yashsingh1/xdaforums huggingface dataset:
[Nokia Lumia 900] ankerael:
Hello everyone.

I have a Nokia Lumia 900 with unlocked bootloader / Qualcomm. I mean, I have Nand Access (if I try OSBL mode it asks to format). I'm currently running OS v 8107 and update 8773 is available but update is not feasible via Zune nor NCS (it does not find Nokia bootloader and can't proceed, so reboots).

As far as I know, updating via QPST is neither posible because of custom ROM (.nb file) is not available at this momento. Am I right?

The unlock bootloader is as is 'since factory'. Is there any chance to flash 'original' Nokia DLOAD so I can upgrade via Zune and/or flash OEM ROM via NCS?

Any help would be appreciated.
[Nokia Lumia 900] chrisz5z:
I've never heard of a Lumia 900 with a Qualcomm bootloader.

But if in fact you do, you should be messaging biktor_gj and Heathcliff so they can get a copy of that bootloader from you

Sent from a satellite
[Nokia Lumia 900] ankerael:
Really, it my case, and that's why it's difficult to me to updating because they have not yet been able to unlock 900. Thanks for the tip, i'm going that way.
[Nokia Lumia 900] efektos:
This might be what we've been all waiting for ankerael - keep us posted please if this might lead to unlocking the Lumia 900! :)
[Nokia Lumia 900] chrisz5z:
Well if its the same Qualcomm bootloader that the 800 & 710 have, its my understanding that its already unlocked.

biktor_gj was the one that discovered it for the 800/710, that's why its crucial you message him. If you do in fact have a Qualcomm bootloader for a 900, he would be able to set it up so that we with the NLOAD bootloader can downgrade to the Qualcomm. Then custom roms can happen.

But until then, you can upgrade via the CAB method SuperSport has provided here -> http://xdaforums.com/showthread.php?t=1736863. It only updates the OS though, not the firmware

Sent from a satellite
[Nokia Lumia 900] ankerael:
Hi,

I had already DM biktor_gj and am awaiting for his response. I tried CAB method before (1 month aprox) and had no success. When it restarts the pone and sends upddated files it gives and error (don't remember the number, i'll try to reproduce later) and reboots with the OS non updated.

I'll keep you updated when I try CAB method once again and regarding the response I get of the DM. Thanks again :)
[Nokia Lumia 900] omgbathtub:
anything happen yet? i've recently purchased a Lumia and i'm definiely wondering about this. an amazing phone regardless!
[Nokia Lumia 900] kwill:
Definitely DON'T upgrade anything until heathcliff and others can check out your bootloader. If you do indeed have qualcomm bootloader (and it seems you do as no update method is working for you) this could be VERY helpful in helping us unlock other Lumias.
[Nokia Lumia 900] nscxp2005:
This sounds like amazing news if it can be done.

How do I find out what bootloader I have on my lumia 900?

Thanks
[Nokia Lumia 900] fpoon:
Turn off your phone. Then, boot into recovery (Either Power+Volume Up or Power+Volume Down), then plug the phone into your computer. If it asks you to format, say no, it can brick your phone. You have a Qualcomm bootloader. If it says "NOKIA DLOAD", then you have a Nokia bootloader.
[Nokia Lumia 900] ankerael:
I have Qualcomm bootloader and still have no clue about recovering DLOAD or even flashing a custom/stock ROM. I can't even update via Zune. Still stuck at 8107.79 (FW 8107.12071) ...

Any idea pls?
[Nokia Lumia 900] Heathcliff74:
Hi,

Many people sent me messages with a reference to this thread. So, I will post here some info on this subject.

- It would be useful for research purposes to have a dump of the ROM. You can do that by connecting your Lumia to a Linux box and have it mounted a mass-storage-device. Linux has proper file-system-drivers to access the device. Make sure you don't write anything to the device. Just make a backup of all the files you see on the phone. Use WinRAR to pack it and upload it somewhere for sharing.

