Message Menu with Sec. code

[Juan2k]

Greetings to all,

I've downloaded the hardcoded flashfile of Joxx which will ask a security code when going to Message menu its a nice one coz as we all know most of the thing inside it is private. Eversince I always used that flashfile and customized it as my personal 3310-557 flashfile. and then i came to like the fading one until i'd like to transfer the sec. code thingy to that flash i manage to compare the clean 3310-557 to the one that has the joxx-code & found out this code between the MCU-PPM freespace:

0032B91C0B800101001113F600313A6700000000017500DC0000000D0100002400313BF600000021017505E0000000520400002400313BBA0000001E017505E0000000520000002400313C170000001D017505E00000005200000024003136560000008E017505E0000000520000002400313C9500000099017505E00000005200000024003130FE0000009C017505E0000000520000002400313C1400000023017505E00000005200000024003133B900000029017505E0000000520800002400313E870000002D017505E0000000520400002400313E4B00000027017505E0000000520400002400313C020000009F017505E00000005200000024

found its pointer too at 0x00b8ed5 with value 32b910
also found this one dont know about it ??? 0x00109c59 with value 33F36C found only in joxx flash

so i insert that code somewhere between the MCU-PPM freespace & change the pointer to that place, coz its spoiling the fadinglight-slideshow having the same address.

i also found-out that my saved genolite code when loaded to other flash resulted into calling the sec. code function but not going inside message menu instead to phone security on/off
just try it for experimentation.

any comments?

[ryan_chong]

Wow....it's too good to have security code for sms inbox but seems like it's really hard to do it.
Any easier solutions?Lot of new stuff hv been created by many experts and we keep asking for the tutorials.We are not lazy to do that but it's really difficult sometimes...:(
Perhaps someone would share it here with everyone...

Btw,can i add the security code for sms inbox by PPMedit?]

Thanks....:)

[spaceimpact33]

hi Juan2k,

This sounds prety cool i was just wondering what porgram are you using to set the pointers?
This security thingy would be great since i am sick of my freinds going through my messages. :)

btw thanks for the info;)

thanks daniel.

[Juan2k]

Hexworkshop or any other will do, and i didn't created it, its Joxx who did it but he may be too busy to give some advice but i know he'll give it to us or Nokdoc.

[Vili]

Just compare Joox code flash file and original 3310 5.57 flash file whit hexworkshop, you will find the differences.:)

I have made one flash file whit inbox sec.code and faidin leds, I can pos it there when i go home.

[theremoids]

i've been trying to do this with my 6210... no success.

is there anyone here successful in putting the security code in the 62xx's messages menu?

[markaidestine]

Originally posted by Vili
Just compare Joox code flash file and original 3310 5.57 flash file whit hexworkshop, you will find the differences.:)

I have made one flash file whit inbox sec.code and faidin leds, I can pos it there when i go home.

what if i want to use 3310 v 5.79? can i compare it to 5.57 or it's different?

[mrpeet]

Is there any working flash with sec. code to open messages???

[imoi]

where can i get that flash with message sec. code?

[theremoids]

http://www.tech-productions.de/nokia/3310_5.57_Joox_Code.zip

[Juan2k]

Maybe you can shed some light to me how in the hell did you do it transfering sec. code to inbox or how to transfer it to other flash
Thanks

[ryan_chong]

Hii....

Juz wondering if the "Messages" menu security code has been added,there's no more security code for the phone as usual?]

Thanks again...:)

[Vili]

Originally posted by Juan2k
Maybe you can shed some light to me how in the hell did you do it transfering sec. code to inbox or how to transfer it to other flash
Thanks

the main prinsiple is: when you enter to the message menu it jumps to phone security menu where the sec.code and when you have entered the sec.code it junps to other message menu which is made to the end of the flash. I can give you some adresses when I go home. :)

Originally posted by Juan2k


0032B91C0B800101001113F600313A6700000000017500DC0000000D0100002400313BF600000021017505E0000000520400002400313BBA0000001E017505E0000000520000002400313C170000001D017505E00000005200000024003136560000008E017505E0000000520000002400313C9500000099017505E00000005200000024003130FE0000009C017505E0000000520000002400313C1400000023017505E00000005200000024003133B900000029017505E0000000520800002400313E870000002D017505E0000000520400002400313E4B00000027017505E0000000520400002400313C020000009F017505E00000005200000024

This is the other message meny

[ryan_chong]

@Vili

Thanksfor ur info....Hope u can go home earlier:p

Btw,i hv juz try the fls files wit sec. code in Messages menu and i found that i can't use security code for the phone anymore.
So,tats means we can only hv sec. code for 1 menu only.Am i right?

Anyway,this is great!:)

[Vili]

Originally posted by ryan_chong
@Vili

So,tats means we can only hv sec. code for 1 menu only.Am i right?


Yes, i think is right.
I think that 3310 asks sec.code in three menu, in phone security, when you reset factory settings and when you reset call timers.

I only know where the phone security sec.code funktion is located, I find it out when I compared the original 3310 5.57 file and Joox´s sec.code file.


Sorry for my english :D

[Juan2k]

cud u please give some info or addresses, do's and don'ts

[Juan2k]

also found this one dont know about it ??? 0x00109c59 with value 33F36C found only in joxx flash

do u know what this means

[malta1]

To joox>>> Can u point the pointer with this process to UNLOCK instead in the message menu. Tnx man you're great! More power to you...

[Vili]

hi

Here is some information...

First:
If you open joox´s file and original 3310 5.57 in g3n0lite you will find this:
Original file [0x00313A67] [0x00308564] (0x0057) (0x0387) (0x0000) (0x003E) (0x0000) (0x0014) Messages
Joox´s [0x00313A67] [0x0000004C] (0x0057) (0x05E0) (0x0000) (0x003E) (0x0000) (0x0014) Messages

The second adress in the message linen is in originalfile [0x00308564] and in jooxs file [0x0000004C]
In original file the adres is to message menu and in jooxs file it is to sec.code

if you want to change this you need hexworkshop.

Second:
Compare files whit hexworshop, you will find four differenses. Remembe to kill MCU checksums in the original file because it is killed in jooxs file.

The first difference is the adress where the phonen jumps after you have entered sec.code. In original file it is to sec.code on/off, but in joox file it is to message menu wich is made around 0x0032B910

Just compare files so you will realise the differences...

:)

[Finn]

@Juan2k

the hex values you posted are the CODE for Security code or for the fading out?
So if you want to have fading out lights or sec code in Messages we have to insert the code in freespace at the end of MCU instead of replacing the old code with the new one...
then we have to set a new pointer in order to call the new routine..
am i right? :confused:

[gkagg]

Is there any flash (prefferably 5.57) to have both fading effect as well as security code when accessing messages menu? Is anyone has it pls post!!

:)

[slikmik]

wow this is clever, simple concept though! excellent to play around with, ok ive spotted the added security code chunk at offset 0012B910 but what does the "4C" direct to obviously this chunk but "4C" i cant figure it out, is this the address of the sec code bit? cant be... i duno

prob a dumb question

anyway please help... :O

Mike

[Iccang]

@Vili: Your attachment is corrupt.. Please to reattach, mate..

Regards

[theremoids]

@Vili... your attached file is only 126 kb.

[Juan2k]

Malta what do you mean Unlock keys or SP Unlock if it is Unlock keys you have given me an Idea. Thanks

[Juan2k]

Oh VILLI i forgot the attached zipfile is indeed broken

[theremoids]

Originally posted by Juan2k
Malta what do you mean Unlock keys or SP Unlock if it is Unlock keys you have given me an Idea. Thanks

unlock key with a security code! this is better!
like in 6250 tho i hate the way it is made in 6250 coz after 3 wrong attempts it will ask for the pin code. :-(

[Vili]

Originally posted by theremoids
@Vili... your attached file is only 126 kb.

sorry :)

I will fix it tonight when i get better connection, i have now only a dial up connection and it is so slow...:)

[Vili]

Hi !

Here is the correct file with inbox sec.code and faiding leds

www.finokia.cjb.net (http://www.finokia.cjb.net)

Enjoy...:D[

[Swiftie]

Originally posted by Vili
Hi !

Here is the correct file with inbox sec.code and faiding leds

http://geocities.com/veijavi/3310/

Enjoy...:D

Good work people! But you see the FADING LIGHTS? Woz this added onto this file? Or did you jus use the G3 file?
Coz I badly need 2 know how to implement the Fading Lights on a 8210 file!! :rolleyes: :( :rolleyes:

[theremoids]

@Vili... thanks for your great creation.
i hope i can learn how to put the security code on my 6250's messages menu...
i hope you could teach us.

many thanks!

[Yozhee]

Thanks Vili!

Hope i can apply it on my 3210 and 7110!!!

Nice Flash u have there!!!

Is it possible for my 7110?

Thanks!



