Unlocking R3442A V3re

[xxalexisrulesxx]

Since the v3re is starting to be common on Brazil i found in a portuguese modding site that says the v3re can be unlocked using smart clip
and i found it here

Edit: sorry, its a great Brazilian site and I like it, but they have different Laws to abide by, so they can host warez, and they do tons of it, lol. Evidently it is right though that the v3re or v3_06 can be unlocked via smartmoto and smartclip, Dumba

[Tony]

so testpoint doesnt work or it just has not been confirmed?

[xxalexisrulesxx]

tespoint has been confirmed according to this site but i dotn have a v3re to confirm if anybody has one they can try to tespoint and tell us if it goes into blank mode or not

[98xploder]

lol i will. my bro just got the v3re. i have no problems screwin up his phone for him.
;)

[xxalexisrulesxx]

@dumba- when i wus gona do post the link i thought its probably warez lmao but i didnt know since i dont know portuguese, and 98xploder lmao nice ill give it 2days before its a brick j.ppp

[98xploder]

more than 2 days. hes comin over this weekend for me to do it. ;) but i told him if i brick it he can borrow my v3xx. :doh:

[Tony]

sounds liek a good deal wanna borrow my phone lol and i am sure he wont brick it he in fact is not named clarkey

[xxalexisrulesxx]

the clarkey jokes are back, lmao cellphones are scared of clarkey, and yea 98 umm ill give it a week then lol

[Clarkey]

My custom title should be "I am your phones worst nightmare

[Tony]

from alexis clarkey is the reason why motorolas didnt go trick or treating this year

clarkeys phone collection

http://i75.photobucket.com/albums/i319/necitony/images.jpg

[Clarkey]

hell no that's too small

[Tony]

well they cant fit that manyin one picture this is just whats on your desk at the moment

[xxalexisrulesxx]

clarkey has bricked so many phones that he made this
http://i12.tinypic.com/8fmuzo9.jpg

[Tony]

lmao i think i used to live there

[98xploder]

nope. you didnt. its clarkey's house. made entirely of motorola brand bricks ;)

[Tony]

lmao its the home of m3

[kirkrkm]

Whats the final word on this? has anyone managed to unlock the v3re? Instructions please:)

[hagan]

I think you can not do it without thw easy test point cable and Smart clip or MSS...

[goofy679]

im brazilian, i can help u to translate, but send me the website

[modnmotos]

So far only subsidy code/tp/smart clip

[Dumba]

Goofy679, I am in Portugal, translation isn't the problem here, :)
(Mas Obrigado para a ajuda, jaja.)

[daha2002]

Test point is confirmed by me, 2 days ago i was able to sucessfully unlock my V3re with the test point method and without using any smart clip, moto clip whatever clip.

Heres how:
- open up your phone
- connect the data cable to pc
- connect the battery
- test point the bastard
- with p2k easy tool, select V3r and repair pds
- with p2k easy tool, go to the locks tab and select unlock
- flash a new unlocked and unbranded mp
- youre done

It worked 4 me, feel free to try it yourselves, and ask me if you have any questions

[Danation]

Interesting, very interesting.

What Bootloader? What S/W version? etc. etc. etc.

I'm very interested indeed.

[modnmotos]

with p2k easy tool, select V3r and repair pds

Does this mean your making it a v3r? So flash with a v3r mp? Can you flash with a v3re mp?????????

:confused:........... Very confused........ Along with Danation much information is needed thankyou!

[Danation]

No he's just saying that he used the repair settings for v3r to repair the PDS of his v3re.

But I agree, more information would be greatly appreciated.

[Dumba]

What's needed, is to know, which TP you used, and which p2k ET program, 3.7 or 4.1 or 5.4?

[Danation]

And if you really have a v3re.

[daha2002]

ok, heres how:
- open your phone
- connect data cable
- connect test point (http://i209.photobucket.com/albums/bb17/daniesto/v3ie-v3re.jpg) - I KNOW IT SAYS V3e, BUT ITS THE SAME THING, IT WORKS (at least for me)
- put battery on
- repair pds (use p2k ET 3.7 or 5.3, i did mine on 3.7, my friend, the one who told me how to unlock it used 5.3, both worked)
- go to locks in p2k ET and do your thing
- done
- flash a new stock unbranded and unlocked mp (ill post the one im using this week, fast, stable and a lot of memory)

^THE PROGRAM, AT SOME POINT WILL ASK YOU TO REMOVE THE TEST POINT, DONT DO IT, JUST PRESS OK AND LET THE JOB FINISH. SELECT V3r AS YOUR PHONE IN P2K EASY TOOL (1st. Because theres no V3re on the list. 2nd. The V3re and the V3r both use NeptuneLTE2, so it will work just as fine)^

IM NOT RESPONSIBLE OF ANY DAMAGE YOU DO TO YOUR PHONE, DO IT AT YOUR OWN RISK, IM JUST SHARING MY EXPERIENCES, 2 SUCCESFUL UNLOCKS SO FAR, BUT HEY, ANYTHING CAN GO WRONG, SO IF YOU DECIDE TO PROCEED, BE VERY CAREFUL!!

Before the procedure, i was LOCKED Motorola V3re to DIGITEL (Venezuela), Bootloader 0C.C1 Firmware R3442A_G_0E.42.02A

[modnmotos]

Is this a V3re guys? I thought boot loader 0C.F4 was v3re, and 43.04 or .08, or .25(i believe it was .25 Danation wasnt that pwyll's) were all v3re! Others were a V3r or V3 or something else.

*edit- This is a V3re confirmed by Dumba*

[daha2002]

I know mine is a V3re for a number of reasons, the firm version, the profile it reads in F&B XD and the tip off was, i have edge!

[Dumba]

Thanks daha. Did you try as well with the other Bootloader, 0C.F4? Not that it matters, but would make it complete.

[Capt.D]

I have done 1 with my smart clip and test point...I am working on the 2nd but their server is down so I guess it will wait till tomorrow...but I know it can be unlocked

[Dumba]

Yes, with smartclip we know, that has been confirmed a long time ago, thanks.

[daha2002]

Did you try as well with the other Bootloader, 0C.F4?

Well... no, i dont know anyone with that bootloader, the other 2 people i know that have V3re (its everywhere in this country), one of the has the same BL as i, and the other one, when i offer to unlocked her cellphone, she got scared when i explained that it needed to be opened and now she doesnt let me go near the device :gasthrower:

[Dumba]

We will get it tested, if it works for all Bootloader, then its really a good crack, and a great step forward in modding for the V3re. :thumbsup:

[Danation]

Hey, Modnmotos, maybe you could give it a shot on one of yours?

I'd be willing to confirm.... but I only have one phone. It's a 0C.C1, btw.

I'm excited. If this works for all.... next step: RSA removal!

__________________________________________________ ________________

I admit, though, I'm still a bit skeptical, being the paranoid guy that I am. I do not mean to offend you, daha2002, and I definitely am not accusing you of dishonesty. That is not it at all.

Rather, for the sake of prudence, I suggest that readers should seriously consider waiting until this find is confirmed.

[daha2002]

I admit, though, I'm still a bit skeptical, being the paranoid guy that I am. I do not mean to offend you, daha2002, and I definitely am not accusing you of dishonesty. That is not it at all.

Its ok :thumbsup: i would be skeptical also, to try a method as dangerous as that one posted by a new guy, give it a try if you dare, all i can say is that it worked for me

[modnmotos]

A quick question, When you TP do you connect all three points at the same time? Or do you connect one then finish the rest of the steps, Then go back to the second TP and go through the rest of the steps, and then the third? Sorry if silly question but I've never TP-ed before and want to get it straight before before I do. To ensure best possible results.

[Danation]

Its ok :thumbsup: i would be skeptical also, to try a method as dangerous as that one posted by a new guy, give it a try if you dare, all i can say is that it worked for me

Thank you for your understanding. Though I mentioned I'm a little skeptical, it sounds reasonable, and I believe you enough that I'm willing to risk a phone brick to test it. I'm just afraid that if 40 people try it at once, we could have a problem.

I think we're going to get a Team v3re project going to verify your find soon. Once it's verified, then I won't have any more qualms about widespread use.

__________________________________________________ ________

That's a good question, Modnmotos.

[Dumba]

A quick question, When you TP do you connect all three points at the same time? Or do you connect one then finish the rest of the steps, Then go back to the second TP and go through the rest of the steps, and then the third? Sorry if silly question but I've never TP-ed before and want to get it straight before before I do. To ensure best possible results.I am sure he means the one, he pointed out, with the red line going to the Negatice base.

