5210 flashing problems - GSM-Forum

Eerchant · 02-27-2002, 22:57

Hi Rango and X-Shadow and others...

Yes...there is problem with small part of flash inside 5210 (003F0000-003FFFF) because it is using new flash type (008988C4/Intel 28F3204C3-T) - it is last 65 Kb block of first 2 MB....and i think problem is with erasing that block - cause i do this things:

When phone live (

) it was 5210 5.13 PPM D (i do not want to change it...only want to experiment and be ready for other phones and potencial sw upgrades)

I download fullflash from it - and compare with flash i have originaly from Wintesla(converted to bin) - flash was 100% the some(except PMM and EEPROM zone of course) - so i was happy that i have correct backup....

I try to flash it with the some flash(mcu+ppm only) and phone not run....i download fullflash again and see problem in area 003F0000-003FFFF...now only trying to get correct boot.bin and f_loader and correct settings for small dejan to flash that crypled end 65 Kb of first 2 MB...no success...and it is really upseting me....so X-Shadow...if you can send me right:

- Dejan small settings (6506 or 6508)
- f_loader.bin+boot.bin (but realy working)

i would be wery grateful to you or some other who break this "last" DCT-3 nokia on the market...if not...phone go to service centre and will be without any problem flashed on Wintesla and will work again.....but we all will not be ready to change MCU version inside our 5210 - only PPM parts...

Regards Eerchant

Lead · 02-28-2002, 01:52

Finally, I know what they did!
They inverted the highest address bit leading to the flash chip. The usual block structure of the 8988C4 (4MB top-boot flash) is as follows:

63 blocks of size 64KB
and then 8 blocks, each of 8KB.

But now, by inverting the MSB, we get:

31 blocks of 64KB,
8 blocks of 8KB,
and 32 blocks of 64KB.

The old loader (6244) naturally can not take into account this block configuration. One way is to disassemble that loader, find the flash erasing part and change the block addressing code so that it would invert the MSB of the block address before executing the block erase command.

I would like to ask someone to disassemble the loader and change it in the way I described. I would do that but I am really busy with another, more important, things. BTW, IN FUTURE THIS MAY HAPPEN ALSO TO PHONES THAT CURRENTLY DO NOT SUFFER FROM THIS PROBLEM... They have absolutely no problem with inverting the MSB of the address bus in whatever phone they wish.

Best regards, Lead.

Cables · 02-28-2002, 02:30

The simple flasher is using a 'Patch' loader for reading/flashing,
some new DCT-3 phone (e.g. 3350, 5210) won't be flashed
correctly by this kind of 'Patch' loader (resulting cannot power-on).
It can be fixed very easy by using WinDLS, it is using the
original flash loader, so there is no problem for MCU & PPM
(firmware) upgrading/downgrading, but you need a Dejan Box
for working with WinDLS !!!

Cables

Lead · 02-28-2002, 02:59

I don't think it is caused by using a wrongly patched f_loader...

Cables · 02-28-2002, 03:23

I have tried before I read the MCU+PPM range from a 5210 then
rewrite it back, the phone cannot be power on.
When I use that MCU+PPM and generate MCU & PPM files by
Dejan v105 and flash the 5210, the phone can power on again.
I got same problems before on some 3330 and 3350.
Everythings are OK when I am using Dejan v1.05 (or v1.04) with
Dejan format MCU+PPM and WinDLS by original Wintesla files,
both of them are using original Flash Loader (Flash Loader in
WinDLS is compiled in the EXE and Dejan is using the re-named
Flash Loader from Wintesla *.tia).
So, I guess the problem is on the Flash Loader !!

Cables

Demon_Ok · 02-28-2002, 03:34

Hi All.
Try use KNOK flasher, this programm use original f_loader files.
Only change file "models.cfg"

Lead · 02-28-2002, 03:53

The problem is in the flash loader, because it can't support the changed block architecture of the flash chip...

Probably new wintesla loaders could help.

rango · 02-28-2002, 09:16

Yes, Lead you are right!

I described this problem long time ago, also killed my phone

But I think Lead is right, there is definetly a problem with a flash loader and don't you think that I didn't tried original loaders from Dejan 1.05 and KNOK with cfg settings 65 06 and 65 08. Noting didn't worked...

Cables: I don't know how you managed to restore you phone, troght is that I didnt tried with Dejan 1.05 Box and WinDLS but I used same f_loaders...

So the problem is with erasing, when you erase flash with KNOK data still remaing in 3F20000-3FFFFFF, I think that Lead is on a good way to figure it out why...