_________________


Yozhee

[chunkhead]

Hey Vili,
Could you maybe post this file on the thread here? Cos geocities keeps telling me it's over used it's allocated space or something like that! Thanks!!!:grin:

[spaceimpact33]

Hi,

At http://www.tech-productions.de/nokia/ i found 2 files for 5110 one was a avi video file showing the menu with sec code and the other an fls file in the fls i found this code http://groups.yahoo.com/group/spaceimpact33/files/jooxcode2.txt
and i noticed it was totaly different to the 3310 code
http://groups.yahoo.com/group/spaceimpact33/files/jooxcode
could anyone shed some light on this? :confused:

open these files in hex workshop :)

thanks Daniel ;)

[malta1]

Juan2k, i mean unlock keys. That everytime you unlock the keypad it will ask for a security code. Please inform me if you have make it work. Thanks.. R U from the Philippines? I am from Davao. U can reach me at [email protected]

[Double L]

@ Vili


Great Flash File...

Hope to see more...

Thanks...

More Power...:)

[<M457>]

Hi Vili,
congratulation for your work!:D
Can you explain us how did you do this?

ThankS !

-=)(M457)(=-

[mirsal]

every body show he knows how to do that but nobody show us how he did that ......

[Juan2k]

Compare the Joxx flash 3310-557 with security code to a clean one with the same ppm packs i think language pack B.

then you'll notice the 32b910 which is pointed at MCU-PPM freespace, you disregard the 3 and replace it with 1 coz.

31b910 - 200000 = 11b910 <== u go to this address

you'll notice it has another pointer that jumps a little more i think 32b91c.

if u want to transfer it to Fade flash by g3gg0 just paste all the difference. just dont forget it must be free FFFF

pointers must be changed if you transfer it to other location incase the location is taken or not free.

btw: include the <<genolite>>.......etc. <<genolite2>> code

find it below the freespace include it to be pasted to fading light flash

i'll write a small tutorial if u don't catch this coz i don't have any reference now just giving the idea.

[mirsal]

OK Juan2k ..... good help please keep on

[imoi]

thanks man for the fls.

this place is the best in the net. keep the gud work men!

[diego]

good work but can you make it better- it really doesn'T SECURE THE INBOX COZ' when msgs received , just press READ and immediately go to inbox w/o pressing the password. good luck and keep the goodwork.

[theremoids]

@Juan2k... thanks! any idea how to do that on a 62xx?
@diego... you can use joox's file:
http://www.tech-productions.de/nokia/3310_5.57_Joox_Code.zip

[Juan2k]

in that case it is different on 6210, coz 3310 is the phreakers phone of the year.

BTW: this is orignally made by "Joxx" so credits goes to him not ours, maybe he's just to silly to give idea how to do it or maybe he wanted us to learn.

[Juan2k]

I think it is better if we transfer the jumps to unlock keys to make it have keylock code like others phone, better coz received message can't be read bypassing the security, oh and unwanted call too, only one thing can remove the battery. haha

[kristoffer]

thanks.. nice job... can you tell me what to put in the mcu-ppm and where exactly will i put to have security code... in the messages?

[gkagg]

@Villi

Buddy your flash file seems to have a bug!

When I enter inbox, after having given the code, and then press up or down arrow the phone hungs up for some time and then restarts.

Any ideas for fixing this bug?

THX

[Vili]

@gkagg

Thanx for your information.

Now the bug is fixed, the hex value in the menu header which tells the number of the menus was bad, i have fixed it and now it works. :)


www.finokia.cjb.net (http://www.finokia.cjb.net)

[gkagg]

Originally posted by gkagg
@Villi

Buddy your flash file seems to have a bug!

When I enter inbox, after having given the code, and then press up or down arrow the phone hungs up for some time and then restarts.

Any ideas for fixing this bug?

THX

THX buddy keep up the good work...:)

[markaidestine]

@Villi,

do u have a 3310 v5.79 fls files with message security code or its better if u could help me how to do it? I tried to put the 2 codes coming from joox files (found between the mcu & ppm space) to 3310 5.79 flash files, but the results... the text menu disappear and everytime i enter the security code in message it hangs, please HELP! thanks and merry christmas!

[Vili]

Originally posted by markaidestine
@Villi,

do u have a 3310 v5.79 fls files with message security code

You can get it from my site (http://www.finokia.cjb.net) :D

Merry Christmass !

And once againg thanx to Joox for this great invention.

[Double L]

Hi Vili,

Nice work man. Can you teach me how to add the fading light to your 3310v5.79 fls file w/ msg security code. Its nice to have it both in the new version.

I know you can help me. Thanks.:)

[ryan_chong]

Originally posted by Double L
Hi Vili,

Nice work man. Can you teach me how to add the fading light to your 3310v5.79 fls file w/ msg security code. Its nice to have it both in the new version.

I know you can help me. Thanks.:)


Yep,i oso wanted to know...btw,i'm still learning bout this...hope that there's easier tutorial..:)

Thanks a lot...

[prasert]

I have one question, how to did fading light effect.if possible you will make tutorial or tell me where offset and code to replace.
Sorry for my Eng.

[KnokKnok]

For fading light and secondary code, you have to study the;

1. joox code file
2. fading light file
3. villi's file

just use hexworkshop and you can get it all (offsets and hex)
just copy and paste.

Give it a try. (Got it already)
Hope this will help.

[Swiftie]

N e 1 caring to help me INSERT the fading lights on Project Z's 8210 flash file! :rolleyes:
Been askin for help from time!
Already opened the file wit a Hex Editor but dun kno wot & where 2 patch.

So n e help or guidance would be gratefully appreciated!!

Brgs

[prasert]

Where can i download fading file, if someone have it let me know how to i download. (I want to know fading light effect only) Thank.
regards.

[THE-MATRIX]

@ prasert

H e R e (http://g3gg0.dyndns.org/~geggo/nokia/flash/3310_fade.fls)

Or...

check out g3gg0's post for more Details... (http://nokiafree.org/forums/t9918/s.html)


Greeeeeeetz :D

[domsat]

Originally posted by Juan2k
Compare the Joxx flash 3310-557 with security code to a clean one with the same ppm packs i think language pack B.

then you'll notice the 32b910 which is pointed at MCU-PPM freespace, you disregard the 3 and replace it with 1 coz.

31b910 - 200000 = 11b910 <== u go to this address

you'll notice it has another pointer that jumps a little more i think 32b91c.

if u want to transfer it to Fade flash by g3gg0 just paste all the difference. just dont forget it must be free FFFF

pointers must be changed if you transfer it to other location incase the location is taken or not free.

btw: include the <<genolite>>.......etc. <<genolite2>> code

find it below the freespace include it to be pasted to fading light flash

i'll write a small tutorial if u don't catch this coz i don't have any reference now just giving the idea.

Thanks, bai!

[Vili]

Hi

I only insert g3gg0´s faidin leds efect fron his flash to my 3310´s flash file, I dont made faiding efect. Many thanks to g3gg0! :)

In 5.57 file you can see the g3gg0s slideshow by pressing *#123#.

I dono yet how to inser faiding efect to 5.79 file, but i tried to find it out.

Just compare files whit hexworkshop you will find the differences....

[markaidestine]

Originally posted by Vili


You can get it from my site (http://www.geocities.com/veijavi/3310/) :D

Merry Christmass !

And once againg thanx to Joox for this great invention.

THANKS! do u have a languange F version of this? i tried to change the ppm with F but i got contact service!

And hope u dont mind, can u tell us what and where are those codes from ur flash files can we see the difference from a clean flash files of 3310v579? because i tried to find the difference in hexworkshop, i just got dizzy and the only thing that i notice is the code after the mcu space and its pointers... please help i really want to learn it, thanks again!

[prasert]

Thank The-Metrix for your help. if you have good way please post
in this thread.
Regards.
Prasert.

[fadi79]

Can we use the same mothed (security code on inbox) to add security code when unlocking the keypad? i.e like 3410 and 6250?

Thanks..

[hooi76]

very interesting

[Vili]

Originally posted by markaidestine


THANKS! do u have a languange F version of this? i tried to change the ppm with F but i got contact service!


Hi

Here (http://www.finokia.cjb.net) is the 5.79 file with ppm f.

And now 3210´s 6.00 file too with inbox sec.code


:D

[kid_rock]

Originally posted by Vili


Hi

Here (http://www.geocities.com/veijavi/flash/3310/) is the 5.79 file with ppm f.

And now 3210´s 6.00 file too with inbox sec.code

3210_6.00_inbox sec.code (http://geocities.com/veijavi/flash/3210/)

:D

How about the inbox sec.code and fading LED on 3210? and also for 8210...........

Thanks in advance!!!

[mykill]

hello guys

does anyone of you have
already the flash file for
3210 with security code
if you open the inbox?

pleas.....

[Vili]

hello


I have made one 8210´s file with inbox sec.code, i have not tested it because i dont have 8210.
Can someone be so nice and test it and post the results to me.
http://www.finokia.cjb.net

Thanx

[imoi]

None of this links is working.

Attachment is the best

[ryan_chong]

@Vili

Hi there..Juz downloaded ur 8210 fls files.Will let u know later...
Thanks!:)

[ryan_chong]

@Vili

The zip files r corrupted...:(
Hope u can upload it again...:)

Thanks...