[daha2002]

Correct, you make a bridge with a thin cable in the marks i pointed in the picture, in theory (according to my friend who taught me how to do it in the first place) the other red points marked should work, but i can speak only from the one i marked since is the one i used.

[Dumba]

You used the one, which looks the most like the Testpoints on other Motorolas. Its usually one of those rectangular solder points. That would be the one I would have used, by the choice of three.

[Danation]

Awesome. Let's get this tested.

[modnmotos]

Ok Danation waiting on you Mr.Gungho, get it tested allready! LOL We should have this confirmed by the V3re team by weeks end hopefully.

[Danation]

Yup, just waiting on the good old USPS, lol.

[pwyll]

Is this a V3re guys? I thought boot loader 0C.F4 was v3re, and 43.04 or .08, or .25(i believe it was .25 Danation wasnt that pwyll's) were all v3re! Others were a V3r or V3 or something else.

*edit- This is a V3re confirmed by Dumba*

I know this is rather late, but yes, my fw version is .25R


Scott

[modnmotos]

After attempting dah2002 explicit directions I was unsuccessfull at unlocking. Danation and I have confirmed that the test point he used is correct, we however have not yet found correct software for performing the unlock or pds repair. I used p2k Easy Tools 5.3 and Danation used 3.9 and in the program selected V3r for the model. Danation also checked out 3.7 but there was no profiles he wanted to try.

[Danation]

k, Modnmotos and I were able to get to S-Blank-Neptune on three seperate v3re's (bootloaders 0C.C1 and 0C.F4), so the actual TP from the image in Daha2002's post is verified. As for the rest of the process.... it is not. At least not yet.

P2kEasyTools 3.7 doesn't have a v3r profile.... so, I admit that calls into question the accuracy of Daha2002's guide... but I will check other uploads of that version.
P2kEasyTools 3.9 doesn't recognize that the Testpoint has been bridged. PDS repair and unlocking don't work for the v3r and v3i profiles. However, RSD Lite shows S-Blank-Neptune-LTE2, so it IS being TPed. I believe Modnmotos used 5.3, but I tried 3.9 on two phones with identical results.

I will be trying later versions of P2kEasyTools soon. The two I tried did not open.

[SocaSlvr]

damn

[modnmotos]

yeah, bummer huh buddy.........Danation will attempt with mstools, Im sure he'll post results when he gets some

[Danation]

K, new results.

Verified that 5.3 doesn't work. Same error.
4.1 doesn't work. Same error.

MSTool8 doesn't work. It says "No Flash Mode dected. Please switch on handset..."

This is all with RSD Lite showing "S Blank Neptune LTE2" which I felt certain meant I had the TP right. Now I'm starting to wonder....

____________________________

Then I put my other phone in BL mode (to try to backup the PDS. Just grasping at straws) and accidentally ran the unlock utility. It said it was successful..... but it didn't work. No brick though

[modnmotos]

This is a rollercoaster of emotion thats for sure. I will try tommorow to confirm Danation's findings as well. And an idea I have as well. In bootloader mode he said it attempted to unlock (without the tp connected) but it did not work anyone got any ideas. We also thought that maybe it really wasnt in blank mode even though it said it was-idk? eitherway-love this stuff.........and she(the pink phone) lives to be modded another day.....lol

[Danation]

By the way, all this testing is with various sequences. TP then release TP and repair and unlock. Or TP and hold TP and unlock and repair. None work.

[modnmotos]

Just as a shot in the dark did you try mstools WITHOUT rsdlite running in the background?

[Danation]

No. I can try it, I suppose. Anything's worth a shot, I guess.

[SocaSlvr]

thats not gonna make any difference

[Dumba]

But ir will tell us that its something else, less to try out, lol. If I find a new aspect, be sure I share it here. But if it was me, the phone would be decorating the wall in a big Dent by now, lol.

[Danation]

I dunno, Dumba, this phone just won't brick. I've done everything I thought would guarantee a brick (other than ridiculous things like unplugging during flashing... though it crossed my mind, lol.)

[modnmotos]

Well lets not go there right now she still alive to try another attempt at unlocking. Lets not brick her on purpose then we wont have a test phone. Let the bricking happen naturally. lol

[Danation]

Haha, yeah. I was joking. I'm not going to resort to that.

Though I bet if I tried it, it still wouldn't permanently brick the phone.

[modnmotos]

Yes I would agree the more we do to these things Im finding its actually pretty hard to brick them on accident. I know we can do it on purpose, but you and I both have done alot to them! Times we thought for sure they'de be bricked they came through with maybe some texts missing in the inbox! I'll take that any day over a brick. These are tough little cookies to crack huh. lol (both with unlocking and bricking) ;)

****UPDATE****
Well I've confirmed Danation's findings with mstools. I also tried making tp during operations and removing during operations. Also started operations in mstools then powered up phone. Still no luck. Fyi this time connection became pretty hot, more than before. So if anyone has any thoughts............

[Danation]

Got_Moto didn't do the trick either.... I'm starting to become discouraged. I used two different TPs to get to S Blank Neptune...

None of the functions would work.

Any ideas? Any at all?

[dohs]

WOW! manage to unlock one v3re today using 5.3 P2kEasy tool...You Rock!!

[Danation]

What the..... ???????????????

Are you sure it's a v3re? What is the exact s/w? What was the Bootloader? What TP did you use? What procedure to you use?

More importantly, why does it not work on the two v3re's I have and the two Modnmotos has?

Tomorrow I will try once more.

To everybody with a V3re, I say: Try this and please post results! I've tried everything I can possibly think of that has a high risk of a brick, and it hasn't died yet. That doesn't mean you won't brick it, but it's not particularly risky.

I really would like to know how many people can and how many people can't get this to work.

[dohs]

bootloader OC.C1 SW R3442A working fine with his guide....maybe it was a luck

[modnmotos]

I have same, boot and s/w and nothing. I dont know whats different between these four phones and the two claims in this thread, so here goes:

1st: Were did you buy your phone?
2nd: What carrier/provider did it come with?
3rd: What exact TP did you use? Which side of the chip did you TP?
4th: What was the exact order you used? (Ex.-power,TP,usb insert/TP,usb,power,....ect.)
5th: What profile in Easy Tools did you use?
6th What order in easy tools did you use? PDS repair or unlock first?

Sorry to ask so many question, but its hard to believe after 60-80 attempts (between Danation and I), the two claims in this thread are correct. You can see our doubt, right? So again sorry, we just want get this confirmed! And it worked for you so we would like EXACT details to follow to confirm it.

[Danation]

bootloader OC.C1 SW R3442A working fine with his guide....maybe it was a luck

Maybe... In another thread, I swear we determined that it's impossible. One fluke I can understand, but two? That's just weird.

I'm not saying that anybody is lying, btw. Just that something extremely odd is going on. That's why I'd like more people to try it and post results.

Btw, What's your BL now? Did it downgrade?

...:confused:...

[Dumba]

Well, I know "dohs" for years, he was also one of the first with other Razr's to unlock, and PDS repair. If he says it can be done, then we are just one step short now. How can it be done to all V3re, :)

[Danation]

As I said, I am accusing nobody. Both stories sound reasonable. I just don't get why it won't work for all v3re's

I really don't know what to think. This post HERE (http://www.modmymoto.com/forums/showpost.php?p=2994611&postcount=68) makes me think it may be a lucky coincidence.

But two lucky coincidences? That doesn't make sense. I don't get it. :scratch:

That's why I'm hoping we can get more v3re users to try it. That way, we'll know whether it's the exception or the rule.

[Dumba]

Well, I PMed some folks on other sites too, and linked to this thread, so they might come up with even more Info. We are missing something, just don't know what. Any help is welcome. Daha published it, his friend told him, so now we have to find what can be done with it.

[dohs]

look i was playing around with all the TP image he posted here for V3e and i end with unlocking the phone w/out recording step. Right now I now i have another one to play around with it .....will post later cuz i got lot of works to do.

[Danation]

Ok, sounds good. Let us know :)

[dstainebze]

Edited, no warez request here, google for it. Dumba.
Trying to unlock the V3re also

[Dumba]

Sorry, those programs you have to find using google or so, they are warez and can't be linked to here.

[Danation]

Hey, I have some major news. I just talked to a really cool guy who has been doing this stuff for like 8 years, and he explained nearly everything to me (some things he didn't know the details on.)

I now know why daha2002 and dohs were able to unlock their phones and why modnmotos and I can't.

I also know a little bit about how the smart clip, rocker box, etc., unlocks these phones.

He even said he won't mind if I post the info online and he didn't charge me for unlocking my phone (though I offered.) As I said, he was a really cool guy.

This is gonna be a long post so let me organize it and I'll post it in a while.

