PDA

View Full Version : How to mod firmware for 6000...


Grinlock
12-24-2005, 06:26 AM
According to the readme in 102torom10-8b.zip:
OPTION 2: mod firmware
No matter the model you need to use irdr or flashedit, as posted recently.

you need to look for the rsa key,

Find
Second rsakey, Xored Together With Primary If Required, for 0001
23 72 80 AA B3 6B E4 B2 1F C7 1F BF 08 21 8E 53
2A 54 5E 74 4D 7B 00 7F F8 69 BA 42 68 31 C4 AC
65 3F 38 25 AD E9 35 8F CD 1F 02 39 EC 44 7C BC
27 65 CC 0A EB E4 37 AF 22 70 FC 46 1C 2F A0 42

OK, now that we found it we can replace it with,

Second rsakey for 0001 TOMMYSET.
6E F7 E8 A1 38 BA B5 CD 7D C7 FD 69 66 CF C5 6D
59 F1 1D B1 B4 5C 0B 61 D5 D1 23 23 0B 5C 85 31
AE 06 99 3A B4 D0 0A E9 A6 67 AC 89 BB 99 E3 BC
F8 49 0F E9 47 8B 95 9F 8A 03 55 AB 42 C9 33 5A

OK, I don't see any way to find and edit these strings in Flashedit or irdr. I have an 829p dump for my 6000. I tried searching both the U41 and U45 dumps in a hex editor, and I can't find any of this data.

I looked in the public downloads section and I see that someone posted an already modded firmware. But I looked in there as well and again I can't find any of this data.

It's bugging me that I can't find it... I'd like to understand what I'm doing before I do it...

irjr
12-24-2005, 10:12 AM
Get FlashEdit Beta 4..... It has the ability to apply the rsa data.

Grinlock
12-24-2005, 01:32 PM
Thanks for the reply...

Any idea where I can get Flashedit Beta 4... I don't see it in the public downloads section...

Grinlock
12-24-2005, 03:00 PM
OK, I found Flashedit 2.1 beta 4, but I still don't see a place to edit the RSA data:

http://img517.imageshack.us/img517/4876/fess11dy.gif

http://img366.imageshack.us/img366/9291/fess29vr.gif

daviejones
12-24-2005, 07:47 PM
I have this fs files for the 6000, but don't know if it works.
Just paste in notepad, name it something like 6000.fs and save in flashedit directory.

[RSA for 6000-829P]
prepare_reverse_crc(0x2CB2B0)

set(0x2c79EC, 0x6EF7E8A138BAB5CD7DC7FD6966CFC56D)
set(0x2c79FC, 0x59F11DB1B45C0B61D5D123230B5C8531)
set(0x2c7A0C, 0xAE06993AB4D00AE9A667AC89BB99E3BC)
set(0x2c7A1C, 0xF8490FE9478B959F8A0355AB42C9335A)

commit_reverse_crc()