yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] hunktb:
Related with adfree post in other thread about bluetooth in S8530 investigation I come to this one :) I have installed QXDM and tested. I have just ubuntu; QXDM tested in WinXP over VirtualBox

Steps in S8500:

-*#8720# to activate "Qualcomm mode" (again to return to normal mode)

-Qualcomm drivers from this thread (Files.rar attachment)

-Looking for NV items related with bluetooth, found this

http://xdaforums.com/showthread.php?p=33233244&highlight=bluetooth#post33233244

2839^"Bluetooth Active"^"Factory*"

2840^"Bluetooth Visible"^"Factory*"

2841^"Bluetooth SAP Enable"^"Factory*

4525^"Bluetooth Disabled"^"Debug*"

But they seem not active in S8500: QXDM Read button says "NV Status Error Received: Item Inactive". BlueTooth logs shows no info, not even mac address.

So Bluetooth in S8500 seem just managed by bcm4329 chip.

Maybe with QXDM we can get some "other processor logs" related with Bluetooth operations, but I am not very confident about that
[Bada Software and Hacking General] adfree:
Caution!

QXDM shows you little overview about "standard" NV items...

OEMs like Samsung can do their own stuff...

But since 2001 I think, really Standard NV items are:

NV item 447 for Bluetooth address

and IMEI

NV item 550

This is also working for S8500 + S8530 and many other handsets in year 2013... Qualcomm based.

If you activate an inactive NV item. Then you could do bad things to your handset... :eek:

Because few items then brick your handset... Bootcycle for instance...

It is really hard to erase or change few NV items, because WRITE Protection and few other ugly Security thingies... remember IMEI... :D

You can backup few NV items with QPST... as QCN file... with Tool Software Download BACKUP

Result looks like this:

File Version: Major 2, Minor 0, Revision 0

File Summary:

Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default, Total NV Item Count: 305

Phone Model 19 [QSC6270/QSC6240] Configurations:

Configuration Name: default

Mobile Properties:

ESN: 0xDEADD00D

Phone Model: 19 [QSC6270/QSC6240]

NV Major: 0

NV Minor: 0

SW Version: Q6270B-KPUBL-1.5.45072S

Client Name: QPST Software Download 2.7.0.348

Feature Mask:

Bit 9: F_PREFERRED_ROAMING_BIT

Bit 11: F_DIAG_ORIG_CALL_BIT

Bit 46: F_UI_SHOW_DROP_CALL_BIT

Bit 48: F_UI_PWR_KEY_ALT_BIT

Bit 81: F_DS_BIT

Bit 91: F_UI_PRL_VER_BIT

Bit 94: F_MULTIPLE_RINGER_TYPES_BIT

Bit 109: F_MC_TIMER_FIX_BIT

Bit 150: F_LPM_BIT

Bit 171: F_IS683A_PRL_BIT

Bit 200: F_NV_TWO_NAMS_RL_SMALL_BIT

Bit 206: F_ODIE_FONT_BIT

Bit 216: F_EVRC_BIT

Bit 269: F_TCXO_CLOCK_BIT

Bit 281: F_UART_POWERDOWN_BIT

Bit 283: F_FAST_WARMUP_BIT

Bit 296: F_SBI_BIT

Bit 300: F_EVRC_ADSP_BIT

Bit 301: F_VOCODER_MANAGER_BIT

Bit 335: F_AUTOBAUD_BIT

Bit 336: F_512KBYTE_RAM_BIT

Bit 340: F_UI_ANIMATE_CHARGE_BIT

Bit 341: F_NSOTASP_BIT

Bit 350: F_UI_DL_ROAM_MSG_BIT

Bit 358: F_MINIBROWSER_BIT

Bit 363: Unknown

Bit 367: Unknown

Bit 371: Unknown

Bit 375: Unknown

Bit 376: Unknown

Bit 377: Unknown

Bit 379: Unknown

Bit 380: Unknown

Bit 381: Unknown

Bit 387: Unknown

Bit 390: Unknown

Bit 391: Unknown

Bit 423: Unknown

Bit 424: Unknown

Total Set Bits: 39 of 432

Roaming Lists:

NV Items:

NV item: 10 [NV_PREF_MODE_I], index 0

NV_PREF_MODE_I 0: 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PREF_MODE_I 7: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV item: 256 [NV_PRL_ENABLED_I], index 0

NV_PRL_ENABLED_I 0: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00

NV_PRL_ENABLED_I 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

I have no idea, how good XP work in Virtual machine...

Its dangerous to have accident during read/write access to NV...

For instance I can only repair few mistakes with JTAG...

Best Regards
[Bada Software and Hacking General] hunktb:
Thanks adfree for caution advise: my S8500 is my only mobile phone :)

I can read info from NV 447 and 550 as you said, thanks

I can backup info as .qcn file. It is a binary file but there is a QPST Viewer.

I have tested, with wifi off and in airplane mode to mimimize logs, that with QXDM Log Viewer (F1) there is no info about bluetooth.

I can see some info about versions in start

DIAG TX [029] Timestamp Request 22:29:27.885 Length: 0000
DIAG RX [029] Timestamp Response 22:29:27.895 03:24:14.705
DIAG TX [000] Version Information Request 22:29:27.895 Length: 0000
DIAG RX [000] Version Information Response 22:29:27.895 Version: QSC6270/QSC6240 (May 12 2010 04:00:00)
DIAG TX [124] Get Extended Build ID Request 22:29:27.895 Length: 0000
DIAG RX [124] Get Extended Build ID Response 22:29:27.905 MSM: 0x4015E0E1, Model: QSC6270/QSC6240
DIAG TX [012] DMSS Status Request 22:29:27.915 Length: 0000
DIAG RX [019] Invalid Command Error Response 22:29:27.915 Length: 0001
DIAG TX [099] Get DMSS State/Status Snapshot Request 22:29:27.915 Length: 0000
DIAG RX [019] Invalid Command Error Response 22:29:27.925 Length: 0001
SUBSYS TX [0015/0000] Call Manager/State Info Request 22:29:27.925 Length: 0000
SUBSYS RX [0015/0000] Call Manager/State Info Response 22:29:27.935 Call State: Idle
SUBSYS TX [0009/0000] UMTS/Version Request 22:29:27.935 Length: 0000
SUBSYS RX [0009/0000] UMTS/Version Response 22:29:27.935 UMTS Version: June/04 (R5)
SUBSYS TX [0008/0000] GSM/Version Request 22:29:27.935 Length: 0000
SUBSYS RX [0008/0000] GSM/Version Response 22:29:27.945 Vocoder DSP: 0xDEAD, MDSP (ROM:RAM): 0x8005:0250
SUBSYS TX [0008/0001] GSM/Status Request 22:29:27.945 Length: 0000
SUBSYS RX [0008/0001] GSM/Status Response 22:29:27.945 Call State: Idle
SUBSYS TX [0004/0000] WCDMA/Version Request 22:29:27.955 Length: 0000
SUBSYS RX [0004/0000] WCDMA/Version Response 22:29:27.955 Vocoder DSP: 0x0608, MDSP (ROM:RAM): 0x00B0:0330
SUBSYS TX [0004/0015] WCDMA/Additional Status Request 22:29:27.955 Length: 0000
SUBSYS RX [0004/0015] WCDMA/Additional Status Response 22:29:27.965 WCDMA L1 State: L1M_DEEP_SLEEP

I can see some error messages: maybe my QXDM is outdated

MSG [00007/04] Diagnostics Services/Fatal 03:24:18.548 msg.c 02314 ==================================================================
MSG [00007/04] Diagnostics Services/Fatal 03:24:18.548 msg.c 02315 NOTE THAT SOME DIAG MESSAGES ARE SENT VIA A NEW COMMAND=<cmd 146>
MSG [00007/04] Diagnostics Services/Fatal 03:24:18.548 msg.c 02316 YOU MUST HAVE A DIAGNOSTIC TOOL THAT SUPPORTS COMMAND=<cmd 146>,TO SEE THE NEW DIAG MESSAGES
MSG [00007/04] Diagnostics Services/Fatal 03:24:18.548 msg.c 02317 ==================================================================

I include some screenshots.

