Hacking Verizon's V710

12.22.2004

Purpose

I bought the V710 after having first owned a T720. With the help of yahoo groups I was able to upload wallpapers and ringtones to my hearts content and the phone was what it was intended to be. An extension of my personality. Sounds cliche but whatever.

Now I own the V710 and hacking the phone has proved a challenge.

But I've learned enough to be dangerous.

To date the hardest part of learning this phone has been negotiating all the information out there.

Hopefully this will help.

- posted by dakev @ 21:59 15 comments

What do I need to hack the phone?

1) The USB data cable.

This is the only thing you'll need to pay money for. eBay has them for two bucks. In the forum's there's a lot of discussion on the type of cable... OEM number and all that kind of stuff but I just bought a cheap cable for my T720 and it worked for the V710. I've read, if your cable does not charge the phone when it's plugged into USB port then the cable may not hack the job. In that case I'd suggest finding a genuine Motorola USB data cable at your local Verizon store. We all know they need the money.

Most of the software you'll need can be found here.

2)V710 USB driver

3)PST 6.9 or PST 7.1

4)The PST_uni_patch.exe by mteusz

This must be executed in the same directory where PST is installed.There are several files to patch so keep clicking next until it says finished.

5)The pst_flash.ini file

Also to be placed in the PST install directory.

PST is necessary to flash the phone and use P2Kseem which modify seems.

6) P2Kseem.exe

Use this to alter seems. This is my understanding of a seem. Seems are non-volatile portions of memory in the phone. They hold operating system information like the start-up image when the phone boots. A different seem tells the phone what text to display on the outside LCD screen when the phone is open.

The term non-volatile means the memory does not require electricity to work.

In other words, if the phone runs out of power, it will still know what start up image to use when it eventually does get power. This is because the memory is non-volatile and wont erase when the phone goes dead.

7)Mobile Phone Tools (MPT)

This program is the most user friendly. Use it to upload ringers and wallpapers or to download your movies or pictures.

Note: When you double click this .rar file Winzip will automatically try to add files to the .rar file. You don't want this. You want to extract the files. So right click on the file and select "Extract files...".

I use the USB cable to do all this but but others use the BlueTooth feature of MPT to transfer files.

8)The latest flash (.shx file)

As of this posting, everyone is using 8700_1.02.SD (and.shx file which will be zipped) from superdavex. It can be found here.

9) A full battery. It is wise to have a fully charged phone before flashing it. Mine was never fully charged but others have had problems.

I would suggest you browse Howard Forums and see what's the absolute latest flash everyone is using. More than likely it will be from superdavex. He knows how to edit the .shx file (which is, in my opinion, the holy grail of customizing the phone).

I'm still trying to figure out how to edit the flash but I'm stuck. It doesn't seem easy. I'll focus more on that when I'm finished writing this guide.

Let the hacking begin.

- posted by dakev @ 21:00 11 comments

Flashing & Transferring Files

Here's what you need to do.

First install the V710 USB driver.

Reboot.

Then install PST.

Reboot.

Then run the patch inside the PST directory. Make sure to keep hitting next until it says finished.

Next put the .ini file inside the PST install directory.

Reboot again. (This is probably not necessary but better safe than sorry.)

It is wise to have a fully charged phone before flashing it. Mine was never fully fully charged... but others have had problems.

Plug the USB cable into the phone. Then plug the cable into the computer. When it asks for drivers, point it to the PST directory. You may need to do this several times.

Make sure you have the .shx file (the latest flash) downloaded and unzipped and readily accessible.

Go to the start menu, find Motorola PST and click on Flash and Test Commands.

It should say something like "establishing connection with phone".

In the bottom left hand corner you'll see a field with device, port, and connection. Under that you should see "Motorola P2K, 0, USB". If you don't, unplug the phone and plug it back in.

The software is very finicky. You may need to reboot the computer several times.

Once it connects to the phone, click browse, and find the .shx file.

Click where it says "Motorola P2K" then click device.

It should enable the flash button.

Then click flash.

It's gonna take several minutes.

