S/Me45i-v04: Flash Patches

[fcotrina]

; SHT 1.1 ScreenShot. Take a picture of the mobile screen
; Firmware : S45iv4
; Author: fcotrina
; Created: 12.01.2005
; Based in Windows ScreenShot and patch CL=CallLogging
; With some ideas taken from lalo.lerry and RizaPN
; Big thanks to Redkin and NCTN.
; How to run it? Follow these steps:
; Press 'left sidekey', to take the screenshot
; Open any file in explorer.
; A new file named scr????.BMP has been created in A:\
; You can view it, send it, or transfer to a computer
; Every time a new file is created with a random secuence number
; Rename the file if you want to keep it. Otherwise it might get overwritten
; known bugs:
; -The picture is taken after the key has been pressed, so the picture
; might change due to that key press
; -You need to open another file in between. I had to delay creating the
; file because S45i allows to create file only in some specific routines
; -If the random name is already an existing file, data is appended. Probably
; I should use a secuential number, or 2 random numbers, or date_time
; -If you take several screenshots, only saves the last one, unless you
; open any file in between. This is not a bug. I want it to be like this
; -it uses free RAM from 0000:1000 . If any other patch uses it, they collide

#include C166.inc

base 0A00000h

org 0CCB2D4h
; original code called when a key is pressed
;CCB2D4: D7 40 03 02 : extp #203h, #1
;CCB2D8: D4 FE 5E 2E : mov r15, [r14+#2E5Eh]
calls new_key_pressed ; my new code
nop ; I replace 4 instructions: 8 bytes
nop

org 0DA2C98h
; original code called when a file is open
; DA2C98: 88 90 : mov [-r0], r9
; DA2C9A: 88 80 : mov [-r0], r8
calls new_file_open ; my new code
after_open_file: ; need to know where to jump back.

;******************************
; When key 'left sidekey' is pressed, copy screen into 00:1000
; That key is on the left part of the screen. Yes, that long key.
; Press the top part of it.
org 0AEB000h ; there is unused ROM here. If not, use 0C94F0 or 5EFA00

new_key_pressed:
mov [-r0], r5
mov [-r0], r11
mov [-r0], r12
mov [-r0], r14

mov r5, r12 ; pressed key is stored in r12
cmp r5, #000Eh ; is left_sidekey?
jmpr cc_NZ, exit_no_left_sidekey

mov r14, #1FD4h ; screen is taken from 0041:1FD4
mov r12, #q(free_RAM_screen) ; target
mov r11, #0410h ; size

; copy 410h bytes from 0041:1FD4 to 0000:1000
; probably there is a memcpy routine somewhere, but I don't know where
another_r11:
extp #41h, #1h
mov r5, [r14] ; can be check with at+cgsn:00,1000 at+cgsn:01,1FD4
add r14, #02h
extp #0h, #1h
mov [r12] , r5
add r12, #02h
sub r11, #02h
jmpr cc_NZ, another_r11


; flag that there is a file pending to be saved
mov r5, #'A:'
extp #0h, #1h
mov q(free_RAM_name), r5

exit_no_left_sidekey:
mov r14, [r0+]
mov r12, [r0+]
mov r11, [r0+]
mov r5, [r0+]

; do now the original code
extp #203h, #1
mov r15, [r14+#2E5Eh]

rets

;******************************

new_file_open:
mov [-r0], r9 ; original code in 0DA2C98h
mov [-r0], r8 ; also original

;base 0100000h
;org 0100900h
save_screen:
mov [-r0], r4
mov [-r0], r6
mov [-r0], r12
mov [-r0], r13
mov [-r0], r14
mov [-r0], r15

extp #0h, #1h
mov r4, q(free_RAM_name)
cmp r4, #'A:'
jmpr cc_NZ, exit ; no screenshot taken yet

; copy file name to 0000:1000 and give it a unique name
mov r15, #p(file_name) ; file name segment
mov r14, #q(file_name) ; file name offset
mov r13, #0h
mov r12, #q(free_RAM_name)
calls 0FF40A0h ; copy string r15:r14 -> r13:r12
; take random value
extp #2h, #2h
mov r13, 03FDAh ; this stores the seconds (in internal format)
mov r14, 03FDCh ; and this stores the minute (more or less)
; convert to 4 letters
and r14, #0F0Fh
add r14, #04141h ; that is , 'A' 2 times
and r13, #0F0Fh
add r13, #04141h ; that is , 'A' 2 times
extp #0, #2h
mov q(free_RAM_name)+06h, r14 ; set it in the middle of file name offset.
mov q(free_RAM_name)+08h, r13 ; set it at the end of file name offset.

; open file for write
mov r14, #10Ah ; always fixed value #10Ah
mov r13, #0h ; file name segment
mov r12, #q(free_RAM_name) ; file name offset
mov r15, #0100h ; always fixed value #100h
mov [-r0], r9 ; emulate original code in 0DA2C98h
mov [-r0], r8
calls after_open_file

cmp r4, #0FFFFh ; check if opening was correct
jmpr cc_Z, exit ; something wrong
mov [-r0], r4 ; save file handler
mov r12, r4 ; file handler
mov r13, #q(header) ; header data offset
mov r14, #p(header) ; header data segment
mov r15, #62 ; data size: 16+16+16+14 , in decimal !
calls 0DA3642h ; write header
mov r12, [r0+] ; retrieve handler


; screen starts in 5FD4 and ends in 63E4 , that is, 0x0410 bytes
; although I have copied in 001000h, that is, 0000:1000
mov r6, #050h ; number of lines: 80
;mov r13, #023D7h ; address of the last line
mov r13, #q(free_RAM_screen)+0403h ; address of the last line, when screenshot starts from 0000:1000
loop_r6:
mov [-r0], r6
mov [-r0], r13
mov [-r0], r12 ; save handler
;mov r14, #41h ; segment address of current line
mov r14, #0h ; segment address of current line, starting from 0000:1000
mov r15, #010h ; line size in bytes: 16 (although width=101, almost 13*8)
calls 0DA3642h ; write to file this screen line r13:r6
mov r12, [r0+] ; retrieve file handler
mov r13, [r0+]
sub r13, #0Dh ; jump to previous screen line
mov r6, [r0+]
sub r6, #01h ; if this is not the first line, continue
;cmp r6, #0h ; not needed because sub also set flags
jmpr cc_NZ, loop_r6

close:
calls 0DA4AB4h ; close file

exit:
mov r4, #0FFFFh
extp #0h, #1h
mov q(free_RAM_name), r4 ; flag that it has been processed

mov r15, [r0+]
mov r14, [r0+]
mov r13, [r0+]
mov r12, [r0+]
mov r6, [r0+]
mov r4, [r0+]
rets

;org 0100990h
file_name: ; file name
db 'A:\scr'
unique_name:
db '0000.'
header: ; header of a BMP file, black+white, 101x80
db 42h, 4Dh, 50h, 00h, 00h, 00h, 00h, 00h, 00h, 00h, 3Eh, 00h, 00h, 00h, 28h, 00h
db 00h, 00h, 65h, 00h, 00h, 00h, 50h, 00h, 00h, 00h, 01h, 00h, 01h, 00h, 00h, 00h
db 00h, 00h, 00h, 05h, 00h, 00h, 0C4h, 0Eh, 00h, 00h, 0C4h, 0Eh, 00h, 00h, 00h, 00h
db 00h, 00h, 00h, 00h, 00h, 00h, 0FFh, 0FFh, 0FFh, 00h, 00h, 00h, 00h, 00h

