Hex Edit Guide - part 2

Hex Edit Guide part 2

Continue from [Hex Edit guide part 1]

This part covers:
- edit plmn_text_table.bin (change carrier name)

edit plmn_text_table.bin to change carrier name

Let's look at a case study.

Case study:
Some USA users of YuetMod told me that their phones are showing "Cingular", but they are actually using sim card from T-mobile.

My findings:
Cingular share the 310-170 (MCC-MNC Code) network with T-Mobile, and in the plmn_text_table.bin, this network is defined as Cingular. So I think we can fix the problem by defining this network as T-mobile. The followings are some network codes for Cingular. If changing the 170 network doesn't work, you can try changing the other 2 networks.
310-410: Cingular Wireless (main network)
310-170: Cingular Wireless (CA/NV network, shared with T-Mobile)
310-150: Cingular Wireless (DCS network, Coastal GA/SC/NC/East TN)

Some more findings:
Somehow I found the 310-170 is stored as "13 00 71" in the plmn_text_table.bin file, while 310-410 = "13 00 14" and 310-150- = "13 00 51". Do you see how they are converted? One more example, if the network code is 123-456, it should be "21 63 54" in plmn file. You can find out the network code of your current carrier, by looking at "my network list" in "network" menu. If you find the code is only 5 characters, add "F" as the sixth character. For example, if the code shown is "525-01", it should become "525-01F" after adding "F". After conversion, it should be "25 F5 10" in the plmn file.

Steps:
1. use P2K software to download the file /a/plmn_text_table.bin to your computer. Please make a backup of the file.
2. open the file using Hex editor.
3. search for the Hex value "13 00 71", you should see the following text is "Cingular". Before "Cingular", there are 5 offsets, including the network code. The offset prior to the text is the number of characters in the text. For example, it is "08" for Cingular.

4. you are lucky that T-mobile has same number of characters as Cingular, so you only need to replace "Cingular" with "T-mobile".

5. however, if you want to change the name to something else. For example, "I love YuetMod", then you should put "0E" at that offset prior to the text. After that you replace "Cingular" with the first 8 characters "I love Y", then insert characters "uetMod".

6. save the file and use P2K software to upload the file to the /a/ of your phone.
7. change the attribute of the file to "System".
8. restart your phone to see the change.

Sponsors links:

Hex Edit Guide - part 1

Hex Edit Guide part 1

This Hex Edit guide will show you steps for some common Hex edit for moto modding.

1. unlock websession
2. adjust audio volume (gain level)


Tools you need:
1. P2K software, such as P2KTools for PC and Moto4lin for Mac
2. Hex editor, such XVI32 for PC and HexEdit for Mac

How to find the offset
Usually people tell you to set a value at an offset in a certain SEEM, to achieve a mod. It is important that you know how to find the correct offset to update. In the Hex editor, it shows 16 columns (0 to F) in each row. The first digit of the offset tells you the column, while the rest tells you the row. For exampe, Let's find offset 0D in a binary file. 0D means the first row (row 00) and the 14th column (D=13 in decimal, and column starts from 0, so 14th column is D). Another example, offset 1B8 is row 1B0, and 9th column. When you select the offset, the Hex editor will show you the address (HexEdit shows it at top-right, while XVI32 shows it at bottom-left.)
screenshot from HexEdit:



Unlock websession
These steps show how to unlock lockedWeb Sessions, which cannot be edited or deleted.
1. use P2K software to download the file /a/WebSession to your computer. Please make a backup of the file.
2. open the file using Hex editor.
3. search for the name of the locked web session in the file on the right text side. For example, Maxic 3G. You will see a dot between each character. (See the screenshots.)
4. look at the three offsets prior to the first letter on the hex side. You should see 03 05 00, or 01 05 00, or even somthing else.
screenshot from HexEdit (before editing):

5. change the three offset number to "03 04 00".
screenshot from HexEdit (after editing):

6. save the file and use P2K software to upload the WebSession file to the /a/ of your phone.
7. change the attribute of the file to "System".
8. restart your phone and now the web session is unlocked.


Adjust audio volume (gain level):
1. use P2K software to download the file /a/gain_table.bin to your computer. Please make a backup of the file.
2. open the file using Hex editor.
3. for example, to adjust external speaker speakerphone game, go to offset 31. The default value is 01, and you can adjust the settings from 00 to 08. "00" is silent, and "08" is loudest. Change the value to what you prefer.
4. save the file, upload it to your phone, and restart the phone.

Look at the following list for the offsets of other gain settings.

SPEAKER GAINS
offset 0D earpiece call gain (original setting: 01, recommended: 05)
offset 19 earpiece keypad gain (original setting: 01, recommended: 01)
offset 25 earpiece system tone gain (original setting: 01, recommended: 05)
offset 31 external speaker speakerphone gain (original setting: 01, recommended: 01)
offset 3D external speaker keypad gain when on speakerphone call (original setting: 01, recommended: 01)
offset 49 external speaker mp3/midi/video gain (original setting: 01, recommended: 01)
offset 4E external speaker system tone gain (original setting: 08, recommended: 01)
offset 61 wired headset call gain (original setting: 02, recommended: 04)
offset 6D wired headset inner keypad gain (original setting: 01, recommended: 02)
offset DC bluetooth headset call gain (original setting: 08, recommended: 08)
offset EA bluetooth headset inner keypad gain (original setting: 08, recommended: 08)
offset F6 external speaker system tone gain when bluetooth headset connected (original setting: 08, recommended: 01)
offset 139 earpiece voice name/voice record playback gain (original setting: 01, recommended: 04)
offset 145 wired headset mp3/midi/video gain (original setting: 02, recommended: 02)
offset 15D external speaker voice dial gain when on speakerphone call (original setting: 01, recommended: 01)
offset 178 bluetooth voice name/voice record playback gain (original setting: 08, recommended: 08)
offset 1BD V3i wired headset mp3/midi/video gain (original setting: 01, recommended: 01)

MICROPHONE GAINS
offset 1E1 handset microphone gain (original setting: 15, recommended: 15)
offset 1F9 wired headset microphone gain (original setting: 1F, recommended setting: 1F)
offset 21D speakerphone microphone gain (original setting: 1F, recommended setting: 1F)
offset 238 bluetooth headset microphone gain (original setting: 08, recommended setting: 08)

Sponsors links:

iTunes in YuetMod v1.6

YuetMod iTunes

Here are the steps to install iTunes on your motorola phone, and the steps to use "iTunes DB creator". Download is at the end of this post.

Update on 03/03/2007: a new version of YuetMod iTunes 2.83 is available.
- MediaViewer(MV) & Phonebook tool plugins for English/Chinese/Russian
- Fixed bug of showing wrong song name in hidden mode
- Press and hold # key to open iShell
- Press 0 key at iTunes main menu to unload, or unload from iShell menu
- Reload iTunes using shortcut (0002_0005 seem)

Update on 25/09/2006: fix problem of song name not showing when iTunes is hidden.

Steps to install YuetMod iTunes

1. Download the YuetModiTunes.zip file. (Download at bottom of this post.)

2. Unzip the file. After that, you have 2 files, iTunes.jar and iTuens.jad.

3. Start Moto Midlet Manager (motomidman) and connect your phone to computer via USB.

4. Wait for motomidman to read the j2me database.

5. Click button "install", then select "install from jad (recommended)".

6. Select the iTunes.jad file.

7. Select "Yes" when ask whether to replace the corelet.

8. Wait for motomidman to finish the installation, then click "restart".

9. Done. If you see the screen "change to default setting" when starting iTunes, press the Red key, then press Menu + 5 to start iTunes again.

Additional steps for non-YuetMod-MP users
1. create at least five shortcuts in the shortcuts menu.
2. download the 0002_0005.seem file and upload it to your phone.
3. restart the phone, then you can press Menu + 5 to start iTunes.

screenshot of motomidman:


Steps to use "iTunes DB creator"

1. Transfer music files to audio folder in the TF card, via USB or bluetooth.

(For Mac users, if you transfer files via USB, one extra step is required to remove the hidden meta files. Start Terminal and follow the commands in the screenshot.)
Screenshot from Terminal:


2. Select "English" as language in "Setting->Initial setup->Language".

3. Start iTunes by press Menu + 5.

4. Press Menu button, select "iTunes DB creator", then select "Yes". (see screenshots)

screenshots:


5. Change back to your language in "Setting->Initial setup->Language". Start iTunes again to see the change. There's no need to restart phone.

Steps to disable autostart

1. Select "English" as language in "Setting->Initial setup->Language".

2. Start iTunes by press Menu + 5.

3. Press Menu button, select "Setting", uncheck the option "auto start", then save the setting.

Steps to use Skins changer

1. Create folder in your TF card -> /b/iTunes/skins.

2. Put your skin resourceDB files, and language resourceDb files into /b/iTunes/skins.

Note #1: You should create subfolder for eash skin, then put the resouceDB file into the skin subfolder.

Note #2: If you enable skins changer, you lose the multi-language support unless you put the language resourceDb files into /b/iTunes/skins.

3. Start iTunes, press Menu button, then select "setting".

4. Tick the "skins changer" option, then press "yes".

5. press Menu button again, then you should see a new option "skins changer". select it, then select the skin that you want to use.

6. restart your phone to see the change.


Language supported by this iTunes
English
Danish
German
Spanish
Finnish
French
Italian
Dutch
Norwegian
Portuguese (Brazil)
Russian
Swedish
Ukrainian
Simplified Chinese
Traditional Chinese

Download::
motomidman version 0.70: [inbrite.com]
0002_0005.seem: [filecloud]

YuetMod iTunes Light 2.80 (Thank Ugunit89 for customising this iTunes.)
YuetModiTunes.zip: [inbrite.com]

YuetMod iTunes 2.83
YuetModiTunes2.rar: [inbrite.com]

Sponsors links:

P2K File System

Understanding P2K file system

This post is for newbie. It will help you get started with moto modding. After you understand the file system, you will be able to do some simple mods, such as how to put skins into your phone, and how to put pictures/music/video into your phone.

After you have installed the necessary P2K drivers and P2K Tools, you are ready to examine the files inside your phone.

The tools I used to access the files in my phone are moto4lin for Mac and P2KTools for PC. You can download them at the bottom of this post. In this post, I call them "P2K tools" in general.

Before you connect your phone to your computer, you should set "Data/Fax connection" under "Connection->USB setting->Default Connection" in the menu of your phone.

Now connect your phone to your computer via USB and start the P2K tools. You click on "Refresh" or "Update list" button, then the software will read the file system in your phone. (For moto4lin, you need to click on "connect/disconnect" button first.)

This is a screenshot from moto4lin:


Typically a motorola P2K phone has 3 drives. /a drive is for system files, /c is for user files and /b is the TF card.

Let's look at some interesting folders and files, and some simple mods by just replacing files.

/a/WebSession : stores your GPRS setting. You can backup/restore it directly and you can Hex edit the file to unlock it if it is non-editable.

/a/gain_table.bin : stores audio gain level setting. You can Hex edit it to change the gain level. Most P2K Tools can update this file directly.

/a/plmn_text_table.bin : stores carriers' ID & Name. You can Hex edit it to change the displayed carrier name.

/a/custgoodbye.gif & /a/custwakeup.gif : custom startup/shutdown animations. They can be replaced.

/a/mobile/system/*.amr : These are camera sounds & timer count down sounds. You can change the sounds by replacing these files.

/a/mobile/system/mma_dcp & mma_ucp : These files define the menu structure of the phone's navigation menu. You can Hex edit it or use P2KMenuEditor to update the files, so as to change the menu structure. mma_ucp is the live copy, while mma_dcp is the copy that will be used when master reset.

/c/j2me15x15icon_VSCL.png & j2me15x15icon.png : The default icon for java midlet when no icon is provided by the midlet. You can change the icon by replacing these files.

/c/phonebook_*.gif : Icons for "new phone entry", "mailing list", "default icon when photo is not available for the phonebook entry stored in phone memory", "icon for PTT entry" and "icon for entry stored in SIM card." The file names are self-explanatory. You can change these icons by replacing these files.

/c/mobile/audio : This folder stores all the ringtone files. Basically all can be deleted to save space. However, before you delete the audio files, make sure all ringtones are set to silent in all ringstyles. You can put your own ringtones in this folder.

/c/mobile/audio/Cust_Start~up.mp3 & Start~up.mp3 : custom startup/shutdown sounds. They can be replaced.

/c/mobile/kjava : This folder stores all the java games & apps in phone memory. You can backup all your games/apps by backing up this folder. jad is jar descrription file, jar is the java class file, png is the icon file, rms is the record storage, and pat is the permission setting file. You can Hex edit the pat file to change the permission for the midlet.

/c/mobile/picture : This folder stores all the pictures in phone memory. They can be safely deleted to save space.

/c/mobile/skins : This folder stores all the skin files. Each skin has its own subfolder. To install new skins, create the skin subfolder in this folder, then upload all skin files into the subfolder. For example, you want to upload a skin called "YuetMod" and you have the files YuetMod.ski, YuetMod.dat and YuetMod1.dat. To install it, use P2KTools create the subfolder "YuetMod" inside "/c/mobile/skins", then upload all the files into /c/mobile/skins/YuetMod. Restart your phone, then you will see the new skin listed in skin menu.

/c/mobile/video : stores video in phone memory. They can be safely deleted to save space.

File Attribute
0 : no attribute, can be modified by java apps, like phone manager.
1 : read-only. cannot be modified by phone manager.
2 : hidden. hidden from some P2KTools, but moto4lin can still show these files. cannot be modified by phone manager.
4 : system file. will not be deleted when master clear. cannot be modified by phone manager.

Download:
P2KTools: [inbrite.com] [filecloud]
moto4lin: [moto4lin]

Sponsors links:

DRM Edit guide

How to edit DRM (part 1) for Motorola P2K phone

DRM? It is not digital right management. I don't know what it stands for, but it is a memory area (code group) in the motorola phone that stores the graphics. Some DRM graphics can be replaced by graphics in the skin files, but not all of them. For example, those signal/battery/ringstyle icons, video camera icon and usb setting icon cannot be replaced by skin graphics. Therefore, you have to edit the DRM in order to change those graphics.

Part 1 of this guide is for phones with 08.A0 or lower bootloader only. Read Part 2 for extra steps for making DRM flashable to 08.D0 phones.

Tool you need:
1. SHXCodec 2.6

Part 1 steps:

1. Start SHXcodec and open the SHX file that contains the DRM which you want to edit. For example, my YuetMod SHX file.

2. Click "Split source SHX file", then select CG 15 DRM (graphics), and click "Edit" button.

screenshot:


3. The window "DRM (graphics) editor" is shown. Click "Parse" button to parse the DRM graphics.

4. Select the graphic that you want to replace, then click "Replace" button to replace it.

5. After you complete replacing the graphics, click "Save changes" and save the change at the default location. (To make DRM for 08.D0 phone, skip the remaining steps, go to [part 2].)

screenshot:


6. Close the window "DRM (graphics) editor".

7. Delete other CGs except the "RAM Downloader" and "DRM (graphics)", by selecting the CG and click "Delete" button.

8. Click "Compile SHX" and save it with a different file name.

screenshot:


9. The DRM reflash file is ready, now you can flash it to your phone to see the change.

Description for some DRM graphics ID (for V360/L7/E398):
329-336: battery icons
403: signal icon (no signal)
411-415: signal icons
416-419: ringstyle icons (loud, soft, silent, vibrate)
1569: ringstyle icon (vibrate then ring)
1678: ringstyle icon (vibrate and ring)
431-433: video camera icons
477-478: new picture and new picture album icons
590-595: outer LCD signal icons
605-607, 663: outer LCD battery icons
1451-1452: card/phone memory icons
152, 213: video icon
205: audio icon
207: picture icon
209: playlist icon
12-13: message received animation (inner/outer LCD)
16, 584: message sent animation (inner/outer LCD)
111-112: extra folder icons
215-216: previous/next songs icons when sound player is hidden
1580, 1597: usb setting icons
1996, 1998: iTunes icons
2017-2018: airplane mode icons
(still many others. Please help me complete the list if you know the other ID/description.)

Download:
SHXCodec 2.66: [inbrite.com] [filecloud]

Sponsors links:

YuetMod v1.6 released

YuetMod screenshots

Here are some screenshots from YuetMod.







Check out different versions of YuetMod at [YuetMod MPs Chart].

Sponsors links:

Make your phone a bluetooth hard disk

Make your phone a bluetooth hard disk with a Mac

Mac has very good support of bluetooth devices. It is extremely easy to transfer files between a Mac and a Motorola bluetooth phone. In this post I will show you how I use my V360 as a bluetooth hard disk, with flip closed.

Steps:

1. If bluetooth power is always on at your phone, skip this step. Otherwise, follow my YuetMod's flip-close operation to turn on the bluetooth power.

2. You should see a bluetooth icon in the menu bar. If not, go to screen "system preference" -> "network" -> "Bluetooth" -> "Bluetooth Modem", check the option "Show Bluetooth status in menu bar".

screenshot:


3. Click on that bluetooth icon and select "Browse Device...". (Assume that you have already setup your bluetooth phone. If not, select "Setup bluetooth device" and follow the steps to set it up.

screenshot:


4. Select the bluetooth device, then click "Browse".

screenshot:


5. Now you can see the folders in your phone in the browsing window. In this screen you can browse/transfer/delete audio/picture/video in your phone memory and TF card. In TF card, you can also create folders and browse/transfer/delete any type of files.

screenshot:


I find this extremely convenient, because you don't need to touch a single button on your phone in the whole process. Your bluetooth phone is a perfect mobile wireless harddisk for small files, at least for Mac users. Enjoy it!

Sponsors links:

A simple way to edit mma

A simple way to edit mma_ucp for V360/L7

Although Hex editing can do all the hacks, but I think most of you prefer using GUI applications to do the task. Hex editing is good because it is mac-friendly. The applications used in this guide are for PC only.

Tools you need:
1. mma converter
2. P2K menu editor
3. any P2K software such as P2K tools, motokit or moto4lin

Steps:
1. use P2K software to download the /a/mobile/system/mma_ucp file to your PC.
2. start mma converter, and open the mma_ucp, then click convert mma, save it to another file, such as mma_ucp_1.
screenshot:


3. start P2K menu editor, and open the mma_ucp_1 file. Re-arrange the menu as you wish, then save it.
screenshot:


4. use mma converter to convert the mma_ucp_1 file again. rename mma_ucp_1 back to mma_ucp and upload it to /a/mobile/system/mma_ucp of your phone, using the P2K software.
5. restart your phone to see the change.

Note:
P2KMenuEditor cannot handle some menu codes, such as PTT setting, Airplane mode, Voice record, iTunes, etc. You should avoice using these codes. You can add some dummy items (such as Chat) in the menu, then using Hex editor to change it to those menu codes. Here is a guide for simple mma edit.

Download:
P2KMenuEditor: [inbrite.com]
mma converter: [inbrite.com]
P2KTools: [inbrite.com] [filecloud]

Sponsors links:

How to backup/restore shortcuts

2 ways to backup/restore shortcuts using P2KAE or manually

You might have renamed or re-arranged the shortcuts after flashing to my MPs, and you want to be able to restore them after each flashing. I found there are 2 ways to backup shortcuts before flashing and restore them after flashing. First is using P2KAE (P2K advanced editor), and the second is backup & restore seem files manually.

Using P2KAE
1. connect your phone to PC via USB and open P2KAE
2. select "Phone Services" -> "Shortcuts"
3. click "Read from phone"
4. keep the P2KAE window open and do flashing (the version of P2KAE I am using cannot save the shortcuts into a file. not sure whether newer version can do it.)
5. after flashing, connect your phone again
6. once P2KAE recognises the phone, click "Write to phone" to restore the shortcuts.
(P2KAE doesn't support Chinese characters in shortcuts.)

screenshot:


Do it manually
1. connect your phone to PC via USB and open any seem editor (P2KTools or Motokits)
2. save seem 0002_0001, 0002_0002, 0002_0003, ... up to the total number of shortcuts, into seem files.
3. flash your phone
4. after flashing, creat as many dummy shortcuts as the number of shortcuts before flashing.
5. use seem editor to write the saved seem files into phone again.

Not very useful, but just want to share with you.

Download:
P2KAE: [inbrite.com]

Sponsors links:

YuetReader - mobile text reader

YuetReader v1.0 a mobile text reader

I wrote this mobile text reader for myself about a year ago. I am using it to read fictions on my V360 every day. It is the second most often used function of my V360. Now I think it is mature enough to release it for anyone who like it. This is a midlet for reading text files inside the jar file. Ideal for creating mobile ebook. It is tested on both motorola V360 and E398. It should work on any mobile phone which supports MIDP2.0, including cell phones by Nokia, Sony Erission, Samsung, etc.

Features at a glance:
- read any text in UTF-8 or ASCII format
- English & Chinese interface, switch language instantly. It is possible to add other language, if you would like to help.
- read text files stored in jar file
- automatically create chapter or book list
- automatically store last reading position
- full screen
- autoscrolling, bookmark, search, multiple background color, word-wrap or character-wrap

Usage:
5=next page
8/2=next/previous page
6/4=next/previous line
1/7=search up/down
3=toggle autoscroll on/off
9=add bookmark
*=back to book list
0=change background color
#=toggle word-wrap/char-wrap

Command Menu:
1.last page
2.first page
3.help
4.exit
5.autoscrolling setting
6.bookmark
7.go to
8.search
9.info

How to create ebook?
- Download and unzip the midlet jar file into a dedicated folder.
- Save each chapter of the book in UTF-8 or ASCII format.
- Name each chapter as textfile0.txt, textfile1.txt, textfile2.txt and so on.
- Put all the text files into the dedicated folder.
- You can change the Midlet name to your book name if you want. You do it by changing the value of "MIDlet-Name:" in the META-INF\MANIFEST.MF file.
- Zip everything in the folder (not including the folder) and rename the extension from zip to jar.
- Install the jar file in your mobile phone.
- For Windows users, you can use Winzip or any other zip program to zip/unzip the file.
- for Mac users, use "stuffit expander" to unzip the jar file and use the archive function to zip the files. Read [Mac tips] for detail.

Why use YuetReader v1.0?
- Text files are compressed in the jar file, so it saves space.
- Everything is in one single jar file, makes it very easy to distribute your ebooks.
- It is compliant to MIDP 2.0, so it should work on any mobile phone with MIDP2.0 support.
- No special permission is required to run this midlet.

V2.0 is in my plan, the major enhancement will be reading text in card or phone memory.

By downloading this file or re-posting any part of this article, you agree to the followings:
1. I am not responsible for any damage to your phone, so use it at your own risk.
2. You do not use this file to get profit.
3. You do not provide direct download of the file. Instead, you must link to this webpage for downloading file.

You can distribute your ebooks using this midlet for noncommercial purpose. If you want to use this midlet for commercial purpose, contact me please.

Download:
YuetReader 1.0: [inbrite.com]
Daniel's Readme.txt for YuetReader 1.0: [inbrite.com]

Sponsors links:

Flashbackup 3.0.050

Randome's Flashbackup 3.0.050 released

Download available at the bottom of this post.

Random's FlashBackup 3 supported phones list*:

Motorola C380
Motorola C381P
Motorola C390
Motorola C650
Motorola E1 ROKR
Motorola E1000
Motorola E1070
Motorola E398
Motorola E770v
Motorola L6
Motorola L7 SLVR
Motorola U6 PEBL
Motorola V180
Motorola V186
Motorola V188
Motorola V220
Motorola V3
Motorola V300
Motorola V360
Motorola V3i
Motorola V3x
Motorola V400
Motorola V500
Motorola V547
Motorola V600
Motorola V620
Motorola V635
Motorola V980
Operating with other models are possible but not guaranteed.
*: In case of probably firmware changes, some newly manufactured
phones in this list maybe not supported.

Trial version of Random's Flash&Backup 3 is limited to run only 15 times. After this, the program will not start until it will be registred. And backuping the flex memory (CG2) is unavailable in trial version. Get latest flashbackup from Random's development website.

However, it can be modified to backup CG2 and also use more than 15 times. Double click to apply the reg file in the package to remove the 15-times trial limitation. (It is found in a Chinese forum. not modified by me.)

PS: Somehow I found the reg file in the package is not effective. I found another way to continue to use it after 15 times, although it doesn't remove the popup message. It is a reg file. Double click it to apply the registry setting, the number of times of use will be reset.

Download is no longer available, as somebody complain it is warez.

The trick to enable CG2 backup is to uncomment the CG2 definition (by removing the semicolon) in the corresponding .prof file under the subfolder "profiles". The trick to reset 15-times limit can be found in comments below.

Sponsors links: