yashsingh1/xdaforums huggingface dataset:
[P3600 Software Upgrading] Jadatmag:
I have a xp computer

I have my p3600 connected in my usb port

My p3600 is stuck in boatloader, version 3.05.KE it says

I DISABLED the USB connection with active sync

I download the Cygwin version and double press the .bat file

I get this error:

I know im missing a step somewhere.. but when I double press NBHextract.exe nothing happens...

Can some1 plz help me? Because I do not have the money for a new phone right now... :(

My English is bad, and my computerknowledge to.. So a simple step by step plan would work I hope :D
[P3600 Software Upgrading] Jadatmag:
Oke, somewhere on my drive i found a file called "SPL.nb" (no idea how, ive tried fixing my pda for several days and nights now, so i forgot where i got the file from...)

I put the file in the same dir as the "unbrick.bat"

Now when i use unbrick.bat i get the next error:

Some1 know any solution?
[P3600 Software Upgrading] maxgasper:
hi everyone! i need your help... i turned my p3600 on and it goes no further than the first image screen were it shows the radio version, etc. i tried to use the splxploit (windows version) to unbrick it but the next message appears "\\.\\WCEUSBSH001: no such file or directory

cannot connect to \\.\\WCEUSBSH001"...

i've edited the batch file as said here (deleting a backslash becoming \\.\WCEUSBSH001) but the message appears again, now without 1 backslash... My pc doesn't recognize the PDA, the only thing it does is recharging the battery!!! :(

pleeeeeaseeeeeee help me!
[P3600 Software Upgrading] Luzik2oo6:
Hi i have the same problem like Jadatmag

Hi i have the same problem like Jadatmag . Active sync doesnt recognize my spv plz help me what should i do?
[P3600 Software Upgrading] Luzik2oo6:
my spv dead?

what should i do. I have the same problem just like maxgasper . help me
[P3600 Software Upgrading] maxgasper:
hi luzik! i managed to fix my p3600! after all it was pretty easy.. what i did was a manual hardSPL (camera button + on/off button + reset) and it went to the bootloader screen! after that i ran this splxploit in the original version (without deleting any backslash "\") with the activesync usb port disabled! all went well and then i flashed it with a new rom! :D

thanks pof! and luzik, i hope that your problem is exactly the same as mine, it means you can fix it! Good luck! :D
[P3600 Software Upgrading] maxgasper:
hi luzik! i managed to fix my p3600! after all it was pretty easy.. what i did was a manual hardSPL (camera button + on/off button + reset) and it went to the bootloader screen! after that i ran this splxploit in the original version (without deleting any backslash "\") with the activesync usb port disabled! all went well and then i flashed it with a new rom! :D

thanks pof! and luzik, i hope that your problem is exactly the same as mine, it means you can fix it! Good luck! :D

Sorry for this repeated message..:o
[P3600 Software Upgrading] bteljuice:
urgent heLP ANYONE, its been 3 days no one is helping me out

IM IN THE BOOTLOADER

IPL-1.04

SPL-2.10 OLIPRO

This is whts happening,i just double clicked unbrick, and this is the result.i just downloaded the folder .zip and unziped it,did not add any additional files to it(am i supposed to?\) should i also download something elsee..PLLZZ HELPP

Please make sure ActiveSync USB connection is DISABLED

Press any key to continue . . .

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb

[] Detecting IPL & SPL versions...

* Unknown IPL - checksum: 0xb365b520 (here it did not detectect the version)

* Unknown SPL - checksum: 0x0 (here it did not also detect the version)

* NOTE: if exploit doesn't work try with -c 1 and -c 2

[] Detecting memory layout...

* Finding CRC...( as u can see,it is not displaying here Trinity SPL_2.10 Olipro,which is my version,HELPP)

* We need to fill the stack until address 0x8c050000

[] Detecting stack layout...

* Send === pattern

[] ERROR: Can't find wanted checksum 0x98ea7ae2

* try increasing MAX_SEARCH or decreasing EQUALS_START

Press any key to continue . . .