S8500 doesn't have a "EFS" (Embebed File System) to navigate? When I use Stune program, which filesystem I am navigating? Where could I search bluetooth firmware used by bada ?

Edit 1: Versions

QXDM Professional 03.12.714 (Production Build)

QPST 2.7 Build 323
[Bada Software and Hacking General] adfree:
Yes, depend on QXDM Version...

Later I will post QPST and QXDM Version info...

Really good Question... maybe only locked... maybe unlock possible to work with EFS Explorer...

Because S8600 can work and shows all stuff... okay its nearly 100 % Qualcomm Hard + Soft... but also S8000 Jet shows EFS...

Thanx for trying. :good:

Best Regards

Edit 1.

Maybe you have time to check about Audio/ Microphone...

Thanx.
[Bada Software and Hacking General] Rebellos:
Filesystem of AMSS is the same as for Bada. Because CP has no direct access to any kind of solid memory, all filesystem operations are performed through sharedmem requests. It is FileManager interface you can find in libmocha-ipc.
[Bada Software and Hacking General] adfree:
PSAS is older Version of Revskills... and project Revskills is discontinued... :( :o

HWTP is from Siemens BenQ Devs from Poland... from 2006 or earlier... work also with hundrets of other QC devices... :D

Not all features...

Their are few other Tools like STune... but STune works really perfect with S8500. Other Tools have problems with S8500...

In 2006 I have used Bitpim for instance to access Qualcomm EFS...

http://www.bitpim.org/

Not tested with S8500.

Very cool for my Siemens devices ... Brew Mobile Commander. :D :good:

Also 2006...

Not tested with S8500...

No idea how many files/folders more hidden...

I have not understand, how NV items stored on S8500... :o

If it is for instance possible to extract NV items from JTAG dump... :confused:

In my old Siems BenQ days... I was able to play with CEFS dump...

Now damn encryption + stronger Security + low brain... :D

Best Regards
[Bada Software and Hacking General] hunktb:
Already installed in my ubuntu 13.4 BitPim 1.0.7 (24 Jan 2010)... it seems to be an abandoned project and it doesn't work with S8500.

S8500 not it supported models list, and it is not detected as "Other CDMA phone"

In Qualcomm mode says:

12:25:01.622 Likely ports:['/dev/ttyUSB0']
12:25:01.622 Detect Phone result: {'/dev/ttyUSB0': {'mode_modem': True, 'mode_brew': False, 'firmwareresponse': None, 'esn': u'214190110016772', 'model': u'GT-S8530', 'firmware_version': u'S8530BOLD1 ', 'manufacturer': u'SAMSUNG ELECTRONICS CORPORATION'}}

