Added Ringtones, now what?

[NokDoc]

Hi,

I added the Ringtone block of a 6210-408 inside a 3310-513B.

It's ok, but I can't calc the MCU&PPM checksum so the phone resets once in 30 sec.

Funny thing, I can hear 71 but it should be 98 however it's more as the standard 35.
The texts are unreadable, tested fact. reset, no result.
The sounds are ok, only I don't know which is what.

Does anyone know how to solve this calculation, these last four bytes?
Or shall I reflash the phone to normal again.

NokDoc

[Doc]

Hi NokDoc!

Can u provide me with just some more info?
I wanna focus on that...

Doc

[o_MAST]

At the moment we can't edit a 3310 ppm 5.XX. Only 4.XX.
I have tried to add ONE ringtones in 5.13 ppm b and then I've edited IndexNumber in crescent order. After this I have recalculated checksums, flash in the phone and cac faid with rolis and box. But it still no network... /n/images/smiles/icon_frown.gif((

Bye

o_MAST

[NokDoc]

Hi Mr. Doc

What's for info?
I assume not about the cutting & pasting or the ringtone format, It' simple job in hexedit, just replaced the 'whole' tone block to avoid seperate PPM chunk calc errors.
There's enough free space available for thousands of rings, only I wanted to see how a certain Rintone was called inside the (MCU) procedure(-s).
The fact that it sees at least more as the original satisfies my expections already.
I'm thinking some bigger, this whole PPM manipilating thing can be done on all other PPM chunk data blocks too in sort of same way too.

If only the calc:
For the calculation of faid number, the last four bytes (PPM Checksum?) are required as input.
Most of te proggies who has facility to calc faid uses this 4 bytes or a database of known values, however none of these proggies can actually calc it. (do they?)
And there's my problem, if incorrect value there > incorrect Faid.

In my opinion there's 3 major MCU and/ or PPM Checksums important if changing bytes:

-MCU Checksum, calced over MCU. (2 bytes, Located at begin 22h and at the end of flash, next to the PPM Check)
-MCU&PPM Checksum, calced over MCU+PPM, every 2 bytes of the 32. (fchk.c)
(4 bytes, located at begin of flash, 38 or 3C from my head)
-PPM Checksum, calced over whole PPM area or from the loose PPM checksums. (4 bytes, Located at the end of flash)
I mostly assume the first, just swapping two bytes (words) in PPM didn't ever give me any satisfying result!

I hope this all is bit of workable, please do ask if U think I know.
Little note, I have to return the only laptop that works with flasher to the legal owner tonight, sad for me.

NokDoc

[NokDoc]

Mr. o_Mast,

This is a very simple test, no involvements of index numbers or individual ppm checks, only this total PPM_Checksum can or is causing the problem.

Calc faid is not calc PPM total Checksum, see the earlier message.
Can U (or you?) do the PPM total Checksum calc?
I do very much hope so.
I did think like you too but I guess I was fooled by my own thought, I just discovered this proggies manco's when actually doing it.

It's a 5.13 problem?
Nice to know, I read about it in one of you're earlier postings I think.
I'm always a man to doubt these unbased? things.
Don't get me wrong, it's definately nothing personal to anyone, It only helps me for myself.
I always have to prove myself things, otherwise I can't be convinced, I'm a very insecure person in real life too.

However I'm very willing to try the same with my 4.06 version, why not.
Do you also want a copy some later to see if it succeeds out there too?

NokDoc

[NokDoc]

Here's the 3310-406B with the 6210-408 Ringtones.

Good Luck.

NokDoc

[nokiaguru]

Hmmm.
You make it sound so hard.
Its easy, if you use right software.

When i testest smstones i modified what i wanted(at mcu) and let flashtool calc mcu chksum before flashing. It alerts that mcuchksum is wrong.

What is suprising that when i loaded that file that has mcu chksum wrong,
it calced faid correctly anyways.