PLZ PLZ PLZ PLZ,HERLPPP ANYONEEE
[P3600 Software Upgrading] bteljuice:
can anyone guide me

can anyone just guide me step by step on wht to do,wht to download.where to put each file.plz help.plz
[P3600 Software Upgrading] bteljuice:
PLZ HELP HELP HELP, i have asked everyone for help and no oneresponded.

im pleading,can anyone help.

wht can i do to get a response.some people ive sent them pms,and they told me we re not slave.handle urself.and others i have asked to guide me step by step and took it as an insult.

i have no where to go and no one to turn to.plz help me as my jasjam is bricked on the bootloader.
[P3600 Software Upgrading] joyqing:
great! i just recovered my p3600 by this method.

thx, especially programmer, dear Pau Oliva Fora.
[P3600 Software Upgrading] yokasha:
You Are The MAN:)
[P3600 Software Upgrading] sapateira:
Help Please

Everything i do keeps me stucked at that damn boot screen, and unable to flash another ROM due to "ERROR 207"

Here's my log:

# ./splxploit -F TRIN_SPL105.nb

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb

[] Detecting IPL & SPL versions...

* Detected Trinity IPL-0.50

* Detected Trinity SPL-1.06.0000

[] Detecting memory layout...

* Finding CRC...

* We need to fill the stack until address 0x8c030fe8

[] Detecting stack layout...

* Send === pattern

* Found pattern === crc=0x98ea7ae2 at address 0x8c08db90 with offset 0x0

* Switch to ruustart command mode...

* Send ~~~ pattern

* Found pattern ~~~ crc=0x91aefc33 at address 0x8c08da40

* Send *** pattern

* Found pattern *** crc=0x709a5411 at address 0x8c08d960

[] Loading unsigned code... (wdata buffer at 0x80b00000)

* WARNING: SPL FILE SIZE IS INCORRECT!!!

[] We need to overflow 0x5c87d bytes on the stack...

* Sent 0x4d8c0 bytes - stack overflow reached the SPL end at 0x8c040000

* Sent shellcode - we will jump here later

* We need to send 272 ruustart calls more, containing relative jumps to our shellcode

* Sent 0x5c7a0 bytes

[] We need to call a properly aligned function above patch limit now

* Calling emapi...

[] Done, Trinity 0wn3d!!!

* If device is not responding, soft reset and try again!

AND NOTHING HAPPENS, help me out people.
[P3600 Software Upgrading] sapateira:
SUCSSES !!!

That unbrick software end up working after all, but only the .NET version in WDATA Mode. The windows version wasn't woking. Couln't load the PT Rom because of the Vendor ID, but the i tried the BEPE again and all went well, now it's booted and is time to unlock it (AGAIN?!)

THANK YOU GUYS
[P3600 Software Upgrading] gadher:
This program worked like a charm. Thanks Alot. Now my Trinity Works again :)
[P3600 Software Upgrading] fabienk:
Hello,

i made a bad use of "HTC_Trinity_SIM_CID_Unlock_v1" my Trinity is now blocked on the carrier boot screen

Hard reset is useless ( press "send" key = nothing )

i can have access to the bootloader

i can use MTTY:

when i use "splxploit-windows" =

= nothing

my problem still the same, even if i repeat softreset & unbrick.bat

i can't use any RUU up/downgrade = Error 270/260

update by mini SD = "not allow"

can i update / change my SPL via MTYY ?

any help will be welcome :)
[P3600 Software Upgrading] xanda:
doesn't work with P3600i
[P3600 Software Upgrading] Jadatmag:
I am on a XP computer as administrator

I have active sync USB DISABLED

I have my p3600 connected trough USB

I download the .NET version, I unzip, I double press "SPLXploit.exe" and the program starts!

When I press "connect" with "emapi ds", "emapi" and "wdata" mode it just keeps saying "Waiting for phone" and nothing happens...

Does some1 know if im missing a step or what I'm doing wrong?

