View Full Version : I need code of bootloader for Alcatel BE4
I need code of bootloader for Alcatel BE4 (ARM based processor). I have some ideas to unlock Alcatels by code.
Slawentiy
08-04-2002, 19:56
this not problem! loader have standart structure you can see if you disasm retrofit loader, but if you need some source i can give some sources.
if you need get some data from phone you can use retrofit loaders this easy and have all what you need
10x. What retrofit do you mean? For old Alcatels?
If you have some sources, pls, send it to me.
pavlinb@abv.bg
Slawentiy
08-05-2002, 14:38
all retrofit have loaders (test loaders,init loaders,etc.) see also script files all retrofit based on script files, and you can see what loader put to phone first and what this loaders do!
see careful function for initializing connection (this problem for all alcatel man kho make soft) you can see all what need.
if you need good connection not using comlite log!;) use function to set,write data - this you see on script files too!
if some problems ask i post answers in forum
Henrich SGU
08-07-2002, 03:12
Originally posted by Slawentiy
this not problem! loader have standart structure you can see if you disasm retrofit loader, but if you need some source i can give some sources.
if you need get some data from phone you can use retrofit loaders this easy and have all what you need
Please send me too.
Hello
There are two lodaers exist , boot loader and flasher loader which one you need ? ;)
Boot loader 1 is
"03 88 00 00 20 80 FF 03 00 00 00 00 BF 18 F0 9F E5 14 F0 9F E5 10 F0 9F E5 0C F0 9F E5 08 F0 9F E5 04 F0 9F E5 00 F0 9F E5 04 F0 1F E5 00 00 00 00 04 48 85 46 04 48 01 B4 80 B4 00 F0 07 F8 80 BC 00 BD 00 00 00 10 00 00 14 00 00 02 BF 00 B5 1E 48 1E 49 88 81 00 21 1E 48 81 84 1E 49 01 82 1E 49 81 82 02 8C 1D 4B 1A 40 02 84 82 8C 1B 4B 1A 40 05 23 1B 02 1A 43 82 84 19 4A 02 80 81 80 01 8C 18 4B 19 40 05 23 19 43 01 84 81 8C BF 15 4B 19 40 05 23 19 43 81 84 14 48 14 49 08 82 14 48 01 8E 14 4B 19 40 08 23 19 43 01 86 01 8E E0 23 19 40 40 29 FA D1 04 21 10 48 01 80 01 7E 0F 4B 19 40 C9 10 01 29 F9 D0 00 BD FF FF 00 00 B3 00 00 00 80 00 00 00 8C 01 88 00 00 01 C8 00 00 FF F0 00 00 51 C8 00 00 F0 FF 00 00 FF AF 00 00 40 03 40 00 40 00 40 00 E3 FF 00 00 00 00 00 90 08 00 FF FF 03 00 00 00 24 C0"
Boot loader 2 is
boot2 = "03 00 00 00 00 BF 18 F0 9F E5 14 F0 9F E5 10 F0 9F E5 0C F0 9F E5 08 F0 9F E5 04 F0 9F E5 00 F0 9F E5 04 F0 1F E5 00 00 00 00 04 48 85 46 04 48 01 B4 80 B4 00 F0 1F F8 80 BC 00 BD 00 00 00 10 00 00 14 00 00 02 BF 01 B5 AA 22 08 4B C1 18 4A 85 55 22 07 4B C3 18 9A 82 90 22 4A 85 41 88 09 04 02 88 89 18 FF 22 02 80 08 1C 01 B0 00 BD 80 AA 00 00 40 55 00 00 F0 B5 31 48 31 49 88 81 31 48 85 8C 04 8C 31 4E BF 86 83 2F 48 01 8C 09 06 09 0E 03 23 9B 03 19 43 01 84 81 8C 09 06 09 0E 01 23 9B 03 19 43 81 84 07 20 80 05 FF F7 CC FF 07 1C 25 48 06 83 06 1C 00 8C 00 06 00 0E 03 23 1B 03 18 43 30 84 B0 8C BF 00 06 00 0E 01 23 1B 03 18 43 B0 84 07 20 80 05 FF F7 B6 FF 34 84 B5 84 39 06 09 0E FF 22 12 04 3A 40 12 0A 11 43 0F 1C 01 06 09 0E FF 23 1B 04 18 40 00 0A 08 43 00 04 38 43 13 49 08 60 B0 8C BF 00 05 00 0D B0 48 11 48 01 88 01 23 1B 03 19 43 01 80 0F 48 01 88 01 23 1B 03 19 43 01 80 0D 48 0D 49 08 82 04 21 0D 48 01 80 01 7E 0C 4B 19 40 C9 10 01 29 F9 D0 F0 BD FF FF 00 00 00"
''00 00 80 A3 00 00 00 8C 01 C8 00 00 00 08 00 00 1C 00 00 8C 18 00 00 8C FF AF 00 00 40 03 40 00 00 00 00 90 08 00 FF FF 03 00 00 00 24 C0"
And be4 has 4 flash loaders ... have to check my old project...
hope above info will be a little bit helpful ;)
Slawentiy
08-09-2002, 07:27
man! this problem all kho use comlite;)
you know what you give him?
you give him comlite log;) but him not need this him need source!
if he start disassembling - he see - nothing!!! first need delete
(set pointer,write to ram,run from) after you see only loader! and loader can correct disassembled with ida - loaders very easy for understanding
and for work with alcatel - need one loader;)
in you project you use standart retrofit loaders
1 - initializing phone for work in user mode and prepare phone for cominication
2 - 2 loaders give you only flash ID and manufacturer ID(end reset flash) remember problems with toshiba flash chip;)))
3 - after this you need make choise for loader what can work with you flash chip, and upload this
if you need only read flash or get som data from ram,port,etc - you need only one loader - but you have limit for size of this loader! if you need upload big boot file to phone you need prepare phone for this and allocate you size in memory and upload this boot using you first loader after make jump to you code
Henrich SGU
08-09-2002, 09:30
Yes
I need source code of bootloader.
Which processor type use Alcatel BFx ?
To Slawentiy: It is clear, you are familiar with Alcatel loaders and comunication. If you have some sources, why dont you share with us? I want to make some little program that cam read/write even one byte of flash. If you have some info about address map for BE4, please, post it.
@Henrich SGU
U made FREE SW for BF3 and ask about CPU type????? I cant understand this...
WBR.
Peter
Cool discussion :) I like it :)
Maybe somebody need other sources, loaders etc ? c166 memory map, boot procedure ? Or maybe some general/specific info about ARM ? Or maybe about on-board flash programming ?
Wow... I forgot about main thing - discussion about max232 and self-made cables...
Heh... I think it's time to make money with other way...
I can offer: Remote School of Phone CPU Programmers.
I hope it will be the best way to get a lot of free software, sources etc. over the World for all. Also, free women and some free gifts like T-Shirt and ARM source collection CD.
I'm ready to start: small reasonable price - only usd200 per one day of study. Big discount for big groups of students.
Sorry, I understand, that this offer should be located at "Sale section", but I'll start from here for first time.
Also, if some smart people like this idea - I think this school will need good teachers. So... I can offer good work for unemployed teachers or for anybody who has good experience.
Techers ! I'm waiting for your offers too.
Special offer: Comlite course ! Small price - big advantage !
Henrich SGU
08-10-2002, 14:43
@HFP
I search for ALL infos about this CPU !
Why you ask such poor questions ?
This man use ComLite so not need to know
hardware , just copy - paste 8-)
WBR
Crew
Originally posted by Henrich SGU
@HFP
I search for ALL infos about this CPU !
Hi Slawentiy,
my ICQ is 152702147. Please contact me i have some question for you if you are so kind. I need to read the OTP part of flash serial ID and i need some hint on modifing the boot.
Thanks and regards.................Wray
P.S. The bootloaders are ARM or THUMB assembled ?
