[HTC Desire S] rxboucher:
Hi All

In my quest of trying to restore my phone to its original state after a hard-brick resurrection, I came up with a procedure to restore/change the WIFI-BT mac addresses.

So hoping that it could be helpful to the community, I'm sharing it with you.

I'm also writing a post about my investigations concerning the Radio/WLAN low level configuration.

As soon as it is ready I'll add a link here, so if you're willing to help or if you're interested in my investigations, stay tuned !!!

1. Prerequisite:

- Rooted and S-OFF Desire S

- USB Debug must be enabled on the phone

- Fast Boot must be disabled on the phone

- Android tools installed (look for tutorial in this forum on how to install them.)

- I assume that you already know how to use the android tools.

2. Disclaimer

- I decline all responsibilities for bricked phone and such.

- You're using this procedure at your own risk.

3. The Theory:

The Radio/WLAN configuration is stored in the mmcblk0p23 partition.

3.a. Changing the WIFI MAC address.

The WIFI configuration is located at the beginning of the partition:

Offset 0x0000000C : the length of the wifi configuration file. (2 bytes little-endian)

Offset 0x00000010 : 32bits CRC checksum of the wifi configuration file

Offset 0x00000040 : the actual wifi configuration file.

Offset 0x000110CC : the wifi mac address (Only informative - not used by the system).

The WIFI configuration "file" contains the MAC address along with other configuration parameters. And these other parameters depends on the revision of your phone's motherboard (and maybe other parameters as well)

The integrity of this "file" is also protected by the CRC checksum located at offset 0x00000010.

So you cannot just change the MAC address in this file as HBOOT will detect it at boot time and restore a "factory" default configuration.

The trick is to have HBOOT restore a "factory" default configuration with the MAC address you want to use.

For this, you should look in the HBOOT partition (mmcblk0p18) and find the "factory" default configuration that EXACTLY match the file of your Radio/WLAN partition (except for the mac address).

BE SURE TO FIND THE CORRECT ONE as the HBOOT partition contains several "factory" default configuration for the various motherboard revisions.

Then change the MAC address of this "factory" configuration file (which should be 00:11:22:33:44:55 if you never modified it).

Then you should alter the configuration file in the Radio/WLAN partition (change the mac address for example) so that the CRC checksum will fail and so that HBOOT will restore the new "factory" default configuration (with your new MAC address) during next reboot.

For consistency, you should also change the MAC address at offset 0x000110CC. (All the information contained at offset 0x00011000 seems to be only informative).

3.b Changing the Bluetooth MAC address.

The BT configuration is much more simple (no CRC or other parameters...)

Offset 0X00006000 : BT mac address (binary format !)

Offset 0x000110BC : the BT mac address (Only informative - not used by the system).

So you just need to put your new BT MAC address at this two offsets

4. The quick procedure...

- download the wlan_config tool I wrote

- open a command line console

- cd into the directory where you've put the wlan_config tool

- Then type:

> adb push wlan_config /data/local/tmp/
> adb shell chmod 777 /data/local/tmp/wlan_config
> adb shell /data/local/tmp/wlan_config --dry-run wf=<the new WIFI macaddr> bt=<the new BT macaddr>

******************************************************************************
***** HTC Desire S WLAN Configuration tool 1.0 by RXBoucher... *****
******************************************************************************

[!] **************************************************************************
[!] >>>>>> dry-run mode: no change will be made to partitions <<<<<<
[!] **************************************************************************
[*] **************************************************************************
[+] Reading partition(s)
[+] partition mmcblk0p23....................................................OK
[+] partition mmcblk0p18....................................................OK
[*] **************************************************************************
[+] Analyzing partition mmcblk0p23...
[+] ModelID : PG8810000
[+] Current WIFI mac address: 7C:61:--:--:--:--
[+] Current BT mac address: 7C:61:--:--:--:--
[*] **************************************************************************
[+] Backing up partition(s)...
[!] partition mmcblk0p23...............................................SKIPPED
[!] partition mmcblk0p18...............................................SKIPPED
[*] **************************************************************************
[+] Configuring WIFI -> 7C:61:DD:DD:DD:DD
[+] Looking up matching "factory" default WIFI configuration................OK
[+] Updating "factory" default WIFI configuration...........................OK
[+] Updating WIFI configuration.............................................OK
[*] **************************************************************************
[+] Configuring BT -> 7C:61:FF:FF:FF:FF
[+] Updating BT mac address.................................................OK
[*] **************************************************************************
[+] Writing partitions...
[!] partition mmcblk0p23...............................................SKIPPED
[!] partition mmcblk0p18...............................................SKIPPED
[*] **************************************************************************
[!] dry-run successful...

