Flashing your nokia [Archive]

Admin

30-06-2002, 03:52 PM

Get the Software

You can just use the flasher and you can use a flasher shell.
Members can login and download all software and you can find some software for download in the free download section.
If you decide to use a shell you don't have problem of configuring flasher and searching for flash files and tia files. And you don't have to know the start addresses. But if a shell is incorrupt it can kill your phone.. It is more safe to do it yourself.

Which files do you have to use: (boot, flash loaders):

There are 4 different boot loaders 808 bytes, 844 bytes, 868 bytes and 964 bytes. 964 bytes is most used. If the flasher stops loading after boot bin then take another.
The flashloader is a bit more complicated.
- Run the Flasher (.com)
- Press read phone (F 1 )
http://www.gsm-software.net/flashtutfiles/id.jpg- Compare the flash id with this table:
01B5: AMD 29LV004T, size 4Mb
01B6: AMD 29LV004B, size 4Mb
04B5: Fujitsu 29LV004T, ALIAS_ID=01B5
04B6: Fujitsu 29LV004B, ALIAS_ID=01B6
1F23: Atmel 49BV080, size 8Mb
20F7: ST M28V411, ALIAS_ID=8979
20FF: ST M28V421, ALIAS_ID=8978
20DF: ST M28V841, ALIAS_ID=89A2
8978: Intel 28F004BV-T, size 4Mb
8979: Intel 28F004BV-B, size 4Mb
897C: Intel 28F002BX-T, size 2Mb Vcc=5V
897D: Intel 28F002BX-B, size 2Mb Vcc=5V
8989: Intel 28F004xx in HD821
8994: Intel 28F001BX-T, size 1Mb Vcc=5V
8995: Intel 28F001BX-B, size 1Mb Vcc=5V
8998: Intel 28F008BE-T, size 8Mb
8999: Intel 28F008BE-B, size 8Mb
89A2: Intel 28F008SA-L, size 8Mb
89A6: Intel 28F008SC-L, ALIAS_ID=89A2
000122DA: AMD 29LV800T, size 8Mb
0001225B: AMD 29LV800B, size 8Mb
000122C4: AMD 29LV160BT, size 16Mb
000422DA: Fujitsu 29LV800T, size 8Mb
0004225B: Fujitsu 29LV800B, size 8Mb
001F00A0: Atmel 49BV8192B, size 8Mb
001F00A3: Atmel 49BV8192T, size 8Mb
001F00C0: Atmel 49BV16X4B, size 16Mb
001F00C2: Atmel 49BV16X4T, size 16Mb
001F00C8: Atmel 49BV32X4B, size 32Mb
001F00C9: Atmel 49BV32X4T, size 32Mb
002000D7: ST M29W800AT, ALIAS_ID=000122DA
0020005B: ST M29W800AB, ALIAS_ID=0001225B
00200090: ST M28W160T, ALIAS_ID=00898890
00200091: ST M28W160B, ALIAS_ID=00898891
002088BA: ST M28W320CT, size 32Mb
002088BC: ST M28W320BT, ALIAS_ID=00898896
002C4492: Micron MT28F160C3-T, ALIAS_ID=008988C2
00894470: Intel 28F400Cx-T, size 4Mb
00898890: Intel 28F160B3-T, size 16Mb
00898891: Intel 28F160B3-B, size 16Mb
00898892: Intel 28F800B3-T, size 8Mb
00898893: Intel 28F800B3-B, size 8Mb
00898894: Intel 28F400B3-T, size 4Mb
00898895: Intel 28F400B3-B, size 4Mb
0089889C: Intel 28F800Cx-T, size 8Mb
008988C2: Intel 28F1602C3-T, size 16Mb
00898896: Intel 28F320B3-T, size 32Mb
008988C4: Intel 28F3204C3-T, size 48Mb
008988F3: Intel 28F160F3-T, ALIAS_ID=00898890
008988F4: Intel 28F160F3-B, ALIAS_ID=00898891
00B00048: Sharp LH28F160BVE, ALIAS_ID=00898890
00B0004A: Sharp LH28F800BG, ALIAS_ID=00898892
00B00060: Sharp LH28F800BG, ALIAS_ID=00898892
00B00061: Sharp LH28F800SX, ALIAS_ID=00898893
00B00068: Sharp LH28F160BG, ALIAS_ID=00898890
00B000D0: Sharp LH28FS16SX, ALIAS_ID=00898891
00B000E8: Sharp LRS1360, ALIAS_ID=00898891
80898896: Intel 28F320B3-T, size 32Mb
- Now you can see what chip you have and get correct tia files for it.(the filename of the loader uses nearly the same name as the chip)
- Then rename the *.tia File (your Flashloader) to f_loader.bin
copy it to C:nk_files

