User Manual for SonnyEricsson DIV 8.2 software (flasher+unlocker)
Revision 8,
last update
Contents
Where is stored Network codes?
Some flashing tips and what is "AVR CPU", "ARM CPU"
How to repair "4 locks closed" phones
How to repair "NO ACCESS" phones
How to repair totally damaged (erased) phones
How to unlock T610 version R1L013 and up
How to make "Empty Boards" phones
1. 17417w227r Plug DONGLE into LPT (Printer) port
2. 17417w227r Plug cable into DONGLE and the other part into USB port
3. 17417w227r Start the software
Do NOT run the software directly from CD, copy first to your local HDD !!
Now is ready to work with phones.
1. 17417w227r Plug phone WITHOUT battery to cable
2. 17417w227r Put the battery to phone
3. 17417w227r Do NOT power ON the phone!!
4. 17417w227r Make desired operation
5. 17417w227r Remove battery
6. 17417w227r Remove cable from phone's bottom connector
!!! Phone's battery must be FULL charged for all operations !!!
!!! Do NOT press any buttons on phone when any operation is in progress !!!
These steps must be followed in EXACTLY this order, especially on R600 and T100. On A3618, R600 and T100 don't forget to remove battery and put back again before try to power up the phone, because after reading Network Codes the phone remains in TEST MODE. Also, on this phones, after entering Network Codes (to unlock SP) power down the phone from ON/OFF button. The lock/unlock status is saved in flash memory only at power down operation!
A3618 have a special procedure: it must be connected WITHOUT battery, and AFTER press the button for desired operation (e.g. Read All Codes) just insert the battery.
On T300, to avoid any errors is better to put the battery's cover when make any operation, because on this model the battery not fit strongly enough inside phone without cover, and the contact (electric power) from battery to phone can be lost when operation is in progress.
If any error occurs when working, do these steps in this order:
1. 17417w227r Remove battery
2. 17417w227r Disconnect cable
3. 17417w227r Connect cable
4. 17417w227r Put battery back
5. 17417w227r Try again desired operation
!!! VERRY IMPORTANT !!!
NEVER try to write a Flash file from other model/type!! Especially if you write Main Flash (AVR) files from one "big flash" model (T68, T300) to a "small flash" model (R520, T39, T65, T200) you will damage FOREVER your phone, because Security Area in GDFS will be overwrite!!
!!! YOU CAN DAMAGE FOREVER YOUR PHONE !!!
The Network Lock/Unlock codes (NCK, NSCK, CCK, and SPCK) are also saved in file "CODESLOG.TXT". This is very useful for A3618 and R600. Also, for A3618 and R600, the software is shown on the screen ONLY Network UNLOCK codes. The other codes (for Lock to network) can be find in log file named "CODESLOG.TXT" located in current working directory.
1. 17417w227r Write (upload) GDFS file "T68m_to_T68i_Version2.GDF"
2. 17417w227r Write (upload) Main CPU (AVR) with desired flash (language) from T68i or T68ic
3. 17417w227r Write (upload) Modem flash (ARM) with file from T68i or T68ic. All the time use the file with SAME revision code as used for Main CPU! For example, if you used for Main CPU the file "T68i_EMEA1_R5C001.sbn" you have to use for Modem flash the file "T68i_Modem_R5C001.arm" (in this case the revision code for both files is R5C001). Also, if you used for Main CPU the file "T68ic_HongKong_R2A014.sbn" you have to use for Modem CPU the file "T68ic_Modem_R2A014.arm" (now the revision code was R2A014 for both files).
4. 17417w227r Disconnect phone from cable
5. 17417w227r Press NO (Power) button and keep pressed for 4-5 seconds. Don't panic if phone will not power on immediately!
6. 17417w227r Wait 10-20 seconds until phone will power on (the new flash will initialize phone, and this take some time)
WARNING (specialy for Chinese/Asian market):
On CD received (first release - version 1) it was an error.
