yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 800] Phenom1:
Hi guys!

I have Lumia 710 RM-803! I try to unbrand and unlock but phone stucked and not power on now just have dload and vibrate on power on! I try to recevor via Nokia Care Sutie and always get message ERROR: OSBL reported an error! Code: 0x30022

Do you know some solution for this?

Regards!
[Nokia Lumia 800] Phenom1:
Does anyone knows.......
[Nokia Lumia 800] bartjuhhbartyow:
if anybody have a Qualcomm bootloader img

i will try it

Regards
[Nokia Lumia 800] Zae0:
For who need it here's are the files of the bootloader :laugh:

http://www.2shared.com/file/ud9Xv8Ze/Lumia.html
[Nokia Lumia 800] deviantenator:
just downloaded your file. and found this file:

RM801_OSBL_QCOM.bin

is that really Lumia 800 Qualcomm Bootloader?

where you get those files?just curious.
[Nokia Lumia 800] trenbeth:
Is the bootloader file RM801_OSBL_QCOM.bin signed? Up until now we only had an unsigned Qualcomm bootloader which does not help with replacing the DLOAD bootloader.
[Nokia Lumia 800] Zae0:
Files came with the atf application who had a folder named lumia with those files
[Nokia Lumia 800] surya467:
are these qualcomm signed?
[Nokia Lumia 800] NielDK:
then, sorry, these are not signed and uou will need ATF and testpoint method to flash (in which case you will get the files with ATF software)
[Nokia Lumia 800] surya467:
http://betalabs.nokia.com/trials/nokia-city-lens-for-windows-phone

city lends beta..better than the one on marketplace currently!
[Nokia Lumia 800] pedrocel85:
kexec method

Hey guys,

Just an idea.

Ive read somewhere that is bootloader lockdown is similar to the ones on 2011 lineup of sony ericson android phones.

Well, if thats true, that bootloaders was bypassed alreadt by kexec method.

It has been done in all S.E devices.

Doomlord is the magician.

Threads:

Unlocking bootloaders for SE 2012 lineup

http://xdaforums.com/showthread.php?t=1527159

The author is:http://xdaforums.com/member.php?u=2784807

His method from x10 line has been proved for so many devices qualcon branded, also exynos:

SGS3 thread for kexec method os bootloader bypass:

http://xdaforums.com/showthread.php?t=1760678

hope it helps.

best
[Nokia Lumia 800] bartjuhhbartyow:
can you tell me more about the kexec method?

Kind regard
[Nokia Lumia 800] pedrocel85:
Sure,

Kexec method patches the bootloader controler of chains signatures.

As the controlers become inoperant, it doesn mather if its signed or not.

The bootloader and kernels will be acepted and work.

There is several discussion here is xda. Many examples and many many devices have been beat down with this method.

Im not a coder, just an enthusiast.

I can point to many tutorial threads here in foruns, for those whos capable to do the trick.
[Nokia Lumia 800] trenbeth:
For kexec to work, you need to put the phone in recovery mode and make it run stuff from the SD card.

The Lumia 800 is very restrictive, so if you do not have one of those early phones with unlocked (and unsigned) Qualcomm bootloader, then you are stuck. And the only way to remove the restrictive DLOAD bootloader is to use the ATF box (costs about 150 euro, and requires some soldering), or get someone else to change the bootloader for you (for a small fee).
[Nokia Lumia 800] pedrocel85:
Well, let me disagree.

Kexec method doesnt require recovery mode.

IT requires Flash mode only, witch de have acess already.

IT has beeing done somethimes, recenty in 2nd generation wp by chianise dark forces group.

best,
[Nokia Lumia 800] NielDK:
could someone, with knowledge on navifirm files, and how to extract the esco images help check if the files I found for 11416 version contains a signed qualcomm bootloade?

http://xdaforums.com/showthread.php?t=2086948
[Nokia Lumia 800] pLUSpISTOL:
Remember this?

