutput[1]". i also can't declare another pointer to ram in the function, even if i don't use the pointer the phone crashes. what did i do wrong? sexit code says Data_Abort! at address 0xA128D51C...
thx in advance

[BennieZ]

Test it as follows:
....
if (iFileHandler != -1 && *(unsigned short*)cFileOutput != 0xFFFE) {
....

if memory need bound allign to WORD, it possibly crashes!

[avkiev]

*(unsigned short*)cFileOutput != 0xFFFE)
Or something like that:
(*(unsigned long*)cFileOutput >> 16) != 0xFFFE

[BennieZ]

Or something like that:
(*(unsigned long*)cFileOutput >> 16) != 0xFFFE

why to right shift this DWORD? X65 is little-endian. so it Should be

(*(unsigned long*)cFileOutput & 0xFFFF) != 0xFFFE

[arsh0r]

thanks guys! "&& *(unsigned short*)cFileOutput != 0xFFFE" works, but i can't increment the cFileOutput pointer, f.ex. "cFileOutput += 2;" or "cFileOutput[2]". should i use a const char* instead? i need to access the data that are copied to ram. compiles correctly, but phone crashes with Data_abort. maybe the compiler messes something up...
another way: does any of these functions return a pointer to the beginning of the file in FFS? single said it won't be fragmented for small files. then i won't have to copy it into ram...

[avkiev]

why to right shift this DWORD? X65 is little-endian. so it Should be
(*(unsigned long*)cFileOutput & 0xFFFF) != 0xFFFE
Oh, of course .

[BennieZ]

thanks guys! "&& *(unsigned short*)cFileOutput != 0xFFFE" works, but i can't increment the cFileOutput pointer, f.ex. "cFileOutput += 2;" or "cFileOutput[2]". should i use a const char* instead? i need to access the data that are copied to ram. compiles correctly, but phone crashes with Data_abort. maybe the compiler messes something up...
You can read it into stack if It is a small file.
e.x
.....
char buf[1024];
......
fread(iFileHandler, buf, iFileSize, &iError);
.....

because i don't known something about X65 memory map, like some can access at 1-byte allign, another must be at 2-byte or 4-byte allign.

another way: does any of these functions return a pointer to the beginning of the file in FFS? single said it won't be fragmented for small files. then i won't have to copy it into ram...

you should not access file skip system file process!

[Acidmrp]

yes, it's possible to access the files directly from file system, but it's no good
idea to do this. Because you can't write this file without implement an flasher.
And you don't know if the file is already opened.

Better use only 4 Bytes aligned Access if you want to be shure. Or even better, do
some tests what addesses can be accesses in what way.

[arsh0r]

i didn't succed in reading files correctly, but i made an addition to at+cgsn:

void Binary(const char* str) {
char buf[128];
int iFileHandler;
unsigned int iError;
unsigned int iFileSize;
dword addr = strtoul(&str,8);
char* paddr = (char *)addr;
word blocks = strtoul(&str,4);

sprintf(buf, "0:\\%08X.bin\0", addr);
// create file if it does not exist:
iFileHandler = fopen(buf, A_Create, P_WRITE, &iError);
fclose(iFileHandler, &iError);

iFileHandler = fopen(buf, A_WriteOnly, P_WRITE, &iError);
if (iFileHandler != -1) {
while (blocks != 0) {
// search the end of the file
iFileSize = lseek(iFileHandler, 0, S_END, &iError);
// add an line
fwrite(iFileHandler, paddr, 0x400, &iError);
paddr += 0x400;
blocks--;
}
}
// close the file
fclose(iFileHandler, &iError);

sprintf(buf, "%08X.bin saved\r\n", addr);
SendATAnswerStr(buf);
return;
}

it can dump n x 0x400 bytes from ram. when i dump 0x400 * 0x400 bytes = 1MB, phone freezes for about 10 seconds. the maximum size that can be written by one fkb.write is 0xF00 = 60 any idea to make this faster and not freezing the phone? by the way how large is the RAM?

[Acidmrp]

I think it's hard to make the phone not freezing. Because you would have to write
an routine running in background and calling itself by an timer for example, if routine
is finished don't setup the timer at it's end.

The big problem: You want to do this in an AT Command. I don't know what the
phone will do if we just call SendATAnswerStr() while other AT Actions already
finished. Can we call this from any routine? Or do we need some Init?
Maybe use an AT Progress? (Sending some dots)

Do anyone know how to access the Display?


EDIT:

@arsh0r
do we really need this:
iFileSize = lseek(iFileHandler, 0, S_END, &iError);

in every loop? I think the file pointer is increasing with the write routine.
Maybe this will make it little faster.

