Quote:
Originally Posted by mattcool  Till now there's no easy and permanent solution for the new custom Firmware (F****dware) Huawei E1732 Data card (Idea Cellular, India).All the solutions requires the use of JTAG Boxes or there is some other temporary stuff like Sola GSM Calculator.Both solutions are worthless since the first is out of reach for most of us and the other is only a Temporary solution.There is only one unlocked E1732 RAW dump available for download and that too for JTAG based Flashers.
I downloaded the raw dump analysed it under revskills and was able to retrieve the partition info which is as below:
0:MIBIB
---------------------------------------------------------
Page: 0x0
Size: 0xA
Address: 0x00000000 - 0x00140000
Block: 0x00000000 - 0x00000280
Flash: 0x00FFFFFF
0:SIM_SECURE
---------------------------------------------------------
Page: 0xA
Size: 0x6
Address: 0x00140000 - 0x00200000
Block: 0x00000280 - 0x00000400
Flash: 0x00FFFFFF
0:QCSBL
---------------------------------------------------------
Page: 0x10
Size: 0x4
Address: 0x00200000 - 0x00280000
Block: 0x00000400 - 0x00000500
Flash: 0x00FFFFFF
0:OEMSBL1
---------------------------------------------------------
Page: 0x14
Size: 0x6
Address: 0x00280000 - 0x00340000
Block: 0x00000500 - 0x00000680
Flash: 0x00FFFFFF
0:OEMSBL2
---------------------------------------------------------
Page: 0x1A
Size: 0x6
Address: 0x00340000 - 0x00400000
Block: 0x00000680 - 0x00000800
Flash: 0x00FFFFFF
0:AMSS
---------------------------------------------------------
Page: 0x20
Size: 0x86
Address: 0x00400000 - 0x014C0000
Block: 0x00000800 - 0x00002980
Flash: 0x00FFFFFF
0:FOTA
---------------------------------------------------------
Page: 0xA6
Size: 0x2
Address: 0x014C0000 - 0x01500000
Block: 0x00002980 - 0x00002A00
Flash: 0x00FFFFFF
0:EFS2
---------------------------------------------------------
Page: 0xA8
Size: 0x34
Address: 0x01500000 - 0x01B80000
Block: 0x00002A00 - 0x00003700
Flash: 0x00FFFFFF
0:MMC
---------------------------------------------------------
Page: 0xDC
Size: 0x312
Address: 0x01B80000 - 0x07DC0000
Block: 0x00003700 - 0x0000FB80
Flash: 0x00FFFFFF
0:OEMINFO
---------------------------------------------------------
Page: 0x3EE
Size: 0x11
Address: 0x07DC0000 - 0x07FE0000
Block: 0x0000FB80 - 0x0000FFC0
Flash: 0x00FFFFFF
---------------------------------------------------------
however there remains a problem with the above mentioned data, since I absolutely have no Idea about the Page sum and page size for the device
all the partition offsets are wrong.If someone could help me with that I will be able to extract the independent partitions of exact size and boundary.
Finally I can compare it with the factory locked Firmware dump and come up to a plausible solution.I have tried to contact Nirav on this matter but there's no response from his side.If you have any information regarding the topic please mention here. |
by rahul_rocks
Idea 1732 3g 7.2 modem successfully unlocked with riff
IDEA 1732 3G 7.2 MODEM SUCCESSFULLY UNLOCKED WITH RIFF
DLL MODEL SELECTED AS E153U
PINOUT ALSO SAME AS E153U WHICH IS GIVEN IN RIFF JTAG MANAGER
AND DUMP FILE USED IN THE LINK GIVEN BELOW
173u unlocked.rar - 4shared.com - online file sharing and storage - download
SPECIAL THANKS TO JAGRITISHARMA FOR THE DUMP
AND TO LALIT GUPTA FOR HELPING ME OUT TO DO THIS SUCCESSFULLY
[9/2/2011 12:43:27 PM] Open serial port...OK
[9/2/2011 12:43:27 PM] Connecting to the RIFF Box...OK
[9/2/2011 12:43:27 PM] Firmware Version: 1.26, JTAG Manager Version: 1.29
[9/2/2011 12:43:27 PM] Selected Resurrector: [USB Modem E153U]
[9/2/2011 12:43:27 PM]
[9/2/2011 12:43:27 PM] Connecting to the dead body...OK
[9/2/2011 12:43:27 PM] Detected dead body ID: 0x301C00E1 - IGNORED!
[9/2/2011 12:43:27 PM] Set I/O Voltage reads as 3.01V, TCK Frequency is RTCK
[9/2/2011 12:43:27 PM] Adaptive Clocking RTCK Sampling is: [Sample at MAX]
[9/2/2011 12:43:27 PM]
[9/2/2011 12:43:27 PM] Resurrection sequence started.
[9/2/2011 12:43:27 PM] Establish communication with the phone...OK
[9/2/2011 12:43:27 PM] Initializing internal hardware configuration...OK
[9/2/2011 12:43:27 PM] Uploading resurrector data into memory...OK
[9/2/2011 12:43:27 PM] Starting communication with resurrector...OK
[9/2/2011 12:43:27 PM]
[9/2/2011 12:43:27 PM] Detected an Initialized FLASH1 Chip ID: 0x00AD/0x00A1 (128MB)
[9/2/2011 12:43:27 PM]
[9/2/2011 12:43:27 PM] Writting FLASH1 memory from 0x00000000 to 0x07FFFFFF
[9/2/2011 12:43:27 PM] ERROR: Timeout while waiting for DCC Loader response. Trying to recover...FAILED
[9/2/2011 12:43:27 PM] ERROR: Failed due to multiple communication errors. Terminating at 0x05160000
[9/2/2011 12:43:27 PM] [FINISH OPERATION_ID = DCC_WRITE_MEMORY]
[9/2/2011 12:43:41 PM] [START OPERATION_ID = DCC_WRITE_MEMORY]
[9/2/2011 12:45:32 PM] Open serial port...OK
[9/2/2011 12:45:32 PM] Connecting to the RIFF Box...OK
[9/2/2011 12:45:32 PM] Firmware Version: 1.26, JTAG Manager Version: 1.29
[9/2/2011 12:45:32 PM] Selected Resurrector: [USB Modem E153U]
[9/2/2011 12:45:32 PM]
[9/2/2011 12:45:32 PM] Connecting to the dead body...OK
[9/2/2011 12:45:32 PM] Detected dead body ID: 0x301C00E1 - IGNORED!
[9/2/2011 12:45:32 PM] Set I/O Voltage reads as 3.00V, TCK Frequency is RTCK
[9/2/2011 12:45:32 PM] Adaptive Clocking RTCK Sampling is: [Sample at MAX]
[9/2/2011 12:45:32 PM]
[9/2/2011 12:45:32 PM] Resurrection sequence started.
[9/2/2011 12:45:32 PM] Establish communication with the phone...OK
[9/2/2011 12:45:32 PM] Initializing internal hardware configuration...OK
[9/2/2011 12:45:32 PM] Uploading resurrector data into memory...OK
[9/2/2011 12:45:32 PM] Starting communication with resurrector...OK
[9/2/2011 12:45:32 PM]
[9/2/2011 12:45:32 PM] Detected an Initialized FLASH1 Chip ID: 0x00AD/0x00A1 (128MB)
[9/2/2011 12:45:32 PM]
[9/2/2011 12:45:32 PM] Resuming write FLASH1 memory from 0x00000000 to 0x07FFFFFF on 0x05160000
[9/2/2011 12:45:32 PM] Completed in 00:01:49.281 (Average Transfer Rate: 1236.88 kB/s)