|
Title: [Tutorial] Manual creating of some patches Post by: Bipolar on January 14, 2011, 06:04:47 am Contents:
1.Keypad lock/unlock (+ patch generator at the end) 2.Change the enter to opcode menu 3.Disable the midlet verification 4.Java over Bluetooth (+ patch generator at the end) 5.Guide to create patch 6.Phone buttons and their hex values 7.ASCII Table You wil need: XVI32 and FlashBackup 2.62 1.Keypad lock/unlock Open with some Hex editor CG1 of the Firmware that you are using. Then search for hex string: For Locking keys: 14 00 0A 00 26 00 14 00 0B 00 26 (http://img218.imageshack.us/img218/6204/lock7ka.png) For Unlocking keys: 14 D1 00 24 01 1C 20 BC 10 BC 08 (http://img80.imageshack.us/img80/798/unlock4sa.png) (Screenshots are from CG1 48R) 14 - menu /first button and 0A - * /second button You can change them directly in CG1 by changing the values: Look at "Phone buttons and their hex values" For creating patch you need to click with the cursor on 14,0A and write somewhere the offsets: look here (http://img148.imageshack.us/img148/7017/xvi323hd.gif) Now create new text document with notepad and if you want lock menu+menu and unlock right soft+menu write in: [Patch_code] here the offset(hexadecimal)of lock b. 1: 14 offset lock b. 2: 14 unlock b. 1: 0F unlock b. 2: 14 Example(48R): [Patch_Code] 319ead: 14 319eaf: 14 459db7: 0f 459e0b: 14 Now save and change extension of the file from .txt to .fpa and the patch is ready. Here are the patch codes for some firmwares: Firmware 48R 45R 42R 70R 6FR 6BR Lock button 1 319ead 319de5 319aa9 31CD75 31cced 31BD15 Lock button 2 319eaf 319de7 319aab 31CD77 31ccef 31BD17 Unlock button 1 459db7 459CDF 45998B 45C52D 45C1A5 45AE09 Unlock button 2 459e0b 459D33 4599DF 45C581 45C1F9 45AE5D And a good program that does all this for you A~LUPG_v1.1.3b by ~Absolut buG~ (You have to know that not all combination of keys is supported by the firmware) 2.Change the enter to opcode menu(from menu+ 048263* to menu+ one key) Search string: 00 00 04 00 08 00 02 00 06 00 03 00 0A (http://img212.imageshack.us/img212/5666/opcodekeyvalues12em.png) You need to change only (http://img382.imageshack.us/img382/964/opcodekeyvalues25bh.png) 00 - to value of the button that you want to use and 04 - that has to be changed to 26 (if you change only 04 to 26 its going to be menu +0) 00 can be changed to 0A,11,12,0F,0E,17,18(1,2,..9 are used for shortcuts) Recommend: 0A,11,12(*,End call,Answer) Then to create patch write the offsets of 00,04 and the patch should look like that: [Patch_Code] 31a095: 0A 31a097: 26 (this is menu + *) Firmware 45R 48R 70R 6fr 42r offset of 00 319FCD 31a095 31cf5d 31ced5 319c91 offset of 04 319FCF 31a097 31cf5f 31ced7 319c93 3.Disable the midlet verification(you have to change 9005 to E00F) Search for string: 90 05 90 04 1C 0F 26 0F 22 0C If you cant find it try this: E0 0F 90 04 1C 0F 26 0F 22 0C(that means your firmware is allready patched) Firmware : offset 70R : 1DA96A 6FR : 1DA952 42R : 1D8C16 45R : 1D8E7E 48R : 1D8E7E Patch should look like that: [Patch_Code] 1D8E7E: E00F 4.Java over Bluetooth(This patch is for transfering files through bluetooth, you need phoneman or iphone explorer to copy the files to audio,video or pictures) Open with hex editor CG1 of your firmware,search for these hex strings: 1.00 00 00 00 00 21 12 00 00 D0 12 (write down the offset for first 00 only) 2.D0 12 00 01 B7 12 00 02 20 -here you have to write the offset for the last one(20) 3.05 00 00 00 00 00 00 07 03 (offset of 05) 4.77 00 62 00 6D FF FE (of 77) When you got the offsets you are ready to create the patch. (offsets: patch code) 1.(00): 3E4F 2.(20): 21 3.(05): 04 (04 is for files to be in video folder/audio=03/pictures=05/audio and video=10) 4.(77): 6A00610072 (6A is j; 06 is a; 72 is r = jar ,if you want to send other file just change this hex values > see ASCII Table) Example(48R for .jar file stored in video): [Patch_Code] 2FCB7E: 3E4F 2FCB87: 21 2FCC34: 04 2FD5A5: 6A00610072 And a good program that does all this for you "motobluetooth 1.2.0 beta" by vassio 5.Guide to create patch Create new text document with notepad and write in: [Patch_code] offset: hex value Example(48R changing keypad lock/unlock): [Patch_Code] 319ead: 14 319eaf: 14 459db7: 0f 459e0b: 14 Other Example(48R Disable the midlet verification): [Patch_Code] 1D8E7E: E00F Save it and change extension of the file from .txt to .fpa and the patch is ready. 6.Phone buttons and their hex values (Key > Hex Value) KP1 > 01 Answer > 12 Joy Left > 2E KP2 > 02 End Call > 11 Joy Click > 3D KP3 > 03 Right Soft > 0F T-Mobile > 42 KP4 > 04 Left Soft > 0E KP5 > 05 Joy up > 2C KP6 > 06 Menu > 14 KP7 > 07 Joy down > 2D KP8 > 08 Vol. Up > 17 KP9 > 09 Vol.Down > 18 KP* > 0A Smart b. > 15 KP0 > 00 Camera b. > 3F KP# > 0B Joy Right > 2F 7.ASCII Table (http://img255.imageshack.us/img255/8772/asciitable.gif) Dec = Decimal Hx = Hexadecimal (Use this) Oct = Octal Html = HyperText Markup Language Char = Character |