1st in the world solution to repair unrepairable BB5 phones (SX4 failed) - GSM-Forum

karwos · 12-22-2007, 19:28

Hello
After release SX4 auth in my software, many persons contacted me and reported that simply SX4 auth not work.
What is SX4 auth, read more please here:
http:///vbb/showthread.php?t=481581
This solution was tested and prooved to work in E50, 6300, N80, etc, and phone s was 100% repairable...
But theres avaiable on market some amount of BB5 phones which simply CANT BE AUTHORIZED even using ORIGNAL Phoenix SW and PK-1 dongle and SX-4 card!!! Auhtorization simply "fails", same with other SW (jaf: error receiving data from server step2, UB: Step1 error, My sw: Card failure) - i just received in my hands this way fuked 3250 (more: http:///vbb/showpo...4&postcount=29).

But, as always, Nokia leaved big security hole...
You can repair all this phones even WITHOUT using SX-4 authorization PROCESS!
How?
Simply.

Get UFS+HWK.
Use RdCert option, and in example of RM-38 this fille will be readen from phone:
Rm-38_357934000834936_2007-12-22185230_NPCCmt.bin
Make copy of this file.
Open file and fill it with same FFFFFFFFFFFFFFFFF.... (0x184 bytes of 0xFF) write it back to phone. It will boot up BUT IMEI will be damaged. Dont worry.

NOW you can write FULL pm including RF and Energy Calibration settings! Phone will not even check the SX-4 auth status!!!

Same way you can repair downgraded phones, without even re-flashing it! Just erase NPC cert, patch the certificate using any SW, reboot phone, and that's it!

After writing PM just write back original NPC.
Tested with "unrepairable" even with Original NMP software 3250 - now phone works ok, no resets.

PS. as long as FlashBus is not yet implemented in my SW, all this steps you need do it yourself. In other way it would be just "one click" and your RF+EMC+DOWNGRADE could be repaired in 5 seconds

BR,
karwos

karwos · 12-22-2007, 19:33

PS2. You can also downgrade this way new security phones. Just flash phone (without even checking "downgrade") and then do above steps.

luskao · 12-22-2007, 19:35

Best project in the last months for sure. Programmer of the year Karwos!! Thanks for your great work

BR

Luskao

SALIMUS · 12-22-2007, 19:41

yes great holl found by karwos
thanks for info sir
keep it up
wbr

HONEY · 12-22-2007, 20:20

Great work bro ..

BR.

MACKIE · 12-22-2007, 20:28

Hehe(c)Crew

Keep Up Good Work My Friend..

Regards
Mackie

GSMSERVE · 12-22-2007, 20:29

Very good update mr karwos keep it up.

kaligola · 12-22-2007, 20:30

nice and really good kawros

paullovinicius · 12-22-2007, 22:47

WoW... Karwos is the Dejan's litle brother

Thanks Karwos!
I(and others friends) are waiting for a good seller in Brazil!

kcgckc2002 · 12-23-2007, 07:05

Quote:

PS. as long as FlashBus is not yet implemented in my SW, all this steps you need do it yourself

& why dont you implement it then???

(dongle inside the box, w/ quality cables supporting tx2 line, & forced localmode/testmode)

w/ special features, like your software able to function like nokia pc suite via usb than using pc suite that is package from phone itself???

& umm... dont forget security...... its really sad whenever a good software being cracked

cbz_4383 · 12-23-2007, 09:16

nice one karwos.
damage imei and bypass authorizetion without any tools.

its good idea.

gsm-decode · 12-23-2007, 10:11

Yeah
another Box in the market sooon

Vote Karwos

Good work man

karwos · 12-23-2007, 11:34

Quote:

Originally Posted by kcgckc2002

& why dont you implement it then???

(dongle inside the box, w/ quality cables supporting tx2 line, & forced localmode/testmode)

w/ special features, like your software able to function like nokia pc suite via usb than using pc suite that is package from phone itself???

& umm... dont forget security...... its really sad whenever a good software being cracked

Sure, if i would have own box with own flashbus then yes i would implement one-button-repair

who knows

gbluez · 12-26-2007, 09:52

@Karwos
Thanks for the cool clue

So, is it gona be like this?

p.s:
phone is working OK with this condition.

br

UB_User · 12-26-2007, 10:04

What About the 6233 IMEI - 123456******* there is a solution now about this?????????