In normal mode

12:34:23.800 coms:[{'available': True, 'description': 'USB modem (/dev/ttyACM0)', 'driver': 'ttyACM', 'device': (166, 0), 'class': 'modem', 'name': '/dev/ttyACM0'}, {'available': False, 'protocol': 'Imaging / Still Image Capture / Picture Transfer Protocol (PIMA 15470)', 'description': 'USB Device - Vendor Samsung Electronics Co., Ltd, Product GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1], (Interface #00)', 'libusb': True, 'usb-productstring': 'Samsung Wave(GT-S8500)', 'active': True, 'usb-vendorstring': 'Samsung Electronics', 'usb-product#': 26720L, 'usb-vendor': 'Samsung Electronics Co., Ltd', 'name': 'usb::002::010::0', 'VID': '0x04E8', 'PID': '0x6860', 'usb-vendor#': 1256L, 'usb-interface#': 0L, 'usb-product': 'GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1]'}, {'available': False, 'protocol': 'Data / Generic', 'description': 'USB Device - Vendor Samsung Electronics Co., Ltd, Product GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1], (Interface #02)', 'libusb': True, 'usb-productstring': 'Samsung Wave(GT-S8500)', 'active': True, 'usb-vendorstring': 'Samsung Electronics', 'usb-product#': 26720L, 'usb-vendor': 'Samsung Electronics Co., Ltd', 'name': 'usb::002::010::2', 'VID': '0x04E8', 'PID': '0x6860', 'usb-vendor#': 1256L, 'usb-interface#': 2L, 'usb-product': 'GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1]'}, {'available': True, 'protocol': 'Vendor Specific Class / Bolivia', 'description': 'USB Device - Vendor Samsung Electronics Co., Ltd, Product GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1], (Interface #03)', 'libusb': True, 'usb-productstring': 'Samsung Wave(GT-S8500)', 'active': True, 'usb-vendorstring': 'Samsung Electronics', 'usb-product#': 26720L, 'usb-vendor': 'Samsung Electronics Co., Ltd', 'name': 'usb::002::010::3', 'VID': '0x04E8', 'PID': '0x6860', 'usb-vendor#': 1256L, 'usb-interface#': 3L, 'usb-product': 'GT-I9100 Phone [Galaxy S II], GT-P7500 [Galaxy Tab 10.1]'}]
...
12:34:24.007 Detect Phone result: {'/dev/ttyACM0': {'mode_modem': True, 'mode_brew': False, 'firmwareresponse': None, 'esn': '', 'model': '', 'firmware_version': '', 'manufacturer': ''}}
[Bada Software and Hacking General] Rebellos:
When you are working on filesystem in AP mode (sTune for eg), you are working on it "directly". If you are working in CP mode (QC tools), you are working in the same filesystem, but whole interface has more layers, as all requests to CP are translated by CP into FM requests and sent to AP and vice versa. If you place some files in Badadroid modem dir and then switch usb muxer into CP mode, you will see all the content of modem dir in QC tools
[Bada Software and Hacking General] ¿kernelpanic?:
Have you tried EFS explorer? Often it would show me the same files as PSAS(while preventing me from accessing some files PSAS allowed)

... or with some deft google-fu you might still be able to find the final release of revskills(thanks to viper adfree and all the others for QC BQS Firmware Analyzer and onward...only wish you'd share a little more source for part-time-hacks like myself :) even the old fourms were a godsend when this was making my living...)

fun side note: in attempting to implement efs in cdmaDevTerm I once accidentally created a file that seemed to be un-deletable by any existing efs software
[Bada Software and Hacking General] Rebellos:
Uhm - can anyone tell me what settings exactly I need to trigger to enable QXDM mode? I'm getting no success in it.

//edit: Nevermind. I didn't enable DIAG service.
[Bada Software and Hacking General] Jovan1997:
PLS help me,pls

Hi,i have S8500,and have problem whit GSM network....3G work,but when change to GSM(2G),he dont have signal....Can anyone send me NV items,or help me how to fix this.....GSM work sometimes(when I install new fresh bada),but i haved old BENQ-Siemens EF-81,and when i installed new software,he is deleted this NV items,and he dont haved network,i just backup from second phone,and restore,and problem is fixed....

Can anyone say me,or help how to fix this....

Sory for bad english
[Bada Software and Hacking General] adfree:
I am paranoid to upload my NV items... because private data...

But can you check maybe first, how many items active?

File Summary:

Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default,
Total NV Item Count: [B]319[/B]

I have few Backups of S8500 and S8530... it seems 47 KB contain around 319 NV items...

Btw.