; this part is only for the compiler. It does not go into the patch, because it takes RAM, not ROM
base 0000000h
org 001000h
free_RAM_name:
db 'A:\scr????.BMP', 0h, 0h ; must be multiple of 2
free_RAM_screen:

; end of source code



; this is the binary patch

0x3A2C98: DA0E4EB0 88908880
0x2CB2D4: D7400302D4FE5E2E DA0E00B0CC00CC00
0x0EB000: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 885088B088C088E0F05C46F50E003D16
0x0EB010: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FED41FE6FC1010E6FB1004D7404100
0x0EB020: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF A85E08E2D7400000B85C08C228B23DF6
0x0EB030: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F5413AD7400000F6F5001098E098C0
0x0EB040: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 98B09850D7400302D4FE5E2EDB008890
0x0EB050: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 88808840886088C088D088E088F0D740
0x0EB060: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000F2F4001046F4413A3D4BE6FFBA02
0x0EB070: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FE1C31E00DE6FC0010DAFFA040D750
0x0EB080: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0200F2FDDA3FF2FEDC3F66FE0F0F06FE
0x0EB090: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 414166FD0F0F06FD4141D7500000F6FE
0x0EB0A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0610F6FD0810E6FE0A01E00DE6FC0010
0x0EB0B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FF000188908880DADA9C2C46F4FFFF
0x0EB0C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D208840F0C4E6FD2731E6FEBA02E6FF
0x0EB0D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3E00DADA423698C0E6F65000E6FD1314
0x0EB0E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 886088D088C0E00EE6FF1000DADA4236
0x0EB0F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 98C098D026FD0D00986028613DF1DADA
0x0EB100: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF B44AE6F4FFFFD7400000F6F4001098F0
0x0EB110: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 98E098D098C098609840DB00413A5C73
0x0EB120: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6372303030302E424D50000000000000
0x0EB130: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 003E0000002800000065000000500000
0x0EB140: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 00010001000000000000050000C40E00
0x0EB150: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 00C40E00000000000000000000FFFFFF
0x0EB160: FFFFFFFFFF 0000000000

[lalo.lerry]

;*** BLR. Blinking Light when Ringing ***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Release : 08.01.05 - v1
;Update : 15.01.05 - v2

;This patch makes retroillumination blinking when phone is ringing for an incoming call
;and tone are setted to off or beep.
;Morover, it corrects retroillumination fading even if phone is still ringing when tones are on.
;Improuvments v2:
;one blink per second (=speed x2)
;stop blinking if a key is pressed
;customization options added


5631E6: FACAD69A FA87E0DF
563316: DACBF02C DA8780E0

07DFE0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DAF71AD448402D27DACD0CDD48402D0D
07DFF0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DAE50E11E6004400CC0048432D03F68E
07E000: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 20370D03C2F120372D03DACC08DF0D13
07E010: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F3F421370821F7F4213747F40600FD0B
07E020: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DA873AE0E6F42437E6F5FA00E6FD3AE0
07E030: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FE8700BB17FACAD69AD7404400C2F1
07E040: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 20373D0FDAE50E1148433D0BDACCD0DF
07E050: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F42837E6F53200E6FDDCDEE6FECC00
07E060: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF BB01DB0088E088D0F0C4E6FD4400F0E5
07E070: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E00FDACCE2960804CB00A9204C616C6F
07E080: FFFFFFFFFFFFFFFFFFFFFFFFFFFF E014D7404400F7F82037FACBF02C


;CUSTOMIZATION:
;Enable blinking retroillumination setting indipendent:
;07DFE0: DAF7 0D03

;Enable blinking retroillumination always (also when tone are on):
;07DFE8: DACD 0D03

;Add a beginning blinking retroillumination delay:
;07E01C: 06 xx
;where xx is a hex value >06, each unit is about 2 second delay

;Change light off time:
;07E056: 32 xx
;where xx is time in ms/0,25 in hex swapped bytes
;default= 32hex = 50dec : 0,25 =200ms



;Enjoy it!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** ISP. Improuved Screensaver Pop-up ***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Thanks to ntcn for accessories state RAM location
;Release : 17.01.05 - v1

;This patch limits screensaver pop-up:
;it will not pop-up if a charger, data cable or tracer cable is connected to phone.


5605FA: DAF87CE5 FA8760E2

7E260: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7404300C2F4DE2148472D0A46F49800
7E270: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D0746F499002D04DAF87CE5DAF6FE05
7E280: FFFF DB00


;CUSTOMIZATION:
;Don't check tracer cable connection (uncomment):
;7E26C: 46F4 0D02

;Don't check data cable connection (uncomment):
;7E272: 46F4 0D02


;Enjoy it, Genetic!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** MES. Missed Events String in Idle/Screensaver ***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Release : 17.01.05 - v1

;This patch changes second line operator name in idle or operator name in screensaver mode
;to became a missed events info string,
;if a missed event is present and if phone is in normal state (e.g. not in "Net searching mode", etc...).
;Missed event/s (calls, SMSes, voice messages, appointments, memos and alarm clock)
;and its/their number is displayed in string.
;NOTE: Missed voice messages number is setted to 1 by default, even if they are more than one.
;This is because my operator (or I?) don't use voice messages,
;so I couldn't check out their missed number RAM location.
;If anyone knows it, please let me know and I will complete the patch .


561130: DACBF86E FA8700E1
;if you don't have Operator Name in Screensaver patch applied apply the following line:
58D764: DAC44488 FA8722E1
;if you have it, comment the above line and uncomment this one:
;58D764: FA87C0DD FA8722E1

7E100: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DA8750E148A03D04DACBF86EFAF63411
7E110: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E016DACA709EE6FE3037E6FF4400FAF6
7E120: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 7411DA8750E148A03D04DAC44488FAF8
7E130: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 68D7E09CDACA08A0E6FE3037E6FF4400
7E140: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DAF8D2F0FAF8B2D7FFFFA9204C616C6F
7E150: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACBB208E6F83037E6F94400E00ADAC4
7E160: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 70C7F0640065DAC4B2C7004600454840
7E170: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D03E6F69301BB41D7403A00C2F4A012
7E180: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D03E6F6930DBB39D7405700C2FCC221
7E190: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 66FC0F0046FC0A002D11D7405700F3F2
7E1A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF C221DACCA85A2D0AD7405700F3F2D925
7E1B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 8AF10830DAC5AAE648402D04E014E6F6
7E1C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9314BB1BE6FCA4CCE6FDF700DAF6BADA
7E1D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48402D03E6F6932DBB10E02CDAF1FEA1
7E1E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48402D04E014E6F69303BB0748A02D03
7E1F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E001DC49B928FACAAC9748A02D09E6F1
7E200: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9595E6F22C20DC59B818C42802000884
7E210: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F0C4E7F23000DC49B928DC47DACBD01F
7E220: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DAFFC03F0882E6F19520DC49B8180882
7E230: FFFFFFFFFFFFFFFFFFFFFFFF F016DC49B818088208A1CB00


;CUSTOMIZATION:
;If you have Operator Name in Screensaver patch applied, apply also this line (uncomment):
;07E12A: DAC44488 FA87C0DD

;Overwrite first line operator name, not the second, in idle (uncomment):
;07E111: 16 06

;Remove leading 0 in 00-09 missed events numbers (uncomment):
;07E214: 30 91




;Enjoy my (very) last gift, Genetic!