[Finn]

Vili about your website..as you can see my nickname is Finn.
your webpage is named finnokia.cjb.net
could you change it? i dont want to be misunderstood.
my page is up www.geocities.com/finn2k1
i am asking for a favour

[Vili]

Originally posted by Finn
Vili about your website..as you can see my nickname is Finn.
your webpage is named finnokia.cjb.net
could you change it? i dont want to be misunderstood.
my page is up www.geocities.com/finn2k1
i am asking for a favour

ok, no problem i can change it. I named my site finnokia because i´m from Finland, but i can find another name. :)

[Vili]

@ryan_chong
The zip file is correct, try download it againg. :D

Btw. does enyone knows what is wrong, every time when i tried to attach file in my post i get a error like this:
There seems to have been a slight problem with the Nokia Flash Reverse Electronic Engineering database.:D

[kid_rock]

Hello Villi, 3210 with inbox sec.code i encounterded auto restart....

i fix checksum on g3n0lite 1.6 but not working....

Need help!!!

thanks....

[markaidestine]

hey villi thanks a lot to your 3310v579 F languange..... how about if ill give u my modified flash files, can u put a security code on its message menu? just asking.... THANKS AGAIN!!

[ryan_chong]

@Vili

Ok,i'll try it;)
]
Thanks!

[2tz]

i tried pasting hex code found on G3GG0's fading LED to a mod flash file, and found that much of the area b/w mcu & ppm is utilized, what if i want to add start tone and want it longer than 20bytes, can i make use of the other FFFF areas(i.e. the after dumfile)?

or is it just a dumb question?:confused:

2tz

@vili: thanks a lot man!!!
@juan2K: mabuhay ka kabayan!!
@g3gg0;joox;Nokdoc & other PRJZ team : Incomparable Geniuses!!!! More power!!!

[<M457>]

hi Vili,

how did you find routine for security code check?

byezZzZ

-=)(M457)(=-

[markaidestine]

@ villi,
hey man, how can i put the security code of 3310v579F in outbox coz its really annoying opening ur inbox with sec code and we usually save our important message in outbox..... can u help me place it in the OUTBOX, i think i just need to change the pointer using the hexworkshop (i guess??), can u tell me how and what to do or if u dont have time to explain it, could you give me a flash files(3310v579F) with OUTBOX security? THANKS MAN and HAPPY NEW YEAR TO YOU!!

[y0ke]

would some be so kind as to make a 3330 4.50 B flash with Inbox security code ? :)

[Brdo]

i suggest that someone writes a tutorial for this, or even better a patcher (but just make the tutorial).. i guess you could make it like you use a program to find the where the address of the pointer for the menu is (i think FLSEdit can do that?) and then build on that? this is fairly important and i suggest joox makes that tool of his to be able to do this.. but i know it is his decision if he does so.

MrBrdo

[DigitalJepoy]

Villi idol! :D thanks man for your innovations on nokia phones, they are superb...and im sorry for what nokia has to say bout your works..anyways, more power man!

[ryan_chong]

Originally posted by Brdo
i suggest that someone writes a tutorial for this, or even better a patcher (but just make the tutorial).. i guess you could make it like you use a program to find the where the address of the pointer for the menu is (i think FLSEdit can do that?) and then build on that? this is fairly important and i suggest joox makes that tool of his to be able to do this.. but i know it is his decision if he does so.

MrBrdo


Yeah mate!You r right!:) I think to learn is better than ask for it!
I'm waiting for the tutorials also....

Thanks a lot....:)

[Vili]

Hi

Here is a little tutorial for how to put sec.code to your outbox menu
Sorry for my poor English, but try to understand.

In this case the file is 3310 5.79 whit ppm A

First of all open your CLEAN file in g3n0lite and watch the outbox line and the phone security line, you will find this:
[0x0031824B] [0x0000001D] (0x0179) (0x05E0) (0x0000) (0x0052) (0x0000) (0x0024) Outbox
[0x00318107] [0x0000004C] (0x0179) (0x05E0) (0x0000) (0x0052) (0x0C00) (0x0024) Phone\x0Asecurity

The second address is some kind function id or something, if it is 0000001D the phone jumps to outbox or if it is 0000004C it jumps to the phone security menu and usually asks sec.code before you can change phone security.

Now you have to change outbox function id 0000001D to 0000004C, but you cant change it in g3n0lite, you have to change it in hexworkshop.
The outbox line which you see in g3n0lite looks in hexworkshop like this 0031824B0000001D017905E00000005200000024

Find this and change 0000001D to 0000004C.
If you now open your file in g3n0lite you can see that the outboxes function id has changed.

Now you have to make another outbox menu to the free space of MCU, the free space starts around the address 12ed30.

REMEMBER that in the phone the start address is 00200000, but in the hexworkshop it is 00000000, so if there is address like this 00317B13 in the flash and if you want to go to that address in hexworkshop you have to change the number 3 to 1.

When you make a new outbox menu you need message menu header, message menu first line(null line or something) and the original outbox line.

The lines in g3n0lite:

Header: [0x0030CDD0] (0x0B) (0x80) (0x0101) [0x00111442]
Null line: [0x0031809B] [0x00000000] (0x0179) (0x00DC) (0x0000) (0x000D) (0x0100) (0x0024) Messages
Outbox line: [0x0031824B] [0x0000001D] (0x0179) (0x05E0) (0x0000) (0x0052) (0x0000) (0x0024) Outbox

Lines in hexworkshop:

0030CDD00B80010100111442
0031809B00000000017900DC0000000D01000024
0031822A00000021017905E00000005204000024

You have to change the headers first address so that is the address where real menu starts ( in front of the null line ) and you have to correct the hex value in the menu header which tells the number of menus, it´s now 0B,correct it to 01.
If you insert the new menu so that it starts at the address 0012ED50, is should look like this: 0032ED5C01800101001114420031809B00000000017900DC0000000D010000240031822A00000021017905E00000005204000024

Now you have to find the hex value, which tells the phone where it jumps to after you have entered the sec.code. Now it´s the address of sec.code on/off menu, but you have to change it so that jumps to your new outbox menu ( to address 0012ED50 ).

Its quite hard to find this hex value, in this case the value is 00328D60, you can find it and replace it whit 0032ED50 (notice that it have to be 0032ED50, NOT 0012ED50 ).

But the real way to find this value is very hard. I used method like this: First export text chunk whit PPM Manager, open the exported txt file and find some text which is in the phone security menu, exp None or Phone, then take the number in front of the word and change it to hex with hexworkshops baseconverter, then insert value 04 in front of it and find it in the flash file, you will maybe find it in many paces, but right is the pace where is other values which starts too with 04. Now watch which is the address of that value and find it ( it is something like this 00XXXXXX ). This what you now fond is the phone security menu, you have to find the header of this menu and the headers address is in this case 00328D60 find this and replace it whit 0032ED50.

Remember to update or kill mcu checksums!


Good luck… :)

Microsoft world version:

[slikmik]

First of all open your CLEAN file in g3n0lite and watch the outbox line and the phone security line, you will find this:
[0x0031824B] [0x0000001D] (0x0179) (0x05E0) (0x0000) (0x0052) (0x0000) (0x0024) Outbox
[0x00318107] [0x0000004C] (0x0179) (0x05E0) (0x0000) (0x0052) (0x0C00) (0x0024) Phone\x0Asecurity

The second address is some kind function id or something, if it is 0000001D the phone jumps to outbox or if it is 0000004C it jumps to the phone security menu and usually asks sec.code before you can change phone security.

Now you have to change outbox function id 0000001D to 0000004C, but you cant change it in g3n0lite, you have to change it in hexworkshop.


-= REGARDING THE ABOVE =-

why cant u just use g3n0lite and write menu? why must it be in hex editor?? :confused:

Great tutorial thank you, could you explain to me please this:

we have a security code chunk at end of mcu ok now the 4C points to it but how??? what similarity is 4C and the start of the security chunk offset?? wheres 4C in hex editor??

please explain

Thanks again and tar for going to the trouble of writing the above!! :D

Mike

[y0ke]

Vili, what you have done with the 3310 flash, can you please do this for 3330 v4.50 B ?
thanks.

[mekme]

Originally posted by Vili


And now 3210´s 6.00 file too with inbox sec.code

3210_6.00_inbox sec.code (http://geocities.com/veijavi/flash/3210/)

:D

hello..
i cant get any network!!
with all others flashfiles it works.. update faid and so..
update faid works on this to.. but it doesnt solve the problem..

autoreboot and no network..

known problem? or only for me?

[DigitalJepoy]

Villi, could you teach me how to put the dim lights and security code on the message menu, not on the inbox or outbox, mainly on the message menu, i find it annoying for people to check out my messages.. and on a clean 3310 flash.virgin...

hoping!

thanks man

DigiPoy :)

[Juan2k]

ok pre! just remember whenever u change the position of something theres always a pointer that points to that function so if it weren't free its fine to place it in other free location.