And the other thing: Why do you search the end of the file? It would be
better to search the start.

- create file if it don't exists
- open
- search start
- LOOP WRITE

because you are appending the data to an file if it already exists so we
don't have an exact memory map, because we don't know the old file size.

[arsh0r]

it works, at+cgsn:bA8000000 dumps 1 MB of RAM to binary file in less than 10secs. does anyone know how to write files to mmc, it'll be slower, but we can dump full 8MB ram to file on mmc? because my FFS is mostly occupied *g*.

but sadly SendATAnswerStr, can't send anything during this operation (output is 0A...)

@acid: you're right lseeking everytime is nonsense

[Acidmrp]

@arsh0r try to send status with this routine:

SendCommChar


typedef void (*g_SendCommChar)(unsigned char cChar);
g_SendCommChar SendCommChar = (g_SendCommChar)(0xA119E176 + 1); // S65 FW47
// Pattern: 01B568460121????????08BD10B5


I only have tested this routine with ATCGSN Debug but it should work in C too ;)

[Acidmrp]

SendCommString


typedef void (*g_SendCommString)(unsigned char *cString);
g_SendCommString SendCommString =
(g_SendCommString)(0xA119DFA6 + 1); // S65 FW47

// Pattern: 10B5041C????????0106090E201C

[arsh0r]

i tried SendCommChar, but AT+CGSN:bA8100000 still returns:
- AT Command: ---------------------------------------------------------------------
0A

and stange: when i change filename to: 4:\\%08X.bin\0 (4 is for mmc i think), AT returns the string i composed with sprintf, when i didnt use any sendanswer function at the end of the routine...

edit:
byte the way: you discovered GetSelectedProfile, did you also find some function to change profile? with that we could f.ex. change profile depending which CI:LAC the phone logs in...

[Acidmrp]

what when you call the SendCommString routine by AT+CGSN:c???????? A00063D8
does this works?

GetProfile

typedef unsigned int (*g_GetProfile)();
g_GetProfile GetProfile =
(g_GetProfile)(0xA08C88F4 + 1); // S65 FW47

// Pattern: 10B5????????????0478????????201C10BDF8B5


SetProfile

typedef void (*g_SetProfile)(unsigned int iProfileNumber);
g_SetProfile SetProfile =
(g_SetProfile)(0xA08C87C2 + 1); // S65 FW47

// Pattern: 10B5041C????????082C0CD2

[arsh0r]

SendCommChar('.'); works. returns something like this: "<<nextline>>."
thanks for the profile functions, i'll check them out...

[Acidmrp]

yes, it's possible that SendCommChar don't send only one char. It's not the low level routine for sending an char to COM Port (not found this yet), it's the high level routine
used by AT Commands for example.

[arsh0r]

with the help of acid i made some minigps patch. it reads files from 0:\Misc\gps\*.txt (create gps folder first!). it saves unknown CI/LAC as "CI-LAC.txt", the content of the file will be displayed as providername.
by the way: does anyone know a good j2me text editor for editiong the files?
i post only the source here. if anyone of you got any ideas/additions to the code, i'll be glad. i also want to change profile when phone logs into another cell, then the file format will be: "name%profilenumber". i didn't implement this yet...

edit: patch crashes phone sometimes, with well known Data_Abort! at Address 0xA128D51C... :mad:

[Acidmrp]

ok, maybe try this:

OpenReadCloseFile


typedef int (*g_OpenReadCloseFile)(char *cFilename, char **cFileData);
g_OpenReadCloseFile OpenReadCloseFile =
(g_OpenReadCloseFile)(0xA0BDAB06 + 1); // S65 FW47

// Pattern: FEB5071C0C1C002500AB1D


this is an crazy routine, it opens an file, allocate needed memory, reads complete
file content and closes the file. If it returns -1 there was an error, else it returns
readed size.