When it's finished unplug the phone from the cable. Reboot the computer and the phone. This is a very important step. I didn't see the need to do it and it drove me nuts cause MPT wouldn't work.

When in doubt... reboot (both the computer and the phone.)

Install Mobile Phone Tools.

Reboot.

Connect the phone.

Start Mobile Phone Tools. It should do a live update. You may need to reboot again.

Once it's done with the live update you should be able to run MPT and have it connect to your phone.

If it doesn't connect with your phone, click on menu (which is the top middle button on the phone... not the vertical row of buttons on the right side of the phone)

Goto setup, then General Setup, click on the communications tab, then click "change modem..." The device configuration window will come up. Make sure the phone is connected (duh) and click next. Select "Motorola USB modem #2" and click next. Check "Do not automatically detect the driver, select from list." and click next. In device manager select "Motorola CDMA" and in Device model select "Motorola V710m" Make sure you don't choose "Motorola V710". The "m" is important. Click next and then finish. Then click okay. And you should be set. As always, reboot the phone and the computer afterwards if you have problems and try again.

Let me know if this works for you.

Once its running correctly, you can click on the multimedia studio button (on the vertical row of buttons to the right of the phone). This is what you use to transfer files between the computer and phone.

I just use the USB cable but if your computer has Bluetooth, and you activate Bluetooth on the phone, I've read people can transfer files that way too. I haven't tried it so I don't know.

- posted by dakev @ 20:00 18 comments

Seem Editing: An IRC Conversation

If you've got questions about seem editing, this conversation may help. TheSteve from efnet's IRC channel #v710 explained it to me this way.

TheSteve: we'll go over here if thats ok
jmedakev: sure
TheSteve: ok, have you read the help stuff on nuclearelephant?
jmedakev: yes
TheSteve: he explains the bits/bytes
jmedakev: I know the difference
TheSteve: ok
jmedakev: bytes = 8 bits
TheSteve: lets talk about everyones favorite seem first
jmedakev: 41a
TheSteve: 041A with a length of 7A
TheSteve: do you understand the length?
jmedakev: it's a hex number
jmedakev: if I translate the hex number I'll get the decimal number of how long it is
TheSteve: basically the file has a length of 122 bytes
TheSteve: which is 7A in hexidecimal
jmedakev: okay
TheSteve: do you have a hex editor?
TheSteve: only way to edit the seem file
jmedakev: yea
jmedakev: I do
TheSteve: have 041A loaded?
jmedakev: somewhere
jmedakev: gimme a sec
TheSteve: k, load it up, I'll wait
jmedakev: yea
jmedakev: got it
TheSteve: which hex editor are you using?
TheSteve: I use hex workshop myself
jmedakev: is it free?
TheSteve: no
jmedakev: :(
jmedakev: I'm using XVI32
TheSteve: which seem do you have loaded?
jmedakev: I'll e-mail it to you.
TheSteve: ok, its the superdave modded seem
TheSteve: matches perfectly
jmedakev: great.
TheSteve: anyway, we need to pick a specific byte to look at editing
jmedakev: 1d/3
jmedakev: start up animation
TheSteve: ok
jmedakev: If I look at the bottom left part of the XVI32 window, it actually says the hex address. I just keep going right untill it says 1D. Got it. Then I go to Tools and select bit manipulation...
jmedakev: 3 is on
TheSteve: so lets look at the byte at offset 1D
TheSteve: the value of that byte in your seem file is "DA" - do you agree?
jmedakev: yes
TheSteve: ok, now convert DA to binary
TheSteve: 11011010
TheSteve: in general 1 is "on" and 0 is "off"
TheSteve: so each byte can hold 8 little switches to turn things on and off
jmedakev: okay
TheSteve: in the example you picked we need to pick the 5th switch
TheSteve: or "bit" as its really called
TheSteve: here is where it sorta gets weird
jmedakev: k
TheSteve: when counting bits and such you start at 0
jmedakev: I understand that
TheSteve: so for the 8 values there go 7,6,5,4,3,2,1,0
jmedakev: okay... from the right to the left
TheSteve: correct
TheSteve: so in our example bit 3 is turned on
jmedakev: correct
jmedakev: d2
TheSteve: so turned off we would have 11010010
TheSteve: correct, D2
jmedakev: cool
TheSteve: so you change the DA to D2
TheSteve: save the file and program the entire seem back into the phone
jmedakev: I understand by gollie
TheSteve: and thats all there is to it
TheSteve: 041A is all just on/off selections
jmedakev: Okay
jmedakev: thanks
jmedakev: I'm saving this conversation.
TheSteve: anyway, when ya write one let it sit for 10 seconds or so afterwards before disconnecting the cable
jmedakev: okay
TheSteve: then poweroff, wait 5 seconds or so and then power back on
jmedakev: cool
TheSteve: new settings will be there
TheSteve: if phone every gets weird pull the battery to do a full reset
TheSteve: and when programming don't have a zillion things playing
TheSteve: no videos/mp3s etc
TheSteve: just treat it as delicate and you'll have no problems
jmedakev: thanks
jmedakev: I'm saving this conversation.

