yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] PoorCollegeGuy:
Hello there,

sorry to temporarily derail your thread (you've got some badass development going on in here), but I just wanted to let ya know that this thread has been featured on the XDA Portal.

here's the link:

http://www.xda-developers.com/windows_phone/nand-access-and-interopunlock-for-lumia-710-and-800/

I hope you enjoy it, keep up the awesome work :)
[Nokia Lumia 800] xsacha:
Ordinarily I would except that that this is the bootloader on the device and I can't change it (which is the problem).
[Nokia Lumia 800] biktor_gj:
Windows Phone has access to the AMSS, ADSP & EMMCBOOT.MBN. In fact, it has access to the 3rd partition of the phone where that is stored, so it probably can also modify the contents on the rest of partitions, including the bootloader. The problem is if you need the unlocked bootloader to unlock windows, and you need to unlock windows to unlock the bootloader... infinite loop :)

That is unless someone finds a hole in some Nokia firmware..
[Nokia Lumia 800] ceesheim:
pm Cotulla , he looked at the bootloader ( he is the one who hacked almost all new phones ) from nokia and told that there are some possibilities.

so tell him who you are and what you already did then he can maybe help you.
[Nokia Lumia 800] warriorvibhu:
To make your work much easier .. Here is COTULLA.. must seek his help.. joint development is something that can really help us in big ways .. BTW i dont even have a Lumia ..Just interested in how things were going here..

regards
[Nokia Lumia 800] ombadboy:
Can he not join the thread? If he spread his knowledge we could all chip in and figure it out! Unfortunately I don't have a locked bootloader Lumia to test stuff out, so am going on instinct here! (and I dont want to flash and lock it for testing purposes :P)
[Nokia Lumia 800] xsacha:
Damn I had already hit reply to suggest this. ;)
[Nokia Lumia 800] biktor_gj:
No worries, that's why I have two of them :)
[Nokia Lumia 800] Bph&co:
Hi,

Just a thought - you can patch all certificate checks in the Nokia loader before

loading it to the phone.

Also here the latest Nss beta, with detailed debugging - phone responces and

parsing data, in case someone wants to play more with the certificates.

BR
[Nokia Lumia 800] ultrashot:
Just to note - we've just released new OSBuilder.

Again - BE VERY CAREFUL! Especially if you don't have experience in ROM Building.
[Nokia Lumia 800] emdzej:
Could anyone with qualcomm mass storage working post windows driver details (.inf name, .sys files names etc)?
[Nokia Lumia 800] biktor_gj:
Well, there's not much to say about that, Windows simply detects it like any other pendrive you could have. It uses generic drivers, nothing particular about qualcomm...

Btw, and just to keep you informed, I already PM'd Cotulla, as suggested by Ceesheim & warriorvibhu. I suppose if he's interested, he'll come here :)

Now back to work!
[Nokia Lumia 800] ombadboy:
I was wondering, is Qualcomm Diagnostics Mode still in there or has it been removed with updating the bootloader to NOKIA DLOAD. I was trying to compare how QDM can be accessed in other phones (i.e. LG) and see if I can achieve the same on the Lumias..
[Nokia Lumia 800] _Madmatt:
How do you enter Qualcomm mode on the LG's? Have you tried using the same method?
[Nokia Lumia 800] suzughia:
The method used by LG phones is VOL + (or VOL - I can't rember now) plus Power, you could easilly image that on Nokia Locked bootloader this lead us to our beloved "NOKIA DLOAD", so is a no-way as the qualcomm bootloader is gone.
[Nokia Lumia 800] _Madmatt:
Maybe another key combination leads to Qualcomm mode? There are only 4 buttons on the device, is there maybe a combination we didn't try? Or is Qualcomm completely gone on the locked ones?
[Nokia Lumia 800] ombadboy:
Indeed.. But there must be a way to access the NAND somehow since Nokia Engineers will need that. Now whether this is a different key combination, or a specialized set of drivers.. I think the latter, but am looking into other combinations that could be used (i.e. other qualcomm powered devices) that might enter QDM
[Nokia Lumia 800] suzughia:
all you need to know is in Nokia.WIndows.Phone.Test.Introduction: Here

and qualcomm is gone, is used NOKIA DLOAD - that is the equivalent to Qualcomm download mode but nokia one and locked -.