- In general, the NOKIA bootloaders have already been analyzed. But they are coded very tightly. No exploit for a HSPL-like-hack have been found yet.

- The dumped bootloader cannot be used to downgrade existing phones to the version with the unlocked bootloader, unless a hardware hack, similar to this, will be found for Lumia 900. It cannot be used now, because a signed certificate is missing for that.

- Currently only ankerael can benefit from this. After you made a backup of all the files/partitions (in Linux), you could ask a ROM builder, like Ultrashot, to fix a nice ROM for you. Maybe he can create an unlocked ROM for Lumia 900 for you? You could follow this guide for flashing the Nokia Lumia. Be careful! It is easy to brick your device with this stuff!

Good luck,

Heathcliff74
[Nokia Lumia 900] ankerael:
Hello everybody, I have some pictures so you can see i'm talking serious about the bootloader. I'll try what @heathcliff74 suggests by the night and keep you posted.

Sorry about being a little distant these days but have had lots of work stuff. I am back now.

Thank you all.

PS... Images are not visible but you can follow the link. They are hosted. @ Skydrive.

I am thinking moving to 920 so if someone is interested in this phone tell me.

I will host the files later @ Skydrive too.
[Nokia Lumia 900] ankerael:
I tried connecting the Lumia 900 into Linux and it showed up this folder.

I am not sure this is what you need,any further assistance will be appreciated.

The link to the RAR file is: https://skydrive.live.com/redir?resid=D038E7CAEF94D5BE!2767&authkey=!AOa8YstcKLg8D6Y
[Nokia Lumia 900] xuninc:
Dude, sell me your phone. Seriously.
[Nokia Lumia 900] ankerael:
Hi! mmmm how much would you pay for it?

* Consider i have No Brand accesories nor box

* Shipping from Mexico
[Nokia Lumia 900] matthewthepc:
Is there any chance that someone could find a hardware hack or the certificate for the 900? Is anyone actively working on this, or is development on the 900 basically dead now that the 920 has replaced it? I know that others have replied to and asked this question, so sorry for asking it again, but I just wanted an update :)

Thanks,

Matthew
[Nokia Lumia 900] ankerael:
Since my lumia 900 suffered a fall and screen get broken (still 100% functional) i decided to get a Galaxy Note II because I couldn't even update. If someone is interested in repairing and having the phone contact me. I am not trying doing a big deal hear neverthelwss i think this unlocked bl phone could be useful for someone with the needed knowings.
[Nokia Lumia 900] Heathcliff74:
I would surely want that device for testing! Plz pm me with the price you want. I can reveal already that i am not well-fortuned. So, if it is too expensive, then it won't be possible for me.

Like to hear from you.

Heathcliff74
[Nokia Lumia 900] Sarge020:
I accidentally format the drive, is there anyway to save my phone?

Please note that you can not turn on in any way or with any key combination.

Regards
[Nokia Lumia 900] whistler-nl:
I dont think there has been any development at all to begin with?
[Nokia Lumia 900] sa-10:
so that guy with the unlocked bootloader was jerking everyone off right?

so that guy with the unlocked bootloader was jerking everyone off right?
[Nokia Lumia 900] ankerael:
??? what you talking about? I have no intention, reason or motivation to joke or fake about that. Anyway, if someone interested the phone is available for research, I had already changed it for a Galaxy Note 2 since i'm waiting to MS's own offer (if some).
[Nokia Lumia 900] whistler-nl:
I thought Heatcliff wanted to buy it from you?
[Nokia Lumia 900] sa-10:
why have you not uploaded your unlocked boot loader to XDA?