For example:

Your flash id is: 00898890 (this one is from a 3310; not only 3310) - So you have a 28F160B3-T, size 16Mb Chip.
Then look for a *.tia file which name is nearly: 28F160B3-T
iw28f016.tia is the correct tia file (FlashLoader)
Note: You probably have to patch the F-loader to read correct. And Sometimes you can't write with patched Flash loader. Members can downlaod patched and non-patched loaders.
Note*:This method does not always work(in practice) if it doesn't work for you then you will have to try all Flash loaders (and combinations with boot loaders)
Now Let's start the real work!
First we are going to make a back-up!! Very important!!
First make sure that you parallel port setting are correct (printer port) This must be set to epp+ecp (or just epp; I use epp) in your bios!
- Connect the nokia flasher interface with you printer port and to your mobile phone.
- Phone MUST be off!
- Go to C:flasher and start flasher.com / Press ALT+ENTER for FULL SCREEN

For back-up we press F1
Choose the type of your mobile phone and then press enter.
A new window will open (on the right)... there you'll have to put in the start-address and the end-address. Look at the table bellow for the CORRECT addresses (This is important).
Older phones have 00200000 - 00400000 (2 mb) and newer phones have 00200000 - 00600000 (4 mb) just ask in the Forum if you're not sure.

Press Enter and press short on the on/off switch of your mobile phone
THE PHONE MUST NOT TURN ON!! if so you are doing something wrong.
(Don't press to long on the 'on' button)
After the program has finished (sometimes it look if it hangs but just wait..) you can find a file flash.out in c:flasher rename that file to your_type+softversion.fls
(e.g. nok3210_536.fls)
Store the file very very securely!
Now let's do the flashing part (the unlocking)
- First download the partial flash files from the archive.
- Copy ONLY the needed fls file in c:nk_files
- The filenames consist of typ + version.fls (for correct version for your phone press *#0000#)
- Start flasher.com
- Now press F2 and choose your type.. then press Enter.
- Choose the correct fls file.
- NOW Something VERY important! Type in the CORRECT start address!!
- Now press Enter again. (make sure you have the good one)
- Again Enter
- Again press the on/off switch shortly. (AGAIN the phone may NOT turn on)(NOT needed if your 3210 connector also has BTEMP)
- Finished!!!
- Test your phone!!
If you kill your phone in anyway and made a back-up you just flash your phone with the backup flash file like described above. BUT take as start address the start address you also used for back up (00200000).

Warning: Wrong address; ****ed up phone! (it can be fixed nevertheless)

Trouble Shooting

- Run flasher from Safe mode.
- Run flasher in Full screen mode. (MUST)
- Change LPT settings to epp in your bios.
- Try different flash loaders..(can't harm your phone if boot loader is not correct it won't connect to your phone)
- You need at least 32 mb ram to make it work..(some exceptions)
- Tip: first try only reading your flash.
- Make sure your flasher interface is correct...
- If everything doesn't work try on different computers.
- Flasher must be RUN under Win98 other don't work!
- Flasher also doesn't work under DOS!!!
- Did you switch on the phone after "Loading Boot Loader... " ??
- If you have problems with reading phone (and tryed everything) you probably have AMS chip you CAN'T read but you CAN write!
- use a shell like Rolis software or nokia flash downloader, they work for me.
Know Errors

