|
Welcome to the GSM-Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. Only registered members may post questions, contact other members or search our database of over 8 million posts. Registration is fast, simple and absolutely free so please - Click to REGISTER! If you have any problems with the registration process or your account login, please contact contact us . |
|
Register | FAQ | Donate | Forum Rules | Root any Device | ★iPhone Unlock★ | ★ Direct Codes ★ | Direct Unlock Source |
| LinkBack | Thread Tools | Display Modes |
02-15-2007, 12:57 | #1 (permalink) |
No Life Poster Join Date: Dec 2003 Location: Canary Islands, Spain. Age: 39
Posts: 539
Member: 45456 Status: Offline Thanks Meter: 6 | for when 6085 flashing ? is there any solution for flashing Nokia 6085 ? i've the flashes downloaded from Support Section but i can see this model in v1.29.1 thanks in advance |
02-16-2007, 17:37 | #4 (permalink) |
No Life Poster Join Date: Dec 2006
Posts: 5,760
Member: 409197 Status: Offline Thanks Meter: 75 | use Dejan method to downgrade phone and all be ok "Best method is FULL FLASH erase and restoring with original Nokia rpl file! Otherwise.... I didn't play much with that problem but you can try... All test are made with 6630, probably it works with other BB5 MCU & DSP signatures are stored in 308,1 field on subblock "ab0fbd96af2ac271d26264af dead 06 00" That subblock is crypted by AES algorithm, and you have to know 16bytes key or to use attack to make change on that subblock. But... To make simple SW update Nokia made some backdors. Rap is testing that subblock and if new SW is newer than SW signature in that subbblock RAP will update subblock with newer SW signature. Otherwise, if new SW is older, RAP will STOP. BUT if that subblock is corupted RAP will write default current SW signature!!! So, procedure is next: Power your BB5 phone. After few sec. read field 308,1 Find in readed field 308,1 bytes "ab0fbd96af2ac271d26264afdead0600" and after that header fill next 16 bytes with zeros. Write back that new field 308,1 to phone. Well why Nokia made that after writing new fild 308,1 it is not tested... Anyway new field is stored in FLASH and it will be tested on NEXT phone reset!!! Here is more critical part. You have to flash phone with older SW before phone SW reset!!! You have to find flasher that allows very fast entering phone in FLASH mode!!! (if flasher after powering phone gives to much time to RAP start SW testing, SW downgrade will faill!) If every thing goes ok after flashing ,RAP will find corrupted subblock and will authorise previous wrote downgraded SW! That's it. B.R. Dejan" |
Bookmarks |
| |
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Looking for service manual for Nokia 6085 | zillah2004 | Nokia Base Band 5 ( BB-5 ) | 1 | 06-19-2009 08:47 |
i-Pmart BX Series RJ48 10 Pin Cable Compatible For Nokia 6085 For MT Box | IPMART | ipmart WebShop | 0 | 04-14-2009 04:40 |
i-Pmart BX Series RJ45 Cable Compatible For Nokia 6085 For JAF | IPMART | ipmart WebShop | 0 | 03-13-2009 14:20 |
6085 flash for unlock | buqki | MT-BOX | 1 | 02-07-2008 10:51 |
When? When?? P800 flash for DIV will be aviable?? | Firecell | Sony Ericsson | 16 | 09-24-2003 07:48 |
|