Why have you not uploaded your unlocked boot loader to XDA?
[Nokia Lumia 900] ankerael:
I've already uploaded some files to Skydrive. Maybe some guidance about what do you exactly need or how to obtain it would be appreciated.
[Nokia Lumia 900] whistler-nl:
Having the unlocked bootloader does not help without the signature. We need the bootloader osbl and the signature but Nokia has not made a mistake by putting them online somewhere.
[Nokia Lumia 900] matthewthepc:
if someone were completely dedicated to unlocking it, could they open the phone up, replace the snapdragon chip (or which ever chip is checking the signature) with a stock one, and then install a custom ROM? Is it possible to purchase stock qualcomm chips?
[Nokia Lumia 900] whistler-nl:
I dont even know if the bootloader is in the cpu or if its a seperate chip? Like the bios on your pc isnt part of the cpu.

Second, i dont think its even possible to de-solder the cpu and solder another one on it with your home soldering iron. You need to have the equipment and skills to do thats kind of stuff.

And even if you manage that, you want that person to do all lumia's?

My best bet would be on someone who disassembles the bootloader and finds a weak spot in the Nokia loader. That way it could be made available to the whole lumia 900 community pretty easy.

I guess it's just not going to happen as the lumia 900 does not seem to have a lot of users i read? And i dont see Nokia providing an unlocked loader as other manufacturers did for some models as they took so much effort in securing this one.

I need to repair my HTC HD2...
[Nokia Lumia 900] aquanaut88:
Nokia's 'coolness' factor would so improve if someone accidently let loose the vulnerabilities of the AT&T Lumia 900 Nokia bootloader...
[Nokia Lumia 900] efektos:
Nokia would never expose vulnerabilities in their products - they have never done this before and I bet they won't be doing this in the future.

Their security measures are top notch, and have always been top notch (such as BB5).
[Nokia Lumia 900] .NetRolller 3D:
Anyone still has the files from SkyDrive archived? It seems that Microsoft has deleted them.

BTW, it was mentioned that the Lumia 800's bootloader can be changed using a hardware hack, plus a special box. I looked at the pictures of the hardware hack - it appears that the "magic" pins are simply the in/outputs of the eMMC storage chips, which in turn, means that a simple MMC card reader may be all that's needed for a HW mod! (And the Lumia 900 also uses eMMC.)
[Nokia Lumia 900] whistler-nl:
I've still got them on my pc.
[Nokia Lumia 900] .NetRolller 3D:
Cool!

What I've found out so far, is that apparently you can simply wire up the eMMC chip to an MMC card reader, according to this picture (top one):

Orange/black circle is CLK, blue square is CMD, and green circle is DATA. VCCQ is the other side of the CMD resistor. VCC is the non-ground side of the "big" capacitor closer to the orange/black circle. (Both VCC and VCCQ should be connected to the VCC pin of the MMC reader.) Connect GND to the big brown rectangle.

Then, simply use dd or any other tool to write the bootloader.
[Nokia Lumia 900] efektos:
All this is nice, but I think I speak for everyone when I say that I'd want a solution that doesn't involve physically opening the device :)
[Nokia Lumia 900] .NetRolller 3D:
Still, it would be nice to have the Qualcomm bootloader uploaded somewhere (assuming it's not the same as for the Lumia 800).
[Nokia Lumia 900] whistler-nl:
You have a PM.
[Nokia Lumia 900] .NetRolller 3D:
Still having to disassemble the device is better than having to disassemble the device AND buy a box from what's presumably some criminal gang. And even the box doesn't work on the Lumia 900.
[Nokia Lumia 900] whistler-nl:
You do have a point there.

But opening phones and putting wires to the soldering points is'nt recommended for everybody (i know i dont have the soldering skills required..).
[Nokia Lumia 900] usr9261231:
(msg. deleted)
[Nokia Lumia 900] usr9261231:
i want to try
[Nokia Lumia 900] Sarge020:
Everything perfect, I have my Lumia 900 open and I'm about to lay the cables, but I do not understand if I need to have a box or if I should connect it into a RJ45 PC Network Adaptor.

If I should connect to RJ45, which software should I use to write the bootloader again and where I can get a bootloader for my Lumia 900 AT & T?