- posted by dakev @ 19:00 0 comments

Seem Editing: Changing the Outside LCD Text

Other resources on the subject of seem editing can be found on this Howard Forums thread and this page at Nuclear Elephant.

It is also wise to save the original seem to your computer. That way if something goes wrong you can load it back the way it was.

First make sure the USB cable is plugged into the phone and the computer.

Start PST Phone Programmer.

Then start P2Kseem.exe. It should say connected at the bottom left corner of the application.

The thee fields you must concern yourself with are...

Bytes (h)
Seem:
Record:

In the Bytes (h) field put
20

In the Seem: put
449

In the Record: put
1

Click "Load from phone"

Click "Save to file" so you can load it back up (save from file) incase something goes wrong) I would just add "old" to the filename so all you need to do is erase "old" when you put it back. I'm not sure but I think I've read the name of the seem is important when it goes back on the phone.

It will then pull up information in the big window.

It in top right portion you will see something like

V.e.r.i.z.o.n. .
W.i.r.e.l.e.s.s.

Click on the "V" and replace it with one letter that you want. Next click the "e" and replace it. Do this until it says what you want. If you want a space just enter a space.

If you happen to accidentally overwrite one of those periods (as I did) you can't just hit the period key. Notice, for ever letter you change, there's a corresponding (hex) number on the left that changes. Those periods have a (hex) value of 00. (That's zero zero). To fix you're screw up, bring your mouse to the hex value that corresponds to the period. You can only edit one number at a time. So click the first value and hit zero then hit zero again to change the next value to zero.

I hope that makes sense.

If you just hit the period key, the display you want will not be the display you get.

Once you're finished click "Save to phone". Click "Restart phone" and wait a second. When the phone boots back up your outside LCD should be changed.

You can also save the seem to your computer and load it from your computer. Just use the appropriate button.

One thing to note, You must specify the bytes. I don't know why or what happens when you don't... but everything I've read says you have to do it. It's the number of bytes in hex. If you don't know what that means, just make a mental note of it. If you don't know what to put in there than you probably need to find more information before you replace the seem.

Or you could just do it and risk the phone. It's up to you.

- posted by dakev @ 18:00 1 comments

Seem Editing: Changing the Inside LCD Banner

- posted by dakev @ 17:00 2 comments

Deleting Factory Images

More information on this subject can be found here.

If after completing this tutorial, you are unable to access the pictures or ringtone directory check out this thread.

You'll need usbser.sys from this .zip file.

You will also need to download and install bitpim-0.72-setup.exe which can be found here.

First unplug the phone from the computer.

This may differ slightly depending on your operating system. I'm using Windows 2000.

You need to put usbser.sys from the .zip file (p2kman.zip) into this directory...
C:\WINNT\Driver Cache\i386

Now delete the file usber.sys from this directory...
C:\WINNT\system32\drivers

Finally put usbser.sys from the .zip file (p2kman.zip) into this directory...
C:\WINNT\system32\drivers

Reboot the computer.

Plug the phone in. Start bitpim. Go to edit and select settings. Make sure Phone Type is "Other CDMA phone.

