yashsingh1/xdaforums huggingface dataset:
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
GSLEON: just in case... if you PM'd me on IRC I did not see it - but I fixed the problem so should be fine now. so come back on :)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] lordsoft:
back other radio

Is this help to remove this radio

http://xdaforums.com/showthread.php?t=371154
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] JimmyMcGee:
Nope. The instructions there won't work. The Program, I'm assuming, is integral to the fix though.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] NotATreoFan:
delete me... ID 10 T error on my part.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Grumps:
Hmm

Im so glad im on GMT + 2 so even if i jump in and do stupid things like flashing radios from hell etc its already been out there long enough so people can find problems/solutions before I wake up. So maybe South Africa is not all bad hey
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
Ahhhh...

...something just hit me. The iPAQs have a H/W backdoor through the battery connector for OEM use. There are 5 pins, three of which are grounded when the battery is installed. One of the three pins was used to sense if the battery is installed, the other pin put the unit into diag mode when pulled High.

I looked at my TyNT and there are only 4 pins, 3 of which are grounded when the battery is installed (see below). One pin has to be the battery sense, the other may just be what we're looking for. Can someone explore this on a bricked Kaiser? You will need a +4VDC supply, a few microclips and a 10K resistor. I can provide guidance but I don't have a brick to try it myself (well, not yet anyway).

TOP OF UNIT

1 +Vbatt

2 High-Z (connected to -Vbatt when battery is installed)

3 High-Z (connected to -Vbatt when battery is installed)

4 -Vbatt
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Nate731:
Can you define what you mean by Brick... an actual bricked phone? Or just one stuck with the Radio from hell? ;)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
Sorry...

...I should have been more specific. An actual bricked phone to start with. If we can make it do anything then we can try the RfH.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] mounsif:
No Solution ????
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
by diag mode you mean bootloader?

and what do you call a brick, you mean task 2a'd kaiser?

so anyway, want to talk to us on MSN or IRC or something?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
OK...

...to me a brick means stuck in bootload or white screen or non-responsive via USB. But the USB port has to work because it is used in the diagnostic mode. The way it was described to me (I didn't see it) is like an "enhanced" bootloader that allows you to do a complete core flush. Sort of like Kernel0 or TrustZone, except those were XScale ARMv5. My thinking is: if HTC implemented that feature on older platforms perhaps they may have done so on the Kaiser as well. Does it make sense?

I don't have access to MSN or IRC because they violate the company's security policies. How else can we talk? This is inefficient indeed :(...
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
But I don't want to try this on my Kaiser yet 'cause I don't want another $800 brick in my drawer.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] sd73ta:
anything yet?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] millerhe1:
Dont know if this will Help but....

Prior to the flash I was showing qualcomm 7200 now after its showing 7201 could there have been something with the cpu switch that is blocking the radio? Boy hopefully some one will figure this out if not is there a way to totally wipe device . (and have it not show the radio for a warranty exchange ) cause reverting back still shows the radio from hell.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] svcglobal:
That is not the first time that I saw that kind of report, the cpu id # being changed after a flash of a radio/ROM. Weird.

Could be interesting to know why...
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
well of course there is a diag mode for OEMSBL but it works a bit different than that.

if you mean the SPL, well, over the years no one ever found anything like that in the SPL.

you might be able to use java irc: http://java.freenode.net//index.php?channel=xda-devs

this will connect you to the xda-devs irc channel on freenode ;)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
don't you guys read the thread? :P

the cpu id has nothing to do with the problem, ATT intentionally blocked flashing... this has been confirmed already

I can post the disassembly of the code that blocks the radio flash, if you want to see it for yourself

p.s.: if you just want it not to display this radio version, then both nk.exe and deviceinfo applet in settings can be edited to show a different version. that is easily doable (of course requires disassembly skills)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] millerhe1:
I did red the thread and did not see mention of the cpu id being changed. So I thought Id try to throw in the things that I noticed as after I was stuck. I have no intrest in the codes as it would be like giving me a book in russian I can read that as about as well. And also why jump on me for attempting to help. The post I left was alot better then "Anything yet?"
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
So helpful.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] haam1978:
come on guys

be cool we are all on the same boat

and any help is appreciated
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
I didn't jump on you... I just explained the situation.

I also offered my help in changing the displayed radio version if someone needs that.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] millerhe1:
Sorry just touchy today been flashing re flashing searching forums and trying everything even if it sounded corny. Would your suggestion work for the death star screen that listed the radio and the protocal and rom version? (that s the one Im most concerned with.)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
Small update...

Pin 3 is the BattSense* (* = not), so leaving it open prevents the unit from turning on. That's to protect the unit if it's plugged into the charger without the battery in. I still don't know what Pin 2 does. Leaving it open has no effect. I'll see if applying a voltage greater than +3.3VDC does anything.