Thank you.
[Nokia Lumia 900] usr9261231:
No, you must use a MMC or SD card-reader and connect the pinouts with some cables;

as he said
[Nokia Lumia 900] Sarge020:
I do not think an SD memory card reader is the right tool

I've been researching and it seems you need to have the ATF box

Without the box does not make sense to disassemble the phone.

Here some info about the cable and box:

http://www.fonefunshop.co.uk/cable_picker/97009_Lumia_Test_Point_Cable_For_ATF.html

http://gsmserver.es/shop/gsm/advance_turbo_flasher.php

Seems who posting pictures of the test point did not read enough ...
[Nokia Lumia 900] usr9261231:
if the reader does the same thing as the network/ATFbox does? , because i did the same search
[Nokia Lumia 900] Sarge020:
Whatever..

If it works, you must face the following issue...

There is no way to put any cable in these contact points

If you find a way to do it, please tell me how to do it

Grettings.
[Nokia Lumia 900] usr9261231:
i can try to use one of the 6 wires contained in a small cable, that are 2.5-3/10 of a millimeter , but is extremely difficult to keep these touching the mothb.
[Nokia Lumia 900] Sarge020:
That's right, space is microscopic and any mistake can cause irreversible damage to the hardware.

I think there must be a more practical way of doing.
[Nokia Lumia 900] usr9261231:
I hope
[Nokia Lumia 900] exiva:
There isn't. and won't be for the foreseeable future. For some reason the 900 didn't grasp anyones interest really in this area, and fell to the side. Anyway, If you don't know what you're doing, and don't have the proper tools you may as well just throw the phone out before you even begin -- You will destroy it. That said, if you can find a shop with an ATF box they may be able to help you. But, I don't think anyone has successfully flashed the Qualcomm bootloader back to a 900.
[Nokia Lumia 900] .NetRolller 3D:
For those who are confused: The images were made for the ATF Box (which works slightly differently, and thus not all points have to be connected); when using a card reader, additional connections are needed, which I described in text. Using a card reader is IMO a cleaner solution - it simply drives the eMMC chip as it would drive a regular MMC card while the phone is otherwise powered down, while the ATF Box appears to do some "arcane" tricks to override the logic levels on the chip command & data lines while the phone is running. Plus, it avoids the cost of the ATF Box itself, which I fear would otherwise finance some criminal gang's activities.

Disregard the RJ45 connector images (they are for ATF only), use the pin mappings provided in my post.

The best way to make the connections is with thin solenoid (coil) wire, that has to be soldered to the marked SMD terminals directly. Do not attempt if you are not good at SMD soldering! Solenoid wire is already covered with an insulating layer, which reduces the risk of shorts.

Once the connection is set up, the right boot image to write is the one for the Lumia 710 (don't forget to extract the raw image from the esco file first!).
[Nokia Lumia 900] Sarge020:
Encouraging...
[Nokia Lumia 900] usr9261231:
(msg deleted)
[Nokia Lumia 900] usr9261231:
Ok I got the card-reader, the wires and the salder etc...

I'm a bit unsecure about the point connections so I post a image, if incorrect tell me

{ http://postimage.org/image/9zhobbp81/ }

And second; i'm insecure about the mmc-card-pinouts, because there is a DataIN and DataOUT pins, i will not flash first my phone because i want to get the files inside in that chip and download that DAMN Nokia-DLOAD to help others to crack it,

and I will not to brick my Lumia

Last i found this,I don't know if can help, just see only

{ https://github.com/beidl/lk_umia }
[Nokia Lumia 900] exiva:
I think you want to use the pinout on the right, not the left. http://farm3.staticflickr.com/2582/4005627546_c115478141.jpg
[Nokia Lumia 900] .NetRolller 3D:
Almost, but not quite:

-VCC is on the relatively "big" capacitor closer to the CLK point - the point you marked as VCC is on a resistor. (There are two "big" capacitors next to each other, choose the one that is closer to CLK. One side of this capacitor is GND, the other is VCC - use a multimeter to find which one is which. The GND side should show a direct connection to the big, rectangular source of GND.