Greatings
[P3600 Software Upgrading] arifmujtaba:
Thanks a lot I thought my device is gone but it worked with your exploit.

Thanks.
[P3600 Software Upgrading] mvrinaldi:
You succeeded? I'm the same problem.
[P3600 Software Upgrading] mvrinaldi:
Try press the on/off button and camera button toghether for access the bootloader.
[P3600 Software Upgrading] iverson pan:
u r the man!!thanksss,im fixed my trinity
[P3600 Software Upgrading] jab1a:
Thank you so much for this.

I have done loads of flashing ROM's via USB and never had a problem till i tried to flash a 6.1 ROM, then it all went wrong. in the end the phone was just stuck with the power light on and nothing on the screen.

after running your unbrick.bat and then straight away trying to flash another ROM it worked PERFECT!

NOTE: first time after running unbrick.bat i did a soft reset thinking i was ment too, This is wrong and i just wanted to make it clear from my troubles:

Flash a ROM straight after you unbrick

Thank you again so much for your time and help
[P3600 Software Upgrading] Jadatmag:
My camera button is not functioning. The button was already broke when the phone still worked, is there another way to get in the bootloader?

greatings, Edwin
[P3600 Software Upgrading] avroy7:
splxploit.zip

splxploit-windows.zip

Will this solution work with Htc touch?
[P3600 Software Upgrading] sanroman:
Bones Pof!

You're the one.

Gracies!
[P3600 Software Upgrading] isurewin:
I just use windows version to unbrick it & can use the phone now. but I cannot flash any rom or SSPL to my trinity now. how can I do??~~thx
[P3600 Software Upgrading] Gizz:
Perfect! It worked.

Ran the Unbrick.exe, afterwards i ran a Hard SPL, did a soft reset and then I ran the Rom Update Utility from the ROM and Perfect!! Workin' again.

And the greatest thing about this is that a collegue gave this phone to me as 'It's broken so you have it' lay'd around, and now it's fixed!
[P3600 Software Upgrading] solae:
AWESOME! thank you!! I thought i've lost my mobilephone ;)
[P3600 Software Upgrading] cmonex:
no... source code must be ported

actually we've tried that for elf (touch) but didn't have an elf at hand to properly test it
[P3600 Software Upgrading] sundark74:
locked in bootloader splxploit doesn't help!!!

My trinity is locked in bootloader, and when I run the splxploit under windows I get this message:

[] SPL file: TRIN_HardSPL.nb

\\.\\WCEUSBSH001: No such file or directory

cannot connect to \\.\\WCEUSBSH001

Can someone help me with this

Thanx
[P3600 Software Upgrading] cmonex:
post above tells you what to do

edit the bat file to \\.\WCEUSBSH001
[P3600 Software Upgrading] sidewinder:
help

tried to read all the post re how to unbrick my htc trinity....im stuck at the bootloader mode....donloaded the xploit file but cannot open...

this is what appear after i click on the xploit..unbrick.bat....

xploit...is not recognize as an external and internal command ,operable program or batch file.
[P3600 Software Upgrading] :
Hi, i have an elf freezed at bootloader screen. I'm trying to port the code but i have one problem: there is no answer for some commands like 'checksum' or 'set' so i have no idea how to find the memory addresses for ipl and spl.

The code always return the message "Error in getChecksum" because if i use mtty and type:

USB>password BsaD5SeoA

...(init messages with g_cKeyCardSecurity=FF)

USB>checksum 0x'anything' 0x'anything'

...(no answers for this command,nothing happens)

USB>set 14 1

or

USB>set 16 1

or

USB>set 1E 1

...(same,no answers for this,although it takes effect on bootloader behaviour)

Any ideas about this? My SPL is 2.20.0000

I offer my frozen elf as test machine for your codes.

Thanks
[P3600 Software Upgrading] stepw:
If checksum command is not recognized, it's likely to be unavailable in Elf SPL.

Dump or extract SPL, then search for the list of commands supported in the dump.
[P3600 Software Upgrading] :
The checksum command is available in the SPL, i can see the commands at SPL dump when i use IDA pro to decompile it, but if i try to use it at mtty there isn't any answer from the bootloader.

