Siemens Service Menu - Cracked! - GSM-Forum

DarkBear · 08-01-2002, 21:05

Patch again full flash C35i/M35i v24:

; Clear Menu Acess Mask
273848 DA -> D7
273849 C1 -> 40
27384A 96 -> 03
27384B 22 -> 00
27384C 48 -> F6
27384D 40 -> 8E
27384E 2D -> 50
27384F 28 -> 36

!!!
After this patch you will need to recalculate Image CRC by my prog. Email me [email protected] & i send it to you,
with sources

!!!
Without it, you phone will'be killed soon by flash crc checker - black square...

To enter Service Menu press '#' key when you in root of menu.

prp · 08-02-2002, 00:23

Is it the same for v18?

DarkBear · 08-02-2002, 11:50

Quote:

Originally posted by prp
Is it the same for v18?

There must be same sequence of byte's in all flashes on C3x/S3x/M3x.

DA C1 96 22 48 40 2D 28

Patch it's as above, but in version's below v20 you NOT to be need to recalculate CRC, just patch it

-=Mad Fish=- · 08-02-2002, 12:39

Quote:

Originally posted by DarkBear

There must be same sequence of byte's in all flashes on C3x/S3x/M3x.

DA C1 96 22 48 40 2D 28

Patch it's as above, but in version's below v20 you NOT to be need to recalculate CRC, just patch it

Does not work! By pressing # in the main menu of nothing occurs. All has made as it is written... and nothing.

C35i v.2404.... In what a problem?

DarkBear · 08-02-2002, 12:59

Quote:

Originally posted by -=Mad Fish=-

Does not work! By pressing # in the main menu of nothing occurs. All has made as it is written... and nothing.
C35i v.2404.... In what a problem?

It's work! Check you really write flash and it's patched corretly..
check it!

-=Mad Fish=- · 08-02-2002, 14:20

Quote:

Originally posted by DarkBear

It's work! Check you really write flash and it's patched corretly..
check it!

It's work 1000% !!!

DarkBear · 08-02-2002, 14:26

Quote:

Originally posted by -=Mad Fish=-

It's work 1000% !!!

Remember it's pure hack, and it's enable all option's, may be it's not needed to some people

Now i work on little more correct patch.
It will Add 'Configuration' menu with option's checklist.

shmidt · 08-02-2002, 15:35

hi darkbear
pls can you post link to your crc calc soft?
thanks

Tarzan · 08-03-2002, 02:48

I've patched firmware v18 and re-applied it to my mobile, and it does NOT work.
Anyway, even the simple fact that you didn't post your magic file here stinks! I've got the strange suspicion that the whole thing is just a fake.

prp · 08-03-2002, 04:19

Yes it works on v18 but i don't know for what this options are used for

Please can someone explain when i enter audio monitor nothing on display

and what is Sat commands?

BufferMess · 08-03-2002, 13:34

SAT - Sim Application Tools

MaMaDx · 08-03-2002, 17:06

Hello people!
DarkBear asked me to post the new solution for NetMonitor activation. Yesterday he was unable to post this one 'cause the board was - You know...
He said that he will appear only on Monday. There is some correction in his genious work: after patching this one appears additional "Configuration" menu. Its his final variant concerning this topic.
And remember: on firmware higher than 20 You must correct Your CRC - don't forget it. Nobody wants to restore Your handy.
So check it:
In all CMS35 series You have to change:
07FF40 FF -> 00
07FF41 FF -> 00

For S35 due to firmware You'll have to patch in addition:
Sorry I can't precisely say about 5, 10 firmware but You can try to change only one field additionally:
5
083A42 2D -> 0D

10
084460 2D -> 0D

12
148454 2D -> 0D
1538A5 8F -> 8E

16
1494DE 2D -> 0D
1537CB 8F -> 8E

18
149BCC 2D -> 0D
1553D7 8F -> 8E

20, 21 (the same)
1477CC 2D -> 0D
155DB3 8F -> 8E

24
14A880 2D -> 0D
155E55 8F -> 8E

For CM35 due to firmware You'll have to patch
12
12CC02 2D -> 0D
137E99 8F -> 8E

16
12DCB4 2D -> 0D
1393D7 8F -> 8E

18
12E4CE 2D -> 0D
139B4F 8F -> 8E

20
12EE16 2D -> 0D
139F95 8F -> 8E

21
12EE16 2D -> 0D
139FBF 8F -> 8E

24
12EF9C 2D -> 0D
13A461 8F -> 8E

DarkBear · 08-04-2002, 03:53

Quote:

Originally posted by MaMaDx
Hello people!
DarkBear asked me to post the new solution for NetMonitor activation. Yesterday he was unable to post this one 'cause the board was - You know...

10x!

DarkBear · 08-04-2002, 04:13

Quote:

Originally posted by Tarzan
I've patched firmware v18 and re-applied it to my mobile, and it does NOT work.
Anyway, even the simple fact that you didn't post your magic file here stinks! I've got the strange suspicion that the whole thing is just a fake.

If you apply this -
******
Patch again full flash C35i/M35i v24:
; Clear Menu Acess Mask
******
- patch to v18 with same offsets... Xe-xe... It Must NOT Work 8)
Because different versions have different code offsets.

Use information from MaMaDx post here, for v18 & it must work. Of course only if you correctly patch file & write it in flash. Check it!

What about a "magic file"? Just a copy of InFlash CRC Checker, writen on pure C. Archive included source & console binary.
With v18 you don't needed to re-calc CRC.