All the way to the left of Com Port there is a Browse... button. Click Browse...

Choose the comm port for the Motorola Phone and click OK. Click OK for the BitPim Settings window.

Click on the Filesystem tab.

Click the little plus sign.

It should say retrieving.

Scroll down and click the little plus sign next to motorola. Click the plus sign next to shared then click the plus sign next to picture.

Delete the files you want to go bye bye.

Unplug the phone and reboot it.

When the phone turns on those annoying images that someone on crack must have picked out will be gone.

- posted by dakev @ 16:00 3 comments

Start Up Animation.

There are two start up animations.

1) Hellomoto
2) Verizon's

This tutorial will discuss #2. You must have Bitpim working. Instructions for that can be found in Deleting Factory Images.

This is super easy.

Hook up the phone to the computer. Start Bitpim. Go to Motorola, then Shared, then Picture.

Right click on customer_opening.gif and select Save...

Open that file in ImageReady and use it as your template. I say ImageReady as opposed to Photoshop because it generates animated gif's with a tweening button... and is bundled with Photoshop.

You don't need to worry so much about the file size (although I wouldn't go too large) because this is stored in your phone's RAM.

Here is Verizon's animated .gif

This was my first attempt.

This is what I decided to use.

Point is... you can do just about anything. Just be sure to name it customer_opening.gif and then right click customer_opening.gif in Bitpim and select Overwrite. Point it to the new customer_opening.gif and click open.

Once it's done... reboot the phone. This animation will play after the Hellomoto animation.

Instructions for replacing Hellomoto are on the way.

- posted by dakev @ 15:50 5 comments

Wallpapers... REVISED

Most people are going to make their own wallpapers. It's a cool feature of knowing this phone. And as you may have noticed from the original wallpapers post, I went hog wiled with google.com/images and threw a few together.

Then it came time to use them and I noticed something.

I knew in the back of my head there would be some screen graphics to contend with. But I hid the front icons so I figured it would be fine. Nothing could have prepared me for what I saw. Sponge Bob Square Pants... had no pants!

Note: To hide icons...

1) In the phone menu select settings
2) Select Personalize
3) select Home Screen
4) Select Home Keys
5) Change Icons: to Hide

So I've made a template that you can use to design your wallpapers.

The Photoshop file has the layer built right in.

Or you can use this.

I'm in the process of redesigning the wallpapers I've already posted. I definitely will use this template from now on.

This is the Wallpaper before.

This is the Wallpaper after using the template.

Here's the comparison.

Ladies and gentlemen, I put the pants, in Sponge Bob Square Pants.

- posted by dakev @ 15:00 1 comments

Wallpapers...

Wallpapers are simple. Their dimensions need to be 176 X 220 pixels with 72 dpi (dots per inch). I compress them at medium (30%) and the file sizes are small and look good.

A great resource for finding images is google.com/images

- posted by dakev @ 14:00 1 comments

Creating Ringtones

Everyone has their own method of getting ringtones. Some people use Walmart.com's music store samples. Others use iTunes. I haven't been able to get any of those to work. But I have come up with my own method that works flawlessly.

I'm going to assume you have your own mp3's to play with.

You are going to need this free software...

Winamp
Out Lame plug-in for Winamp
Lame .dll file
mp3DirectCut.exe

Install WinAmp. Unzip Lame and copy the file lame_enc.dll to the WinAmp install directory. Install the Lame plug-in and mp3DirectCut.

Start mp3DirectCut.

Open your mp3.

Now go to settings in the top menu, go to configuration, and click on the operations tab. At the bottom you'll see "Mouse selection method".

Select "Left = set begin / Right = set end".

Click close.

The top half of the window is the wave form of the mp3. The bottom half is navigation and other information.

In the waveform you should see a yellow dotted line moving vertically in the center somewhere. This is the play point. You can't move the play point. You can only move the mp3 around the play point with the slider bar below it.

Find the beginning of your ringtone inside the mp3 and left click there. Find the end and right click. The waveform should highlight.

You can play with the controls on the bottom to make sure your in and out point are correct.

