Nokia E7-00, X7-00, E6-00 Downgrade to Anna Firmware:

[..::Angel::..]

بِسْمِ اللّهِ الرَّحْمنِ الرَّحِيمِ

Hi, I saw many users stuck with these Nokia phones in downgrading firmware.. Don't have working ENO for 25.xx.xx Anna Firmwares? Don't worry!

Here is the working solution for them:

1. Backup RPL and Full PM
2. Full Erase Phone Flash chip
3. Write Flash with 25.xx.xx Anna version - CORE, ROFS3, ROFS2 and UDA - NO LOCAL MODE ON SCREEN ??? :O) Go for next step ...
4. Power On phone in NORMAL MODE, select OVI Suite in phone
5. Write Full PM Backup - (YES, PM BACKUP - NOT RPL) - SIMLOCK will remain corrupted without NPC DATA, but PM Backup written to phone
6. Write RPL Backup
7. Authorize Phone via ATF Network
8. Again Power On phone in NORMAL MODE, if phone stuck on "Nokia Logo" Reconnect Battery and Power On again - this time it will be powered on.
9. Go to PM/PP tab, select "StandAlone SX4 AUTH" Write RM-1.pm or RM-xxx.pm of your phone or the backup - it doesn't matter.
10. Click SD/CMLA KEY check button. CMLA KEY would be absent, but Anna Firmware can work without it. Phone back to normal and downgraded from Belle to Anna. :O)

Nokia BB5 SL3 Firmware downgrade via USB cable:

Trust ATF...

[maroc11]

Hi,

yes it's true. I did with N8.

But if you want upgrade again to Belle....NO WAY

I tried many times.

Maybe, Belle needs CMLA Key to work

br

[rumenshom]

thanks for this tread.

but

7. Again Power On phone in NORMAL MODE, if phone stuck on "Nokia Logo" Reconnect Battery and Power On again - this time it will be powered on.

for disconnect battery need to open this phone, and last time i got same problem with this phone, becoz it was new pone and i had to disassemble this phone and did with fbus via u.

[..::Angel::..]

Originally Posted by maroc11

Hi,

yes it's true. I did with N8.

But if you want upgrade again to Belle....NO WAY

I tried many times.

Maybe, Belle needs CMLA Key to work

br

Hi,

For N8, C7 is no problem, since we have ENO for 25.xx.xx
but if you will write ENO in E7-00, X7-00 - they end-up on Vibrate problem.

@rumenshom

Yeah, I kinda remember that... and yes, this requires disassemble of phone.
In case phone stuck on Nokia logo and its not going further even after waited
few minutes or after reset.

BR

[maroc11]

Originally Posted by rumenshom

thanks for this tread.

but



for disconnect battery need to open this phone, and last time i got same problem with this phone, becoz it was new pone and i had to disassemble this phone and did with fbus via u.

Just press Power button 8 seconds- they vibrates 2 times
Release buttom and press again until vibrate one time- release button

br

[maroc11]

Originally Posted by ..::Angel::..

Hi,

For N8, C7 is no problem, since we have ENO for 25.xx.xx
but if you will write ENO in E7-00, X7-00 - they end-up on Vibrate problem.

@rumenshom

Yeah, I kinda remember that... and yes, this requires disassemble of phone.
In case phone stuck on Nokia logo and its not going further even after waited
few minutes or after reset.

BR

Hi again
i tried with ENO ( tree version : 148;161;162) and without.

Tried all Belle and Anna version (and before) with USB and FBUS

I did like you said in first post, but have another way..
Just flashing Scandinavian 11.5 and can flash any version you want (except Belle)

Finded in Navifirm "quality Assurance" 11.5
RM-596_011.005_06.01_Scandinavia_79.92_prd.rofs2.fpsx
RM-596_011.005_79.92_prd.core.fpsx
RM-596_011.005_02.01_truetest_79.92_prd.rofs3.fpsx

This 3 files

maybe this help our community

I HAVE SUCESS ONLY WITH ATF

br

[debeliamark]

Originally Posted by ..::Angel::..

.
.
1. Backup RPL and Full PM

1. A. Erase Flash ( or just NPC ) and go to next point ...

Originally Posted by ..::Angel::..