If i try an invalid command there is an answer like 'Invalid command' but when i type 'checksum' or 'set' nothing happens.

However the 'set' command takes effect on the machine, but 'checksum' command doesn't seem to do nothing at the bootloader config (i supose the only utility of 'checksum' is obviously return a certain memory checksum,but nothing is returned in my elf).
[P3600 Software Upgrading] stepw:
There's also a flag associated with every command that allows its execution.

checksum can be disabled. Try various SPL commands to determine those that work, flag values should become apparent then...

PS And for God's sake, use putty for terminal emulation.
[P3600 Software Upgrading] :
:confused: is there a flag for each command? how can i enable the checksum command?

Ok, i will try, but if i cannot execute checksum even is available in SPL... i cannot find the memory address to do stack overflow...:(

Ok, thanks for your help, i will try putty. Has putty more options than mtty...?
[P3600 Software Upgrading] cmonex:
putty is ok but some commands will not work with putty, so you still need mtty. :P

i use putty for logging task 37, neat for that

checksum doesn't have to be enabled. the way the original exploit code sends/receives data to/from SPL doesn't work on elf. we solved that but still just got stuck after a while, well, it did actually get to the part where it was about to send the ruustart commands, but got stuck right away (but not like on polaris, see below! polaris did start sending many ruustart commands just fine). and without an actual elf, too much pain to test.

and if you can't find the memory address then porting the exploit is not a solution for you..

you can PM Olipro though, apparently he has another solution to trick the bootloader
[P3600 Software Upgrading] cmonex:
hey stepw :)

so now that i see you here.. if you want to hear some sad news: the original exploit will never work on the new MSM7xxx based devices. USB code to send/receive data uses memory between SPL end and stack start --> crash...

the exploit code itself ported very well to a polaris (not like the elf for some reason), but this killed it at the end after about a couple hundred ruustarts.
[P3600 Software Upgrading] stepw:
Possibilities are endless. There could exist another stack or buffer overflow, maybe even more complex. Maybe Olipro will release his solution too?..
[P3600 Software Upgrading] :
If checksum doesn't have to be enabled, why i don't get any answer with this command?

You say the original code doesn´t work, but you have solved it. How can you solve it?

Same problem, first i have to find the way to run checksum command.

I did it, but i'm trying to find a solution for my own (with your appreciated help). Olipro's method is a bit expensive for me.

Olipro do it, so should be a way to unlock the Elf and any other phone like it.
[P3600 Software Upgrading] cmonex:
hey. :) how did you find the trinity exploit originally?
[P3600 Software Upgrading] cmonex:
no, we haven't solved it, it got still stuck, right after the ruustart commands started sending. and we don't have an elf so didn't bother much - because we managed to solve the guy's problem (who had a bricked elf) in another way in the end anyway. this is the one that you can ask Olipro about, but I see you already did so.
[P3600 Software Upgrading] stepw:
Curiosity and persistence. :)

I needed to run unsigned code to make a dump of the full flash.
[P3600 Software Upgrading] cmonex:
yeah I bet persistence was needed :)

what did you need the full flash for?
[P3600 Software Upgrading] liamhere:
THANK YOU

Just Bricked My M700...and This Fixed It Thank You
[P3600 Software Upgrading] wssoo:
first of all does this unbrick work for CHT9110?

secondly before I run the unbrick my phone must be in bootloader mode?

third after soft reset it stop at bootloader? i then run sspl/hard spl?
[P3600 Software Upgrading] cmonex:
no...

if your CHT9110 isn't a trinity / P3600, then forget it.

if your OS is booting then simply run SSPL and flash HSPL.

if is not booting and you're stuck in stock SPL that's when you need this.
[P3600 Software Upgrading] tramuyo:
will that work for herald?