Error ONE Possible Solution
Boot init error! (Bad crc) - use other boot.bin
Flash Loader init error Tx=0 ! - Wrong Flash Loader
CMD error! - When the connector loses connection if reading/flashing
Phone NOT respond Tx=0 - If you press to hard on the connector(with 3210)
- Make sure battery is full
- Try taking battery out and put it back again
Phone NOT respond Tx=0 (Load boot data) - Take out battery and try again
- Try other boot loader
Boot init error! (Bad phone RAM) - Wrong bootloader
Erase flash error! - Wrong flash loader

Tested working solution for repairing nokia 3310 'Contact Service'

You must have original full flash. If phone has not yet been full flashed with another phone's full flash then it's very good. Check out the procedures below: Copy flash of the same phone version from Start add: 00200000 to 003d0000. First of course you must have back up of your phone's flash. Then flash this partial flash to phone. and again partial flash to unlock using the unlock partial flash with Start address: 00270000 or 00280000 whatever phone version you have.

If an partial FLS file killed your phone:

1) Found a phone as yours with the same version
2) Reda it out with F1 from 00200000 to 00300000 or if ppm is bad try till 003d0000 (also clever to backup this part before flashing)
3) rename the file to xxx.fls
4) flash your dead phone with F2 from 00200000
5) after flash your phone is back in life AND HAS ITS ORIGINAL IMEI NUMBER!!!

So this means: don't use full Flash files on the sites which start from 0020000 to 00400000, because the new imei is inside the flash (after 003d0000) and that is why the phones imei is changing and you get 4 closed lock or no network!

Best boot loader 868 bytes

Last Updated: 06/30/2002 15:43:55

Flashing your nokia

Warning!

You could damage your phone is you do something wrong! You should follow this tutorial exactly. This description was produced for research, not to harm any provider or/and their SIM-Locks. We ARE NOT responsible in ANY way for damage to your phone or violating any rules!!!

Flash tutorial

The Nokia flashing method uses the Dejan flasher as its basis. Follow the steps exactly and you will have unlocked nokia (if supported).
There are constantly comming new flash shells for easy flashing. This flasher tutorial is just an explanation on how to use the basic flasher software provided by dejan. At the moment, 30-12-2001, the program by Rolis and of course Dark flasher by Dark Lemming are one of the best out there. Members can download them all and some you can download in the free download section.
Now let's get started.

- Get the flasher interface or build one.
- Get approciate Software.
- How to use the software.
- Trouble Shooting.
(Also 100% working solution to repair nokia 3310 Contact service)

How to get the flasher interface:

You can buy one at different site's on the internet (also here just Contact me. YOU can also build one yourself. It is not hard to do, the only thing you have to do is solder....

How to build the flasher interface:

Here is a list of components:

1 Bord with SubD-port (529028-62) 3,04 Euro
1 Sub-D25 connector 90° print (741183-62) 1,07 Euro
1 Sub-D9 female or socket 90° print (741345-62) 0,89 Euro
1 IC 74HC14 OR 1 74HCT14 (Specification from Hex Schmitt inverter) (164232-62) 0,84 Euro or (150185-62) 0,64 Euro
1 resistor 4,7 kOhm (418331-62) 0,13 Euro
1 resistor 100 Ohm (418137-62) 0,13 Euro
1 condenser 0,1µf (100nF) (453099-62) 0,26 Euro
2 diodes BAT 43 or 1N4148 (153010-62) 0,33 Euro or (162218-62) 0,04 Euro

The numbers are order numbers from Conrad
Download here The flasher schema. (Hold shift to download)
Click here for flasher schematic with external volt supply.
Connections to Fbus TX und RX, GND and Mbus are needed.
NOTE: For Nokia 3210 you also need Vpp.
(Btemp is not needed, that is used to turn on phone)

Pinouts:

For every nokia you need a other connector. So if you don't want to rebuild your flasher constantly you should use a DB9 connector to connect to the connector of the phone.
Here are the pinouts for the nokia phones:
Nokia 3210:

Nokia 51xx/61xx/62xx/71xx:

Nokia 8210/8850:

Nokia 3310/3330:

--------------------------------------------------------------------------------

Get you Software

You can just use the flasher and you can use a flasher shell.
Members can login and download all software and you can find some software for download in the free download section.
If you decide to use a shell you don't have problem of configuring flasher and searching for flash files and tia files. And you don't have to know the start addresses. But if a shell is incorrupt it can kill your phone.. It is more safe to do it yourself.

