GSM Shop GSM Shop
GSM-Forum  

Welcome to the GSM-Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features.
Only registered members may post questions, contact other members or search our database of over 8 million posts.

Registration is fast, simple and absolutely free so please - Click to REGISTER!

If you have any problems with the registration process or your account login, please contact contact us .

Go Back   GSM-Forum > GSM & CDMA Phones / Tablets Software & Hardware Area > Various > Siemens-Benq > Siemens-Benq Flash Patching > x4x, x5x Flashpatching

Reply
 
LinkBack Thread Tools Display Modes
Old 01-30-2003, 15:14   #1 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
SLIKv56: Flash patches


I thought it would be great to list all the flash patches discussed in this forum. Some people have been doing some excellent work and it would be a shame to see it forgotten in a few weeks time.

We could keep the first post as a table of content, and each further post as an individual patch. Here are the first patches:

[list=1][*]Create new shortcut for Inbox SMS (located on the SIM card)[*]Create new shortcut for Outbox SMS (located on the SIM card)[*]Eliminate the additional "_nnn_nnn" string when moving SMS to the archive folder[*]Get access to "SIM Location" directly using front UP Arrow key[*]Add "Send via IrDA ..." options in CardExplorer[*]Overwrite "VoiceDialling" shortcut with "Display" shortcut[*]Overwrite "VoiceDialling" shortcut with "Illumination Toggle"[*]Use # short button to release the key-lock[*]Use * [GREEN] as an Illumination Toggle shortcut[*]Disable "Do you want to copy all SIM Card content to the phonebook" message when change SIM Card[*]Use * 0 and # followed by [GREEN] button as shortcuts[*]Use LEFT Arrow key as a "SIM-Location" shortcut[*]*NEW* Long press of left side [+] button for "Illumination Toggle" and its short press for IrDA[*]*NEW* Overwrite selectable "User Group" shortcut/hotkey with "Archive"[/list=1]

Instructions for fast modification without full-flash:[list=1][*]The patch shows at which address the bytes need to be changed. Each address is in the form: 0xYYZZZZ[*]Download the flash from address 0xYY0000 with a size of 0x10000 (use UniSiemens or other suitable software)[*]Save the downloaded block as a local file, name it sl45_YY.bin (use the actual digits instead of YY)[*]Open the file in your favourite hex editor (I use UltraEdit)[*]Navigate to address 0xZZZZ[*]Verify that the bytes to be modified have the correct value; if they don't, do not perform the patch: you might be using a different firmware version which requires a different patch or location[*]Modify the bytes as intructed in the patch[*]Save the modified flash file as sl45_YY.bin[*]Repeat the operation for any other location that needs to be modified until all the bytes have been changed. You might end up with more than one file[*]Upload the modified sl45_YY.bin file(s) to the phone at address 0xYY0000 with a size of 0x10000[/list=1]

Last edited by zdob; 12-18-2003 at 14:35.
  Reply With Quote
The Following User Says Thank You to arman68 For This Useful Post:
Old 01-30-2003, 15:16   #2 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Create new shortcut for Inbox SMS (located on the SIM card)
Firmware: SL45 v56
Author: RizaPN

* overwrite 'Profile' shortcut
* use your full-flash file

0x18E3AC : 2A 08 ==> 5A 03
0x18E3E0 : 0B 02 ==> D3 00
0x18E524 : 2A 08 2A 08 ==> 5A 03 5B 03
0x3AE412 : DA DF 94 4C ==> DA D9 EE 0A

For fast modification, if there is no full-flash yet, just download the flash from address 0x180000 with size 0x10000 and from 0x3A0000 size 0x10000 (partials). Name the first one as sl45_18.bin and the 2nd as sl45_3A.bin

Addresses to be modified from file sl45_18.bin is : and E3AC, E3E0, E524.
Address to be modified from file sl45_3A.bin is E412.

After the modification, upload sl45_18.bin to the phone at address 0x180000 with size 0x10000, and sl45_3A.bin to 0x3A0000 size 0x10000.

Last edited by arman68; 01-31-2003 at 11:55.
  Reply With Quote
The Following User Says Thank You to arman68 For This Useful Post:
Old 01-30-2003, 15:18   #3 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Create new shortcut for Outbox SMS (located on the SIM card)
Firmware: SL45 v56
Author: RizaPN

* overwrite 'Conceal ID' shortcut
* use your full-flash file

0x18E38A : 49 ==> 92
0x18E3BE : 4A 01 ==> 69 00
0x18E416 : 49 01 49 01 ==> 92 01 92 01
0x3AE308 : DA DA 04 A3 ==> DA D9 F8 0A

0x18E38A is address in the full flash file, 49 is the original value(s), and 92 is the new value(s)...

For fast modification, if there is no full-flash yet, just download the flash from address 0x180000 with size 0x10000 and from 0x3A0000 size 0x10000 (partials).
Name the first one as sl45_18.bin and the 2nd as sl45_3A.bin

Addresses to be modified from file sl45_18.bin is : E38A, E3BE, E416.
Address to be modified from file sl45_3A.bin is E308.