But you need to free the buffer after use if it don't returns -1. If it returns -1 the
buffer is already free'd.

malloc_high


typedef char* (*g_malloc_high)(int iSize);
g_malloc_high malloc_high =
(g_malloc_high)(0xA0BDE680 + 1); // S65 FW47

// Pattern: 10B5002800D110BD????????04


mfree_high


typedef void (*g_mfree_high)(char *cArray);
g_mfree_high mfree_high =
(g_mfree_high)(0xA0BC6274 + 1); // S65 FW47

// Pattern: 80B5002801D0????????80BD10EB


try it ;)

[Acidmrp]

ah and one more thing, if malloc_high an mfree_high don't work, try this ones:

maybe they are better:

malloc


typedef char* (*g_malloc)(unsigned int iSize);
g_malloc malloc =
(g_malloc)(0xA0820F98); // S65 FW47

Patter: 0010A0E10200A0E3????????70402DE9


mfree


typedef void (*g_mfree)(char *cArray);
g_mfree mfree =
(g_mfree)(0xA0821000); // S65 FW47

Pattern: 000050E3????????1EFF2FE104E02DE53CD04DE2

[arsh0r]

thx, seems to work, i'll test it this evening and see if its stable....

edit: :D it didn't crash... i used mfree_high to free the buffer. big thx for your help...

[Acidmrp]

@arsh0r can you please post your latest x65.h? I want to do some tests with
minigps patch but my NetData don't have the struct LAC

[arsh0r]

i old versions i named it LAI2 ('cause it was the second number after LAI)

[Acidmrp]

I've done some changes in minigps patch.

v0.3: modified by ACiD[mrp]

- added "change profile"
- changed file format into tmo. This format is directly editable
on the phone.

Use this String:

[profile number] [space] [text to be displayed]

profile number is between 1 and 8. If the profile should be not changed
use 0 as profile number.

Example:

"0 home" will display "home" on screen and not change the profile
"1 work" will display "work" on screen and change profile to normal
environment.

- now saving default text to files

I've used malloc and mfree. They work perfect.

[Acidmrp]

I continue the list of functions here:
http://www.gsm-multifund.de/board/showthread.php?p=50510#post50510

because I get always an "The server is too busy at the moment. Please try again later." error message here.

[avkiev]

I continue the list of functions here:
http://www.gsm-multifund.de/board/showthread.php?p=50510#post50510

I'll collect functions in file "Functions.ini" from Smelter.
It can be easy converted to idc-file for exporting to IDA.
Use Smelter - StandardFunctions - List - Save_as_IDC

[amacri]

Hi,

miniGPS is really nice, but the current version 0.8 sometimes crashes.

Here below some questions after a rough look in the code in order to understand the reason of my crashes.

1. I think that it would be better to avoid any additional file operation when one (e.g., fwrite, lseek) returns errors (this apart from fclose). This consideration might not be really appropriate... just because I noticed that the phone crashes when the filesystem becomes close to full. Maybe this could be the solution...

3. I think that decodeTMOfile should be made more robust; if size is not correct, the phone might crash. The function should first control the xor at the end of the buffer, then copy it; if not correct, it should return an error. The function should also avoid to exceed "dest" lenght (e.g., with appropriate check against additional dest_length parameter). (I noticed that version 0.9 simply deletes decodeTMOfile. Does this simply fix all related issues?)

4. Is there a limit to the charset and size of tmo files? (e.g., in the number of characters of the operatorname) If there is, it should be checked.

5. I would add "sprintf(out, "MiniGPS Error\0");" just after "out = malloc(64);" at the beginning of te file; this is because I think that there might be a case where "out" is not correctly valued; e.g., when "size = OpenReadCloseFile(filename, &filebuffer);" fails and iCID == 0 and isNewNet(iCID) fails. Maybe this is the reason of possible crashes just after new cell selection....

6. Maybe "new cell selected" would be better than "new network found"

[arsh0r]

@amacri:
1.i heard that phone sometimes crashes from many people, it didn't crash for me on v43, didn't test it on v50. yes we must avoid file routines as much as possible, we could use ram to save some temporary values, f.ex. last cell/ last provider string.

3. the data in a tmo is in unicode, but the decodetmo routine copied the data to a char and this killed unicode support. we don't know the lenght of the provider string for sure, simply noone should create a tmo file that is bigger than one line of text. checking the xor will just cost more processor power, don't know if this is really needed.

4.we could simply define a maximum of about 32 characters

5. the file routines sometimes cause a data_abort!, don't know yet how to avoid it.

6. we also could use langpack for those strings...

[BennieZ]

Hello, All
I want to know which compiler are you using to make patch. I try some compiler include ADS1.2,GCC and Keil's ARM. found that there are not a easy way to make patch by this tools.
for example, if you'd like to use BLX instruction to call a ARM function at Thumb mode. It cann't be correctly assemble by Keil's AA and Ads's armasm. it has some other problem as memory locating and bound align.
sorry for my poor english.