;© Lalo 2005 Luki's Siemens Modding Forum

[fcotrina]

; TRO1.0 set breakpoints at Output points and trace them
; Firmware : S45iv4
; Author: fcotrina
; Created: 16.01.2005
; Based in patch DAR=Dump_All_Registers_v2 by RizaPN
; With some ideas taken from lalo.lerry and RizaPN
; Big thanks to Redkin and NCTN and all patchers out there
;
; This patch is related to TRI
; This patch is useful for patch programmers. If you
; find some code in ROM and want to know who calls it, just
; change any instruction "rets" with "trap #4Ah", that is:
; 0xYYYYYY: DB00 9B94
; After patching the ROM with new traps, start the phone. If it
; crashes, undo the trap, as this is not a traceable routine.
; Then, using CGSN patch, set the debug level in 0040:0802
; at+cgsn*40,0802,0000 not debug anything
; at+cgsn*40,0802,FFFF not debug anything
; at+cgsn*40,0802,7777 call procedure 0100700h before anything else
; at+cgsn*40,0802,6666 call procedure 0100600h after debugging
; at+cgsn*40,0802,1111 print the routine that is hitted and its caller
; Any other value will print the routine that is hitted and 12 entries in stack.
; for example, at+cgsn*40,0802,2222 will do that. This is what I normaly use.
; When I say "print", I mean that the information it output to the first
; serial port COM1 . Use Hyperterminal or similar to see the data.
;
; For example, apply this patch:
; 0x53B940: DB00 9B94
; then, at+cgsn*40,0802,2222
; and when you start the game RaceAce , it shows:
; 00F3B940<00FA61C8-0800.BF7E.00FC.BB34.00FC.B50A.00FC.FED2.00F4.64F2. 00CC.E6C6.
; The first value is the routine that was intercepted. Almost sure, this is the
; place where you have set your breakpoint: 0xF3B940
; The second value, after the '<', is the routine that called it. Let's call it S1
; In this case, FA61C8 is "calls 0E2FFFAh" (a.k.a. callR5R4) with r5=03E9 and r4=21C8,
; what converts to 03E9:21C8=0FA61C8h
; Later, after the '-', it dumps the stack:
; Usually, the first value is the flags register PSW , 0800 in this case
; Then, it usually follows the routine S2 that called S1, But remember that S1 might
; store information in the stack, so this word can be anything else.
; in this case, it is BF7E.00FC , that means 0FCBF7Eh
; Following, the routine S3 that called S2, with same warning as above: 0FCBB34h
; If nothing messes up with the stack, it is possible to back-trace 2+5 routines.
;
; limitations:
; -the patch sets up a new handler for trap #4Ah. This is done
; quite early in the mobile initialization, but may not early enough.
; That means that not all "rets" can be substituted, because
; the trap might had not been set yet.
; -too many breakpoints might print too much data, and crash the phone
; -only work with "rets" . Instruction "ret" can not be traced because
; CSP is not stored, and it is tricky to know it.
; -if another trap is being processed, the breakpoint might not be processsed.
; This depends on the priority of the processed trap and the processor mode
; -if to terminal is connected, the patch tries to send the information
; -I know there are routines to output characters to serial port. I did not
; use them because they use new processes/multitasking, and this modifies
; the values and timings
; -this patch might confuse aplications like SiemensDebugger. Set debug_level
; to 0000 before using SiemensDebugger, ex: at+cgsn*40,0802,0000

base 0A00000h
#include C166.inc

org 0CEE650h ; this is the end of the original routine that sets any trap handler
jmps set_my_trap_4A
; originaly:
; 2EE650: FC00 ; pop DPP0
; 2EE642: DB00 ; rets

org 0FEF100h ; just some freee space in ROM
;******************************************
; Set the new handler for trap #4A
set_my_trap_4A:
mov r1, #s(my_trap_4A)
movb rh1, rl1
movb rl1, #0FAh ; code for "JMPS"
mov r12, #0128h ; trap 4A jumps to 4A*4=128h. This is in C166 manual
mov [r12], r1 ; set the segment to jump to
mov r1, #o(my_trap_4A)
add r12, #2
mov [r12], r1 ; set the offset to jump to.
; in other words: put in 0000:0128 the intruction "jmps my_trap_4A"
pop DPP0 ; this was in the original code
rets
;******************************************

; this is where "trap #4Ah" will jump to
my_trap_4A:
mov [-r0], r6
mov [-r0], r5
mov [-r0], r4
mov [-r0], r3

extp #40h, #1h ; read debug_level
mov r4, 0802h
cmp r4, #7777h ; if 7777h, call subrutine
jmpr cc_NZ, continue_process ; if not, continue
calls 0100700h
continue_process:
pop r6 ; a trap always sets PSW-CSP-IP. As I come from
pop r3 ; a "rets" substituted by "trap #4Ah" , therefore
; ; IP is the last data in stack, and CSP is the previous
callr output_r3 ; output CSP
mov r3, r6 ; and then IP. To make it better, show the address that
sub r3, #02h ; called the trap, not the address where I should return to
callr output_r3
movb rl4, #'<' ; print a separator
callr output_rl4_char
pop r6 ; get PSW from stack. Can not be modified
pop r5 ; stack holds IP of the address that called
pop r3 ; stack holds CSP
push r6 ; insert PSW again, because we'll return with reti
push r3 ; insert CSP again. Remember that reti extracts PSW-CSP-IP
push r5 ; insert IP again. Now we could return
callr output_r3 ; print who called, that is, where we come from. First CSP
mov r3, r5 ; and later IP. As this is a "calls ..." instruction, takes 4 bytes
sub r3, #04h
callr output_r3

; after printing the current address and the calling address, dump some stack
extp #40h, #1h
mov r5, 0802h ; but only if debug_level tells us so.
cmp r5, #1111h ; if #1111h , short listing.
jmpr cc_Z, check_post_routine
; long listing
movb rl4, #'-' ; initial separator
callr output_rl4_char
mov r5, SP
add r5, #04h ; the first 4 bytes have already been printed
mov r6, #0Ch ; dump 12 words
another_stack:
mov r3, [r5+]
callr output_r3
movb rl4, #'.' ; separator in between stack words
callr output_rl4_char
sub r6, #01h
cmp r6, #0h
jmpr cc_NZ, another_stack

; output a line_feed and see if need to call a post-process-routine
check_post_routine:
movb rl4, #0Dh
callr output_rl4_char
movb rl4, #0Ah
callr output_rl4_char
extp #40h, #1h
mov r5, 0802h ; read debug_level
cmp r5, #6666h ; if 6666h, call routine at 100600
jmpr cc_NZ, end_my_trap_4A
calls 0100600h
end_my_trap_4A:
mov r3, [r0+]
mov r4, [r0+]
mov r5, [r0+]
mov r6, [r0+]
reti ; this pops IP, CSP, PSW, and then rets

;**************
; if r3 is a word with value #1234h, outputs 1, 2, 3, 4
; this is not a trivial as it looks, because of little indian
output_r3:
mov r4,r3
shr r4, #0Ch ; get left-most nibble: 1
callr output_rl4_numeric
mov r4,r3
shr r4, #08h ; get second-left-most nibble: 2
callr output_rl4_numeric
mov r4,r3
shr r4, #04h ; get second-right-most nibble: 3
callr output_rl4_numeric
mov r4,r3 ; get right-most nibble: 4
callr output_rl4_numeric
ret ; it is a relative routine.

