GSM Shop GSM Shop
GSM-Forum  

Welcome to the GSM-Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features.
Only registered members may post questions, contact other members or search our database of over 8 million posts.

Registration is fast, simple and absolutely free so please - Click to REGISTER!

If you have any problems with the registration process or your account login, please contact contact us .

Go Back   GSM-Forum > GSM & CDMA Phones / Tablets Software & Hardware Area > Nokia > Nokia Base Band 5 ( BB-5 )

Nokia Base Band 5 ( BB-5 ) Baseband-5 Phones: 2700 Classic , 2730 Classic , 3109c , 3110c , 3120c , 3250 , 3500c , 3600s , 3610 Fold , 3710 Fold , 3720 Classic , 5130 XpressM , 5200 / 5200b , 5220 XpressM , 5230 XpressM , 5300 / 5300b , 5310 / 5310b , 5320 , 5500 , 5530 XpressM , 5610 , 5630 XpressM , 5700 , 5730 XpressM , 5800 , 6085 / 6086 , 6110n , 6120c , 6121c , 6124c , 6125 , 6126 / 6133b , 6131 / 6133 , 6131 (NFC) , 6136 , 6151 , 6208 Classic , 6210n , 6212c , 6220c , 6233 , 6234 , 6260 Slide , 6263 , 6267 , 6270 , 6280 / 6288 , 6282 , 6290 , 6300 , 6300i , 6301 , 6303 Classic , 6500 Classic , 6500 Slide , 6555 , 6600 Fold , 6600 Slide , 6630 , 6650 Fold , 6680 , 6681 , 6682 , 6700 Classic , 6710 Navigator , 6720 Classic , 6730 Classic , 6760 Slide , 6790 Surge , 7210c , 7310c , 7370 , 7373 , 7390 , 7500 , 7510c , 7610c , 7900 , 8600 , 8800 arte , E50 , E51 , E52 , E55 , E60 , E61 , E61i , E62 , E63 , E65 , E66 , E70 , E71 , E72 , E75 , E90 , N70 , N71 , N72 , N73 , N75 , N76 , N77 , N78 , N79 , N80 , N81 , N82 , N85 , N86 , N90 , N91 , N92 , N93 , N93i , N95 , N95 8GB , N96 , N97 , N97 Mini , X3 , X6

Reply
 
LinkBack Thread Tools Display Modes
Old 06-27-2005, 23:58   #1 (permalink)
Freak Poster
 
Join Date: May 2003
Location: Poland
Age: 31
Posts: 233
Member: 29897
Status: Offline
Thanks Meter: 3
BB5 - Technical Discussion


! PLASE DON'T POST HERE ANY USELESS INFORMATION ABOU FAKE UNLOCK SOLUTIONS !

What is BB5 ? It new platform what Nokia Mobile Phones use in new products. After review it looks similar to WD2 platform(ex. 6600). It can't work without operation system. Heart of BB5 is main procssor "RAP3G". This name is codename used by Nokia to describe very good Texas Instrument integrtaed prcosseor developed for mobile solutions. It's new technolgy OMAP 1710(up to 220 MhZ). Here you can view infmation at Texas Instrument about this platform:

-> http://focus.ti.com/general/docs/wtb...data/omap_1710

Another link goes to documenation of "Innovator Development Kit" very similar to Nokia 6630

-> http://www-s.ti.com/sc/psheets/spru667/spru667.pdf

For this Kit is avaible good descripted JTAG(shuld work also with BB5) and Flasher via USB. Algoritms must be very similar !

Here you can download 60 days evaluation Code Composer v2:

-> https://focus.ti.com/general/docs/re...sp?regAppId=97

This is software what Nokia Mobile Phones used to develope software for Nokia BB5 Platform ! It's include Compiler, Linker, Debuger etc.

Fot today that's all. I hope that I'm not stay alone in this topic. We waiting for other useful information. Also I will post tomorrow next part of information

Good luck

MobileTech Team,
Poland
  Reply With Quote
The Following User Says Thank You to adihack For This Useful Post:
Old 06-28-2005, 12:48   #2 (permalink)
Freak Poster
 
Join Date: Sep 2001
Location: Syria
Posts: 107
Member: 6475
Status: Offline
Thanks Meter: 1
Bb 5.0

I Think you have some wrong info,The RAP3G Processor is Very Similer To The Previous UPP2WD and its Handling The CMT Side Of The Phone and the Second Processor is OMAP 1710 Witch Handling The APE Side OF The Phone.
The Power MAnagment Ic's (UEM) Now Splited into Two Parts (Tahvo) and (Retu) its very Integrated Asic Devloped By Nokia.

