Siemens x65 Unlocking Solution (NOT TESTED!!!)

[0xFEDF]

Hi all!
At first, here is Siemens x65 flasher: http://users.iptelecom.net.ua/~dmitr...asher-1027.zip
Here is EEPROM Tool 3.1 by Skylord: http://download.siemens-club.ru/file...EPROM_tool.rar
For unlocking any Siemens mobile, You need access to EEPROM blocks:

0x1391 = 5009 (EEfull) - Freia IMEI Block 00
0x004C = 0076 (EElite) - Freia IMEI Block 01
0x1390 = 5008 (EEfull) - Freia IMEI Block 02
0x13D5 = 5077 (EEfull) - Freia IMEI Block 03

Without fullflash patching You can only access EEPROM block 0076.
Fullflash patching: read fullflash from phone, find HEX string:
01 14 00 00 90 13 00 00 D5 13 00 00 91 13 00 00 02 14 00 00 03 14 00 00
Replace string: 90 13 00 00 D5 13 00 00 91 13 with all zeros (0x00)
Upload patched part of fullflash to phone.
Read with EEPROM Tool 3.1 EEPROM blocks 5009, 0076, 5008, 5077 from phone to be sure patch is working and save in .txt
Now all what we need, is PhoneID. If anybody knows, how to read PhoneID from x65-series, then we can edit any .log file from Freia, like this:

LOG File.
This log file should be sent to /dev/null
[Model: Siemens x65][PhoneID: 12345678][Desired IMEI: 123456-12-123456]

generate MAP-file and upload new EEPROM blocks to phone with EEPROM Tool - You may edit content of EEPROM blocks, saved with EEPROM Tool in .txt, with any txt-editor - according information above.

This solution is TOTALLY NOT TESTED!!!
Because I don't have any x65-series mobile and don't know, how read PhoneID.
P.S. Always make backups BEFORE flashing Your phone!!!

[vulf_anatolige]

thanks for this solution

[Preco]

I will test and post results

[0xFEDF]

Originally Posted by Preco

I will test and post results

How EXACTLY do You want read PhoneID from x65 phones? x65_Flasher can't do this task, it may be used for reading/writing fullflash from/to phone ONLY. Because it is only FLASHER, not UNLOCKER!

[DMD]

@ 0xFEDF

Some people don't read too well

"Now all what we need, is PhoneID. If anybody knows, how to read PhoneID from x65-series, then we can edit any .log file from Freia"

WBR D.

[Preco]

I am not sure but dont you get phone ID when you press *#06#,you get imei software version and i am think phone ID too !
Correct me if i am wrong

[Acidmrp]

@Preco you're wrong. Till now there is no way to get phone ID. The only way is to
write an own loader

[Preco]

Sory,my mistake.I think about something else

[pavlin]

@0xFEDF
Do you have fullflash, readed from x65 Siemens? Can you send it to me?

[0xFEDF]

Originally Posted by pavlin

@0xFEDF
Do you have fullflash, readed from x65 Siemens? Can you send it to me?

You may get fullflash (except EEfull) just from your phone using "x65 flasher" - what's a problem?
Sorry, but I don't have any Siemens x65.
P.S. Fullflash size must be above 30 Mb.

[daz]

even if the solution was working it's not the best solution to unlock 100 x65's !!!

[mobilland_k1]

when type *#0606# whithout simcard phone show some hex string and after that show type of lock.Is that hex string phone ID?????

[0xFEDF]

There is a small proggy for reading PhoneID (is shown as "FSN:") from x65 phones when phone is on (it work in BFB mode).
Program work fine with x65 phones, but not work with x55-x60 phones without "OpenBFB" patch applyed to phone.
But, there is another problem for unlocking x65 - generating MAP from LOG with Freia is not possible, because for right MAP You need all 3 parameters: [Model: Siemens S65][PhoneID: FFFFFFFF][Desired IMEI: 000000-00-000000] - there is no free unlockers, supporting x65-series.

What do You think about this "little" problem?

[XisiX]

- there is no free unlockers, supporting x65-series.

Which one will be released first: free or commercial? As we can see, Martech work too long on x65 series; where is Nutzo?

[0xFEDF]

I think, commercial unlocker for x65 series will be released soon (from Martech?).
There is no "big" problem writing program for generating unlock MAP from LOG, if You have access to fullflash and know, how disassemble phone's firmware.
Wait few days...