Sometimes faid remained right even some changes were made.

nokiaguru.gsmsearch.com

[NokDoc]

Hi Mr. NokiaGuru, thanks for reply.

>>You make it sound so hard.
I'm very sorry, it's bit my problem.

- Changing MCU is other thing as PPM!
- MCU Checksum has Nothing to do with Faid calc, it isn't being used!
For U the PPM and it's Checksums wasn't changed, Faid could thus be calced correct based upon correct PPM Checksum.

Within the Faid calc is however data of MCU used but it's for the MCU&PPM calc.
(just 2 in the 32 sequence, the 1/16th risk!)
Also even if Faid is calced correct, the MCU Checksum must be correct, U didn't mention the phone did work.

I hope this was a bit clearer, the next might again be very confusing:

To prove why MCU Checksums aren't involved in the MCU+PPM Checksum:
It's calc starts not at the first 32 (20h) postion but at 64 (40h).
To avoid the MCU Checksum at loc 34 (22) have influence at this calc?
Tell me I drunk too much on that please.

As for now I only want info or calc of total PPM Checksum, none of these others.

I just tested this new kNok proggy, it intents to have this facility but I didn't succeed on both 513 & 406 files.
It did give me pleasure now to do things with the string 'Contact Service', I already got bored on it.
The original PPM checks at least had a working result.

NokDoc

[Doc]

Hi NokDoc!

You say that you wanna focus on the "contact service" thing...
Do u use a reassembler or just fighting with the bits and
bytes?
It#s a good idea to check the original PPM-checksum routines.
But I fear they will be done from DSP ROM.

Otherwise you were right. I dont wanna know about the ringtone
changing stuff.. Just the checksums r interesting to me.

Doc

ps.: Sorry for my abbrev. like u=you and 2=to b=be anc c=see
I got used to it more than I ever wanted :-/

[NokDoc]

Hi again.

The whole ringtone @!#$ doesn't interrest me too.
The "contact service" thing was my abbrev. for the screen I was looking at whole day, I've done about 25 dissapointing flashings+calcs I guess.

So I only want info or calc of total PPM Checksum.
It's the bigger sense, the PPM Checksum is required for all (structural) PPM changes.

And because the dissassembling is bit beyond my level I use the good old fashion hex editor like U.

>>But I fear they will be done from DSP ROM.
Once there was a time, not so long ago, the people thought the same about Faid....
Then the Wizzard came and...

NokDoc

[NokDoc]

Wow, I've been censured.

NokDoc

[Liam]

So how to we get tones on the phone without it restarting?

I tried this on 4.xx versions of 3310 and it still resets after 30 secs even after calculating the FAID.

[Doc]

Hi NokDoc!

The first bytes of MCU seem to be some kind of ID for each
phone.

The first lword (4bytes) is always 20610fxx
where xx depends on the phone type.
7fh = 6210, 6ah=51x0/61x0, 59h = 7110

some locations r always the same as i can see (word at
36h=2000h and on the 6130s and 6150s I have the flashes here
the word at 38h is always the same (242bh for 6130 and
2435h for 6150 but this might be the MCU checksum. Just strange because they are different version and should have different checksum then.

From 56h the data is "random".
Maybe these researches r a bit prehistoric but i just started
and unluckily I did not find any useable disassembler for
the flash data. And there must be some instruction code for sure!

Doc

p.s.: If u need those flash-files let me know and i#ll send
them to you.

[NokDoc]

Hi Mr. Doc.

Are U familiar with the ARM Dissassembler?
I can't make much of it myself yet but since U have interrest in it check the www.arm.com (http://www.arm.com) or goto Ldrill 's site at geocities somewhere.

