vB Easy Archive - Bell K1m firmware upgrade 2402

Pages: 1 2

Bell K1m firmware upgrade 2402_01.16.00 available
(Click here to view the original thread with full colors/images)

Posted by: Mark I

Hello all,

Just updated my Bell K1m via Motorola Software Update. Not sure if this flash can be used by anyone perhaps someone who's knowledgeable can verify it. The update adds a lot of missing features to the original Bell software including most data services (MMS, web, etc..) it also adds Java for games/apps.

Here's the link: http://www.megaupload.com/?d=9VKQK0RJ

Posted by: null1281

Well we know you can use a bell upgrade flash on the original amp'd e816...in theory if someone has an amp'd k1m there is only an 85-95% chance it will brick their phone

Still exciting though, but I'm hoping and praying we actually find a bell monster for any krzr or razr, or at least a telus one.

Posted by: bushe

hmmm I really want to try this out I wonder if it will work with my VIVO flash or if the bootloader is still really different on the bell phones.

Posted by: kbman

Oh boy...been waiting for this to show up! Congrats and thanks!

Could be the start of another 2000 post thread and a lot of frustration...let's hope not.

We know so much more now though the same obstacles may still apply.

Who's first?

Posted by: bushe

is there anyway to take a look at the flash and see if it will be compatable, or even look to give me some confidence in the flash. I will be willing to try but I am worried as it has a flash and a flex and i dont know much about flexes. Am I suppose to somehow do them at the same time of do them one after the other and if so which on first.

Posted by: kbman

The fact that it contains a flex as well as a flash is actually very good news. It may contain critical file system elements that the firmware doesn't write by itself. This was one of the suspected issues with the original Bell e815 upgrade file, although the problems have since been determined to be bootloader related. Nonetheless, the flex may provide additional functionality. I briefly took a glance at both file and, no, there really is no way superficially to determine if the flash will brick your phone.

I would suggest waiting for a bit to see what further examination reveals.

I don't have Motokit loaded on this partition to split the flex with so I'll have to wait till I get more time.

Posted by: bushe

Ok i got antsy and firgured I would just bite the bullet and give it a try and well IT WORKED now just have to run through and try to get everything working. Flashed from VIVO to Bell. I can proudly say that i have the first VZW k1m running Bell Firmware.

Posted by: luiset83

Quote:

Originally Posted by bushe

Ok i got antsy and firgured I would just bite the bullet and give it a try and well IT WORKED now just have to run through and try to get everything working. Flashed from VIVO to Bell. I can proudly say that i have the first VZW k1m running Bell Firmware.

Excellent news... just when I sold my L7c, too.

I wonder if this Bell flash exhibits the same authentication issues as the Bell E815 does... If it doesn't, it would truly turn a K1m or L7c into one heck of an amazing phone.

Posted by: jlbrightbill

edit: Looks like bushe beat my analysis to press time. Don't bother applying the flex as all it will likely do is further mess up your data settings.

-----

RAM DL version is the same on this file as the Alltel 26.08 and .11 firmwares, as well as every other Moto UI firmware I checked. The RAM DL also checks out to be identical using Radiocomm's Flash App, this includes both size and checksum.

Mark I, if you don't mind loading the phone up in RSD Lite and checking the bootloader version, that would be a big help. Those of you running Alltel's K1m firmware should do likewise, I'm fairly sure they'll be the same since the RAM DL is identical, but it's best to be safe.

The flex only writes seems, I extracted them and stuck them in a zip for your viewing pleasure:

http://rapidshare.com/files/3138275...m_Seem_Flex.zip

Posted by: griesr

this does not work on a verizon v3m and yes i know this was meant for a k1m but i felt lucky and said what the heck.....

The good news is that i was able to recover with the verizon v3m monster file....

I hope this works on a regular k1m! Happy Hacking!

Posted by: Aixelsyd

Quote:

Originally Posted by luiset83

Excellent news... just when I sold my L7c, too.

I wonder if this Bell flash exhibits the same authentication issues as the Bell E815 does... If it doesn't, it would truly turn a K1m or L7c into one heck of an amazing phone.

Dam, I was hoping you were going to see this and maybe flash your l7c using it. I'll agree with you that would be one nice setup if it all worked out right. Worse part is I just had a chance to buy a l7c over the weekend for cheap and I passed on it.

Posted by: fxnsht

Flashing an alltel 00.26.11P right now.
feeling lucky

Edit: Flashed. rebooted. activation fails so far.
Edit2: updated Preferred Roaming List. (same one from Alltel flash). dialed *228 opt 1 - Activation successful. Now i can make and receive phone calls.

Will see about the rest.

Today is a good day...

Edit3: text messaging works.. i was trying t oget on the web - got a hostname error, but now i'm trying to get into #073887* and the 000000 password doesn't work.

Any ideas ?

Posted by: griesr

Do u have java?????!!!!!!

Posted by: griesr

As far as your SPC Try this:

Quote:

Originally Posted by CQD-dude

The Razr ask for 2 codes, the Security code THEN the lock code.

1- Power-up the device.
2- Enter: # 0 7 3 8 8 7 * (you will have to press those buttons quickly one after the other or you will have to start over)
3- The following menu will appear:

-----------------------
Enter Security
Code:

______
--------------------

4- This is NOT THE LOCK CODE. Instead enter 2 3 6 1 9 7 then press the central button. The following menu will appear:

-------------------
Programming Me…

Web Sessions
Browser Reset
User Activation
etc…
------------------

5- Select 'User Activation' then press the central button. The following menu will appear:

-----------------
Enrer Subsidy
Password:

______
-----------------

6- Enter the lock code then press the central button.

Posted by: corys00

OMG, I just sold my black krzr on ebay!

Posted by: fxnsht

Quote:

Originally Posted by griesr

Do u have java?????!!!!!!

Java -> games and apps ->

Tetris demo - working
Super KO Boxing - working
Midnight Pool - working

All of those were there by default, i didn't install any games/apps yet.

Posted by: fxnsht

Quote:

Originally Posted by griesr

As far as your SPC Try this:

Thanks a lot - worked like a charm.

Web sessions are for Bell - got to get rid of 'em and install VZW. will do in a bit.

Posted by: Aixelsyd

Mark I, question would you happen to know anyone who has a v3c from Bell that could check MSU to see if there is a Bell upgrade flash for the it possibly. If this file does work out I'm sure there would be numerous folks interested in a Bell v3c flash file specially if it has Java enable on it.

Posted by: kbman

No upgrade for the v3c. This was a much publicized upgrade.

Posted by: griesr

FXNSHT: Did you use the flex after you flashed bell?

Posted by: fxnsht

Quote:

Originally Posted by griesr

FXNSHT: Did you use the flex after you flashed bell?

Well, this is gonna sound funny, but what is Flex?
there were two files inside the RAR. i ran the _01.hs first, then _02.shx file using RSD Lite 2.7
then after updating the PRL, i did *228 opt 1, and opt 2

Does this answer your question?

Posted by: griesr

The hs file you ran first was the flex.
ok so you flexed first then you flashed....
hmmm interesting....

Posted by: InfinitiProject

If this really works on VZW K1m, then this is really cool!

I got a few questions though

Will this upgrade work on .19 Alltel FW? Or will I have to downgrade to .11? And if we have to do that, should the fixes & such be applied first?
Do we still follow the steps on Mark_Venture's VZW to Alltel tutorial?
What's new/different between this FW and Alltel's besides Java?

I really want to flash with this FW mainly because of Java but don't want to risk bricking my only phone a second time and hoping that I can get another under warranty

EDIT: I ran RSD Lite 3.2 and this is what I have under Bootloader & DRM

Bootloader: N/A
DRM: N/A

Posted by: InfinitiProject

Well I went for it and flashed to Bell and Java is in the menu. I haven't tried the flex but will in a few minutes

Posted by: jlbrightbill

All the flex will do is overwrite system and data seems to values you'll have to fix later. It's just seems, no filesystem, take a look at the zip I posted further up. There's no need to use it.

Posted by: InfinitiProject

Dangit I wish I read in more detail before I done it...

Gonna follow Mark_Venture's tutorial again to see what the outcome is

Posted by: Mark I

I've installed both Google Maps and Opera Mini directly through the Openwave browser with no problems except the network access nag screens. I've looked at and tried to modify the selector.utf that's present with this new Java environment and although all the applications are listed as "untrusted" any attempts I've made to change them to "trusted" result in a blank Java menu.

Attempts to install Java games via Rumkin have been successful as well.