Which files do you have to use: (boot, flash loaders):

There are 4 different boot loaders 808 bytes, 844 bytes, 868 bytes and 964 bytes. 964 bytes is most used. If the flasher stops loading after boot bin then take another.
The flashloader is a bit more complicated.
- Run the Flasher (.com)
- Press read phone (F 1 )

- Compare the flash id with this table:
01B5: AMD 29LV004T, size 4Mb
01B6: AMD 29LV004B, size 4Mb
04B5: Fujitsu 29LV004T, ALIAS_ID=01B5
04B6: Fujitsu 29LV004B, ALIAS_ID=01B6
1F23: Atmel 49BV080, size 8Mb
20F7: ST M28V411, ALIAS_ID=8979
20FF: ST M28V421, ALIAS_ID=8978
20DF: ST M28V841, ALIAS_ID=89A2
8978: Intel 28F004BV-T, size 4Mb
8979: Intel 28F004BV-B, size 4Mb
897C: Intel 28F002BX-T, size 2Mb Vcc=5V
897D: Intel 28F002BX-B, size 2Mb Vcc=5V
8989: Intel 28F004xx in HD821
8994: Intel 28F001BX-T, size 1Mb Vcc=5V
8995: Intel 28F001BX-B, size 1Mb Vcc=5V
8998: Intel 28F008BE-T, size 8Mb
8999: Intel 28F008BE-B, size 8Mb
89A2: Intel 28F008SA-L, size 8Mb
89A6: Intel 28F008SC-L, ALIAS_ID=89A2
000122DA: AMD 29LV800T, size 8Mb
0001225B: AMD 29LV800B, size 8Mb
000122C4: AMD 29LV160BT, size 16Mb
000422DA: Fujitsu 29LV800T, size 8Mb
0004225B: Fujitsu 29LV800B, size 8Mb
001F00A0: Atmel 49BV8192B, size 8Mb
001F00A3: Atmel 49BV8192T, size 8Mb
001F00C0: Atmel 49BV16X4B, size 16Mb
001F00C2: Atmel 49BV16X4T, size 16Mb
001F00C8: Atmel 49BV32X4B, size 32Mb
001F00C9: Atmel 49BV32X4T, size 32Mb
002000D7: ST M29W800AT, ALIAS_ID=000122DA
0020005B: ST M29W800AB, ALIAS_ID=0001225B
00200090: ST M28W160T, ALIAS_ID=00898890
00200091: ST M28W160B, ALIAS_ID=00898891
002088BA: ST M28W320CT, size 32Mb
002088BC: ST M28W320BT, ALIAS_ID=00898896
002C4492: Micron MT28F160C3-T, ALIAS_ID=008988C2
00894470: Intel 28F400Cx-T, size 4Mb
00898890: Intel 28F160B3-T, size 16Mb
00898891: Intel 28F160B3-B, size 16Mb
00898892: Intel 28F800B3-T, size 8Mb
00898893: Intel 28F800B3-B, size 8Mb
00898894: Intel 28F400B3-T, size 4Mb
00898895: Intel 28F400B3-B, size 4Mb
0089889C: Intel 28F800Cx-T, size 8Mb
008988C2: Intel 28F1602C3-T, size 16Mb
00898896: Intel 28F320B3-T, size 32Mb
008988C4: Intel 28F3204C3-T, size 48Mb
008988F3: Intel 28F160F3-T, ALIAS_ID=00898890
008988F4: Intel 28F160F3-B, ALIAS_ID=00898891
00B00048: Sharp LH28F160BVE, ALIAS_ID=00898890
00B0004A: Sharp LH28F800BG, ALIAS_ID=00898892
00B00060: Sharp LH28F800BG, ALIAS_ID=00898892
00B00061: Sharp LH28F800SX, ALIAS_ID=00898893
00B00068: Sharp LH28F160BG, ALIAS_ID=00898890
00B000D0: Sharp LH28FS16SX, ALIAS_ID=00898891
00B000E8: Sharp LRS1360, ALIAS_ID=00898891
80898896: Intel 28F320B3-T, size 32Mb
- Now you can see what chip you have and get correct tia files for it.(the filename of the loader uses nearly the same name as the chip)
- Then rename the *.tia File (your Flashloader) to f_loader.bin
copy it to C:nk_files