; ****************
output_rl4_char:
mov [-r0], r5
jmpr cc_UC, numeric

output_rl4_numeric: ; outputs a number. Basically, adds '0' to it
mov [-r0], r5
and r4, #000Fh
add r4, #30h
cmp r4, #3Ah
jmpr cc_ULT, numeric ; although if it is in range 0Ah to 0Fh, needs
add r4, #07h ; to add 'A'-'0'
numeric:
extp #40h, #1h
mov r5, 0802h ; read debug_level
cmp r5, #0h ; if 0 of FFFF, do not output anything
jmpr cc_Z, exit_output_rl4
cmp r5, #0FFFFh
jmpr cc_Z, exit_output_rl4

movb S0TBUF, rl4
mov r4, r5
bclr S0TIR ; send to COM1 serial port
not_sent_yet:
jb S0TIR, exit_output_rl4 ; if sent, exit
sub r4, #01h ; if not sent, try again, as many times as debug_level
jmpr cc_NZ, not_sent_yet
exit_output_rl4:
mov r5, [r0+]
ret

end

; I am not releasing the binary code because I assume that
; you need (and you know how) to compile yourself

[fcotrina]

; TRI1.0 set breakpoints at Input points and trace them
; Firmware : S45iv4
; Author: fcotrina
; Created: 16.01.2005
; Based in patch DAR=Dump_All_Registers_v2 by RizaPN
; With some ideas taken from lalo.lerry and RizaPN
; Big thanks to Redkin and NCTN and all patchers out there
;
; This patch is related to TRO
; This patch is useful for patch programmers. If you want
; to know the value of the registers, just change any
; instruction "mov [-r0], r15" and "mov [-r0], r14" with
; a call to this patch (debug_r15_r14), that is:
; 0xYYYYYY: 88F088E0 DAFE00FA
; Then, using CGSN patch, set the debug level in 0040:0802
; at+cgsn*40,0802,0000 not debug anything
; at+cgsn*40,0802,FFFF not debug anything
; Any other value will print the routine that is hitted and 12 entries in stack.
; for example, at+cgsn*40,0802,2222 will do that. This is what I normaly use.
; When I say "print", I mean that the information it output to the first
; serial port COM1 . Use Hyperterminal or similar to see the data.
; Also, you need to specify which routines you want to trace.
; For that, set the address in 0040:0840
; For example, suppose you are interested in the register values at 0xC83B88
; Remember that C83B88 = 283B88
; Apply this patch:
; 0x283B88: 88F088E0 DAFE00FA
; And start the phone.
; then, do at+cgsn*40,0840,00C83B88 to enable the breakpoint
; and at+cgsn*40,0802,2222 to see the results in Hyperterminal
;
; If you want to debug a routine that does
; not use "mov [-r0], r15" and "mov [-r0], r14"
; but uses "mov [-r0], r09" and "mov [-r0], r08" instead, just call debug_r09_r08
; In this case, patch the ROM with:
; 0xYYYYYY: 88908880 DAFE18FA
; for example, 0x280788: 88908880 DAFE18FA
; and enable the breakpoint with at+cgsn*40,0840,00C80788
;
; You can enable several breakpoints just putting them together:
; at+cgsn*40,0840,00C83B8800C80788
; Even more, you can enable all breakpoints in the same page using FFFF as the offset:
; at+cgsn*40,0840,00C8FFFF will enable C80456 and also C804DE and C8054A ...
; But remember that first you need to path ROM:
; 0x280456: 88F088E0 DAFE00FA
; 0x2804DE: 88F088E0 DAFE00FA
; 0x28054A: 88F088E0 DAFE00FA
;
; limitations:
; -you can trace 8 breakpoints. Modify the program if you need more
; -only 6 combinations "mov [-r0], rX" + "mov [-r0], rY" are supported
; it is really easy to add more, but those 6 combinations appear:
; r15_r14 = 88 F0 88 E0 -> 2474 times
; r14_r13 = 88 E0 88 D0 -> 1414 times
; r13_r12 = 88 D0 88 C0 -> 4544 times
; r09_r08 = 88 90 88 80 -> 5425 times
; r08_r07 = 88 80 88 70 -> 1840 times
; r08_r07 = 88 70 88 60 -> 2498 times
; That is, about 15.000 routines
; -It is a good idea to patch as much ROM as you can, and then enable only
; those breakpoints you are interested on. If you enable too much, for
; example with at+cgsn*40,0840,00C8FFFF500F7FFFF00F9FFFF00FAFFFF
; then the data will be huge. Apart from that, if you do NOT output
; data, that is, at+cgsn*40,0802,0000 , then the mobile will run
; just a bit slower than usual
; -do not breakpoint this patch in routine debug_rX_rY, or it will
; go into an infinite loop
;

base 0A00000h
#include C166.inc

org 0FEFA00h ; just some freee space in ROM

; These are all entry points. They can be called from anywhere in ROM
debug_r15_r14:
mov [-r0], r15
mov [-r0], r14
jmps do_debug

debug_r14_r13:
mov [-r0], r14
mov [-r0], r13
jmps do_debug

debug_r13_r12:
mov [-r0], r13
mov [-r0], r12
jmps do_debug

debug_r09_r08:
mov [-r0], r09
mov [-r0], r08
jmps do_debug

debug_r08_r07:
mov [-r0], r08
mov [-r0], r07
jmps do_debug

debug_r07_r06:
mov [-r0], r07
mov [-r0], r06
jmps do_debug

;******************************
; Do the processing
do_debug:
; save flags. This is required as it will be very bad if I modify it
push PSW
; save all registers. That will make it easier to print them
mov [-r0], r15
mov [-r0], r14
mov [-r0], r13
mov [-r0], r12
mov [-r0], r11
mov [-r0], r10
mov [-r0], r9
mov [-r0], r8
mov [-r0], r7
mov [-r0], r6
mov [-r0], r5
mov [-r0], r4
mov [-r0], r3
mov [-r0], r2
mov [-r0], r1
mov [-r0], r0


continue_process:
; first thing is to print where we are. As we come from "calls ...", the CSP-IP
; is stored complete in the stack
pop r6 ; get PSW, because I have stored it previously. As long as it stays in r6, it is safe
pop r14 ; get IP
pop r15 ; stack holds CSP
push r15 ; insert CSP again
push r14 ; insert IP again. Now we could return
push r6 ; need to push flags again because it is extracted at the very end
sub r14, #04h ; the stack doesn't have the address that called, but the address just after that

; find if this address has an enabled breakpoint:
; search r15:r14 from 0040:0840 until 0040:0860, that is, 8 times
and r6, #00FFh
mov r12, #0840h
mov r11, #8 ; times to search
search_again:
extp #40h, #2h
mov r3, [r12+] ; get CSP that is breakpointed. This is stored as a page, not a segment
mov r2, [r12+] ; get IP
movb rl3, rh3 ; change little_indian to big_indian
and r3, #00FFh ; only pages in the first 16Mg (are there pages outside this? answer:NO)
cmp r3, r15 ; check page
jmpr cc_NZ, not_coincidence
movb rl3, rh2 ; change little_indian to big_indian
movb rh3, rl2
cmp r3, r14 ; check offset
jmpr cc_Z, coincidence
cmp r3, #0FFFFh ; if offset is FFFF, also debug. This is like a mask for page:****
jmpr cc_Z, coincidence
not_coincidence:
sub r11, #1h
jmpr cc_NZ, search_again
jmpr cc_UC, end_do_debug ; not in list

coincidence:
; first print stack
mov r3, r15
callr output_r3 ; print who called, that is, where we come from. First CSP
mov r3, r14 ; and later IP. As this is a "calls ..." instruction, takes 4 bytes
callr output_r3
; long listing of stack
movb rl4, #'-' ; initial separator
callr output_rl4_char
mov r5, SP
add r5, #06h ; PSW-IP-CSP have already been printed. Each one takes 2 bytes
mov r6, #0Eh ; dump 12 words from stack
another_stack:
mov r3, [r5+]
callr output_r3
movb rl4, #'.' ; separator between stack words
callr output_rl4_char
sub r6, #01h
jmpr cc_NZ, another_stack
callr output_CR_LF