After the modification, upload sl45_18.bin to the phone at address 0x180000 with size 0x10000, and sl45_3A.bin to 0x3A0000 size 0x10000.

Last edited by arman68; 01-31-2003 at 11:54.
  Reply With Quote
Old 01-30-2003, 15:19   #4 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Eliminate the additional "_nnn_nnn" string when moving SMS to the archive folder
Firmware: SL45 v56
Author: RizaPN

0x39FE5C : 88 60 F0 C8 ==> FA D9 02 FF

Last edited by arman68; 01-31-2003 at 11:53.
  Reply With Quote
Old 01-30-2003, 15:21   #5 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Get access to "SIM Location" directly using front UP Arrow key
Firmware: SL45 v56
Author: RizaPN

original:

0x3B0366 : EA 20 3C 04 48 C3 EA 20
0x3B036E : 3C 04 46 FC 20 00 EA 20
0x3B0376 : 5A 04 48 C6 EA 20 82 04

modify to:

0x3B0366 : 2D 6A 48 C3 2D 68 46 FC
0x3B036E : 20 00 2D 74 48 C6 EA 20
0x3B0376 : 82 04 46 FC 21 00 2D 7E


original:

0x3B0474 : E0 0C E0 0D E0 0E DA D4 AC 70

modify to:

0x3B0474 : DA DB 3C EF 0D 02 DA DB 46 EF

Last edited by arman68; 01-31-2003 at 11:52.
  Reply With Quote
Old 01-30-2003, 15:22   #6 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Add "Send via IrDA ..." options in CardExplorer
Firmware: SL45 v56
Author: RizaPN

This patch will *overwrite* ---Help--- menu inside the Sort menu
with the new "Send via IrDA" options.

0x18A3E4 : 28 01 28 01 => 21 02 21 02 (change the text)
0x18A3FE : AE AB => A4 7D (change the function address)

Last edited by arman68; 01-31-2003 at 11:51.
  Reply With Quote
Old 01-31-2003, 11:45   #7 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Overwrite "VoiceDialling" shortcut with "Display" shortcut
Firmware: SL45 v56
Author: RizaPN

Use Left side button [+] to access VoiceDialling.

0x18E3A0 : 4E 02 --> 60 00 (shorcut Start: text)
0x18E3D4 : 4F 02 --> 60 00 (upper-right button text)
0x18E4A6 : 4E 02 4E 02 --> 60 00 60 00 (menu item text)
0x3AE3B2 : DA E6 F8 A9 --> DA D5 6A F2 (function entry-point)

It will give the access to the "Display" menu directly.

Last edited by arman68; 01-31-2003 at 11:50.
  Reply With Quote
Old 01-31-2003, 11:49   #8 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Overwrite "VoiceDialling" shortcut with "Illumination Toggle"
Firmware: SL45 v56
Author: RizaPN

Use Left side button [+] to access VoiceDialling.

0x18E3A0 : 4E 02 --> 82 00
0x18E3D4 : 4F 02 --> 82 00
0x18E4A6 : 4E 02 4E 02 --> 82 00 82 00
0x3AE3B2 : DA E6 F8 A9 --> DA DC 80 46

It can be used to assign a single button for doing Illumination Toggle as in SLCK firmwares.
  Reply With Quote
Old 02-04-2003, 12:22   #9 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Use # short button to release the key-lock
Firmware: SL45 v56
Author: RizaPN


0x3B07C4 : 1E -> 14
0x3B07C7 : 03 -> 04
0x3B07CA : 1F -> 21
0x3B07CE : DA A2 18 4C 48 40 2D 10 -> 0D 03 DA DA EC F6 0D 0F


If you want to use * instead of #, modify 0x3B07CA with 13.
For other button, use the value listed in the button code table.

* That patch also unhides a VoiceDial function * Press UP arrow key when the key is locked to activate the VoiceDial function. If you want to use another button, just modify the value in 0x3B07C4 with the listed button code.

Button Code:

5C : UPPER LEFT
05 : GREEN
01 : RED
03 : UPPER RIGHT

22 : RIGHT ARROW
20 : DOWN ARROW
21 : UP ARROW
23 : LEFT ARROW

13 : *
14 : #
15 : DIGIT 0-9
1F : LONG #

0E : LEFT SIDE +
0D : LEFT SIDE -
62 : LEFT SIDE PLAY
  Reply With Quote
Old 02-04-2003, 12:27   #10 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Use[*][GREEN] as an Illumination Toggle shortcut
Firmware: SL45 v56
Author: RizaPN


0x3AD7A4 : E6 FC 0A 00 E6 FD 36 00 -> E6 00 36 00 F3 FC 0A 00
0x3AD7AC : DA DB 00 30 48 40 3D 21 -> 47 FC 2A 00 3D 04 DA DC
0x3AD7B4 : E6 00 36 00 CC 00 -> 80 46 EA 00 04 DA


If you want to use 0[GREEN], just modify 2A (0x3AD7AE) with 30.
If you want to use #[GREEN] use 23 ...
  Reply With Quote
Old 02-04-2003, 12:29   #11 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Disable "Do you want to copy all SIM Card content to the phonebook" message when change SIM Card
Firmware: SL45 v56
Author: RizaPN