The 2 files from directory "\!Flash\Main_Flash.AVR\T68ic":
"T68ic_China_R5C001.sbn" and "T68ic_HongKong_R5C001.sbn"
MUST be renamed to:
"T68ic_China_R2A014.sbn" and "T68ic_HongKong_R2A014.sbn"
The 2 Modem files for revision code R2A014 is missing.
Ask your box vendor for this 2 files:
"T68i_Modem_R2A014.arm" and "T68ic_Modem_R2A014.arm"
and place this files in their specific folders and/or subfolders.
1. 17417w227r Write (upload) Main CPU (AVR) with desired flash (language) from T310
2. 17417w227r Write (upload) GDFS file "T300_to_T310.GDF"
3. 17417w227r Disconnect phone from cable
WARNING
When use any FLASH file, this must be copyed from CD to PC or NoteBook HardDisk and the Read Only flag must be cleared (all files are stored on CD with Read Only flag set).
All new Sony-Ericsson phones have a special part area in Flash chip named GDFS. This area is used because the new phones no more have an separate EEPROM chip. Here is stored all parameters regarding the phone (SP lock codes, SP lock status, User code, RF calibration, games, display settings, . and many more). From software version 6.2 there is a new operation available for all 'original brand' Sony-Ericsson made phones, named "Write GDFS". This operation was available in old software versions only for upgrade T68m to T68i. There is also provided more GDFS files for different repair or upgrade operations.
This files are in a special TXT format, and do NOT try to edit this (you can damage your phone forever)! Also, use a specified file ONLY for the phone model for what this is provided!
Here is a description of each GDFS file available now:
|
"T68m_to_T68i_Version2.GDF" |
For upgrade T68m phones to T68i phones |
|
"T300_to_T310.GDF" |
For upgrade T300 phones to T310 (will add new games: Ace of Spade, Minigolf and THPS4) |
|
"T39_EMS_fix.GDF" |
To fix bug in |
|
"T65_Volume00_fix.GDF" |
Remove "Volume 0/0" bug after flash on T65 phones |
|
"T68_HBH30_Echo_fix.GDF" |
Fix echo problems on HBH30 handsfree on T68 phone |
|
"T68_Reset_Total_Time_Joystik_Counter.GDF" |
Reset joystik counter and total used time (life time) on T68 phones |
|
"T68_Set_Mic_Normal.GDF" |
Set microphone sensitivity to normal on T68 phones |
|
"T68_Volume00_fix.GDF" |
Remove "Volume 0/0" bug after flash on T68 phones |
|
"ALL_Models_Channel_Menu_ON.GDF" |
Enable "Channel info" menu on all phone models |
|
"ALL_Models_Channel_Menu_OFF.GDF" |
Disable "Channel info" menu on all phone models |
|
"T300_Reset_Total_Time_Joystik_Counter.GDF" |
Reset joystik counter and total used time (life time) meter on T300 phones |
|
"T310_Reset_Total_Time_Joystik_Counter.GDF" |
Reset joystik counter and total used time (life time) meter on T310 phones |
|
"T310_Write_Only_Games.GDF" |
Write only games area in T310 phones. Included games are: Ace of Spade, Minigolf and THPS4 |
|
"T200_Volume_Level_Fix.GDF" |
Remove "Volume 0/0" bug after flash on T200 phones |
|
"T306_Audio_Reset.GDF" |
Reset audio parameters on T306 phones |
|
"T316_Audio_Reset.GDF" |
Reset audio parameters on T316 phones |
|
"T610_Reset_Total_Time.GDF" |
Reset total used time (life time) meter on T610 phones |
|
"T616_Audio_Reset.GDF" |
Reset audio parameters on T616 phones |
More
GDFS files for different repair/upgrade operations will be added soon and the
description for this will be in next revision of this User Manual.
Inside new 'original brand' SonyEricsson phones there is two processors (CPU's). One is Main CPU and this is AVR chip, and the second is Modem CPU and this is ARM chip.
The Main CPU (AVR chip) is holding almost all phone functions, including language packs available. The Modem CPU (ARM chip) take care of Infrared communications (IRDA), Bluetooth and Data/Fax functions.