My EF81 is still alive and I am using it often/daily. :cool:

Best Regards
[Bada Software and Hacking General] Jovan1997:
Ok,but i cant install QXDM on Win 8.1.....My frend have S8500,and i will be backup from there,but i dont know,will be worked....and i dont have any box....

EF-81 is more simple,i know all about hhim.. :D :D

P.S:I cant change Bootloader on my S8500 whit Multiloader..
[Bada Software and Hacking General] adfree:
For NV items and S8500 you need NO Box...

Only QPST. This only Software...

I will try to make Video for S8500 NV item Backup...

Normally same like EF81 with QPST...

But for EF81 other Tools work too more NV items... and from Siemens leaked 1 template of NV items...

I have not Win 8 for tests... few QPST Versions maybe too old to work with Win 8...

No idea yet...

Best Regards
[Bada Software and Hacking General] Jovan1997:
I know for QPST,but i cant find phone whit QPST....need drivers,and i cant find for win 8.1...I now use XP on Virtual box

And yes,i cant change bootloader,but this not big problem...
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?t=1333956

I am now little bit lazy... :o

Check this Tutorial...

For Driver and so on... no idea yet. I have forgotten where my drivers are...

But I am sure my Drivers are 32 bit XP compatible...

Because I have only tried on XP... not on other Win Versions nor VM...

No idea about sideeffects...

Best Regards
[Bada Software and Hacking General] Jovan1997:
Ok,tnx.....i will be try tomorow,and if need help,i will contact you.....
[Bada Software and Hacking General] Jovan1997:
ok,i checked NV item....not 319NV
[Bada Software and Hacking General] adfree:
Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default,
Total NV Item Count: [B]305[/B]

Checked short other QCN Backup... from other S8500 of mine...

So I think more then 300 NV items is normal...

"Panic" should be, if IMEI is absent and less 100 items... like here if whole EFS is erased...

Total NV Item Count: [COLOR="Red"][B]88[/B][/COLOR]

Next step...

I have ever tried on EMPTY S8500... maybe only once with all NV items to overwrite other QCN...

IMEI is reserved/secured...

NV item 550 is write protected if active...

And few other also, but normally during Restore existing NV items ignored...

I will do some tests next days... which NV itmes write protected...

On S8500 it is not possible to repair mistakes "easily" via Software...

Like on EF81 with CEFS file...

Best Regards
[Bada Software and Hacking General] Jovan1997:
when try to restore,show me error:
[Bada Software and Hacking General] adfree:
Need some time, but I could make such list with active NV items...

Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default,
Total NV Item Count: [B]305[/B]

Phone Model 19 [QSC6270/QSC6240] Configurations:

Configuration Name: default
Mobile Properties:
ESN: 0xDEADD00D
Phone Model: 19 [QSC6270/QSC6240]
NV Major: 0
NV Minor: 0
SW Version: Q6270B-KPUBL-1.5.45072S
Client Name: QPST Software Download 2.7.0.348