[avkiev]

use BLX instruction to call a ARM function at Thumb mode. It cann't be correctly assemble by Keil's AA and Ads's armasm
I have use Keil Asm.
Also I've use such macros:


q0 equ 0xA0000000

;Call ARM from Thumb
CallARM macro addr
a set addr - q0 - $ - 2
dw 0xF000 + ((a>>12)&0x7FF)
dw 0xE800 + ((a & 0xFFC)>>1)
endm

;Call Thumb from ARM
CallThumb macro addr
a set ((addr - q0 - $ - 8) >> 2) & 0xFFFFFF
dw a & 0xFFFF
dw 0xFA00 + (a>>16) + ((addr & 2) << 7)
endm

[BennieZ]

I have use Keil Asm.
Also I've use such macros:

Ohh, very thanks to avkiev, I try some main compiler and Keill is better than others for assemble . only problem is BLX.
because it I has plan to make a software named apm(arm patch maker). it is very like RizaPN's sfe. and has finished lexeme and phrase.

[avkiev]

How to play consecutively several wav-files ?
I can play one wav-file, but if I try play "1.wav" then "2.wav" - only second file plays, it stops first file.
How to play consecutively "1.wav" then "2.wav" ?

[ahmed_elnozahy]

i'm fine thanx man

Ok, I do the beginning. Please Post only technical articles here.

@Mod please make this sticky

File Handling

fopen

Code:
typedef int (*g_fopen)(const char * cFileName, unsigned int iFileFlags, unsigned int iFileMode, unsigned int *ErrorNumber);
g_fopen fopen = (g_fopen)(0xA1230050); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE52CC090E5

fclose

Code:

typedef void (*g_fclose)(int FileHandler, unsigned int *ErrorNumber);
g_fclose fclose = (g_fclose)(0xA122FFA4); // S65 FW47
// Pattern: 38402DE90150A0E10040A0E1????????00C090E5

fflush

Code:

typedef void (*g_fflush)(int FileHandler, unsigned int *ErrorNumber);
g_fflush fflush = (g_fflush)(0xA122FFD4); // S65 FW47
// Pattern: 38402DE90150A0E10040A0E1????????08C090E5

lseek

Code:

typedef unsigned int (*g_lseek)(int FileHandler, unsigned int offset, unsigned int origin, unsigned int *ErrorNumber);
// g_lseek lseek = (g_lseek)(0xA1230004); // S65 FW47
// Pattern: FF412DE928509DE50280A0E10170A0E10360A0E10040A0E1

fread

Code:

typedef void (*g_fread)(int FileHandler, char *cBuffer, int iByteCount, unsigned int *ErrorNumber);
g_fread fread = (g_fread)(0xA1230090); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE530C090E5

fwrite

Code:

typedef void (*g_fwrite)(int FileHandler, const char * cBuffer, int iByteCount, unsigned int *ErrorNumber);
g_fwrite fwrite = (g_fwrite)(0xA1230178); // S65 FW47
// Pattern: FE402DE90270A0E10160A0E10350A0E10040A0E1????????00 30E0E304308DE500508DE55CC090E5

SetFileSize

Code:

typedef void (*g_SetFileSize)(int FileHandler, unsigned int iNewFileSize, unsigned int *ErrorNumber);
g_SetFileSize SetFileSize = (g_SetFileSize)(0xA12300D0); // S65 FW47
// Pattern: 7C402DE90160A0E10250A0E10040A0E1????????0030E0E300 308DE544C090E5

Constants

Seek

Code:

#define S_SET 0
#define S_CUR 1
#define S_END 2

Permissions

Code:

#define P_WRITE 0x100
#define P_READ 0x80

Access

Code:

#define A_ReadOnly 0
#define A_WriteOnly 1
#define A_ReadWrite 2
#define A_NoShare 4
#define A_Append 8
#define A_Exclusive 0x10
#define A_MMCStream 0x20
#define A_Create 0x100
#define A_Truncate 0x200
#define A_FailCreateOnExist 0x400
#define A_FailOnReopen 0x800

#define A_TXT 0x4000
#define A_BIN 0x8000

Sample - File Read


Code:

int iFileHandler
unsigned int iError;
unsigned int iFileSize;
unsigned int iFilePos;
char *cFileOutput = (char*)0xA8100000;

// file read example:
iFileHandler = fopen("0:\\test.bin\0", A_ReadOnly, P_READ, &iError);

if (iFileHandler != -1) {
// get the file size:
iFileSize = lseek(iFileHandler, 0, S_END, &iError);

if (iFileSize > 0) {

// seek the beginning of the file:
iFilePos = lseek(iFileHandler, 0, S_SET, &iError);