On 'non original' SonyEricsson phones (this are A3618, R600 and T100) there is only one Main CPU (an ARM chip). Also on latest models 'original brand' T200 and T300 the Modem CPU (ARM chip) is no more present.
When flash a phone, usually is enough to flash the Main CPU (AVR chip). The Modem CPU (ARM chip) is needed to be re-flashed only when upgrade T68m to T68i or when make major version upgrade (e.g. from R2A to R5D or so on). If there is any error in "Connect" or "WAP services" menus, or if phone hang-up when try to enter any of this menus, a flash update for Modem CPU (ARM chip) is needed. Also the Modem CPU need to be upgraded if there is any errors in Bluetooth functionality. In all other cases, the Modem CPU no need to be upgraded.
For T68, T200, T300, T310 and P800 phones, is just needed to mark the checkbox for IMEI change and enter the desired 15 digits IMEI.
On T610 phones, after IMEI change, you have to flash the phone with special flash. You can find this in New Support Area under the directory "EmptyBoard_ImeiChange" E.g. For T610 EMEA1 you have to use the file "T610_FullFlash_v5_R1L013_EMEA1.sbn". It will be better to flash Modem (ARM) file too (with same version - e.g. R1L013). After phone was flashed with this file, you can change IMEI on this phone how many times you want and to any value you want.
On the first CD's released to customers there is old version of "Special Flash" files. PLEASE do not use this files and download and use latest version from New Support Area (under the directory "EmptyBoard_ImeiChange")!
This function now works in any damage status of phone's memory (GDFS area) for the following models: T68m, T68i, T200, T300, T310, T610, T616, T618 and P800.
On many phones damaged by others free and/or cracked softwares, usualy is enough to apply function "Reset GDFS". If after that the phone is still locked (4 locks closed and retry counters on 0), full flash the phone (AVR CPU and ARM CPU) and make operations for Change IMEI on this phone.
For full flash the phone (AVR CPU and ARM CPU) follow the next rules:
· 17417w227r For T68, T200, T300, T310, P800 use any REGULAR (NOT patched) flash files.
· 17417w227r For T610 use the patched (modified) files for your language desired area. You can find this in New Support Area under the directory "EmptyBoard_ImeiChange" E.g. For T610 phone with EMEA1 languages pack, you have to use the file "T610_FullFlash_v5_EMEA1_R1L013.sbn". It will be better to flash Modem (ARM) file too (with same version - e.g. R1L013).
For more details about change IMEI, please read previous section (How to change IMEI). If your phone was not an Empty Board phone (for Empty Board phones OTP IMEI is FFFFFFFFFFFFFFF) and you just want to keep the original phone's IMEI (the one stored in OTP) you just have to mark the checkbox "Rebuild SP Area using OTP IMEI".
This function now works in any damage status of the phone's memory (GDFS area) for the following models: T68m, T68i, T200, T300, T310, T610, T616, T618 and P800.
If your phone was repaired with the previous version of DIV software (v8.0), on some phones with Static Checksum (SCRC) destroied, you have "NO ACCESS" problem (phone not log into GSM network). To correct this, just follow the instructions for repair "4 locks closed" phones. Don't forget to full flash the phone too!!
For full flash the phone (AVR CPU and ARM CPU) follow the next rules:
· 17417w227r For T68, T200, T300, T310, P800 use any REGULAR (NOT patched) flash files.
· 17417w227r For T610 use the patched (modified) files for your language desired area. You can find this in New Support Area under the directory "EmptyBoard_ImeiChange" E.g. For T610 phone with EMEA1 languages pack, you have to use the file "T610_FullFlash_v5_ EMEA1_R1L013.sbn". It will be better to flash Modem (ARM) file too (with same version - e.g. R1L013).
Totally damaged phones means phones with no power up at all due to software and/or memory (GDFS) problems. This repair function works now only for the following models: T68m, T68i, T200, T300, T310, T610, T616, T618 and P800.