This is a little off-topic but I dug into the iPAQ: it turns out there are 6 pins on the battery connector: +Vbatt, -Vbatt and BattSense*, the other 3 pins are for OEM use. Perhaps a SPI bus? Anyway, that won't help us here...:(

cmonex, I'm curious to see the flash blocking code. You can PM me if you like. I'll try the java IRC tomorrow.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
I don't know if this is helpful or not... but when I go into bootloader mode, for a split second a tri-colored screen shows "loading..." then it says something but I can't make it out before it flashes to the regular tri-colored screen.... I don't remember if I saw this before I was locked into 17.10... anyone know what I'm talking about or can confirm that it happens with other radios as well?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cotu1961:
What it says is...
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] JimmyMcGee:
Don't worry. Its looking for the KAISIMG.nhb file in the root of your SD card. This is how you flash via an SD card. If you don't have an Image File I wouldn't worry about it too much. Everything still functions as it should without that File on your SD card.

For Example mine doesn't Say Image File Not Found, because I flash via my SD card a lot and I have a KAISIMG.nhb in my SD card root.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Mare of Earth:
Might be a stupid question, but I didn't see an answer, so I thought I would ask:

what part, exactly of Jocky's SuperCID Unlock is supposed to give you the "Security Unlocked" message?

I initially ran his unlocker with HardSPL (Olipof), I later installed Jocky's patched HardSPL which allows AT commands (after I installed the Radio From Hell.)

However, nowhere in this process did I ever get the "security unlocked" message.

Has anyone been successful in attaining "Security Unlocked" status since they flashed the Radio From Hell?

Also - with the Radio From Hell, would getting the SIM Unlock Code from AT&T allow the "Security Unlocked" status?

Thank you to any responders, Sorry if this annoys anyone.

Mare

On a side note, changing the SPL was actually rather easy, so long as you follow the White Screen thread instructions *exactly*
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] JimmyMcGee:
I security Unlocked. I had to run Step 2 twice, then my BootLoader Said "Security Unlocked."
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
I am in the same boat... Is there any other indication such as "AT@SIMLOCK" that will verify that the device is definitely security unlocked?

I had run an application when I first got the phone that promised to security unlock and sim unlock the phone. Believing that I was security unlocked, i flashed the radio from hell... after which I had instant doubts :)

I guess we are all looking for a solution for the following question "How to security unlock the kaiser with the radio from hell?"
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
asdlkjngakhdshadsoijoa jDSADSOKFJalkjga' JADSOFADSO EWTAI SN gdsg

Sorry...

FYI... Punching your phone does NOT unlock this radio..

This sucks... my internet doesn't work well, it hangs if I ask it to open a page larger than google's homepage... it won't internet share with my computer at speeds over 3 kb/sec and it's not streaming youtube... it just freezes it after the clip plays for 2-4 seconds.. sounds like some devious plan to cut down on my data transfers..
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] GSLEON3:
The first indication is bright RED letters at the top of the BL (Tri-Color) screen. They say "Security Unlocked". With AT@ Commander you can issue the AT@SIMLOCK=7,0 & if it returns a zero value, you are security unlocked.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
True, it doesn't get any clearer than that when it has worked... I have something a little different, these are the values I get when I run the following commands:

AT@SIMLOCK=7,0 -> m (if i run it a second time i get a W)

AT@SIMLOCK?40 -> @SIMLOCK=00 0

I am guessing that i am SOL and locked eh?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
that "Loading" string is in SPL and it appears if you have your SD card inserted, standard SPL feature
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
yeah the ipaq is a bit different, it's old HTC implementation

OK, let's try IRC, PM in worst case :)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
no problem :)

what do you call "death star screen"? the device info in settings? or the bootscreen?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] millerhe1:
The boot screen the first of the 3 start up screens were you first turn it on. Just for my own education you said the lines of code have been Identified ? Whats making it such a bugger to get around ? You folks seem to me a very capable bunch .
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Sebastiii:
Hi :)

I have tested :

Cmd>rtask a

POWER OFF PMIC VREG_USB : SUCCESS!

C VREG_USB : SUCCESS!

Invalid command : help

For a help screen, ask JockyW :D or h

So i have the screen :)

Seb.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Out of hell?

Bingo!

It has worked for me as well =)

Cmd>rtask a
POWER OFF PMIC VREG_USB : SUCCESS!
C VREG_USB : SUCCESS!
Invalid command : help
For a help screen, ask JockyW :D or h
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
I might be slow... but what does this mean? is there a solution? I enter bootloader but there is no place to input any commands.. Thanks
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Sebastiii:
Hi :)

Me too, i can try, but i'm newbies in flash so ...