Once you have everything set right you may want to increase the volume. I've noticed that sometimes mp3's save to the phone with low volume. All you have to do is go to settings in the top menu, select MPEG graph level, and select higher. You can do this as many times as you see fit.

Now click file in the top menu, and select "Save selection...".

Now open the file in WinAmp.

In the very top left hand corner of WinAmp there is a little button, click it, select options, then select preferences. Under Plug-ins, select Output. In the right hand screen select Lame MP3 Writer Plug-in then click configure.

For Channels, select mono, then click force. Under Bitrate Mode make sure "Constant BR" is selected and in the Bitrate field I choose 80. Choose the Output Directory so you know where the file will go when it's done then click OK then click close.

When you play the song you wont hear anything because it is converting. After it's done converting you'll find the mp3 in your output directory ready to be transferred to your phone.

- posted by dakev @ 13:00 1 comments

Ringtones...

These are not for download. They are for back up purposes only.

Butterfly
Clocks
Play That Beat
Hella Good
Not Gonna Get Us
Show Me Love
Days Go By
Big Time Sensuality
Call Me
Groove Is In The Heart 1
Groove Is In The Heart 2
Human Behavior
I Want Your Sex
Personal Jesus
World In My Eyes

- posted by dakev @ 12:00 0 comments

Hosed your phone?

You need to manually put the phone in bootloader mode. Here's what to do...

You'll need a Motorola OEM serial cable ($20 bucks on eBay).

Start PST Phone Programmer. Go to Settings, then select PST CONFIG.

In Detection, make sure Manual is selected.

Make sure the com port for your serial connection is selected. You may need to play with this to find the right one.

Click Save.

Close PST.

Now remove the battery from your phone.

Next you'll need to short pin 13 and 14. These pins are on the bottom of the phone... where the cables connect to the phone.

These are the pins on a Motorola v710.

You do this by placing a small wire (32 gauge or so) between the 13 pin and 14 pin on the serial connector. That way the pins will be shorted when you plug it into the phone.

Plug in the serial cable (with pin 13 and 14 shorted with a small wire).

Put the battery back in to the phone.

Hold down the power for a few seconds. (The phone will not appear to power on.)

Start PST Flash and test commands.

You should see a P2K device in the device window in the lower left.

If you don't see the device, select View, then Refresh Connections. If you still don't see the device you may want to start over after selecting a different com port in PST Programmer (one of the first steps of this tutorial).

Select device and the flash button should be enabled.

Make sure you flash with a correctly working flash file.

If all else fails bring the phone back to Verizon.

I brought my hosed phone to the Verizon shop and asked them to try and flash it... that I thought the firmware might be corrupted.

The tech tried to put the phone in bootloader mode through the computer software and determined my problem was with the hardware and switched out the phone.

- posted by dakev @ 11:15 2 comments

Changing the Outside LCD Graphic

Warning! This is very involved. If you screw up your phone... I'm not responsible. I highly suggest you read this tutorial through fully before doing this. Make sure you are clear on all the steps.

Also, you will loose your ringtone settings after the flash.

You will need two programs...

PST which can be found here.

and a program called WinHex

and a flash (.shx) file which can be found here.

Until this endeavour, I've never used WinHex. But I have to say it's really cool. Forensic computer scientists use it to recover data from the bad guys.

First connect the phone to the computer using the USB data cable.

Fire up Motorola PST Flash & Test Commands (the flasher).

Under "File Name" browse to the .shx file. Make sure the .shx file is in a directory all by itself.

In the lower left hand corner you should see "Motorola P2K". Highlight that. It should switch to flash mode.

The field that is in the lower right part of the window has a section called "Status".

Click the "Flash Button".

In the Status field it should say "Creating image file".

Quickly unplug the phone.

You will need to pull the battery, wait a second, put it back in and hold the power button down for 4 seconds to get it to boot.

In the directory where the .shx file was you should now see four new .smg files.

Copy the file 8700_1.02.SDCG1.smg and paste it to a new directory.

Open 8700_1.02.SDCG1.smg in WinHex.