-You used the pinout of an SD card. MMC is slightly different - look up the 7-pin MMC pinout (true MMC mode, not SPI).
[Nokia Lumia 900] usr9261231:
Is now right? if not, show Me more accurately

{ http://postimage.org/image/tzhg2lpfb/ }

here I think the left is the grouded point, for the VCC

-I think the SDs were made compatible with the old MMCs, without 9 and 8 it's a MMC, the connector is the same, I'm not sure
[Nokia Lumia 900] .NetRolller 3D:
If you mean the ground side is the one with the red line, then yes, it's correct. But use a multimeter to find the grounded point before actually soldering the wires!
[Nokia Lumia 900] usr9261231:
an another question;

The Nokia-Service-Manual give the infos about the eMMC-chip has inside a Nand and mmc, and need 4 DAT wires instead of one (like a SecureDigital), where VCCQ is the MMC power supply (1.8v), nand is 2.9, I need those connections?
[Nokia Lumia 900] .NetRolller 3D:
The 4 data lines correspond to MMC Plus, not SD. They are optional, if your reader supports MMC Plus, you can wire them for more speed. (In fact, the chip has 8 data lines, which I think are all connected to the 8 test points at the left of the picture. The phone uses only 4.)

The chip supports both 1.8V and 3.3V signal levels, selected by VCCQ. Most card readers expect 3.3V, so no 1.8V should be used.
[Nokia Lumia 900] Sarge020:
I would like to know if you could finally make the connections and if so, if you finally fixed the problem.

Regards
[Nokia Lumia 900] pedrocel85:
Hey there,

Netroller idea has been proved?

If its worked im eager to try.

If it works...netroller will get xda frontpage and instant developer reconissance status.
[Nokia Lumia 900] usr9261231:
I'm sorry for the absence, but im there now

I've got a last question,

if I do something wrong with the other connections, the ground-connection will save the mob?
[Nokia Lumia 900] skiddd:
@ .NetRolller 3D

We are not a "criminal gang", hehehe. What made you instantly assume that? :)

Anyway, your memory card reader idea will have no chance of working if you plan to connect VCC, VCCQ etc...

This is because the MSM (when powered off) will constantly sink any logic driven to any of it's I/Os, and memory card

readers don't have enough mA drive to force a "0" to "1".

Timing is crucial, the eMMC has to be initialized right after the MSM halts after it sees a "corrupted" SBL and when the

eMMC Reset PIN is already held high. It will only also work at a narrow voltage range, which is again dependent on

how much mA your card reader can drive.

To enabled "USB EMERGENCY MODE" is possible, but you need to GND 2 points on the PCB, and currently the official

qualcomm diagnostic driver only works on 32-bit winxp machines... I want to avoid discussing more about this "hack" because

you still need to open disassemble the phone and create custom boot images for QPST.

@whistler-nl

The JTAG Pads are accessible right under the SIM Card SOCKET. You can remove the SIM Card tray

and point a flash light on the docking area and you will see what I mean. Nokia have a Special "cable" that connects

through the SIM card socket and to those JTAG pads. I have tried to acquire this "cable" for months now

but it seems it is super hard to order it from nokia even for valid Level 4 service centers. The Lumia 900

Schematics also mentions these JTAG Pads but does not clearly mark it's location. I was tempted to

uproot the MSM some months ago just to trace the pinouts manually,,,, but all that effort is useless

unless a "QCOM OSBL" actually exists...

Can you share the skydrive files for me to test it on a AT&T 900?

If found working, then I will trace the JTAG pads on March when I get back to work. (if anyone is still interested by then).
[Nokia Lumia 900] whistler-nl:
@skiddd

You have a pm with the link to the files.