Had to redo some seem edits (camera sound, pixplace selecting, etc..) and so far they all work. Changed both SPC code and subsidy code to 000000. Sucessfully sent pics to thephonecam.com

jlbrightbill: sorry I don't have RSDLite installed to check the bootloader right now.

Posted by: MadBrad

Anyone get verizon mms or web browser to work on the bell firmware? I tried setting all of the web sessions and mms settings the correct way, and also followed the steps at http://mark.cdmaforums.com/Monster2.htm , but I can't seem to be able to get mms or internet working. Anyone else figure it out?

Posted by: bushe

I have been trying even doing a fresh Verizon(backup) then Alltel->Bell and restoring everything but cant get mms or mobile web to work.

How are people installing Java Apps on this phone i dont know much about it because I have never had a Java enable phone besides my E*!% that i gave away before i could use it with Java.

Posted by: griesr

what JSRs does the new environment have?

Posted by: szale1986

Anyone tried flashing directly from the VZW Firmware yet?

Posted by: Stephen Soulsby

Quote:

Originally Posted by szale1986

Anyone tried flashing directly from the VZW Firmware yet?

I wouldn't. When the first update flash was made available it would brick the phones. It was thought that this was caused by Verizon removing all traces of the Motorola UI on the KRZR.

Posted by: szale1986

Good call, so basically flash from Alltel or VIVO. Also anyone able to determine if the delivery confirmation bug is an issue here?

Posted by: suzook

so i can use the bell flash on my vzw k1m that is flashed to alltel?

Posted by: luiset83

Quote:

Originally Posted by suzook

so i can use the bell flash on my vzw k1m that is flashed to alltel?

that's the only suggested route (or from vivo) basically not from the vzw firmware..

Posted by: suzook

i cannot f'ing believe this!!!!, i now have java working on my vzw k1m. i just flashed from my alltel flashed vzw k1m. all my contacts, wallpapers, photos, and ringers are still intact. my number hasnt changed, and my sms and mms settings are the same. this was the easiest upgrade i have ever done. thanks so much for the file poster. my k1m is NOW complete.

Posted by: Stephen Soulsby

Can you tether with this Bell firmware?

Posted by: bushe

Quote:

Originally Posted by suzook

i cannot f'ing believe this!!!!, i now have java working on my vzw k1m. i just flashed from my alltel flashed vzw k1m. all my contacts, wallpapers, photos, and ringers are still intact. my number hasnt changed, and my sms and mms settings are the same. this was the easiest upgrade i have ever done. thanks so much for the file poster. my k1m is NOW complete.

You can still send mms? can you also access mobile web?

Posted by: null1281

Quote:

Originally Posted by bushe

You can still send mms? can you also access mobile web?

Have you tried reprovisioning your data?

Posted by: daveyp225

A little late to chime in, but I'm happy that I'll get to join this party soon. I just bought a k1m off eBay on Sunday, should be here soon. Good timing I'd say

Posted by: !-OMAR-!

tried it on my vivo k1m works amazing what did i tell you guys as soon as the bell firmware is leaked itil be the ultimate firmware because its purpose is to enable java

Posted by: !-OMAR-!

oh and just so ppl dont go cazy the java system is different i will post who wants to be a millionare (a java game that works with this system) in a bit

Posted by: kbman

A couple questions remain before it can be declared"the ultimate firmware" but it's certainly nice not to start out with a string of hosed phones right off the bat!

Has anyone looked at the MIP profile in QPST?

If everyone who has done this is going from the Alltel configuration with the secondary profile, is that preserved and is it required for data to function?

I would think not, going from the Bell e815 example but it wasn't required for the e815 Alltel conversion either so it may be in the case of the K1m.

Anyone pulled all the data authentication seems yet to see what they contain?

We may assume nvm directory access is locked like other K1ms?

Has anyone looked at the mma_ucp and dcp files yet?

It's very promising but there's lot's to be done yet...

Posted by: !-OMAR-!

wow im surprised bell came out with this firmware a lot is enabled i was expecting bluetooth obex disabled, mpt disabled, etc im happy with this firmware i get to use telus mobile tv, xm satlelite radio, and navagator again

Posted by: bushe

Quote:

Originally Posted by kbman

A couple questions remain before it can be declared"the ultimate firmware" but it's certainly nice not to start out with a string of hosed phones right off the bat!

the M.I.P profile in QPST is protected and wont change like in the Alltel firmware. Unlike the VIVO frimware were you could edited the 0 profile and change it to verizon for less of a hassle.

The nvm directory is still protected just like the other k1m's

I have glanced at the mma_ucp and oddly its blank? or maybe i am just doing something wrong. but when i put my own custom mma_ucp everything works and when i goto Get it Now it bring up the java menu.

From what I can see the firmware is closely related to the Alltel firmware and alot less close to the vivo firmware.

Posted by: !-OMAR-!

yeah except java enabled its basicly telus firmware with more features telus firmware is based on altel firmware vivo and altel firmware are basicly the same but vivo firmware for the k1m got made first since Vivo launched the phone before altel

Posted by: InfinitiProject

Mobile Web is not working here. I get "authentication failed" each time I try to run it. Tried to enter my HA & AAA keys which has always worked after I flashed but for some reason they won't stick.

MMS Messaging also isn't working. Gets stuck at 0% when trying to send a message to myself & others.

Data Connection under Menu > Settings > Security doesn't show up even after seem edits

A lot of other seem edits seem to not work either. Maybe because I flashed the flex to it?

Posted by: suzook

we need to figure out how to format java games to work on this phone. it is different

Posted by: !-OMAR-!

yep it is different at least bell puts some demo apps

Posted by: !-OMAR-!

k wtf !
whats the security code my phone wont stop switching to evdo and back to 1x i want to force 1x but i need the security code 000000 didnt work 183729 didnt work either

Posted by: luiset83

Quote:

Originally Posted by !-OMAR-!

whats the security code

*coughs* on this same same thread too...
http://howardforums.com/showpost.ph...56&postcount=14

Posted by: griesr

can i flash directly from vzw or do i need to flash alltel or vivo first?

Posted by: luiset83

Quote:

Originally Posted by griesr

can i flash directly from vzw or do i need to flash alltel or vivo first?

i thought i answered this already... unless you want a possible brick, flash to either alltel or vivo first... you've been warned.

Posted by: griesr

ok ok.... btw what JSRs are loaded in this new fw

Posted by: caifan805

Quote:

Originally Posted by suzook

So you did the flash and not the flex, right? Does this mean you can use MMS (send and receive), WAP, and GIN without reapplying all the fixes?

Posted by: InfinitiProject

On my K1m:

MMS send status sticks at 0%
WAP Browser gives "authentcation faled"
There is no Get-It-Now option in the menus. Who needs that when Java's supported in the firmware

You can't write nor read your ERI to/from the phone. PST 7.2.5 says it's not supported.

You can't write your HA & AAA shared keys with QPST because 't's locked. I mean, you can but it won't go into effect on the phone.

Some seem edits that you can use on the Alltel firmware have no effect on the Bell firmware (ex. Enable "Data Connection" under Menu > Settings > Security)

I flashed back to Alltel .11, applied the fixes, and everything's working perfectly with ths FW.

I suggest waiting until more is discovered with this FW

Posted by: suzook

we need to figure out how to edit java games to work on this phone. if we cant, it negates the positive of the flash.

Posted by: luiset83

Quote:

Originally Posted by InfinitiProject

On my K1m:

MMS send status sticks at 0%
WAP Browser gives "authentcation faled"
There is no Get-It-Now option in the menus. Who needs that when Java's supported in the firmware

Based on what you said, this flash seems to behave similar to the Bell E815 flash... which means that tethered NAI won't stick -- aka no tethering possible, but you can force a data reset by calling VZW CS, and that should get MMS and Mobile Web working again @ EVDO speeds. There should be no need to create a second MIP, if this is the case.

More feedback is needed from other users.

Posted by: Mark_Venture

If I'm reading this thread correctly....

1. Flashing this over the Vivo or Alltel firmware works, flashing over the Verizon firmware doesn't?

2. Java is enabled, and working, but different than the Bell E815, so a different process to load games/apps must be found.

3. Because of Java, there is obviously no BREW/Get-it-Now, so no VZNav

4. BT Obex File Transfers work, as does MPT with MultiMedia Studio capabilities.. no Hacks required...

4a... What about OPP?

5. Phone calls and Text messaging works..

6. mentions of not being able to edit the M.IP in qpst, and the NVM folder being locked implies no tethering. Is that correct?