One thing you should know is that ALL (that I know of) .gif's that are embedded in software have a header of...

gif89

and a footer of

003b

I'll explain what this means.

Select "Position" in the top horizontal menu of WinHex. Select "Go To Offset". In the pop up window put...

AAD3E4

This is the hex address for the beginning of the front LCD .gif file (of the "moto" color style).

Look on the left hand side of the window. Those are the ASCII character's. You'll notice the ASCII character that coincides with the hex address AAD3E4 is the G of the gif89 header.

If you search through the file you'll see the end of that .gif file is at hex address...

AAD882 is the 00

AAD883 is the 3b

003b is the signal "This is the end of the .gif"

Any .gif file you replace will follow the header and footer rule.

The header for this image is AAD3E4 and the footer is AAD883

Make sure you understand this as this is how you will replace graphics other than the front LCD graphic. You will find a graphic using the header and footer markers. You will need to know where both the header and footer is (in the .smg file) so you can safely remove and replace them.

Again the gif lives from AAD3E4 to AAD883.

We can only change the bits from AAD3E4 to AAD883. We MUST change ONLY those bits. If you change any other bits you WILL hose yoru phone. This is why special attention must be paid to the file sizes.

Okay. In WinHex highlight AAD3E4 to AAD883. Do this by selecting Edit, then Define Block.

When everything is highlighted correctly, select "Edit" in the top horizontal menu, then select "Copy Block" then select "Into New File".

In the dialog box, name the file whatever.gif and save it where you can find it.

Now open whatever.gif in Photoshop.

The image had dimensions of 96x64 and is 1,668 bytes in size. Do not change the dimensions and the file size MUST be equal to or less than 1,668 bytes. I would go less than just to be safe but that's me.

A dummy trick you probably already know is to right click on the image (in Windows Explorer), select properties, and you'll see exactly how many bytes the image is.

After you have triple checked the file size of your new .gif, open it in WinHex.

On the top horizontal menu of WinHex select edit, then select all.

Next in the top horizontal menu select edit, then copy block, then normal.

Now, go back to your .smg file. (everything should still be highlighted).

Make sure you are at offset AAD3E4.

In the top menu, select edit, then Clipboard Data, then Write.

It will give you a warning dialog box saying it will write at AAD3E4 (which is your header offset). Click okay.

Now make sure it didn't write past offset AAD883

You may want to also notice the 00 3B at the end of your new image.

Save the .smg file in WinHex (don't need to save as).

Okay... you've got your new image in there... now time to put it on the phone.

Plug the phone up to the computer. Run PST flasher.

In the bottom left hand corner select "Motorola P2K". It should switch into flash mode.

In the bottom left of the window there is a field with the label "Status".

Go to the directory with the updated .smg file, select it, and copy it to the clipboard.

Click "Flash".

Under Status it's going to say "Creating image file".

When it's done, it will say "Erasing flash memory".

While it's erasing, go to the directory where the original .shx file is (where the new .smg files are) and paste your updated .smg file. It will give you a confirm file replace warning... just click okay.

After you do all that... PST will continue to flash the phone until you get an error. It will say something like...

Error verifying Code Group 1 checksums. File 0x87A5, Phone 0xBA82

The information you need to know is Phone 0xBa82.

Write that down.

Click okay.

Exit PST Flasher.

Now open the .shx file in WinHex.

Go to Offset 420. (Select position, then goto offset...)

Now look at the checksum you wrote down. The information you want is Ba82.

You are going to switch it around. Put 82 underneath the 0 and Ba underneath the 1.

Save the file.

You'll need to unplug the phone, and pull the battery. Put the battery back in and plug the phone back up. It will be dead. But worry not. You will resurrect it.

Start PST Flasher.

In the bottom left corner select "Motorola P2K" and it will switch into flash mode.

You will again need to paste your updated .smg file into the same directory where the .shx file is, overwriting the .smg file flasher just produced.

Make sure you do this while it says "Erasing flash memory" under "Status".

If it throws you an error, like it's done to me, just start over. Unplug your phone, pull the battery, put it back in, plug the phone back in to the computer, start PST Flasher, Flash, copy .smg while it's erasing and it should work.