MyKy2002
09-18-2002, 00:17
Ha Ha Ha! Slawentiy
You mean...
! ************************************************** ********
loadbin : fl_id.rmi, 0
runwithresult : x[F00]
tempo : 10
setpointer : x[00000F00]
readmem : 1, tstresu
ifequal : tstresu, testok, 1, 0
setpointer : x[00000F04]
readmem : 2, val1
! ****************** Type de F L A S H ***********************
ifequal : val1, amd800b, 2, 1
display : =-=Type=de=FLASH====AM29LV800B
loadbin : dflamd8.rmi, 0
elseif : val1, amd800bd, 2, 1
display : =-=Type=de=FLASH====AM29DL800B
loadbin : dflamd8d.rmi, 0
..............
Originally posted by Slawentiy
man! this problem all kho use comlite;)
you know what you give him?
you give him comlite log;) but him not need this him need source!
if he start disassembling - he see - nothing!!! first need delete
(set pointer,write to ram,run from) after you see only loader! and loader can correct disassembled with ida - loaders very easy for understanding
and for work with alcatel - need one loader;)
in you project you use standart retrofit loaders
1 - initializing phone for work in user mode and prepare phone for cominication
2 - 2 loaders give you only flash ID and manufacturer ID(end reset flash) remember problems with toshiba flash chip;)))
3 - after this you need make choise for loader what can work with you flash chip, and upload this
if you need only read flash or get som data from ram,port,etc - you need only one loader - but you have limit for size of this loader! if you need upload big boot file to phone you need prepare phone for this and allocate you size in memory and upload this boot using you first loader after make jump to you code
Originally posted by Bert
Hello
There are two lodaers exist , boot loader and flasher loader which one you need ? ;)
Boot loader 1 is
"03 88 00".....
.....
And be4 has 4 flash loaders ... have to check my old project...
hope above info will be a little bit helpful ;)
Hi Bert
Explain me what i doing wrong:
1. Open Com Port (9600, 8bit, no parity, one stopbit)
2. Send boot loader
Here is nothing happends... I try to turn off RTS. Phone seems to power on, but also nothing happends. But i think, phone must send $04.
Please help
Hi all.
Can you know address CPU registers for control SPI interface in Alcatel BF3 phone ?
I wand do project for control LCD display in BF3/4 phone, if phone don't switch ON. It will be ARM C & assembler program, that be directly programming SPI interface of BBG.
In Retrofit ftpv155 for BF3 in file scenario.txt is present LAD tests for testing BBG ( NN 80052 - 80062, 80019 - 80033 ). How I need to programming it tests in file menu.txt, that it working ?
Did you manage to start this application (Retrofit ftpv155 for BF3 )? Every time it gives me error at startting...
In Retrofit ftpv155 for BF3 in file scenario.txt is present LAD tests for testing BBG ( NN 80052 - 80062, 80019 - 80033 ). How I need to programming it tests in file menu.txt, that it working ?
@pavlin
1)Are you use Retrofit ftpv155 for BF3 in Windows NT?
2)Are you use Retrofit ftpv155 for BF3 with "cvirte" from LabWindows/CVI National Instruments ?
3)Are you use Retrofit ftpv155 for BF3 with native Alcatel "LTP Serial Driver" ?
Best regards.
Vishay.
1. Yes
2. Yes
3. No, can you give me a link to full Retrofit ftpv155 for BF3?
Regards.
@pavlin
1)Are you use Retrofit ftpv155 for BF3 in Windows NT?
2)Are you use Retrofit ftpv155 for BF3 with "cvirte" from LabWindows/CVI National Instruments ?
3)Are you use Retrofit ftpv155 for BF3 with native Alcatel "LTP Serial Driver" ?
Best regards.
Vishay.
Sorry, I dont know this link.
You can also read about Retrofit BF3 installing in this forum in:
http://forum.gsmhosting.com/vbb/showthread.php?t=49889&highlight=LTE
Please send to me bootloader. Thanks
okinen@seznam.cz