; dump all 15 registers : | r0 | r1 | r2 | r3 | ... | r13 | r14 | r15
mov r15, r0 ; see where I stored them
mov r14, #10h ; number of words to output
another_register:
movb rl4, #'|' ; separator between registers
callr output_rl4_char
mov r3, [r15+]
callr output_r3
sub r14, #1h
jmpr cc_NZ, another_register
callr output_CR_LF

end_do_debug:
mov r1, [r0+] ; I stored r0, but don't want to retrieve it
mov r1, [r0+]
mov r2, [r0+]
mov r3, [r0+]
mov r4, [r0+]
mov r5, [r0+]
mov r6, [r0+]
mov r7, [r0+]
mov r8, [r0+]
mov r9, [r0+]
mov r10, [r0+]
mov r11, [r0+]
mov r12, [r0+]
mov r13, [r0+]
mov r14, [r0+]
mov r15, [r0+]
pop PSW
rets

output_CR_LF:
; output a line_feed
movb rl4, #0Dh
callr output_rl4_char
movb rl4, #0Ah
callr output_rl4_char
ret

;**************
; if r3 is a word with value #1234h, outputs 1, 2, 3, 4
; this is not a trivial as it looks, because of little indian
output_r3:
mov [-r0], r4
mov r4,r3
shr r4, #0Ch ; get left-most nibble: 1
callr output_rl4_numeric
mov r4,r3
shr r4, #08h ; get second-left-most nibble: 2
callr output_rl4_numeric
mov r4,r3
shr r4, #04h ; get second-right-most nibble: 3
callr output_rl4_numeric
mov r4,r3 ; get right-most nibble: 4
callr output_rl4_numeric
mov r4, [r0+]
ret ; it is a relative routine.

; ****************
output_rl4_char:
mov [-r0], r5
jmpr cc_UC, numeric

output_rl4_numeric: ; outputs a number. Basically, adds '0' to it
mov [-r0], r5
and r4, #000Fh
add r4, #30h
cmp r4, #3Ah
jmpr cc_ULT, numeric ; although if it is in range 0Ah to 0Fh, needs
add r4, #07h ; to add 'A'-'0'
numeric:
extp #40h, #1h
mov r5, 0802h ; read debug_level
cmp r5, #0h ; if 0 of FFFF, do not output anything
jmpr cc_Z, exit_output_rl4
cmp r5, #0FFFFh
jmpr cc_Z, exit_output_rl4

movb S0TBUF, rl4
mov r4, r5
bclr S0TIR ; send to COM1 serial port
not_sent_yet:
jb S0TIR, exit_output_rl4 ; if sent, exit
sub r4, #01h ; if not sent, try again, as many times as debug_level
jmpr cc_NZ, not_sent_yet
exit_output_rl4:
mov r5, [r0+]
ret

end

; I am not releasing the binary code because I assume that
; you need (and you know how) to compile yourself

[lalo.lerry]

;*** ISP. Improuved Screensaver Pop-up ***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Thanks to ntcn for accessories state RAM location
;Release : 17.01.05 - v1
;Update : 19.01.05 - v1.1 - little relocated -

;This patch limits screensaver pop-up:
;it will not pop-up if a charger, data cable or tracer cable is connected to phone.
;NOTE: tracer cable is a data+charger cable.


5605FA: DAF87CE5 FA87D0E2

7E2D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7404300C2F4DE2148472D0A46F49800
7E2E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D0746F499002D04DAF87CE5DAF6FE05
7E2F0: FFFF DB00


;CUSTOMIZATION:
;Don't check tracer cable connection (uncomment):
;7E2DC: 46F4 0D02

;Don't check data cable connection (uncomment):
;7E2E2: 46F4 0D02


;Enjoy it, Genetic!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** MES. Missed Events String in Idle/Screensaver ***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Release : 17.01.05 - v1
;Update : 19.01.05 - v4 - option added

;This patch changes second line operator name and/or date in date&time string in idle
;and/or operator name in screensaver mode, to became a missed events info string,
;if a missed event is present and if phone is in normal state (e.g. not in "Net searching mode", etc...).
;Missed event/s (calls, SMSes, voice messages, appointments, memos and alarm clock)
;and its/their number is displayed in string.
;NOTE:
;1. Missed voice messages number is setted to 1 by default, even if they are more than 1.
;This is because my operator (or I?) don't use voice messages,
;so I couldn't check out their missed number RAM location.
;If anyone knows it, please let me know and I will complete the patch.
;2. If missed events are 4 or + in data&time string, they "collides" with time and this one disappear.
;It will reappear as soon as missed events number will be less than 4.
;UNINSTALL any previously applied version, first!
;Improuvments v4:
;missed event string instead of date support added
;dinamic use of string spaces and characters
;space saved
;small/big font type string option added


;patch routine:

7E100: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E003BB2B48403D04DACBF86EFAF63411
7E110: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E013BB1FE016DACA709EFAF67411E003
7E120: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF BB1C48403D04DAC44488FAF868D7E013
7E130: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF BB10E09CDACA08A0DAF8D2F0FAF8B2D7
7E140: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E003BB0B48403D02FAC66439E033BB05
7E150: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DB00E6FE3037E6FF4400DACAB89CDA87
7E160: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 70E1DACA629CCB00FFFFA9204C616C6F
7E170: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACBB208E007DAC470C7F0640065DAC4
7E180: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF B2C70046004548402D03E6F69301BB47
7E190: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7403A00C2F4A0122D03E6F6930DBB3F
7E1A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7405700C2FCC22166FC0F0046FC0A00
7E1B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D11D7405700F3F2C221DACCA85A2D0A
7E1C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7405700F3F2D9258AF10830DAC5AAE6
7E1D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48402D04E014E6F69314BB21E6FCA4CC
7E1E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FDF700DAF6BADA48402D07E6F6932D
7E1F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48312D02E6F6930ABB12E02CDAF1FEA1
7E200: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48402D04E014E6F69303BB0948302D03
7E210: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E102DC49B928F047F0B7FACAAC974830
7E220: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D3048B13D0848333D06E6F19520BB2B
7E230: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F12020BB2848702D0EE6F19595BB23
7E240: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F12C9148333D0248B39D0448B49D02
7E250: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F12C20BB18F0C4E7F23000DC49B928
7E260: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DC47DACBD01FDAFFC03F088248333D02
7E270: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48B29D0548B39D03E6F19520BB04F016
7E280: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF BB020871CB00DC49B8180882CB00FFFF


;patch starting points:

;Missed events string in operator name second line space in idle (uncomment):
;561130: DACBF86E FA8700E1

