C139 8.8.17 TracFone

[geohot]

So I was in walmart the other day and saw this phone for $11. I figured I'd pick it up and mess with it. I built a quick serial cable and got it working, but then started reading threads about how these phones can't be unlocked, except with a testpoint and the $350 infinity box. I have done a lot of work with the iPhone and have good reversing skills. I'll post what I've figured out so far; hopefully people can add to this.

@ 57600 baud, only two at commands appear to work
at -- echos OK
at+system=0 -- enter factory mode

The acer tool factory mode commands work, and I can read out the subsidy code, but the firmware is locked to TracFone.

@ 115200 baud, the phone prints "ftmtool" then one second later prints "error" I'm sure this is a flasher interface, but when I google "ftmtool", I get nothing at all.

Does anyone have docs on this phone, or more importantly a flash dump of a 8.8.17 TracFone?

[el_venga]

with acer tool they work like a charm but only reading subsidy codes. u already know about how to do the testpoint, if what u want is a backup of the original 8.8.17 it would be kind a hard without an unlocking box like rockerdongle or infinity so i suggest u get one. i have tryed to make backup with other free tools but no luck, not even with non-tracfone ones. let me know how can i help.

[savantimports]

Is this the George Hotz? I had hoped that some of the expertise being applied to the iPhone problem would cross-over into the realm of GSM unlocking.

Good luck with the C139 a non-soldering solution would be very helpful. Maybe compare the AT&T version...

[rudyandremely]

yes that would be good to unlock this phone with out taking apart the phone cos i have screw up 2 of them the one whit the new pcb 8.8.17. keep trying bro...

[geohot]

If anyone can get a dump of the 8.8.17 bootcore, could you send it to geohot at gmail

[un1x]

i cand send you only a... the COMPLETE FIRMWARE where is locate part of the bootcore you think this help??

[dEnw0h]

you can unlock that using only software depends on flags

if flag = 0 OK
but if flag = 1 u need a testpoint in CPU to unlock

[un1x]

Originally Posted by dEnw0h

you can unlock that using only software depends on flags

if flag = 0 OK
but if flag = 1 u need a testpoint in CPU to unlock

dude.. sorry but TESTPOINT is not needed any more a solutiom come from VICTOR GSM mssbox2 can unlock ANY 8.8.8.17 whit ANY FLAG 1 OR 0 whit testpoint Cpu

[dEnw0h]

TESTPOINT is not needed any more

ANY 8.8.8.17 whit ANY FLAG 1 OR 0 whit testpoint Cpu

wrong explanation!

worst people....

[KMHON]

I have already converted and flash such C139 tracfone unit (v.8.8.8.17) without testpoint, but with new Tracfone NTc139b with same version, i have getting problem, it cannot detect by pc, maybe the bootloader are different, is there anyone succed to flash this Tracfone NTc139b?

[el_venga]

NTC139B is the net10 version i think. as already said MSSBOX2 ODM TOOL is the only one capable skipping testpoint procedure. they dont specify if net10 ones use same method. ill let u know as soon as i can get my hands on one of those.

[mrfixit]

flashing of tracfone c139 ok with mssbox2 which will make it a "normal" gsm phone, but received another new version of c139-tf which dont want to connect into flash mode.

[mrfixit]

Originally Posted by geohot

So I was in walmart the other day and saw this phone for $11. I figured I'd ....

@ 115200 baud, the phone prints "ftmtool" then one second later prints "error" I'm sure this is a flasher interface, but when I google "ftmtool", I get nothing at all.

Does anyone have docs on this phone, or more importantly a flash dump of a 8.8.17 TracFone?

I can send u flash dump from mssbox2 from this one in a short while.

[gsmdoctorca]

http://rapidshare.com/files/96314074...8.17.mofw.html

[mrfixit]

so c139 is done, now we really need this c168i att "fixed" too, another 20 dollar phone