[belabs]

Originally posted by mekme


hello..
i cant get any network!!
with all others flashfiles it works.. update faid and so..
update faid works on this to.. but it doesnt solve the problem..

autoreboot and no network..

known problem? or only for me?

i encounter the same problem :-<
autoreboot and no network..

but i already moved the security code to the message menu
just read some threads here
try to compare the the original flash file with the vill's flashes using Hex edit
look at the menu codes using g2nOlite
and figure out how it works

it took me 3 sleepless nights to figure it out! hehehe!

[DigitalJepoy]

ganito, i tried replacing the security code (Phone Security) and put it on the message menu, replacing the address of it, except for the last 3 set of hexa, and the first set with the brackets. Thats in g3nolite...so what your saying is that I should use hexaworks to edit the flash? and g3nolite to read the contents of the flash? All I want lang is to have fade lights with sec code on the message menu on a clean 3310 v5.57 flash..all i need is a clear instructions....could you guys help me out? kayo, kabayan, tulungan nyo naman ako... naloloko na ako!:confused: :confused:

Thanks guys!

[Vili]

Hi

Sorry guys the 3210 flash file was bad, but now its correct.
www.finokia.cjb.net (http://www.finokia.cjb.net)

@y0ke
Here (http://www.finokia.cjb.net) is 3330 4.50 B file whit inbox sec.code. :D

[Vili]

Originally posted by slikmik

why cant u just use g3n0lite and write menu? why must it be in hex editor?? :confused:

we have a security code chunk at end of mcu ok now the 4C points to it but how??? what similarity is 4C and the start of the security chunk offset?? wheres 4C in hex editor??

please explain

Mike
Thanx for information, we relly can use g3n0lite. I tryed to change the addreses in g3n0lite very long time ago, but I got some error or something, i dot remember. But to day a tried again and it works.

I correct the tutorial tomorrow when i have more time. :)

I dono what 4C means, maybe g3gg0 or Joox knows.


Originally posted by belabs

it took me 3 sleepless nights to figure it out! hehehe!
This is the right attitude ! :D :D :D

[kid_rock]

Originally posted by Vili
Hi

Sorry guys the 3210 flash file was bad, but now its correct.
http://www.geocities.com/veijavi/flash/3210/3210_600_A_inbox_sec_code.zip

@y0ke
Here (http://www.geocities.com/veijavi/flash/3330/3330_450_B_inbox_sec_code.zip) is 3330 4.50 B file whit inbox sec.code. :D

Thanks!!!

Happy new year!!!!

[belabs]

Originally posted by Vili
Hi

Sorry guys the 3210 flash file was bad, but now its correct.


Yeah!! on my 4th night i try to open Ur flash file in g3n0lite, "Read Menu structure", and without changing it "Write menu Structure", "fix all Checks" i save it and the NO NETWORK is Solved! :-)

[DigitalJepoy]

joox's message menu code with g3ggo's dimlight on 3310 v5.57 (clean).... does anybody have that on one flash? thats what ive been trying to do...

[parot]

3210 page not found......



happy new year to all.......................

[markaidestine]

@ VILLI

thanks to ur tutorial, ur reaaly a great man! I tried ur tutorial last night unfortunately, no success that's why i just want to ask for ur help regarding ur tutorial... when i opened the outbox, it will ask a sec code then after entering the right code it will open to "Write messages" instead of my messages in the outbox, what do u think is the problem, did i miss something in ur instructions?, please help, i really want to learn... THANKS AGAIN and Happy New Year!!

[Finn]

Vili nice work man :)
many thanx for changing your domain :)
Happy new year to everyone

[Vili]

@markaidestine

I think that you have wrong line in your new outbox menu in flashs free space, maybe you have the Write messages line instead of Outbox line.



Happy new year ! :D

[Crux]

hi.
can you email me language pack c 5.79 with portuguese language and light fade and inbox password ?
i would really appreciate.
you are all making a wonderfull job here in the forum. congratulations.

my mail is [email protected]

B gUd!

[no1]

anyone done security codes on the inbox and such on 5210 ?

[y0ke]

thankx vili, much appreciated :D

[nokiafreak_2003]

nice work! hope that outbox security code would be included.
plus the fading light too.
you're great Vili.

[Vili]

Hi guys

I have little problems with my web pages. It says almoust every time "Sorry, this site is temporarily unavailable!"

And geocities help says:
"As a free member, you are only allotted so much data transfer. If your web site is popular or contains many large files, it can exceed the data transfer limit and will be disabled for a short time. Within the hour, your site will be available again."

Does enyone knows is ther any better free web site hosting places than geocities?

I´m quite a new in this web site world:D

[nkresource]

http://www.portland.co.uk/

[Juan2k]

english lang ako ha kc its the rule here, i can give u a flash with the sec. code and fade i have a long time but this is the sense of it all to learn on your own making us all here a knowledgable persons. And VILLI's tutorial is correct in the sense i followed it and it works 100% only that i know it before the tutorial came out but it gives me new ideas the way he do it in his own way.

ok here's a concise tut:

1. compare a clean 3310-557 to joxx sec.code flash
2. you'll find the 32b910
3. copy from address 12b910 untill the first FFFF
4. paste it 2 your new flash with fade if u want it. if not free find another place below it with FFFF.
5. now change the 32b91c to where the new 313a97 ithink just 3 to 4 blocks after it.
6. change the function of message menu [0x000004C] to 4C

save ur flash and thats it
correct me if i miss something

[Juan2k]

i 4got change the 32b910 address pointer the new one in case change of address is done.

[Double L]

@ Juan2k

tol, I found the 32b910 hex value from joox sec.code flash but when i try to locate it to g3gg0 Fade flash it say "the specified search string was not found" do you have any idea why??:confused:

[gardz]

how to create a sec.code inbox in 8250

[Crux]

i would really appreciate if anyone post here a 3310 v 5.57 (or 5.79) with language pack c (with portuguese lang) with security code and light fade.
i have my flash with light fade, but i can't put security code.
P L E E E A S E !!!
my mail is [email protected]
tanks a lot!

B gUd!

[maddog17]

can anyone plz help me on makin a sec. code on my 3410.....

dat guide is quite complex 4 me...........any1 got an easier guide?
thnx!

[Murda_INC]

@Vili

Now i was wondering, do u reckon u cud put the security code thing for the inbox into a 3350 flash file version 5.15 because i have been studying the tutorial and it just doesnt make sense to me,cos it refers to hex workshop, and i just hate hex!

so do u reckon u cud do the security code on inbox for me please to 3350 v5.15? plus, do u know how to add the fading led's? if u do, could you do that for me as well please. i would be very very very greatful

Regards

Murda

[crackhead]

this is sum complicated stuff man!!!!!
i cant get da hang of it!

[gynther]

Are you finnish??? if niin voit vastata tähän kysymykseen eli mulla ois 3330 niin voisitkos tehdä semmoisen flashin siihen että olisi ne feidaavat valot...??? Koska sä varmaankin osaat ku mä taas en oo mikään haka... =( Ja saahan siinä olla se security koodikin... no sen flashin jo löysinkin... mutta jos saisit sinne lisättyä sen... feidaus jutun... jos pystyt niin voin testata sitä jos sulla ei ole 3330 puhelinta... ja voin kertoa sulle sitten täällä että toimiiko vai ei... jos vaan pystyt... If your not then you didnt understand a word... :D :D :D

[nokiafreak_2003]

@vili
can you add message security code on projectZ 3315?:(
what is the offset? or what is value to be changed?
thanks vili :D

[Vili]

Hi

If you have troubles to download file from my geocities site, try this:

http://www.finokia.cjb.net/ (http://www.finokia.cjb.net)

:)

[acezone_dan]

Hiya i also need help with regards doing this to a 3410 any pointer would be a help also which is the best program to use?

thnks dannn

:confused: :confused: :cool: :D :)

[domsat]

Originally posted by theremoids
i've been trying to do this with my 6210... no success.

is there anyone here successful in putting the security code in the 62xx's messages menu?

@thermoids

were you able to succesfully install the security code on 6210's inbox?

@nokdoc

any idea how?

[Vili]

Hi

@acezone_dan

Find hex value 004BF01C in your 3410,s flas, it is the address to where phone jumps after you have entered the sec.code it is the address of sec.code on/off menu´s header. Replace that value with the address of your new menu. The other addresses you can find with g3n0lite.
Hope this helps... :)

I think that the best soft is Hexworkshop.

@gynther

If you want to write finnish please PM or mail to me :(

[syndromtr]

At first,greetings to Vili for the tutorial.
Have already made the security code for inbox
(for 5210)
The file was modified and this is the last step for now.
I'll try to inject fade effect.

I'll upload the 5210 flash file in a few days...And I'll give the offsets.

Have fun...

[theremoids]

Originally posted by domsat

@thermoids

were you able to succesfully install the security code on 6210's inbox?


no... i swapped my 6210 with a 3510 and i've nothing to experiment right now.

[markaidestine]

open the exported txt file and find some text which is in the phone security menu, exp None or Phone, then take the number in front of the word and change it to hex with hexworkshops baseconverter, then insert value 04 in front of it and find it in the flash file, you will maybe find it in many paces, but right is the pace where is other values which starts too with 04. Now watch which is the address of that value and find it ( it is something like this 00XXXXXX ).

