Messages: Please use the inbrite.com forum for our discussions & Q&A.

News: It is reported that iTunes 9 is compatible with jailbroked iPhones... Now I got an iPhone 3GS. I will be posting something about it...

Sponsors links:

Tuesday, July 18, 2006

mma hacks

Hacks of mma_ucp / mma_dcp
The menu files of motorola p2k phone
I am not the one who found out the details of these mma hacks. I don't know who it is. I sucessfully edit the mma files of V360 based on this hacks.

Update on 15 April 2007: added mma hacks for newer phone. Record lenght in mma of newer phones (such as V360/L7/K1) is 36 bytes, while the record lenght in older phones (such as E398) is 22 bytes.

Now open the mma_ucp file using a Hex editor, and read the followings to understand what are those values in the mma file.

WARNING: Putting an incorrect mma file in your phone can turn it into black screen and force you to flash your phone, so edit it carefully and do it at your own risks.

In the mma_ucp/mma_dcp file, the first 10 offsets are the header. The menu item record starts from 0x0A offset. The first item is "Root", the second is "Container", then follow by 7 root items (home key items). After that is the "MenuRoot" item, follow by all other menu items.

mma hacks for older phones (22-byte record length)

Each record is composed of 7 items starting at offset 0x000A. The length of each record is 22 bytes. The attributes of a record are as follows starting follows: (Unless specified, each item is 1 byte in length)

[has child items] (boolean; will be a 1 when there is a child item)
[parent item's index] (everything except root has one)
[next item's index] (will be FF if this record is the last item in list)
[child item's index] (will be FF if there are no children)
[NULL]
[lock status] (determines if an item/application is lockable and it's state; see Settings > Security > Lock Application)
[item ID] (the string identifying the menu item, 16 bytes)

Address 0x02 = Number of menu items in hexadecimal. This will need to be increased to add menu items.

Here are the details:

Address 0x16 * index + 0x0A = [has child items]; Also the start of this item's attributes; 01 indicates this item has sub items; 00 indicates it's just a regular item.
Address 0x16 * index + 0x0B = [parent item's index] (self explanatory)
Address 0x16 * index + 0x0C = [next item's index]; If value is FF then there is no next item; end of list for this menu; works like a linked list.
Address 0x16 * index + 0x0D = [child item's index]; If this is not FF, this is a menu as well.
Address 0x16 * index + 0x0E = Null (don't touch)
Address 0x16 * index + 0x0F = Menu Type; this may be a bit flag... Values I've see are as follows:
* Value of 00 is seen on hidden items not shown (shouldn't mess with this one)
* Value of 01 means lockable but value was not set (might be an invalid value; showed blank in Lock Apps)
* Value of 21 means locked
* Value of 40 means not lockable (item is not seen in security > lock apps)
* Value of 41 means unlocked
* Value of 61 means view only (Option available for phonebook)
* My GUESS is that bit 0 is the one that determines if the item is shown in the Lock Apps screen. Bit 5 means locked, bit 6 means unlocked and bits 5 and 6 both on means that it's kinda locked (view only).
Address 0x16 * index + 0x10 to 0x1F = This is the string ID for the menu item.


mma hacks for newer phones (36-byte record length)

Each record is composed of 10 items starting at offset 0x000A. The length of each record is 36 bytes. The attributes of a record are as follows starting follows: (Unless specified, each item is 1 byte in length)

[has child items] (boolean; will be a 1 when there is a child item)
[parent item's index] (everything except root has one)
[next item's index] (will be FF if this record is the last item in list)
[child item's index] (will be FF if there are no children)
[NULL]
[lock status] (determines if an item/application is lockable and it's state; see Settings > Security > Lock Application)
[item ID] (the string identifying the menu item, 25 bytes)
[whether it is home key item] (CC = home key items, and CD = all other menu items.)
[offset of customised function] (2 bytes, only meaningful when 10th item is not "00 00")
[length of the customised function] (2 bytes)

Address 0x02 = Number of menu items in hexadecimal. This will need to be increased to add menu items.

