Help me please with SIEMENS A70

[moder10]

Hi guys,
i need to unlock the siemens a70.

Can you tell me how to do?
The steps to follow to avoid burning the mobiles a70


Best regards....MODER

[moder10]

I've done the CUT on the mainboard of my SIEMENS a70 according the scheme of "Siemens-Testpoint_Station_3"
but when i connect with the comcable this is the answer:

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.

IMEI:
Error Get Battery Voltage!
SecurityMode: Error!

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.

IMEI:
Error Get Battery Voltage!
SecurityMode: Error!


Please help me

[kricster]

i have the same problem.....

please let me know what is the right cut for a70...

[moder10]

I've found to way to make tp (cut) on siemens a70, i've attacched the images.
I've done the cut according the SIEMENS-TESPOINT STATION3.

The 2 imagines semm different, one up and one down respect the black diode....coul it be the reason for that i'm not able to read the firmw of the phone and give me error???

Please give us your help

[dagos]

Originally Posted by moder10

I've found to way to make tp (cut) on siemens a70, i've attacched the images.
I've done the cut according the SIEMENS-TESPOINT STATION3.

The 2 imagines semm different, one up and one down respect the black diode....coul it be the reason for that i'm not able to read the firmw of the phone and give me error???

Please give us your help

OK, to understood....
You cutted this way, but your phone is not recognised by Joker. Is werry possible to you damaged the way from the second level (Siemens phone PCB's have four level). To know, you need to indentify the malfunction (low battery message or not network). In attachemment you have the correct position for cutting PCB circuit and repair after wrong cut...not easy!
BTW, A70 and AX72 phones have the same procedure for unlocking with A65 (E-GOLD phones).
Br,
dagos

[moder10]

Originally Posted by dagos

OK, to understood....
You cutted this way, but your phone is not recognised by Joker. Is werry possible to you damaged the way from the second level (Siemens phone PCB's have four level). To know, you need to indentify the malfunction (low battery message or not network). In attachemment you have the correct position for cutting PCB circuit and repair after wrong cut...not easy!
BTW, A70 and AX72 phones have the same procedure for unlocking with A65 (E-GOLD phones).
Br,
dagos

I think is really difficult, howewer i need other lessons from you, dear dagos, before understand how reapair these mobiles, i have totally 6 phones a70....3 before your post and 3 after your post...all with the same problem, i have not gone deep when i've done the cut but softly...and the JOKER answer at the same way...before cut read all, after the cut the error:

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.

IMEI:
Error Get Battery Voltage!
SecurityMode: Error!

• I've tried also to unlock a siemens ax72 with the same procedure of siemensa65, but after all the procedure is completed, the mobile even if is not locked more, i can't make call, infact instead of "VODAFONE" on the display appear " !VODAFONE" .... what can i do???

• I've also unlocked other2 siemens a65, but when i insert the sim inside, at startup when ask to click ok, i can't click ok....i don't know why...the button isn't broken...there's a way to click ok, making something like to repai the wrong cut of siemensa70?

Thank you DAGOS....and many thanks to everyone will ask me

[dagos]

Originally Posted by moder10

I think is really difficult, howewer i need other lessons from you, dear dagos, before understand how reapair these mobiles, i have totally 6 phones a70....3 before your post and 3 after your post...all with the same problem, i have not gone deep when i've done the cut but softly...and the JOKER answer at the same way...before cut read all, after the cut the error:

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.

IMEI:
Error Get Battery Voltage!
SecurityMode: Error!

• I've tried also to unlock a siemens ax72 with the same procedure of siemensa65, but after all the procedure is completed, the mobile even if is not locked more, i can't make call, infact instead of "VODAFONE" on the display appear " !VODAFONE" .... what can i do???

• I've also unlocked other2 siemens a65, but when i insert the sim inside, at startup when ask to click ok, i can't click ok....i don't know why...the button isn't broken...there's a way to click ok, making something like to repai the wrong cut of siemensa70?

Thank you DAGOS....and many thanks to everyone will ask me

Hi,
this is the strange malfunction....Possible, the other PCB firmware.
Try to make fullflash (need to indentify first the flash capacity 4 or 8 MB) on the one "brocken" A70 and post the log file. Download file from http://www.gsmsimlocking.com/Gsm/ind...l_Support/A70/

user: gsmsimlocking
password: freefornow

About the AX72, you need to make fullflash (to dissapear the Vodafone brand).
About the A65, BAD CUT WAY (or wrong cut track). You need to repair it using microscope, solder station and powerfull light from the outside face(see on attachemment) and after cut the correct way. In this phone you need to cut the way from the second level, not from the first!
dagos

[raezak]

for better work no need to cut track use martechII



br

[moder10]

Originally Posted by raezak

for better work no need to cut track use martechII



br

Hi raezak....what is MARTECH II ?

Br

[moder10]

Originally Posted by dagos

Hi,
this is the strange malfunction....Possible, the other PCB firmware.
Try to make fullflash (need to indentify first the flash capacity 4 or 8 MB) on the one "brocken" A70 and post the log file. Download file from http://www.gsmsimlocking.com/Gsm/ind...l_Support/A70/

user: gsmsimlocking
password: freefornow

About the AX72, you need to make fullflash (to dissapear the Vodafone brand).
About the A65, BAD CUT WAY (or wrong cut track). You need to repair it using microscope, solder station and powerfull light from the outside face(see on attachemment) and after cut the correct way. In this phone you need to cut the way from the second level, not from the first!
dagos

FOR A70
How can i do to watch the FLASH CAPACITY??? 4 or 8 mb ???
Wich is the file to download for fullflash of siemens a70 in the link you wrote?
Which is the procedure to send the fullflash to mobile?

FOR AX72
Which is the procedure to send the fullflash to mobile?
Where i can download the fullflash file?

FOR A65
The track is correct, infact in the other mobils already unlocked i've done in the same way. I've done all the procedure and the mobile is unlock (service mode= factory) but when i turn on the mobile i can't push the Ok on startup (the botton on the left)......BOOOO!

Many thanks...br Moder

[dagos]

...full flash procedure:

1. if use the Freia software:
-connect the serial cable
-open Freia
-select phone model
-enter "Configuration function" and set the Com port of cable, check RTS and DTR, speed on 115200, Process information to Medium, boot tipe to the Normal and OK.
-enter to "Write flash to phone" and open your fullflash file (".fls" or ".bin" file from SST software, not ".bin" file from Joker!!!).
-preset to "Firmware" (on the Count window you have the fullflash file dimension) and click to OK.
-press short the phone red key (not working autoignition) and wait ~ 20 minutes to finalise (see on the Process information window).
-enter to "Unlocking functions", select "Direct unlock no map is saved" and OK.
If your phone make BZZZ (and/or shortly splash display), something is wrong (fullflash file low version or not correct unlocked).
-disconect serial cable and start normaly your phone.

2. If use the Joker software:
-connect the serial cable
-open Joker
-set phone type,COM port, COM speed (115200), Boot typ (Normal).
-click on "Flash" tab and select Fullflash, Protect BCore (verry important!!!) and click on the Write tab.
-select the file for write on the flash and "Open"
IF YOU RECEIVE THE MESSAGE "The file size is not equivalent to a size of area!To record?" CLICK ON "NO" AND SEARCH THE GOOD FULLFLASH FILE!!!!
-wait to finalise fullflash process
-unlock your phone.
That is!

To recognise the fullflash capacity, loocking on the PCB flash chip and search on Internet the writed code on this....

Fullflash files for E-Gold series (for Joker) you have on:http://www.gsmsimlocking.com/Gsm/ind...icial_Support/

user: gsmsimlocking
password: freefornow

About the "can't push the Ok on startup", I give one trick:
Open Joker, go to "?" tab enter in service mode and click on "0071 EEP".
Post the results

Best regards,
dagos

[moder10]

Originally Posted by dagos

...full flash procedure:

About the "can't push the Ok on startup", I give one trick:
Open Joker, go to "?" tab enter in service mode and click on "0071 EEP".
Post the results

Best regards,
dagos

ABOUT SIEMENS A65 ----"can't push the Ok on startup"

I've done so, before SERVICE SECTION then Service Mode...click on re button and:

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.
MobileMode: Service
HWID: 230 (A65)
A65 lg98 Sw14 21.02.05 15:57:20
IMEI: *********************
DisplayID: 34, Sharp Hynix HM17CM4101
FSN: BA280A52
SW FlashID: 0089/8856
Code(05): OTP closed
Code(09): BootKEY is written in EEPROM
Code(0D): Keys are registered in BCORE
Code(13): Complete access to BFB
Code(15): Complete condition
Code(19): Monitoring is switched on
Code(1D): Blocks 5121,5122,5123 are present
Battery Voltage 3920 mV.
SecurityMode: Factory
Phone off...