Feature Mask:
Bit 9: F_PREFERRED_ROAMING_BIT
Bit 11: F_DIAG_ORIG_CALL_BIT
Bit 46: F_UI_SHOW_DROP_CALL_BIT
Bit 48: F_UI_PWR_KEY_ALT_BIT
Bit 81: F_DS_BIT
Bit 91: F_UI_PRL_VER_BIT
Bit 94: F_MULTIPLE_RINGER_TYPES_BIT
Bit 109: F_MC_TIMER_FIX_BIT
Bit 150: F_LPM_BIT
Bit 171: F_IS683A_PRL_BIT
Bit 200: F_NV_TWO_NAMS_RL_SMALL_BIT
Bit 206: F_ODIE_FONT_BIT
Bit 216: F_EVRC_BIT
Bit 269: F_TCXO_CLOCK_BIT
Bit 281: F_UART_POWERDOWN_BIT
Bit 283: F_FAST_WARMUP_BIT
Bit 296: F_SBI_BIT
Bit 300: F_EVRC_ADSP_BIT
Bit 301: F_VOCODER_MANAGER_BIT
Bit 335: F_AUTOBAUD_BIT
Bit 336: F_512KBYTE_RAM_BIT
Bit 340: F_UI_ANIMATE_CHARGE_BIT
Bit 341: F_NSOTASP_BIT
Bit 350: F_UI_DL_ROAM_MSG_BIT
Bit 358: F_MINIBROWSER_BIT
Bit 363: Unknown
Bit 367: Unknown
Bit 371: Unknown
Bit 375: Unknown
Bit 376: Unknown
Bit 377: Unknown
Bit 379: Unknown
Bit 380: Unknown
Bit 381: Unknown
Bit 387: Unknown
Bit 390: Unknown
Bit 391: Unknown
Bit 423: Unknown
Bit 424: Unknown
Total Set Bits: 39 of 432
Roaming Lists:

NV Items:
NV item: [B]10[/B] [NV_PREF_MODE_I], index 0
NV item: [B]256[/B] [NV_PRL_ENABLED_I], index 0
.
.
.

Best Regards
[Bada Software and Hacking General] adfree:
Few items are SECURED... minimum NV item 550 because IMEI is write protected...

Few others... forgotten which one...

Caution! With trying to Restore...

Again, give me more time and I will check what is protected...

It is possible to "edit" QCN files to remove write protected ITEMs...

Best Regards
[Bada Software and Hacking General] Jovan1997:
ok,ok.....but this NV item,can be delete if anyone tryed to flash bada whit multiloader?....or can be just deleted/writed whit box?

P.S:Android dont using NV item(badadroid)????....
[Bada Software and Hacking General] Jovan1997:
This from my frend,but cant restore :(

I think this problem is because in my phone miising some NV item....

NV item is in AMSS file,maybe when i back to BADA 1.0.2,maybe all NV item is back,but when try multioader show problem....

319 NV items(bada 1.0.2):

And this is my(bada 2.0.1):
[Bada Software and Hacking General] adfree:
Sorry, not much time yet... :o

Convert QCN into TXT...

Then compare with Total Commander for instance...

Found difference... for instance:

NV ID 882
2742
2744
2746
.
.

Somewhere is Calibration Date...

NV item: [B]571[/B] [NV_RF_CAL_DATE_I], index 0

Maybe we could sort by "groups"

Otherwise too many differences...

Best Regards

P.S:

My Calibration Date...

NV_RF_CAL_DATE_I 0: 03 b6 32 01 00 00 00 00 00 00 00 00 00 00 00 00

and

NV_RF_CAL_DATE_I 0: 26 b7 32 01 00 00 00 00 00 00 00 00 00 00 00 00
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=46182256&postcount=39

About Restore...

Damn QPST can not skip activated/existing NV items and few other d. Restrictions...

If you know all about EF81... then you know NV Editor... :D

But this is too old to work with all NV items of S8500...

But it work... :cool:

Anyway.

Problem 1 for S8500 is to remove ID 550 from QCN Backup...

This is why it stops... at 5 %... Received invalid Command from phone...

You need an Editor for NV items to remove IMEI NV ID 550...

NV Editor crashes if I try to open my QCN...

RF_NV_Manager.exe from QPST is full of Restrictions and can not open my QCN :rolleyes: :rolleyes:

Also in this "blue green" Factory Mode NV items are secured...

Need some time to find solution...

Maybe weeks, months... years. :o

Sorry.

You are at your own.

Best Regards

P.S.:

For me I can easily Restore all NV items from QPST QCN because if I erase them with RIFF JTAG Box...
[Bada Software and Hacking General] adfree:
:D

Its really only because ID 550 is not allowed during Security...

First test with HEX Editor changed short IMEI to match IMEI in S8500...

Same...