Shame is that I'm not such a good programer that coud disemble f_loader and write new one, I will just have to wait someone to do that and be so kind to pass to everione...

Thanx

Lead · 02-28-2002, 09:29

The loader sends to the phone a command to erase the block at the address 3F0000, which would normally be a 64KB block, but in the case of 5210 with inverted MSB, at the address 3F0000, there is a block of size 8KB, therefore the area 3F2000-400000 remains untouched and only the range 3F0000-3F2000 will be erased.

Lead · 02-28-2002, 09:43

Anyway, one could try erasing the flash manually, block-after-block. For this reason use kNok. Erase the areas in this order:[list=1][*]200000-3F0000[*]3F0000-3F2000[*]3F2000-3F4000[*]3F4000-3F6000[*]3F6000-3F8000[*]3F8000-3FA000[*]3FA000-3FC000[*]3FC000-3FE000[*]3FE000-400000[*]400000-600000[/list=1]
Then write the backup flash without erasing - it could probably work.

Best regards, Lead.

X-Shadow · 03-04-2002, 17:32

Hello Lead,

I tried your theory using Knok 1.8... Here are the results:

Erasing: 200000-3F0000 ---> Success
Erasing: 3F0000-3F2000 ---> Success
Erasing: 3F2000-3F4000 ---> Error
Erasing: 3F0000-3F2000 ---> Error
Erasing: 3F2000-3F4000 ---> Error
Erasing: 3F4000-3F6000 ---> Error
Erasing: 3F6000-3F8000 ---> Error
Erasing: 3F8000-3FA000 ---> Error
Erasing: 3FA000-3FC000 ---> Error
Erasing: 3FC000-3FE000 ---> Error
Erasing: 3FE000-400000 ---> Error
Erasing: 400000-600000 ---> Success

SeEbOy · 03-04-2002, 23:48

i do it by my silf
u have to ereaset by JIC neelix then flash it by work shop

our red full flash from 20000 to 60000 by nokia flash tool
then writ by nokia flash tool it well tack 78 sec to eraes when it finesh eraesin remove the cabel befor writing then flash it by dct3 work shop

best regard

Cables · 03-05-2002, 00:12

Why do it so complicated !!! Just using the WinDLS + Wintesla
flash file and Dejan Dongle, 100% working.
No way to do it by Simple classic flasher, the phone will not power
up after the flashing (but you can restore your phone by full
backup), you cannot partial (MCU+PPM) flash your phone only,
I 100% sure this is the patched flash loader problem !!!!

Cables

X-Shadow · 03-05-2002, 00:57

To Cables,

Maybe your 5210 is not using C4 flash Chip... Because I personally
destroyed my friend's brand new 5210 for the sake of research!
I upgraded his phone using WinDLS 2.0 + Original 5210 Wintesla
files from Nokia site. Now phone is dead (as I expected).

Best Regards,
X-Shadow

xpmobile · 03-05-2002, 01:07

Hi X-Shadow,

You have used the windls 2.0 that can kill a phone regardless of any model. I had tried to upgrade the phone with it... but its just erase the eeprom area for my 8250 and 3310. That version can kill all phone after 1-2 days usage. But how ever.. i was lucky to have a backup for the eeprom and manage to safe my phone from the damage.

Regards
Alan

02-27-2002, 22:57	#1 (permalink)
Eerchant No Life Poster Join Date: Sep 2000 Location: Czech Republic Posts: 829 Member: 1993 Status: Offline Thanks Meter: 94	5210 flashing problems Hi Rango and X-Shadow and others... Yes...there is problem with small part of flash inside 5210 (003F0000-003FFFF) because it is using new flash type (008988C4/Intel 28F3204C3-T) - it is last 65 Kb block of first 2 MB....and i think problem is with erasing that block - cause i do this things: When phone live ( ) it was 5210 5.13 PPM D (i do not want to change it...only want to experiment and be ready for other phones and potencial sw upgrades) I download fullflash from it - and compare with flash i have originaly from Wintesla(converted to bin) - flash was 100% the some(except PMM and EEPROM zone of course) - so i was happy that i have correct backup.... I try to flash it with the some flash(mcu+ppm only) and phone not run....i download fullflash again and see problem in area 003F0000-003FFFF...now only trying to get correct boot.bin and f_loader and correct settings for small dejan to flash that crypled end 65 Kb of first 2 MB...no success...and it is really upseting me....so X-Shadow...if you can send me right: - Dejan small settings (6506 or 6508) - f_loader.bin+boot.bin (but realy working) i would be wery grateful to you or some other who break this "last" DCT-3 nokia on the market...if not...phone go to service centre and will be without any problem flashed on Wintesla and will work again.....but we all will not be ready to change MCU version inside our 5210 - only PPM parts... Regards Eerchant