[modnmotos]

Wow what a tease why do you say something but then don't post?

Thats not fair :P

;)


lol

Look forward to hearing the low-down!

PS-e-mail,pm,text all work for me as well.

[Danation]

Alright guys, here's the info. Sorry it took me so long. The information overload gave me a headache (I was getting a ton of info on CDMA for Superbleeeder as well,) so I decided to sleep on it and post today, lol.

Ok, first, I will tell you facts of what I saw and what he told me he knows. Then I will talk about speculation. That way we can keep it separated.

First of all, why could daha2002 and dohs unlock their V3re's like a regular V3r? Well, apparently there are different generations of V3re motherboards, and the oldest can be unlocked like a V3r. He showed me pictures of the different motherboards. Very subtle differences, but they are there. So that solves THAT mystery (thanks heavens. It was really bothering me.)


Back to the unlock.

Here's how the unlock process went:

He plugged a USB to the board. It was a crossover USB of sorts. Apparently it can power a phone without a battery (I need one of those, lol.) Anyway, he sent the ramloader and put it in bootloader mode, nothing special there. Then he sent a command to put it in "blank mode." This is apparently different than the S Blank Neptune LTE2 that Modnmotos and I got. He said that in this mode, you can't boot up the phone at all until you get it out of this mode. He's tried it.

Next, he plugged in an unpowered USB cable to the box. Meaning that first, it's not a crossover, and second, the box won't send any power through the positive wire of the cable. It's apparently necessary that the cable does not send power at all. He has tried it with power (like if we plugged it into a computer,) and it does not work. So if we're going to try to do this without a box, we'll have to do some surgery on a USB cable and cut the positive wire.

Next, he drilled a hole in the shield to get to the special TP. This special TP is different than a traditional TP, as Modnmotos discovered. It's not a solder point, it's a hole in the board, so you have to stick a needle in it. Obviously, it contacts some copper.

Then, he clipped a positive cable from the box to the positive terminal on the motherboard (where the battery's + side goes.) He grabbed another cable (again going to the box) with a sharp probe on it and stuck it in the special TP. The computer was still waiting to detect the right connection.

Finally, he took another probe from the box and touched it to the first probe (here was where I was thinking "huh????".) The computer detected this and did it's thing, writing to the PDS to unlock the phone. And lastly, it sent a command to get it out of "blank mode."

I put the phone back together and stuck in an AT&T SIM. It was unlocked. Then I stuck my T-Mobile SIM back in.

So that's how it's done. Now for the speculation:

What is this blank mode? I'm guessing it disables the regular bootloader in some manner so that while you're doing the special TP, it doesn't try to boot the phone up normally.... but that's a guess. SocaSlvr was telling me yesterday that a similar process is needed for K1 RSA removal, so perhaps somebody who knows more about that can give us some information.

Why do we even have to do all this? Well, we need to read and write from that RAM chip. And I think to do that, we have to power it independant from the chip that contains the bootloader. Or perhaps we're bypassing a different chip altogether. I am not certain. But one thing is for sure, you can't just use a USB cable and simple TP to do it.

What do the two probes do? This is what was making my head spin last night. If we've got positive (and I am 100% sure he was clipped to the positive battery spot,) and the first probe is ground (he kept calling it ground, so that would make sense,) wouldn't that complete the circuit? Shouldn't the computer detect it? What's the 3rd cable? Another positive? But.... then it would just short to ground when he touched the other probe. Unless the first isn't ground.... it's nothing at all. That would make a little sense. You don't want to put a live wire down by sensitive chips, something might arc. So you put in a dead wire and then connect something to it. But if so.... why would that first probe connect to the box? Why not leave it independent? So maybe.... it's running parallel circuits. Part of the voltage shorts to ground and part of it goes out through the ground of the USB cable....? And where does the first positive cable come in?

If anybody knows how to answer that, please do tell. He didn't want me messing with a volt meter by his $1000 box, lol.

So.... can we do this ourselves? It'd be a pain, but I think so. We just need to know what voltage, etc, gets applied where. Then we can cut up a usb cable, etc., and go for it. Of course, then a program will be needed to unlock. For unknown phones, some investigation and programming would be needed. For a V3re... well, if older ones can be unlocked by the same method as a V3r, doesn't that mean the PDS is the same, at least for unlocking? Maybe we can just rig up the hardware and use Got_moto to unlock the phone. Just a thought.

Anyway.......... that's what I've got. Any thoughts?

I have also posted this in the thread "Motorola Unlocking in General" in the general section: http://modmymoto.com/forums/showthread.php?t=407141&page=6

[artman]

Any chance of being able to identify the older boards? Thanks, artman

[Danation]

Sorry, I wouldn't really know. It has something to do with the placement of that chip below where the keyboard flex cable connects to the motherboard. But I don't really know well enough to identify it.

One good way to find out: Try unlocking it with P2kEasyTools. If it works, you have an old board. If not, you have at least a less-old board. If it fails, it doesn't brick, so nothing to fear there.

[mr.sovereign]

okie, maybe this wil catch-on some grease on the current topic. .
Ive read about ppl unl0cking V3 thru RadioComm. Maybe v shud thrash the P2k ET method n direct our energy in this way. . anyone willing to lend a hand?

[Danation]

I suppose we can. The main problem is gaining access to the PDS. It's an actual hardware problem.

[mr.sovereign]

wdot playin with the PDS . . I suppose v can calculate the subsidy. if u check out the GSM3 tab - SBSDY_LCK u can :
Check Status
Verify
Service Code - ?
. . i read a post sayin thr is an option for RESET SUBSIDY , howevr i cudn locate it!

[Danation]

Here's the thing: The subsidy code, the lock, the IMEI and other things are in the PDS. On older phones, that's perfectly fine, you can just read it from a flash chip. But on the v3re, it's stored on a chip that is not accessible via regular USB connection or even with a regular testpoint.

Here is why (I think.) I think there's an intermediate chip, a security chip, that can access the PDS when the firmware asks it to. That's why you can unlock via subsidy code, that's why you can read the IMEI code off of the phone, etc. Because the firmware is programmed to let you.

So, you ask, why can't we just change the firmware so that it unlocks it for us? Well, I was wondering that, too. Here's the problem. On Motorola phones, there's what's called RSA protection. It's a security measure that Motorola put on phones to prevent changing CG1 (the firmware.) Can we remove RSA? Sure, but the Bootloader of the phone checks to see if there's RSA, and if there isn't.... it won't boot. So......... Can we change the bootloader? Sure..... but.... it's on the same chip as the PDS. Isn't Moto so clever?

So here's what we have to do. Either A) crack RSA such that you can hack CG1 without actually removing the RSA (Impossible, or close. At least unheard of.) B) trick the chip into allowing us access to the PDS (how do you trick hardware?) Or finally C) bypass that chip entirely.

C is what the Rocker Box, the Smart Clip, etc., do, and that's what I'm trying to figure out how to do without spending the cash. It requires a special Testpoint with special voltages and such.

[mr.sovereign]

Well, I concur in some of your findings, though not all. Here's why: The subsidy code may/may not be on the chip where the PDS is. But the Locks and IMEI are certainly not protected by any means. I myself have and was able to reset the Locks and was even able to read the IMEI (it's warez so can't make any mention).

Secondly, I somewhat believe that there is something fishy about the phone being recognised as "S Blank Neptune LTE " in RSD whereas other tools such as P2K ET and MsTool 8 aren't able to. Maybe as you say a "security chip" may be doing the gamble. But I would also like to suggest that reading from this chip won't be much of a 'pain' if anyone can provide me with a competent tool as I have (and suppose I'm the only one on this forum) who has a WIBU-KEY - the official Hardware Lock that authenticates Motorola Service Tools. Maybe we can try having a go for it.

Any ideas would be greatly appreciated.

[Danation]

I don't understand what you're saying. Yes, you can read the IMEI, but try changing it without the special TP. Not gonna happen. The firmware is what is allowing you to read the IMEI. Same with the locks. Unless you're saying you can change the IMEI without any special procedure? Or unlock it? Well, if so, tell us how to unlock! I want to be wrong.

Tell me more about this Wibu-key, that sounds interesting.



Anyway, maybe I didn't explain the situation correctly. Here is what Vermsky told me at MotoXtreme, he explains it more clearly than I did:

On your first post, I would say that that is the correct TP location to put the phone in blank mode. However, V3rE is not a p2k phone. It is a ROM4 phone. Argon and ROM4 chips have a special security inside them that disallows writing to the chip when in blank mode. You need to put it in a "special" blank mode.

This was done in your second post. You also said he had a box. It was either a smartclip, MSSbox2, rocker dongle, or other moto service box.

