Messages: Please use the forum for our discussions & Q&A.

News: It is reported that iTunes 9 is compatible with jailbroked iPhones... Now I got an iPhone 3GS. I will be posting something about it...

Sponsors links:

Monday, February 26, 2007

Java corelet/midlet permission & iTunes menu icon

How to patch Motorola firmware to have full Java corelet/midlet permission & iTunes menu icon
for R4513 V360/L7
This guide will show you how to patch the R4513 firmware in order to install java corelet (such as iTunes & mediaviewer) and midlets with full permission, and also putting iTunes menu icon.

What you need:
- A R4513 firmware patched to bypass RSA signature verification, and the extracted CG1 bin file. (Read this post about RSA patching first if you are not sure about RSA patch.)
- HexEditor
- P2K software (P2kTools or moto4lin)
- file


1. open the CG1 bin file with a HexEditor, such as XVI32;

2. search for this hex string;
B5 FF B0 91 20 00 90 05 90 04 27 0F 1C 1C 22 0C
then change the hex string to:
B5 FF B0 91 20 00 E0 10 90 04 27 0F 1C 1C 22 0C

3. search for this hex string;
1C 05 D1 04 48 37 30 4C F7
then change
1C 05 D1 04 48 37 30 4C F7 ?? ?? ?? E0 DD
1C 05 D1 04 48 37 30 4C F7 ?? ?? ?? E0 DE

(?? ?? ?? are three offsets which are different in different firmware, for example, in B7R it is BD F8 0C, in AER it is BD FC 46, in 0FR it is BA F9 F6)

4. search for this hex string;
B5 70 25 00 00 6B 18 1A 78 52 2A 01 D0 09 2A 02
then change the hex string to:
20 01 47 70 00 6B 18 1A 78 52 2A 01 D0 09 2A 02

5. search for this hex string;
20 00 22 02 00 41 5C 6B 2B 05 D1 00 54 6A
then change the hex string to:
35 01 22 03 00 41 5C 6B 2В 04 DA 00 54 6A

6. search for this hex string;
495244414C696E6B0000000000000000000000000000000000 0000001400001CFFFF00E5
then change the hex string to:
4954554E455300000000000000000000000000000000000000 00000014000076FFFFFFFF

(steps 2-5 is patch for java midlet permission, which step 6 is patch for iTunes menu icon.)

7. save the file. Now you have the patched CG1 bin file.

8. follow RSA patch guide to recompile the MP with the patched CG1, then flash it to your phone.

9. after flashing, install iTunes as Corelet on your phone using Motomidman.

10. download the file.

11. use P2k software to backup the original file (in '/a/mobile/certs/root/x509/kjava'), then replace it with the new downloaded file.

12. set iTunes as SIGNED and CORELET using motomidman, then restart your phone.

13. use P2k software to download the /a/mobile/system/mma_ucp file, make a backup, then edit it to add ITUNES menu item. Read this guide if you are not sure how to edit mma file.

14. upload the new mma_ucp file to /a/mobile/system of your phone using p2k software, then restart your phone.

15. you can install other non-corelet java midlets using the bluetooth or midway method. Read this guide for details.

Done. Now you have iTunes with menu icon and java midlets with full permission.

Download: []

Sponsors links:


4:53 AM, March 01, 2007 Anonymous said...

HI,does "Java corelet/midlet permission & iTunes menu icon" will permit to install and make working itunes on a L7 with EOR firmware? Thanks Vodkablim

9:55 PM, March 01, 2007 Yuet said...

I know it works on AER, but not sure about E0R. Will u try it?

3:48 PM, March 02, 2007 Jeremy said...

Will this work with v1050?

6:59 PM, March 02, 2007 Anonymous said...

Do you know how I can enable Bluetooth access from Java on my RAZR V3? I have a J2ME midlet that requires BT, but Cingular disables BT access via the J2ME security manager (unless the midlet has a preferred signature).

So far I have found that the file mentioned in this post may be the place to look ... but I don't know whether to change it, replace it, delete it.

Any suggestions? Thanks.

1:11 AM, March 03, 2007 Yuet said...

jeremy, I have no idea about v1050. I only know this works for v360/L7/V3i.

I don't think we can add BT support in j2me by modding, unless the new V3 firmware support it. That domain registry file won't add function to j2me.

8:36 AM, March 03, 2007 Jeremy said...

Yuet, I think it can work it is just that when I try to select Corelet in Motomidman, it is greyed out as an option. Any ideas why? Thanks.

10:24 PM, March 04, 2007 Yuet said...

jeremy, to verify whether it works, you can try to install java apps such as phonemanager using Midway, to see if you can set full permission for it. I am not sure why the "CoreLet" option is greyed. Can u show me a screenshot?

3:09 PM, March 05, 2007 Jeremy said...

Sure here is is...

4:16 PM, March 05, 2007 Yuet said...

jeremy, what's the firmware in the V1050? is it a LTE2 phone? please show me the motomidman.ini file. You may want to try the older version of motomidman such as 0.38.

BTW, where to get the iTunes revolution 2.9.0? I want to try it.

2:37 PM, March 06, 2007 Jeremy said...


Thanks for the help yuet, my firmware for the v1050 is...


I forgot where I got Itunes Revolution I just thought it was Itunes and downloaded it. I will look for it and post a link. I will also try motomidman 0.38. Here the .ini file I have already tried changing my phone firmware to mode2, but it caused my programs to get deleted even though I could then access Corelets. Here is is anyway...



5:22 PM, March 06, 2007 Anonymous said...

Re: Enabling BT for J2ME on RAZR V3

Yuet, thanks for the earlier response.

The J2ME libraries already include the BT stack. However, Cingular has added special security restrictions that disable access to the BT routines from midlets - they only want their preferred partners to create BT-enabled midlets.

Since this restriction is implemented as a Java Security Manager policy, it may be possible to replace this policy with a less restrictive one, but I don't know how to do that on the RAZR. Any ideas?

11:48 PM, March 06, 2007 Yuet said...

in this case, you can try the file in this post. remember to backup your original file first.

7:43 AM, March 07, 2007 Anonymous said...

Re: Enabling BT for J2ME on RAZR V3

Okay, I tried replacing my file with the one you supply above, then re-installed the midlet, but I still get an error indicating that BT is not accessible from Java.

At this point unfortunately I have no further leads. Thanks for your help.

11:45 PM, April 01, 2007 Rami said...

Hi there...
I have an L7 with the following specs:

bootloader: 08.D0
Sw version: YuetMod_32_L7_0FR (the sw version after I flashed the Yuet MP 3.2)

I am having a problem with the access of java application to the internet....

When I first bought the phone (in Germany) it was unlocked - unbranded...and the java applications could not gain access to the net.

When I start a java application it asks weather I want to allow access to the net ... I choose allow - ask once .... then the GPRS squares flash on at the upper side of the screen .... next the java application says ... connection error..

I tried several java applications such as Opera , IMHere, Mobichat, ...etc and all came to the same result..

The mobile wap browser however is able to access the net normally and the websession settings are perfectly set up.

I flashed the Yuet MP 1.8 and I was happy to solve this problem... all java applications were able to access the net..

However, later on I tried to install some new midlets using MotoMidMan... the applications were successfully installed (with full access permision) however I lost access via java to the net again...

I tried to solve this problem by reflashing MP 1.8 but this did not solve the problem..
I flashed MP 3.2 and it did not solve the problem as well.

Some people pointed out that I should turn GPRS auto attach On via the engineering options... I did it and it did not solve the problem...

Can somebody Pleeeeeeeaaaaasssssseeeee help !!!!!!!

11:38 PM, April 02, 2007 Yuet said...

rami, I think it is problem in the websession setting. I know a guy can use operamini in YuetMod v3.x. He told me that the "port 2" should be 80. You can try.

It is a bit strange as you said you solved it by flashing v1.8, but flash it the second time couldn't solve it again.

4:57 PM, April 06, 2007 Rami said...

Well I actually tried this before. It didn't work!!!
Any other suggestions??

Many thanks

9:56 PM, April 06, 2007 Yuet said...

rami, I have no other idea at the moment.

4:50 AM, June 27, 2007 achap said...

hye yuet..
the link to download the is not available.

10:43 PM, June 29, 2007 Yuet said...

achap, link updated.

BTW, please come & join to my forum.

2:33 PM, January 25, 2009 Anonymous said...

Thanks a lot Yuet!! MMM didn't have this guide! Excellent!

9:09 AM, February 13, 2009 uiyui said...

Joy in warcraft leveling living comes wow lvl from having wow lvl fine emotions,wow power level trusting them,power leveling giving them power leveling the freedom of wrath of the lich king power leveling a bird in the open.wlk power leveling Joy in living can age of conan gold never be assumed as a pose,or put on from guildwars gold the outside as a mask. People who have this joy don not need maple story mesos to talk about it; they radiate it. wow gold They just live out their joy and let wow power leveling it splash its sunlight and glow into other lives as naturally as bird sings. Web