yashsingh1/xdaforums huggingface dataset:
[XDA Assist] Moni4nexus:
thanks .. this helped me....http://www.androidbeat.com/2013/11/flash-factory-image-ne

http://www.androidbeat.com/2013/11/flash-factory-image-nexus-device/
[Windows Mobile Development and Hacking General] c0rnholio:
Hi folks,

I did some kind of research regarding the problem that some of us are facing when it comes to new rom versions and the Blackberry Connect software.

I found a few things out, including a way to enable debug logging for BBC on the PPC.

Now I'm stuck and need some help of people who have crypto-skills or know something about pseudo number generators.

If you are interested in my current findings, please take a look at the following posts:

http://xdaforums.com/showpost.php?p=1110712&postcount=123

http://xdaforums.com/showpost.php?p=1137145&postcount=125

The first one describes how to enable debug logging, and the second one shows what I have found out so far...

Cheers

EDIT: If you are interested on how this is done, please read post number 3, and after that read post number 64 and 152.

EDIT2: Depending on your device there might be a way to get BBC Version 4 running see post #302
[Windows Mobile Development and Hacking General] c0rnholio:
Manipulate GetVersionEx call?

I found out that the Blackberry Connect Client uses standard GetVersionEx function to query the OS Version and build information of the device it is running on. So instead of analyzing how the pseudo random version generator works, maybe there is a way to build some kind of wrapper around it that intercepts the GetVersionEx call and provides manipulated version strings to the BBC...just an idea...
[Windows Mobile Development and Hacking General] c0rnholio:
Got it...

OK folks, I've got it done. BBC is finally working in WM6 on my Universal...

I was able to prove my theory about the pseudo random os version string. If you have the right string, BBC will work with every ROM.

Here are the steps you need to do in order to get it working (shown on the example of WM6 (J.Wright's last ROM 2.01.08 and BBC 2.1.2.31):

1. Use the famous HTC64 Extended ROM Tool to decode the .nbf from the above ROM

2. Open the resulting .fat (or .nba) file with your favorite HEX-Editor

3. Search the follwing hex value (there will be two locations for this, you have to edit both of them)

4F 3F A0 E3 02 30 83 E3 45 2F A0 E3 05 10 A0 E3 02

4. Change it to:

C3 30 A0 E3 02 30 83 E3 45 2F A0 E3 05 10 A0 E3 01

5. Save the changes to your .fat (or .nba) file

6. Use the famous HTC64 Extended ROM Tool again to encode the file back to a .nbf file (ignore the warning about to big .fat file)

7. Flash the .nbf to your device

8. After flashing use a registry editor and go to the following key:

HKLM\System\Versions and edit the Aku string from .0.0.0 to .2.0.0

9. Reboot and install the blackberry connect client

10. From here on do the same steps that nessecary on a normal BBC install

11. You're done..it should work now

The above hex-magic patches the coredll.dll from OS Version 5.2.318 to 5.1.195. In combination with BBC Version 2.1.2.31 this will result in a pseudo random os version string that is allowed to connect to the blackberry network.

Have fun!

Cheers
[Windows Mobile Development and Hacking General] monster:
Hi and many thanks for this work! It's the only reason I haven't moved accross to wm6 yet.

Can you tell me which version of wm6 you edited the .nbf file of? or should it work with all versions? I tried it on JWrightMCPS's version 2.01.06WWE version but it didn't work.

Many thanks.

Sham
[Windows Mobile Development and Hacking General] c0rnholio:
it's 2.01.08 like I wrote in the my last post ;-)

you can do it with every rom if you know the right hex-string to look for. I will write detailed instructions on monday or tuesday. In general this trick will work for every device and every os version including all the aku 3.x roms for all devices.

cheers
[Windows Mobile Development and Hacking General] beginner:
what hex editor do you recomend?
[Windows Mobile Development and Hacking General] c0rnholio:
I used hexEdit. I don't have a link for you currently, cause I'm not at my PC . Surfing with a Simpad (a CE based webpad).
[Windows Mobile Development and Hacking General] beginner:
it doesn't work for me

for me, after a soft reset it leaves to work...
[Windows Mobile Development and Hacking General] aniel1:
is it possible to get a patch made in cab format. much easier for newbies.
[Windows Mobile Development and Hacking General] c0rnholio:
have you made the changes to both occurances of the string?

what does you system report as os version now?

have you used version 2.1.2.31 of bbc connect?

it works 100% for me and a handful of others that I know.

cheers
[Windows Mobile Development and Hacking General] c0rnholio:
No, this is not possible.
[Windows Mobile Development and Hacking General] beginner:
Same versions as you said (rom, bb)

Radio is 1.13, but it was working previously with bb and other roms

I insist on this question, in your case, after a soft reset it works?