When it's finished the phone will automatically reboot. It's going to take several minutes so don't freak out.

When it does eventually turn back on, check out the new front LCD graphic you put in. Oh yea. But don't brag about it at work... they may think your a dork (speaking from personal experience.)

- posted by dakev @ 11:10 4 comments

Part 2: Extracting Images (and other files) From the Flash

This is pretty simple.

Obviously you'll need WinHex to do this stuff.

Open the .smg file in WinHex. SuperDaveX says all the images are in 8700_1.02.SDCG1.smg but I suspect the other .smg's have images in them too.

But for this tutorial, we are going to use 8700_1.02.SDCG1.smg.

Once it's open, in the top horizontal menu of WinHex select Tools, then Disk Tools, then File Recovery by Type...

A warning window will pop up... click okay.

We are going to search for .gif files... but later you can search for anything you may want.

In the Max file size: put 15145552 (the size in bytes of the .smg file).

Specify the output folder.

Check Thorough search...

Check Create subfolder...

Check Ignore errors...

Click okay.

You are going to get a bunch of errors. I don't exactly know why but just hold down the enter key and after a few minutes or so it should be finished.

When it's done you'll have all the extracted .gif's in the output folder.

- posted by dakev @ 11:05 4 comments

Part 3: Finding a Graphic in the Flash

Let's say you want to change the outside LCD graphic for the Midnight color style.

In the first tutorial, I showed you how to change the outside LCD graphic for the Moto color style. I also gave you the hex address where it lived in the .smg file.

In the second tutorial I told you how to extract all the images out of the Flash.

Now I'm going to show you how to find a graphic (once it's been extracted) without knowing the hex address first.

Gotta give credit where credit is due. SuperDaveX told me this is how he finds graphics.

You take the first 50 bit's of the image and search the .smg file (using WinHex of course).

First open your image in WinHex.

Select the first 50 bits or so.

Go to the top horizontal menu, select Edit, select Copy Block, select Hex Values.

Now open your .smg file (there are four of them but so far everything I've needed has been in 8700_1.02.SDCG1.smg).

Now select Search, then Find Hex Values...

Control + v (or paste) the hex values in the field and click okay.

It should find the very beginning of your graphic.

At the bottom center of the screen you'll see Offset: and an address. Write that address down.

Now you want to search for the end of the image the same way.

You need to find the end of your image and copy the last 25 bits or so of the image. (Copy Block -> Hex Values) .

Do this by looking for the hex values of...

003B4749463839

For some reason when you rip these images out of the flash, WinHex pulls way more than it needs. The image ends at 003b right before another image. 4749463839 actually means GIF89
in ASCII.

I replaced a graphic in the flash without knowing the correct ending and actually overwrote a whole bunch of stuff I shouldn't have. Needless to say, the phone was hosed and I had to replace it at Verizon.

I did this by asking the Verizon rep to flash the phone... I thought the firmware might be messed up. He gave me a new phone 15 minutes later.

I didn't tell him I messed up the flash and he didn't ask.

I got a new phone so I wasn't upset. But word to the wise... when you replace graphics in the flash... make absolutly sure you know where it begins and where it ends and only replace the bits inbetween those beggening and ending bits.

In your .smg file, Search -> Find Hex Values, and paste

003B4749463839

in the field. Click okay.

Move your mouse over until you get to 3B of 00 3B (the footer of the .gif) and write that offset: address down.

Now you have your header and footer and can safely extract the image using the method described in Changing the Outside LCD Graphic tutorial.

But what if you don't have the image to begin with?

I heard a rumor that a new tool is coming out soon that will automatically extract images from a flash file. This would be great because you could take images out of modified flashes... where you don't have access to the images to begin with.

Some people released a zip full of images they ripped from original stock flashes. Only problem is I use SuperDaveX's modified flash... and he changed some of the images.

I don't' have access to the outside LCD graphic for the Silver color style because I don't have the original image.

I could search the .smg file for the header gif89 and footer 00 3B... but that's too much work.

I'll wait for the tool.

- posted by dakev @ 11:00 3 comments