03-04-2002, 23:48	#12 (permalink)
SeEbOy Freak Poster Join Date: Nov 2001 Location: SAUDI ARABIA Posts: 255 Member: 7530 Status: Offline Thanks Meter: 2	100% working by JIC box i do it by my silf u have to ereaset by JIC neelix then flash it by work shop our red full flash from 20000 to 60000 by nokia flash tool then writ by nokia flash tool it well tack 78 sec to eraes when it finesh eraesin remove the cabel befor writing then flash it by dct3 work shop best regard

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
5210 flash problem HELP	kreten	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	0	11-07-2004 21:13
5210 flash problem	b2k	Nokia Hardware & Hardware Repair	2	05-01-2004 09:35
5210 flashing problem	prezgivah	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	12	10-25-2002 15:58
5210 network problems	trafix	Nokia Hardware & Hardware Repair	0	10-19-2002 22:43
5210 New Problem...	JammerOne	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	3	06-13-2002 19:24

02-28-2002, 01:52	#2 (permalink)
Lead No Life Poster Join Date: Aug 2008 Age: 52 Posts: 3,292 Member: 1841 Status: Offline Thanks Meter: 469	Finally, I know what they did! They inverted the highest address bit leading to the flash chip. The usual block structure of the 8988C4 (4MB top-boot flash) is as follows: 63 blocks of size 64KB and then 8 blocks, each of 8KB. But now, by inverting the MSB, we get: 31 blocks of 64KB, 8 blocks of 8KB, and 32 blocks of 64KB. The old loader (6244) naturally can not take into account this block configuration. One way is to disassemble that loader, find the flash erasing part and change the block addressing code so that it would invert the MSB of the block address before executing the block erase command. I would like to ask someone to disassemble the loader and change it in the way I described. I would do that but I am really busy with another, more important, things. BTW, IN FUTURE THIS MAY HAPPEN ALSO TO PHONES THAT CURRENTLY DO NOT SUFFER FROM THIS PROBLEM... They have absolutely no problem with inverting the MSB of the address bus in whatever phone they wish. Best regards, Lead.

02-28-2002, 02:30	#3 (permalink)
Cables Freak Poster Join Date: Dec 2001 Location: Hong Kong, China Posts: 329 Member: 7866 Status: Offline Thanks Meter: 4	The simple flasher is using a 'Patch' loader for reading/flashing, some new DCT-3 phone (e.g. 3350, 5210) won't be flashed correctly by this kind of 'Patch' loader (resulting cannot power-on). It can be fixed very easy by using WinDLS, it is using the original flash loader, so there is no problem for MCU & PPM (firmware) upgrading/downgrading, but you need a Dejan Box for working with WinDLS !!! Cables

02-28-2002, 02:59	#4 (permalink)
Lead No Life Poster Join Date: Aug 2008 Age: 52 Posts: 3,292 Member: 1841 Status: Offline Thanks Meter: 469	I don't think it is caused by using a wrongly patched f_loader...

02-28-2002, 03:23	#5 (permalink)
Cables Freak Poster Join Date: Dec 2001 Location: Hong Kong, China Posts: 329 Member: 7866 Status: Offline Thanks Meter: 4	I have tried before I read the MCU+PPM range from a 5210 then rewrite it back, the phone cannot be power on. When I use that MCU+PPM and generate MCU & PPM files by Dejan v105 and flash the 5210, the phone can power on again. I got same problems before on some 3330 and 3350. Everythings are OK when I am using Dejan v1.05 (or v1.04) with Dejan format MCU+PPM and WinDLS by original Wintesla files, both of them are using original Flash Loader (Flash Loader in WinDLS is compiled in the EXE and Dejan is using the re-named Flash Loader from Wintesla *.tia). So, I guess the problem is on the Flash Loader !! Cables

02-28-2002, 03:34	#6 (permalink)
Demon_Ok No Life Poster Join Date: Mar 2001 Location: Kazakhstan Age: 48 Posts: 522 Member: 3528 Status: Offline Thanks Meter: 5	Hi All. Try use KNOK flasher, this programm use original f_loader files. Only change file "models.cfg"

02-28-2002, 03:53	#7 (permalink)
Lead No Life Poster Join Date: Aug 2008 Age: 52 Posts: 3,292 Member: 1841 Status: Offline Thanks Meter: 469	The problem is in the flash loader, because it can't support the changed block architecture of the flash chip... Probably new wintesla loaders could help.

