Flash File Format, Info/Reference

[Ice Dragon]

I'm posting here what I found out about the Flash file we read from our phone. I hope this will help our members when doing their research and encourage others to post their findings too in the spirit of open source development/research.

Here's what I found out initially (using a 6210v301C):

PPM Checksums Algorithm<br />by Ron Jagar<br />member:Ice Dragon Ally<br />July 2001

<br />Conventions used in this document:

Strings are enclosed in {} or " "

Hex values begin with "x" like in x02E5

Null-terminated strings are indicated by StrZ at<br />end of identifier.

base32(PPM1) returns a 32bit value like x00320000

offset(MCUChecksum) returns a 32bit value like x00000022

word(MCUChecksum) returns a 16bit value like x02E5

dword(FlashChecksum) returns a 32bit value like x35A003CC

24bit(StartMCU) returns a 24bit value like x200024

Underscore between hex means "to" like in x002C_x002F,<br />it means values from x002C to x002F.

2-digit numbers found at end of identifiers (like the 16 in Chksum16)<br />denotes value type (Chksum16 is a 16bit value like x02E5)

Chksum16 is a 16bit checksum obtained by adding 16bit values.<br />Example: <br />Offset Word<br />x320034 x1234 <br />x320036 x1122<br />Chksum16 x2356

Chksum32 is a 32bit checksum obtained by adding 32bit values.<br />Example: <br />Offset DWord<br />x320034 x12345678<br />x320038 x11223344<br />Chksum32 x234589BC

Searching for PPM Block checksums:

PPM1: <br />Set base32=x00320000

or use search string {xFFFF,"PPM",x00}. <br />base32=offset({xFFFF,"PPM",x00})+2

BOPPM1...........base32<br />Chksum32.........dword(base32+x002C_x002F)<br />PPMLeng***2......dword(base32+x0030_x0033)<br />BChkSum32........offset(Chksum32)<br />EChkSum32........BChkSum32+PPMLeng***2<br />EOPPM1...........EChkSum32

<br />Set PPMx.........PPM1<br />Set EOPPMx.......EOPPM1

PPMx:

Set PPMBlockEndString={x0000,x0000,x0000,x0010,x0000,x 0000,x0000,x0000}

base32=EOPPMx+1

or use PPMBlockEndString after base32(PPMx)<br />base32=offset(PPMBlockEndString)+16

If dword(base32)=x00000000 then <br /> end PPM block search<br />Else<br /> BOPPMx........base32<br /> Chksum32......dword(base32)<br /> PPMLeng***2...dword(base32+4)<br /> BChkSum32.....offset(Chksum32)<br /> EChkSum32.....BChkSum32+PPMLeng***2<br /> EOPPMx........EChkSum32<br />EndIf

Loop to PPMx until PPM block search ends

PPM Blocks:<br />PPM1.............PPM Version<br />PPM2.............GSM Code Version<br />PPM3.............Fonts<br />PPM4.............Language Text Version<br />PPM5.............Language Array Order/Index<br />PPM6.............Tone Version<br />PPM7.............Mobile Network Codes<br />PPM8.............Language Packs

<br />PPM1 Block contents: *PPM Version<br />(Note, null-terminated strings are indicated by StrZ at<br />end of identifier)<br />base32..............offset(PPM1)<br />PPMHeaderStrZ.......(base32)_(base32+3)<br />PPMVerStrZ..........(base32+4)_(base32+35)<br />Reserve1............(base32+36)_(base32+39) {xFFFF,xFF00}<br />PPMPackStrZ.........(base32+40)_(base32+41)<br />Reserve2............(base32+42)_(base32+43) {xFFFF}<br />Chksum32............(base32+44)_(base32+47)<br />PPMLeng***2.........(base32+48)_(base32+51) *Starting from offset(Chksum32)<br />LangPackVerStrZ.....(base32+42)_(base32+63)<br />BOSectUnk1..........(base32+63)_(base32+67) {x0000,x0001}<br />SectionLeng***2.....(base32+68)_(base32+71) *Starting from offset(BOSectUnk1)<br />Unk2Str.............(base32+72)_(base32+75) *In 6210v301C "A13C"<br />SectionContents.....(base32+76)_(offset(BOSectUnk 1)+SectionLeng***2)<br />EOSection...........(base32+76)+(offset(BOSectUnk 1)+SectionLeng***2)<br />PPMBlockEndString...(offset(EOSection)+1)_((offse t(EOSection)+1)+16)