Hope This info is good For All.
  Reply With Quote
The Following User Says Thank You to Mohanad For This Useful Post:
Old 06-28-2005, 15:09   #3 (permalink)
No Life Poster
 
John_Doe's Avatar
 
Join Date: Aug 2000
Location: anywhere
Posts: 596
Member: 1879
Status: Offline
Sonork: 100.28016
Thanks Meter: 941
and here some more infos...
Attached Images
File Type: jpg rapinfo.jpg (63.6 KB, 5499 views)
  Reply With Quote
The Following User Says Thank You to John_Doe For This Useful Post:
Old 07-01-2005, 10:17   #4 (permalink)
Junior Member
 
Join Date: Jun 2005
Location: Canada
Posts: 12
Member: 157119
Status: Offline
Thanks Meter: 0
Thumbs up Thnx Doe ... & adihack...

...was impressed by the info. u posted regarding the RAP3G Processor. Was wondering if you have any other helpful info. on other Nk IC i.e. UPP, UEM, RAM, FLASH, HAGAR, MJOLNER, etc.
Anywhere could obtain photos from Mnf. ?
Regards,
Xprts
  Reply With Quote
Old 07-01-2005, 13:11   #5 (permalink)
No Life Poster
 
John_Doe's Avatar
 
Join Date: Aug 2000
Location: anywhere
Posts: 596
Member: 1879
Status: Offline
Sonork: 100.28016
Thanks Meter: 941
Quote:
Originally Posted by experts
...was impressed by the info. u posted regarding the RAP3G Processor. Was wondering if you have any other helpful info. on other Nk IC i.e. UPP, UEM, RAM, FLASH, HAGAR, MJOLNER, etc.
Anywhere could obtain photos from Mnf. ?
Regards,
Xprts
here some info's about RETU...
Attached Images
File Type: jpg retu_info.jpg (50.2 KB, 2350 views)
  Reply With Quote
The Following User Says Thank You to John_Doe For This Useful Post:
Old 07-01-2005, 15:17   #6 (permalink)
Freak Poster
 
sixkiller666's Avatar
 
Join Date: Dec 2001
Location: Croatia and occasionally MARS
Posts: 281
Member: 7828
Status: Offline
Thanks Meter: 3
And few hints on BB5 Certificate structure




So. let's rock and roll



Regards


Commselect Inc.
Attached Images
File Type: jpg BB5C.jpg (50.6 KB, 3882 views)
  Reply With Quote
The Following User Says Thank You to sixkiller666 For This Useful Post:
Old 07-01-2005, 16:36   #7 (permalink)
Junior Member
 
Join Date: Jun 2003
Age: 43
Posts: 30
Member: 30719
Status: Offline
Thanks Meter: 0
This is a DUAL ENGINE PHONE with two processor one for EPOC and one for NOS. Both operating systems are physically seperated on different cores. NOS is now totally focused on the cellular modem activites and EPOC is totally focussed to user activities. The old series 60 was a single engine with the above points being shared.

BB5 security.

Most of the vital terminal/phone information such as locks, customisation etc have been encrypted/signed using a private key before downloading to the phone. This happens in the production phase.

If the information is is changed (ie lock status) the phone will recognise this and will not switch on.

The security system of the phone will apply a reset to the phone after 3 minutes if the security certificate is missing. If the certificate becomes corrupted the phone will reset every 30 seconds.

P.S. Anybody out there an ace repairer i wish to swap tricks and tips with them on things like fixing sysol samsung with key press faults and wd2/series 60 nokias that have signal failures
  Reply With Quote
Old 07-01-2005, 18:34   #8 (permalink)
No Life Poster
 
Join Date: Oct 2004
Age: 48
Posts: 508
Member: 88938
Status: Offline
Thanks Meter: 16
Quote:
Originally Posted by MuXBoX
This is a DUAL ENGINE PHONE with two processor one for EPOC and one for NOS. Both operating systems are physically seperated on different cores. NOS is now totally focused on the cellular modem activites and EPOC is totally focussed to user activities. The old series 60 was a single engine with the above points being shared.

BB5 security.

Most of the vital terminal/phone information such as locks, customisation etc have been encrypted/signed using a private key before downloading to the phone. This happens in the production phase.

If the information is is changed (ie lock status) the phone will recognise this and will not switch on.

The security system of the phone will apply a reset to the phone after 3 minutes if the security certificate is missing. If the certificate becomes corrupted the phone will reset every 30 seconds.

P.S. Anybody out there an ace repairer i wish to swap tricks and tips with them on things like fixing sysol samsung with key press faults and wd2/series 60 nokias that have signal failures
very interesting information thanks
regards loneunlocker
  Reply With Quote
The Following 2 Users Say Thank You to loneunlocker For This Useful Post:
Old 07-02-2005, 17:29   #9 (permalink)
No Life Poster
 
Join Date: Mar 2002
Location: Somewhere in the World
Posts: 1,417
Member: 9848
Status: Offline
Thanks Meter: 144
Quote:
Originally Posted by sixkiller666
And few hints on BB5 Certificate structure




So. let's rock and roll



Regards


Commselect Inc.