The TP for V3r still works with the V3rE though when you connect it to the box for unlocking, it will see boot version x.00 (I'm not sure what this x is but it is definitely not 0).

The box doesn't recognize this boot version and will fail unlocking it. The special TP is used to make the phone go into a special blank mode which shows a boot version of 0.00. The phone can be unlocked this time.

As for your dad's comments, he is actually right. Tespointing requires grounding the point. To Testpoint the V3r, you have to connect the TP to a ground (either the shield or another ground point). The concept with this testpoint adapter (that thing with the clips and needle) is actually the same. The only difference is that it also uses the pinouts of the box to actually ground the point.

All Testpoint concept is the same with every phone. It doesn't matter whether it is a nokia, motorola, siemens, sony ericsson, or whatever. It always require grounding at least one point. (I said at least one because there are some motos that actually require two or points to ground just to achieve blank mode)

[mr.sovereign]

Let me first make my say clear. I mentioned that I was able to reset the User and Security Locks thru RadioComm. And abt IMEI write. . . the warez app simply doesn have a V3re Profile. :( About the 'special' Blank mode, do u think its achievable thru RadioComm command? Or only a special test point?
In the next post Il explain u abt WIBU-KEY. Since I got some iPhone 3G unlock work now.

Let me continue . .
WIBU-KEY is nothing but a dongle that sits in the back COM Port of the CPU. It is required to run (not all, but almost) applications that are supplied by Motorola. Primarily for Service Tools. People out here know about the PST, but it wont run without first authenticating with the WIBU-KEY. That's why we have the 'patch' that bypasses the WIBU-KEY check. So far. . . I've only seen PST patched. But there are certain other programmes, that people out here are not even aware of as it requires the key and they cannot be, as such, found on forums as they are Motorola Confidential Property.
Do buzz me back if you or anyone require any further assistance on it. However, I opine this isn't the right platform to discuss these matters. Maybe we can run a new thread. :)

[Danation]

Ok, I think we're starting to get on the same page. As you can see, the V3re is different, which is one of the reasons there's no profile in any of the warez programs. Which one are you referring to? We're allowed to post the name, just not links.

You can certainly try RadioComm, it's worth a shot, but my understanding (from my experience and from what Vermsky said) is that it's a hardware issue. We have to bypass that other chip. So to answer your question, I think the special TP is srequired. Kind of a bummer, but I think we should be able to rig a setup that will get the job done. Btw, I'm 99.9% sure that if you were to take a V3re to Motorola's service center, they'd do the special TP or find the subsidy code for unlocking. So we've got a little work to do :)

More programs we haven't heard of? That's interesting to me :) Certainly, start a new thread about it. I'm sure I'm not the only one who wants to know.

[mr.sovereign]

Well here's a little gyan (knowledge) on the thing u mentioned about Motorola Service Centre. Now , service centres have a grading known as 'Levels' :
L1 - collection point
L2 - all repairs EXCLUDING that require any operation on the PCB
L3 - all repairs which are not authorized to L1 or L2
but the irony is that customers have access only to L1 or L2 sectors. Any major issues are escalated to L3 hence they can't perform any Test Point or Unlocking Procedures (officially).
And the warez you wanted to know about is 'MotoIMEI'. I would surely start a new thread but I don't want to do it at the cost at contingencies. Let us be objective. If any Hackers, Reverse Engineers or Programmers are ready to develop or aid in our End Goal - modding, i'm all for it! ;-)

Well here's a little gyan (knowledge) on the thing u mentioned about Motorola Service Centre. Now , service centres have a grading known as 'Levels' :
L1 - collection point
L2 - all repairs EXCLUDING that require any operation on the PCB
L3 - all repairs which are not authorized to L1 or L2
but the irony is that customers have access only to L1 or L2 sectors. Any major issues are escalated to L3 hence they can't perform any Test Point or Unlocking Procedures (officially).
And the warez you wanted to know about is 'MotoIMEI'. I would surely start a new thread but I don't want to do it at the cost at contingencies. Let us be objective. If any Hackers, Reverse Engineers or Programmers are ready to develop or aid in our End Goal - modding, i'm all for it! ;-)

[Danation]

Well here's a little gyan (knowledge) on the thing u mentioned about Motorola Service Centre. Now , service centres have a grading known as 'Levels' :
L1 - collection point
L2 - all repairs EXCLUDING that require any operation on the PCB
L3 - all repairs which are not authorized to L1 or L2
but the irony is that customers have access only to L1 or L2 sectors. Any major issues are escalated to L3 hence they can't perform any Test Point or Unlocking Procedures (officially).
And the warez you wanted to know about is 'MotoIMEI'. I would surely start a new thread but I don't want to do it at the cost at contingencies. Let us be objective. If any Hackers, Reverse Engineers or Programmers are ready to develop or aid in our End Goal - modding, i'm all for it! ;-)


Oh, I see. Well, there really is an easy way to check. Have a moto service center unlock a V3re, and see if there's a hole one of the shields. If so, they did the special TP.

Any thoughts on basically making a box to get to the "special" blank? I think that's probably our best bet. I doubt we'll need special software. I'm betting P2kEasyTools will unlock it for us.... when we're finally able to get to the special blank. I'd actually rather use Got_moto, but the principle is the same.

Yeah, we probably ought not to talk about MotoIMEI. Since here at M3 we can't talk about IMEI change.

But what about this Motorola software that they use that we've never heard of? Is that something different?

[mr.sovereign]

I'm still quite itchy about this special blank mode. Firsty, the test point image on boot-loader.com is essentially different from one that is popular- the one beside the Flash IC. Like for the V3r. Maybe test pointing that will procure a different result. . . But for that we need to rip off the shield. I'm ready for it. But again. . . I stress more on the objectivity! Has anyone had a go at it?
Coming to the Programmes you wish to know. Well, there are heck lotta them . . That serve different purpose. . . For instance there's a Major version of the Service Compal populary known as 'Compal Tool' that's freely available, though that's a Minor Release and the one I'm talking about ( the Major Release) requires, as I said earlier, the WIBU-KEY.

[Danation]

Well, I watched somebody unlock my V3re with the special testpoint using the MSS box. So yes, it works. Just a matter of.... how. Is it just another ground? Is it some voltage? Does the USB cable truly have to be unpowered? So many questions. I'm sort of tempted to buy another GOT pass and just try different things. But I wanted to hear some opinions from you and Vermsky and others before I went to all of that effort.

Sounds like you've got some good info, man. I'd love to hear some other stuff you've got up your sleeve :)

[mr.sovereign]

Certainly. I think the phone can be put into that weirdly "special" blank mode by what has been discussed earlier. We are somewhere failing to take cognizance of the technicality involved. It's quite puzzling as to why P2K ET won't recognize the "S Blank Neptune 2" even after RSD does. Even if we do get the phone into "special" blank mode, what's the probability that P2K ET will recognize it? Of course, there's nothing bad in giving it a try. But I guess we need to locate where are we failing.

I'm trying my level best to gather as much as technical information about this phone. Lets see what findings can I gather.

I'll keep updating.

-Continued-

I fetched this PCB Diagram. Now I'm starting to wonder if there exists any special security chip. I've compared this to a V3i PCB and "essentially" both run on almost similar hardwares, without any major differences. It wouldn't be bad if modders may consider this diagram for analysis. Anyone interested may ask for further much detailed technical specs. I'm having other L3 diagrams as well.

[Danation]

I'm not technical enough to understand that completely, but I agree.... I'm not seeing a specific chip that seems to be a security chip.

Maybe I'm smoking somethin, but I believe it may have something to do with whichever chip stores the PDS. During normal operation, I think it may be physically impossible to read and right to that chip, without altering the firmware (which we went through above.)

I think I'm gonna suck it up and try to fool around with the special TP as soon as I can.

[mr.sovereign]

There neednt be a special chip for that. You're partially right in that aspect. Since it is an ugly reality that this phone is not merely an LTE2 phone. The security that you're guessing about may well be embedded in the very chip itself!
Let know of what your results are.

[Danation]

Yes, I completely agree. It's probably imbedded in the chip. Which makes things frustrating.

There are two things that make me hopeful:

1. Dohs and daha2002 used P2kEasyTools to unlock V3re's, presumably with older boards without the security. That leads me to believe that the PDS for their phones was the same as the V3r (at least the unlocking part.) And since all V3re's have the same memory map (right?), once we can finally access the PDS, I bet P2kEasyTools or Got_moto will do the job.

2. It is possible to unlock. It's been done with Smart moto, Moto rocker, and the MSS box. So it's just a matter of time before we get it. :)

I have a Got pass for the day, so I'm gonna try it today, if I can. If not, oh well, it's just $5, I'll catch it another time.