:fingers-crossed: http://www.youtube.com/watch?v=xMhSRyDSlWc
[Nokia Lumia 800] moropazzo96:
News for Lumia 800 with bootloader lock? :crying:
[Nokia Lumia 800] moropazzo96:
Mmm, I was thinking of NaviFirm there are 3 different versions of Lumia 800: RM = 801/RM = 819 and RM = 802. It 'possible that one of them there is the bootloader qualcomm?
[Nokia Lumia 800] amir323b:
hi guys . I have lumia 800 ... and when I was flashing custom rom , it does stuck on nokia logo .... what should I do right now ? ????:confused:
[Nokia Lumia 800] .NetRolller 3D:
Probable boxless - though still hardware-based - way of unlocking the bootloader on Lumia 800 (also Lumia 900, with different test-point layouts):

You will need an MMC card reader that supports >4GB cards, a good soldering iron and some thin, insulated wire (e.g. coil or jumper wire).

Disassemble the phone, disconnect everything from the board (including the battery).

Solder wires between phone M/B and the card reader according to these 2 images:

VCC -> VDD S

VCCQ -> VDD S

CLK -> CLK I

MOSI -> CMD I/O

MISO -> DAT0 I/O

GND -> VSS1 S

(Leave CS on the phone side, and RSV/NC and VSS2 S on the card reader side unconnected.)

Plug in the card reader to your computer. Windows should ask you to format -> SAY NO! (just like when connecting a Qualcomm Lumia 800 via USB)

Download HxD. Using HxD's "Open Disk" feature (in the Extras menu), open the physical drive corresponding to the card reader. Make sure to uncheck read-only mode.

Use the toolbar to navigate to sector 1001. The first bytes should be "0B 00" - otherwise, you are in the wrong sector.

Go to Edit -> Select block. Click "Length", and enter "180000" in the Length field. Press Ctrl+C.

Go to File -> New. In the new tab that opens, press Ctrl+V, and click OK. Save the resulting file on your hard drive - this is a backup of the original boot loader.

Close the new tab, and navigate to sector 1001 again.

Open the file with your Qualcomm bootloader (use an image extracted from a Lumia 800 that originally came with Qualcomm, or just extract the raw image from the leaked *.esco file commonly used for Lumia 710 unlocking), select all, and press Ctrl+C. Close the file.

Back in the original tab (still at the beginning of sector 1001), press Ctrl+B and accept any warnings. Press Ctrl+S to write the changes to the eMMC chip. Close HxD.

Safely remove the MMC card reader, desolder the wires from the phone logic board, and reassemble the phone. Boot your phone, and you're done.

(Mostly re-posted from the Lumia 900 forum, adapted for the Lumia 800, in case it generates more interest here.)
[Nokia Lumia 800] djtonka:
So if we can use *.esco from Lumia 710 why do not use NSS Pro?
[Nokia Lumia 800] moropazzo96:
you can not flash the bootloader qualcomm via software? without hardware changes? :confused:
[Nokia Lumia 800] debbuger:
xdaforums.com/showthread.php?t=1587650&page=86

on this page a dev is talking about the bootloader description....i think its fifth post...in that post,in the first part written as key 1-0x72 & key 2 -0x73 , i think are chipset identifiers...once i've seen 0x73 may be its 0x74 in registry as chipset in my lumia 710...
[Nokia Lumia 800] .NetRolller 3D:
The esco file only contains a valid signature for the 710 - the 800 will not accept it through the normal flashing interface. Therefore, you must write the bootloader extracted from the esco file directly into the eMMC.
[Nokia Lumia 800] trenbeth:
Is there a service manual that shows how to open up the Lumia 800?
[Nokia Lumia 800] pLUSpISTOL:
Better than a guide :

http://www.youtube.com/watch?v=YS9azQLWNAI
[Nokia Lumia 800] .NetRolller 3D:
@trenbeth: Google is your friend.

BTW, I have another idea for an even simpler hack: simply short TP1555 (eMMC clock) to GND, and plug in the USB cable. This should trigger "QHSUSB_DLOAD" mode.

EDIT: It turns out, for the card reader trick, not any card reader will do - you will need one that operates in SD/MMC host controller mode, and not USB mass storage mode. Thus, most PCI, PCIE, Cardbus and laptop built-in card readers should work, but USB ones usually won't. (Because it's generally a bad idea to solder wires directly into one's laptop just for a phone hack, I suggest getting a MiniSD or MicroSD adapter, and soldering the wires from the phone to that adapter.)
[Nokia Lumia 800] surya467:
how about this?

http://www.fonefunshop.co.uk/cable_...Test_Point_Cable_Set_For_ATF_(Pre-Order).html
[Nokia Lumia 800] djtonka:
But built-in card readers are still on USB I suposed.

