BB5 - Technical Discussion
 

! PLASE DON'T POST HERE ANY USELESS INFORMATION ABOU FAKE UNLOCK SOLUTIONS !

What is BB5 ? It new platform what Nokia Mobile Phones use in new products. After review it looks similar to WD2 platform(ex. 6600). It can't work without operation system. Heart of BB5 is main procssor "RAP3G". This name is codename used by Nokia to describe very good Texas Instrument integrtaed prcosseor developed for mobile solutions. It's new technolgy OMAP 1710(up to 220 MhZ). Here you can view infmation at Texas Instrument about this platform:

-> http://focus.ti.com/general/docs/wtb...data/omap_1710

Another link goes to documenation of "Innovator Development Kit" very similar to Nokia 6630 ;)

-> http://www-s.ti.com/sc/psheets/spru667/spru667.pdf

For this Kit is avaible good descripted JTAG(shuld work also with BB5) and Flasher via USB. Algoritms must be very similar !

Here you can download 60 days evaluation Code Composer v2:

-> https://focus.ti.com/general/docs/re...sp?regAppId=97

This is software what Nokia Mobile Phones used to develope software for Nokia BB5 Platform ! It's include Compiler, Linker, Debuger etc.

Fot today that's all. I hope that I'm not stay alone in this topic. We waiting for other useful information. Also I will post tomorrow next part of information ;)

Good luck

MobileTech Team,
Poland

Bb 5.0
 

I Think you have some wrong info,The RAP3G Processor is Very Similer To The Previous UPP2WD and its Handling The CMT Side Of The Phone and the Second Processor is OMAP 1710 Witch Handling The APE Side OF The Phone.
The Power MAnagment Ic's (UEM) Now Splited into Two Parts (Tahvo) and (Retu) its very Integrated Asic Devloped By Nokia.

Hope This info is good For All.

and here some more infos...

Thnx Doe ... & adihack...
 

...was impressed by the info. u posted regarding the RAP3G Processor. Was wondering if you have any other helpful info. on other Nk IC i.e. UPP, UEM, RAM, FLASH, HAGAR, MJOLNER, etc.
Anywhere could obtain photos from Mnf. ?
Regards,
Xprts

here some info's about RETU...

And few hints on BB5 Certificate structure :D




So. let's rock and roll



Regards


Commselect Inc.

This is a DUAL ENGINE PHONE with two processor one for EPOC and one for NOS. Both operating systems are physically seperated on different cores. NOS is now totally focused on the cellular modem activites and EPOC is totally focussed to user activities. The old series 60 was a single engine with the above points being shared.

BB5 security.

Most of the vital terminal/phone information such as locks, customisation etc have been encrypted/signed using a private key before downloading to the phone. This happens in the production phase.

If the information is is changed (ie lock status) the phone will recognise this and will not switch on.

The security system of the phone will apply a reset to the phone after 3 minutes if the security certificate is missing. If the certificate becomes corrupted the phone will reset every 30 seconds.

P.S. Anybody out there an ace repairer i wish to swap tricks and tips with them on things like fixing sysol samsung with key press faults and wd2/series 60 nokias that have signal failures

very interesting information thanks
regards loneunlocker:D

Could you give some infos from which document the screenshots are? Is the document available somwhere?

Since after presentation of correct unlock password the phone writes new simlock data the "Nokia Private Key" must be inside the phone. E.g. in RAP3G ?!?

Who can reverse engineer and read out RAP3G?

The 3g Radio Application Processor (RAP3G) replaced the TIKU. This chip looks like it has no memory at all. It is a processor so i dont think this would contain any data german gsm team.
I can tell you its also not the RETU, TAHVO.

I think what we are looking for is a security certificate that is encrypted using an external key at the nokia flash centres. I do not know how security certificates work but i can imagine they are not disimilar to the types of security used by microsoft when signing certificates for websites. So basically this will be a purely software unlock. Now if you manage to open sp lock etc ,the certificate will not match and hence wont work. If you change the certificate in any way without using the encoding hardware key found at nokia centres then the phone wont work due to corrupt certificate.

What you "could" do is re-write parts of the operating system to stop it ever looking for the security in the first place maybe. This would involve rewriting part of the series 60 OS. So getting past the lock is the easy bit , getting the phone to work afterwards will be what people like dejan are struggling to do.

I'm learnig quit abit here guys please keep it uP :-)

from my own exprince RPA3G got imei and unlock algo sotred inside

Actually better look on structure of BB5 architecure :)





Best regards



Commselect Inc.

Not that fast...

PerformAuth ; CODE XREF: load_algo+D2p
BX PC ; Thumb to Arm switch
NOP
LDR R12, =0x3F6D ; boot addr
BX R12
; End of function PerformAuth

---