Then section SKEY and Recalc All Keys:

Start...
Loading BootsModel(A65)...
Sending StartBoot Ok.
Sending MainBoot Ok.
SIEMENS A65 lg98 Sw14
Soft FlashID: 0089/8856
FlashID: 0089/8856
Flash Size: 16Mb
Region(1): Blocks 255, Size 64Kb
Region(2): Blocks 8, Size 8Kb
Start EEPROM segments at addres 0x7C0000
FSN: BA280A52 -> PhoneID: 520A28BA
OTP IMEI: *************
HASH: ********************
Use OTP IMEI: *****************
USE SKEY: 12345678
*#0000*12345678# - Network Lock
*#0001*12345678# - Service Provider Lock
*#0002*12345678# - Corporate Code
*#0003*12345678# - Phone Code
*#0004*12345678# - Network Subset Lock
*#0005*12345678# - Only Sim
BCORE HASH is equivalent - not change.
Read EEPROM addr: 0x7C0000 size: 0x030000...
EEPROM backup in ".\Backup\A65lg98Sw14_EEPROM_080118184412.bin" file.
Write EEPROM addr: 0x7C0000 size: 0x030000...
Change BOOTKEY - Ok.
Change EEP0076 - Ok.
Change EEP5009 - Ok.
Change EEP5077 - Ok.
Change EEP5121 - Ok.
Change EEP5122 - Ok.
Change EEP5123 - Ok.

The mobile when i turnon it i can't click on OK, the button don't give input.

So i go in the section ? ...as said by DAGOS and click on ServiceMode, then 0071EEP :

Start...
Loading ServiceBoot...
Sending ServiceBoot Ok.
MobileMode: Service
HWID: 230 (A65)
A65 lg98 Sw14 21.02.05 15:57:20
IMEI: *********************
DisplayID: 34, Sharp Hynix HM17CM4101
FSN: BA280A52
SW FlashID: 0089/8856
Code(05): OTP closed
Code(09): BootKEY is written in EEPROM
Code(0D): Keys are registered in BCORE
Code(13): Complete access to BFB
Code(15): Complete condition
Code(19): Monitoring is switched on
Code(1D): Blocks 5121,5122,5123 are present
Battery Voltage 3912 mV.
SecurityMode: Factory
Reparation of the block EEP0071 for disable "aircraft check" and adding of the "Band selection" menu...
HWID: 230 (A65)
Band selection menu add - Ok.
Disable aircraft check - Ok.
EEP0071 block is written in ".\Backup\A65lg98Sw14_0071_080118185108.eep" file.
Write block 0071 - Ok.
The block EEP0071 is updated.
Phone off...

After this point, i insert my Vodafone Ital SIM CARD, turnon the mobile, and bypass the initial control....BUT....BUT...after that mobile make and receive call, i can't use the button high on the left and the PAD...now i have the mobile unlocked but the button left hight and the pad, don't work.

What can i do??? to repair these 2 functions? SIEMENS A65....coul it be that when i've done the cut fot TP i have done damage??

Many thanks....HELPPPP

[moder10]

Originally Posted by dagos

...full flash procedure:

2. If use the Joker software:
-connect the serial cable
-open Joker
-set phone type,COM port, COM speed (115200), Boot typ (Normal).
-click on "Flash" tab and select Fullflash, Protect BCore (verry important!!!) and click on the Write tab.
-select the file for write on the flash and "Open"
IF YOU RECEIVE THE MESSAGE "The file size is not equivalent to a size of area!To record?" CLICK ON "NO" AND SEARCH THE GOOD FULLFLASH FILE!!!!
-wait to finalise fullflash process
-unlock your phone.
That is!

To recognise the fullflash capacity, loocking on the PCB flash chip and search on Internet the writed code on this....

Best regards,
dagos

I'm just tryng now with siemens ax72...it sems to be longer than i immagine...howewer i'll post later my results...i hope GOOD.

I have taken a file like an other for ax72, there was writen AX72_FF and i have taken it, even if before make fullflash i have read in the service section in the reading of my firmw something like this....
AX72lg98Sw01_30.08.05_13:29:04

[moder10]

Originally Posted by moder10

I'm just tryng now with siemens ax72...it sems to be longer than i immagine...howewer i'll post later my results...i hope GOOD.