Note: I think I made correctly decode-modification rom- encode, but jut in the case... could you upload rapidshare or other place the nbf resulting file please?
[Windows Mobile Development and Hacking General] c0rnholio:
yes, it works, even after multiple softresets, uninstallation and reinstallation of the bb client. I also have radio 1.13.
[Windows Mobile Development and Hacking General] beginner:
IT WORKS!!!!!

THANKS A LOT, YOU ARE GREAT.

Note: I followed again the process from zero. Maybe related some intermediate step not covered correctly.
[Windows Mobile Development and Hacking General] beginner:
network parameters to surf internet

cOrnholio:

it works great after several hours and softreset. VERY GOOD JOB.

Going ahead with details. When BB is connected and you surf internet, BB is disconnected and is difficult to put it again to work, do you have some idea?

Other question: I think BB service offers the capability to surf internet by their services, do you know how to do it in the APN parameters?
[Windows Mobile Development and Hacking General] c0rnholio:
No, sorry. You can only try to restart the service.

AFAIK your provider has to enable this feature in order to use it. After it has been unlocked in your service plan you should be able to use it. I think the APN is pushed to your device by the network, or if you have bb enterprise it will be pushed by the blackberyy desktop client.

Cheers
[Windows Mobile Development and Hacking General] monster:
Hi c0rnholio, many thanks again for all your hard work on this. Could you please tell me where to find the BBC 2.1.2.31 version? Many thanks,

Sham
[Windows Mobile Development and Hacking General] c0rnholio:
You can find it here:

http://support.vodafone.de/spopup41.html

and on th eT-Mobile Download page.
[Windows Mobile Development and Hacking General] titus666:
Great work Cornholio! One thing though, is that radio version seems to matter in experiments thus far.. do you think you can do some tests to see if the pseudo number changes if your radio version changes?

Is the "core" version basically WM5 (5.1.195) as opposed to WM6 (5.2.318)

This would imply that most people can just use the BB version you used (2.1.2.31), any WM5 AKU 2.x rom, and simply change the AKU string back to 2.0 and all will be well.. no need to hex edit if all you want is WM5 with an updated/stable rom...
[Windows Mobile Development and Hacking General] c0rnholio:
Hi,

The radio version is not involved in the generation of the pseudo random os string. I've just only tested the BBC client on WM6 with radio 1.13. It should run on 1.14 also.

Well, the OS version 5.1.195 is the version string that is reported by the original AKU 2.0 update from T-Mobile. The only requirement in this hole thing is to find a combination of versions that are allowed to run. For example the hermes has an aku version of 3.3 and a matching BBC version of 2.1.2.52 (as far as I've read int the hermes forum). This combination is allowed to connect to the network. So if you edit the coredll.dll to the same OS-Version string of the hermes aku3.3 one and use the 2.1.2.52 bbc client it should also work.

So to answer your question (if I understood you right), yes, as long as the os version is 5.1.195, the blackberry client 2.1.2.31 should run if you set the aku string back to .2.0.0

But AFAIK each AKU higher that AKU2 (which is 5.1.195 on universal) has a different os version string hardcoded in the coredll.dll.
[Windows Mobile Development and Hacking General] c0rnholio:
this all sounds pretty interesting and I will test ASAP. I'm out of office for the next weeks but will maybe try on the weekend to get it working with the modified AKU string. since some say that it works on other devices as hermes and dash, AND we now have a way to flash the os part of the rom without the need of CID unlock first, it should only be a small step to get 4.0 working on all htc devices. maybe for some there might be the need of hex-editing and for others not. stay tuned.

cheers
[Windows Mobile Development and Hacking General] beginner:
athena -wm5 - bb 4

The bb 4 works nice on the athena. There are some collateral problems -today pluggin- and I am not sure if creates aditional troubles with activesync. But the change from v. 2 to v. 4 is really interesting, and was really easy, only modificate the aku number. Looks bb people thinks that ever we will find a solution
[Windows Mobile Development and Hacking General] gladiac:
WOW, BBConnect 4 seems to work nicely on my Artemis with the German O2 WM6-Rom when I changed the AKU-Version from 0.2.3 to 0.2.0. It now connects and lets me do the enterprise activation. NEAT :)

EDIT: HELL YES I'm really IMPRESSED :D
[Windows Mobile Development and Hacking General] c0rnholio:
OK, found a minute to install and sync with our BES.