Could you give some infos from which document the screenshots are? Is the document available somwhere?
  Reply With Quote
Old 07-02-2005, 17:30   #10 (permalink)
No Life Poster
 
Join Date: Mar 2002
Location: Somewhere in the World
Posts: 1,417
Member: 9848
Status: Offline
Thanks Meter: 144
Since after presentation of correct unlock password the phone writes new simlock data the "Nokia Private Key" must be inside the phone. E.g. in RAP3G ?!?

Who can reverse engineer and read out RAP3G?
  Reply With Quote
Old 07-02-2005, 18:34   #11 (permalink)
Junior Member
 
Join Date: Jun 2003
Age: 43
Posts: 30
Member: 30719
Status: Offline
Thanks Meter: 0
The 3g Radio Application Processor (RAP3G) replaced the TIKU. This chip looks like it has no memory at all. It is a processor so i dont think this would contain any data german gsm team.
I can tell you its also not the RETU, TAHVO.

I think what we are looking for is a security certificate that is encrypted using an external key at the nokia flash centres. I do not know how security certificates work but i can imagine they are not disimilar to the types of security used by microsoft when signing certificates for websites. So basically this will be a purely software unlock. Now if you manage to open sp lock etc ,the certificate will not match and hence wont work. If you change the certificate in any way without using the encoding hardware key found at nokia centres then the phone wont work due to corrupt certificate.

What you "could" do is re-write parts of the operating system to stop it ever looking for the security in the first place maybe. This would involve rewriting part of the series 60 OS. So getting past the lock is the easy bit , getting the phone to work afterwards will be what people like dejan are struggling to do.
  Reply With Quote
Old 07-02-2005, 18:57   #12 (permalink)
No Life Poster
 
The Repair Shop's Avatar
 
Join Date: Feb 2003
Location: In My Pub
Posts: 5,828
Member: 307549
Status: Offline
Thanks Meter: 187
I'm learnig quit abit here guys please keep it uP :-)
  Reply With Quote
Old 07-02-2005, 19:24   #13 (permalink)
Administrator
 
..::Neo::..'s Avatar
 
Join Date: Jul 2002
Location: E G Y P T
Age: 34
Posts: 3,183
Member: 14178
Status: Offline
Thanks Meter: 7,784
from my own exprince RPA3G got imei and unlock algo sotred inside
  Reply With Quote
Old 07-02-2005, 20:24   #14 (permalink)
Freak Poster
 
sixkiller666's Avatar
 
Join Date: Dec 2001
Location: Croatia and occasionally MARS
Posts: 281
Member: 7828
Status: Offline
Thanks Meter: 3
Quote:
Originally Posted by ..::Neo::..
from my own exprince RPA3G got imei and unlock algo sotred inside

Actually better look on structure of BB5 architecure





Best regards



Commselect Inc.
Attached Images
File Type: jpg rap3G.jpg (60.4 KB, 3763 views)
  Reply With Quote
Old 07-02-2005, 21:00   #15 (permalink)
Junior Member
 
Join Date: Jun 2005
Age: 63
Posts: 12
Member: 155436
Status: Offline
Thanks Meter: 0
Quote:
Originally Posted by MuXBoX
What you "could" do is re-write parts of the operating system to stop it ever looking for the security in the first place maybe. This would involve rewriting part of the series 60 OS. So getting past the lock is the easy bit
Not that fast...

PerformAuth ; CODE XREF: load_algo+D2p
BX PC ; Thumb to Arm switch
NOP
LDR R12, =0x3F6D ; boot addr
BX R12
; End of function PerformAuth

---
Attached Images
File Type: jpg untitled.JPG (112.0 KB, 3136 views)
  Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
thread Thread Starter Forum Replies Last Post
x65 patching technical discussion Acidmrp x6x and x7x Flashpatching 42 10-10-2009 08:06
Iphone 3G Technical Discussion and SP Unlocking theory GraveSlayer iPhone 2 / iPhone 3G / iPhone 3GS 8 11-15-2008 06:04
Technical discussion sharp705sh celluniversal Sharp 0 05-17-2007 18:26
Technical discussion BB5 unlocking twisterfan Nokia Base Band 5 ( BB-5 ) 0 05-16-2007 20:36
Patching: Technical Discussion ... rizapn x4x, x5x Flashpatching 282 10-03-2006 20:23

 



All times are GMT +1. The time now is 07:41.



Powered by Searchlight © 2019 Axivo Inc.
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
- GSM Hosting Ltd. - 1999-2017 -
Page generated in 0.47224 seconds with 9 queries

SEO by vBSEO