[XPERIA X8 General] baiclark:
hew...a little more!

this is from the_laser himself..

he said in this page:

how to unlock s1 android based phones, based on msm7227,qsd8250, using alternative security bypass using testpoint?

a:

Here is procedure.

FIRMWARE VERSION DOES NOT MATTER, WHEN USING TESTPOINT METHOD

1.

prepare for testpoint operation.

check testpoints location for your phone model in dist\docs\s1_qualcomm_uart_cables or use GPG cable set

open testpoints for access

if you do not have GPG cable set, get some needle with wire, connect it to phone gnd ( battery minus ) or to usb cable shield, etc.

2.

select proper phone model.

select COM as interface.

on settings check signed mode, use alternative security bypass, do full unlock instead usercode reset, use testpoint (gnd type)

fill login/password and check if account valid.

press unlock

when prompted, execute steps in EXACT order:

remove cable from phone,

remove battery from phone,

attach testpoint ( turn on switch on cable set )

insert cable to phone, HOLDING TESTPOINT ( cable set switch in "on" position )

press "ready"

when prompted detach testpoint

press "ready"

install drivers from dist\drivers\USBFlash_driver\ ( if asked )

phone will be unlocked.

ON THE OTHER HAND, on the same page, there was a TUTORIAL for repairing msm7227 BRICKED phones..

here you go

q:

how to repair totally damaged s1 android phones, based on msm7227,qsd8250, using alternative security bypass using testpoint?

a:

Here is procedure.

okay, here is example how to resurrect totally dead x10 phone.

so, we have x10 phone with totally erased semcboot and trim area.

phone does not turn on, does not connect to pc anyhow.

lets resurrect it.

run setool2, select x10 as model, select com port as interface

( one where GPG resurrection cables connected )

1.

on options set signed mode,altbypass mode, use testpoint (gnd type)

2.

connect GPG x10 resurrection craddle to phone, press RECOVERY

follow program instructions.

important notice:

for msm7227 phones, insert battery in phone after you attached testpoint.

btw, as phone has erased semcboot, you do not need apply testpoint that time.

however, that is very special case, so for simplicity lets apply testpoint all time.

here is operation output:

Code:

SIGNED MODE (USING SERVER)

ALTERNATIVE SECURITY BYPASS ENABLED

CFG:110010000010

DETACH USB CABLE FROM PHONE

REMOVE BATTERY FROM PHONE

ATTACH TESTPOINT

ATTACH USB CABLE TO PHONE,THEN PRESS "READY"

PROCESSING ...

REMOVE TESTPOINT NOW, THEN PRESS "READY"

RUNNING S1_LOADER VER "R4A024"

SWITCHING TO "USB" ...

PLEASE ATTACH TURNED OFF PHONE NOW

RUNNING S1_LOADER VER "R4A024"

LOADER AID: 0001

FLASH ID: "002C/00B3"

LOADER VERSION: "r4A024"

WRITING SEMCBOOT ...

Checking TA ...

MINOR ERROR [ MISC_CLASS: MISC_ERROR, TA_set_config_failed ]

Writing config ...

MINOR ERROR [ MISC_CLASS: MISC_ERROR, TA_invalid,_format_may_be_required ]

Formatting ...

Checking MISC TA ...

MINOR ERROR [ MISC_CLASS: MISC_ERROR, TA_invalid,_format_may_be_required ]

Writing config ...

MINOR ERROR [ MISC_CLASS: MISC_ERROR, TA_invalid,_format_may_be_required ]

Formatting ...

SUCCESS

now we recovered semcboot and prepared trim area for loading.

if phone only had erased semcboot, it will already work after that step.

but our phone TOTALLY damaged, so lets proceed with second step:

we need now load trim area.

options are same for step1 + "format gdfs when writing" checked,

select x10.zip in misc.edit and press "write gdfs".

( any trim area, read from corresponding model live phone will work )

follow program instructions.

here is operation output:

Code:

SIGNED MODE (USING SERVER)

ALTERNATIVE SECURITY BYPASS ENABLED

CFG:110010000110

Will write GDFS now.

DETACH USB CABLE FROM PHONE

REMOVE BATTERY FROM PHONE

ATTACH TESTPOINT

ATTACH USB CABLE TO PHONE,THEN PRESS "READY"

PROCESSING ...

REMOVE TESTPOINT NOW, THEN PRESS "READY"

RUNNING S1_LOADER VER "R4A024"

SWITCHING TO "USB" ...

PLEASE ATTACH TURNED OFF PHONE NOW

RUNNING S1_LOADER VER "R4A024"

LOADER AID: 0001

FLASH ID: "002C/00B3"

LOADER VERSION: "r4A024"

Can't get IMEI

will write 1010 units

done

will write 53 units

done

Phone detached

Elapsed: 23 secs.

finally, we need rebuild imei and security zone.

for that, check same options as for step1 + "do full unlock instead of usercode reset","allow to change imei when unlocking" checked,

press "unlock/repair", follow program instructions

here is operation output:

Code:

THAT ACTION IS ILLEGAL,IF YOU DOING IT

FOR ANY PURPOSE, OTHER THAN REPAIR PHONE

SIGNED MODE (USING SERVER)

ALTERNATIVE SECURITY BYPASS ENABLED

CFG:110010010010

DETACH USB CABLE FROM PHONE

REMOVE BATTERY FROM PHONE

ATTACH TESTPOINT

ATTACH USB CABLE TO PHONE,THEN PRESS "READY"

PROCESSING ...

REMOVE TESTPOINT NOW, THEN PRESS "READY"

RUNNING S1_LOADER VER "R4A024"

SWITCHING TO "USB" ...

PLEASE ATTACH TURNED OFF PHONE NOW

RUNNING S1_LOADER VER "R4A024"

LOADER AID: 0001

FLASH ID: "002C/00B3"

LOADER VERSION: "r4A024"

Can't get IMEI

REQUESTED : 359419030xxxxx

Checking for HWConfig ...

Waiting for calculation process ...

RESPONSE: "SUCCESS" [826]

Checking for signature ...

signature found, skipping calculation

WRITING SEMCBOOT ...

WRITING HWCONFIG ...

Unlock DONE

Elapsed: 20 secs.

from now on, phone is full repaired, testpoint cradle not needed.

reflash phone with any suitable firmware.

now my only question is...based on this statement,"check testpoints location for your phone model in dist\docs\s1_qualcomm_uart_cables or use GPG cable set

open testpoints for access" which is highlighted as purple....where can we find this one?where is the dist\docs\s1_qualcomm_uart_cables?

if we find this, then we will be able to revive our dead x8 phones..

kind regards,

baiclark