It's working! Hell, and I fool thought RIM had applied additional security mechanism, when finaly it was an AKU setting only.

It didn't mess up my today screen. It only added two items: BB Owner Info, and BB Device Lock. I disabled both in my today settings and everything looks like before.

Internet Browsing through BB works like a charm, as everything else does also. Thanks and CHEERS to beginner for the finding with the AKU string.

I think it will help others if we, who have BB4 up and running on our devices, post our OS and version info, so others may copy that to get it up and running on their device also.

Here's my info:

Device: Athena

ROM: 1.12.111.6 (German)

Radio: 1.32.00.00

OS: 5.1.465 (Build 15673)

AKU Setting: .3.0.0

BB Version: 4.0.0.67

BB Transport: 4.0.0.70

Happy Blackberry'ing

Cheers
[Windows Mobile Development and Hacking General] ckolibab:
Guys - great work, inquiry if I could - dont shoot me ;)

Guys ---

AWESOME work here, and to those that got this working I am very graciously asking a few questions here - don't shoot me dead please :) Net net I am a 911 BB user, never used Connect - but have a Treo750-W (WM5) and 8525 (WM5 or WM6)....

My preference is to roll with the Treo for form-factor reasons, and currently am using connectors and other options to get my email pushed - but connection to our Corp BES is really the only way to roll....

So could I ask a few questions - and at the same time I am reading every post here to assemble the solution - and even see that some 8525 ROM's were cooked with this embedded (does not help me with Treo750-WM5)....

1 - Is this hack possible on any device, such as my Treo750 WM5 ...

2 - I have my BB connecting to our BES services, but I thought that connection was tied to the device IMEI ID? --- hence I have little experience with BB Connect and those that know the Enterprise - we have wm5 devices not-allowed with Connect --- does this matter?

3 - I actually have 2 devices 1 with BB pkg - 1 with unlimited data pkg 2-SIM cards... I can move them around without issue. Does this require BB pkg from the carrier if heading to a BES server?

4 - When I first hooked my BB-8700 up it had to locally synch with the BB sw on the PC which was what I thought was a security key exchange. I know times have changed and much of this is done over the air now --- can someone advise on what that FIRST PROCESS should feel like? I have read the docs and tried this a few weeks ago but kinda scrapped it....

Guys ---- I honestly would be SOOOOOO grateful if someone see this as a helpable situation. If I could get my Treo750-WM5 connecting to our BES without and just swap from my BB I would be in heaven - and willing to offline pay $'s for someone to walk me thru some of the snags....

I am also going to look at one of the baked ROM's for my 8525 but clearly some of my questions show I don't know the BB Connect option very well so would still need to fill in those blanks.

Sincere thanks for any assistance!!!!!!! :confused: :) :eek: --

Chris
[Windows Mobile Development and Hacking General] gladiac:
Ok, let's do it:

Here's my info:

Device: Artemis (ARTE110)

ROM: 3.4.207.2 (German)

Radio: 0.2.88.90

OS: 5.2.1238 (Build 17745)

AKU Setting: .0.2.0

BB Version: 4.0.0.67

BB Transport: 4.0.0.70

It's the German O2 WM6-ROM from here.

All you need to change is the Aku from 0.2.3 to 0.2.0 using phm-regedit. It also survives a soft-reset :).
[Windows Mobile Development and Hacking General] Andy Phillips:
Works for me too!

Thanks to beginner!:D

device: WIZARD

rom version: nbd.v7.1.touch.ext

OS version: 5.2.1413 (Build 17913.0.3.0)

AKU: 0.3.0

Radio: 2.19 (TmobUK - you know the one!)

BB Version: 4.0.0.67

BB Transport: 4.0.0.70

Been waiting for this..and it WAS worth it!;)
[Windows Mobile Development and Hacking General] Andy Phillips:
1> Shouldn't be any reason why not!

2> I started out with a blackberry device and just pulled the sim out and stuck it in a QTEK9100 (wizard device) with WM5 - worked no problem.

3> Yep Definately need the card on the BB pkg.

4> Install the bbc client on your pocketpc device.

Install the desktop software..make sure you are connected to your work network...start outlook and check that you can send/recieve mail if your not sure!

Connect your ppc to your pc via activesync...let it sync (but turn off/disable syncing of mail, contacts etc).

Start the desktop software and click on connect to device.

This should send provisionind data to the device.

Once its finished, disconnect the usb cable and see if you get any mail!