Tarzan · 08-04-2002, 14:30

DarkBear:
I've searched your byte series and replaced it. I haven't used the same offset but another one. Nevertheless, it did NOT work. Anyway, MaMaDx's method works just sweet :-).
I would appreciate if you would explain your hack on a more technical level (e.g. how did you find out the hack, have you disassembled the firmware or what?).

08-01-2002, 21:05	#1 (permalink)
DarkBear Junior Member Join Date: Jan 2002 Location: RUSSIA Age: 46 Posts: 34 Member: 9048 Status: Offline Thanks Meter: 0	Siemens Service Menu - Cracked! Patch again full flash C35i/M35i v24: ; Clear Menu Acess Mask 273848 DA -> D7 273849 C1 -> 40 27384A 96 -> 03 27384B 22 -> 00 27384C 48 -> F6 27384D 40 -> 8E 27384E 2D -> 50 27384F 28 -> 36 !!! After this patch you will need to recalculate Image CRC by my prog. Email me [email protected] & i send it to you, with sources !!! Without it, you phone will'be killed soon by flash crc checker - black square... To enter Service Menu press '#' key when you in root of menu.

08-02-2002, 00:23	#2 (permalink)
prp Freak Poster Join Date: Jan 2002 Location: Bulgaria Age: 44 Posts: 161 Member: 8627 Status: Offline Thanks Meter: 4	v18? Is it the same for v18?

08-03-2002, 17:06	#12 (permalink)
MaMaDx Major Poster Join Date: Dec 2001 Location: Ukraine, Kiev Posts: 44 Member: 7723 Status: Offline Thanks Meter: 0	Another activation code Hello people! DarkBear asked me to post the new solution for NetMonitor activation. Yesterday he was unable to post this one 'cause the board was - You know... He said that he will appear only on Monday. There is some correction in his genious work: after patching this one appears additional "Configuration" menu. Its his final variant concerning this topic. And remember: on firmware higher than 20 You must correct Your CRC - don't forget it. Nobody wants to restore Your handy. So check it: In all CMS35 series You have to change: 07FF40 FF -> 00 07FF41 FF -> 00 For S35 due to firmware You'll have to patch in addition: Sorry I can't precisely say about 5, 10 firmware but You can try to change only one field additionally: 5 083A42 2D -> 0D 10 084460 2D -> 0D 12 148454 2D -> 0D 1538A5 8F -> 8E 16 1494DE 2D -> 0D 1537CB 8F -> 8E 18 149BCC 2D -> 0D 1553D7 8F -> 8E 20, 21 (the same) 1477CC 2D -> 0D 155DB3 8F -> 8E 24 14A880 2D -> 0D 155E55 8F -> 8E For CM35 due to firmware You'll have to patch 12 12CC02 2D -> 0D 137E99 8F -> 8E 16 12DCB4 2D -> 0D 1393D7 8F -> 8E 18 12E4CE 2D -> 0D 139B4F 8F -> 8E 20 12EE16 2D -> 0D 139F95 8F -> 8E 21 12EE16 2D -> 0D 139FBF 8F -> 8E 24 12EF9C 2D -> 0D 13A461 8F -> 8E Last edited by MaMaDx; 08-03-2002 at 17:37.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Siemens A50 menu key problem	zullu2004	x1x to x45/x50	1	07-04-2005 09:45
Siemens S45i menu	magnumas	x1x to x45/x50	0	10-29-2003 07:45
Tetris in Siemens Service Menu ?	Artz	x1x to x45/x50	0	08-18-2002 19:46
Andromeda Siemens Service v4.5 free for download - need to be cracked	karlo1hr	x1x to x45/x50	0	07-30-2001 15:39
N2110 and Service menu	5110	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	4	12-06-1999 19:57

08-02-2002, 15:35	#8 (permalink)
shmidt Insane Poster Join Date: Apr 2002 Location: here Posts: 79 Member: 10751 Status: Offline Thanks Meter: 0	hi darkbear pls can you post link to your crc calc soft? thanks

08-03-2002, 02:48	#9 (permalink)
Tarzan Junior Member Join Date: Jul 2002 Posts: 5 Member: 14141 Status: Offline Thanks Meter: 0	I've patched firmware v18 and re-applied it to my mobile, and it does NOT work. Anyway, even the simple fact that you didn't post your magic file here stinks! I've got the strange suspicion that the whole thing is just a fake.

08-03-2002, 04:19	#10 (permalink)
prp Freak Poster Join Date: Jan 2002 Location: Bulgaria Age: 44 Posts: 161 Member: 8627 Status: Offline Thanks Meter: 4	Yes it works on v18 but i don't know for what this options are used for Please can someone explain when i enter audio monitor nothing on display and what is Sat commands?

08-03-2002, 13:34	#11 (permalink)
BufferMess No Life Poster Join Date: Mar 2002 Location: Karabakh - Azeris motherland Age: 45 Posts: 816 Member: 9856 Status: Offline Thanks Meter: 2	SAT - Sim Application Tools

08-04-2002, 14:30	#15 (permalink)
Tarzan Junior Member Join Date: Jul 2002 Posts: 5 Member: 14141 Status: Offline Thanks Meter: 0	DarkBear: I've searched your byte series and replaced it. I haven't used the same offset but another one. Nevertheless, it did NOT work. Anyway, MaMaDx's method works just sweet :-). I would appreciate if you would explain your hack on a more technical level (e.g. how did you find out the hack, have you disassembled the firmware or what?).