This will run the wlan_config tool in dry-run mode (will not actually perform any changes to the partitions.)

If the dry-run mode is successful then you can re-run the command without the --dry-run option

>adb shell /data/local/tmp/wlan_config wf=<the new WIFI macaddr> bt=<the new BT macaddr>
******************************************************************************
***** HTC Desire S WLAN Configuration tool 1.0 by RXBoucher... ****
******************************************************************************

[+] Reading partition(s)
[+] Analysing partition mmcblk0p23...
[+] Backing up partition(s)...
[+] Configuring WIFI -> 7C:61:DD:DD:DD:DD
[+] Configuring BT -> 7C:61:FF:FF:FF:FF
[+] Writing partitions...
[!] WLAN configured...
[!] please reboot phone

Then you must reboot your phone and enjoy your new WLAN configuration.

If the dry-run mode fails, it means that the tool was unable to find where or how to change the WLAN configuration.

In this case, maybe you should read the Long Procedure and try to perform the changes manually.

If you want to see the various options and parameters of the wlan_config tool

> adb shell /data/local/tmp/wlan_config --help
******************************************************************************
***** HTC Desire S WLAN Configuration tool 1.0 by RXBoucher... ****
******************************************************************************

USAGE:
wlan_config [OPTIONS] <PARAMETERS>

OPTIONS:
-d, --dry-run : test mode. The configuration tool will be run without
actually modifying partition(s)
-v : verbose mode. The configuration tool will output more
detailed information.
Can be added several times to increase verbosity
--help : display this usage message.

PARAMETERS:
wf=<macaddr>: the configuration tool will change the WIFI mac address
bt=<macaddr>: the configuration tool will change the BT mac address

with <macaddr>=XX:XX:XX:XX:XX:XX

5. The long procedure (manual)

Connect your phone to your PC using the Charger Only option.

Then open a command line console and dump the mmcblk0p18 (HBOOT) and the mmcblk0p23 (wlan/radio config) partitions:

>adb shell dd if=/dev/block/mmcblk0p18 of=/sdcard/mmcblk0p18.img
>adb shell dd if=/dev/blocl/mmcblk0p23 of=/sdcard/mmcblk0p23.img
>adb pull /sdcard/mmcblk0p18.img
>adb pull /sdcard/mmcblk0p23.img
>copy mmcblk0p18.img mmcblk0p18-org.img
>copy mmcblk0p23.img mmcblk0p23-org.img

You should keep the "org" files safe in case you need to restore them.

Now we're going to edit/modify the 2 files mmclkk0p18.img and mmcblk0p23.img with HexEdit:

- Go in the mmcblk0p23.img tab

- Select, in the Hex View (not Text View), everything starting at offset 0x0000005B (sromrev=) up to the last 0D 0A 00

- Copy it to clipboard (Ctrl+C)

- Go in the mmcblk0p18.img tab

- Open the search dialog box (Ctrl+F)

- In the "Search For" text field, paste the clipboard (Ctrl+F)

- In the "Datatype" drop down list select "Hex-values"

- Click OK

HedEdit should then find and highlight the corresponding match.

Just before the highlighted selection, you should have the factory default MAC address: macaddr=00:11:22:33:44:55

-Change this MAC address with the one you want to use (in the text-view)

-Save the file (Ctrl+S)

-Go back to the mmcblk0p23.img tab

-Put the new MAC address at offset 0x00000048 (in the text-view)

-Go to offset 0x000110CC (Ctrl+G)

-Put your WIFI MAC address here also (in the text-view)

-Go to offset 0x00006000

-In the hex-view type in you're new BT MAC address

-Got to offset 0x000110BC

-Put your BT MAC Address here to (in the text-xiew)

Save the file.

You're done with the editing.

You should now replace your partitions with the modified images.

Go back to your command line console then type:

>adb push mmcblk0p23.img /data/local/tmp/mmcblk0p23.img
>adb push mmcblk0p18.img /data/local/tmp/mmcblk0p18.img
>adb shell dd if=/data/local/tmp/mmcblk0p23.img of=/dev/block/mmcblk0p23
>adb shell dd if=/data/local/tmp/mmcblk0p18.img of=/dev/block/mmcblk0p18

Reboot your phone and enjoy your new WLAN configuration !!!