0x44EB9E : 3D -> 0D
  Reply With Quote
Old 02-04-2003, 12:35   #12 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Use[*] [0] and [#] followed by [GREEN] button as shortcuts
Firmware: SL45 v56
Author: RizaPN


0x3AD7A4 : E6 FC 0A 00 E6 FD 36 00 -> E6 00 36 00 F3 FC 0A 00
0x3AD7B2 : 2D 19 -> 2D 12

0x3B3000 : F0 ED 70 EC 2D 0B DC 4D -> E0 14 27 FC 23 00 3D 03
0x3B3008 : A9 2C 47 F2 -> DA D8 B4 E1
([#] button function)
0x3B300C : 30 00 2D 06 47 F2 -> 0D 09 29 C7 3D 03
0x3B3012 : 2A 00 2D 03 -> DA DC 80 46
([*] button function)
0x3B3016 : 47 F2 23 00 3D 02 -> 0D 04 29 C6 3D 03
0x3B301C : E0 04 DB 00 -> DA D9 62 0A
([0] button function)
0x3B3020 : E0 14 DB 00 -> E0 04 DB 00


It will assign :
[#][GREEN] as a shortcut to "Java",[*][GREEN] as a shortcut to "Illumination Toggle",
[0][GREEN] as a shortcut to "Write Message" ...

Remark: if you already apply patch : "[*][GREEN] as an Illumination Toggle shortcut" then you need to reset some addresses back to their original values.
  Reply With Quote
Old 02-04-2003, 12:38   #13 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Use LEFT Arrow key as a "SIM-Location" shortcut
Firmware: SL45 v56
Author: RizaPN

* If you already apply patch for UP Arrow as a "SIM-Location" shortcut, and want to apply this patch, please reset them back to the original values *

[font=courier new]
0x3B03B0 : EA 20 0A 05 46 FC 14 00 -> 8D 04 46 FC 15 00 EA F0
0x3B03B8 : EA 20 0A 05 46 FC 15 00 -> 0A 05 46 FC 23 00 2D 5D
0x3B0474 : E0 0C E0 0D E0 0E -> DA DB 3C EF 0D 02
0x3B047A : DA D4 AC 70 -> DA DB 46 EF
[font]
  Reply With Quote
Old 02-04-2003, 12:39   #14 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Use RIGHT Arrow key as a "Card-Explorer" shortcut
Firmware: SL45 v56
Author: RizaPN

It will overwrite the previous function (entered to the Main Menu)


0x3B0368 : 3C -> 54
0x3B0450 : F0 C4 DA E5 -> EA 00 EE 07
0x3B0454 : 24 3A EA 00 F4 07 -> DA D8 CA E1 0D 23
  Reply With Quote
Old 02-06-2003, 10:26   #15 (permalink)
Major Poster
 
Join Date: Jan 2003
Posts: 47
Member: 20543
Status: Offline
Thanks Meter: 2
Long press of left side [+] button for "Illumination Toggle" and its short press for IrDA
Firmware: SL45 v56
Author: RizaPN


0x3B04A4 : DA A2 18 4C 48 40 EA 20 -> DC 59 98 C8 A8 D8 DC 4D
0x3B04AC : F6 07 DC 59 -> D4 8C 04 00
0x3B04B0 : 98 C8 A8 D8 DC 4D -> 46 F8 EB 00 2D 03
0x3B04B6 : D4 8C 04 00 -> DA DC E8 46 ... (*)
0x3B04BA : 46 F8 EB 00 EA 30 F6 07 -> 0D 07 E0 1C E6 FD 82 00
0x3B04C2 : E0 1C DA F0 -> DA E6 98 F1
0x3B04C6 : 50 83 EA 00 -> DA DC 80 46
0x3B04CA : D6 07 -> 0D 0B


* Known bug : IrDA will also toggled for long-press ...
If you want to apply this patch withour IrDA capability, use :


0x3B04B6 : D4 8C 04 00 -> CC 00 CC 00 ... (without IrDA)
  Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
thread Thread Starter Forum Replies Last Post
SLIKv56: Flash Patching (3rd part) ... rizapn x4x, x5x Flashpatching 2900 12-24-2007 10:51
TOC for Sticky: SLIKv56: Flash patches. StevieRay x4x, x5x Flashpatching 17 10-15-2005 09:26
"Bugs" in Thread SLIKv56: Flash patches trustkill Siemens-Benq Flash Patching 2 07-13-2004 08:33
M55 Flash Patch -Anyone´s got full modded flashes ready for flash--?? Uvedovle x4x, x5x Flashpatching 0 04-27-2004 11:32
Where can i download riza's SLIKv56: Flash Patching (3rd part) Gabriel_he Siemens-Benq Flash Patching 2 04-04-2003 03:20

 



All times are GMT +1. The time now is 10:04.



Powered by Searchlight © 2019 Axivo Inc.
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
- GSM Hosting Ltd. - 1999-2017 -
Page generated in 0.43286 seconds with 9 queries

SEO by vBSEO