<br />PPM2 Block contents: *GSM Code version<br />base32..............offset(PPM2)<br />Chksum32............(base32)_(base32+3)<br />PPMLeng***2.........(base32+4)_(base32+7) *Starting from offset(Chksum32)<br />GSMCodeVerStrZ......(base32+8)_(base32+19)<br />BOSectUnk1..........(base32+20)_(base32+23) {x0000,x0001}<br />SectionLeng***2.....(base32+24)_(base32+27) *Starting from offset(BOSectUnk1)<br />Unk2Str.............(base32+28)_(base32+31) *In 6210v301C "A13C"<br />SectionContents.....(base32+32)_(offset(BOSectUnk 1)+SectionLeng***2)<br />EOSection...........(base32+32)+(offset(BOSectUnk 1)+SectionLeng***2)<br />PPMBlockEndString...(offset(EOSection)+1)_((offse t(EOSection)+1)+16)

<br />PPM3 Block contents: *Fonts<br />base32..............offset(PPM3)<br />Chksum32............(base32)_(base32+3)<br />PPMLeng***2.........(base32+4)_(base32+7) *Starting from offset(Chksum32)<br />FontStrZ............(base32+8)_(base32+19)<br />BOSectUnk1..........(base32+20)_(base32+23) {x0000,x0001}<br />SectionLeng***2.....(base32+24)_(base32+27) *Starting from offset(BOSectUnk1)<br />Unk2Str.............(base32+28)_(base32+31) {x0000,x0000} <br />SectionContents.....(base32+32)_(offset(BOSectUnk 1)+SectionLeng***2)<br />EOSection...........(base32+32)+(offset(BOSectUnk 1)+SectionLeng***2)<br />PPMBlockEndString...(offset(EOSection)+1)_((offse t(EOSection)+1)+16)

<br />PPM4 Block contents: *Language Text Version<br />base32..............offset(PPM4)<br />Chksum32............(base32)_(base32+3)<br />PPMLeng***2.........(base32+4)_(base32+7) *Starting from offset(Chksum32)<br />TextVerStrZ.........(base32+8)_(base32+19)

Set EOSectx.........(base32+20)

PPM4Sections:<br />BOSectx.............(EOSectx)<br />If word(BOSectx)=(x0000) then <br /> *Check for PPMBlockEndString<br /> If found(PPMBlockEndString) then PPM4 Block ends<br />Else<br /> If word(BOSectx)=(xFFFF) then<br /> EOSectx=EOSectx+2<br /> Loop to PPM4Sections<br /> EndIf<br />EndIf<br />LangIndex...........(BOSectx)_(BOSectx+3) *See notes after this block<br />SectxLen32..........(BOSectx+4)_(BOSectx+7) *Starting from BOSectx<br />LangCode............(BOSectx+8)_(BOSectx+11) *See notes after this block<br />SectxContents.......(BOSectx+12)_(BOSectx+SectxLe n32)<br />EOSectx.............(BOSectx+12)+(BOSectx+SectxLe n32)

Loop to PPM4Sections until PPMBlockEndString is encountered

Notes:<br />LangIndex........LangCode<br />x0000,x0033......COMM<br />x0000,x0002......GERM<br />x0000,x0001......ENGL<br />x0000,x000D......TURK <br />x0000,x0005......SPAN <br />x0000,x0003......FREN

<br />P.S. <br />This is only up to PPM4, others still to come <img src="smile.gif" border="0"> <br />If you find this topic interesting or may have helped you, will you rate me? <img src="smile.gif" border="0">

[ 30 August 2001: Message edited by: Ice Dragon ]</p>