First, you have to full flash the phone's firmware following this rules:
· 17417w227r For T68, T200, T300, T310, P800 use any REGULAR (NOT patched) flash files.
· 17417w227r For T610 use the patched (modified) files for your language desired area. You can find this in New Support Area under the directory "EmptyBoard_ImeiChange" E.g. For T610 phone with EMEA1 languages pack, you have to use the file "T610_FullFlash_v5_ EMEA1_R1L013.sbn". It will be better to flash Modem (ARM) file too (with same version - e.g. R1L013).
After that, you have to fill the GDFS area with an correct data. To do this, you have to write the AVR CPU part of GDFS area with a flash file in SBN format for this part (GDFS).
- 17417w227r 17417w227r for T68m use "T68m_FullGdfs_in_AVR_flash_format.sbn" (up to R2B version)
- 17417w227r 17417w227r for T68i use "T68i_FullGdfs_in_AVR_flash_format.sbn" (R5C and upper)
- 17417w227r 17417w227r for T200 use "T200_FullGdfs_in_AVR_flash_format.sbn"
- 17417w227r 17417w227r for T300 use "T300_FullGdfs_in_AVR_flash_format.sbn"
- 17417w227r 17417w227r for T310 use "T310_FullGdfs_in_AVR_flash_format.sbn"
- 17417w227r 17417w227r for P800 use "P800_FullGdfs_in_AVR_flash_format.sbn"
All this needed files you can find in New Support Area.
On new versions of T610 phones, the SP Area encryption algorithm is changed. If you unlock this phones with any older version than DIV v81. it becomes "4 locks closed". To unlock this new phones, you have to use one of the functions "Rebuild SP Area using OTP IMEI" (for regular T610 phones) or "Change IMEI" (for empty board phones). If you use "Change IMEI" function, you will have to full flash (AVR and ARM) the phone with patched flash files available in New Support Area. If you use the function "Rebuild SP Area using OTP IMEI" there is NO need to flash the phone!
Empty Board phones is phones who comes directly from factory assembly line and instead of usual firmware (flash contents) have only a Test firmware written inside. This phones can be easy identified, because if try to power on, there will be only some letters and numbers on display (E.g. CXC123.., R2A, .). For this phones, you have to do 2 main operations: one is to flash both AVR and ARM CPU's, and other is to fill GDFS part with needed fields (e.g. IMEI, SP lock area, correct checksums, .).
For first operation (flash AVR and ARM) flash phone with desired file
For full flash the phone (AVR CPU and ARM CPU) follow the next rules:
· 17417w227r For T68, T200, T300, T310, P800 use any REGULAR (NOT patched) flash files.
· 17417w227r For T39 and T610 use the patched (modified) files for your language desired area. You can find this in New Support Area under the directory "EmptyBoard_ImeiChange" E.g. For T610 phone with EMEA1 languages pack, you have to use the file "T610_FullFlash_v5_ EMEA1_R1L013.sbn". It will be better to flash Modem (ARM) file too (with same version - e.g. R1L013).
After the flash process is done, you have to fill GDFS, upload IMEI and SP lock area, clear SP locks. For this, you have to mark following Check Boxes: 'Clear SP Locks', 'Clear User Code', 'Default SP Area (empty phones)', 'Change IMEI:' and 'Write GDFS file with:'.
In 'Change IMEI:' right field, just write some 15 digits IMEI number.
In 'Write GDFS file with:' you have to use one of the following files:
- 17417w227r 17417w227r for T610 use "T610_FullGdfs.gdf"
- 17417w227r 17417w227r for T68 use "T68i_FullGdfs.gdf"
- 17417w227r 17417w227r for R520, T39, T65 use "R520_T39_T65_Gdfs_for_EmptyBoard.gdf"
- 17417w227r 17417w227r for T200 use "T200_T300_Gdfs_for_EmptyBoard.gdf"
For the latest software version, flash package files, documentation and support forum please check:
https://www.sonyericssonflasher.com
|