Details:

The first 1-7th items are same as those in older phones, except the length of the 7th item.
Address 0x24 * index + 0x0A = [has child items]; Also the start of this item's attributes; 01 indicates this item has sub items; 00 indicates it's just a regular item.
Address 0x24 * index + 0x0B = [parent item's index] (self explanatory)
Address 0x24 * index + 0x0C = [next item's index]; If value is FF then there is no next item; end of list for this menu; works like a linked list.
Address 0x24 * index + 0x0D = [child item's index]; If this is not FF, this is a menu as well.
Address 0x24 * index + 0x0E = Null (don't touch)
Address 0x24 * index + 0x0F = Menu Type; this may be a bit flag... Values I've see are as follows:
* Value of 00 is seen on hidden items not shown (shouldn't mess with this one)
* Value of 01 means lockable but value was not set (might be an invalid value; showed blank in Lock Apps)
* Value of 21 means locked
* Value of 40 means not lockable (item is not seen in security > lock apps)
* Value of 41 means unlocked
* Value of 61 means view only (Option available for phonebook)
* My GUESS is that bit 0 is the one that determines if the item is shown in the Lock Apps screen. Bit 5 means locked, bit 6 means unlocked and bits 5 and 6 both on means that it's kinda locked (view only).
Address 0x24 * index + 0x10 to 0x28 = This is the string ID for the menu item.
Address 0x24 * index + 0x29 = [whether it is home key item] (CC = home key items, and CD = all other menu items.)
Address 0x24 * index + 0x2A to 0x2B = [offset of customised function]
Address 0x24 * index + 0x2C to 0x2D = [Hex length of the customised function]
* The offset of first customised function starts at the end of the last menu record. the 9th item is only meaningful if 10th item is not '00 00'. In other words, if the 10th item is '00 00', you can give the 9th item any value without affecting the mma_ucp's function in any way. for the first special function, 9th item is always 00 00 and 10th item is hex length of first function. for the second special function, 9th item is the ending offset for first function. if you have no special settings for a record, just make sure 10th item is 00 00. Customised function can be used to create branded icons/links/functions. The details of how to define such functions is not clear yet. You can, however, make special functions using p2k menu editor, and import the resulting functions created. p2k menu editor is currently limited to creating alternative icon names/images.

Credits to FizzWinkle for the new findings in the mma of newer phones.

I know it is not easy to understand, but I don't know how to explain it further. I think the best way to explain is by questions & answers, so post your questions.

Download my mma_ucp of 3x4 icons : (rename mma_ucp.bin to mma_ucp, copy it to mma_dcp, then upload the mma_ucp & mma_dcp into /a/mobile/system of your phone. set mma_dcp as system file.)
[inbrite.com] [filecloud]

Sponsors links:

21 comments:

10:23 PM, September 17, 2006 srini said...

hey yuet
can u help me in unlocking my Mp
when ever i insert a sim it shows
please contact service provider

i have a motorola v360

11:14 PM, September 17, 2006 Yuet said...

srini, sorry I can't help. I don't know how to unlock a v360.

7:14 AM, October 15, 2006 Steve-O said...

I love the V1.8, thanks! Quick question, what are the steps you have to take to change your mma with file changer, without messing up the icons and such? Do you need to turn the current one off, or just switch it? I appreciate it!

~Steve-O

1:17 AM, October 17, 2006 Yuet said...

Steve, the files are mma_ucp_* in /a/mobile. you can rename your mma file and put it there, then use filechanger to apply your mma. I forgot to make a copy of the v1.8 mma_ucp in /a/mobile. you should make a copy of the /a/mobile/system/mma_ucp before change it.

1:14 PM, December 26, 2006 Red Machine said...

Hello,
ROGERS V360
i have Q's about changing menu files
- I wish to eliminate some ROGERS icons or make them not do anything
- i also noticed there are blank spaces where previously deleted default ring tones remain in the multimedia \ sounds menu. I have the necessary programs but am lost in hex editing? pls help thx

8:46 PM, December 26, 2006 Yuet said...

- the mma_ucp in the branded firmware is quite different from those retail firmwares. I am not sure how exactly you can do to eliminate the icons. It is quite difficult to hex edit the mma file. The easy way is to flash to unbranded firmware.
- not quite understand the problem. if you find tempdb files in /mobile/audio, delete them and restart the phone.

3:05 AM, February 21, 2007 Stanley said...

Hey Yuet, I have a v360 flashed with yu MP version 3.1.2. I've been trying to enable lock application for my pictures and videos but have been unsuccessful. They weren't in the menu before, but follwing the instructions i have gotten them to show up and have been able to set their status, but it has no effect. I am not prompted for a password when i select them, Please help. Thanx alot

11:41 PM, February 21, 2007 Yuet said...

stanley, have you set your phone lock password?