Hope this helps some..
[Windows Mobile Development and Hacking General] ckolibab:
BB Connect on Treo750 ... (almost there..... few ?s')

Andy --- THANKS SO MUCH .... Exceptional input and it is working STELLAR!!!!!!!!!!!!!!!! Your steps were EXACTLY the key pointers I needed - exactly and proof to me "it should work so gave me the push to try this again since I never had luck before" ... :eek: :)

However - I took a shortcut which I now need to backup a few steps. I used a baked ROM with the hack from my other device and now need to apply the hack.

So let me ask a few more questions if possible - but I do know once the hack what I need to do -- (which I did not apply as I used the Custel WM6 ROM with the hack applied to my 8525 -> I did need to load the CAB and DESKTOP APPS) -- no WM6 baked ROM's exist for the Treo so the hack will have to be manual. :confused:

1 - BEST to FOLLOW HACK STEPS? -- So - on a Treo750WM5 device I am reading back thru threads and see several variations. I don't want to brick my device - is there a "best steps for a WM5 anyone would suggest" ----- I have solid feel on what to do after the hack now since I got it working on my 8525. Usually once many people have done this the quick steps seem to come out and I promise to read all pages of the thread again ---- hints?

2 - CINGULAR and CARRIER BB vs DATA PKGS -- Andy, the good news is the SIM card I used with my 8525 did have the BB pkg, and sadly not the Unlimited Data. Am I to assume that Cingular or other carriers simply block these ports when using BES unless you purchase the BB pkg from them? Meaning - no way around not buying the BB pkg --- like everyone we know they hit us $50 for BB and $50 for Data --- advice? I want it to work and if this is the case - it is the case vs trying to troubleshoot it not working due to the pkg not supported.

Summary ---

-------------

- THANKS - I got this working with a Cingular 8525/HERMES with Custel-HACK'd ROM and BB Pkg to BES. It is flawless so far...

- Now I need to prepare the Treo750 and better understand thru reading or tips the HACK STEPS to not brick my Treo which will then be WM5. I will then complete the other steps to get it cooking. POINTERS!!!

- CARRIER PKGS... Understand is the net net these guys are port blocking in the cloud well known BES ports to keep you paying for BB even BES in order to prevent bypass?

If someone could help me a little with a few of these questions I would be very happy to chime in now and assist others. I had severaly tricky steps as it relates to the way I need to connect to my Corp Email which I actually got around --- net-net VPN gets torn down when I USB connect my device due to the Tunnel Stack ----- so had to be on the Corp Net to connet to the BES. Sounds hard than it was - but required a late night trip to the office...

Sincere thanks for a stunning breakthru --- this is in a word - MASSIVE!!!!

Thanks - help is appreciated.

Chris
[Windows Mobile Development and Hacking General] mahjong:
Mine is:

Device: HTC X7500 Advantage

ROM: 1.25.412.2 (Spanish)

extROM: 1.25.412.103

Radio: 1.38.00.00

OS: 5.1.465 (15673.3.3.1)

BB Version: 4.0.0.67

BB transport: 4.0.0.70

where I can find my AKU setting? No idea.

The BB4 in my athena drove today screen mad.

EDIT: Hmmm I think my AKU level is 3.3.1 which follows the build number 15673. Is that right?
[Windows Mobile Development and Hacking General] beginner:
HKEY_LOCAL_MACHINE\System\Versions

here look for AKU and change into .3.0.0 don't forget the dots.

the screen problem is for me solved using programs as spbdiary.

cheers.
[Windows Mobile Development and Hacking General] gladiac:
Maybe someone wants to make a wiki with all the working config variations? IMHO it would be way clearer for beginners.

cheers
[Windows Mobile Development and Hacking General] c0rnholio:
Excellent idea! I will jump in and make one but this make take 2-3 Weeks until I get back from business...

If anyone other will jump in, just do it!

Cheers
[Windows Mobile Development and Hacking General] mahjong:
Checked. On that registry record said .3.3.1
[Windows Mobile Development and Hacking General] pt-1:
Hi,

I tried this with the BlueWM6 Release from this forum and I changed the registry value as advised by you.

Unfortunately my Vodafone UK Card still does not connect to the Blackberry Service.

In the Blackberry client on the phone I get pending

Any Ideas ?