Seb.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
if you flashed jocky's incorrectly patched radio then yeah, you have more chance to fix it because at least the commands are unlocked... that's what that patch does

by the way... still too lazy to upload the proper patch, but just take the radio only NBH (this ATT 1.65.17 crap) in a hexeditor, go to 0x1f8bc1, you should see the bytes DD E5 there, change them to A0 E3, save, flash. this should then allow you to reflash even if not security unlocked prior to flashing it.

makes the radio bootloader (OEMSBL, not AMSS) think it is sec unlocked by only changing 2 bytes ;)

disclaimer: do that patch properly or you're ****ed.

but of course if you had already flashed unpatched 1.65.17 then no good
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
ok, that's nk.exe's job, it can be edited. if you want help with that, point me to the OS image that you want edited.

yeah the lines of code have been identified in the radio... if you are security unlocked it goes straight to flashing the new radio image, if you aren't, it simply exits the flashing function with an error code.

(they put in a retarded unnecessary check too, but that doesn't change the above summary)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
Cool thanks, I'm trying to find the line 001f8bc1 but I can't seem to find it.. maybe I don't understand hex but I have used it before.. I am using the patched version..
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Originally had the patched radio from hell...

Took the 1.65.17.10 patched version, changed address 0x1f8bc1 from DD E5 to A0 E3, saved then flashed. Tried to flash the patched radio from Olipro's Kaiser Unlock tool. Still no go... still the same radio from hell =(

Any other suggestions?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] austinsnyc:
Yes cmonex you seem to be on a roll with ideas :) Shoot out somethings we should try to fix this damn radio!
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
so we are close? this radio sucks for me... I'm locked to the patched version.. anything I can try to help?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] RoozbehDream:
excuse me but i'm too low here! what is "Rtask a"?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] Sebastiii:
Hi, I'm in hell lol,

I have flashed the patched version but i haven't put security unlooker so now i can't flash any other radio.

I have make the hexeditor, go to 0x1f8bc1 that you say on patched version and flash it, but idem no change.

Thx Seb.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
just use goto

[size=+2]BUT TO EVERYONE[/size] this is not for people who already flashed the radio from hell. this is for people who haven't yet but want to try it out for god knows what reason.

let me try explaining again... the code in the (unpatched) radio explicitly blocks flashing, you cannot flash anything in the normal way.

if there is a solution it will involve a totally different way to download an image to the phone in special diag or dl mode.

I repeat: it is not going to be a plain NBH flash through SPL.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
oh... from what I understood, if I had flashed using the patched radio without being security unlocked (my situation) then doing this would allow me to change my radio... but to no avail. are we talkin about running a hex editor on the file "Kaiser_Radio-1.65.17.10-patched.nbh" from my hard drive correct? I still can't seem to find that damn line :-( and if there is a patched version that fixes this I'll send $10 to the person's paypal.. it's not much but it's a couple beers...
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] cmonex:
nooo, I never said this would help for those who ALREADY flashed the crap previously.

again, NO NBH flash will fix this. read my previous post maybe? :) (not jumping at you btw)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] KaiserVideoDriver:
my goodness, seems like this radio demands a dedicated wiki page
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jockyw2001:
You probably meant to say: "if you incorrectly flashed jocky's patched radio then yeah, ...". That version was an early test only for guys who already had installed 1.65.17.10. Of course it was patched correctly :D

So now for the morons who can't read and flashed that early test version not intended to be used by you, e.g. Sebastiii and russianspy4, you can easily flash another radio by following these steps:

1. enter tri color bootloader mode

2. connect with MTTY, press enter, you should see "Cmd>"

3. type "rtask a" (w/o the quotes)

4. type "mw 90d4a8 1 e1a00000" (w/o the quotes and note that you won't see what you typed and the command does not return anything).

5. type "retuoR" (w/o the quotes)

6. close MTTY

7. deactivate "allow usb connections" in activesync

8. disconnect and reconnect USB

9. flash any radio u like (except 1.65.17.10)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
at the risk of being called a moron... I tried the above and I still could not get rid of my patched 17.10 radio. if anyone had success please let me know what you did.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
sorry.... why can't I delete my posts?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
This will teach me to jump for a new radio... I made my mistake by installing the patched radio when it appeared on XDA. Now I am just trying to find a way to get rid of it.

Tried steps 1-8 without resetting, any radio I flash stops at 99% and times out. RUU errors out with "ERROR [262]: UPDATE ERROR", I follow the instructions and it recovers correctly but does not update radio.

I am guessing that steps 3 & 4 only act on the unit until reset... I even attempted them during the recovery process when the tri-color screen displays RUUNBH. Still goes up to 99% then back to recovery.

