[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Full unlocking proces revealed (PART II)

THE PREVIOUS PART IS IN THE COMMENT BEFORE THIS ONE

6. The device resets and goes into real 1.04 bootloader just flashed, the unlocker shows this:

Unlocking..._........._..... .............................

While this happens, the unlocker does the following:

set 6 ffff

Turns device screen white.

info 3

Get password crypt information.

info 3

Get password crypt information (again).

password xxxxxxxxxxxxxxxx

Authenticates to the bootloader

set 1e 1

This sets the RUU command read/write flag to 1 (unlock).

wdatah 6065f 535cd095

This tries to flash the same HERMIMG_IPL1.01_SPL1.04_ONLY.nbh file signed by MIGsoft which has been flashed before. As this time the device is running on the real 1.04 bootloader and the signature is not from HTC, the bootloader returns "Image Cert is error..." and nothing gets flashed.

set 1e 1

This sets the RUU command read/write flag to 1 (unlock) again.

set 1 0

This sets the operation mode to user

set 5 ffff

This sets the background color white

set 2 1

Sets the back color flag on

shmsg 2 2 "SIM-UNLOCK"

Shows the string "SIM-UNLOCK" on row 2, column 2 of the device screen.

shmsg 8 2 "initializing..."

Shows the string "initializing..." on row 8, column 2 of the device screen.

rtask b

This enters to the Radio Image AT Command interpreter

AT+CGSN

This AT command returns the IMEI of your device. A "0" is returned after which indicates that the command has been executed successfully.

AT

Returns "0" (ok).

retuoR

Exits the AT command interpreter and goes back to normal bootloader.

shmsg 8 2 "unlocking..."

Shows the string "unlocking..." on row 8, column 2 of the device screen.

rtask a

This enters the radio bootloader.

rinfo

Get password crypt information to authenticate to radio bootloader.

rpass \r HTCSxxxxxxxxxxxxxxxx(4byte-crc)HTCE

This authenticates to the radio bootloader. The device returns "T" meaning success.

rversion

This returns radio bootloader version. The rest of the process can vary depending on what the device returns here:

For radio bootloader version <= 0106 the command 'rrbmc' will be used to read the device's memory content

For radio bootloader version >= 0107 the command 'rdpram' will be used to read the device's memory content

-If rversion is <= 0106

rrbmc x 6D0000 8000

This reads back 32768 bytes (0x8000) of memory content from address 0x6D0000. I put the read contents on 00-rrbmc-6D0000-8000.bin, the 4-byte checksum for this file is "3D 2E 51 98" (hexa).

rwdata 4D0000 800

This sends the the contents of the file 00-rwdata-4D0000-800.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "F4 3E 36 04" (hexa).

retuoR

Exits the radio bootloader and goes back to normal bootloader.
​

- If rversion is >= 0107

rwdata 0 10000

This sends the the contents of the file 01-rwdata-0-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "6F 17 EF 2C" (hexa).

rwdata 10000 10000

This sends the the contents of the file 02-rwdata-10000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "B0 8D 60 65" (hexa).

rwdata 20000 10000

This sends the the contents of the file 03-rwdata-20000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "A5 F0 3C 09" (hexa).

rwdata 30000 10000

This sends the the contents of the file 04-rwdata-30000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "A5 F0 3C 09" (hexa). (note: this is not an errror the data sent is the same)

rwdata 40000 10000

This sends the the contents of the file 05-rwdata-40000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "AC 02 5A EB" (hexa).

rwdata 100000 10000

This sends the the contents of the file 06-rwdata-100000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "CD 8C 22 4D" (hexa).

rwdata 110000 10000

This sends the the contents of the file 07-rwdata-110000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "93 10 BD 5E" (hexa).

rwdata 120000 10000

This sends the the contents of the file 08-rwdata-120000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "A5 F0 3C 09" (hexa).

rwdata 130000 10000

This sends the the contents of the file 09-rwdata-130000-10000.bin to the device encapsulated in HTCS+contents+4byteCRC+HTCE. The CRC for the file is "A5 F0 3C 09" (hexa).

retuoR

Exits the radio bootloader and goes back to normal bootloader. (they have some problems with CR+LF here, so the unlocker has to issue the command 3 times :P)

rtask a

This enters the radio bootloader again.

rinfo

Get password crypt information to authenticate to radio bootloader.

rpass \r HTCSxxxxxxxxxxxxxxxx(4byte-crc)HTCE

This authenticates to the radio bootloader. The device returns "T" meaning success.

rdpram x 340000 8000

This reads back 32768 bytes (0x8000) of memory content from address 0x340000. I put the read contents on 01-rdparam-340000-8000.bin, the 4-byte checksum for this file is "A1 6A 6A F0".

rdpram x 348000 8000

This reads back 32768 bytes (0x8000) of memory content from address 0x348000. I put the read contents on 02-rdparam-348000-8000.bin, the 4-byte checksum for this file is "BC 26 7D 78".

rdpram x 350000 8000

This reads back 32768 bytes (0x8000) of memory content from address 0x350000. I put the read contents on 03-rdparam-350000-8000.bin, the 4-byte checksum for this file is "B0 4F DF AF".

rdpram x 358000

This reads back 32768 bytes (0x8000) of memory content from address 0x358000. I put the read contents on 04-rdparam-358000-8000.bin, the 4-byte checksum for this file is "7C FA 81 6A".

rwdata 158000 8000

This writes 32768 bytes (0x8000) of data to address 0x158000, the data is sent encapsulated on HTCS+data+(4byteCRC)+HTCE block. I put the contents on 10-rwdata-158000-8000.bin, the 4-byte checksum for this data is "7D E0 E2 B2".

retuoR

Exits the radio bootloader and goes back to normal bootloader.
​

- This is the rest of the unlocking process, the same in all rversion:

rtask b

This enters the radio Image AT-Command interpeter, the unlocking will follow:

AT@SIMLOCK=0,1,22051978

Device returns "0"

AT@SIMLOCK=0,2,22051978

Device returns "0"

AT@SIMLOCK=0,4,22051978

Device returns "0"

AT@SIMLOCK=0,8,22051978

Device returns "4"

AT@SIMLOCK=0,16,22051978

Device returns "4"

AT@SIMLOCK=0,32,22051978

Device returns "0"

AT

retuoR

retuoR

Exits the radio bootloader and goes back to normal bootloader.
​

7. The unlocker shows this:

Unlocking done.

Device is rebooting

This is what happens, the unlocker sends this commands:

shmsg 8 2 " done"

Shows the string " done" on row 2, column 2 of the device screen.

task 8

Resets the device
​

8. That's all :eek:

Now, who is willing to write a free unlocker? :confused:​