Lastly... I can't make out.. does MMS and Mobile Web work? If it doesn't.. has anyone tried the steps used when converting a AMP'd E816 or Verizon E815 to Bell's firmware? see -> http://motorola.szczuka.org/Hollywood_VZW_Bell.html and/or -> http://mark.cdmaforums.com/Vzw-Bell.htm or at least KBMAN's Bell MMS tutorial -> http://mark.cdmaforums.com/MMS_Tutorial.htm

Posted by: JakeE

For those trying the java games, are you using the e815 or V3 formatted games? Try to look for KRZR K1 java games. They might work better because they lack the middle button.

Posted by: timothyjay2004

Quote:

Originally Posted by Mark_Venture

If I'm reading this thread correctly....

1. Flashing this over the Vivo or Alltel firmware works, flashing over the Verizon firmware doesn't?

From what I've read here, yes that is correct.

Quote:

Originally Posted by Mark_Venture

3. Because of Java, there is obviously no BREW/Get-it-Now, so no VZNav

I see this as a good thing yet bad thing at the same time. Good, that you can get free apps, such as Google Maps, to use instead of paying vzw for vznav. But bad in that people who want to be able to use brew related things, such as vcast or other games or something, will no longer be able to.

None the less, pretty neat find. Kinda wish I bought the k1m now instead of v3m on ebay... lol.

Posted by: suzook

Quote:

Originally Posted by JakeE

For those trying the java games, are you using the e815 or V3 formatted games? Try to look for KRZR K1 java games. They might work better because they lack the middle button.

thats not the problem. the problem lies in the format of the java files on the krzr are different. there are no.jar files, they are.jah files. there is also some other file that is not present on all other java files. i am wondering if someone can come up with some sort of krzr java game editor to make all the existing java games work. are there any java experts out there?

Posted by: luiset83

Quote:

Originally Posted by suzook

I read earlier on this same thread that another user managed to download Java games over-the-air. This was my preferred method as well when I had the E816 flashed to Bell. I used the Freebie proxy linked in the Free WAP thread, along with the Rumkin Java Midlet uploader found here: http://rumkin.com/tools/sprint/

Try that. Also, it isn't much work to duplicate the format of the already existing demo apps, I'm sure...

Posted by: Mark I

Quote:

Originally Posted by Mark_Venture

If I'm reading this thread correctly....

2. Java is enabled, and working, but different than the Bell E815, so a different process to load games/apps must be found.

Yes, the Java environment on this handset is "Esmertc Jbed - Jbed FastBCC Build ID: Apr 02 2007"

Quote:

4. BT Obex File Transfers work, as does MPT with MultiMedia Studio capabilities.. no Hacks required...

4a... What about OPP?

Yes and yes.

Posted by: bushe

Is anyone else having the problem where the front LCD doesn't turn off and drains that battery like crazy?

Posted by: griesr

I figured out how to put java apps on to this new java system...

Here is what you do: put your raw jar and jad files into /brew/mod/jbed/preinstall and the phone will put them in the correct areas upon launching the java app manager.

This will actually put the java programs into the format of the ones already preinstalled!!!

Posted by: griesr

it is also very important that you do not change the file extention of the jad file or it will not compile...

Posted by: fxnsht

Nice. it works...
now... how do you UN-install?

Posted by: griesr

not sure....

Posted by: kbman

On the e815, java apps can be deleted from the menu in the phone.

Posted by: MadBrad

Quote:

Originally Posted by fxnsht

Nice. it works...
now... how do you UN-install?

To uninstall I have been using BrewSelectorEditor to edit the selector.utf to remove the games that I don't want. Then upload the new selector.utf to the brew/mod/jbed/Installed folder and also remove the files for the game in that folder. You can find out which files are for the game you are removing when you first use BrewSelectorEditor. It's kind of annoying but it works and seems like the only way I could find to uninstall stuff. I just wish I could figure out how to get mms or mobile web working.

Posted by: InfinitiProject

I'm going to flash to bell again to see if the e815 VZW to Bell method works or not

Posted by: suzook

Quote:

Originally Posted by griesr

I figured out how to put java apps on to this new java system...

Here is what you do: put your raw jar and jad files into /brew/mod/jbed/preinstall and the phone will put them in the correct areas upon launching the java app manager.

This will actually put the java programs into the format of the ones already preinstalled!!!

you rock!!! it works. thanks alot.

Posted by: griesr

anyone have access to wap (vzw or 3rd party) using this new flash

Posted by: !-OMAR-!

Quote:

Originally Posted by griesr

OMG ru joking wow telus ppl never even figred that out and you did already congrats man

Posted by: griesr

Quote:

Originally Posted by !-OMAR-!

OMG ru joking wow telus ppl never even figred that out and you did already congrats man

Never underestimate a person who hates BREW as much as i do.... LOL

Posted by: !-OMAR-!

lool
i told the people in the telus forum
if someone from verizon had ths phone we'd get java working
in a day guess i was right
just some questions while doing the flash
did you guys
keep evdo settings, data settings, etc?

Posted by: griesr

im still having trouble with data but java and bt works

Posted by: Mark I

Benchmarked with SPMark06

MIDP: v2.0
Other J2ME Profiles: none
CLDC: v1.1
J2ME Platform: Jbed-FastBCC
3D API: Not Supported
Multimedia API: v1.1
Bluetooth API (JSR-82): Not Supported
PIM API (JSR-75): v1.0
File Access API (JSR-75): Not Supported

Posted by: InfinitiProject

Web browser, MMS still not working.

Installed a few apps including Opera Mini to see if that works with mobile web but no go

Posted by: !-OMAR-!

hey can someone post there orginal selector.utf file

Posted by: griesr

mark i are you using bell's mobile web or your own to access the internet?

Posted by: Mark I

I'm using Bell's mobile web and have both the Openwave browser working and Opera Mini working. This wasn't possible with my E815, I used to have to use a free proxy to get Opera working. I haven't had a chance to play with websessions yet or log what's being transferred with HoTTProy.

When I asked about the update a few months back at a Bell World store they said it was delayed because they were working on a security-hash issue. I know Bell is more like Sprint with the way they have their data services set up so perhaps that may be harder to get working on VZW.

Posted by: richardrblc

if anyone is interested it works on the slvr i have as well just cant get data quite right but still working on it

Posted by: !-OMAR-!

Quote:

Originally Posted by Mark I

I'm using Bell's mobile web and have both the Openwave browser working and Opera Mini working. This wasn't possible with my E815, I used to have to use a free proxy to get Opera working. I haven't had a chance to play with websessions yet or log what's being transferred with HoTTProy.

When I asked about the update a few months back at a Bell World store they said it was delayed because they were working on a security-hash issue. I know Bell is more like Sprint with the way they have their data services set up so perhaps that may be harder to get working on VZW.

they seriously told you that, they have like 20 reasons why this firmeware was delayed somehow i think moto never got the firmware done intime for bells holiday launch so they just decided to release it later, i think maybe telus met with motorola first so they got their firmware first, but your reason sounds right but looking at this firmware it looks like bell is using the same authorization that telus uses. I had this same problem with vivo firmware but i applied some seem edits and web worked. Something just clicked wouldn't the sprint flash work after flashing to bell? since the bell firmware is already java enabled.

Posted by: griesr

omar what seem edits exactly

Posted by: !-OMAR-!

Offset 006A, bit 3 checked to Enable the Menu: Security > Data Connection (didn't work though)
Offset 0073, bit 5 & 7 unchecked
Offset 0094, bit 7 unchecked
all my settings in 1x worked after this

Posted by: jlbrightbill

Sprint's firmware is awful, not even worth considering.

Posted by: InfinitiProject

Quote:

Originally Posted by !-OMAR-!

Offset 006A, bit 3 checked to Enable the Menu: Security > Data Connection (didn't work though)
Offset 0073, bit 5 & 7 unchecked
Offset 0094, bit 7 unchecked
all my settings in 1x worked after this

Data & MMS works on 1X?

Posted by: fxnsht

Hmm,
After flipping 006A ON i got "authentication failed"
after flipping it to OFF i got "can't resolve hostname"
Both times in 1X...

Posted by: !-OMAR-!

weird i started to get those messages now wtf ! bell and telus r suppost to be the same uggh
the funny thing is all i use is texting, calling and sometimes data

Posted by: kbman

I think it's time to do a much closer examination of the data authentication seems.

The ones in the flex definitely have values different from both VZW and the Bell e815 from a brief look at them.

Somebody has to manually pull all the data related seems and compare them as well as looking at 2742 and 275a.

Posted by: fxnsht

let me know if i can do anything...

Posted by: bushe

Ok well no matter what I do I can't get MMS or Mobile Web to work. I have tried doing a fresh VZW > Alltel > Bell then applying all the fixes, and also Tried VZW > Alltel apply fixes then Bell, and VZW > Alltel apply fixes > bell then apply fixes again but no matter what I do I cant get any data services working. I also tried it with VIVO instead of alltel but still no luck.

