CFP Commands Uses

[cellz]

Lets Discuss besides whats in the help file what other commands are there for cfp.exe



What steps can we use to clear mep.

What are some useful address ranges

For those that don't know what CFP is its blackberry command line programmer

[TECNICELL2007]

ok here are the basic commands
with a folder cfp
either be left as cfp or rename a loader

text entered in the following

:START
loader -u INFO
pause
GOTO exit

after writing this in the page of text
change the extention .txt to .bat
this command is to do a reading of blackberry

example:

loader -u INFO
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

Connecting to Bootrom: Connected

[ Uploading RAM Image 0x1001F77C ] [############## 100 ##############]

Device Info:
PIN: 3280554a

Bootrom Version: 5.6.0.37
Hardware ID: 0x0C001404 RIM BlackBerry Device
HW ID Override: None
Metrics Version: 6.12
Build Date: Sep 30 2009
Build Time: 13:26:21
Build User: absadmin
Security: Enabled
Supported Options: 0x00000005
Drivers: 0x00000004
Processor: 0x00010002
LDR Blocks: 0x0C00B030
Bootrom Size: 0x00020000
External MCT/HWV: Enabled
Boot Mode: N/A
Boot OS Count: N/A
HWV:
Board Revision 0001 - 0x0B
CPU Version 0002 - 0x90
SW Compatibility 0003 - 0x02
POP Revision 0004 - 0x10
Power Mgt Hardware 0007 - 0x30
POP Security 000B - 0x01


Mem Config Table (ver 1.19):
Flash Chip: blocks 0-2000, Chip 0, Sub 0
Bootrom: blocks 0-0
OS Dynamic: blocks 2-????
FS Dynamic: blocks ????-1919
Modem EFS: blocks 1920-1983, total = 64
OS NV: blocks 1984-2000, total 17
CRC: 0xDAEBCC9B


Mem Config Table (ver 1.16) (actual):
Flash Chip: blocks 0-2000, Chip 0, Sub 0
Bootrom: blocks 0-0
OS Dynamic: blocks 2-????
FS Dynamic: blocks ????-1919
Modem EFS: blocks 1920-1983, total = 64
OS NV: blocks 1984-2000, total 17
HWV Entry: 0018 - 0003
CRC: 0xEA4AD3B3

Flash:
Number of chips: 1
Flash ID: NAND blocks 0-2020
Device ID: 68
Vendor ID: 236
Version ID: 33
Total Size: 252.6 MB

Memory Map:
NAND Blocks: 2021 * 128 Kb
RAM Base: 0x10000000
IRAM Base: 0x0C000000
OS Range: 2 - 140

File System:
Memory Map:
141 - 1919
Sectors: 1779

Branding:
VendorID: 303

OS Version: 4.2.0.250
Hardware ID: 0x0C001404 RIM BlackBerry Device
Metrics Version: 3.16
FS Code Version: 10.0.0.0
FAT Code Version: 2.32
Package Version: "4.2.0.250"
Build Date: Mar 4 2010
Build Time: 19:01:13
Build User: absadmin
SV Number: 22
OS Address: 0x10000000-0x11155BD7
App Start: 0x10003EE0

RAM usage: 0x14B6FFFC-0x15BFFFFF
IRAM End: no IRAM!
DSP ROM2 Address: *not present*
OS Extended Addr: 0x00000000
LDR Blocks: 0x102A0AB0

API Checksum: 0x00000000
JumpTable (<3): 0x00000000
JumpTable (>2): 0x00000000

Radio Code: Eltron5 radio code linked
OS API Version: 119.62
STP Protocol Ver: 5.185.4 (release OS)

