mma hacks

Hacks of mma_ucp / mma_dcp The menu files of motorola p2k phone

I am not the one who found out the details of these mma hacks. I don't know who it is. I sucessfully edit the mma files of V360 based on this hacks.

Update on 15 April 2007: added mma hacks for newer phone. Record lenght in mma of newer phones (such as V360/L7/K1) is 36 bytes, while the record lenght in older phones (such as E398) is 22 bytes.

Now open the mma_ucp file using a Hex editor, and read the followings to understand what are those values in the mma file.

WARNING: Putting an incorrect mma file in your phone can turn it into black screen and force you to flash your phone, so edit it carefully and do it at your own risks.

In the mma_ucp/mma_dcp file, the first 10 offsets are the header. The menu item record starts from 0x0A offset. The first item is "Root", the second is "Container", then follow by 7 root items (home key items). After that is the "MenuRoot" item, follow by all other menu items.

mma hacks for older phones (22-byte record length)

Each record is composed of 7 items starting at offset 0x000A. The length of each record is 22 bytes. The attributes of a record are as follows starting follows: (Unless specified, each item is 1 byte in length)

[has child items] (boolean; will be a 1 when there is a child item)
[parent item's index] (everything except root has one)
[next item's index] (will be FF if this record is the last item in list)
[child item's index] (will be FF if there are no children)
[NULL]
[lock status] (determines if an item/application is lockable and it's state; see Settings > Security > Lock Application)
[item ID] (the string identifying the menu item, 16 bytes)

Address 0x02 = Number of menu items in hexadecimal. This will need to be increased to add menu items.

Here are the details:

Address 0x16 * index + 0x0A = [has child items]; Also the start of this item's attributes; 01 indicates this item has sub items; 00 indicates it's just a regular item.
Address 0x16 * index + 0x0B = [parent item's index] (self explanatory)
Address 0x16 * index + 0x0C = [next item's index]; If value is FF then there is no next item; end of list for this menu; works like a linked list.
Address 0x16 * index + 0x0D = [child item's index]; If this is not FF, this is a menu as well.
Address 0x16 * index + 0x0E = Null (don't touch)
Address 0x16 * index + 0x0F = Menu Type; this may be a bit flag... Values I've see are as follows:
* Value of 00 is seen on hidden items not shown (shouldn't mess with this one)
* Value of 01 means lockable but value was not set (might be an invalid value; showed blank in Lock Apps)
* Value of 21 means locked
* Value of 40 means not lockable (item is not seen in security > lock apps)
* Value of 41 means unlocked
* Value of 61 means view only (Option available for phonebook)
* My GUESS is that bit 0 is the one that determines if the item is shown in the Lock Apps screen. Bit 5 means locked, bit 6 means unlocked and bits 5 and 6 both on means that it's kinda locked (view only).
Address 0x16 * index + 0x10 to 0x1F = This is the string ID for the menu item.


mma hacks for newer phones (36-byte record length)

Each record is composed of 10 items starting at offset 0x000A. The length of each record is 36 bytes. The attributes of a record are as follows starting follows: (Unless specified, each item is 1 byte in length)

[has child items] (boolean; will be a 1 when there is a child item)
[parent item's index] (everything except root has one)
[next item's index] (will be FF if this record is the last item in list)
[child item's index] (will be FF if there are no children)
[NULL]
[lock status] (determines if an item/application is lockable and it's state; see Settings > Security > Lock Application)
[item ID] (the string identifying the menu item, 25 bytes)
[whether it is home key item] (CC = home key items, and CD = all other menu items.)
[offset of customised function] (2 bytes, only meaningful when 10th item is not "00 00")
[length of the customised function] (2 bytes)

Address 0x02 = Number of menu items in hexadecimal. This will need to be increased to add menu items.

Details:

The first 1-7th items are same as those in older phones, except the length of the 7th item.
Address 0x24 * index + 0x0A = [has child items]; Also the start of this item's attributes; 01 indicates this item has sub items; 00 indicates it's just a regular item.
Address 0x24 * index + 0x0B = [parent item's index] (self explanatory)
Address 0x24 * index + 0x0C = [next item's index]; If value is FF then there is no next item; end of list for this menu; works like a linked list.
Address 0x24 * index + 0x0D = [child item's index]; If this is not FF, this is a menu as well.
Address 0x24 * index + 0x0E = Null (don't touch)
Address 0x24 * index + 0x0F = Menu Type; this may be a bit flag... Values I've see are as follows:
* Value of 00 is seen on hidden items not shown (shouldn't mess with this one)
* Value of 01 means lockable but value was not set (might be an invalid value; showed blank in Lock Apps)
* Value of 21 means locked
* Value of 40 means not lockable (item is not seen in security > lock apps)
* Value of 41 means unlocked
* Value of 61 means view only (Option available for phonebook)
* My GUESS is that bit 0 is the one that determines if the item is shown in the Lock Apps screen. Bit 5 means locked, bit 6 means unlocked and bits 5 and 6 both on means that it's kinda locked (view only).
Address 0x24 * index + 0x10 to 0x28 = This is the string ID for the menu item.
Address 0x24 * index + 0x29 = [whether it is home key item] (CC = home key items, and CD = all other menu items.)
Address 0x24 * index + 0x2A to 0x2B = [offset of customised function]
Address 0x24 * index + 0x2C to 0x2D = [Hex length of the customised function]
* The offset of first customised function starts at the end of the last menu record. the 9th item is only meaningful if 10th item is not '00 00'. In other words, if the 10th item is '00 00', you can give the 9th item any value without affecting the mma_ucp's function in any way. for the first special function, 9th item is always 00 00 and 10th item is hex length of first function. for the second special function, 9th item is the ending offset for first function. if you have no special settings for a record, just make sure 10th item is 00 00. Customised function can be used to create branded icons/links/functions. The details of how to define such functions is not clear yet. You can, however, make special functions using p2k menu editor, and import the resulting functions created. p2k menu editor is currently limited to creating alternative icon names/images.

Credits to FizzWinkle for the new findings in the mma of newer phones.

I know it is not easy to understand, but I don't know how to explain it further. I think the best way to explain is by questions & answers, so post your questions.

Download my mma_ucp of 3x4 icons : (rename mma_ucp.bin to mma_ucp, copy it to mma_dcp, then upload the mma_ucp & mma_dcp into /a/mobile/system of your phone. set mma_dcp as system file.)
[inbrite.com] [filecloud]

Sponsors links: