To Setool Team Plz Fix This Problem

[asia_gsm]

Phone was unlocked / repaired with DreamBox...


v0.915018/UNI
CARD SERIAL: 0002***
Loaded 51 flash descriptors
ChipID:8040,EMP protocol:0301
NEW SECURITY (MARITA RESPIN) PHONE
erom_readvar: error reading unit 1/725
error while reading SIMLOCK SIGNATURE unit
phone was tampered with other software
SECURITY UNITS CAN'T BE READ !
DAMAGED FIRMWARE,GDFS OR EMPTY PHONE
CONTINUE ON YOUR OWN RISC

PHONE STATE: "RETAIL"
FLASH CID: 0052
Speed:921600
Flash ID check:897E
Flash props sent ok
OTP: LOCKED:1 CID:51 PAF:1 IMEI:35427001242651 CERT:RED
FLASH CID:52 COLOR:RED

Model:W200i
Brand:Generic
MAPP CXC article: R4GB001 prgCXC1250724_VODAFONE_ME
MAPP CXC version: R4GB001
Language Package:S_ASIA_LEVAN
CDA article: CDA102737/1
CDA version: R2A
Default article: cxc1250728
Default version: R4GB001
PROVIDER: 000-00
SIMLOCKS NOT DETECTED

USERCODE:0000

RESTORATION FILE PRESENT FOR DETECTED FIRMWARE

BYPASS PACKAGE PRESENT FOR DETECTED FIRMWARE

Elapsed: 9 secs.

[rico_deep]

Here's HOW...............

q:
when i attaching phone using dcu60 i see following messages:

Code:

erom_readvar: error reading unit 1/725
error while reading security units
SECURITY UNITS CAN'T BE READ !
DAMAGED FIRMWARE/GDFS OR EMPTY PHONE

or

erom_readvar: error reading unit 1/851
error while reading security units
SECURITY UNITS CAN'T BE READ !
DAMAGED FIRMWARE/GDFS OR EMPTY PHONE

and process stops,but phone works normally on com/ufs.
what is root cause and what is solution ?

A:
that phone is tampered by d_reambox software.

during their famous method of "testpoint bypass", they writing patched erom with own custom loader embedded, patching simlock signature check and ... erasing simlock signature without any reason, which prevents setool2 from making backup.

i had write a post on their forum, but they too arrogant even to read it.

fix is extremly simple:

using com/ufs write next script in SIGNED MODE (check ONLY "USE SIGNED MODE" on settings)

for db2020:
Code:

gdfswrite:0001085144554D4D5944415441

for db2012:
Code:

gdfswrite:0001072544554D4D5944415441

alas, they custom loader also breaks alternative bypass support using dcu60 cable,
so you only can use SIGNED MODE with dcu60 after their "testpoint".

maybe i will write program (embed option in setool2) to restore tampered by d_reambox erom to correctly patched.

br.