HWV:
Board Revision 0001 - [0x01 - 0xFF], 0x01
POP Revision 0004 - [0x00 - 0xFF], 0x01
CPU Version 0002 - [0x00 - 0x8B], 0x01
CPU Version 0002 - [0x8D - 0xFF], 0x01
SW Compatibility 0003 - [0x02 - 0x02], 0x01
Power Mgt Hardware 0007 - [0x03 - 0xFF], 0x01
POP Security 000B - [0x00 - 0xFF], 0x01
WTE supported 003C - [0x01 - 0xFF], 0x00
VClick Hardware 0018 - [0x00 - 0xFF], 0x00

Version Table:
OS API Version: 119.62
STP protocol version: 5.185.4
BlockFS API Version: 10.0.0.0
USB driver version: 01.07
Bugdisp RTAS key: 1.0
STP RTAS key: 1.0
NVSIG RTAS key: 1.0
Block map version: 2.13
WLAN radio version: 3.0.1.3000
App:
Version: 5.0.2.38 (0x05000226)
Metrics Version: 1.6
Build Date: Mar 4 2010
Build Time: 19:24:40
Build User: RIM
Memory Map: 0x10003EE0-0x102A0AAF
App c_main: 0x101D6178
API Checksum: 0x00000000
JumpTable (<3): 0x00000000
JumpTable (>2): 0x00000000
AppFSVersion: 3.0.0.0
AppFSSize: 0x3200000
OS API Version: 119.62
RAM Map: 0x13270000-0x14B70000
IRAM Map: Unused
App Type: JVM




Done.

[TECNICELL2007]

for the function of the loader l
to let in nal
application is not linked
is the following command

loader-u load MFI/MFI-20939-016

would look like
check that says mfi, mfi is the folder that corresponds
C: \ MML \ HHFiles
The next serious comans

: START
loader-u load MFI-24380-014
pause
GOTO exit

each model is different mfi
sel deve so the correct mfi put signal in order to nal

example:

loader -u load MFI-24380-014
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

Connecting to Bootrom: Connected

[ Writing 0x00000055 ] [############## 100 ##############]
Done.

[TECNICELL2007]

Here are the commands of cfp 3.9.0.165

RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

CFP Usage
=========
CFP [-u<port>] [-g<GUID>] [-IG] [-W<password>] [-NP] [-FS] [-V<verbosity>] [-T <max connect timeout>] [-C <max command timeout>] <command>

-U<port> specifies the USB port (e.g. -U4 specifies USB port 4)
Configuration with USBPortMapper.exe is required.
-G<GUID> specifies the device GUID. Cannot be combined with -U
-IG specifies that cfp will ignore the device GUID when connecting
to a device. Cannot be used with -U or -G options.
-W<password> specifies the device password. If a password is required, but
not provided, the user will be prompted to enter the password.
-NP specifies that the operation should only procede if there is NO
password. The operation will abort if a password is set.
-FS specifies that only a full speed RAMImage may be uploaded.
-V<verbosity> specifies the level of information chatter. If ,<filename> is
specified, all output other than the progress will be sent to the
specified file.
-T<max connect timeout> specifies a maximum conection timeout in ms.
-C<max command timeout> specifies a maximum command timeout in ms.

All of the above are optional.

<command> is one of HELP, INFO, FLASHINFO, FILEINFO, LOAD, SAVEFS, CSAVEFS
WIPE, ERASE, READ, CREAD, WRITE, HIS
HOS, USBMS, NUKE, FRESH, HASHBOOTROM, PATRIOT,
GETLOG.



Where:
------
The CFP command is used to load firmware and
assist RIM internal developers.

Use CFP HELP <command> for more information.

[TECNICELL2007]

for ease of us and not doing command text in multiple folders you upload this program to provide
test all commands
crear con autoload.rar - 4shared.com - online file sharing and storage - download

[TECNICELL2007]

this can otherwise saver for each command is executed as

loader -u help help

RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

HELP Usage
==========
HELP [<command>]



Where:
------
<command> is the name of a command to get help for.



Description:
------------
The HELP command invokes the built-in help system. With no options
a generic help message is produced. Help for a specific command can
be obtained by specifying it as an option.