2. Write Flash with 25.xx.xx Anna version - CORE, ROFS3, ROFS2 and UDA -

[rumenshom]

Originally Posted by maroc11

Just press Power button 8 seconds- they vibrates 2 times
Release buttom and press again until vibrate one time- release button

br

i did it, not worked

[.::SoFtWaRe ZoNe::.]

Hi..
Angel you always coming with very good tutorial.I like your work always.. No:1 supporter....in forum..... no doubt.

Regards,

[maroc11]

Originally Posted by debeliamark

1. A. Erase Flash ( or just NPC ) and go to next point ...

Hi
u can erase full flash, if u have full PM and RPL.

But after flash u must need write PM before RPL
Angel post#1 number 4

I erased full flash.

br

[maroc11]

Originally Posted by rumenshom

i did it, not worked

can you do "Buscheck" ?
If yes go to Navifirm and download "sacandinavian 11.5" like i posted

Flash the phone with scandinavian(not need erase flash) if you didn´t before

Then phone should be start
Flash with version u want like Anna (except Belle)

br

[rumenshom]

Originally Posted by maroc11

can you do "Buscheck" ?
If yes go to Navifirm and download "sacandinavian 11.5" like i posted

Flash the phone with scandinavian(not need erase flash) if you didn´t before

Then phone should be start
Flash with version u want like Anna (except Belle)

br

u did not get me, read this point 7 from first.

7. Again Power On phone in NORMAL MODE, if phone stuck on "Nokia Logo" Reconnect Battery and Power On again - this time it will be powered on.

for that i need to disassemble this phone and solved with fbus.

br

[maroc11]

Originally Posted by rumenshom

u did not get me, read this point 7 from first.



for that i need to disassemble this phone and solved with fbus.

br

You can do this USB via (without disassemby)
1-disconnect usb cable
2-start ATF and do "Buscheck"
3-connect now usb cable
when atf read , wait few seconds and do "SD/CMLA check"
Now phone remains in local mode(if not repeat again)
sometimes, need to disconnect usb cable and insert again when u perform next step(flash)
4- select Scandinavian 11.5 datapackage
5-flash
6- when finish, phone starts normally.

Hope this help you

br

[..::Angel::..]

Originally Posted by debeliamark

1. A. Erase Flash ( or just NPC ) and go to next point ...

Hi,

ERASE NPC DATA only doesn't work with these phones.
... must Full EraseFlash.

BR

[supermatrix]

hi
The problem of my E7 is Nokia bliking only. After falshing still same.. below is the logs...Anyone an ideas?


here the logs...
=======================================
Number of Image Files: 6
(Mass Memory File Detected)

Processing Image File :
RM-626_111.030.0609_79u_prd.core.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 13000000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 601
Entry Point: 0x0214
Page Format : -1
MAX PAGE : 0x00040000

Processing Image File :
RM-626_111.030.0609_C02.01_SEAP_79u_prd.rofs3.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 13000000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 16
Entry Point: 0x00FC
Page Format : -1
MAX PAGE : 0x00004A00

Processing Image File :
RM-626_111.030.0609_36.01_APAC_QW1_79u_prd.rofs2.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 13000000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 199
Entry Point: 0x00F4
Page Format : -1
MAX PAGE : 0x00040000

Processing Image File :
RM-626_111.030.0609_U08.01_79u.uda.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 13000000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 587
Entry Point: 0x00F4
Page Format : -1
MAX PAGE : 0x00040000

Processing Image File :
RM626_APE_ONLY_ENO_11w36_v0.037.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 6500000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 26
Entry Point: 0x0138
Page Format : -1
MAX PAGE : 0x00040000

Processing Image File :
RM-626_M019.20.emmc.fpsx
CMT Type : BB5
CMT Algorithm : XSR 1.6
Secondary Sending Speed : 650000Hz
Algorithm Sending Speed : 6500000Hz
Program Sending Speed : 13000000Hz
Message Reading Speed : 98000Hz
Number of Blocks : 6865
Entry Point: 0x01B7
Page Format : -1
MAX PAGE : 0x00040000



AUTO SELECTED DEAD USB FLASHING...

If Phone Booting does not Start in 5 Seconds,
Then Perform Steps 1, 2, 3 and 4...

1. Remove USB and Battery...
2. Insert USB.
3. Insert Battery. (Some phones boot automatically)
4. Please Power on phone shortly...