Mobile Web will either get a Auth Failed or Hostname not avail

MMS just gets stuck at 0%

Posted by: daveyp225

Quote:

Originally Posted by bushe

Ok well no matter what I do I can't get MMS or Mobile Web to work. I have tried doing a fresh VZW > Alltel > Bell then applying all the fixes, and also Tried VZW > Alltel apply fixes then Bell, and VZW > Alltel apply fixes > bell then apply fixes again but no matter what I do I cant get any data services working. I also tried it with VIVO instead of alltel but still no luck.

Mobile Web will either get a Auth Failed or Hostname not avail

MMS just gets stuck at 0%

You could flash it back to VZW, call CS and play dumb, they'll tell you manually what numbers to put where. If that doesn't work, bring it to a corp store.

Posted by: bushe

Quote:

Originally Posted by daveyp225

You could flash it back to VZW, call CS and play dumb, they'll tell you manually what numbers to put where. If that doesn't work, bring it to a corp store.

No I can get everything working in Verizon or Alltel or VIVO but I am having a 0 success rate with the bell firmware.

Posted by: !-OMAR-!

bell doesnt use automated activation like verizon, altel, would that make a difference?

Posted by: bushe

I don't know but I have sucessfully sent one MMS message but that was it now it doesn't work again. I was doing some small edits in the 275a and I can now get the Web Browser go Connecting..., Sending.., Recieving..., but right when recieving appears I get a Auth Failed but the only thing is that it is different than the one I was getting before this one shows up in the browser instead of in a small pop-up.

Ok well while typing the above message I recieved and MMS message from myself and I was able to send one more message but now cant send them again this is just too weird.

*Edit* Ok so i was thinking to fast and not testing everything so MMS does work but only in 1X mode but mobile web doesn't work at all in 1X or EV

Posted by: lazarus

i will be recieving my krazr soon (hopefully tomorrow) i will flash to alltel to get rid of the vzw ui but i was also considering the bell flash has anyone that is running their own hottproxy looked at what the phone sends when you try to access wap? does it send your info that you put in the username password fields or does it do like the E815 bell flash and send your esn and a really long hex stream as your password? this would help to understand what is going on if it sends your esn as your username then this flash appears to have the same issue the bell e815 has which means you can't use VZW's proxy you will have to use a free proxy for wap. also if i understand correctly no one can get the "data connection" menu to appear in the security section under intial setup? If we could get that menu then we could also see if this flash exhibits the same data authentication problems as the E815 flash. So if no one who has flashed has hottproxy then as soon as i get mine i will flash and see what the phone is sending for username and password.

Posted by: InfinitiProject

Wirelessly posted (Motorola KRZR K1m: MOT-24.0_/00.62 UP.Browser/6.2.3.4.c.1.115 (GUI) MMP/2.0)

I flashed back to alltel and i'm currently browsing (and typing this post) through my hottproxy setup. how do i find out what's being sent through where? i'm willing to flash to bell yet again to help in the process of getting that firmware working correctly for us vzw users :-)

Posted by: lazarus

Quote:

Originally Posted by InfinitiProject

Wirelessly posted (Motorola KRZR K1m: MOT-24.0_/00.62 UP.Browser/6.2.3.4.c.1.115 (GUI) MMP/2.0)

I flashed back to alltel and i'm currently browsing (and typing this post) through my hottproxy setup. how do i find out what's being sent through where? i'm willing to flash to bell yet again to help in the process of getting that firmware working correctly for us vzw users :-)

you have to go to the administration console and select the view log option the ones that are highligted in blue are usually the log in attempts if you have never cleared your log then it will be REALLY long.... but try with the bell flash on you hottproxy then check the log on your hottproxy if the username isn't what you put on your phone but is your esn then with this flash we won't be able to use the vzw proxy but mms should still work as that isn't controlled by the same log in authentication process apparently.

this is the main reason i don't use my e815 w/bell firmware java is cool but i don't use it that much and with hottproxy you can't use the wap version of gmail as your homepage so....

Posted by: szale1986

Any word on delivery confirmation texts? Do they happen just like the alltel fw.

Posted by: GP-SE

what would happen if I just flashed the flex files to my bell v3c? I only ask because on the bell v3c we have no OBEX.
also is the PRL contained in the flex?
thanks

Posted by: Lexie69x

i flashed my cricket slvr over using the software update and so far calls and text work but nuthin else works like mms, or mobile web has anyone figured out anything?

Posted by: griesr

nope. we are still trying to figure that out....

Posted by: griesr

what if someone was to pull all of the seems that are in the bell seem flex from another working k1m flash and apply them to the bell flash on a vzw phone

Posted by: GP-SE

Quote:

Originally Posted by Lexie69x

i flashed my cricket slvr over using the software update and so far calls and text work but nuthin else works like mms, or mobile web has anyone figured out anything?

u used the bell k1m firmware on ur slvr?

Posted by: kbman

The K1m and L7c firmwares are interchangeable in many cases and the Bell firmware apparently is as well.

Posted by: GP-SE

Quote:

Originally Posted by kbman

The K1m and L7c firmwares are interchangeable in many cases and the Bell firmware apparently is as well.

think i could flash my v3c with it? or the flex file part perhaps to get full bluetooth (phone to phone) or maybe even EVDO?

Posted by: Stephen Soulsby

Quote:

Originally Posted by GP-SE

think i could flash my v3c with it?

Asked and answered in a thread you started three days ago.

Posted by: kbman

Definitely not flash the K1m firmware to the V3c. I don't think that the flex in and of itself will give you EvDO, certainly not without an EvDO PRL, which is not in that flex. There are data connectivity seems and that's it. They are somewhat different than my Bell e815 default values and are definitely related to EvDO connectivity but not the whole thing. You could try it but I would back up all those seems manually first and compare them before I attempted the flex. You could even try writing them manually to test it piece by piece. They may only function when all written properly though.

These seems are meaningless or completely incompatible on VZW's network so they are only of interest to us as a factory set of configuration seems to study the difference between Bell and VZW.

Posted by: griesr

i dont think that seems pulled from the vzw k1m firmware will be of much help as far as comparing goes since they are so radically different....

Posted by: GP-SE

Quote:

Originally Posted by kbman

Definitely not flash the K1m firmware to the V3c. I don't think that the flex in and of itself will give you EvDO, certainly not without an EvDO PRL, which is not in that flex. There are data connectivity seems and that's it. They are somewhat different than my Bell e815 default values and are definitely related to EvDO connectivity but not the whole thing. You could try it but I would back up all those seems manually first and compare them before I attempted the flex. You could even try writing them manually to test it piece by piece. They may only function when all written properly though.

These seems are meaningless or completely incompatible on VZW's network so they are only of interest to us as a factory set of configuration seems to study the difference between Bell and VZW.

thanks for the reply, I wont attempt it yet because I don't want to hose this v3c.

Posted by: !-OMAR-!

Quote:

Originally Posted by GP-SE

think i could flash my v3c with it? or the flex file part perhaps to get full bluetooth (phone to phone) or maybe even EVDO?

theres already a way to get evdo look in the bell forum for a thread called telus software on bell v3c if you want full bluetooth flash your v3c with an altel upgrade flash file i did it on my friends all she lost was java and she kept everything else pics,music, etc

Posted by: daveyp225

Well I just joined the party. Let me know if theres anything I can contribute.

Posted by: luiset83

Quote:

Originally Posted by daveyp225

Well I just joined the party. Let me know if theres anything I can contribute.

I should be getting a working K1m on Saturday... so I will be trying this Bell firmware, as well. Technically I'll have two... but I need a flex cable for the other one. If anyone on the offhand has one with them, I'd like to buy it, as to not wait a week for cnn.cn or gsm4world.us, heh.

Posted by: daveyp225

Quote:

Originally Posted by luiset83

I should be getting a working K1m on Saturday... so I will be trying this Bell firmware, as well.

I saw the auction you won... I was going to bid on it but I forgot when the thing ended.

Posted by: griesr

is there a way to pull every seem off of a phone at one time?

Posted by: Phreakish

Wow, I just cought up with this thread and had to re-read it 3 times to make sure we got working Java on VZW K1m.
Congrats guys. It seems like one of those rare "right off the bet" things we haven't seen in a while.

I'll keep my eye on this thread.

Posted by: !-OMAR-!

yeah i was expecting this frimware at the end of april but moto is slow hey guys i lost usb drive funtionality when flashing to this just like the altel upgrade moto is losing it bigtime

Posted by: luiset83

Quote:

Originally Posted by !-OMAR-!

yeah i was expecting this frimware at the end of april but moto is slow hey guys i lost usb drive funtionality when flashing to this just like the altel upgrade moto is losing it bigtime

!! Wow, is all I can say if this is really the case. On the offchance that it's seem related, even I don't recall it was... try restoring 275a and 2742 from before the flash.

Posted by: griesr

its not working 100% the data and mms do not work

Posted by: !-OMAR-!

ill try that moto really sucks lately weird how my telus settings worked on the altel flash and didnt on the bell i think a telus monster pack would benefit verizon krzrs more since telus is basicly mini verizon but they dont use their crapy ui on their moto phones so thats good

Posted by: Mark I

Ran some tests with using HoTTProxy and a custom websession. Doesn't look too good.

Using Openwave browser, got "Authentication Failed" HoTTProxy didn't log anything, but the module log showed the following:

Code:

(1684) SOCKET: New connection from 206.172.XXX.XXX:32769
(1684) REQUEST: GET http://homepage/
(1684) REQUEST: Via: 1.1 HoTTProxy
(1684) REQUEST: Accept: application/vnd.phonecom.mmc-xml,
 application/vnd.wap.wmlc;type=4365, application/vnd.wap.wmlscriptc, application/vnd.wap.xhtml+xml, application/xhtml+xml;profile="http://www.wapforum.org/xhtml", image/bmp, image/gif, image/jpeg, image/png, image/vnd.wap.wbmp, image/x-up-wpng, multipart/mixed, multipart/related, text/html, text/plain, text/vnd.wap.wml;type=4365, video/mp4, video/3gpp, video/pmd, video/3gpp2, audio/imelody, audio/mid, audio/midi, audio/x-midi, audio/mp3, audio/mpeg, audio/mpeg3, audio/mpg, audio/x-mp3, audio/x-mpeg, audio/x-mpeg3, audio/x-mpg, audio/aac, audio/amr, audio/qcelp, audio/vnd.qcelp, application/motorola-mmstemplate, application/vnd.oma.drm.message, application/vnd.phonecom.mmc-wbxml, application/vnd.wap.slc, application/vnd.wap.sic, application/vnd.wap.mms-message, application/vnd.wap.multipart.alternative, application/vnd.wap.multipart.mixed, application/vnd.wap.multipart.related, application/java, application/java-archive, multipart/alternative, text/css, audio/vnd.qcelp, text/vnd.wap.sl, text/vnd.wap.si, text/vnd.sun.j2me.app-descriptor, application/vnd.oma.dd+xml
(1684) REQUEST: Accept-Charset: utf-8
(1684) REQUEST: Accept-Language: en, fr-ca
(1684) REQUEST: Host: homepage
(1684) REQUEST: User-Agent: Motorola-K1m UP.Browser/6.2.3.4.c.1.123 (GUI) MMP/2.0
(1684) REQUEST: X-Forwarded-For: 206.172.XXX.XXX
(1684) REQUEST: X-Network-Type: IS2000
(1684) REQUEST: X-Wap-Profile: "http://uaprof.bellmobilite.ca/BMC_Motorola_K1m_qualification.rdf"
(1684) RESPONSE: 407 Proxy Authentication Required
(1684) RESPONSE: Connection: close
(1684) RESPONSE: Date: Sat, 19 May 2007 17:43:45 GMT
(1684) RESPONSE: Transfer-Encoding: chunked
(1684) RESPONSE: Proxy-Authenticate: Basic realm="HoTTProxy"
(1684) RESPONSE: Server: HTTP::Proxy/0.16
(1684) SOCKET: Connection closed by the proxy
(1684) PROCESS: Served 1 requests

With the custom websession I did get Opera Mini to work, but it must have still be using the Bell servers as there was no log of me going to any sites from HoTTProxy.

It would seem that data services for now are still a mystery and are hardcoded somewhere in the Bell firmware.

Posted by: kbman

I found the Web session file template in the flash file and took a look at it.

It just has the various fields delineated and defined but not filled in, but the Password field is 52 bytes in length rather than 32 bytes for the Bell e815. So, we need to find out what it's using for that value.

Do you have verbose logging enabled for both logs? It should show up in the DOS window that User: XXXXXXXX(ESN hex) attempted login using XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX or something similar.

Posted by: Mark I

I'll double check it tonight when I'm at home but yes, I'm pretty sure I have full logging for both the program and the module.

Posted by: !-OMAR-!

but opera would work for you since your already using bell service

Posted by: fxnsht

I have a potentially stupid question.
remember not a long while ago there was a Sprint KRZR K1m Reflash which failed on vzw and/or alltel software. i recall it had some java apps. Do you think trying it now with vzw->alltel->bell software will make a difference? mabe solve data problems?

just a thought...

Posted by: !-OMAR-!

tried flashing my phone with that file didnt work

it did the same thing as other people said it showed the verizon wireless logo and just stayed like that that flash is useless plus bell and sprint use similar data authorization

Posted by: fxnsht

gotcha. thanks for trying it.

Posted by: griesr

omar did u try it on the bell f/w or on the vzw f/w?

Posted by: !-OMAR-!

i tried flashing a phone that was on the bell firmware flash then flashed it on sprint with that flash file they found earlier i figred the flash would proboly require java to be enabled before flashing and bell has java but still no dice weird how it showed a verizon logo and it was a sprint flash file

Posted by: Mark I

Well I've had some success using HoTTProxy and Opera Mini/Google Maps. It seems the phone uses the same method as the Bell E815 (ESN in hex & 32 digit password) to authenticate when using a custom websession. After creating the required username/password in HoTTProxy I was able to get maps and web pages to load. The Openwave browser refused to work though and like the E815 sent no username/password. In Opera Mini I had to change the protocol from "Socket" to "HTTP" as well when using HoTTProxy.

Posted by: GoldMembr

You should be able to get to the 1XRTT Setting menu by typing in this code ##DATA then inputting the spc code 000000 if you changed it in the seems. The 1XRTT seem doesn't work on my Telus V3c and that's how i get to it.

Posted by: hachu

While the firmware from that set won't work, you're welcome to use the "preloads" shx from that archive to install the java apps from a sprint phone.

Quote:

Originally Posted by fxnsht

I have a potentially stupid question.
remember not a long while ago there was a Sprint KRZR K1m Reflash which failed on vzw and/or alltel software. i recall it had some java apps. Do you think trying it now with vzw->alltel->bell software will make a difference? mabe solve data problems?

just a thought...

Posted by: hachu

Wow, I disappear for a couple weeks for a work deadline and I come back to see this? Congrats guys!

Though hmm.... Jbed-FastBCC? No 82 or 75? This doesn't sound like the JVM I was expecting to see. I need to do a little checking...

Quote:

Originally Posted by Mark I

Benchmarked with SPMark06

MIDP: v2.0
Other J2ME Profiles: none
CLDC: v1.1
J2ME Platform: Jbed-FastBCC
3D API: Not Supported
Multimedia API: v1.1
Bluetooth API (JSR-82): Not Supported
PIM API (JSR-75): v1.0
File Access API (JSR-75): Not Supported

Posted by: Dodge2k6

so besides the java support, is the UI the same? same fonts and stuff?

Posted by: Mark I

Quote:

Originally Posted by hachu

Wow, I disappear for a couple weeks for a work deadline and I come back to see this? Congrats guys!

Though hmm.... Jbed-FastBCC? No 82 or 75? This doesn't sound like the JVM I was expecting to see. I need to do a little checking...

Welcome back, yeah it's a neat development but the data stuff not working on VZW is a bit dissapointing.

Posted by: hachu

Aww Boo... So that explains it... I looked online at what Sprint uses and they're using QVM, which is what I was hoping the Bell/Telus K1m/V3m/L7c units would be using.

The Sprint k1m java files might not work so well since the Bell k1m jvm is missing features.

Nevertheless, it's tempting to go shopping on ebay.... Should I buy a sprint or a vzw k1m? :P

Posted by: bushe

I would have to say get a Verizon Wireless k1m just so you can help us on our goal of having another java enable Verizon Motorola phone. Plus the sprint phones might be hard to flash away from sprint if you choose too but the sprint k1m might provide some insight or help with the bell flash and its auth errors and such.

Posted by: fxnsht

Hey all,
i just noticed that when connected to MPT the display on the program shows as "Bell mobility". is it just a useless information, or does it mean that the phone has a lot more "bell" references inside?

Posted by: fxnsht

one more thing.
inside the motorola/shared/jbed folder there is internal.config file. there are these lines that are commented out:
#com.sun.midp.io.http.proxy: webcache:8080
#com.sun.midp.io.http.proxy.login: user
#com.sun.midp.io.http.proxy.password: pass

i was wondering, since guys here mentioned something about the passwords and usernames, if this is something relevant to it or not?

Sorry if i'm way off with this...

Posted by: bushe

Quote:

Originally Posted by fxnsht

one more thing.
inside the motorola/shared/jbed folder there is internal.config file. there are these lines that are commented out:
#com.sun.midp.io.http.proxy: webcache:8080
#com.sun.midp.io.http.proxy.login: user
#com.sun.midp.io.http.proxy.password: pass

i was wondering, since guys here mentioned something about the passwords and usernames, if this is something relevant to it or not?

Sorry if i'm way off with this...

I figured it wouldn't work but gave it a try anyways and well, i got the same results as i was getting before.

Posted by: TheSteve

Quote:

Originally Posted by griesr

Excellent job verifying this works with Bell firmware.
The Telus guys were not able to because it doesn't appear work on the Telus firmware. It was something tried a few months back as it was suggested to us. I am guessing it was suggested as other firmware likely supports it as well.

So why doesn't it work and what can we do to make it work.
Can someone upload the files from the motorola/shared/jbed directory in the Bell firmware, I'll compare them to the Telus files. Perhaps we can swap some files and make it work.

Posted by: hachu

What JVM does Telus k1ms use? Jbed or QVM?

Quote:

Originally Posted by TheSteve

Posted by: !-OMAR-!

k i wana make another game pack how to i convert utf files into jad?

Posted by: quentincollins

I have a Cricket SLVR on the way that I'm going to flash to Alltel and activate on VZW.

In the event that we eventually solve the data problems, as I know we will, some more basic questions bear asking:

- How is the vibrate mode?
- How is the speaker volume?

I ask these because the vibrate mode on the e815 Bell firmware was extremely weak, and the speaker volume was considerably softer than the Alltel or VZW firmwares.

Posted by: Mark I

Quote:

Originally Posted by quentincollins

- How is the vibrate mode?
- How is the speaker volume?

I had the Bell E815 and I know the vibrate mode was weaker than the VZW E815 (after the software upgrade). I don't use vibrate mode much though so I can't really tell if it's any stronger than the E815.

Speaker volume seems quite loud and clear. A friend of mine has the LG8600 and while the volume on that was louder than my K1m it was also a little distorted.

I hope you guys can get data working but I must say that I think it might be quite difficult. Has anyone who's flashed this created a custom websession, tried to load up Opera Mini and use HoTTProxy with their ESN and random 32 digit password and see if that works? Also try playing with the Opera Mini network connection setting (changing it from "socket" to "http").

I tried this, but as mentioned earlier, I'm on Bell so unfortunately my tests aren't really as helpful.

Posted by: Lexie69x

has anyone tried the sprint flash on this bell firmware?

Posted by: Null0

wow, looking forward to how this progresses...

did anyone ever try mark venture's links?

http://motorola.szczuka.org/Hollywood_VZW_Bell.html and/or -> http://mark.cdmaforums.com/Vzw-Bell.htm or at least KBMAN's Bell MMS tutorial -> http://mark.cdmaforums.com/MMS_Tutorial.htm

Posted by: id4rox

Quote:

Originally Posted by Null0

wow, looking forward to how this progresses...

did anyone ever try mark venture's links?

http://motorola.szczuka.org/Hollywood_VZW_Bell.html and/or -> http://mark.cdmaforums.com/Vzw-Bell.htm or at least KBMAN's Bell MMS tutorial -> http://mark.cdmaforums.com/MMS_Tutorial.htm

Took a glance at the last two links, and seems very useful for those who want a more detailed source of information for getting to bell. Seems like the MMS_Tutorial should be substantial help to restoring mms

Posted by: griesr

tried those... no avail...

Posted by: 0mie

So MMS isnt working on the Bell K1m? Is that correct? I didnt read the whole thread but thats my understanding from what little ive read. When I had the Bell E815, I couldnt get MMS working for the life of me and I tried EVERYTHING until it hit me and I tried something that I didnt think mattered and BAM it worked.

Posted by: bushe

I have tried but have only gotten MMS to work but only in 1X and not in EVDO but Mobile Web doesn't work in either 1X or EVDO.

Posted by: griesr

Wirelessly posted (MOT-24.1_/00.62 UP.Browser/6.2.3.4.c.1.117 (GUI) MMP/2.0)

Did you use the e815 bell guide or the monster 2 guide

Posted by: bushe

I have tried every guide I could find related to Flash whether it be the monster the Alltel wiki and all the Bell guides

Posted by: lazarus

i just got a krzr off ebay so i figured i would play around with the bell flash and i just found something that i thought was very interesting.... i went from vzw to vivo then to bell and just like the other bell flashes changing the MIP profile will not survive a reboot so just for fun i thought i would do a *228 option 1 (*22899 hasn't worked for me with the bell flash) and after the successful programming note i used qpst and pulled the service programming file and in the MIP profile i found something very interesting... you have two fields NAI and tethered NAI oddly enough after the *228 the NAI went to my MIN@alltel.net??? and the tethered NAI went to my MIN@mip.1x.bell.ca to even further the oddness(i don't think that's a real word) under the PPP config tab and the UM and AN tag selected my user id is my MIN@vzw3g.com i don't really know what to make of this.... My Krzr has never had alltel firmware on it at all only stock vzw when i got it and then vivo and bell

Posted by: Lexie69x

did anyone notice seem efits dont appear to work on the bell firmware, cuz when i flashed to alltel from cricket i wrote the cricket 2742 seem to it cuz that was the only way that my mms would work and now i tries to writw my cricket seem to the bell firmware and it made no affect to any settings as a matter of fact nuthin changed at all

Posted by: Mark I

Quote:

Originally Posted by griesr

Good job! To uninstall games/apps loaded this way you edit the selector.utf and replace "preinstalled=y" with "preinstalled=n" and then the "remove" option will be available on the phone for the app/game.

Posted by: Mark I

Quote:

Originally Posted by jlbrightbill

The flex only writes seems, I extracted them and stuck them in a zip for your viewing pleasure:

http://rapidshare.com/files/3138275...m_Seem_Flex.zip

Could this be key to figuring out the data issues on VZW? I don't know enough about the problems but using evade's seem map the seems included are as follows:

Code:

Seem Name			Seem#	Data(h)
NV_PREF_MODE_I			000A	00 04 00
NV_IMSI_ADDR_NUM_I		00D1	00 FF
NV_DATA_QNC_ENABLED_I		00F0	01
NV_DATA_SO_SET_I		00F1	02
NV_PRIMARY_DNS_I		01A7	00 00 00 00
NV_SECONDARY_DNS_I		01A8	00 00 00 00
NV_DATA_SCRM_ENABLED_I		01AD	01
NV_DS_QCMIP_I			01CB	02
NV_DS_MIP_RETRIES_I		01CC	02
NV_DS_MIP_RETRY_INT_I		01CD	04
NV_DS_MIP_PRE_RE_PRQ_TIME_I	01CE	1E
NV_DS_MIP_NUM_PROF_I		01CF	01
NV_DS_MIP_ACTIVE_PROF_I		01D0	00
NV_DS_MIP_GEN_USER_PROF_I	01D1	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 01 D3 04 00 00 01
					02 00 00 00 01 00 00 00 00 00 00 00 00 FF FF FF
					FF
NV_DS_MIP_SS_USER_PROF_I	01D2	00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00
NV_DS_MIP_QC_DRS_OPT_I		01EF	00
NV_DS_MIP_RRQ_IF_TFRK_I		02C3	01
NV_DS_MIP_ENABLE_PROF_I		02CA	01 00 00 00 00 00
NV_HDR_AN_AUTH_PASSWD_LONG_I	04A8	10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00
??				04A9	01
NV_DATA_PKT_ORIG_STR_I		012A	05 23 37 37 37 00
NV_DATA_AUTO_PACKET_DETECTION_I	012C	00
NV_ANALOG_REG_I			0013	00 00
??				27A7	24 40 FF FF 24 40 FF FF 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PPP_PASSWORD_I		038A	10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
					00
NV_PRL_ENABLED_I		0100	00 01
??				0101	(too large to include here)
NV_DATA_MDR_MODE_I		0129	03
??				0222	01
NV_HYBRID_PREF_I		0232	01
??				279A	F9
NV_DS_MIP_DMU_PKOID_I		0356	00 0A
NV_DS_MIP_DMU_MN_AUTH_I		0379	00 80 01 00
??				2797	00 00 00 00 00 00 00 00 00 00 30 01 00 00 00 00
??				2798	00 00 E7 03 E7 C3 F9 00 84 A8 00 00 00 1F 02 35
					23 01 1B 01 80 01 B3 02 09 03 01 01 AA AA AA AA
					AA 00 00 00 02 00 E7 03 E7 C3 F9 00 E7 03 63

Would modifying the data in one (or more) of these seems and possibly allow the VZW settings to stick or be changed? Sorry if it's already been explored, just trying to throw out some ideas.

Posted by: kbman

I don't think those are active values for several of those seems.

They are empty (00) values for the user name and password as well as shared secret seems.

I do believe that what needs to be done involves examining and properly editing those and perhaps other related seems.

Have you manually pulled all those seems to see what the actual Bell values are for you active, functioning data services? Those will be more informative than those values from that flex, unless I'm wrong.

You have already determined that HoTTProxy login uses the same configuration as the Bell e815,
the ESN in Hex and a 32 character random string. That string should be in 038a listed in the flex but it's 10 00 00 etc.

So, in short, yes I still think the key is in the data configuration seems, just not those posted in that flex.

Really wish I had a K1m to play with...I'm certain it can be done.

Posted by: !-OMAR-!

wait you mean you found the shared secrets on a bell e815?

Posted by: Mark I

I just pulled a few of those seems I had posted before an there's the regular 32 character string in seem 038a just like you mentioned. Then there's a different 32 character string in seem 04a8 (NV_HDR_AN_AUTH_PASSWD_LONG_I). Perhaps this is the key to getting data working (especially in EVDO mode).

Seem 01d1 contains XXXXXXXXXX@services.1x.bell.ca (XX = mobile number)
Seem 01d2 contains the ESN in hex.

Posted by: !-OMAR-!

omg bell and telus are using the same authorization
now i kno how to get evdo back on my phone
and on the telus firmware 01d1 contains the xxxxxxxxxx@microbrowser.telusmobility.com
and 01d2 contains
the esn in hex
so i guess if telus firmware was released we would have the same problems
crap thats the only seem i didnt backup

Posted by: kbman

This is definitely good news. The authentication strings should be different for 1X and EvDO so that's no surprise but the the ESN in 01d2 is.

I'll go thru my stuff and find some Bell NVM tables I have that I will send to you.
These are used by RadioComm to pull large sets of seems in one operation and can be compared side by side in the GUI.
Might help get a fuller picture of the authentication structure of your phone so we can isolate the differences.

@Omar: I have known the location of all of the authentication elements of the Bell e815 practically from the very beginning, so that's not news. It's the ability to manipulate them as required which has always been the issue and remains the fundamental problem of the Bell phones.

Posted by: null1281

Quote:

Originally Posted by Lexie69x

has anyone tried the sprint flash on this bell firmware?

I'm looking at my new Sprint k1m right now and they change ALOT it doesn't even look much like the moto ui and the yahve a ton of brew changes and a different web browser aside form the obvious data authentication issues. The bottom line is I don't think anything but a Sprint monster will get you Sprint firmware on a k1m or just buying a Sprint k1m

Posted by: Lexie69x

Quote:

Originally Posted by null1281

Really? ooh thats wach i guess im jus gon have to wait til a sprint monster us leaked or sumthin lol

Posted by: Mark I

Quote:

Originally Posted by kbman

This is definitely good news. The authentication strings should be different for 1X and EvDO so that's no surprise but the the ESN in 01d2 is.

I'll go thru my stuff and find some Bell NVM tables I have that I will send to you.
These are used by RadioComm to pull large sets of seems in one operation and can be compared side by side in the GUI.
Might help get a fuller picture of the authentication structure of your phone so we can isolate the differences.

Sounds good, I'll run the table when you send/post it.

Posted by: syikho

I know this has been stated before but I just want to confirm what has been found here.

The bell upgrade works after flashing from either Alltel or Vivo?
Mobile Web doesn't work, but there has been success using Opera Mini and HoTTProxy? Has full access been established, IE going to a website such as thephonecam.com, zedge.net and any other wap site and being able to use the features available there?
Java is enabled and a fix has been found to install programs on the phone? Is it possible to download/install java programs using Opera Mini?
Data services are not currently working? (MMS, Mobile Web, GIN, VCast)
After upgrading to the Bell FW, *228 opt 1 successfully programs the phone and doesn't cause errors? (because after Alltel flash I did *228 to see what would happen and no matter what order I did it, either after flash or after fixes, it caused errors and I would need to re-flash to get phone working properly)
Has anyone, after the Bell upgrade, tried calling CS and having their data services reset to see if this changes anything? (only way I was able to get Data working after Alltel flash)

I think those are about all i can think of, it's late and im tired. Just got my K1m about a week ago, first Moto phone, and am really excited/interested with this flashing idea. I have flashed my phone from VZW to Alltel and back again a few times, mostly to get the hang of it and become comfortable with the steps involved, and have been able to get everything working like it should. However, with this bell update I am really excited about Java, and I can do without GIN and Mobile Web, as long as I can use Opera Mini and HoTTProxy, but without MMS it's kind of useless to me.

Also, are there any UI changes to the Bell FW or is it the typical Moto UI. I am completely new to this whole thing so I don't know the differences in everything, other then what I have read here. I am currently running the VZW FW, waiting on a number change and as I stated above my phone always mess's up after a *228, but as soon as that happens I am going back to Alltel, and possibly Bell and would be willing to help if I can. Don't know too much at the moment but am willing to learn. I am very excited about this change, feel sorry for the Razr people because the still don't have anything, and am looking forward to getting everything fixed. Also, would it be too much for someone who has successfully gone from VZW to Bell to post up a fairly detailed tut on how to upgrade?

I have gone from VZW to Alltel .11 applied patch's then used MSU to update to .19 and had success, also have gone from .11 to .19 via PST's MFF tool with success. Would it be the same thing for going to the Bell FW and is it best to go from .11 or .19? A big reason, besides VZW's horrible UI, for me going to Alltel .11 was the ability to skin and access my MP3 via side button, then to .19 was the ability to cancel out of MP3 by hitting end. Can someone confirm these settings are in place also? Sorry for such a long post but I just want to make sure I cover as much as I can so I don't end up spamming this thread with a bunch of single question posts. Thanks to all who are working so diligently on trying to get the Bell FW to work completely with VZW service.

Posted by: theirlaws

Hey folks,

Got a charcoal k1m, flashed it out of the box with alltel .11 monster, then bell update.

Trying to copy to the phone through qpst just creates empty files with the link field for the file showing -1.

I checked seem 2742 005a to enable qpst copy. the check stuck, but i still get the same problem with file copy.

Also, even though seem 0055 shows 000000 as the security code, it's not accepted.

Anyone have experience with the qpst copy or security code issues?

Thanks!

Posted by: id4rox

You can reset your data services yourself by using the online ESN changer on verizonwireless.com . Log in, hover over my account at the top, then choose my phone. On the right, select activate phone.

You can change your ESN one digit off and then switch back to the real ESN. I've noticed that, after changing the ESN to the fake one, I have to wait 10-20 minutes to switch it back or the system will error, not allow the switch and tell you to call verizon to activate. If this happens, wait longer and try again.

I've been flashing a lot lately troubleshooting a problem, and often my mobile web and other services don't work. Doing the ESN change-a-roo fixes it perfectly.

Posted by: null1281

Seem 0055 is the SPC not security code, here are the useful code seems:
The 6 digit SPC Code is seem 0055 bytes length 6
The 6 digit Security Code is seem 2786 bytes length E.
The 4 digit User Lock Code is seem 2784 bytes length A.

Posted by: syikho

Quote:

Originally Posted by id4rox

You can reset your data services yourself by using the online ESN changer on verizonwireless.com . Log in, hover over my account at the top, then choose my phone. On the right, select activate phone.

You can change your ESN one digit off and then switch back to the real ESN. I've noticed that, after changing the ESN to the fake one, I have to wait 10-20 minutes to switch it back or the system will error, not allow the switch and tell you to call verizon to activate. If this happens, wait longer and try again.

I've been flashing a lot lately troubleshooting a problem, and often my mobile web and other services don't work. Doing the ESN change-a-roo fixes it perfectly.

i've tried that and have gotten the please call cs message. i waited about 10 mins or so before switching back, so maybe i should wait longer? and does this work to get data working on the bell flash?

Posted by: id4rox

The esn switch should reset your data services. It's an issue on verizon's side I believe.

I've had problems with the changer. I sometimes change the esn to a fake one then am unable to change it back even after waiting an hour. In that case it usually turns out that the esn was never really changed. If you can't change back to the real esn, make a phone call from your phone. If the call goes through then you know that your esn was never changed.