So short TP1555 (eMMC clock) to GND would work?
[Nokia Lumia 800] .NetRolller 3D:
The built-in card readers I've seen so far were all PCI-Express, appearing in Device Manager as an SD/MMC host controller.

But even with a USB reader, it should be possible to interop unlock, or maybe even root the device, as the main OS partition (including the registry) should be accessible.

EDIT: The test-point cables are only good for ATF or the testpoint shorting hack, as they don't connect the VCC and VCCQ lines. (ATF operates on a powered-ON PCB, and overrides the logic levels sent by the main CPU, rather than operating with a powered-down PCB with the CPU inactive.)
[Nokia Lumia 800] pedrocel85:
Net,

Does your ideas worked? you managed to flash qualcombootloader?
[Nokia Lumia 800] .NetRolller 3D:
Not yet, I have the Lumia 900 (where CLK is not easily accessible - instead, it's VCCQ that can be shorted to ground), and I'm waiting for ankerael's PM with the dumped bootloader. (His earlier dump didn't include the bootloader proper.)
[Nokia Lumia 800] djtonka:
Instead USB card reader could we use MMC card with soldered wires and then put into bulitin reader?
[Nokia Lumia 800] .NetRolller 3D:
Yes, that's exactly what I recommended. (Internal card readers are usually PCI/PCIE-based, which present the card directly to the OS, rather than emulating a USB flash drive.)

If you use Linux, changing the bootloader may be even easier, as it will show up as a separate block device "/dev/mmcblkXboot1" (or maybe boot0 - you will need to check it yourself). By default, this device will not be writable, to guard against accidental overwrites - read the documentation for enabling writes to the boot partitions.
[Nokia Lumia 800] Bph&co:
Hi,

I am still yet to see somebody implement off power read/write of the eMMC chip. ATF manages with so many wires by the fact that the chip

is still wired to the CPU and all control signals are handled correct. If you watch the protocol on screen you will see that ATF FGPA asserts

low's and high's(high levels slightly higher than phone's 1s and lows via bridging few gates in parallel to assert low impedance on the bus) during

the important boot mode check when the eMMC is in 1bit SDIO mode, immediately after restart.

To use external MMC reader and not powered phone PCB you will need bit more lines connected, maybe less with a small microcontroller

development board and using the HW SDIO interface(most chips have it these days) e. g. - STM32F4Discovery, but you still need to cook

custom boot sequence yourself.

The standard firmware in off the shelf reader would probably not manage to take control of the eMMC as i suspect it not communicate in 1 bit

SDIO mode, probably do in the beginning and then switches to wider interface.

BR
[Nokia Lumia 800] .NetRolller 3D:
Actually, the eMMC chip documentation shows that it fully supports 1-bit MMC (not SDIO, and not SPI) mode, and only switches to a higher bus width when explicitly requested to do so.

EDIT: Not very relevant, but open the Lumia 710 boot loader MBN in a hex editor, and go to address 0x1E490 for a good laugh. :) Or, if you have the Lumia 800 Qualcomm boot loader image, it's @ 0x1E52C.
[Nokia Lumia 800] Bph&co:
Hi,

I guess 1-bit MMC = SDIO, sorry my bad. The phone for sure switches to wider bus after initial boot sequence, i haven't reversed this part, not sure

where it is, probably the bootrom. But during this initial chip inquiry is the golden opportunity to take control and off course hats off to X-Shadow for

the hack and implementation (!).

What version of the bootloader ? I have some old diss, i have ptr to a string at this location.

