[8525, TyTN, MDA Vario II, JasJam Software Upgradin] drummer10630:
Needed tools:

PuTTY ver.6 or above

Plink

Active Sync 4.5

any Hex editor

MTTY1.exe ver 1.11a

Windows PC

SPL 2.30 Olipro

SPL 1.01 MFG pack

SPL 1.10 Oli w/custom RUU

SPL 1.04 w/custom RUU

DUTTY'S Good .NB Tool

Win Rar

Hermes with working wlan

There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.

Steps for Working Wlan Device:

You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)

then use DUTTY'S Good .NB Tool...

http://xdaforums.com/showthread.php?t=296311

...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)

Download PuTTY and Plink and copy them into your C:\Windows\Temp folder

http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

Put your device in bootloader mode and disable USB connections in Active Sync

Connect to the PC and open PuTTY

Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...

http://xdaforums.com/download.php?id=9864

... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.

Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.

Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.

Go to START/RUN/CMD

This opens a DOS window. Change directories to C:\Temp and type the following:

plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)

Now type the following and hit ENTER (once) after each command:

task 32

password 0000000000000000 (that's 16 zeros)

set 1e 1

rbmc me.txt 500a0000 40000

that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.

When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.

Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).

Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:

In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".

You now have the eeprom flash file to be transfered to the non working device...

Steps for Non-working Wlan Device:

Using the methods on MrVanx's downgrading SPL page...

http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27

...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

Read the full instructions before flashing.

Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.

Connect to the device (\\.\WCEUSBSH001)

and hit ENTER to get a CMD prompt

Now type the following:

task 32

password 0000000000000000

set 1e 1

lnb herm1.nb 500a0000 40000

Hitting ENTER after each command.

When it's done, close MTTY and reboot your device and verify that your Wlan is now working...

Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)

BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:

plink HERMES > full.nb (hit ENTER twice)

task 32 (hit ENTER once and only once from now on after every command)

password 0000000000000000

set 1e 1

rbmc me.txt 50000000 7fff800

watch your file grow to 128 MB.

If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...

Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.

Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.

*NOTE* Olipro just posted later in this thread

"just to point out guys;

to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"

another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...

Member alakentu has translated this method into Spanish. The thread is here:

http://xdaforums.com/showthread.php?t=364751

***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***

For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.