I really think the only way to get the most out of the Lumia 900 is by building our own custom roms. And after the hyped 7.8 release that didn't bring much usefull besides the wp8 startscreen :( we (and our phones) deserve more.

The Lumia 900 was my first Nokia Phone after using HTC for years and my next one will be a HTC again even if Nokia has some better hardware parts (like the screens).

I dont know why but i do feel like my HD2 was performing better on wp7 then the Lumia...?
[Nokia Lumia 900] skiddd:
@whistler-nl

Thanks for the files. Unfortunately, none of those files contain the OSBL partition.

We need a QUALCOMM type OSBL,,, which will make all Partitions accessible

via USB.

I don't know which software was used to dump the MBN files, but the exact partition that is needed

is the second entry on the MBR.

This one:

MBR Entry[1]:

Flags: 0

First Head: 0, Last Head: 0

First Sector: 0

First Track: 0

Last Head: 0

Last Sector: 0

Last Track: 0

Type: 0x46 <--------------------------------------- 0x46 is the OSBL

Starting Sector: 0x3e9

Sector Count: 0xbb8

So is the thread starter still around to check with the phone again?

I also cannot see any of those screenshots which the thread starter mentioned.

Did it really show partitions accessible via USB?
[Nokia Lumia 900] whistler-nl:
As far as i know those files are the only files available to us. I have never seen a .esco bootloader file for a Lumia 900.
[Nokia Lumia 900] .NetRolller 3D:
I've received a dump of ankerael's bootloader in PM. I'm still analyzing it, but it appears to be a genuine Qualcomm boot loader. I'm not sure if posting a link here is permitted - I'll post it as soon as I get confirmation that it's not against the board rules.

However, it looks like the bootloader is almost the same as existing Lumia 710 and 800 Qualcomm loaders, so simply flashing a loader from Lumia 800 may also work.

@skiddd: Are you an actual ATF developer? I actually expected some Russian or Middle-Eastern underground team behind ATF, similar to the infamous DM3 box. I didn't realize there are countries where it's fully legal to produce and sell flasher boxes...

BTW, keep in mind that the 900 has no MSM chip inside - there is a separate APQ8055 CPU and MDM9xxx-something modem. The JTAG pads may lead to either of those - according to the SM, both chips have JTAG interfaces.

I would be curious which 2 pins need to be GNDed for QHSUSB mode - there are quite a few tools (including unofficial ones) that can work with HTCs in QHSUSB mode; AFAIK there was even one HTC for which the rooting method involved softbricking the phone to throw it into QHSUSB. It wouldn't be hard to imagine the same tools working with a Nokia in QHSUSB mode.

Shouldn't grounding VCCQ be enough to trigger QHSUSB?

BTW, this site appears to have schematics for the L900: http://www.dlgsm.com/register.php?f...ervice-manual/nokia/9_series/900_Lumia_RM-808

Unfortunately it's a pay site, and quite shady at that IMO.

@whistler-nl: no need for a .esco bootloader - a .mbn is all that's needed for direct eMMC flashing.
[Nokia Lumia 900] efektos:
.NetRolller 3D, do you think the information you acquired might lead to being able to interop-unlock the Lumia 900?
[Nokia Lumia 900] .NetRolller 3D:
Yes, if we can make a working eMMC flasher (or if it's incorporated in ATF Box).

@skiddd: It would be nice to add the ability to flash custom (raw) image files in ATF, rather than having to work with the internal images.
[Nokia Lumia 900] whistler-nl:
If the bootloaders of the 710 are allmost the same we could flash the signed qualcomm bootloader of the 710 so we dont need any hacking around anymore... if it would have been so easy i guess someone would have found that out before?
[Nokia Lumia 900] .NetRolller 3D:
I took a bit closer look at the boot loader, and it is indeed different, much more than the 800 is from the 710. Perhaps because the 710 and 800 both have MSM SoCs, while the 900 is an APQ + MDM dual-chip device.