BR
[Nokia Lumia 800] .NetRolller 3D:
How about accessing the eMMC while the board is otherwise down? In that case, no worries about switching to a higher bit width.
[Nokia Lumia 800] tombalaci_46:
Files removed, can you reupload ?
[Nokia Lumia 800] ceesheim:
did someone who has problems with getting this to work try to flash (see attacments) to a lumia 800 ?

it could work because the phones are almost the same ( if not the flasher sould error out )

my bad , sould work now (unrar :) )
[Nokia Lumia 800] beidl:
That's an HTML file.
[Nokia Lumia 800] ChrisKringel:
Nope… It contains RM803_11w48_prod_generic_nokia_osbl.esco
[Nokia Lumia 800] ceesheim:
he was right , by renaming it to .zip and uploading it to xda it got bricked , I reuploaded it but first I rared it and that works.
[Nokia Lumia 800] biktor_gj:
Sorry to disappoint, but it has cert checking...
[Nokia Lumia 800] balcsida:
Keep working guys! I doesn't have any Lumia devices, but my dreams maybe comes true.
[Nokia Lumia 800] ceesheim:
that was the oldest stock that I could find , seems that there isn't any rom with that osbl then
[Nokia Lumia 800] Briefcase:
Over at the following thread: http://xdaforums.com/showpost.php?p=23878400&postcount=1 a user reports getting the Qualcomm mass storage after changing firmware. So it looks like the version of the bootloader is dependent on the firmware/rom and not on the hardware revision.

Also note that in that same thread another user got the same Qualcomm mass storage device after changing firmware. He confirmed the format dialog so it looks like now he has a broken bootloader. I think that might be the reason why Nokia released another version of their bootloader...
[Nokia Lumia 800] surya467:
yea..cant downgrade beyond a low firmware that the bootloader supports i guess..

now he has to update to 12070.

i guess i am stuck with 12070 and HW rev 2.4
[Nokia Lumia 800] donpromillo:
Hi,

I'm on a Lumia

OS 7.10.8107.79

FW 1600.2483.8106.11500

HW Rev. 112.1402.2.3

Funksoftw ver: 1.6.00.24

Funkhardw ver:8255

Bootloader: 7.35.0.0

Chip-SOC-Ver 0.74.2.1

and it works on my Win7 x64 Pro as Qualcomm USB Massstorage as described by original poster.

For all of you who are unable to get it working: Have you tried to remove all unknown and nonpresent devices from devicemanager of your windows-pc? Often an old entry of a nonpresent device prevents the normal behaviour also in other situations, where a device is not recognized correctly. To check that, you can look here support.microsoft.com/kb/241257 on howto show nonpresent devices.

Regards

Donpromillo
[Nokia Lumia 800] xsacha:
Definitely nothing to do with my computer.

I've tried 4 different laptops with various configurations. It always resuts in Nokia DLoad with the boot to WP7 following.

The people who have this working don't get the WP7 boot after disk mode which suggests that the bootloader of the phone is acting differently.

So it's entirely down to the bootloader the user has and nothing else as far as I can see.

Although, even with the same bootloader version two users are getting different outcomes so perhaps it also depends on the region of the firmware?

I'm out of ideas :D

By the way:

Diagnostics App Version: 1.9.4.0

Firmware Revision: ...12070 (I updated just now)

Radio HW Revision: 8255

OEM Device Name: RM-801 SE 615

Device HW Revision: 112.1402.2.3

Note: I have one of the first retail units. It was sent to me by Nokia before the public release.
[Nokia Lumia 800] dy_domyoung:
Im not sure if this will help but;

The Nokia 800 uses a NAND lumia eMMC

The capacitive touch digitizer is an ATMEL mXT224

The controller is a Broadcom WiFi BRCM4329
[Nokia Lumia 800] beidl:
What we currently need is info on how to initialize the screen and power it on from within a custom bootloader. More specifically, we need the right addresses for the screen and the framebuffer. Any developers that have experience in modifying the LK bootloader?
[Nokia Lumia 800] xsacha:
I just realised something. Which hardware Lumia 800 are you guys using? Also, which method did you use to update?