(code must be ported... is that right??)
[P3600 Software Upgrading] Jadatmag:
my camera button is jammed, is is there another way to get it in bootloader?
[P3600 Software Upgrading] raf1987:
just curious about something:

Whether I have Olipro 1.20 or Des' Crash installed, I still can not successfully upgrade the original ROM of WM6 for Trinity (always stuck on 20-30% and then got disconected) I don't know why? (already 2 times trying and got same result)

This does not happened when I upgrade my trinity with other unofficial ROMs..

any ideas?
[P3600 Software Upgrading] Justlookin:
Bricked a Trinity

I tried to up-date Rom on a Trinity I have just bought.

I now have a Trinity that I cannot connect with using ActiveSync.

The Trinity on a soft re-set comes up with large HTC logo then screen goes blank(almost white} with red light.Press on/off switch screen goes black but red light still on.

If I go into boolloader and press send to restor factory default I get restore completed press ok to boot but when I do it just goes to the htc white screen then black then the large white logo before going onto plain white screen.

I guess I buggered up my rom but without being able to make a connection what can I do, please?
[P3600 Software Upgrading] jezzauk:
Thanks for this saved my M700 I stupidly bricked as i didn't unlock the CID first and couldn't get the Orange ROM back on with the non-standard boot loader.

Anyone else who screws up their Orange Trinity use this and load any ROM

Or save yourself days of searching for this thread by making sure you unlock your network before changing the bootloader and ROM.

This was about the 5th ROM i was trying and didn't realise it had a bootloader included ;-)

oh well it's back and I have the new ROM to play with before getting bored again!

thanks again!
[P3600 Software Upgrading] boodi:
Unfortunately I'm not a programmer .

hi everyone reading .

I have my p3600 ( spv m700 ) in bootloader screen after tryin to update rom without the hard-spl

me to blame only , I know .

But now what to do with this splxploit I just dloaded ?

any help is greatly appreciated .
[P3600 Software Upgrading] Basilio Cat:
Don`t worked... Please somebody help me. I run splxpoit after i see this screen

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb

[] Detecting IPL & SPL versions...

* Detected Trinity IPL-0.50

* Detected Trinity SPL-1.07.0000

[] Detecting memory layout...

* Finding CRC...

* We need to fill the stack until address 0x8c03115c

[] Detecting stack layout...

* Send === pattern

* Found pattern === crc=0x98ea7ae2 at address 0x8c08db90 with offset 0x0

* Switch to ruustart command mode...

* Send ~~~ pattern

* Found pattern ~~~ crc=0x91aefc33 at address 0x8c08da40

* Send *** pattern

* Found pattern *** crc=0x709a5411 at address 0x8c08d960

[] Loading unsigned code... (wdata buffer at 0x80b00000)

[] We need to overflow 0x5c709 bytes on the stack...

* Sent 0x4d8c0 bytes - stack overflow reached the SPL end at 0x8c040000

* Sent shellcode - we will jump here later

* We need to send 271 ruustart calls more, containing relative jumps to our s

hellcode

* Sent 0x5c6c0 bytes

[] We need to call a properly aligned function above patch limit now

* Calling emapi ds...

[] Done, Trinity 0wn3d!!!

* If device is not responding, soft reset and try again!

When I reboot phone all remaining on her place.
[P3600 Software Upgrading] gilbert_xda:
Stuck in bootloader

Hi,

Im a newbee,

My trinity is stuck in bootloader.

I have tried to unbrick but it is still stuck to boot loader.

I was able to hard spl before i tried to upgrade but usb failed to connect and now im stuck with 3 color bootloader.

Message:

TRIN100

IPL-0.50

TRIN100 MFG

SPL-1.30.Olipro

Serial

Please help me.

Thanks
[P3600 Software Upgrading] ndiqbal:
Help please!

Hi

I have used this software. It chnged the bootloader tp 1.20, but after a re-boot and I return back to the bootloader its the same (1.30)

When trying to download a ROm it freezes at 13% or some Roms stick at 82%

I have tried at least 10 different Roms

Hope someone out there could help!