For example:

Your flash id is: 00898890 (this one is from a 3310; not only 3310) - So you have a 28F160B3-T, size 16Mb Chip.
Then look for a *.tia file which name is nearly: 28F160B3-T
iw28f016.tia is the correct tia file (FlashLoader)
Note: You probably have to patch the F-loader to read correct. And Sometimes you can't write with patched Flash loader. Members can downlaod patched and non-patched loaders.
Note*:This method does not always work(in practice) if it doesn't work for you then you will have to try all Flash loaders (and combinations with boot loaders)

--------------------------------------------------------------------------------

Now Let's start the real work!
First we are going to make a back-up!! Very important!!
First make sure that you parallel port setting are correct (printer port) This must be set to epp+ecp (or just epp; I use epp) in your bios!
- Connect the nokia flasher interface with you printer port and to your mobile phone.
- Phone MUST be off!
- Go to C:flasher and start flasher.com / Press ALT+ENTER for FULL SCREEN

For back-up we press F1
Choose the type of your mobile phone and then press enter.
A new window will open (on the right)... there you'll have to put in the start-address and the end-address. Look at the table bellow for the CORRECT addresses (This is important).
Older phones have 00200000 - 00400000 (2 mb) and newer phones have 00200000 - 00600000 (4 mb) just ask in the Forum if you're not sure.

Press Enter and press short on the on/off switch of your mobile phone
THE PHONE MUST NOT TURN ON!! if so you are doing something wrong.
(Don't press to long on the 'on' button)
After the program has finished (sometimes it look if it hangs but just wait..) you can find a file flash.out in c:flasher rename that file to your_type+softversion.fls
(e.g. nok3210_536.fls)
Store the file very very securely!

--------------------------------------------------------------------------------

Now let's do the flashing part (the unlocking)
- First download the partial flash files from the archive.
- Copy ONLY the needed fls file in c:nk_files
- The filenames consist of typ + version.fls (for correct version for your phone press *#0000#)
- Start flasher.com
- Now press F2 and choose your type.. then press Enter.
- Choose the correct fls file.
- NOW Something VERY important! Type in the CORRECT start address!!
Type Flash file Start address
3210 3210_5.31.fls, 3210_5.36.fls, 3210_6.00.fls 00260000
3310 3310_3.24.fls, 3310_4.02.fls, 4.35 00270000
3310_4.06.fls, 3310_4.18.fls, 3310_4.19.fls, 3310_4.45.fls 00280000
51xx 5110_5.28.fls, 5110_5.29.fls, 5110_5.30.fls, 5130_5.71.fls 00250000
6150 6150_5.22.fls, 6150_5.23.fls 00270000
6210/ (6250 4.01, 4.04, 4.05, 5.00) 6210_3.01.fls, 6210_3.04.fls, 6210_3.74.fls, 6210_4.08.fls, 6210_4.27.fls, 4.36, 5.01, 5.02,5.17 00380000
7110 7110_4.88.fls, 7110_5.00.fls, 7110_5.01.fls 003A0000
7110 7110_4.94 003B0000
8210 8210_5.11.fls, 8210_5.16.fls, 8210_5.20.fls, 8210_5.21.fls, 8210_5.25.fls, 8210_5.26.fls, 5.27, 5.28 00280000
8850 8850_5.11.fls, 8850_5.16.fls, 8850_5.20.fls, 8850_5.21.fls, 8850_5.25.fls, 8850_5.26.fls, 5.27, 5.28 00280000