@VILLI
can u elaborate more on this part of ur tutorial, i tried it so many times but i really cant get it coz im trying to get it in my 8250? can u tell me the hex value of it in 8250 and how? many thanks again!

[Vili]

Hi

A new 3310 5.79 file with in and out fade (thanx to Al) and inbox sec.code
www.finokia.cjb.net/ (http://www.finokia.cjb.net/)

[Vili]

@markaidestine

Hi here are some addreses and tips

Find this line in Ppm manager: 861 ENGL None
The number is 861, when you convert it to hex it is 035d and when you have inserted 04 in front of it, it is 04035d. When you search it from your flash file you will find it in address 001319ec, If you look a little bit upwards you find this null line 000000000000000000000000012D00DC000000101000001A.
The null lines address is 001319d4
Find this and replase it with the address of your new menu.

Hope this helps a little... ;)

[markaidestine]

Thanks a lot Villi! ill try it, i really learn a lot from you, thank you very much! you are really COOL!! :cool: :cool: :cool:

[markaidestine]

@VILLI

i tried to search the 04035d in 8250v5.06 fls files in Hexworkshop, but it is located @ 00126723 and there was no "000000000000000000000000012D00DC000000101000001A"on the upper part, what ive seen was something like this 04035204035304035404035504035604035704035804035904035A04035B.... Can u help me please, THANKS again!!

[nyo73]

Hi and do excuse me, could I know if it exists some cracks or other to avoid that I have the mini gps expired?
Thanks of everything

Answer me please to mine and.mail

[email protected]

[Vili]

@markaidestine

Sorry i forgot to mention that the addreses is fo 6.00 file. :)

[Finn]

Vili one more time thanx again :)
i was hiting my head to the wall...i couldnt understand how to find the header.
thanx..you saved my life lol

[NokDoc]

Hi,

Mr. Vili, I added one step to Ur text.
I hope U not mind?
=================================
Find this line in Ppm manager: 861 ENGL None

The number is 861, when you convert it to hex it is 035d
Insert 04 in front of it, it is 04035d.

When you search "04035D" in your flash file you will find it at address 00126717

Now add 200000h to this 00126717 (=00326717)

Now find that "00326717" in Ur file.
That is on location 001319A4

If you look at 1319A4, just in front U see this null line
000000000000000000000000012D00DC000000101000001A.

The null lines address is 001319d4

Find this and replace it with the address of your new menu.

Hope this helps a little.

=================================
(this all was originally by Mr. Vili.)

NokDoc

[markaidestine]

Originally posted by Vili
@markaidestine

Sorry i forgot to mention that the addreses is fo 6.00 file. :)

thanks, but how about in version 5.06? how can i find the null line? becoz in v5.06 they have just the same number and text (861 ENGL None), but i cant find that null line when converting it to hex, thank you very much again Mr. Villi hoping for ur response. :)

@ NokDoc
thanks to ur additional information

[w0rf]

little question, this kinda kills your phone security menu then?
or better, you will end up in the inbox/outbox too when you select that option??

[syndromtr]

@ Vili

My question is the same,can we NOT destroy the original phone security menu and add the inbox there?
I think we can find hidden None,Memory,Phone submenus and put them into our new inbox menu.

HF

[Vili]

@syndromtr

Thats good idea... i think that it works. I thing that the other way is to find out some less used function witch asks sec.code, reset call timers or restore factory setings and use it. :)

@markaidestine

If you convert 861 to hex, you will get 035d, add 04 infront of it, you will get 04035d, find this value and.... follow my previous instructions. Hope you will find the null line. :)

@NokDoc

Thanx for your correction :cool:

[DigitalJepoy]

Villi, can you make a 3310 v5.79 message menu sec code..or if you want, can you teach me how to do that? i dont really want it on inbox or outbox, just on the message menu..thanks man!

im using hexworkshop...

[Juan2k]

I know ur reasons my friend

just make ur new menu the message menu instead of inbox menu. To where the sec. code jumps.

patext naman ako sa phone mo. hehe

better if we put it on keylock so it secures even the unwanted callers who picks our phone at home or with friends.

now press * ==> sec. code (get the idea):D

[tcc1982]

i got a easy method to find out the pointer for security code !!
Using hexworkop and search for - 00004387000045E0000005DD
(Hex value). Infront of this number 00xxxxxx
is the pointer jump to security on/off after u key in the security code. Just change that value and point to the new menu which u write at the free space of MCU . I already try on 32xx,33xx,62xx,82xx serial.

[ryan_chong]

@tcc1982

Great method!Gonna try it now!
Thanks!Nice job!:)

[gardz]

pls give me the flsh file 8250 v6.00 w/sec.code

[dragon100]

has anyone got this for a 6210???

please mail it to me if u do

[email protected]

[louisekennedy]

can any one tell me what the security code is for the in box with the flash files 1 says its *#123#but if you try to type that in it will only come up 123 and doesnt work so can any one give me the code?

[Vili]

Hi

Now 3410 4.26 A file available at my site (http://www.finokia.cjb.net)



Originally posted by louisekennedy
can any one tell me what the security code is for the in box with the flash files 1 says its *#123#but if you try to type that in it will only come up 123 and doesnt work so can any one give me the code?

Hi
sec.code is your own sec.code, if you press *#123# in normal mode you can see the g3gg0´s slideshow. :)

@tcc1982

Nice method, good job. That helps alot. :)

[gardz]

can u do it sec.code in 8250

[Swiftie]

Yes plz VILLI! N e chance of having a 8250 file??

Attached is a 8250 SW v6.00 file wit FADING effects already on.
& MCU & FAID checks killed!!

SAVE TARGET AS (http://www.geocities.com/swiftie103/8250_6.00.zip) to get the 8250 file!

Thanx in advance!

More Power 2 u!

Brgs

[Swiftie]

Originally posted by tcc1982
8250 Version 6.00_K inbox with security code
http://www.geocities.com/tcc8221202/

Is this wit SEC CODE on Inbox or Outbox?? Or Menu?

[gardz]

thank you for the 8250 sec.code:cool:

[tcc1982]

Originally posted by Swiftie


Is this wit SEC CODE on Inbox or Outbox?? Or Menu?


Security code on INBOX !!!

[Swiftie]

Thanx m8!! ;)

[gardz]

bad flash file 8250 sec.code error in ppm manager,rolis,and knok

[tcc1982]

i oledi try it , its working !!!
Nvm, i check first !!

[Swiftie]

Tried 2 flash wit ROLIS but get this....

File Size Must Be n*64KB (n=1,2,3...)

Tried 2 FIX all CHECK SUMS, still didn't work.
Tried 2 kill Check Sums & it still didn't work.! :(

Brgs

[THE-MATRIX]

First I want to thank mr.Vili for the nice tutorial he made... Keep up this good work mate :)

I've successfully done the outbox menu with sec code, but there's a lil prob : that after u enter sec code, it won't jump directly to ur Outbox, but u'll go to another outbox menu that don't have a sec code requset & this one will lead u to ur real outbox!

I've tried also to add the Sec code request to messages menu, but with no success at all, I used Vili's tut.. but after I enter the sec code, it turns back to the main menu... I checked the values & pointers & everything was allright..

I hope that som1 could help, that would be much appreciated :)


thanx to u all




greeeeeeeeeeeeeeeeeeeeeetz :grin:

[Finn]

i face a different problem..i am trying to add inbox security code but after inserting the right code it drops me to Phone Security Menu.
y?

[Vili]

Hi

I made one 8250 6.00 K file with inbox sec.code and in and out fade, but i cant test it. Some one who have a 8250 please test it and post results here.

www.finokia.cjb.net (http://www.finokia.cjb.net)

@THE-MATRIX

It´s normal that there is second in or outbox menu, i dono how we can do it so that jumps direct to in or outdox

If you want to add sec.code to messages menu, you can follow my tut, but you have to copy whole messages menu to the flashs free spase instead of the in or outbox menu. :)

@Finn

I thin that your prob is very simple. You have forgot change the the address to were phone jumps after the sec.code, find this 00004387000045E0000005DD and replace the value in front of it with the address of your new menu.
Hope this helps a little bit, but if this is not your problem then we have to think againg. :)

[Finn]

Vili i dont get it at all.. :P
Look..first i change the ID of inbox..Security Level has ID 46.So inbox ID which is 1C must change to 4446 ..right?
Then i create the new inbox menu in the mcu free space.
i am taking the header the null line and the inbox line.
first 4 bytes in header must change according to new location.Also the number of menus must change.from 0A to 01
and inbox line must be the same as original? with original ID (1C) not 4E.right?
i am trying this to 3210 and 8250 5.04

[nonu_don]

Guys??
no one has a working tutorial for implementing security code for inbox or outbox menu in 8210????

plz tell if any one has done so, and also attach your flash file.