AdvanceFBox SendBootCodeEx
InitialiseBootstrap_DCT5 DIR
BootFlashMode_DCT5
READING BOOTROM

BootFlashModeDCT5Ex Succeeded First Time
SYSTEM_ID_RESPONSE_BB5 (0xC0) - 96 (0x60) bytes returned
Number of Sub Blocks 7 (0x07)
1 SYSTEM_ASIC_ID 01
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00000003
ID DWORD 1 : 00000226
ID DWORD 2 : 00010007
ID DWORD 3 : 600C1921
ID DWORD 4 : 02031104
2 EM_ASIC_ID 02
Block Length : 5 (05)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00001040
3 EM_ASIC_ID 02
Block Length : 5 (05)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 00001030
4 PUBLIC_ID 12
Block Length : 21 (15)
BB ASIC Index : 0 (00) CMT
ID DWORD 0 : 0C800019
ID DWORD 1 : 53D60344
ID DWORD 2 : 625E8897
ID DWORD 3 : 14C45DC3
ID DWORD 4 : 76349A90
5 ASIC_MODE_ID 13
Block Length : 2 (02)
BB ASIC Index : 0 (00) CMT
Mode Id : 00
6 ROOT_KEY_HASH 14
Block Length : 17 (11)
BB ASIC Index : 0 (00) CMT
Hash : 91 6F 75 21 7F 32 08 12 48 B1 5C 38 DF C8 E8 1B
7 ROM_ID 15
Block Length : 9 (09)
BB ASIC Index : 0 (00) CMT
CRC 0 : E693EF0D
CRC 1 : AC22615B

CMT Secondary Loader: C:\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\New\RAPUv11_2nd.fg
Secondary Loader Sent....

MCU_CONFIGURATION_RESPONSE_BB5:
MessageID : C1
SubBlocks : 06
1 Sub Block ID : 10 STORAGE_DEVICE_ID_BB5
Block Length : 0B
BB ASIC Index : CMT 00
Device Type : RAM 05
Device Index : 00
Manufacturer Code : 0000 -> Flash
Device ID : 0000 -> Type not in database
Extended/Fixed ID : 0000
Revision ID : 0000
2 Sub Block ID : 10 STORAGE_DEVICE_ID_BB5
Block Length : 0B
BB ASIC Index : CMT 00
Device Type : MMC 04
Device Index : 00
Manufacturer Code : FFFF -> Flash
Device ID : 0000 -> Type not in database
Extended/Fixed ID : 0000
Revision ID : 0000
3 Sub Block ID : 10 STORAGE_DEVICE_ID_BB5
Block Length : 0B
BB ASIC Index : CMT 00
Device Type : NOR 00
Device Index : 00
Manufacturer Code : 0020 ->
Device ID : 0068 -> Type not in database
Extended/Fixed ID : 0000
Revision ID : 0031
4 Sub Block ID : 10 STORAGE_DEVICE_ID_BB5
Block Length : 0B
BB ASIC Index : CMT 00
Device Type : NOR 00
Device Index : 01
Manufacturer Code : 0000 -> SPANSION
Device ID : 0001 -> Type not in database
Extended/Fixed ID : 0000
Revision ID : 0000
5 Sub Block ID : 10 STORAGE_DEVICE_ID_BB5
Block Length : 0B
BB ASIC Index : CMT 00
Device Type : MuxOneNAND 03
Device Index : 00
Manufacturer Code : 0020 ->
Device ID : 0068 -> Type not in database
Extended/Fixed ID : 0000
Revision ID : 0031
6 Sub Block ID : 35 NAND_DRIVER_VERSION_BB5
Block Length : 09
BB ASIC Index : CMT 00
Data : XSR 1.6

SearchForBootstrap_DCT5 : No Error - 0 (0x00)
Flash Descriptor
Manufacturer Code : 0020
Device ID : 0068
Extended/Fixed ID : 0000
Revision ID : 0000
Size : 40000000 (1024 MB)
VPP Info : 0000
Erase10s : 1E
Block1s : 32
BErase1s : 02
Reserved0 : 00
Reserved1 : 00
Reserved2 : 00

CMT Algorithm Loader: C:\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\New\RAPUv11_XSR17_alg.fg
Algorithm Loader Sent...

FUR_Control_AddClient_BB5() ASIC_INDEX_CMT (Ready)
FUR control Ok

START READING RPL DATA
IMEI: 354864042566613
Reading : NPC... OK!
Reading : CCC... OK!
Reading : HWC... OK!
Reading : R&D... OK!
Reading : PARTNERC... OK!

NPC CERTIFICATE INFORMATION (CMT):
IMEI : 345680424656631
PRODUCT CODE : 059C9R9
WLAN ID : 78:2E:EF:79:CB:91
BLUETOOTH ID : 78:2E:EF:79:7D:71
PUBLIC_ID : 0C80001953D60344625E889714C45DC376349A90
PAPUB_KEYS_HASH: 8EABFDA6B8A757034233978C16A93B892CE2D4FA
CCC CERTIFICATE INFORMATION (CMT):
PRODUCT CODE : 059C9R9
HWC CERTIFICATE INFORMATION (CMT):
PUBLIC_ID : 0C80001953D60344625E889714C45DC376349A90
PRODUCT CODE : 059C9R9


RPL Backup was Successful...
Plain RPL saved to:
C:\AdvanceBox Turbo Flasher\Nokia\Backup\354864042566613\3548640425666 13_40927.rpl

Pabub KEY Request
PhoneInfoRequest_BB5 (Asic Index 00 )
PHONE_INFO_RESPONSE_BB5
PAPUB_KEYS_HASH_RESP_BB5 2A
BB Asic Index : 00
CMT PAPUBKEYS HASH:
8EABFDA6B8A757034233978C16A93B892CE2D4FA
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM-626_111.030.0609_79u_prd.core.fpsx
Read Type : FIASCO_BB5_DO_NOT_READ_CERTIFICATE (01)
Sending STORE_CERTIFICATE_REQUEST_BB5 (CMT 00 only)
Certificate 1
Name : NPC
ASIC Index : CMT 0
Certificate 2
Name : CCC
ASIC Index : CMT 0
Certificate 3
Name : HWC
ASIC Index : CMT 0
Certificate 4
Name : R&D
ASIC Index : CMT 0
Certificate 5
Name : PARTNERC
ASIC Index : CMT 0
STORE_CERTIFICATE_REQUEST_BB5 : 61 05 2B 0D 4E 50 43 00 00 00 00 00 00 00 00 00 00 2B 0D 43 43 43 00 00 00 00 00 00 00 00 00 00 2B 0D 48 57 43 00 00 00 00 00 00 00 00 00 00 2B 0D 52 26 44 00 00 00 00 00 00 00 00 00 00 2B 0D 50 41 52 54 4E 45 52 43 00 00 00 00 00 3B
STORE_CERTIFICATE_REQUEST_BB5 : No Error - 0 (0x00)
ProcessPartitionInfo_DCT5...
PARTITION_INFO_REQUEST_BB5 : 64012F5F00030000020000FFFFFFFF00000005000000030000 00020014000002A40000000000040000000202B800000D1000 0000000008000000010FC800001E4800000000002700000001 2E100000105000000000000A000000013E60000000400000D9
PARTITION_INFO_REQUEST_BB5 : No Error - 0 (0x00)
StartErase_DCT5...
BlockLength : 0x57 (87)
ERASE Blocks : 0x02 (2)
0 ERASE_AREA_BB5 0x12
Block Length : 0x23 (35)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
0 : 00040000-0007FFFF
1 : 000C0000-008BFFFF
2 : 00DC0000-0FC7FFFF
3 : 2E100000-3E5FFFFF
1 FORMAT_PARTITION_BB5 0x19
Block Length : 0x2F (47)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
Format Info ID : 0x03000000
Format Info : 000000000000000A0000000000000002000000640018000000 000002000000010000000000000000

ERASE_REQUEST_BB5 : 5004120B000300000400000007FFFF120B000300000C000000 8BFFFF120B00030000DC00000FC7FFFF120B0003002E100000 3E5FFFFF54

FORMAT_REQUEST_BB5 : 5001192F00030000000003000000000000000A000000000000 00020000006400180000000000020000000100000000000000 0025