Thanks
[P3600 Software Upgrading] ndiqbal:
This is the data I get when running this tool:-

Please make sure ActiveSync USB connection is DISABLED

Press any key to continue . . .

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb

[] Detecting IPL & SPL versions...

* Detected Trinity IPL-0.50

* Unknown SPL - checksum: 0xf6bad106

* NOTE: if exploit doesn't work try with -c 1 and -c 2

[] Detecting memory layout...

* Finding CRC...
[P3600 Software Upgrading] Olipro:
------ (deleted)
[P3600 Software Upgrading] cmonex:
then do not reboot. when the bootloader is changed like that with the exploit, you need to flash hardspl to make the change permanent.
[P3600 Software Upgrading] bigdad:
is this methode work with elf to im trying to unlock the cid/sim with no luck till know

i got error 270 when im trying to flash it with

http://xdaforums.com/showthread.php?t=445666

regards to all xda members
[P3600 Software Upgrading] tchoklat:
error 0018003Hi, Getting this error when I try to upgrade ROMs. Will this tool fix my problem? As I do not have a Windoze PC can I run the splxploit.zip file on my 3600i?

cheers!
[P3600 Software Upgrading] sidekraouf95:
And if there is anything in my device and my phone brick after 3% of installation of NiAX rom :-( my phone reboot and stay with the htc screen pfff :-(

please help I'm under windows vista....pfff
[P3600 Software Upgrading] albelsingh:
cannot enter into bootloader with power+camera+soft reset. Is there any way out of this
[P3600 Software Upgrading] neohtm:
I got this error * WARNING: SPL FILE SIZE IS INCORRECT!!!

and the d810 is still the same. BRICKED!

user@debian:~/Desktop/splxploit$ ./splxploit -F hardspl.nbh

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: hardspl.nbh

[] Detecting IPL & SPL versions...

* Detected Trinity IPL-1.00

* Detected Trinity SPL-3.03.0000

[] Detecting memory layout...

* Finding CRC...

* We need to fill the stack until address 0x8c03167c

[] Detecting stack layout...

* Send === pattern

* Found pattern === crc=0x98ea7ae2 at address 0x8c08db90 with offset 0x0

* Switch to ruustart command mode...

* Send ~~~ pattern

* Found pattern ~~~ crc=0x91aefc33 at address 0x8c08da40

* Send *** pattern

* Found pattern *** crc=0x709a5411 at address 0x8c08d960

[] Loading unsigned code... (wdata buffer at 0x80b00000)

* WARNING: SPL FILE SIZE IS INCORRECT!!!

[] We need to overflow 0x5c1e9 bytes on the stack...

* Sent 0x4d8c0 bytes - stack overflow reached the SPL end at 0x8c040000

* Sent shellcode - we will jump here later

* We need to send 265 ruustart calls more, containing relative jumps to our shellcode

* Sent 0x5c180 bytes

[] We need to call a properly aligned function above patch limit now

* Calling emapi ds...

[] Done, Trinity 0wn3d!!!

* If device is not responding, soft reset and try again!
[P3600 Software Upgrading] claudiola:
HELP

Hi, I installed the ROM named "Trinity WM 6.1 OS 19588 (Build 19588.1.1.4) Diamond edition by Akeo " , the install goes correctly but at the restart my P3600 in stuck at boot.

Try to hard reset appears : "press SEND to restore factory default, press END to quit." --> no way

try to unbrick with this tool but got error :

Please make sure ActiveSync USB connection is DISABLED

Press any key to continue . . .

=== Trinity splxploit by pof - pof[at]eslack[.]org

=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb

\\.\WCEUSBSH001: No such file or directory

cannot connect to \\.\WCEUSBSH001

Press any key to continue . . .

C:\splxploit-windows>

----------------------------------

Some ideas please ??
[P3600 Software Upgrading] claudiola:
THANKS !!!

manual hardSPL (camera button + on/off button + reset)

after that the splxpoit work correctly ( my fault was doing the hard reset softkey dx +softkey sx + reset ).

" if everything fail , try reading all the instruction"