- Now press Enter again. (make sure you have the good one)
- Again Enter
- Again press the on/off switch shortly. (AGAIN the phone may NOT turn on)(NOT needed if your 3210 connector also has BTEMP)
- Finished!!!
- Test your phone!!
If you kill your phone in anyway and made a back-up you just flash your phone with the backup flash file like described above. BUT take as start address the start address you also used for back up (00200000).

Warning: Wrong address; ****ed up phone! (it can be fixed nevertheless)

Trouble Shooting

- Run flasher from Safe mode.
- Run flasher in Full screen mode. (MUST)
- Change LPT settings to epp in your bios.
- Try different flash loaders..(can't harm your phone if boot loader is not correct it won't connect to your phone)
- You need at least 32 mb ram to make it work..(some exceptions)
- Tip: first try only reading your flash.
- Make sure your flasher interface is correct...
- If everything doesn't work try on different computers.
- Flasher must be RUN under Win98 other don't work!
- Flasher also doesn't work under DOS!!!
- Did you switch on the phone after "Loading Boot Loader... " ??
- If you have problems with reading phone (and tryed everything) you probably have AMS chip you CAN'T read but you CAN write!
- use a shell like Rolis software or nokia flash downloader, they work for me.

Know Errors

Error ONE Possible Solution
Boot init error! (Bad crc) - use other boot.bin
Flash Loader init error Tx=0 ! - Wrong Flash Loader
CMD error! - When the connector loses connection if reading/flashing
Phone NOT respond Tx=0 - If you press to hard on the connector(with 3210)
- Make sure battery is full
- Try taking battery out and put it back again
Phone NOT respond Tx=0 (Load boot data) - Take out battery and try again
- Try other boot loader
Boot init error! (Bad phone RAM) - Wrong bootloader
Erase flash error! - Wrong flash loader

Tested working solution for repairing nokia 3310 'Contact Service'

You must have original full flash. If phone has not yet been full flashed with another phone's full flash then it's very good. Check out the procedures below: Copy flash of the same phone version from Start add: 00200000 to 003d0000. First of course you must have back up of your phone's flash. Then flash this partial flash to phone. and again partial flash to unlock using the unlock partial flash with Start address: 00270000 or 00280000 whatever phone version you have.

If an partial FLS file killed your phone:

1) Found a phone as yours with the same version
2) Reda it out with F1 from 00200000 to 00300000 or if ppm is bad try till 003d0000 (also clever to backup this part before flashing)
3) rename the file to xxx.fls
4) flash your dead phone with F2 from 00200000
5) after flash your phone is back in life AND HAS ITS ORIGINAL IMEI NUMBER!!!

So this means: don't use full Flash files on the sites which start from 0020000 to 00400000, because the new imei is inside the flash (after 003d0000) and that is why the phones imei is changing and you get 4 closed lock or no network!

Best boot loader 868 bytes
Info from Arasharash.

Things I heard around the web that could be useful:
Don't always trust this because It could be a headspin from somebody
And he/she is afraid to try it himself so he tells and let other people try:

74HC14 is CMOS IC which is sensitive to static electricity. If unused inverters have open inputs, this can be reason for damage IC. You must blocked inputs of unused inverters. Simply way is:
short circuit pins 12 -11 and 10-9. I suggest add. electrolytic capacitor 4.7 mF in parallel with
100nF and resistor 4.7K HC family IC have operating range 2 - 6V. =Lord=

According to my experineces, all you need is a stable Vpp voltage for flashing. I had the same problem, and the Vpp was wrong attached. With some Tia's it was possible to read, but result was 00 FF. Check Vpp very properly, if it's under 3V than use external power. Or maybe give some extra power. (Don't go over 5V!)