2:37 AM, March 29, 2007 Sarah's Angel said...

Hi yuet, this hack is pretty cool.. however.. i wanted to ask you something:
After you create your mma_ucp, and you store it in your phone.. where do you save the path for that menu?.. i mean.. If i call it mma_ucp_angel .. where do i tell the skin to find it and use that one?..
I've seeing that you've done that with yuor skins (specially with the ones that changes from 3x3 to 3x4)

Im new with skins and all that.. If you have answered this before.. sorry.. i couldnt find it.. thanks
Cheers :)

2:35 PM, March 29, 2007 Yuet said...

if the no. of icons in skin is less than no. of icons in mma, there will be a extras folder to contain the extra icons. this conversion is automatic, you don't need to do anything.

to change mma file, you need to use the "fileChanger" java app. If you are using my MP, put your mma_ucp_angel into /a/mobile (you can configure this path in fileChanger), then go to "fileChanger" to apply your mma. before you do this, you should backup the original mma_ucp file, as it will be overwritten.

12:01 AM, March 30, 2007 Sarah's Angel said...

thanx for the reply yuet.. a couple of doubts though..
Im trying to install now the Ocean Rotator skin (it's pretty cool).. but the menu is only 1x1 .. i have the mma for that skin.. now, i just need to change the path in the file a/mobile/system/mma_ucp with File_Changer right??
Does the skin will save this path_changing if i switch it back to your iphone skin? or do i have to use the file changer to change the path everytime i wannna use a different skin?
Also, have you seen the skins with 14 icons? very cool design..
Thanx again for the info.. Cheers :)

4:14 AM, March 30, 2007 Sarah's Angel said...

oh.. i forgot to ask you one more thing.. how can i define my mma_ucp_angel as a template for the skin applied?... the way i see it, is everytime you choose a skin, this will look for that template right? or not?..
If im right, by replacing the mma original with my own mma, this new mma will work for all skins from now on? which is not what i want, I only want that mma for that skin no for the others.. I think im missing something... and im sure it's a small thing.. thanx

10:17 AM, March 30, 2007 Yuet said...

1. in filechanger, set the path for your mma files. i.e. /a/mobile.
2. put your files (with mma_ucp as prefix), such as mma_ucp_angel, mma_ucp_yuet, etc. into /a/mobile
3. in fliechange, select the file and apply it. restart ur phone.

changing skin won't change mma. you have to use fliechanger to change mma.

11:51 AM, March 30, 2007 Sarah's Angel said...

hi yuet.. thanks for the reply.. and thanks for making it clear for me.. i thought the skin was the one that changed the mma.. why? cuz i saw some skins 3x4 and then by switching to a skin 3x3, this would show the menu icons without a problem.. i guess you have to create a mma file compatible with both right?
Do you have any tip for that?
i appreciate your time.. cheers :)

10:47 AM, March 31, 2007 Sarah's Angel said...

nevermind yuet.. i figured it out.. i installed skins with same icons on the menu for all of them..
In case i need something different.. then i will use the file changer..
thank you anyways.. Cheers

6:33 PM, April 16, 2007 Leton said...

yuet i can't download it . plz. send it to me.

2:51 PM, May 31, 2007 Anonymous said...

Hey yuet, first of all i'm glad i found this site...i was looking for the iphone skin for my new moto rokr e6, i found nothing but wut you have, but i don't exactly know how to do it...kinda new to the phone, but i really want an iphone but can't afford it, long story short, could u epxlain to me how to download the iphone skin on my e6 step by step...i would really appreciate it, thanx!

4:46 PM, June 01, 2007 Yuet said...

I have a guide here.

12:26 PM, June 02, 2009 Anonymous said...

Yuet,

I was uploading a skin for my motorola v360 and now I have a black screen. The HelloMoto splash screen and my t-moble splash screen still appears when I turn on the phone but after that, goes black. I need your help. Thank You.

12:27 PM, June 02, 2009 Anonymous said...

Yuet,

I was uploading a skin for my motorola v360 and now I have a black screen. The HelloMoto splash screen and my t-moble splash screen still appears when I turn on the phone but after that, goes black. I need your help. Thank You.

2:31 PM, June 02, 2009 Yuet said...

please follow the solution for Scenario 3 in this post. click me


yuetblog.blogspot.com Web