Successfully Erased...
Total blocks to write : 601
>> CMT Rootkey Hash CERT : ADA
>> CMT Rootkey Hash CERT : KEYS
>> CMT Rootkey Hash CERT : PRIMAPP
>> CMT Rootkey Hash CERT : RAP3NAND
>> CMT Rootkey Hash CERT : SOS+PMML
>> CMT Rootkey Hash CERT : SOS+DECOMP
>> CMT Rootkey Hash CERT : PASUBTOC
>> CMT Rootkey Hash CERT : PAPUBKEYS [8EABFDA6B8A757034233978C16A93B892CE2D4FA]
>> CMT Rootkey Hash CERT : GENIO_INIT
>> CMT Rootkey Hash CERT : SOS+IVE3A
>> CMT Rootkey Hash CERT : SOS*UPDAPP
>> CMT Rootkey Hash CERT : SOS*DSP0
>> CMT Rootkey Hash CERT : LDSP
>> CMT Rootkey Hash CERT : SOS*ISASW
>> CMT Rootkey Hash CERT : SOS+CORE
>> CMT Rootkey Hash CERT : SOS+ROFS1
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM-626_111.030.0609_C02.01_SEAP_79u_prd.rofs3.fpsx
StartErase_DCT5...
BlockLength : 0x16 (22)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x13 (19)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
0 : 01378000-0139FFFF
1 : 0E900000-0FC7FFFF

ERASE_REQUEST_BB5 : 5002120B000300013780000139FFFF120B0003000E9000000F C7FFFF5B

Successfully Erased...
Total blocks to write : 16
>> CMT Rootkey Hash CERT : SOS+ROFS3
>> CMT Rootkey Hash CERT : SOS+IVE3B
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM-626_111.030.0609_36.01_APAC_QW1_79u_prd.rofs2.fpsx
StartErase_DCT5...
BlockLength : 0x0E (14)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x0B (11)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
0 : 0A580000-0E8FFFFF

ERASE_REQUEST_BB5 : 5001120B0003000A5800000E8FFFFFE1

Successfully Erased...
Total blocks to write : 199
>> CMT Rootkey Hash CERT : SOS+ROFS2
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM-626_111.030.0609_U08.01_79u.uda.fpsx
StartErase_DCT5...
BlockLength : 0x0E (14)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x0B (11)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
0 : 0FC80000-2E0FFFFF

ERASE_REQUEST_BB5 : 5001120B0003000FC800002E0FFFFFCC

Successfully Erased...
Total blocks to write : 587
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM626_APE_ONLY_ENO_11w36_v0.037.fpsx
StartErase_DCT5...
BlockLength : 0x0E (14)
ERASE Blocks : 0x01 (1)
0 ERASE_AREA_BB5 0x12
Block Length : 0x0B (11)
BB ASIC Index : 0x00 CMT
Device Type : 0x03 MuxOneNAND
Device Index : 0x00
0 : 008C0000-00DBFFFF

ERASE_REQUEST_BB5 : 5001120B000300008C000000DBFFFF79

Successfully Erased...
Total blocks to write : 26
>> CMT Rootkey Hash CERT : SOS*ENO
ImagePath: C:\Program Files\Nokia\Phoenix\Products\RM-626\
ImageFilename: RM-626_M019.20.emmc.fpsx
ALG_CONF_REQUEST_BB5 : No Error - 0 (0x00)
ProcessPartitionInfo_DCT5...
PARTITION_INFO_REQUEST_BB5 : 64012F67000400FFFF0001FFFFFFFF42474148534D4D435049 3A0000000200000100010001FFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFF0000000001D1A00000000001030BFFFF00000220FF FFFFFFFFFFFFFFE0
PARTITION_INFO_REQUEST_BB5 : No Error - 0 (0x00)
Total blocks to write : 6865
ContinueFlash_DCT5 Complete
Continue Flash Complete : : No Error - 0 (0x00)
STATUS_REQUEST_BB5...
1 Sub Block ID : 15 STATUS_NAND_OK_BB5
Block Length : 0F
BB ASIC Index : 00
Device Type : 03
Device Type : 00
Num Bad Blocks : 0000000B
Additional Bad : 0000000B
Correctable ECC : 00000000
FlashInfo.RestartMode : 1

Flashing Done...
Total Flashing Time (Erase + Flashing) : 00:08:07
(Booting time is NOT Included)

Waiting for Phone to Start-Up..(Max 150 seconds)

Operation Cancelled...

Scanning USB Ports...
Operation Cancelled...

Scanning USB Ports...

================================================== ====
ERROR: Active Phone Handle was NOT DETECTED
================================================== ====

TIP: Make sure that Phone USB Connection Mode is
OVI Suite Mode
or
PC Suite Mode

================================================== ====