I guess it is still a no go... any suggestions welcome, and by the way, thanks a lot guys for all the help you have been providing... us noobies sometimes jump in head over heals to try out the "new thing" and get burned, but none the less it is a valuable experience and I have learned a "hell" of a lot, no pun intended =)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] OmaniMan:
sorry to disturb you dear, but from where can i get MTTY ?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] DaveShaw:
Here you go: http://xdaforums.com/showthread.php?t=371154

Dave
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jkim0121:
I am ready to hear your yelling at me at this point.

I see "Invalid Command: mw" at the step 4. I actually flashed with the patched 1.65.17.10. Should all these steps be done without patching the new (?) 1.65.17.10? Is it probably because I am now using tilt? not regular Kaiser?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jockyw2001:
Instructions only apply to those who installed my patched version and who didn't have 1.65.17.10 installed before they flashed my patched version. You obviously don't belong to that group.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] OmaniMan:
Thanks for your reply ..

i downloaded the MTTY v1.42 and following the steps. but when I run the MTTY it's not shows any port except COM1 and COM2. iam sure that i closed all task that related to Windows Mobile Device Center.

Can you help me please ?
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jockyw2001:
Skip recovery if it doesn't work the first time (next, next, exit)

Try again but first remove and reinsert battery, then immediately boot it in tricolor mode by holding camera and power on. Then connect usb cable and repeat the steps. You can check if step 4. went right before proceeding with step 5: type "mb 90d4a8". You should see exactly this on the first returned line:

0090D4A0: - 00 00 A0 E1 94 09 9D E5 | ........

If it is you can proceed with step 5 etc.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Hey Jocky, proceeded with all steps, verified to make sure I got the same return as your "mb 90d4a8" command. Still hung at 99%.

Thanks for trying =)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] OmaniMan:
Still waiting for help please .. :(
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Follow the MTTY instructions included.

Hey OmaniMan, download the latest MTTY from

http://xdaforums.com/showthread.php?t=371154&highlight=mtty.exe then:

stop ActiveSync, by Task Manager (press Ctrl + Alt + Delete)

kill two processes rapimgr.exe and wcescomm.exe and connect your device to the usb port.

Now you can follow Jocky's steps to remove the hell radio.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] azizam:
always wrong!99%
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Hey Jocky! I believe it worked, although it took a different combination of actions.

Here is what worked for me:

1. deactivate "allow usb connections" in activesync

2. kill wcescomm.exe

3. enter tri color bootloader mode

4. connect to usb

5. connect with MTTY, press enter, you should see "Cmd>"

6. type "rtask a" (w/o the quotes)

7. type "mw 90d4a8 1 e1a00000" (w/o the quotes and note that you won't see what you typed and the command does not return anything).

8. type "mb 90d4a8", if you get the following return in the first line then proceed to step 9:

0090D4A0: - 00 00 A0 E1 94 09 9D E5 | ........

9. type "retuoR" (w/o the quotes)

10. close MTTY

11. disconnect and reconnect USB

12. Start from Step 2 of the Kaiser CID/SIM Unlocker

13. Follow the steps provided by the application

Remember... this will only work if you have the Jocky Patched 1.65.17.10 installed!

Thanks again Jocky... Will try to install Laurentius' rom to verify =)

Update: Successfully installed Laurentius V4 My Favourite and the radio included in the package... Man this has been quite a learning experience. THANKS GUYS!
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jockyw2001:
Excellent, I forgot that step.

Yes, reconnecting USB is absolutely necessary. Will update my earlier post.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] vanbovene:
Patched or Not?

I am stuck on this radio which I downloaded 5/1 from either AllTheWay or P1Taters site. How can I tell if it is the patched version or not?

Thanks
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] azizam:
it worked,thans!
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] neva dinova:
thank you all so much i am freeeeeeeee :)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
Read the previous couple of pages in this thread... you will find the following.

Enter bootloader mode, connect with MTTY and enter "rtask a", then type "help" (this is not echoed to screen), if you get the following then you have the patched version:

Invalid command : help
For a help screen, ask JockyW :D or h
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] ericmcintire:
in MTTY when you type "rtask a" what does it say afterwards? mine only says

POWER OFF PMIC VREG_USB : SUCCESS!

C VREG_USB : SUCCESS!

but I remember ONCE last night when I was trying to get this to work it had a few more lines.... maybe this is why I can't get it to work properly.. thanks
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] vanbovene:
Patched or not?

Thanks russionspy4 :)

I'll give it a shot tonight
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] russianspy4:
No Echo!

If you read the previous couple of pages carefully, you will realize that your commands will not be echoed... proceed with the steps as written and eventually you will see results! Just be careful typing =)
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] RoozbehDream:
OK. thanks guys and good luck. please someone find a way for those who have the *ORIGINAL* radio from hell!!