Seems to me that nokia can achieve the same results of qualcomm bootloader but with software trigger and protocol - take for example RevSkills as example of what one can do if is permitted to do so.
[Nokia Lumia 800] ombadboy:
Hmmm interesting.. So using QPST USB Drivers won't help at all.. Maybe a Nokia corresponding would do the trick, which of course we can't grab..
[Nokia Lumia 800] jessenic:
Are you trying in Nokia DLOAD or in the USB diag mode?
[Nokia Lumia 800] ombadboy:
I already have an unlocked Bootloader so QPST works fine here.. Not sure what goes on when you try the QPST UBS Drivers with Nokia DLOAD
[Nokia Lumia 800] suzughia:
Nothings happens.
[Nokia Lumia 800] ombadboy:
Hmm.. anyone know what SLDR/KITL mode does? I tried pressing camera button and then power button, while holding camera button, and it showed me a pic to connect my phone to the PC.. Then windows was trying to install some drivers, and zune showed me that it was unable to restore my phone to a 'previous state'..
[Nokia Lumia 800] biktor_gj:
Zune recovery mode. I think its just for data/os updates. Windows kernel seems to have already started...

Qpst on locked loader cannot start diagnostic driver in windows, at least you can tether your internet connection with qc modem driver 319b ;)

About sldr/kitl...no idea really.
[Nokia Lumia 800] biktor_gj:
Well, look for frankenkaiser drivers and use bundled motoq drivers on 32 bit OS. It enumerates four devices but I managed to make work the modem only, diag interface cannot start (code 10 in device nanager), so no way of putting it in download mode, or on any other modem really. The most recent drivers I could find are from 2004 & 2006 though...
[Nokia Lumia 800] ap3rus:
It's a mode which is used by Zune to send updates or restore backups
[Nokia Lumia 800] lilstevie:
Nokia engineers will not be using a production bootloader on their devices either they would be using a engineering firmware, which could have entirely different options, such as this KITL mode, big boss mode and menu in SLDR
[Nokia Lumia 800] ombadboy:
What i meant is when devices come in for repairing.. There must be a way for them to access..
[Nokia Lumia 800] Amir WM:
Hi Every one

in 1st generation of WP7 Devices (HTC) the bootloader Version is Important too Unlock. If bootloader Version more than 4.xx you Must not XSPL your device .

but I think in 2nd Generation of WP7 Devices Such as Nokia Lumia Series the bootloader Version Is not Important isn't it ?

you say about HW and Firmware version ....

My Brother Has Bought Lumia 800 And I can't XSPL it .

could You Explain More about that ?

Thanx
[Nokia Lumia 800] zeronk:
How to create .nb dump from firmware downloaded on navifirm+?
[Nokia Lumia 800] biktor_gj:
Unpack the biggest esco file, rename boot.img to boot.payload, and open with Dump Tool
[Nokia Lumia 800] deylo:
anyone experienced this and has a solution? i cant flash any firmware whatsoever with NCS as shown in pic. when i click copy to clipboard is results to:

ERROR: OSBL reported an error! Code: 0x30022

at Nokia.Wezen.Programming.SequenceLogic.BaseBb6Logic.VerifyResponse(Bb6Tlv response)

at Nokia.Wezen.Programming.SequenceLogic.ImageLoader.LoadCertificate(ImageCertificate certificate)

at Nokia.Wezen.Programming.SequenceLogic.ProgrammingLogic.ProgramImageFiles(EraseMethod eraseMethod)

at Nokia.Wezen.Programming.Programmer.Program()

at Nokia.Wezen.Product.Programming.FirmwareUpdate.WezenFirmwareUpdate.Recovery()

at Nokia.CareSuite.PlugIns.WezenRecovery.RecoveryDialog.RecoveryDialogModel.Flash()

at Nokia.CareSuite.PlugIns.WezenRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__7(Object state)

xsacha in this thread had a similar error but with another error code (i think 0x30025)

trying to flash with NSS gives:

Flash File: RM801_12w07_prod_generic_nokia_osbl.esco

Sending certificate...Done.

Sending file...Failed.

this happen when i interop unlock my lumia 710 and then tried to go back to original nokia DLOAD
[Nokia Lumia 800] lilstevie:
With NSS you are trying to flash a RM-801(Lumia 800) firmware when you have an RM-803(Lumia 710)
[Nokia Lumia 800] surya467:
broken link..wont download.

pls mirror it
[Nokia Lumia 800] ceesheim:
https://hotfile.com/dl/152761802/27b2472/os-new.rar.html

Seems to work for me , but here again the link

Please let me know if it works and if the rom works but please follow all instrucktions on first post
[Nokia Lumia 800] cdbase:
for me it also don't work, upload it somewhere else cuz there is maintenance
[Nokia Lumia 800] ceesheim:
No time to reupload it. And it is strange because for me there seems to be no maintenance ( Germany) but when it tonight still not works I will upload it to multiupload
[Nokia Lumia 800] deylo:
i have tried numerous firmwares for RM-803 and also RM-809 and same thing happens. NCS doesnt work either
[Nokia Lumia 800] Briefcase:
Looks like the latest firmware (1600.3030.8773.12120*) for the Nokia 710 (RM-803) contains just another updated version of the OSBL (version 12w12 [12070 was 12w07]). Maybe this contains some new interesting stuff, it's a few bytes larger than the previous one.

* Can now be found at NaviFirm; it's a Proximus branded version, i think other versions will soon follow, as will the 12120 version for the Lumia 800
[Nokia Lumia 800] ap3rus:
I hope this new stuff is not a downgrade blocking mechanism
[Nokia Lumia 800] cdbase:
this simply shows us than NOKIA knows what we are all about to do and is afraid of something so there must be a F****** BUG which I wish you all to find really soon :D
[Nokia Lumia 800] xodeus:
Here's a danish mirror:

http://mirrors.xodeus.dk/os-new.rar
[Nokia Lumia 800] Briefcase:
haha don't think so, development of such critical systems like the bootloader takes lots of time to test. If the version number (12w12) relates to 2012 week 12 as the date of approval this was ready long before we discovered the Qualcomm Mass Storage mode in the bootloader. But i like the idea ;-)
[Nokia Lumia 800] mousey_:
I've mirrored the extracted file here: http://xdafil.es/Lumia800/ROM/tango-os-new.nb

The original one by @biktor_gj can be found here to: http://xdafil.es/Lumia800/ROM/os-new.nb

For the split zipped files of the original go here:

http://xdafil.es/Lumia800/ROM/Zipped
[Nokia Lumia 800] ap3rus:
If you look into versions of all botloaders and corresponding firmware versions, you will notice a direct link

12070->12w07

12120->12w12

14141->14w14_1

---------- Post added at 08:06 PM ---------- Previous post was at 08:02 PM ----------

Hm, this really could be 'yearweekrevision' :)
[Nokia Lumia 800] voluptuary:
I was looking at the most recent Zune CAB update and inside there are some packages that deal with boot/emmc and have values relating to write protecting different partitions and such.
[Nokia Lumia 800] kevnb:
so i put my lumia 710 into mass stoarage mode just to see if it would go, but the only way i can get it out is by pulling the battery. Doesnt seem like a major issue except when I try and flash using nokia suite it goes in download mode when checking the mode... I was going to flash an official rom, but i cant seem to do it anymore :(
[Nokia Lumia 800] schulz1199:
Hi,

I cant check for unlocked bootloader. Wibdows 7 shows 5sec a Windows Phone at Devices and Printers and then the Phone boots with Windows.

tested on 4 machines all show the same

Lumia 800

Carrier E-Plus (german)

Rom Version 7.10.8107.79

Firmware Revision 1600.2487.8107.12070

Device HW Revision 112.1402.2.3

Radio HW Revision 8255

Radio SW Revision 1.6.00.24
[Nokia Lumia 800] Giblet-dono:
I opend my Nokia Lumia up, and disconnected the battery..

This was actually fairly easy, compared to an HTC or iPhone (oehhh swearing!)

It didn't help, it's really dead!

I'm going to send it in under warrenty, as I work at a telecom company ;)

I hope I'll get a repaired one, with the original bootloader intact (the Qualcomm one)

Thanks for your helpfull tips
[Nokia Lumia 800] mousey_:
So I managed to Flash my phone succesfully.

I used Mac OS X to do the backup and flashing.

Turn the phone off and hold VOLDOWN + Power until you get the small vibration and then plug in the USB. You should get a NO NAME volume appear on your desktop if you have the Qualcomm Driver.

Open terminal and type the following:

cd /dev
ls

Now look through the folders in there I had the following sequence:

disk1s1
disk1s2
disk1s3
disk1s5
disk1s6
disk1s7
disk1s8
disk1s9

I backed up the partitions using terminal again (repeat the command for each disk):

dd if=/dev/disk1s9 of=/Users/<username>/disk9

I got an error with disk1s4 as it says it's in use, I believe thats the one that OS X mounts and so you cant access it, but I could be wrong.

Like biktor_gj said the disk 9 is 15GB so make sure you have the space.

Once backed up I downloaded the new-os.nb to my /Users/<username>/ directory and flashed it to the phone again using dd in terminal

dd if=/Users/<username>/new-os.nb of=/dev/disk1s9

This took about 25 minutes. If you open a second terminal while the dd is running you can check the progress of the dd comand with the following command

killall -INFO dd

This gave me peace of mind as I could tell that it was still writing.

once that has competed do a hard reboot and you should now be unlocked.

On a side note the first time I tried to write the new image to the phone I CTRL+C the dd process and the phone would only boot to the word NOKIA. But as we don't touch any of the other partitions I was able to put it into the Boot Mode again and this time I waited out the dd command and it worked fine.

After booting up I had to Activate My Phone as other people have said I used the online chat feature here: General inquiries for home users I provided my phone number and they gave me an activation key.

The phone is working fine.

Thanks very much biktor_gj for all your hard work
[Nokia Lumia 800] surya467:
congo! we still waiting for the bootloader unlocked! ://
[Nokia Lumia 800] Briefcase:
Nice guide, you might want to have this linked from the general Q&A thread around this subject in the Lumia 800 general forum! Few things you might want to clarify before doing so:

* Are you sure you presseed voldown + power, as i understood it's VOLDOWN+VOLOP + POWER.

* clearly state the sequence you are looking for is /dev/diskXs{1,9} where X is variable

* Perform a hard reboot: how? [wasn't it also necessary to perform a hard reset?]

* Isn't disk1s4 the logical partition definition (that's why it cannot be backup up?)
[Nokia Lumia 800] dim-soft:
I tried to flash the 710 on tango-os-new.nb and received brick
[Nokia Lumia 800] surya467:
i guess it was for 800 o.O

anyways..any way of recovery?
[Nokia Lumia 800] Hellboarder:
Ok, so I have a Lumia 710 with HW revision 2.1 and after flashing a 12070 rom destined for India (I have a T-Mobile version in the US) everything was fine until I wanted to flash the new Tango ROM that is available, in particular the Belgian one for Proximus.

It appears I have the Qualcomm bootloader which everyone who has it is so happy about. However, is anyone able to acutally get their phone into DLOAD mode so Nokia Care Suite will be able to recover the phone?

I tried every possible combination of pressing keys when inserting the USB cable, but the NCS will not start doing anything until it times out.

Does anyone know how to get the DLOAD back and rid of the Qualcomm bootloader? One can always flash back to the one that contains the Qualcomm bootloader when it is actually useful but for now I would like to be able to flash whatever I like.

Does anyone know if I can flash backwards to an older version via cabsender and then do a hard reset and have the old bootloader back or is Zune not able to flash a new bootloader?

Thanks for your help and sorry for not sharing the enthusiasm to be able to access the phone's partitions.
[Nokia Lumia 800] ombadboy:
You won't be able to flashback to Qualcomm once you go NOKIA DLOAD. The bootloader isn't stored in the backups.

You can try QPST to flash a new ROM..
[Nokia Lumia 800] Hellboarder:
Ok since I would not really mind if I could not go back to the Qualcomm bootloader (even though I had DLOAD in the first place and then flashed to Qualcomm, so I dont see why I could not do that again) would you mind giving me a quick tutorial on QPST.

I have QPST installed but no clue on (respectively had no luck getting it to do anyhting):

- how to make the phone talk to it

- which ROM format (cab, NCS, .nb)
[Nokia Lumia 800] ombadboy:
You first have to enter your phone in Qualcomm Mass Storage mode.. then just follow the guidelines in the leaked Nokia presentation: http://imgur.com/a/QOrbG
[Nokia Lumia 800] Faruk88:
I'm in the same situation as Hellboarder... I have the Rogers RM-809 and I flashed the Indian 8107.12070 ROM.

Does this mean that it is now impossible to downgrade my phone to get NAND access + Interop unlock?

It said in the Q/A thread that the Lumia 710 can be downgraded but the Lumia 800 can not... Am I missing something here?
[Nokia Lumia 800] Hellboarder:
So, does that mean you dont have the Qualcomm bootloader after flashing the India ROM? I had a RM-809 too until flashing it and now I have the RM-803 (at least according to the software ;) ) but with the Qualcomm bootloader which I wish to rather not have gotten.

If I get anywhere with QPST I will let you know.
[Nokia Lumia 800] surya467:
lol..im waiting for the Qualcomm bootloader :// and ur saying u dont want it! :P

dude we all need interop!

sumone get the 800 to downgrade to Qualcomm bootloader!
[Nokia Lumia 800] Faruk88:
I have no idea which bootloader I had before, but I definitely have Qualcomm right now. My phone gets detected as "Qualcomm CDMA Technologies MSM" in mass storage mode, and it asked me to format (and of course I clicked cancel). I wasn't able to do a hard reset by following the instructions though... I had to do a battery pull instead, and now I'm back into Windows (phew).

And you're right, my phone is now detected as RM-803 by Nokia Care Suite, even though it was originally an RM-809.

This raises another question for me... Is there actually any difference between RM-809 and RM-803? RM-809 is supposed to be quad-band HSPA, with 1700MHz (AWS) support for T-Mobile, Wind Mobile, etc. I wonder if there may be any adverse effects in the future if the Radio firmware is updated, since RM-803 is only tri-band? Any thoughts on that, devs?

Edit: Here's the band comparison:

RM-803: HSPA 900/1900/2100

RM-809: HSPA 850/1900/1700/2100

Thankfully my phone is still working on Wind right now (1700), even with the RM-803 ROM installed, so I guess the radio firmware was left intact.
[Nokia Lumia 800] zeronk:
Thx!

I extracted the .nb file, now I'm running uncooked tango rom on my lumia 710 now.

Can you give me more information on how to cook a unlocked rom?
[Nokia Lumia 800] Heathcliff74:
Since some NOKIA's are now Interop Unlocked, I got a lot of questions about support for WP7 Root Tools. Interop Unlock alone is unfortunately not enough.

You need either:

- Interop Unlock + Hacked drivers

or:

- Custom ROM with Full Unlock

I wrote a blog about it here.

Ciao,

Heathcliff74
[Nokia Lumia 800] surya467:
its heart breaking without any updates of the locked bootloader...
[Nokia Lumia 800] sHaHiN786:
It is sad indeed, you can see developers working hard on this and not finding a solution. Looks like Nokia have pretty much managed to keep their product locked tight. Damn them! :(
[Nokia Lumia 800] Ricehead:
I don't understand why they want us to not have Inter-Op, I mean it would enable the developing community to create user fixes for their very flawed device, Also make their device alot more desirable to users who are connected in the dev community (e.g Custom Roms, Themes, Tweaks etc), We have Full unlocks on HTC devices and nothing bad (That i know of) has come of them being unlocked, The only downside i can think of (Which hasn't occured yet) is security vulnerabilities and malware incurred with giving apps Inter-Op capabilities, But that is the risk you take when unlocking your phone because you should always know what you're installing and if it can be trusted. Is it the ability to get apps free that scares them ? I don't see that as a real problem for Microsoft as it really isn't a big income generator for them.

For me i see it as a Win Win situation, Could someone explain to me why keeping their device extremely restricted is better ?
[Nokia Lumia 800] bleh815:
Qualcomm USB Host Driver version 2.0.6.7 for Windows 2000/XP/Server 2003/Vista/Win7

Qualcomm CDMA Technologies MSM

USB\VID_05C6&PID_9006&REV_0000&MI_00

USB\VID_05C6&PID_9006&MI_00

https://teleweb2.tcl-ta.com/SOFTWAREUPGRADE/TOOLS/delivery/QCT/Drivers/usb_host_driver_2.0.6.8.rar

http://www.bergfiles.com/i/bf49ce2440h32i0

"Test certificate may need to be applied to Windows before installing the USB host driver"
[Nokia Lumia 800] Briefcase:
Good find bleh815!

what is the benefit of using this driver? the qualcomm msm is already detected as a mass storage device without this drivers right?
[Nokia Lumia 800] biktor_gj:
This is for QPST when in bootloader mode (qcsbl)

If only we could find the drivers for qualcomm diagnostics interface with windows phone running (serial mode in diagnostics app,0x319b)...
[Nokia Lumia 800] jessenic:
I'm 99% sure that these drivers won't work for Nokias, but here are the Samsung Omnia 7 QPST drivers: https://hotfile.com/dl/150390665/a9ca8d9/I8700_Samsung_Mobile_USB_Driver_V5.2__V1.2.1050.0.exe.html
[Nokia Lumia 800] Bph&co:
Hi,

I asked in previous posts for people to hex edit the second partition(the bootloader),

but seems better not, unless you have a recovery method.

The first 710 that felt victim to unsolicited hex editing of the bootloader code:

Init connection...Done
Enter flash mode...Done
Enter bootloader mode...Done
Boot version:	0.0.0.1
------------------------------------------
Flash File:	RM803_12w07_prod_generic_nokia_osbl.esco
Sending certificate...Done.
Sending file...Failed(err: 0x30047).

Did comment out the cert checking functions, but forgot to set this flag:

ROM:04538458 1C 08 9F E5 LDR R0, =[B]unk_45DE83C[/B]
ROM:0453845C 00 00 D0 E5 LDRB R0, [R0]
ROM:04538460 00 00 50 E3 CMP R0, #0
ROM:04538464 8C 08 9F 05 LDREQ R0, =0x30047
ROM:04538468 7D 00 00 0A BEQ bad_err

Hehe, now need to buy another phone.

I could not find an alternative restore method via test point, as suggested earlier

in the thread. The only possible pins for TP access could be GPIO35 or GPIO160

(not likely, seems WD dissable for JTAG access). Shorting to GND or Vcc will not

give different USB device.

JTAG seems to be alive, at least the RST and HOLD pins respond, did not check

actuall comm.

I am attaching the testpoints description, if somebody wants to push this further.

BR
[Nokia Lumia 800] biktor_gj:
Ouch! You could have tried putting nokia's sbl on top of EMMCBOOT and boot it from there (difficult to press the key just in time but...) Does it still do something or is it dead dead?

LK Bootloader update: Well not much to update really, nothing I've done so far works... Even tried contacting the guy who wrote the panel kernel module for the n9 but I think he was fired from Nokia... or at least his mail address has disappeared (no such user). I have tried to force every gpio up, just to make it vibrate, or turn the led flash on or something but no luck so far... will keep on trying anyway :)

By the way, if someone's bored and wanting to look for datasheets, here's the panel: Samsung AMS391PJ01