Select Case F1(MCUSt + &H1) 'set hardware.
Case &H60: TStr = "8 byte Flash, 8 byte Ram"
Case &H61: TStr = "16 byte Flash, 8 byte Ram"
Case &H65: TStr = "16 byte byte Flash, 16 byte Ram"
Case Else: TStr = "Unknown Flash/Ram Size"
End Select

Select Case F1(MCUSt + &H4) 'hardware def of VPP, Flash Size etc.
Case &H2: QStr = "5110, 6110"
Case &H4: QStr = "5130"
Case &H5: QStr = "3310, 8850, 8890"
Case &H6: QStr = "3210, 8210"
Case &H7: QStr = "6210"
Case &H8: QStr = "3330"
Case Else: QStr = "Unknown, I don't have flashfile"
End Select

000001-000002 *Flash/RAM Sizes: 610F (61: 16 byte Flash, 8 byte Ram)
000003-000004 *Hardware Def.: 6A02 (02: 51xx, 61xx)
000005-000007 Unkn aaa2: 920013
000008-000021 always FFFF: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000022-000023 MCU CheckSum1: 4592 (Calced: 4592)
000024-000026 MCU Field Start: 200024
000027-000029 MCU Field End: 2AFFFF
00002A-000037 MCU Unknown 2: FFFFFFFFFFFFFFFFFFFFFFFFFFFF
000038-00003B Flash CheckSum1: BCA9CAD7
00003C-00003F MCU Base: 002AAC2C
=========================================
093848-093867 MCU Version: V 05.24 03-09-99 NSE-1 (c) NMP.
0AAC2C-0AAC2F InfoBase: 00293848
=========================================

This is also nice to do, only I'm focussed at the PPM right now.
And I have only one spare time to do it all, so....

Nothing is prehistoric, do only think of you're own goals, not the methods, they're irrelevant.
It's a part of the word nFree, just have a good time with you're Nokia.

NokDoc

[nokiaguru]

I used program that is in at my page.

If i change ppm then i use ppm fix.
If i change bot mcu and ppm then i first use ppm fix, then i let flashtool to fix mcu chksum.

If i only change mcu then let also use flashtools mcu fixoperation(witch is automatic).

Then i use mbus faid calculator(why, it only one that i can rely on) with file
that has mcu chksum wrong.

Maybe this cleared some questions.

I might read wrong.I thought you(someone) said that faid is calculated with
ppm and mcu chksums.

Doc, Nokdoc&Liam >have you changed mcu yet?
Find any locations that might be nice to change?
I have changed smstones and alarmclock.


I tried to change emergency number but phone goes confused and must be reseted. Maybe that work on older software. That i used was 5.30 for 8210

[NokDoc]

Hi again Mr. Nokiaguru,

I do know this.
http://gsmsearch.com/nfree/nfreeboard/read.php?f=1&i=5078&t=5078

But You are very right, I never succeeded succesful MCU changing.
And it hurts.


NokDoc

[nokiaguru]

NokDoc
Do you have Nokia flashtool?

With it its easy to change mcu chksums.
Just use hexeditor and flash with flashtool.

I might send modified smstones file at evening.

[nokiaguru]

NokDoc
By the way, what is your phone?

[NokDoc]

Hi Mr. Nokiaguru.

Correction, I did succeed MCU special alert beep changing.
I have 3310, originally 406b but this changes so now and then.

My log of simply changing 2 note numbers inside MCU:

1.Swapping: (+1, -1)
0002FD 0A80 05 02 0A01 5A0C 400C 5A0C 400C
0002FD 0A80 05 02 0A01 590C 400C 5B0C 400C
This works on 3310-406b incl network, not on 3310-513b!

2.Changing: (+1, +1)
0002FD 0A80 05 02 0A01 5A0C 400C 5A0C 400C
0002FD 0A80 05 02 0A01 5B0C 400C 5B0C 400C
This works not on 3310-406b, not on 3310-513b.

I did MCU checksum recalc, placed in 2 locations, crosschecked it in 3 proggies.
Tones in MCU were always sounding correct, so changing can simply be done.
Authorising only succeeded once. (because it had original MCU Checksum?)

NokDoc

[G marsh]

hi guys i have a pro which can add tones to ur nokia 5146 but it has mADE me loses signal can anyone help