RM-801 (900MHz)

or

RM-819 (850MHz)

AND

Zune update

or

NCC/FiRE update

I have a RM-801 with Zune update and not working.
[Nokia Lumia 800] ale07:
I have a RM-801 EU 222, HW revision 112.1402.2.3, updated to 12070 through zune, and it shows up as a removable disk.
[Nokia Lumia 800] ChrisKringel:
RM 801 with HW 112.1402.2.3 and updates via Zune only. Currently this phone is on the 12070 firmware. I sent it to a Care Point once, maybe they did something there....
[Nokia Lumia 800] xsacha:
What's the firmware/region name to get EU-222. I'll try and install it.
[Nokia Lumia 800] cdbase:
some update methods leave bootloader untouched , im still trying to refurbish and flashing different regions on NCS cuz cab method leaves bootloader untouched and zune im not even sure so please send me your phone details and firmware ver and also info like vodafone_es_retail mode v1 black for ex if you know it and got qualcomm mode working on lumia 800

eu 222 is gb
[Nokia Lumia 800] xsacha:
OK guys, I think I found the issue.

If you have *EVER* flashed (without zune) 11501 or 12070, you will not be able to do this.

These two firmwares include a new file (not seen in earlier firmwares) called prod_generic_nokia_osbl.esco. That is the bootloader right?

I flashed 11501 using Nokia Care Suite. Hence, I have the new Nokia DLOAD bootloader.

Note: It's a 935KB file. Someone posted the new 'locked' file vs their dumped 'unlocked' file earlier and showed that unfortunately it requires a signature.

Note: Some RM-819 firmwares didn't include the new bootloader. It's only if you flashed that file!
[Nokia Lumia 800] cdbase:
this is not correct i know a guy who flashed using NCS and then he got it working
[Nokia Lumia 800] xsacha:
Yes, I saw the forum messages about people updating to 12050 on NCS and then getting this.

Notice the filename for 12050 on NCC is now:

RM803_12w05_prod_generic_updated_nokia_osbl.esco

They changed this because the original 12050 bootloader appeared as:

Qualcomm HS-USB Diagnostics 9006
[Nokia Lumia 800] ombadboy:
Not sure what I flashed, but I got 12070 flashed using CAB Sender and it's working fine.. (Flashed as soon as singapore cab was available)
[Nokia Lumia 800] xsacha:
Yeah CAB Sender = Zune

It doesn't flash bootloader.
[Nokia Lumia 800] whitealien:
I can confirm. I flashed only using zune and I got Nokia DLOAD.
[Nokia Lumia 800] cdbase:
so ok there's something you can do for us ,please make a restore point

and upload it if you find a minute to do this.Also anyone who got Qualcomm .

Thanks!
[Nokia Lumia 800] xsacha:
Found a bootloader without a .cert!!!! The entire firmware doesn't have any .esco's. Very strange.

RM-819 -> 12070 -> Nokia 800 RM-819 Country Variant Australia AU Cyan V2_COLOR (059N6Q8)

RM801_12w07_prod_generic_nokia_osbl.mbn

I think I can make a .mbn out of the one someone dumped earlier (sdb2). Can be flashed directly? :)

See relevant xml file:

<program file_sector_offset="0" filename="RM801_12w07_prod_generic_nokia_osbl.mbn" label="OSBL" num_partition_sectors="3000" physical_partition_number="0" size_in_KB="1500.0" start_sector="1001"/>
[Nokia Lumia 800] ap3rus:
How come anyone earlier not proposed to create a restore point , great idea ! :)
[Nokia Lumia 800] xsacha:
A restore point would be like a Zune update. It does not affect bootloader.
[Nokia Lumia 800] ombadboy:
Could you please explain me how to? Is it just a regular backup? (no personal info saved right?)

Thnx
[Nokia Lumia 800] cdbase:
http://xdaforums.com/showthread.php?t=1346030

read that thread :)
[Nokia Lumia 800] xsacha:
OK guys, I have created:

qualcomm_osbl.mbn

Download here: http://www.mediafire.com/?45hz8t4dsxfshfx

This is the original bootloader that comes with the phone and allows 'Disk mode'.

Replace it with RM801_12w07_prod_generic_nokia_osbl.mbn in "Nokia 800 RM-819 Country Variant Australia AU Cyan V2_COLOR (059N6Q8)"

Untested!
[Nokia Lumia 800] flex0r:
Heath:

It's interesting to see what is your hardware version, because I tested this on 3 Lumias (yeah our household is Nokia powered..!)