___________________________________________

Well, I tried to do a special TP. Here is what I did: connected + to + and ground to ground on the battery terminals. Then I TPed it normally (RSD detects "S Blank Neptune LTE2.") Then I put my TP probe on the special TP and remove the ground from the battery terminal. Tried to PDR repair with GOT. Nope, says it needs a TP. Tried the same thing except without removing ground from battery terminal. Nope, says I need to TP. Tried the same thing, except I moved the battery ground to the initial TP (so I was applying 2 TPs.) Same thing.

So... without knowing exactly what happens in that box, we're stuck for now.

[mr.sovereign]

What I learn from ur endeavour is, the phone isnt goin in the 0.00 or similar kinda BL. By d way, which cable did U use? n also by wat means u did d TP? All these are relevant as may be we just need an altogether diffrnt set of TP apparatus to get dat mode. How abt askin GOT Tech. Support for the procedure they contemplate of?

[Danation]

Yes, it still detected 0400. I used a regular USB cable. For TPing, I used my special setup: Wall charger wires come to connectors which clip onto battery terminals (did a diode drop to lower voltage. Yeah, I know, I'm a barbarian :)) The TP probe comes from the ground wire of the charger.

Sorry, I'm not sure what you mean. What should I ask GOT?

[mr.sovereign]

These Online Service Providers have a well established procedural requirement that needs to be complied with inorder to achieve the desired result with their tool. It wouldn't be bad hence to communicate with them. As u're availing their services.
And good self realization Mr. Barbarian! :)

[Danation]

That's true. I can ask them if they know anything on the V3re. They don't support it, though :(

But still, they want me to keep buying passes. Maybe they'll give me some info :)

[mr.sovereign]

The thing is that. Their Support Persons arent allowed to post on blogs or forums (just as I wasnt). But they might give u info. as far as GOT is concerned. This is only for analysis, we have to work other things out.

[karlleeto]

I Wish My Smart Clip Was Working. I Would Sure Try It With P2k ET To Determine If P2k ET Can Unlock V3re. It's So Simple Unlocking V3re With Smart Clip. My Tp Cable Come With With Three Leed, One Of The Leed Connect To The + To Give The Phone Power. The Other Two Is For Tp But I Only Use One To Make Tp. And Also Regular Usb Cabe.

[Rooter]

Don't waste your time, it won't work with old software. ROM4 is not bootable yet. You can set it into blank mode but not more. That's why special testpoint needed to use security hole.

[mr.sovereign]

It's not that it ''won't''. It's just that we ''can't''. It certainly can be accomplished. But, as I said, it requires a special apparatus and a hand-in-glove procedure. Which we are yet to determine. And this phone isn't a ROM4 as such. It's an LTE2 ROM4 based phone. So the primary factor is the same and this is what keeps us puzzled. I'll post certain other technical specifications, as I see most of the users are mistaken by the specifications itself! Maybe that's a contributing factor leading to our inability to achieve an unlock. :)

[Danation]

I Wish My Smart Clip Was Working. I Would Sure Try It With P2k ET To Determine If P2k ET Can Unlock V3re. It's So Simple Unlocking V3re With Smart Clip. My Tp Cable Come With With Three Leed, One Of The Leed Connect To The + To Give The Phone Power. The Other Two Is For Tp But I Only Use One To Make Tp. And Also Regular Usb Cabe.


Dang, get a new one :) Help us out on this project :)



I think, Mr.Sovereign, you or I or both (and anybody else who wants to help) need to get a box and play around with it in concert with other programs, such as P2kEasyTools or GOT.


Don't waste your time, it won't work with old software. ROM4 is not bootable yet. You can set it into blank mode but not more. That's why special testpoint needed to use security hole.


GOT and P2kEasyTools won't do it? Yes, that is correct, not YET, and certainly not alone. But if we use something else to get us in that special blank mode, maybe those tools will then work.

Also, I think we should think about using port sniffers to see the commands that are coming from the box. Also a volt meter would be handy.

The unlock will be accomplished. Just a matter of playing around until we get it. After that, it will be time to work on decompiling bootloaders in preparation for RSA removal :)

[mr.sovereign]

Check this out: :)

http://www.modmymoto.com/forums/showthread.php?t=431851

[Rooter]

It's not that it ''won't''. It's just that we ''can't''. It certainly can be accomplished. But, as I said, it requires a special apparatus and a hand-in-glove procedure. Which we are yet to determine. And this phone isn't a ROM4 as such. It's an LTE2 ROM4 based phone. So the primary factor is the same and this is what keeps us puzzled. I'll post certain other technical specifications, as I see most of the users are mistaken by the specifications itself! Maybe that's a contributing factor leading to our inability to achieve an unlock. :)


Yes it is ROM4, you said it too. Don't know why you say it isn't ROM4 and then later you say LTE2 ROM4. I think it's clear that it is a LTE2 but the difference to the older LTE2 with ROM3 or ROM2 is the new ROM here, since ROM4 no easy unlocking anymore. And the point was is the unlocking working wtith eaystool or any free tool. No, it isn't. Backup is no problem.

[mr.sovereign]

There is a substantial difference in saying V3re is a ROM4 handset and saying it's an LTE2 ROM4 (literally meaning LTE2 based using ROM4 handset). Hence, technically we 'ought' to say it's a LTE2 ROM4.

[Danation]

It certainly is. Which, btw, means that RSA removal won't be as bad as it could be. Removing the RSA from the MP will be a piece of cake with F&B3. Just a matter of booting it up.

....but we'll get to that problem later :)

[Rooter]

There is a substantial difference in saying V3re is a ROM4 handset and saying it's an LTE2 ROM4 (literally meaning LTE2 based using ROM4 handset). Hence, technically we 'ought' to say it's a LTE2 ROM4.


You are wrong. It's ok if I say ROM4 but you can say LTE2 ROM4 if you want, it's the same. There is no difference between them. The unlockers just call it ROM4 because it's always LTE2.

[Danation]

This is purely an argument of symantics. Let's just be friends and get this phone unlocked :)

[Rooter]

Have a look to mssbox.com. It is always called ROM4, it's just needless to write LTE2. And btw since the unlock doesn't work with a usual usb cable like older models V3r etc. with needle, I doubt we can unlock it until somebody write a new free software that supports V3re.

- Unlock for ROM4 phones via MSS Box adapter:

• L72, L9, V3re (V3_06), W510

[Danation]

We may have to do that. Let's get it figured out. :)

[mr.sovereign]

@Rooter

Why don't you have a glance at this "official" Motorola Document laying out the specifications AND making a 'distinction' between the RAZR Baseline and RAZR V3_06 (V3re) (hope you don't dispute that!) :)

[Danation]

Well, I think you guys need to quit arguing, but that's a pretty sweet document, mr.sovereign!

[mr.sovereign]

Well I guess you're correct. Anyway, so what's the status? Any new findings? I've been trying to pass that loader thru MsTool . . P2K ET . . no luck. . I guess we need some hard core C Programmer to decompile P2K ET or any unlocking programme that does the job and insert a similar loader that FB3 uses or - make P2K ET execute the latter part of the unlocking sequence without sending another loader to the phone ( since the phone is already in BL 0000)

[Danation]

Been thinking of getting a rockerbox and finding a port sniffer. See what it does.

[Dumba]

As far as I know, p2k ET doesn't have a separate .prof or .ldr folder. So they must be somewhere in the other Folders. If we find those, maybe we can add the FB3.07 .prof and .ldr files in there, to add the profile for the v3re. The FB3 .ldr and .prof files for the v3re are as an attachment here on MMM.

[modnmotos]

Someone correct me if Im wrong, doesnt the profile have the chip/memory addresses in it? Doesnt the profile basically tell the program were the data needs to go/ what chip the data needs to be written to? Is there another reason for profile?

[Danation]

No, it's the loader that we're talking about. The profile isn't such a big deal.

[mr.sovereign]

I agree. P2K ET is a stand alone executable file. That doesn't need much of dependencies, other than winscard.dll . . Hence placing a profile or loader is ruled out. I guess we just need to keep trying different programmes.
One important thing folks- I guess we also gotta try using older drivers. What I've observed it the updated drivers are causing an impediment in unlocking many phones. Maybe someone on the forum can give a try using older drivers.

[OCM770]

Well smart clip and motorocker are two programs that can unlock ROM4 and ARGON phones but require a box, i believe however that the loaders are in the smart clip program, if it can be disassembled that would be great.

[Danation]

Agreed. And a special loader makes a lot of sense. P2kET and Got are not going to be any help for that.

[modnmotos]

Ok now confused:

We're talking about bootloaders right? Even if we are able to extract a bootloader from the program how would it be flashed to the phone?

If we're talking about 0000 vs. 0400, is'nt this more like the state the phones in? Or are you saying there is an actual 0000 loader(meaning that actual data is sent to phone which the phone uses in some way to allow reprograming)?

[mr.sovereign]

Well, the idea regarding port sniffing is good enough to try. Once we get the unlocking sequence it won't be difficult putting the phone in required states ( meaning the various modes viz. Flash, P2K, Special Boot Loader, whatever it maybe) but knowing the sequence is necessary.
@ modnmotos:
A simplified answer to clarify you would be. . BL 0000 is certainly different from the phones 'actual' BL. The difference basically lies in the Memory Address. It's just like visiting a place you want to go(the unlock) by different ways (BL 0040 or 0000). In our case there is a blockade through road 0040 hence our only way out is 0000!
Hope that clarifies you :)

[OCM770]

Ok now confused:

We're talking about bootloaders right? Even if we are able to extract a bootloader from the program how would it be flashed to the phone?

If we're talking about 0000 vs. 0400, is'nt this more like the state the phones in? Or are you saying there is an actual 0000 loader(meaning that actual data is sent to phone which the phone uses in some way to allow reprograming)?
No, not extracting the bootloader from the program, extracting the RAMDLD which is what allows the program to actually flash/backup/repair/etc the phone just like you cant use an L7 RAMDLD with a V3 you cant use a V3r RAMDLD with a V3re ;)

[Danation]

Between those two answers, I think we've got a pretty satisfying answer to Modnmotos question.

Now.... where to get the loader that will give us the right access? Probably need that port sniffer to see what it sends to the phone and to see what it writes to the phone.

So... I'll be scrounging up money for a box, lol.

[mr.sovereign]

@ OCM 770:
I would like to differ on this point and rather correct. It's not that the RAMDLD 'allows' you to flash, repair, etc. For it's just a loader that 'facilitates' the programm to handshake with the phone. Now only if the further data sent by the programme to the phone is acceptable to the phone's platform, then and only then will the further operations be carried out. And that's the reason you're ended up with the DEA1 error.

[Rooter]

@Rooter

Why don't you have a glance at this "official" Motorola Document laying out the specifications AND making a 'distinction' between the RAZR Baseline and RAZR V3_06 (V3re) (hope you don't dispute that!) :)


What's so special with this document? On the left the it's the first Razr released in 2005 with easy unlocking. On the right side the Razr06 running with the new ROM4 we talking about. Also written in this document. I see nothing new here. ROM4 is not bootable, that's why testpoint to get in CPUs bootloader 0400 doesn't work for unlock and current solutions using a security hole...

[Dumba]

Well, anyway. I hink it was about if Motorola calls it a LTE2 ROM4 or not. Doesn't matter to us at all, what someone calls the phone. And everything else you say is true, but we know that.We are not looking for reasons to explain, why it can't be done, we want to find out how it can be done, with the knowledge of how it won't work. Constructive Think Tank Talk, :)

[mr.sovereign]

@ Dumba :

I concur! :cheers: The purpose of me posting that official document was to make it manifest that Motorola 'does' call it as an LTE2 ROM4. And as you rightly said, perhaps we must be directing our energy in constructive ways and providing solutions than cursing the causes!

By the way, folks, seems like Motorola has made some major changes in their official driver update, as I'm having serious issues even updating the ODM models. I'll post the confirmed results this.

[Danation]

Oh no.... what's Moto doing now?

[mr.sovereign]

Well, there have been changes in almost all .inf files. I think we must try using the older versions and analyze. Seems like they've overcome some issues that were previously not backed up. Certain ODM phones which Moto no longer services are even no longer being detected on certain tools!

[Dumba]

Yup, same I read on a different Forum. Drivers are inhibiting certain access, as well as new RSD Lite versions don't flash certain unapproved stuff. So it needs a clean PC with older driver pack, and older flash programs. I have saved the older versions. For those who can't get hold of it in the Net, just post here and say so, :)

[sharedito]

so...98xploder did it work the tes point?? I need to know if it works I need help to unlock a V3re with O1.C1 and R442A

Please Help Me

[Danation]

98xploder isn't around, but many of us have tried it. No, sorry, it does not work without a box or subsidy code.

[dohs]

ok! I am back been very very with office works...let scroll back ..hmmhmmm.. where was i. OH! testing Daha's method again. tonite going to do it tomorrow- result will be post brick it or not at least the job done.

I also agreed with older moto soft. Does anyone try VictorGSM V3.8 and higher?

result:phone brick going to restore it with clip and try again.

[Danation]

You got a brick? I didn't know that was possible with this phone. That sorta indicates you got to the PDS. What did you do, specifically?

[dohs]

mess up with PDS with wrong file ..damm need to re-arrange what backup is this and that......will let u on my second round.

[Rooter]

@ Dumba :

I concur! :cheers: The purpose of me posting that official document was to make it manifest that Motorola 'does' call it as an LTE2 ROM4. And as you rightly said, perhaps we must be directing our energy in constructive ways and providing solutions than cursing the causes!



Both is correct. As I said you can call it LTE2 ROM4 (you see the comma in this document?), but there is no need of it. Every V3re is LTE2 and every ROM4 is LTE2. LTE2 isn't the important thing but it's ROM4. Vre3 is ROM4 and you proved me with this document. And also don't waste your time with V3re (and all other ROM4 phones) unlock unless an easier method is discovered by professionals Smartclip, Rocker or MSS team.

[Dumba]

Oooooh, but I wouldn't call it waste of time. Its our Hobby here, not our job. We can't get fired from modding for wasting time, and we don't get payrise for dicovering new stuff. We have fun, and entertain ourselves with tech riddles. And ROM4 phones are the riddle of the moment, like RSA and LTE2 and Magx and all other riddles are fun too.

[Danation]

I completely agree. Somebody once asked George Mallery why he wanted to climb Mt. Everest. He said "Because it's there."

Why do we want to do this to the V3re? Because people have the V3re. I have the V3re. We want to mod it to it's maximum capability. This is not ModSomeMotos. This is ModMyMoto. And I will indeed mod my moto :)

[Dumba]

Yes, and Motorola owns the Software, the Firmware, and the copyrights. But once we buy the phone from them, its ours, and we can privately, without commercial intend, do what us pleases, with it. Unlocking it for example, :) .

[dohs]

i will never stop until i climb the highest mountain..LOL! nvr.

[modnmotos]

agreed

[jricky31]

so, smart clip is a simple software to unlock the Brazilian v3re razr black or it needs electronic knowledge to do that

[Dumba]

It needs a smartclip, which is a rather expensive little box, and connection to smartmoto, via internet.

[Danation]

Yeah, it does a special type of testpoint (a cool hardware trick) and a special type of loader (a cool software trick.)

[mr.sovereign]

And both these chillers have almost frozen our thoughts about unlocking it... ;-)

[Danation]

Well, I'm fresh out of new ideas, man. You got any?

[dohs]

don't be man. We are almost there.

[Clarkey]

We now have another modder on the unlock case, Me! We should get this one in no time.

[Danation]

Sweet! Clarkey has joined us! :)

[mr.sovereign]

Hail the spirit to M3 !!!! :cheers:

[modnmotos]

Echoing Danation Im out of ideas except for below.
mr.sovereign - Questions Here (http://www.modmymoto.com/forums/showpost.php?p=3212651&postcount=44)

[arafat458]

hey, I got a v3re and I killed it, it give me error (dea1) it shows the boot loader as
r3342a_g_0e.43.0ar. I 'm trying to do a repair pds, it gives me this massege,
(io timeout). I'm using smart-clip.

Now it gives me error (c4)

[Danation]

Try asking in the smart moto forum, I haven't used a smart clip. Have you tried a regular flash?

[jack lone]

can i unlock it without testpoint

[Dumba]

Not even with.

[arafat458]

I will ask, and get back, thx...
I will try to flash it...
I think thats the only way to unlock it. unless someone now's without a test point.

I'm new on this machine, so... I will keep posted.

[Dumba]

Yes, with the Smart Clip Box and some Flash it might work.

[whoistherabbit]

is there no testpoint without taking the shielding off?

[Danation]

There is. It's the regular TP for V3r. It will get you to S-Blank-Neptune LTE2. But you can't unlock it in that state with this phone.

[whoistherabbit]

yeah i found your shot a motoxtreme. it in the same location but sits different direction. damn the torpedoes, i'll try the unlock anyway.

[Danation]

Yeah, go for it. If it fails, you won't get a brick.