I have taken a file like an other for ax72, there was writen AX72_FF and i have taken it, even if before make fullflash i have read in the service section in the reading of my firmw something like this....
AX72lg98Sw01_30.08.05_13:29:04

NO WORK SIEMENS AX72...after fullflash with file AX72_FF.rar
After the full flash, the mobile was locked, so i've unlocked it as for as siemens a65, but when i have inserted the sim inside....................................... " ! Vodafone " again
Other important thing, for me that i'm italian, in the fullflash including in the file AX72_FF.rar ther's not the ITALIAN language.

Open file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin" for write in Flash.
FullFlash file info:
FlashID: 0001/2221
SIEMENS AX72 Sw01 lg91
RealLgPack: lg91
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
Error: SetSpeedBaud answer code 0x554355!
Open file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin" for write in Flash.
FullFlash file info:
FlashID: 0001/2221
SIEMENS AX72 Sw01 lg91
RealLgPack: lg91
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
SIEMENS AX72 lg98 Sw01
Soft FlashID: 0001/2221
FlashID: 0001/227E-2221-2201
Flash Size: 16Mb, WriteBuffer: 32 bytes
Region(1): Blocks 128, Size 128Kb
Start EEPROM segments at addres 0x7A0000
FSN: C189F370 -> PhoneID: 70F389C1
OTP IMEI: ****************
HASH: 558150624E54D9C05B0FCA01D7C94639
Read EEP0067 block (ver00), size 20 bytes - Ok.
Read EEP0076 block (ver00), size 10 bytes - Ok.
Read EEP5005 block (ver00), size 64 bytes - Ok.
Read EEP5007 block (ver00), size 10 bytes - Ok.
Read EEP5008 block (ver00), size 224 bytes - Ok.
Read EEP5009 block (ver00), size 10 bytes - Ok.
Read EEP5012 block (ver00), size 14 bytes - Ok.
Read EEP5077 block (ver00), size 232 bytes - Ok.
Read EEP5093 block (ver00), size 76 bytes - Ok.
Read EEP5121 block (ver00), size 56 bytes - Ok.
Read EEP5122 block (ver00), size 6 bytes - Ok.
Read EEP5123 block (ver00), size 12 bytes - Ok.
EEPROM blocks is written in
".\Backup\AX72lg98Sw01_Backup080118192248.eep" file.
Restore EEP0067 - Ok.
Restore EEP5005 - Ok.
Restore EEP5007 - Ok.
Restore EEP5012 - Ok.
Restore EEP5093 - Ok.
Data file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin".
Write Flash addr: 0x000000 size: 0x1000000 - Ok.
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
SIEMENS AX72 lg91 Sw01
Soft FlashID: 0001/2221
FlashID: 0001/227E-2221-2201
Flash Size: 16Mb, WriteBuffer: 32 bytes
Region(1): Blocks 128, Size 128Kb
Start EEPROM segments at addres 0x7A0000
FSN: C189F370 -> PhoneID: 70F389C1
OTP IMEI: ****************
HASH: ***********************
Use OTP IMEI: *********************
USE SKEY: 12345678
*#0000*12345678# - Network Lock
*#0001*12345678# - Service Provider Lock
*#0002*12345678# - Corporate Code
*#0003*12345678# - Phone Code
*#0004*12345678# - Network Subset Lock
*#0005*12345678# - Only Sim
BCORE HASH is equivalent - not change.
Read EEPROM addr: 0x7A0000 size: 0x060000...
EEPROM backup in ".\Backup\AX72lg91Sw01_EEPROM_080118202738.bin " file.
Write EEPROM addr: 0x7A0000 size: 0x060000...
Change BOOTKEY - Ok.
Change EEP0076 - Ok.
Change EEP5009 - Ok.
Change EEP5077 - Ok.
Change EEP5121 - Ok.
Change EEP5122 - Ok.
Change EEP5123 - Ok.


I try the other file and i hope to unlock definitely this mobile..is the last of 3, the others all ok, work perfectly...this one make me hungry
I'll post the result later
See you

[dagos]

Originally Posted by moder10

NO WORK SIEMENS AX72...after fullflash with file AX72_FF.rar
After the full flash, the mobile was locked, so i've unlocked it as for as siemens a65, but when i have inserted the sim inside....................................... " ! Vodafone " again
Other important thing, for me that i'm italian, in the fullflash including in the file AX72_FF.rar ther's not the ITALIAN language.

