Moto Hell - The Motorola Modding Community

Well as the title of the post says i'm trying to find a way to moddify the FW and/or MP to avoid the "Invalid Battery" message when it's generated by the PDS corruption in phones with IMEI changed. Only in those phones that have been patched to change its IMEI (like mines).
I've started searching in the CG1 (which is supposed to be patched), first i extract the CG1 from my phone wich is already patched and comparing it with the original CG1 from the ZINE_SPANISH (the one translated by the "Damn Factory"). These are the results:


Here we found 12 differences in this CG, now the thing is: if i patch the CG1 of a FW/MP with these bytes before flashing the phone it will avoid the "Invalid BatterY" message? or i'll need to search other CGs? well i hope we will find it out, anyone with IMEI changed will try to make these comparison
between its phones CG and the original CG. I used WinHex to make the comparison, and to extract the CG1 from my phone i used the method explained here: https://motohell.com/index.php?topic=3055.0 (https://motohell.com/index.php?topic=3055.0)

I hope we will find something with these info :D

Here the Spanish post at M3 http://modmymoto.com/forums/showthread.php?t=324431 (http://modmymoto.com/forums/showthread.php?t=324431)

you cannot make your own bp flashfile, though you know how to hack bp smgs.

Thanks for 4 reply ilove3d, so you mean that it's not possible to patch directly the CG1 file that i get when i use EZXCodec and then repack it? another thing that we (luks10100 from M3 and me) have detected is that when my phone was patched its bootloader was downgrade to version 0x000900 from 0x000980 that will be another reasen why the PDS is corrupted, i think. BTW is any possible way to backup the Bootloader?

back up is easy, but you can't restore

the bp and dsp etc. are in a secret zone

I had broke an E2 for trying flash custom bp smg

mmm so as i understand when i read from the addr 0x10000000 to 0x12000000 i'm just reading a copy of the actual FW or at least the BP part of it? in these post https://motohell.com/index.php?topic=3055.0 (https://motohell.com/index.php?topic=3055.0) fade2black s ays that to restore a backup i just have to make the inverse process ("send binary file" instead  "save memory range") and as i found in these full dump of the memory the PDS apperas in the offset that it's supposed to be (offset 0x00010000 in the file), here i foud these letters PDS_4017, althought one strange thing also appears, in the offset 0x00020000 appears again the PDS or a copy of it but with these letters PDS_4015. And finally in the offset 0x00030000 appears these phrase"Downgraded flash bootloader security version}" too many times to count, well it's clear what it means, but now why it's there :S. I hope that you with all your expirence could help me. Thanks in advance ilove3d. and BTW i forgot to thank you for all your great work ;)

You must do testpoint if you want flashing on PDS area.