If that happens, just change the esn to a fake one again, go mow the lawn and change it back after. You can try other 'reasons' as well.

you get the hang of it. patience is key.

Posted by: theirlaws

has anyone had success fixing a phone with "authentication failed" with the esn switch approach?

Posted by: Aixelsyd

syikho; Just try flashing with the Vivo Monster flash file. Then the whole *228 thing is not an issue from my understanding. So in essence you can *228 on that flash without messing up data.

Posted by: theirlaws

Quote:

Originally Posted by Aixelsyd

syikho; Just try flashing with the Vivo Monster flash file. Then the whole *228 thing is not an issue from my understanding. So in essence you can *228 on that flash without messing up data.

i flashed from to alltel to bell -- can i reflash with vivo and then bell and expect data to work?

Posted by: kbman

No data services work on this flash because the authentication protocols are completely different than what we have dealt with before on both the Alltel/Vivo flashes and the Bell e815 flash.

I spent a good bit of time last night going over all this with null before and after he flashed to Bell.

We got a lot done in terms of documenting the nvm and now have to isolate the differences and figure out what needs changing and if those changes will stick or not.

Until this work is done successfully, there won't be any data services for this flash.

No little trick is going to do it, it's not that simple, unfortunately.

Posted by: Aixelsyd

I haven't kept up on every last post in this thread, but from memory it doesn't matter what firmware you go to and then Bell. They have yet to work out all the details as to getting data to work with the Bell flash.

Don't quote me on that completely tho, I'm sure someone will clear my statement up if I am wrong. I've got a buddy itching to get this Bell thing and at this point that is why I haven't flashed it for him yet, he really needs data to work so I'm just holding off until it's a proven process to get it working.

Edit; there ya go the man of the hour made it clear as day to what's up. As I said that is why I haven't flashed yet either.

Posted by: null1281

Quote:

Originally Posted by Aixelsyd

I haven't kept up on every last post in this thread, but from memory it doesn't matter what firmware you go to and then Bell. They have yet to work out all the details as to getting data to work with the Bell flash.

I'd just like to point out that we know the upgrade seems to work with firmwares that use the moto ui if you try the upgrade on a heavily modified ui like Verizon or Sprint don't be surprised if it doesn't work.

Posted by: InfinitiProject

Quote:

Originally Posted by null1281

Doesn't work as in..... a brick.

Tried it before myself. Couldn't recover functionality of my phone what-so-ever (sp?)

Posted by: theirlaws

spoke to a verizon tech services rep to reset my data services. she sent me a picture message while we talked, did a trace, discovered a bell signature and urged me to return it to the store.

Posted by: null1281

Quote:

Originally Posted by InfinitiProject

Doesn't work as in..... a brick.

Tried it before myself. Couldn't recover functionality of my phone what-so-ever (sp?)

Well that's what I'd expect but since nobody had chimed in (that i noticed) to say they tried it I didn't want to jump gun.

Posted by: theirlaws

I'm getting antsy without email access through a free/personal proxy, if not through java, then at least through openwave.

Do i need to swap my bell flashed k1m for a fresh one at a verizon store, then backup and flash to alltel?

Posted by: id4rox

Why would you return it to the store? Because a verizon CS was able to spot it as being flashed ? Verizon won't swap your bell flashed phone for a stock verizon one :-D Just flash back to verizon if you are concerned?

I'm holding off on bell firmware for a few months until (hopefully) someone gets data services working!

Posted by: bdl6164

I feel the same as to the Bell Flash. I'd like Java but I must say the data pieces are important to me as well. As to a question earlier about flashing back to Verizon and then to Alltel, let me add another alternative. The VIVO flash for K1M on my L7c was very simple to do and I can still do a *228 2 for ERI updates without risk of data interuption. It is also nice to be able to do a *228 1 to activate after the flash. I would recommend this flash as an alternative to the Alltel. It is quicker and less complicated than the Alltel for the same features. See the VIVO forum for more info.

Posted by: theirlaws

id4rox, i thought i would need to start from scratch, with a fresh k1m to get data working. I had just blindly flashed without backing up secret keys etc, so I dont have any of the vzw data configs.

bdl6164, to restore data services, would i flash:

bell --> vzw --> vivo?

Do i need to backup some settings after flashing back to vzw? Or, unlike alltel, are those settings restored with a *228?

thanks!

Posted by: bdl6164

To be safe I would flash back to VZN and then make sure it is stable before doing any other F/W flash.

Once you flask back to VZN you can do the *228 1 and then two. Chances are this will get you going. Worst case call CS after you activate and ask them to reset data services.

Posted by: syikho

ok, i know, beating a dead horse. but I have seen post from people who state they have the bell flash on their VZ K1m and their data and such working. are they just blowing smoke or do you think it's possible they just got lucky and for whatever reason it works?? and i think i will check out that VIVO flash, sounds alot better, especially if it offers the same things as the alltel does. hopefully a tried and true work around gets discovered soon, i really really want java, but i need my data. and if anyone has data services on the bell flash could you please post what you did exactly to get everything working properly.

Posted by: null1281

Guys, I know a lot of you are frustrated with data services not working right now, but give it time. What this firmware needs is more people experimenting with it and trying different things. kbman, myself and others are still working on what the differences in the seems are and trying to figure out what can and can't be changed trying to gain a greater understanding of how we might be able to get it working. So far the following seems related to authentication are known to be locked on the Bell firmware: 01d1, 01d2, 038a, and 2760

More to follow.

Posted by: bdl6164

I for one applaud the work you guys are doing. If I had the time I'd be there with you but with 5 teens in the house I don't have much time to recreate. I know you guys want data as bad as I do. However since I cannot help in a substantial way I am content to help when I can those who struggle with the Alltel and VIVO flashes. While monitor your progress of course....

Posted by: bushe

I am willing to help I have been running the bell firmware for over two weeks and haven't had any luck. I got small parts of data working but nothing in EV, so if anyone needs me too try anything i am all ears because I have been fighting with this firmware for whats seems like forever. I have exhausted all my attempts so I will try just about anything right now.

Posted by: theirlaws

So if I understand correctly, with seem edits to unlock data service programming, custom websessions, pix servers would work after a *228?

Posted by: suzook

Quote:

Originally Posted by theirlaws

So if I understand correctly, with seem edits to unlock data service programming, custom websessions, pix servers would work after a *228?

no it will not

Posted by: !-OMAR-!

the java is amazing but stupid data well for me data doesnt matter as long as i can text and call

Posted by: Lexie69x

hopefully the data issues get resolved cuz i would love to have the java but i cant live without data now lol cuz i been using my pic messaging alot latley lol and im payin extra mobile web but i suppose i could cancle it

Posted by: null1281

While I was examining the text strings in the firmware last night I came across a java dialog asking if the user wants to grant the app permission to use location services (i.e. GPS) would love to test that out if it works. In regards to unlocking seems, I at least, am not sure how the seems are locked but it seems unlikely that simply editing a seem would unlock another seem it kind of defeats the purpose. Thats not to say its impossible, just illogical.

Posted by: bushe

Quote:

Originally Posted by null1281

Guys, I know a lot of you are frustrated with data services not working right now, but give it time. What this firmware needs is more people experimenting with it and trying different things. kbman, myself and others are still working on what the differences in the seems are and trying to figure out what can and can't be changed trying to gain a greater understanding of how we might be able to get it working. So far the following seems related to authentication are known to be locked on the Bell firmware: 01d1, 01d2, 038a, and 2760

More to follow.

What Happens when you manually edit these seems do they just go back to normal after a reboot?

Posted by: null1281

Quote:

Originally Posted by bushe

What Happens when you manually edit these seems do they just go back to normal after a reboot?

As far as I can tell the phone accepts them like they are written but doesn't actually write them. Even if it did I assume they would be overwritten at startup. Some of the locked seems are actually included in the flex file that comes with the flash so flexing might be the only way to truly overwrite them. The problem with that scenario is according to kbman if you screw up a flex it bricks the phone. Beyond that I cannot an accurate picture of the actual format of a CDMA motorola flex file. The info here http://wiki.howardforums.com/index...._Guide#FLEX_BIN seems to be a GSM flex file format... I've figured out that last 4 bytes on each line of the flex file are a crc16 not sure of what though. And bytes 29-32 of each line are the seem.

edit: even if we flexed the seems *228 wouldn't work because they would still be locked and the auth keys still couldn't be written to I think assuming the bits that locked the seems aren't actually in those seems.

Posted by: !-OMAR-!

it should work on telus we use a java app called telus navagator which is very similar to verizon nav