If the output is not redirected to a file, the help system uses a
built-in paging system. Press any key at the <MORE> prompts.



Examples:
---------
To get help on the LOAD command, try:
CFP HELP LOAD
To get this help page, type:
CFP HELP HELP

[TECNICELL2007]

command info here

loader -u help info

RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

INFO Usage
==========
INFO



Description:
------------
The INFO command extracts and then displays a wealth of information
about the device.



Examples:
---------
The following command will display all known information about a device:
CFP INFO

[cellz]

Thanks but this info is all common anything else useful for clear mep after you load mfi file and are at application linked screen then what?

Old MML Says phone still RTAS Enabled so how to deactivate, or how to remove with cfp.

Tried writing blank mep file to phone does not work with address provided 0x00000002

Address 0x00000000 Is security protected.

[COVVA]

@Tecnicell

This commands offset are defaults cfp....

Imei ..mep is inside Samsung flash memory.. .
------------------------------------------------------------------

To load mep and Vsm --- blackberry is in mode nal and "no Boot" to this proccess..

This 100%% tested in BB old models to clear mep Mep blank is used and other mepreset
therefore--

Mep_blank no have references numbers so sooo the question is...

If blackberry no boot to load mep_blank so what commands or instruction used??

I need colaboration from alls if something have jtagfinder please:

Post here pinout jtag: 8520 8900 9700 9800 Thanks to alls for apposts

[COVVA]

I suggest search comand to read/wrte Csavefs--

[GuilleC_PMA]

Originally Posted by COVVA

@Tecnicell

This commands offset are defaults cfp....

Imei ..mep is inside Samsung flash memory.. .
------------------------------------------------------------------

To load mep and Vsm --- blackberry is in mode nal and "no Boot" to this proccess..

This 100%% tested in BB old models to clear mep Mep blank is used and other mepreset
therefore--

Mep_blank no have references numbers so sooo the question is...

If blackberry no boot to load mep_blank so what commands or instruction used??

I need colaboration from alls if something have jtagfinder please:

Post here pinout jtag: 8520 8900 9700 9800 Thanks to alls for apposts

See this for Blackberry 8900

[Mr_F10ch3]

Originally Posted by COVVA

I suggest search comand to read/wrte Csavefs--

im able to read CSAVEFS but i can't write ever i try i get "cannot write encrypted data", as u can see data is encrypted....

C:\>cfp csavefs 8520csavefs
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

Connecting to Bootrom: Connected

[                   Reading 0x000007C0 ] [############## 100 ##############]
Done.


C:\>cfp fileinfo 8520csavefs
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited



FILE '8520csavefs':
File System Image:
    Sectors Loaded:    1871
       Sector Size:    131072
   FS Code Version:    10.0.0.0
   App FS Code Ver:    3.0.0.0
       Hardware ID:    0x8C000F03
    FS Compat info:    10.x.x.x
         Encrypted:    yes

[Mr_F10ch3]

This is another from 9800

C:\>cfp csavefs 9800csavefs
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited

Connecting to Bootrom: Connected

[                   Reading 0x000007C5 ] [############## 100 ##############]
Done.


C:\>cfp fileinfo 9800csavefs
RIM Wireless Device Command-Line Programmer Version 3.9.0.165
Copyright 2010 Research In Motion Limited



FILE '9800csavefs':
File System Image:
    Sectors Loaded:    1866
       Sector Size:    262144
   FS Code Version:    10.0.0.0
   App FS Code Ver:    3.0.0.0
       Hardware ID:    0x05001807
    FS Compat info:    10.x.x.x
         Encrypted:    yes

[Mr_F10ch3]

1 ALGO detected SHA-512 [Compresion] % Offset 0xEA7BF6

[Celhack]

Data is crypted when save file, 9800csavefs is only file name. A diferent history is while cfp is reading data, data is not crypted yet.