Open file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin" for write in Flash.
FullFlash file info:
FlashID: 0001/2221
SIEMENS AX72 Sw01 lg91
RealLgPack: lg91
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
Error: SetSpeedBaud answer code 0x554355!
Open file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin" for write in Flash.
FullFlash file info:
FlashID: 0001/2221
SIEMENS AX72 Sw01 lg91
RealLgPack: lg91
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
SIEMENS AX72 lg98 Sw01
Soft FlashID: 0001/2221
FlashID: 0001/227E-2221-2201
Flash Size: 16Mb, WriteBuffer: 32 bytes
Region(1): Blocks 128, Size 128Kb
Start EEPROM segments at addres 0x7A0000
FSN: C189F370 -> PhoneID: 70F389C1
OTP IMEI: ****************
HASH: 558150624E54D9C05B0FCA01D7C94639
Read EEP0067 block (ver00), size 20 bytes - Ok.
Read EEP0076 block (ver00), size 10 bytes - Ok.
Read EEP5005 block (ver00), size 64 bytes - Ok.
Read EEP5007 block (ver00), size 10 bytes - Ok.
Read EEP5008 block (ver00), size 224 bytes - Ok.
Read EEP5009 block (ver00), size 10 bytes - Ok.
Read EEP5012 block (ver00), size 14 bytes - Ok.
Read EEP5077 block (ver00), size 232 bytes - Ok.
Read EEP5093 block (ver00), size 76 bytes - Ok.
Read EEP5121 block (ver00), size 56 bytes - Ok.
Read EEP5122 block (ver00), size 6 bytes - Ok.
Read EEP5123 block (ver00), size 12 bytes - Ok.
EEPROM blocks is written in
".\Backup\AX72lg98Sw01_Backup080118192248.eep" file.
Restore EEP0067 - Ok.
Restore EEP5005 - Ok.
Restore EEP5007 - Ok.
Restore EEP5012 - Ok.
Restore EEP5093 - Ok.
Data file "C:\Programmi\Right Click Mobiles\siemens
joker\AX72_v01_lg91_FlashID_0001_227E-2221-2201_Fullflash_Joker\AX72lg
91Sw01_00-100_Fullflash.bin".
Write Flash addr: 0x000000 size: 0x1000000 - Ok.
Start...
Loading BootsModel(AX75)...
Sending StartBoot Ok.
Sending MainBoot Ok.
SIEMENS AX72 lg91 Sw01
Soft FlashID: 0001/2221
FlashID: 0001/227E-2221-2201
Flash Size: 16Mb, WriteBuffer: 32 bytes
Region(1): Blocks 128, Size 128Kb
Start EEPROM segments at addres 0x7A0000
FSN: C189F370 -> PhoneID: 70F389C1
OTP IMEI: ****************
HASH: ***********************
Use OTP IMEI: *********************
USE SKEY: 12345678
*#0000*12345678# - Network Lock
*#0001*12345678# - Service Provider Lock
*#0002*12345678# - Corporate Code
*#0003*12345678# - Phone Code
*#0004*12345678# - Network Subset Lock
*#0005*12345678# - Only Sim
BCORE HASH is equivalent - not change.
Read EEPROM addr: 0x7A0000 size: 0x060000...
EEPROM backup in ".\Backup\AX72lg91Sw01_EEPROM_080118202738.bin " file.
Write EEPROM addr: 0x7A0000 size: 0x060000...
Change BOOTKEY - Ok.
Change EEP0076 - Ok.
Change EEP5009 - Ok.
Change EEP5077 - Ok.
Change EEP5121 - Ok.
Change EEP5122 - Ok.
Change EEP5123 - Ok.


I try the other file and i hope to unlock definitely this mobile..is the last of 3, the others all ok, work perfectly...this one make me hungry
I'll post the result later
See you

...hmmm
I see your log and you have one error "Error: SetSpeedBaud answer code 0x554355!". Verify again the bautrate (115200).
I don't see in your log the "Service" status (Customer, Default or Factory. Is werry important to know....
About the italian language pack, not is important, now.....After unbrand your phone (from the Vodafone brand), make only firmware upgrade with the italian LG (default is LG1):
"AX72_010101_service.zip" from http://eh.student.utwente.nl/~landy/index.php?dir=AX72/
or update to the SW02: "AX72_020101_update.zip"
from http://eh.student.utwente.nl/~landy/...72/UpdateTool/

user: mobile
password: elibom

If only the "! Vodafone" message (on startup) appair, you solve it using map file (see on attachemment). Enter in Service mode and place here the full log file.
Br,
dagos