02-28-2002, 09:16	#8 (permalink)
rango Freak Poster Join Date: Dec 2000 Location: Belgrade, Serbia Age: 44 Posts: 238 Member: 2768 Status: Offline Thanks Meter: 12	Yes, Lead you are right! I described this problem long time ago, also killed my phone But I think Lead is right, there is definetly a problem with a flash loader and don't you think that I didn't tried original loaders from Dejan 1.05 and KNOK with cfg settings 65 06 and 65 08. Noting didn't worked... Cables: I don't know how you managed to restore you phone, troght is that I didnt tried with Dejan 1.05 Box and WinDLS but I used same f_loaders... So the problem is with erasing, when you erase flash with KNOK data still remaing in 3F20000-3FFFFFF, I think that Lead is on a good way to figure it out why... Shame is that I'm not such a good programer that coud disemble f_loader and write new one, I will just have to wait someone to do that and be so kind to pass to everione... Thanx

02-28-2002, 09:29	#9 (permalink)
Lead No Life Poster Join Date: Aug 2008 Age: 52 Posts: 3,292 Member: 1841 Status: Offline Thanks Meter: 469	The loader sends to the phone a command to erase the block at the address 3F0000, which would normally be a 64KB block, but in the case of 5210 with inverted MSB, at the address 3F0000, there is a block of size 8KB, therefore the area 3F2000-400000 remains untouched and only the range 3F0000-3F2000 will be erased.

02-28-2002, 09:43	#10 (permalink)
Lead No Life Poster Join Date: Aug 2008 Age: 52 Posts: 3,292 Member: 1841 Status: Offline Thanks Meter: 469	Anyway, one could try erasing the flash manually, block-after-block. For this reason use kNok. Erase the areas in this order:[list=1][]200000-3F0000[]3F0000-3F2000[]3F2000-3F4000[]3F4000-3F6000[]3F6000-3F8000[]3F8000-3FA000[]3FA000-3FC000[]3FC000-3FE000[]3FE000-400000[]400000-600000[/list=1] Then write the backup flash without erasing - it could probably work. Best regards, Lead.

03-04-2002, 17:32	#11 (permalink)
X-Shadow No Life Poster Join Date: Jan 2000 Location: GSM Forum Posts: 1,108 Member: 871 Status: Offline Thanks Meter: 602	Hello Lead, I tried your theory using Knok 1.8... Here are the results: Erasing: 200000-3F0000 ---> Success Erasing: 3F0000-3F2000 ---> Success Erasing: 3F2000-3F4000 ---> Error Erasing: 3F0000-3F2000 ---> Error Erasing: 3F2000-3F4000 ---> Error Erasing: 3F4000-3F6000 ---> Error Erasing: 3F6000-3F8000 ---> Error Erasing: 3F8000-3FA000 ---> Error Erasing: 3FA000-3FC000 ---> Error Erasing: 3FC000-3FE000 ---> Error Erasing: 3FE000-400000 ---> Error Erasing: 400000-600000 ---> Success

03-05-2002, 00:12	#13 (permalink)
Cables Freak Poster Join Date: Dec 2001 Location: Hong Kong, China Posts: 329 Member: 7866 Status: Offline Thanks Meter: 4	Why do it so complicated !!! Just using the WinDLS + Wintesla flash file and Dejan Dongle, 100% working. No way to do it by Simple classic flasher, the phone will not power up after the flashing (but you can restore your phone by full backup), you cannot partial (MCU+PPM) flash your phone only, I 100% sure this is the patched flash loader problem !!!! Cables

03-05-2002, 00:57	#14 (permalink)
X-Shadow No Life Poster Join Date: Jan 2000 Location: GSM Forum Posts: 1,108 Member: 871 Status: Offline Thanks Meter: 602	To Cables, Maybe your 5210 is not using C4 flash Chip... Because I personally destroyed my friend's brand new 5210 for the sake of research! I upgraded his phone using WinDLS 2.0 + Original 5210 Wintesla files from Nokia site. Now phone is dead (as I expected). Best Regards, X-Shadow

03-05-2002, 01:07	#15 (permalink)
xpmobile No Life Poster Join Date: Nov 2001 Location: China GuangDong Posts: 1,673 Member: 7220 Status: Offline Thanks Meter: 1,592	Hi X-Shadow, You have used the windls 2.0 that can kill a phone regardless of any model. I had tried to upgrade the phone with it... but its just erase the eeprom area for my 8250 and 3310. That version can kill all phone after 1-2 days usage. But how ever.. i was lucky to have a backup for the eeprom and manage to safe my phone from the damage. Regards Alan