BlackBerry Version 4.0.0.67

Transport Version 4.0.0.70

Rom Version Black & Blue V2.0 WWE

ROm Date 4/30/07

Radio Version 02.93.90

Protocoll VErsion 4.1.13.42

ExtRom VersionPDAVIET.Net

ModelNo: ARTE200

Platform PocketPC

CE OS 5.2.1238 (built 17745.3.0.0)
[Windows Mobile Development and Hacking General] walshieau:
the AKU string needs to be .2.3.0
[Windows Mobile Development and Hacking General] tom_codon:
I think you need change String Aku to 0.2.0

Cheers..!
[Windows Mobile Development and Hacking General] titus666:
Sigh.. illegal handheld pin still for me. The only difference is I used nbd.v.7.2. Just can't see what is wrong...

So my setup (for reference):

Device: WIZARD

Rom Version: nbd.v7.2

OS Version: 5.2.1413

AKU: .0.3.0

Radio: 2.19

Edit: Back to BB 2.x and just like magic, "illegal handheld pin" gone and email flows again. sigh.
[Windows Mobile Development and Hacking General] gladiac:
ACK. That worked for my device...
[Windows Mobile Development and Hacking General] walshieau:
ok... now who wants the good news??

looks like RIM just started blocking 5.2.1238 (Build 17745.0.2.3)

:mad: :mad: :mad:

hmm not sure.. its not working for WM5 either... unless RIM is down again...
[Windows Mobile Development and Hacking General] titus666:
Hmmm I wonder if this is related to mine not working... Andy... is yours still working with 5.2.1413 AKU 0.3.0?

I don't think RIM is "down", my BBC 2.x was working just fine...
[Windows Mobile Development and Hacking General] gladiac:
No, still works fine on my ARTE110 with that rom-version.
[Windows Mobile Development and Hacking General] walshieau:
with bbc 4.0 or 2.*
[Windows Mobile Development and Hacking General] KarmaNP:
BB & Pocket PC

I'm not sure how much this applies to of you, but I use my Wizard & Universal as my phone and according to Tmobile (my carrier), pocket pc is allowed to have only 3 email account (service books).

Is this info correct? Are you guys able to setup more than 3 accounts on your pocket pcs?

TIA
[Windows Mobile Development and Hacking General] gladiac:
It's the version 4 connector.
[Windows Mobile Development and Hacking General] :
hey.

Im using the LVSW_Trinity_WM6_v2.0.1.1 rom on my phone and i cant find the .nbf file anywhere.

Plz help.
[Windows Mobile Development and Hacking General] beginner:
finally my athena cannot work with bb 4. I tried going back to 2.52 and still not working. It's not a problem of the mobile operator, it is because the marketing and sales of rim. Due my country is not in the list of the ones accepting pda for bb service -only if you have bb device-

In conclussion, I just cancel the subscription to bb and hire a service to use outlook over gprs. I cannot support so arrogant people.

In the time to have it clear I oppened many discussions with my company bb administrator and vodafone support, who restarted the service many times for me and no working.

crazy world.

I am very sure rim people will read this post -it's the only explanation on how fast they canceled for everybody using the athena for bb 4 the service-

The problem of 2.52 is that the performance and abilities are very poor in comparative with bb 4 and obviously outlook, that still being the king for pda, sorry mr. rim....

My next step is to move -that will mean more profitability to my company without investment due we have exchange- the bb devices into pda, more functionality and connectivity possibilities. Lest cost on bb server maintenance... This will mean other hundreds of less people using software from so arrogant people...
[Windows Mobile Development and Hacking General] Andy Phillips:
Still working

Not sure what's goin on but mine seems to be ok.

Nstefanelli is building a new rom with the bbc installed...

http://xdaforums.com/showthread.php?t=313295
[Windows Mobile Development and Hacking General] :
Hey guys. latest gossip from me is that i got the damn blackberry connect working.

Now i await my emails to come to me..................not that i need it but still.........i hav it !
[Windows Mobile Development and Hacking General] Andy Phillips:
Info...info...info!

Which versions of everything are you using;

OS

AKU

BBc:D
[Windows Mobile Development and Hacking General] andyjs:
I think more than one have the same issue with the blackberry connect and the internet. If the blackberry connect is on the internet wont work, if the internet works the blackberry connect doesn't. Is there any solution for that? I know the problem is that there are two different connections, but can this be fixed in any way.
[Windows Mobile Development and Hacking General] :
Rite im using the

"RUU_Trinity_DOPODASIA_WWE_1.23.707.4_6275_1.33.00.11_108_Test" for my rom - Windows Mobile 5 based.

and

"BBConnecttrinity" for my Blackberry Connect. Thats it. I used both of these and my SPV M700 worked with blackberry. I happil recieving my emails as we speak.

Hope this fixs all the common problems asked on here. If it does plz tell me so :D
[Windows Mobile Development and Hacking General] :
Good point. If ya get the answer do post it on here.