[ky0]

well i just found out mototools will do nothing for a v3re cuz it doesnt support it or at&t for that matter....the site claims it will unlock any motorola phone, Ha!

[dohs]

i want to try that pass on the pic.. got plenty v3re

[Dumba]

I thought you did before?????

[modnmotos]

What are you trying?

[shackpole]

Has any body got a set of diagrams for a v3re?

[Dumba]

Hmmm, if there is, then it is most probably Motorola Copyright protected Service Manual. We can't host it, or link to it, but you might find it with google. Problem is that Motorola doesn't call it v3re. Maybe its under v3 07. I never found one.

[Danation]

V3_06 is the official name, I believe.

[Dumba]

Yep, it is, but it wasn't to be found under that, lol. So maybe we have to look for 07, lol.

[Danation]

A few months ago, somebody came by and posted that she had V3re schematics, but she said she "lost the link."

[Jabbacks]

Where's the testpoint image of the V3re??????

[Danation]

Well, you can't do a traditional TP on the V3re. But you can find an image earlier in this thread.

[jdyates]

hmmm i had a theory a while back.....it refers to the unlocking solution for the Z3/K1....maybe someone can connect their V3re to ramldr2 to see if it connects? if it does, we can go from there to maybe write the same files like "BOOT_START" for V3re? just a thought...

[Dumba]

Any new idea is welcome. Would be a gianyt leap if we only could get into any of the Boot info.

[jdyates]

also guys....i found a TP for V3xx....it is the charging LED! lol i poked it with a tiny flathead screwdriver (my outer L.C.D glass broke so i decided to play with it) and it put it into blank (how do i know? i had to remove the battery and pop it back in to get it back on, just like on my Z3....) the point? i theorize that most phones have multiple TP's.....maybe im wrong? not sure becouse im not a TP expert: ive only done it ONCE to revive my Z3............

Any new idea is welcome. Would be a gianyt leap if we only could get into any of the Boot info.


isnt that a specialty of the russians? they can REALLY hack their phones.....it may be quite possible to work with them to break down the diffrent types of code in ramldr2 so that it supports V3re....AND to create AN UNLOCKING SOLUTION!!!

again guys please correct me if im wrong, im not an expert and i have absolutely NO idea whatsoever regarding .exe programs (ramldr2)

[Dumba]

No v3re in russia, bad luck for us. :(

[jdyates]

ILL say.....well guys i have a V3re

boot:0C.F4
S/W: R3442A_G_0E.43.25R
and the phone was built in august 3rd of 2008 so im guessing its a newer one.....

and i dont use it much so i will be willing to be a tester (if nobody has tried that B/L yet?) for any method that comes to mind.....but first: does the V3re have the ability to flash in blank? just in case i get a :bricked: and have to TP


here are some pics of my motherboard.....sorry for blurryness i took them from my Z3 (2megapixel)

[Danation]

Well, you can't really write to the PDS or bootloader sections of the phone. So... you can't really brick it. And you can't unlock it. Or basically do anything.

You can get S-Blank-Neptune LTE2, but you still can't write a bootloader or PDS. You can flash an MP in blank mode, though, if you want.

Using the TP picture in previous posts (by daha2002) you will get blank mode. From there.... well, I dunno what to do next.

[jdyates]

ok, heres how:
- open your phone
- connect data cable
- connect test point (http://i209.photobucket.com/albums/bb17/daniesto/v3ie-v3re.jpg) - I KNOW IT SAYS V3e, BUT ITS THE SAME THING, IT WORKS (at least for me)
- put battery on
- repair pds (use p2k ET 3.7 or 5.3, i did mine on 3.7, my friend, the one who told me how to unlock it used 5.3, both worked)
- go to locks in p2k ET and do your thing
- done
- flash a new stock unbranded and unlocked mp (ill post the one im using this week, fast, stable and a lot of memory)

^THE PROGRAM, AT SOME POINT WILL ASK YOU TO REMOVE THE TEST POINT, DONT DO IT, JUST PRESS OK AND LET THE JOB FINISH. SELECT V3r AS YOUR PHONE IN P2K EASY TOOL (1st. Because theres no V3re on the list. 2nd. The V3re and the V3r both use NeptuneLTE2, so it will work just as fine)^

IM NOT RESPONSIBLE OF ANY DAMAGE YOU DO TO YOUR PHONE, DO IT AT YOUR OWN RISK, IM JUST SHARING MY EXPERIENCES, 2 SUCCESFUL UNLOCKS SO FAR, BUT HEY, ANYTHING CAN GO WRONG, SO IF YOU DECIDE TO PROCEED, BE VERY CAREFUL!!

Before the procedure, i was LOCKED Motorola V3re to DIGITEL (Venezuela), Bootloader 0C.C1 Firmware R3442A_G_0E.42.02A


OK GUYS! i had a few problems with this method (nothin works the first time for me lmao!) well i got p2keasytools v3.9 cracked and it had the V3r profile....anyway i did the TP (RSD lite showed "S Blank Neptune LTE2") and tried to repair the PDS first right? wrong...it says:
connecting to phone....done
repairing PDS......
ERROR need to activate TESTPOINT for this phone model


and i have to close it out.......any ideas? or am i doing the TP wong? (what i do is, TP it the take my ground wire out.....was i supposed to leave it in?)


now im flashin an MP (just for fun) so ill try again tommorrow :D:D:D:D:D

[Danation]

You're doing it right. You're finding out, like everybody else, that daha2002's method does not work.

Either it was a fluke for him, or he was lying. Either way, it never works when we try to verify it. I have two V3re's. I got the same thing you do.

[jdyates]

lol this is getting annoying..... im usin P2keasytool 3.9 like i said above.....oh and about my theory on the last page: ramldr2 DOES in fact connect to my V3re but when i click send loader OR set blank from 300 it gives an error... heres why: (i THINK) the V3re has a 0400 bootloader, and ramldr2 was written for 0300 phones (Z3, and K1, and i think maybe L7e/i) lol i hope im helping somehow (otherwise im just wasting space in this thread.....)

[modnmotos]

Well, you can't really write to the PDS or bootloader sections of the phone. So... you can't really brick it. And you can't unlock it. Or basically do anything.

You can get S-Blank-Neptune LTE2, but you still can't write a bootloader or PDS. You can flash an MP in blank mode, though, if you want.

Using the TP picture in previous posts (by daha2002) you will get blank mode. From there.... well, I dunno what to do next.

I do!!!! Buy a box....lol

[Danation]

I'm poor :(

Yeah, I already tried Ramldr, and yeah, we're on a 0400 phone. What we need is for it to be detected as 0000.

[jdyates]

ahh thats right.......hmm......im all out of ideas.....

[Danation]

Yeah, you're at the point we're at :S

[jdyates]

lol.......isnt there at least a FEW resident motorola employees here at M3? i wonder......ahh nvm im just thinkin out loud.....while posting....what? lol

[Dumba]

There are probably a load of Moto Employees here, reading, but its a bit like cat and mouse. They don't want to spoil all the fun by telling us. :)

[jdyates]

lol well i guess thats what moddings all about: finding new ways and methods to do cool stuff to make our phones better than the rest (my moms stupid nokia 5310 LOL! my Z3 and V3xx OWN her nokia and dads Treo 800w) and moto employees are pretty cool for not spoiling it :D:D:D:D:D:D

[Danation]

Well, the V3re is so old.... why can't somebody spill the beans?

[jdyates]

well, yeah i agree some phones like the V3, V3re, V3r, V360 and so on ARE old and it WOULD be cool to have a talk with a moto employee about programming etc.

[shackpole]

No v3re in russia, bad luck for us. :(
So why don't they have v3re in Russia? I'm confused????. It's a quad band phone.....Is Moto afraid the Russians will crack this nut? And just how did the Russians get so far in front of the rest of the world in modding??? I'd be willing to sacrifice my v3re to an able bodied Russian for the advancement of knowledge of MMM....

[Danation]

I'm not sure. Moto releases some phones some places and some phones other places. A lot of the good phones recently released went to China and not the US (grrrrrr.)

Well, not too much attention has been paid to these ROM4 phones, simply because most of them are old, low end phones such as this. But I believe L9 is ROM4, as well, and some work on RSA removal has been done on it. I've been meaning to look into it, but I've not been diligent about it.

As far as why it's the Russians (and Chinese) I think it's somewhat cultural. Where I live, here in the US, if you don't like a phone, you toss it in the trash and go buy a new one. In less prosperous places, or at least places with a previous history of being less wealthy, people are more inclined to make their phone do what they want it to and less inclined to just go buy another.