Naman

[Finn]

www.finokia.cjb.net
Vili's page has a flash file for 8210

[aRoH]

Mr Vili
I flashed my phone with your new 8250 6.00 K file with inbox sec.code and in/out fade but get Contact Service...:(

P.S:Thanks mr.Vili for this nice tutorial.;) ;) ;)

[gkagg]

Vili I have been trying to download http://www.sunpoint.net/~veijavi/3310/3310_557_a_inbox_sec_code_faiding_leds.zip but I always receive the following error:
Sorry the page cannot be found!
The page does not exist on Sunpoint.net server.

PLS provide a fix... or send the file to [email protected]

[THE-MATRIX]

Originally posted by Vili

@THE-MATRIX

It´s normal that there is second in or outbox menu, i dono how we can do it so that jumps direct to in or outdox

If you want to add sec.code to messages menu, you can follow my tut, but you have to copy whole messages menu to the flashs free spase instead of the in or outbox menu. :)



I already did :roll: !

with no success :(

[gardz]

it works in 8250 6.00 sec.code in inbox there is a slideshow menu after inbox.thanx

[Vili]

Sorry guys,there was a little bug in my 8250 600 file, but now its corect.

some of links in my site was bad, but now everything is corect :grin: :D

@THE-MATRIX
I dono what is wrong in your file, if you attach the file here or send it to me, i can whatc what is wrong. :rolleyes:
[email protected]


Originally posted by Finn
Vili i dont get it at all.. :P
Look..first i change the ID of inbox..Security Level has ID 46.So inbox ID which is 1C must change to 4446 ..right?
Then i create the new inbox menu in the mcu free space.
i am taking the header the null line and the inbox line.
first 4 bytes in header must change according to new location.Also the number of menus must change.from 0A to 01
and inbox line must be the same as original? with original ID (1C) not 4E.right?
i am trying this to 3210 and 8250 5.04

I think that everything else is ok, but you have to replace inbox ID 1C with 46, not with 4446.
Hope this helps a little...

[acezone_dan]

@ aRoH


hiya you need to update the faid and reset the factory settings using a program like eeprom tools or knock 95
hope this helps

acezone:cool: :cool:

[acezone_dan]

@Vili
_______________________________________________
Find hex value 004BF01C in your 3410,s flas, it is the address
____________________________________________

i can`t find this string with hex workshop please help me thats is there another program i should be useing to read the flash file??

thanks acezone:D :D

[Vili]

@acezone_dan

sorry i forgot to mention that the instructions was to 4.26 file, what version do you have? But in any version just find this hex value 00004387000045E0000005DD and replace the address in front of it with the address of your new menu. (Thanx to tcc1982 for this great method) :)

[Finn]

vili did you read my previous post about 8250 sec code?

[aRoH]

@acezone_dan

Thank you very much Mr acezone_dan for your help.
Now everything is ok...:D :D :D

[Vili]

Originally posted by Finn
vili did you read my previous post about 8250 sec code?

Yes i think, that one in the previous page, watch few post up, i think that there is the answer. :rolleyes:

[User32]

why is it so necessary to create another menu? what if we change the function id and then change the jump target of the sec.code-taken function after we enter the code?

[Finn]

you didnt get it..
vili changed the address where security menu jumps..but it has to jump somewhere..not over a cliff :PP
but to a new inbox menu in order to open the received messages..

[battouter]

is there a flash file for this compatible for a 5110 v5.30??? where can i get it?

[Vinny]

You can do it by yourself :)

example for 5110 5.30

[0x002ABA94] (0x0A) (0x10) (0x0101) [0x0010B602]
# --------------
[0x00000000] [0x00000000] [0x00000000] (0x0043) (0x00DC) (0x0000) (0x000C) (0x0100) (0x0000)
[0x002A4BF4] [0x00000000] [0x002ABB70] (0x0034) (0x0387) (0x0000) (0x0032) (0x0000) (0x0000) Messages
[0x002ABB7C] (0x06) (0x80) (0x0101) [0x00000000]
# --------------
[0x002A4BF4] [0x00000000] [0x00000000] (0x0043) (0x00DC) (0x0000) (0x000C) (0x0100) (0x0000) Messages
[0x002A4D83] [0x00000000] [0x0000001F] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0400) (0x0000) Write messages
[0x002A4D50] [0x00000000] [0x0000001C] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Inbox
[0x002A4DA1] [0x00000000] [0x0000001B] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Outbox
[0x002A4D9E] [0x00000000] [0x00000021] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Message settings
[0x002A474A] [0x00000000] [0x00000025] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0800) (0x0000) Info service
[0x002A4F54] [0x00000000] [0x00000029] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0400) (0x0000) Voice mailbox number
# --------------
[0x002A4C3C] [0x00000000] [0x00000000] (0x0033) (0x02C9) (0x0000) (0x0032) (0x0000) (0x0000) Phone book
[0x002A46BD] [0x00000000] [0x002ABC08] (0x0035) (0x0387) (0x0000) (0x0032) (0x0000) (0x0000) Call register
[0x002ABC14] (0x07) (0x80) (0x0101) [0x00000000]
# --------------
.
.
.
[0x002A4C42] [0x00000000] [0x0000003C] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0C00) (0x0000) Phone security

Well on my experience here's what i did:

1. I used g3n0lite 1.7b to rewrite the Menu structure (shown above) so that when i press menu, messages is next then write message then relocated Phonebook after messages.
2. After writing the menu back, killing mcu/faidcheck, and saving it, i used hexworkshop to look for the following at the new menu structure that g3n0lite created:
002A4BF4002ABB70003403870000003200000000 which is the "Messages"
then changed it according to the phone security:
002A4C420000003C004305E0000000450C000000
so that it would be
002A4BF40000003C003405E00000003200000000
in short replaced Messages 3rd and 5th [] with Phone Security's 3rd and 5th []

3. Then i search for the first occurance of the "Messsage" header [0x0029FBB8] (0x06) (0x80) (0x0101) [0x00000000] shown as 0029FBB80680010100000000 then recorded its start address (the one at 0029...)

4. Then searched for 00004387000045E0000005DD then replaced the address before it with the recorded address at step 3

That's it there was no need to create a new Message menu. So that whenever i enter the Messages, I am asked for the security code.

Hope this helps :D

[Guntcha]

How to add sec.code protection on 3310-5.79 when unlocking keys ?

[Vili]

Hi

@User32

I think that it is possible if we use some other function which uses sec.code and starts some function automaticaly after you have entered sec.code.

@Finn

Sorry, i dont get your point. Im not so good at english, please can you explain little more. :(

[ggho5t_200sx]

This might have already been metioned above (but I couldn't see it posted anywhere) but has anyone tested the 8210 flash file with inbox security code from Vili's site because I have tried it and whenever I enter the inbox (after entering the correct security code) the phone just reboots and goes back to the main screen. Anyone know why this would happen? Could someone post another 8210 flash file with security code on the inbox or outbox?

[westy]

anyone got 1 of these files for a 5510? (english)

[Coopz]

@Vinny

Just a thought, It would be a good idea to replace the Hex value for the 'Select' button to a 'Back' button so it stops the backdoor into the Message menu from the phone security menu.

Example from my 3330:

[0x00401C5E] [0x00000000] [0x003F2318] (0x0178) (0x0387) (0x0000) (0x0054) (0x0C00) (0x0020) Security level

Changed to:

[0x00401C5E] [0x00000000] [0x003F2318] (0x0178) (0x0387) (0x0000) (0x0067) (0x0C00) (0x0020) Security level

Apart from that it works great!

Regards,
Coopz

[nonu_don]

Originally posted by Finn
www.finokia.cjb.net
Vili's page has a flash file for 8210


i have that file, it doesnt works,, hangs when we enter the correct security code.

and next i want the tutorial and not the modified file.

Naman

[Vinny]

@Coopz
nice idea thanks :) Its not actually a backdoor since it still asks for the security code when selected, but it will be useless now that it has been redirected to messages and its a great idea to change the select to back :) ( or better yet remove/hide/skip the phone security option by adjusting the addresses)

Nice work!