I only got it to work on 1 phone though:

Dev phone :

HW 112.1402.2.3

Radio software 1.6.00.24

Radio hardware 8255

Bootloader 7.35.0.0

Chip SOC 0.74.2.1

On those 2 it didn't work, only difference in HW version:

HW 112.1402.2.4

Radio software 1.6.00.24

Radio hardware 8255

Bootloader 7.35.0.0

Where it doesn't work I have the exact same result as you found, you feel the short buzz, you connect USB, but instead of showing up in windows, nothing happens, another short buzz, nothing happens again, and after that a long buzz and it boots, so here it looks like all that matters is the HW version,

because the 2 phones with the .4 at the end, both didn't work, while on different firmware version (11500 and 12070) (the 12070 updated with zune).

Also the dev phone with HW version .3 at the end, is updated to 12070 with cab sender method, so unlike another posts says, this does not make this impossible!
[Nokia Lumia 800] xsacha:
This has nothing to do with hardware versions. Your findings are a coincidence. It's all about whether you have the Nokia bootloader or not.

.4 might just come with the Nokia bootloader pre-installed.

Cab Sender = Zune update = doesn't update bootloader = you have original bootloader.

I have looked at the bootloader and can confirm that the nokia_osbl bootloader contains the "Nokia DLOAD" "Secure init" when volume up+volume down is held.

Whereas, the original bootloader (unaffected by Zune and Cab sender), has "Qualcomm" and no mention of "DLOAD" when volume up+volume down is held.
[Nokia Lumia 800] cdbase:
why should i instal rm-819 firmware on rm-801 ??
[Nokia Lumia 800] xsacha:
Haha, you don't have to because yours already works.

RM-819 works on RM-801 hardware (I've used it before). It just so happens that this firmware (which is RM-819) is unsigned, no .esco's and has a flash layout (partition sizes / offsets). So it's perfect candidate for.. well.. changing stuff :)
[Nokia Lumia 800] flex0r:
This is exactly what my testing some Lumias showed, Nokia DLOAD shows up for the .4 revision, while .3 shows up as "Qualcomm etc".

So would this mean everyone with newer HW revisions is out of luck?
[Nokia Lumia 800] ap3rus:
I am a user of hw .3 and I have DLOAD, so this is must be a wrong assumption, true is somewhere else ;)
[Nokia Lumia 800] xsacha:
No they are not out of luck because they can flash the older one. Read up.

It's also nothing to do with the hardware revision, just a coincidence due to that hardware revision coming with 11500 at minimum.
[Nokia Lumia 800] cdbase:
there are two firmwares with same product code but

one is without mbn file so use navifirm to see the files

and ok i have nothing to do now and i'll check your qualcomm.mbn
[Nokia Lumia 800] ombadboy:
"100% device Backup Method (SMS/Email/WhatsAPP)" -> any way to exclude that from the restore point? My Lumia is my everyday phone and it's full of personal info
[Nokia Lumia 800] xsacha:
I know everyone is just ignoring me, but basically: Forget the backup, it doesn't back up bootloader.

It's basically only for backing up personal info which is what you don't want to back up.

No one has ever needed to back up a bootloader before so this function doesn't exist.
[Nokia Lumia 800] Briefcase:
I'm afraid it's not :( Zune backups are encrypted too so we can't alter them either. That's why I do not see how this could help.

Edit: ah apart from that it doesn't even backup the boot loader, see the reply above me ;-)
[Nokia Lumia 800] ombadboy:
I am a bit new to all this, is there a way to backup the bootloader from mounting it on Linux as a disk? If so I could give it a go..
[Nokia Lumia 800] xsacha:
Yes, it's sdb2. Just dd it. Someone already did it for us.

I found that, converted it to a .mbn, found a compatible firmware and posted it on the last page while you guys were working out backups :P.
[Nokia Lumia 800] ombadboy:
Great! Let's see if all those not getting Qualcomm can get it working now, including Heathcliff
[Nokia Lumia 800] Heathcliff74:
I don't think we/they are ignoring you. It is just a matter that our balls are not big enough to try it (chance of bricking is just a bit too big)

Thanks for making the mbn though. Let's see who tries it.

Heathcliff74