// read complete file:
fread(iFileHandler, cFileOutput, iFileSize, &iError);
}

// close the file
fclose(iFileHandler, &iError);
} else {
// File not found
}

Sample - File Write


Code:

int iFileHandler
unsigned int iError;
unsigned int iFileSize;
unsigned int iFilePos;
char *cFileOutput = (char*)0xA8100000;

// create file if it does not exist:
iFileHandler = fopen("0:\\outfile.txt\0", A_Create, P_WRITE, &iError);
fclose(iFileHandler, &iError);

iFileHandler = fopen("0:\\outfile.txt\0", A_WriteOnly, P_WRITE, &iError);
if (iFileHandler != -1) {
// search the end of the file
iFileSize = lseek(iFileHandler, 0, S_END, &iError);
// add an line
fwrite(iFileHandler, "new line\x0D\x0A", 10, &iError);

// close the file
fclose(iFileHandler, &iError);
}

BR

ahmed_elnozahy :) :) :)

[benj9]

Does anybody know a function to change the mainscreen wallpaper or to push the phone to reload what is written in data:/system/HMI/profile.pd, wallpaper entry? Dont care which kind of x65...

[x-geo]

hello to all !! :rolleyes:

as can i see here is where the gods of patches stay!! :eek:

i only have one question

do any of you know how to convert patches of C65 to C66 or C55 to C56? in the internet only i found patches of X65 series and i never found any of X56 or X66 series ;)

I really appreciate all the given help :D

Thank you!!! :cool:

[benj9]

int SetIllumination(int Mode, int Enable, int Brightness, int FadingSmoothness)

Parameters:
R0: 0=Screen, 1=Keypadlight, 2=Dynamic Lights, 3=?. >=4 not supported.
R1: 1. If 0, funtion disabled.
R2: illumination intensity. Like the illumination setting in phone 0-100.
0: off (keypadlight 1 also off)
1-100: dimmed light to bright light
R3 Keypadlight: correction delay for smooth turn-off. OS puts here normally R2 times ten. Using higher values produces a keypadlight delay.
R3 Screen & Dynamic Lights: 00 sharp turn-on/off, FFFF long-smooth turn-on/off

Returns 0 on success.

Example1: R0=R1=1, R2=30, R3=300: turns on keypadlight with low brightness and standard delay.
Example2: R0=R2=0, R1=1, R3=255: turns off screen illumination smoothly.
Search-Pattern:
FF4D2DE90160A0E180179FE508D04DE2-
0010D1E502B0A0E300A0A0E3000051E-
30200E0030050A0E30240A0E10A00000A

[moeinm37]

hi:
i want to patch my phone siemens s65,but i do not know
complete tutorial about doing of them,
i have some patches,
and i have these programs:
OpenAll,SiemensDebugger,SiemensCE,LayoutMe,
vdisk,x65PapuaUtilsV038d_ENG,SiMoCo,Smelter,
V_KLay 3.3,Siemens Quick EEPROM features,OD_02,
DESSwitcher,x65flasher,px65v3,sensortool13,VkpTrac er_3b5.
i install px65v3 in my phone,and then i run it,
about 12 minutes later, give me "OK,Times :799 sec "
and i use x65flasher and with COM1 and speed 57600
i connect to phone,chech boot password and then
give me my boot pass and save it in ---.vkd file in
v_klay folder in the folder of x65flasher,in x65flasher
i can not read flash,is needed later?????
when i use SiemensDebugger ,tell me that "BFB not opened"
,what is it ? and is needed for v_klay ,i mean BFD.
how can i use v_klay program,please help me,
with s65(password boot) or s65(chaos bootpatch),
when the green button change to red,
what is this message : "Connecting...press power button
shortly or disconnect and connect is ofpress power button but does not change anything,
and i can not connect to phone.i use ariant a600.thanks a lot.
i use DCA-500(COM) Cable,
sincerely yours,
S.Moein.M.J

[moeinm37]

hi:
i use these patches last night,and my phone (S65-SW58)
do not turn on up to now !
http://www.sendspace.com/file/cv62us
even , i use the repair patchs of them :

http://www.sendspace.com/file/hc11b9
but nothing ,
do i use this patch for repairing of my phone (S65) ?
http://www.sendspace.com/file/8glsup
please help me sir ! , i do not know what can i do for my
phone to turn it on !
please send your great and prompt reply to me !
thanks a lot.
sincerely yours,
SMMJ

[saidgoren.com]

how about imei patches???

[yohanson]

Needs flash or patch with MULTYSIM????????
URL PLEASE

[yohanson]

how about imei patches???

Yes how about imei patches???