;Missed events string in operator name space in screensaver (uncomment):
;if you don't have Operator Name in Screensaver applied use this line:
;58D764: DAC44488 FA871EE1
;if you have Operator Name in Screensaver applied:
;if you choose to delete operator name use this lines:
;58D764: 0D424488 FA871EE1
;07E126: DAC44488 FAF8EAD7
;if you choose to alternate operator - profile names use these lines:
;58D764: FA87C0DD FA871EE1
;07E126: DAC44488 FA87C0DD

;Missed events string in date space in idle (uncomment):
;if you don't have any "data patch" applied use this line:
;560506: DAC66439 DA8740E1
;if you have "DD dd mmm" date patch applied use these lines:
;560506: DA8740DA DA8740E1
;07E148: FAC66439 FA8740DA
;if you have temperature instead of DATE patch or both date patches applied use these lines:
;560506: DA8730CE DA8740E1
;07E148: FAC66439 FA8730CE


;CUSTOMIZATION:
;Memos small icon font is missing in orginal fw, so, if you have changed operator font type to a small font (06,07),
;use this line to use small bell as icon font for missed appointments (uncomment):
;07E111: 13 23 ;in idle
;07E12F: 13 23 ;in screensaver

;Overwrite first line operator name, not the second, in idle (uncomment):
;07E115: 16 06

;Remove leading 0 in 00-09 missed events numbers (uncomment):
;07E25A: 30 91

;delete missed events arrow in screensaver:
;58D9A8: F084 E008
;NOTE: missing event arrows pops up for more missed events
;(but less important, IMHO, like bitmap or ringtone recieved) than missing events string.


;That's the very last end (I HOPE)!
;Enjoy it!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

Sorry, I really couldn't avoid to make it


;*** MSC. More Shortcut ***

;Firmware : S-ME45i v04
;Author : RizaPN, Lalo
;Release : December 16, 2003 - v1
;Updated : December 19, 2003 - v2
;Updated : Jenuary 26, 2005 - v3 - bugs corrected

;This patch adds 13 more fixed shortcut in idle,
;by pressing button 0-9,*,+,# followed by LeftSoftKey.
;Assign your favourites function to them by patch customization ...
;Improuvements v3 - bug fixed:
;correct display of "clear" text in left softkey after having used the shortcut
;no more strange patch auto-disablements
;no shortcut if call in progress (you can't cancel the pressed digit by red button if call is in progress)
;some TAG text corrected


27F966: F0D65C2D DA8770CC
55DA78: 46FF0B00 DA87B6CC
5611DC: FACAAC97 FA872ACD

7CC70: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48603D1E46FC2A013D1B88C0DAC46AAC
7CC80: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 98C048412D15D7405B00F3F45C243D10
7CC90: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7404400F3F4FF373D0BBB30D7501F02
7CCA0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9932A922F0C1E114D7405B00F7F45C24
7CCB0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F0D65C2DDB0046FF0B003D1388C0DAC4
7CCC0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 6AAC98C048412D0DF04CD7404400F3F4
7CCD0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FF373D0248412D062841D7404400F7F8
7CCE0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FF37DB00BB0B0822E005D7601F0299A2
7CCF0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9992A982DAE2FAFFE00CDB00D7405B00
7CD00: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F3F45B2427F430009D0607F40D003D02
7CD10: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E1C40D01094347F40C00EDFAC042F012
7CD20: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 5C21002106F2380DCB00E108D7404400
7CD30: FFFFFFFFFFFFFFFF F7F8FF37FACAAC97


CUSTOMIZATION:
;Choose shortcuts:
;Modify this list as you like.
;The first 2 byte is text code for LeftSoftKey
;and the last 3 byte is function entry-point
;Example: 01EC is "Calc.", and F65D38 is its entry-point

7CD38: FFFFFFFFFF 01ECF65D38 ; 0.Calculator
7CD3D: FFFFFFFFFF 074CE994CA ; 1.Inbox
7CD42: FFFFFFFFFF 0749E99466 ; 2.SMS
7CD47: FFFFFFFFFF 074DE99508 ; 3.Outbox
7CD4C: FFFFFFFFFF 02F1E99548 ; 4.Archive
7CD51: FFFFFFFFFF 0099E99624 ; 5.New email
7CD56: FFFFFFFFFF 0102F5E37A ; 6.IrDA
7CD5B: FFFFFFFFFF 01FEF65D50 ; 7.Appointment
7CD60: FFFFFFFFFF 010BF65D44 ; 8.Calendar
7CD65: FFFFFFFFFF 0288F65DAA ; 9.Internet
7CD6A: FFFFFFFFFF 01C1F65D1C ; *.Games
7CD6F: FFFFFFFFFF 04A9F5E368 ; +.GPRS
7CD74: FFFFFFFFFF 08B2F65D64 ; #.Explorer

;Enable shortcuts in call in progress (uncomment):
;07CC7A: 88C0 0D05
;07CCBC: 88C0 0D05


;Enjoy it!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** NAM. New "Applications" Menu v3***

;Firmware : S-ME45i v04
;Author : Lalo
;Luki's - Siemens Modding Forum
;Based on RizaPN SL45i patch (thanks Master for your source asm)
;Release : 03.02.05
;Updated: 04.02.05 - v3.1 - autosize improuved, rilocated, pictures changed, space saved -

;This patch replaces unusefull (IMHO) "Help on line" item with a new "Applications" item in main menu.
;The new Application menu consists of 5 profiles,
;and each profile controls 16 patches functions (tot. 80 voices max),
;and has the capability to "autosize" itself (this means that only used voices are displayed)
;Old NAM menu is totally implemented in first profile menu of new NAM.
;UNINSTALL the first NAM version before apply this one.


5A9B4: 3E60F6 00E387
5AB20: 06020502 1A0C1A0C

0x7C9D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 40010000C7000000AD01000077020000
0x7C9E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D0091F021A0CFF7F
0x7C9F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 00000000000000000000000000000000
0x7CA00: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 08091A02FE081A028002000000000000
0x7CA10: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 123844006C3844000500FFFFFFFFFFFF
0x7CA20: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D4091F028D0AFF7F
0x7CA30: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D4091F028E0AFF7F
0x7CA40: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D4091F028F0AFF7F
0x7CA50: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D4091F02900AFF7F
0x7CA60: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0000000065000C00D4091F02910AFF7F
0x7CA70: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 00000000000000000000000000000000
0x7CA80: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0C091A02FE081A028102000010E48700
0x7CA90: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 80384400A03944001000FFFFFFFFFFFF

0x7E300: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6004400E6F12438E6F28038E6F3E024
0x7E310: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F426E3E045E006E017BB35E6FAE009
0x7E320: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FBF0090D21E00C0D07E01C0D05E02C
0x7E330: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D03E03C0D01E04CE6004400F6FC1038
0x7E340: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F03C5C53E6F19238E6F2E03906F3F024
0x7E350: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F426E4E0F5E026E027BB15F0AC5C4A
0x7E360: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 06FA200AE6FB700AF0CEF0DFE00E88E0
0x7E370: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F0FAE6F11F02881088F0F0EBF0F1DAFA
0x7E380: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF A8470806DB00EC00D7401F029893BB0D
0x7E390: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6FA870088A2F0A55C2A00A488A206F1
0x7E3A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2400A0053DF1FC00CB0048702D16E6FA
0x7E3B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 050248713D0FE6FB7025F0D55C5D20BD
0x7E3C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E008D7401F0298DB46FDFFFF3D0680F8
0x7E3D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 8DF80D0546F9FFFF2D02E6FA590588A1
0x7E3E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E03A88A1E00A88A188A188A146F9FFFF
0x7E3F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3D02E6F922038891889148603D0288A1
0x7E400: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D05E6FA1A0288A1E6FA300988A1CB00
0x7E410: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E02BF02EBB4C60212D01E01B88B0DAFA
0x7E420: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3A2B0802DB00E00C0D1DE01C0D1BE02C
0x7E430: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D19E03C0D17E04C0D15E05C0D13E06C
0x7E440: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D11E07C0D0FE08C0D0DE09C0D0BE0AC
0x7E450: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D09E0BC0D07E0CC0D05E0DC0D03E0EC
0x7E460: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D01E0FCF02CBB235021DC45B82448C0
0x7E470: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3D02E0020D0EE6F19038E002D7404400
0x7E480: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF A84146F405022D01082106F1120028C1
0x7E490: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3DF5F0C8F0D9F0E2E00FDAFA1827F0C8
0x7E4A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF F0D9DAFA822EDACA7AB2FAFADC35E6F4
0x7E4B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 3C3FE6F54200E0114C12D7404400F2F3
0x7E4C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 10382D07E6F4602EE6F55B0028315C13
0x7E4D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0043DC45A824CB00FFFFA9204C616C6F


;These are the Application menu items names, stored by thier hex byte swapped string IDs:
0x7E4E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 8D0A8E0A8F0A900A910AFFFFFFFFFFFF

;These are the Profile 1 menu items names, stored by thier hex byte swapped string IDs:
0x7E4F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF AA062E018503B6023800A3042B022B06
0x7E500: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 03008D006607290663007F0275009A02

;Here must be placed the Profile 2 menu items names, stored by thier hex byte swapped string IDs:
;0x7E510-0x7E52F: empty by now, each word correspond to an item in profile 2 menu

;Here must be placed the Profile 3 menu items names, stored by thier hex byte swapped string IDs:
;0x7E530-0x7E54F: empty by now, each word correspond to an item in profile 3 menu

;Here must be placed the Profile 4 menu items names, stored by thier hex byte swapped string IDs:
;0x7E550-0x7E56F: empty by now, each word correspond to an item in profile 4 menu

;Here must be placed the Profile 5 menu items names, stored by thier hex byte swapped string IDs:
;0x7E570-0x7E58F: empty by now, each word correspond to an item in profile 5 menu

;First profile menu voices (=old NAM menu voices):
;voice 1 = Black = FD. Funny Display: invert colors option
;voice 2 = Swap = FD. Funny Display: turn display on orizzontal ax option
;voice 3 = Reversi = FD. Funny Display: turn display on vertical ax option
;voice 4 = Clock = DC. Digital Clock
;voice 5 = Animation = ? AOL. Animated Operator Logo
;voice 6 = Screensaver = BLANK. Blank Screen when Keylocked
;voice 7 = Alarm clock = HB.Hourly Beep or ACP.Automatically change the phone's profiles
;voice 8 = Temperature = SCT. Show Current Temperature instead of time or date
;voice 9 = 12 Hours = HFI. 12AM-PM Hours Format in Idle screen
;voice 10 = Format date = DFI. dd NN mmm Date Format in Idle screen
;voice 11 = SMS as text = CL.Call Logging: save SMS text option
;voice 12 = Save data = CL.Call Logging
;voice 13 = Auto Answer = BL.Black List: autoanswer option for unknown ID calls
;voice 14 = Reject = BL.Black List: reject option for unknown ID calls
;voice 15 = Busy = BL.Black List: busy option for unknown ID calls
;voice 16 = Silent = AAA. Assign Any ringtone to Any number: silent option for unknown ID calls

;if you don't use some of them and want to delete them, just fill the related word of FFFF
;e.g.: delete Reversi menu item:
;0x7E4F4: 8503 FFFF


;CUSTOMIZATION:
;Disable autosize menu feature:
;0x7E319: 17 07 ;show always all profiles in application menu (also "empty" profiles)
;0x7E359: 27 07 ;show allways all items in profiles menu (also "empty" voices)

;(continues in following post)

[lalo.lerry]

;(continues from previous post)

;PICTURES:
;Change "Help on Line" pictures to "Applications" pictures in main menu animations (pictures nn.578-584):
; ##### Picture 578 #####
; Picture Data
0DAAE8: 00000F00000F00000F1FFFCF1F87CF1F 00400F00400F00E00F00E00F00E00F01
0DAAF8: 03CF1E31CF1E79CF27F9CF1FF1CF1FE3 F00F01F00F7FFFCF3FFF8F1FFF0F07FC
0DAB08: CF1FC7CF1FCFCF1FCFCF1FFFCF1FCFCF 0F03F80F07FC0F07FC0F07BC0F0F1E0F
0DAB18: 27CFCF1FFFCF 0C060F18030F
; ##### Picture 579 #####
; Picture Data
0DAB1E: 07E00F0FE00F1EE00F3C7FCF3B604F3B 00400F00600F00600F00E00F00F00F00
0DAB2E: 604F3E604F3EE04F4CE04F3DE04F3FE0 F00F01F00F3FFF8F1FFF0F0FFE0F07FC
0DAB3E: 4F3EE04F3CC04F3FA04F3F404F3E804F 0F03F80F03F80F03FC0F07FC0F07BC0F
0DAB4E: 4D004F3A004F 071C0F06040F
; ##### Picture 580 #####
; Picture Data
0DAB54: 1C000F1C000F3C000F3FFFCF3C004F3C 00100F00100F00380F00380F00780F00
0DAB64: 004F3C304F3C304F4C004F3C704F3C70 780F0FFF0F07FF0F03FE0F01FC0F00FC
0DAB74: 4F3C304F3C304F3C304F3C784F3C784F 0F00FC0F00FC0F01FC0F01DC0F01CC0F
0DAB84: 48004F38004F 01840F01000F
; ##### Picture 581 #####
; Picture Data
0DAB8A: 60000F60000F60000F7FFFCF60004F60 00400F00400F00400F00600F00600F00
0DAB9A: 004F60304F60304F58004F60704F6070 600F00E00F00F00F00F00F00700F0060
0DABAA: 4F60304F60304F60304F60784F60784F 0F00600F00600F00E00F00E00F00A00F
0DABBA: 58004F60004F 00B00F00100F
; ##### Picture 582 #####
; Picture Data
0DABC0: 80000FC0000FE0000FFFFFCFE0004FE0 00200F00200F00200F00600F00600F00
0DABD0: 004FE0004FE1FE4FD9FE4FE0004FE000 600F00700F00F00F00F00F00E00F0060
0DABE0: 4FE1FE4FE0004FE0004FE0004FE0004F 0F00600F00600F00700F00700F00500F
0DABF0: D8004FE0004F 00D00F00800F
; ##### Picture 583 #####
; Picture Data
0DABF6: 00000F80000FC0000FFFFFCFE0004FE0 00800F00800F01C00F01C00F01E00F01
0DAC06: 004FE0004FE1FE4FD8004FE0004FE1FE E00F0FFF0F0FFE0F07FC0F03F80F03F0
0DAC16: 4FE1FE4FE0004FE0004FE1FE4FE0004F 0F03F00F03F00F03F80F03B80F03380F
0DAC26: D8004FE0004F 02180F00080F
; ##### Picture 584 #####
; Picture Data
0DAC2C: 00000F00000F00000FFFFFCFE0004FE0 00200F00600F00600F00700F00F00F00
0DAC3C: 004FE0004FE1FE4FD8004FE0004FE1FE F00F00F80F1FFFCF0FFF8F07FF0F03FE
0DAC4C: 4FE0004FE0004FE1FE4FE1FE4FE0004F 0F01FC0F01FC0F03FC0F03FE0F03DE0F
0DAC5C: D8004FE1FE4F 038E0F02060F