Second attempt...

Changed ID 550 into 551...

No idea yet what 551 is... but then Restore is complete working and S8500 starts...

CAUTION!!!

Warning.

Playing with NV items is dangerous on S8500.

Because Security is stronger as in EF81...

EF81 if you make mistake, then you can erase all NV items with writing empty .qvcefs and then write NV items new...

Maybe next days I have better solution, then I can better describe...

For now I have few other problems... I have killed my Qualcomm Driver with Sniffer... :rolleyes:

Now it works only 1 time and I have to reboot my XP... :crying:

I have to fix this annoying problem first...

Best Regards
[Bada Software and Hacking General] adfree:
Puhhh, found my problem and solved... :victory:

USBlyzer... blocked my USB for QC... maybe after stupid tests long time ago... :o

@ Jovan1997

Are you able to edit your QCN with HEX Editor?

I have tested short.

Replaced NV ID 550 with NV ID for Product Code... :D

You can find IMEI via HEX search for 0x083A

Or NV ID 550...

880001002602

Change into:

88000100[B]5727[/B]

Again Caution!

At your own risk

I can NOT help you, if something goes wrong...

NO idea if this could help you to fix your problem...

Best Regards
[Bada Software and Hacking General] Jovan1997:
ok,thanks,but need you help....i will be contact on PM....
[Bada Software and Hacking General] adfree:
It seems QCN is simple structure... I hope.

Because to remove IMEI from QCN file...

I have removed 136 Bytes...

ID 550 looks like this...

8800010026020000083A

880001 Header/start of every NV item...

2602 is Little Endian 226 ... HEX Value means ID 550

BT address is 447...

Later I will try this also to remove...

It is possible to check if valid offline, without writing to device...

Open with QPST QCNView and convert into txt...

I will check if I can now find WiFi address... never found before...

http://xdaforums.com/showthread.php?t=1035837

Best Regards
[Bada Software and Hacking General] Jovan1997:
hahahaah ok,i wait for second qcn file....

i will be try to restore this my NV item,to try....
[Bada Software and Hacking General] adfree:
NV item: 571 [NV_RF_CAL_DATE_I], index 0

Memo to me...

Later I will try to compare few QCNs by Calibration Date...

Found way how I can Backup few QCNs for study... :angel:

http://xdaforums.com/showpost.php?p=46334291&postcount=121

Best Regards

Edit 1.

If NV item 571 looks like this:

NV item: 571 [NV_RF_CAL_DATE_I], index 0

NV_RF_CAL_DATE_I 0: 7a b6 32 01 00 00 00 00 00 00 00 00 00 00 00 00

Then you can see via Code:

*#197328640#

2 Version Information

2... HF Cal

4 Read Cal Date

See Screenshot...

Best Regards
[Bada Software and Hacking General] adfree:
Seems "few" JTAG dumps are from Prototypes/Samples...

I can see XXJB1 in "Info Block"...

NV items are more then 400... :confused:

About Calibration Date...

For now I have not found 2 matching dates... maybe "later"...

Now I will check XXJB5d...

Later I will try to understand how NV ID 571 work...

3[B]2010[/B]0

Maybe this is year 2010...

No idea yet, how first 2 Bytes work...

Best Regards
[Bada Software and Hacking General] adfree:
[B]HEX[/B] Value	NV ID [B]571[/B]
72B43201	2010.02.10
D1B43201	2010.03.05
03B63201	2010.06.11
11B63201	2010.06.25
7AB63201	2010.07.30
DAB63201	2010.08.26
26B73201	2010.09.02
35B73201	2010.09.17
E5DB3201	2011.03.09

Calibration date is easy... Little Endian...

Hmm, it seems not same date as in Info Block at 0x1FFC5000...

Will check next with open eyes... :D

Found no 2 same date nor nearly equal QCN... most have 1000 differences...

Will compare again... maybe can find less differences...

Best Regards