12-22-2007, 19:28	#1 (permalink)
karwos No Life Poster Join Date: Feb 2005 Location: Poland Age: 34 Posts: 4,943 Member: 117496 Status: Offline Sonork: 100.83919 Thanks Meter: 22,689	1st in the world solution to repair unrepairable BB5 phones (SX4 failed) Hello After release SX4 auth in my software, many persons contacted me and reported that simply SX4 auth not work. What is SX4 auth, read more please here: http:///vbb/showthread.php?t=481581 This solution was tested and prooved to work in E50, 6300, N80, etc, and phone s was 100% repairable... But theres avaiable on market some amount of BB5 phones which simply CANT BE AUTHORIZED even using ORIGNAL Phoenix SW and PK-1 dongle and SX-4 card!!! Auhtorization simply "fails", same with other SW (jaf: error receiving data from server step2, UB: Step1 error, My sw: Card failure) - i just received in my hands this way fuked 3250 (more: http:///vbb/showpo...4&postcount=29). But, as always, Nokia leaved big security hole... You can repair all this phones even WITHOUT using SX-4 authorization PROCESS! How? Simply. Get UFS+HWK. Use RdCert option, and in example of RM-38 this fille will be readen from phone: Rm-38_357934000834936_2007-12-22185230_NPCCmt.bin Make copy of this file. Open file and fill it with same FFFFFFFFFFFFFFFFF.... (0x184 bytes of 0xFF) write it back to phone. It will boot up BUT IMEI will be damaged. Dont worry. NOW you can write FULL pm including RF and Energy Calibration settings! Phone will not even check the SX-4 auth status!!! Same way you can repair downgraded phones, without even re-flashing it! Just erase NPC cert, patch the certificate using any SW, reboot phone, and that's it! After writing PM just write back original NPC. Tested with "unrepairable" even with Original NMP software 3250 - now phone works ok, no resets. PS. as long as FlashBus is not yet implemented in my SW, all this steps you need do it yourself. In other way it would be just "one click" and your RF+EMC+DOWNGRADE could be repaired in 5 seconds BR, karwos

12-26-2007, 09:52	#14 (permalink)
gbluez No Life Poster Join Date: Jul 2004 Posts: 11,049 Member: 73565 Status: Offline Thanks Meter: 5,062	@Karwos Thanks for the cool clue So, is it gona be like this? p.s: phone is working OK with this condition. br Last edited by gbluez; 06-30-2011 at 19:42.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
1st in the world solution to repair unrepairable BB5 phones (SX4 failed)	karwos	Multi-Box	29	04-26-2009 17:21
1st in the world solution 707sc2 07 2008 1st tested and unlocked in the phils by spt	cetech	SPT BOX	8	09-22-2008 12:27
Infinity box : First in the World Solution to repair "BAD SOFTWARE" in Chinese phones	InfinityHelp	Main Sales Section	0	08-16-2008 12:02
26-12-2007 Absolutly 1st in the world unlock solution for Nokia 1650!	GSMtricks	Multi-box LITE	4	12-27-2007 02:53

12-22-2007, 19:33	#2 (permalink)
karwos No Life Poster Join Date: Feb 2005 Location: Poland Age: 34 Posts: 4,943 Member: 117496 Status: Offline Sonork: 100.83919 Thanks Meter: 22,689	PS2. You can also downgrade this way new security phones. Just flash phone (without even checking "downgrade") and then do above steps.

12-22-2007, 19:35	#3 (permalink)
luskao Product Supporter Join Date: Sep 2004 Age: 39 Posts: 5,993 Member: 81703 Status: Offline Thanks Meter: 1,332	Best project in the last months for sure. Programmer of the year Karwos!! Thanks for your great work BR Luskao

12-22-2007, 19:41	#4 (permalink)
SALIMUS No Life Poster Join Date: Feb 2004 Location: ALGERIA Posts: 2,209 Member: 54116 Status: Offline Thanks Meter: 218	yes great holl found by karwos thanks for info sir keep it up wbr

12-22-2007, 20:20	#5 (permalink)
HONEY No Life Poster Join Date: Apr 2000 Location: India, China Posts: 1,792 Member: 44158 Status: Offline Sonork: 100.64344 Thanks Meter: 143	Great work bro .. BR.

12-22-2007, 20:28	#6 (permalink)
MACKIE No Life Poster Join Date: Jan 2003 Location: Prijepolje-Durmitor, Serbia And Montenegro Age: 46 Posts: 1,287 Member: 19987 Status: Offline Thanks Meter: 27	Hehe(c)Crew Keep Up Good Work My Friend.. Regards Mackie

12-22-2007, 20:29	#7 (permalink)
GSMSERVE No Life Poster Join Date: Sep 2004 Location: Setif ALGERIA Age: 44 Posts: 817 Member: 80990 Status: Offline Sonork: 100.1583974 Thanks Meter: 312	Very good update mr karwos keep it up.

12-22-2007, 20:30	#8 (permalink)
kaligola No Life Poster Join Date: Mar 2006 Location: lost in a supermarket Posts: 830 Member: 239318 Status: Offline Thanks Meter: 51	nice and really good kawros

12-22-2007, 22:47	#9 (permalink)
paullovinicius No Life Poster Join Date: Jul 2005 Age: 37 Posts: 754 Member: 164786 Status: Offline Thanks Meter: 56	WoW... Karwos is the Dejan's litle brother Thanks Karwos! I(and others friends) are waiting for a good seller in Brazil!

12-23-2007, 09:16	#11 (permalink)
cbz_4383 Freak Poster Join Date: Jul 2007 Location: ********** Age: 36 Posts: 271 Member: 567351 Status: Offline** Thanks Meter: 40	nice one karwos. damage imei and bypass authorizetion without any tools. its good idea.

12-23-2007, 10:11	#12 (permalink)
gsm-decode No Life Poster Join Date: Dec 2003 Location: SC610108CFU S-CLASS Age: 44 Posts: 1,505 Member: 47441 Status: Offline Thanks Meter: 14	Yeah another Box in the market sooon Vote Karwos Good work man

12-26-2007, 10:04	#15 (permalink)
UB_User Freak Poster Join Date: Dec 2007 Location: ..::ShArJaH::.. Posts: 142 Member: 662685 Status: Offline Thanks Meter: 27	What About the 6233 IMEI - 123456******* there is a solution now about this?????????