;Change unused (I hope!) picture n.320 to become the new menu icon:
; ##### Picture 320 #####
; Picture Table Index
0DE930: 1A280100 0F0B0100
; Picture Data
0D6CD9: 0050003F0028003F0C50003F1EA0003F 01010101038103813FF90FE107C107C1
0D6CE9: 1F70003F1FFD003F0EFE803F15FF803F 0EE1082100010F0F0F0F0F0F0F0F0F0F
0D6CF9: AFD1803F5F90803FAF18403F4E11403F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D09: 0FE2403F0E44403F0E00803F0615003F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D19: 0B23003F07CF803F01F3803F03FF803F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D29: 03FF803F07FF803F07FFC03F0FFFC03F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D39: 0FFFC03F13FFF03F1CFFE83F0B3FE83F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D49: 08FC283F0883F03F0CFFE03F07FFF03F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D59: 007DF03F007DF83F007CF83F007CFC3F 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F
0D6D69: 007CFFBF00E4FE7F0104C07F01F8FFBF 0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F


;FOR PATCH MASTERS:
;These are the EEFULL RAM locations used by this patch (for any selectable patches),
;1st Profile => 0042:3F3Ch (old one used in the first NAM patch),
;2nd Profile => 005B:2E60h (unused? profile setting data)
;3rd Profile => 005B:2E62h (unused? profile setting data)
;4nd Profile => 005B:2E64h (unused? profile setting data)
;5rd Profile => 005B:2E66h (unused? profile setting data)

;new item names must be placed in NAMv3 menu names area (0x7E510-0X7E58F)
;REMEMBER not to place any new patch there!
;I hope a lot of new selectable patches will come!



;Enjoy it!

;© Lalo 2005 Luki's - Siemens Modding Forum

[lalo.lerry]

;*** CLS. Change Log-in and Log-off Sounds ***

;Firmware : S-ME45i v04
;Author : Lalo
;luki's Siemens Modding Forum
;Adapted and modified from a SL45 Trustkill's and Abomin's patches
;Release : 06.09.04 - v1
;Updated: 04.02.05 - v1.1 - new NAMv3 integration -

;This patch changes the startup and/or shutdown sound in any other phone one,
;according to extended info tone flag in profile's menu
;and selectable through my NAMv3, profile 2, item 1.
;UNDO the previouly version if applied!


557357:CD3EDB 8710DA
591173:CD3EDB 8724DA

7DA10: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF D7405B00F2F4602E9AF40200E6FC5100
7DA20: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FACD3EDBD7405B00F2F4602E9AF40200
7DA30: FFFFFFFFFFFFFFFF E6FC5600FACD3EDB


;CUSTOMIZATION:
;change log-in sound:
;7DA1E: 51 xx
;change log-off sound:
;7DA32: 56 xx
;where xx is sound number according to word list sound

;Selection throught NAMv3 (you must have NAM patch applied):
;defoult = profile 2, item 1 (own sounds)
;7E510: FFFF 5309 ;assign 2.1 item to CLS patch (uncomment)



;Enjoy it, Genetic!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** NNC. Name and Number in Incoming/Outgoing Calls ***

;Firmware : S-ME45i v04
;Author : Lalo
;luki's Siemens Modding Forum
;Partly based on RizaPN SL45i patch
;Release : 08.02.05 - v1
;Updated: 10.02.05 - v1.1 - option added

;This patch adds a new line with number just under name in incoming and/or outgoing call screen.
;The number will be shown only if avable and if not yet shown in "name" string.


;show number in incoming calls (comment if you don't want it):
5631B6: DACB6264 DA87A0E5
5631BC: FA3FE6FF1502 6037E6FF4400

;show number in outgoing calls (comment if you don't want it):
55CA1C: DACA709E DA87A6E5
55CA22: E43FE6FF1502 6037E6FF4400

;show number in outgoing calls if handfree on (comment if you don't want it):
55CAB4: DAF76CD3 DA8710E6
55CAD0: DACAA8B2 DA87ACE5
55CAD6: E43FE6FF1502 6037E6FF4400

7E5A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACB62640D05DACA709E0D02DACAA8B2
7E5B0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACAF097E6F63E27E6F77521E6F86037
7E5C0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E6F94400E6003C00A9862D120862A986
7E5D0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 2D0F0D0447F893003D030D01BB110871
7E5E0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 9927F041BB092D04F0147C41BB053DF8
7E5F0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF E102BB08FAC6E23AE1F3612341232D05
7E600: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 07F23000DC49B9280881CB00FFFFFFFF
7E610: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DAE50E1148443D02FAF76CD3E004DB00


;CUSTOMIZATION:
;Delete your country international prefix in shown number (uncomment):
;7E5D2: 0D04 A987
;7E5D6: 93 xx
;where xx is you country international prefix with swapped numbers
;e.g.: Germany: prefix = +49, xx = 94
;and write a "0" instead of it (uncomment if you want it):
;7E5DA: 0D01 E102

;Move name and number string in incoming call to fit it properly in screen (comment if you don't want it):
59E39: 2E02 2B02 ;name string: y and font type
59E45: 0001 3806 ;number string: y and font type


;Enjoy it, Maulwurf!

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** PLK. PTT Button Long in Keylock Screen ***

;Firmware : S-ME45i v04
;Author : Lalo
;luki's Siemens Modding Forum
;Release : 11.02.05 - v1

;This patch invertes PTT button pression behaviour when keylocked to avoid unwanted shortcut:
;short pression: no effect
;long pression: start voicedialling function


560D3C: DAFD66D6 DA87A0E2

7E2A0: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACAB6F1DACB0647DACCD25C46F6EB00
7E2B0: FFFFFFFFFFFFFFFFFFFF 3D02FAFD66D6E004DB00


;Enjoy it, Lalo!
;(Finally I can enjoy my Siemens mp3 player without unwanted music stops! )

;© Lalo 2005 Luki's Siemens Modding Forum

[lalo.lerry]

;*** UWS. Unsent SMS Waring Sound ***

;Firmware : S-ME45i v04
;Author : Lalo
;luki's Siemens Modding Forum
;Release : 11.02.05 - v1
;Updated : 12.02.05 - v2 - more situations included

;This patch changes "SMS not sent" MessageBox beep with a warning sound,
;if the SMS has not been (or only partly if multiSMS) sent.


4A3496: DACA4E9A DA8770F1
4A38A8: DAFAD84C DA8776F1
4A4070: DACC5C1A DA877CF1
4A437A: DACA5EA0 DA8782F1

7F170: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF DACA4E9A0D08DAFAD84C0D05DACC5C1A
7F180: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 0D02DACA5EA0DACAB89CE6FC6700DACD
7F190: FFFFFFFFFFFF 3EDBFACA629C


;CUSTOMIZATION:
;Change warning sound type (uncomment):
;7E18C: 67 xx
;where xx is a sound taken from word sounds list



;NOTE: If you find some other situations in which SMS in not sent but there is no waring sound,
;please report to me and I'll try to add them.
;Enjoy it, ElPossa!


;© Lalo 2005 Luki's Siemens Modding Forum