[jdyates]

As far as why it's the Russians (and Chinese) I think it's somewhat cultural. Where I live, here in the US, if you don't like a phone, you toss it in the trash and go buy a new one. In less prosperous places, or at least places with a previous history of being less wealthy, people are more inclined to make their phone do what they want it to and less inclined to just go buy another.

i agree. i can't afford a new phone, otherwise i would get either a MAXX or V8

[hagan]

Well, the V3re is so old.... why can't somebody spill the beans?

Well the "bean" worth crap load of money!!!! those guys that build smart clip and mss box..ect figured it out did they not??? so to spill the "bean' is to spill crap load of money out!!! right???
I can not even get my hand on the level 1 schem for this model!!! while i got most of others

[Danation]

I'm not an expert on the different levels of schematics. Can you tell us what they all are for?

[hagan]

Level 1 normally would have disassembly guide and part# level 2 & 3 would have the layout of very components in each area , mainboard lay out and such so with level 3 schem and if you are a full tech you can repair and replace anything to the fone.

Oh yeah, tip my hat to you guys, you know more than i do and mostly because i have the box so it made it much easier for me to fix so i did not have to dig deep therefore i did not know as much as you guys.
Thanks for the big heart that alway willing to help and the love of modding moto.
All have my highest respect.
BR

[Danation]

Somebody sent me Level 3 schematics (I think) one time. Do you think that would help with unlocking?

I may be able to post them, but let me check first to see if that's allowed. It may not be.

[Dumba]

No, posting them is not OK. They are Motorola Copyrighted. But they are very easy to find in the Net, :)

[Danation]

Thanks, Dumba. I was afraid that was the case.

But back to my question. Do you think the schematics would help with unlocking/RSA removal?

[Dumba]

Everything might help, but if you look at them, then tell me how they may contribute. I don't think we want to unlock by unsoldering the chips and replacing them, lol. I don't think its hardware related.

[Danation]

Well, it will be somewhat hardware related. If we know how the chips work, we'll know where we need to access.

[modnmotos]

So if we know about the actual chip maybe a tp to the actual chip in the right place would allow info to be rewritten to it. This is just thought off the top of my head. What do you think?

[jdyates]

VEEERRRY good point, modnmotos! that sounds like a great idea....dan, you gonna try to find the schem's?

[Danation]

Somebody was kind enough to send them to me, but I'm not allowed to post them.

I'm not sure what level they are, I'll have to check.

@Modnmotos: Yeah, I think that's right.

[jdyates]

yeah i got them too so im gonna send them to my other computer and take a look....also got some for Z3.

[hagan]

I'm not got enought to go that far, with level 3 schem just help me with hardware like replace chips ect

[shackpole]

So if we know about the actual chip maybe a tp to the actual chip in the right place would allow info to be rewritten to it. This is just thought off the top of my head. What do you think?
I "think" your on the right track....I'm thinking a chip jump with a different voltage applied than the operational voltage or a change in frequency through an oscillator as it is being booted up...It's gotta' be simpler than we are anticipating....

[Danation]

Once we have access, then another challenge will present itself, lol.

[shackpole]

That would not surprise me in the least...Have any of the other Neptune LTS phones been cracked?

[Danation]

Plenty of LTE2 have, just not ROM4.

[shackpole]

I'll start there and go both ways....LOL

[Danation]

Yeah, check around some other sections, like L7, V3i, Z3, L9, and V3r. All are a little different.

[Jabbacks]

Is it yet possible to downgrade BL for the V3re?

[Danation]

No.

[fefuts]

Hello. I'm already a little dizzy after so much reading and I'm pretty confused at this point, so I prefer asking you guys to clarify ideas.

I've got what I think is a Motorola Razr V3re. I'm looking a way to unlock it since it's locked to Claro (Arg).

Phone info:
Boot Loader: 0C.C1
SW Version: R3442A_G_0E.42.04R

I know that this phone unlocking process must be done by testpoint. I've already got the resistor to perform TP at. The problem is that I don't know:
1. How to perform testpoint step by step (when to connect the wire, what to do while wire is connected, how does the process end, etc.).
2. If I didn't understand wrong from all I've read related to this, TP turns the phone "blank" for installing a monsterpack, right? Please correct me if I'm wrong. Do anyone of you have a MP or a link to one at least that has been tested with this BL and SW versions?

Please correct me if you read something I put that does not make much sense as it would be very helpful for me to understand the whole process and its limitations.

Any help will be appreciated.

Bye!

[Kenny_Jay]

I don't have any good stuff to add. But I really wanted to send a thanks out to you. Long story shortened, i was battling a V3re for two weeks. Had Moto software update set a 'unlocked' back to carrier defaults and was getting subsidy code request. Had 30 days to return it but I'm stubborn technician(PC's) and accepted the challenge. Well, I've been following this thread(and the suggestions) and have learned more about cellphone motherboards and test points in a month than I would if I spent a month in the library reading about this. I finally surrendered and got a subsidy code by using the IMEI. Sorry to let you down, I had hope to jump on and say I GOT IT. Now I'm looking to see why the screen goes partially white, but then comes back normal. Probably something I did while 'under the hood'. But again thanks, you folks are fantastic.:thanks:

[Jabbacks]

I did my V3re in Blank Mode (RSD Lite). What's next? Cannot flash anything (FB3). Not even ramldr/jump, erase, etc. Cannot go further than that.

[jdyates]

V3re is still being tested by us at M3. im sure the Russians would have cracked it MONTHS ago, but theres no V3re in russia, so we have to do it ourselves :(.

[Jabbacks]

Let's donate a locked one and send it....lolz!

[thierno]

So i have some problem to unlock my motorola V3re, if someone have tespoint file to give me or unlock file, please give it to me.
sincerly

[Dumba]

No Testpoint unlock has been successful so far.

[Jabbacks]

?????

[freak_13h]

I think someone already touched apon this point in the thread, but I was curious if it was possible to get the subsidy code out of seem. I remember doing this with my V3m, and a V3 if my memory serves me. This would be WAY easier then touchpoints and boxes ;) . I'll start pulling seems that have the code on other phone versions, see if it's there. I imagine someone else has tried this method.

[jdyates]

i tried it with P2k commander, but thats a good idea!

Let's donate a locked one and send it....lolz!

you know what? that could work......

[zedbra]

haha, now its my turn to crack this phone!!:)

Hmmm, i have been doing some research and it appears the only way to unlock this phone is with the TP box. :(
too expensive for me!! :) i will keep searching for a free method. lots of good info out there, but not much help for this phone.
i also noticed that my mobo is different than others posted. the TP on the main board looks different, and the other TP near the flex cable isnt the same either..... lucky me!!

[Danation]

Take a look at some of my ancient postings. The TP location that's similar to V3r does get S-Blank-Neptune LTE2, but it doesn't work right.

You need the other testpoint.

The subsidy code is located at a location where we cannot access unless it's in "special blank" mode. So pulling random seems won't solve this. We need to replicate the special TP.

Btw, it's good to see you in on this project :)

[zedbra]

yeh, i read all your posts... here and @ MX. my mobo doesnt have the same location as v3r. and the one under shielding looks slightly different too. i did TP this location and after holding the TP for about twenty second, finally Windows went "ding-dong", but wouldnt show up in any programs. i think whats happening is, with the battery attatched when i hold TP, the phone powers on fully, bypassing Blank mode. im working my brain to think of a way to introduce power to the single positive pin and connect to USB without having the phone power up. also need newer program to recognize v3re in blank mode. i have one program that works with "the box", but its buggy. i know someone will find the answer... probably not me, but i'll keep at it anyway. it's an addiction:D

[Danation]

Well, we can certainly collaborate. Btw, my pics ARE of a V3re motherboard.

Here's the pic:

http://i385.photobucket.com/albums/oo299/niatram/V3re_Testpoint.jpg

The two I circled will get RSD Lite to recognize the phone as "S Blank Neptune LTE2" which is supposedly what we want. But it doesn't work.

The real TP location is under the shield.

http://i385.photobucket.com/albums/oo299/niatram/V3re2.jpg

[zedbra]

yes, i have seen this pic you posted once before. on second examination mine is the same as yours. under the shieling tho, i may need a magnifying glass, but the TP orientation seems different to me. i also have that diagram... i believe from smartclip instructions. i have cut a piece from the shielding. maybe i can take a picture with a good camera and zoom in. :)

[Danation]

It's there, but it's tiny. Sometimes you have to dig into the board a little to contact the TP point.

[zedbra]

yeh, i'm pretty sure i hit the right one. anyway this pic is the best i could do quickly... all i can see is the one solder point, where in the diagram there is another solder point adjacent to the TP


oooooooh, smart clip on special for $290. Tempting.... who wants to pay me to unlock their phone?? LOL :D