[THE-MATRIX]

Originally posted by Vinny
You can do it by yourself :)

example for 5110 5.30

[0x002ABA94] (0x0A) (0x10) (0x0101) [0x0010B602]
# --------------
[0x00000000] [0x00000000] [0x00000000] (0x0043) (0x00DC) (0x0000) (0x000C) (0x0100) (0x0000)
[0x002A4BF4] [0x00000000] [0x002ABB70] (0x0034) (0x0387) (0x0000) (0x0032) (0x0000) (0x0000) Messages
[0x002ABB7C] (0x06) (0x80) (0x0101) [0x00000000]
# --------------
[0x002A4BF4] [0x00000000] [0x00000000] (0x0043) (0x00DC) (0x0000) (0x000C) (0x0100) (0x0000) Messages
[0x002A4D83] [0x00000000] [0x0000001F] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0400) (0x0000) Write messages
[0x002A4D50] [0x00000000] [0x0000001C] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Inbox
[0x002A4DA1] [0x00000000] [0x0000001B] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Outbox
[0x002A4D9E] [0x00000000] [0x00000021] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Message settings
[0x002A474A] [0x00000000] [0x00000025] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0800) (0x0000) Info service
[0x002A4F54] [0x00000000] [0x00000029] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0400) (0x0000) Voice mailbox number
# --------------
[0x002A4C3C] [0x00000000] [0x00000000] (0x0033) (0x02C9) (0x0000) (0x0032) (0x0000) (0x0000) Phone book
[0x002A46BD] [0x00000000] [0x002ABC08] (0x0035) (0x0387) (0x0000) (0x0032) (0x0000) (0x0000) Call register
[0x002ABC14] (0x07) (0x80) (0x0101) [0x00000000]
# --------------
.
.
.
[0x002A4C42] [0x00000000] [0x0000003C] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0C00) (0x0000) Phone security

Well on my experience here's what i did:

1. I used g3n0lite 1.7b to rewrite the Menu structure (shown above) so that when i press menu, messages is next then write message then relocated Phonebook after messages.
2. After writing the menu back, killing mcu/faidcheck, and saving it, i used hexworkshop to look for the following at the new menu structure that g3n0lite created:
002A4BF4002ABB70003403870000003200000000 which is the "Messages"
then changed it according to the phone security:
002A4C420000003C004305E0000000450C000000
so that it would be
002A4BF40000003C003405E00000003200000000
in short replaced Messages 3rd and 5th [] with Phone Security's 3rd and 5th []

3. Then i search for the first occurance of the "Messsage" header [0x0029FBB8] (0x06) (0x80) (0x0101) [0x00000000] shown as 0029FBB80680010100000000 then recorded its start address (the one at 0029...)

4. Then searched for 00004387000045E0000005DD then replaced the address before it with the recorded address at step 3

That's it there was no need to create a new Message menu. So that whenever i enter the Messages, I am asked for the security code.

Hope this helps :D


this worked perfect on my 3310 v 5.79


u're Gr8 :)




Greeeeeeeeeeeeeeeeetz :grin:

[Coopz]

@ Vinny

I moved some values which i guess i shouldnt have so when I went to Security Level it jumped straight to message menu, I didnt think about deleting the entry, then again it was 1am. I have since deleted the entry, works well thanx.

Cheers,
Coopz

[acezone_dan]

i have version 4.09 so if you cold give that code it would be a gr8 help

thanks very much acezone_dan

[slikmik]

why do u all search for the hex in hex editor why not change directly from g3n0lite

quite a bit easier guys... :rolleyes:

Mike

[User32]

Because it doesn't change! I've tried it. You try it too and see.

[slikmik]

ok dont shout.

Well it works fine for me :) - what version are you using?

g3n0lite 1.6 i use just read, edit, write and wham simple :)

or latest g3n0lite 0.9g as sometimes this works where 1.6 doesnt

Mike

p.s. Always wondered why this post says use hex editor - i think you must have had an old version of g3n0lite (??) as all the ones i have tested work fine by direc editing of menu struct

[User32]

i'm using v1.7


no, the oldest ver i've used is 1.6. v1.7b had a problem...
i wonder why g3gg0 removed the capability of having full control of the menu (according to you) ...

[slikmik]

well belive me it works, 1.7 works too!

May be your flash not got enough MCU space - increase it see if then u can directly edit structure

Mike

[eleoson]

can anyone please post a tested 6150 P5.23 flash file with sec code
or just email it to me: [email protected].

I can add sec code but i don't have 6150 to test it ;(

[User32]

i have plenty of space (how am i supposed to increase it?). that's not the problem. why do all say to use a hex editor?
i've tried it using g3n0lite and it doesn't work.

[domsat]

Originally posted by tcc1982
i got a easy method to find out the pointer for security code !!
Using hexworkop and search for - 00004387000045E0000005DD
(Hex value). Infront of this number 00xxxxxx
is the pointer jump to security on/off after u key in the security code. Just change that value and point to the new menu which u write at the free space of MCU . I already try on 32xx,33xx,62xx,82xx serial.

1)What is this Hex value, the program for on/off security code?

2)Do you know the Hex value of the unlocking of the keyguard lock? To modify my question, do you know the offsets of unlocking the keyguard lock?

Thanks.

[slikmik]

Originally posted by User32
i have plenty of space (how am i supposed to increase it?). that's not the problem. why do all say to use a hex editor?
i've tried it using g3n0lite and it doesn't work.

Well then u must be DOING IT WRONG... simple

So instead of saying how it aint working play about and im sure you'll figure it out but take it from me and EVERY ONE ELSE it works in g3n0lite

Mike

[markaidestine]

============================================
3. Then i search for the first occurance of the "Messsage" header [0x0029FBB8] (0x06) (0x80) (0x0101) [0x00000000] shown as 0029FBB80680010100000000 then recorded its start address (the one at 0029...)

=============================================

@ Vinny,
pal how can i search for the first occurance of the message header, where did u get IT? i cant find it in your sample address of 5110 or i just didnt notice it? THANKS!

[domsat]

1) get the offsets of unlocking the keyguard lock.
2) place the 4C on the 7th and the 8th position of the hex value
3) look for free space and write the changed Hex value. don't
forget to note the start offset of the free space.
4) find 00004387000045E0000005DD in Hex Workshop and
change the 6 characters before this value with the offsets of
the free space + 200000.
5) save and fix checksums.

Please note:

1) that this procedure is just a theory and not tested (because
I still don't know the offsets of unlocking the keyguard lock)
2) am not so sure if inserting 4C really invokes the security code

Nokdoc, can you help us?

Anyone, can you comment?

Thanks.

[demon_head]

@vili

the 3310 files with security code at your site, could this be flash to a 3310 but upgraded to 3315 without losing the 3315 features? or we should edit a clean 3315 fls file and edit it?

thnx

[slikmik]

3310 = 3315 mate so dont matter only 1 tinsey wincey ickle tiny tidgey bit of the eepeom is different - PROFILE BIT 30 from 0 to 1

Mike

[demon_head]

thnx mate:grin:

[Vinny]

@ markaidestine

Use g3nolite to get this.

In my example :
.
.
.
[0x002A4BF4] [0x00000000] [0x002ABB70] (0x0034) (0x0387) (0x0000) (0x0032) (0x0000) (0x0000) Messages
[0x002ABB7C] (0x06) (0x80) (0x0101) [0x00000000]
# --------------
[0x002A4BF4] [0x00000000] [0x00000000] (0x0043) (0x00DC) (0x0000) (0x000C) (0x0100) (0x0000) Messages
[0x002A4D83] [0x00000000] [0x0000001F] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0400) (0x0000) Write messages
[0x002A4D50] [0x00000000] [0x0000001C] (0x0043) (0x05E0) (0x0000) (0x0045) (0x0000) (0x0000) Inbox

.
.
.
the bolded yellow part is message header. the 002abb7c points to the 002a4bf4 and the 06 is how many submenus it contained.

Hope this helps

:)

[set]

@ Vinny


your tut on message menu w/ security code method works 100% on my 3310v5.57... I dindnt even touch a single bit on my free space.. thnx 4 d enlightenment...

[nonu_don]

anyone??? tutorial for implimenting security code in inbox/outbox for 8210 or 8250

Naman

[gardz]

can i convert 3330 to 3315 with your flsh file with sec.code

[markaidestine]

@ vinny
thanks to ur reply pal

[Murda_INC]

@Gardz
I dont think that it is possible due to the memory chip size etc etc etc so i think the answer to ur questionis.NO

[theremoids]

@gardz...
convert a 3330 to 3315 first...
then just flash the 3315 with sec code flash file at 400000.

[gardz]

thank u

[Vinny]

Glad this helps :)

Also, if you'd like you can remove the Phone Security option so that there will be no confusion, but remember to decrease the Security Settings header and submenu counter by 1.

I also did this:

Put all Menus and submenus under a new Menu (by Adding +ADD_TEXT) then put the security code there so that when pressing menu, there will be no other menus but my self made menu with sec code, upon entering the right sec code, it goes to the usual menus, else goes back to the self made menu.

Hope this helps.


:D

[User32]

if we add sec. code to message composer, there is a way to access without security code: edit an inbox/outbox msg.

[gardz]

there is a bug in 3310_557F bec when i press the "have i nice day" message in inbox.Like in 8250 theres no bug when in when i press the have a nice day its good the slideshow come out

[Finn]

I tried Vili's method for 5210 but when i press the right code phone restarts..anyone tried this and had the same problem?

[b0rg3]

Originally posted by DigitalJepoy
ganito, i tried replacing the security code (Phone Security) and put it on the message menu, replacing the address of it, except for the last 3 set of hexa, and the first set with the brackets. Thats in g3nolite...so what your saying is that I should use hexaworks to edit the flash? and g3nolite to read the contents of the flash? All I want lang is to have fade lights with sec code on the message menu on a clean 3310 v5.57 flash..all i need is a clear instructions....could you guys help me out? kayo, kabayan, tulungan nyo naman ako... naloloko na ako!:confused: :confused:

Thanks guys!

kabayan, pareho tayo. i've been into this sec code thing since last year.. di ko pa rin makuha... but at least i've learned some little things...

[b0rg3]

Originally posted by nokiafreak_2003
@vili
can you add message security code on projectZ 3315?:(
what is the offset? or what is value to be changed?
thanks vili :D

man, try doing it yourself... baka akalain nila mga tamad tayong mga pilipino... besides, you've got a lot of kabayan here who you can ask for help.

[Vinny]

ok ok. ganito po. here's a detailed/expanded tutorialinstruction and notes on how to manually put security code on message menu, btw there already exists a software that can do this. :)


1. Using g3n0lite, open the flash file you are going to use
2. Click on Menu Structure and click on the textbox on Language
3. Type in the language you like, for example ENGL
4. Click on Read Menustructure

at this time you will see the menu structure of the flash you've selected. Since at this time we are only concerned on creating a new table for the menus, we simply

5. Click on Write Menustructure
6. Click on Save and save it to a filename of your choice

Note: After each click on step 5 together with step 4 a new table is created and hence wasting mcu space. Also each new table will now have different offsets.

for example clicking on step 4 then on step 5 might give you the following:

# checking given ROOT-entry..

# ... seems to be okay
#

#

[0x0032C5E4] (0x0F) (0x10) (0x0101) [0x001113EE]
# --------------
[0x00000000] [0x00000000] [0x00000000] (0x0175) (0x00DC) (0x0000) (0x000D) (0x0100) (0x0024)
[0x00313A67] [0x00000000] [0x0032C724] (0x0057) (0x0387) (0x0000) (0x003E) (0x0000) (0x0014) Messages
[0x0032C730] (0x0B) (0x80) (0x0101) [0x001113F6]

And if you clicked on step 4 then on step 5 again, you might get the following:

[0x0032E0D4] (0x0F) (0x10) (0x0101) [0x001113EE]
# --------------
[0x00000000] [0x00000000] [0x00000000] (0x0175) (0x00DC) (0x0000) (0x000D) (0x0100) (0x0024)
[0x00313A67] [0x00000000] [0x0032E214] (0x0057) (0x0387) (0x0000) (0x003E) (0x0000) (0x0014) Messages
[0x0032E220] (0x0B) (0x80) (0x0101) [0x001113F6]


So in order for us to get the correct offset, please don't take the said note forgranted.

7. After saving the file, do not close g3n0lite yet, instead repeat step 4 so that you can have a reference. Open the file you just saved with Hex Workshop. Referencing to your menustructure at g3n0lite, look for the first Message line and the Phone Security line.

ex.

[0x00313A67] [0x00000000] [0x0032E214] (0x0057) (0x0387) (0x0000) (0x003E) (0x0000) (0x0014) Messages
[0x0032C730] (0x0B) (0x80) (0x0101) [0x001113F6]
.
.
.
[0x00313AD3] [0x00000000] [0x0000004C] (0x0175) (0x05E0) (0x0000) (0x0052) (0x0C00) (0x0024) Phone security

8. In Hex Workshop look for the last occurance of the hex value of the 3rd bracketed offset of the first Message line. for example the greened portion below but look for it in hex value and without the 0x

00313A670032E214005703870000003E00000014

9. After getting step 8, replace it with the 3rd bracketed offset of the Phone Security and also replace the 5th part of the first Message line with the 5th part of Phone Security. for example the illustrated Message line above + the illustrated Phone Security line above = the illustration below

00313A670000004C005705E00000003E00000014

ok now the above line will now point to the Phone Security code. But we're not done yet, if we use just the above line, entering messages with the right code will just redirect you to on and off (may vary) of the Phone Security. What we're after is when we enter the message menu, after entering correct code, goes to the usual message menu. To do this we'll need to make it jump to where we want it to jump when we enter the correct code, which is in this case, the usual Message Submenus. The next step is exactly how we'll achieve that.

10. Search for the last occurance of the offset of the message header and take note of its hex offset. The message header is the one below the First message line as shown on the tomato colored offset above step 8. For example:
search for the last occurance of 0032C730, in hex workshop you'll see the offset at the status bar which is located at the lower center of the screen which says Offset: such as Offset: 0012C724 now take note of this offset.

11. Search for the hex value 00004387000045E0000005DD after finding it replace the offset in front of it with the offset+00200000 noted at step 10.

example :

noted offset:
0012C724

add 00200000

0012C724
+
00200000
--------
0032C724

find: 00004387000045E0000005DD

found:
00325AF000004387000045E0000005DD

replace with:
0032C72400004387000045E0000005DD

12. Save the file

13. Verify with g3n0lite. Open the file with g3n0lite, read its menustructure, you should see that the submenus for messages is now hidden. ( for better result, kill cs/faid, fix checksum before flashing ;) )

That's it.

Hope this helps.

[dluik]

Amazing work!!!!!

Unfortunately flash for 8210 from:
http://www.finokia.cjb.net/

is faulty. phone works fine and full signal but as soon as you enter in correct security code at the inbox the phone freezes and resets.

Any chance of fixing this bug PLEASE

regards

Dan

[NokDoc]

Mr. Vinny,

Just a Thank U.

U do great stuff for alot of guys out here.

NokDoc

[gonzales]

Vinny

Can you tel me for insert sec.code for inbox in nokia 6150 P523, i try but not work.

[Vinny]

ok. if you're just going to put security code to your inbox, use Villi's guide. you can find it at http://www.finokia.cjb.net/

:)

[dluik]

Has anyone else tested the 8210 flash from vinney's site? Is it just me that is having problems with it?

thanks

Dan

[newcasper]

I am sorry I am not expert in hex editing so I thought it would be easier if I made it with programs such as seccode and sectone
but after flashing the file I found that I can normally open messages and inbox but when I am trying to open security level and after I put the right security code I found that the mob freezes and restarts
did I make it in a wrong way?
or may be there is no free space in mcu?
as I said I am not expert in hex editing .......... so how can I know if there is free space or not ....... and if there is free space ....... is it siutable for adding these values?
and if there is not free space ........can I add more free space?

[mikejumanan]

Vinny,

can you help me put a security code on phonebook menu of 3310?
or is would this be possible?

[DigitalJepoy]

thanks vinny....

[Vinny]

@dluik

that's not my site.. that Villi's site :)

@newcasper

you can use flsedit or ppmedit to check for free space in mcu and ppm area. and yes you can add free space in the mcu area but this too needs hexediting know-how.,

[newcasper]

I faced the same problem while I was trying to add new menu with g3nolite and it was solved by reserving some ppm space
can I do it with g3nolite ?
I have hex workshop 4 but I my information in it is not very good but I know how to find and replace values but the problem is that all people speak about 3310 but I have 6110 :o

[set]

when you see a line in g3n0lite, it has brackets and braces that enclose the values. try removing the brackets, braces, 0x, and the second bracket with 0x000000. use the find function in hex workshop to find your edited line in g3nolite... there should be an exact match.. all you have to do is replace values.:)

[sandra02]

anyone successful in putting sec code to unlock the keypad.

now press * ==> sec. code (get it)

[domsat]

Originally posted by sandra02
anyone successful in putting sec code to unlock the keypad.

now press * ==> sec. code (get it)

Sandy;
been waiting also for this one...so far, no one has given feedback yet...it's still worth waiting...

anyone out there? Yohoooo!!!

[User32]

maybe there will be an option in a newer version from nokia... who knows?

[wendela]

anyone knows the offsets of "1 message received" and "%N messages received"

coz if we will change the pointers for these two to "phone security," we may be
able to eliminate the bug of flashes with inbox sec code that bypasses the inbox
whenever there are new messages are received.

[wendela]

anyone knows the offsets of "1 message received" and "%N messages received"

coz if we will change the pointers for these two to "phone security," we may be
able to eliminate the bug of flashes with inbox sec code that bypasses the inbox
whenever there are new messages are received.

[luN]

Can this be done with a 5210?
i don't think i see any sec menu offsets when i open my flash file with genolite... only the messages menu offsets..
can anyone help??

[ericser]

Hello Vili, the 8210 inbox security code flash file got problem... after we entered the security code and press ok, no respond at all...

[Nick_214]

Originally posted by markaidestine
Thanks a lot Villi! ill try it, i really learn a lot from you, thank you very much! you are really COOL!! :cool: :cool: :cool:
Hi villi I think I need ur help if u dont mind how to make a security to my inbox 3390v7.14. I find this line in the text 894 Phone security and I convert it to hex 037E. after this can u please tell me what is the next move.thanks

regards nick

[Nick_214]

Originally posted by Vili
@acezone_dan

sorry i forgot to mention that the instructions was to 4.26 file, what version do you have? But in any version just find this hex value 00004387000045E0000005DD and replace the address in front of it with the address of your new menu. (Thanx to tcc1982 for this great method) :)

Vili can you help me about security inbox. I follow ur tuturial how 2 put a inbox security but my problem is when I put my security jump me to Inbox but he can't read the message in my inbox. so do you have any idea what is the problem . anyway my flash is 3390v7.14 hope to hear from u soon thanks.

regards nick

[Jimmy Lim]

Vili can you help me about security inbox. can you give me a clearly tuturial how 2 put a inbox security hope hear from u soon thanks.