Changing the Outside LCD Graphic
Warning! This is very involved. If you screw up your phone... I'm not responsible. I highly suggest you read this tutorial through fully before doing this. Make sure you are clear on all the steps.

Also, you will loose your ringtone settings after the flash.

You will need two programs...

PST which can be found here.

and a program called WinHex

and a flash (.shx) file which can be found here.

Until this endeavour, I've never used WinHex. But I have to say it's really cool. Forensic computer scientists use it to recover data from the bad guys.

First connect the phone to the computer using the USB data cable.

Fire up Motorola PST Flash & Test Commands (the flasher).

Under "File Name" browse to the .shx file. Make sure the .shx file is in a directory all by itself.

In the lower left hand corner you should see "Motorola P2K". Highlight that. It should switch to flash mode.

The field that is in the lower right part of the window has a section called "Status".

Click the "Flash Button".

In the Status field it should say "Creating image file".

Quickly unplug the phone.

You will need to pull the battery, wait a second, put it back in and hold the power button down for 4 seconds to get it to boot.

In the directory where the .shx file was you should now see four new .smg files.

Copy the file 8700_1.02.SDCG1.smg and paste it to a new directory.

Open 8700_1.02.SDCG1.smg in WinHex.

One thing you should know is that ALL (that I know of) .gif's that are embedded in software have a header of...


and a footer of


I'll explain what this means.

Select "Position" in the top horizontal menu of WinHex. Select "Go To Offset". In the pop up window put...


This is the hex address for the beginning of the front LCD .gif file (of the "moto" color style).

Look on the left hand side of the window. Those are the ASCII character's. You'll notice the ASCII character that coincides with the hex address AAD3E4 is the G of the gif89 header.

If you search through the file you'll see the end of that .gif file is at hex address...

AAD882 is the 00

AAD883 is the 3b

003b is the signal "This is the end of the .gif"

Any .gif file you replace will follow the header and footer rule.

The header for this image is AAD3E4 and the footer is AAD883

Make sure you understand this as this is how you will replace graphics other than the front LCD graphic. You will find a graphic using the header and footer markers. You will need to know where both the header and footer is (in the .smg file) so you can safely remove and replace them.

Again the gif lives from AAD3E4 to AAD883.

We can only change the bits from AAD3E4 to AAD883. We MUST change ONLY those bits. If you change any other bits you WILL hose yoru phone. This is why special attention must be paid to the file sizes.

Okay. In WinHex highlight AAD3E4 to AAD883. Do this by selecting Edit, then Define Block.

When everything is highlighted correctly, select "Edit" in the top horizontal menu, then select "Copy Block" then select "Into New File".

In the dialog box, name the file whatever.gif and save it where you can find it.

Now open whatever.gif in Photoshop.

The image had dimensions of 96x64 and is 1,668 bytes in size. Do not change the dimensions and the file size MUST be equal to or less than 1,668 bytes. I would go less than just to be safe but that's me.

A dummy trick you probably already know is to right click on the image (in Windows Explorer), select properties, and you'll see exactly how many bytes the image is.

After you have triple checked the file size of your new .gif, open it in WinHex.

On the top horizontal menu of WinHex select edit, then select all.

Next in the top horizontal menu select edit, then copy block, then normal.

Now, go back to your .smg file. (everything should still be highlighted).

Make sure you are at offset AAD3E4.

In the top menu, select edit, then Clipboard Data, then Write.

It will give you a warning dialog box saying it will write at AAD3E4 (which is your header offset). Click okay.

Now make sure it didn't write past offset AAD883

You may want to also notice the 00 3B at the end of your new image.

Save the .smg file in WinHex (don't need to save as).

Okay... you've got your new image in there... now time to put it on the phone.

Plug the phone up to the computer. Run PST flasher.

In the bottom left hand corner select "Motorola P2K". It should switch into flash mode.

In the bottom left of the window there is a field with the label "Status".

Go to the directory with the updated .smg file, select it, and copy it to the clipboard.

Click "Flash".

Under Status it's going to say "Creating image file".

When it's done, it will say "Erasing flash memory".

While it's erasing, go to the directory where the original .shx file is (where the new .smg files are) and paste your updated .smg file. It will give you a confirm file replace warning... just click okay.

After you do all that... PST will continue to flash the phone until you get an error. It will say something like...

Error verifying Code Group 1 checksums. File 0x87A5, Phone 0xBA82

The information you need to know is Phone 0xBa82.

Write that down.

Click okay.

Exit PST Flasher.

Now open the .shx file in WinHex.

Go to Offset 420. (Select position, then goto offset...)

Now look at the checksum you wrote down. The information you want is Ba82.

You are going to switch it around. Put 82 underneath the 0 and Ba underneath the 1.

Save the file.

You'll need to unplug the phone, and pull the battery. Put the battery back in and plug the phone back up. It will be dead. But worry not. You will resurrect it.

Start PST Flasher.

In the bottom left corner select "Motorola P2K" and it will switch into flash mode.

You will again need to paste your updated .smg file into the same directory where the .shx file is, overwriting the .smg file flasher just produced.

Make sure you do this while it says "Erasing flash memory" under "Status".

If it throws you an error, like it's done to me, just start over. Unplug your phone, pull the battery, put it back in, plug the phone back in to the computer, start PST Flasher, Flash, copy .smg while it's erasing and it should work.

When it's finished the phone will automatically reboot. It's going to take several minutes so don't freak out.

When it does eventually turn back on, check out the new front LCD graphic you put in. Oh yea. But don't brag about it at work... they may think your a dork (speaking from personal experience.)


Thanks a bunch for the effort on the tutorials!

FYI, I believe you have at least one occurance of describing looking for 003_D_ instead of 003_B_ for the end of a gif file. I just happened to be looking at that particlular line when I was playing around in WinHex -- looking for the end of file marker. Made me scratch my head for a minute ;)

Thanks again,
McLaser (HoFo)
Hosed my phone.... Phone bough off E-bay.... Wasted $300.... almost. Spent 2 hours trying to fix it. Be careful when you unplug your phone.
This has been very helpful. Can anyone give me the hex address for the LCD display gif in the Alltel flex? thanks
Great tutorial! Very informative in how well worded and descriptive you were! You know they say that if one knows how to describe what they want really well, then life is just as good as how you describe it :)
Its great for people who feel like time is running against them and then land on your blog and feel like a whole burden was just lifted off of their shoulder.. I admire and respect people who take
time to make it easier for others.. Thanks a bunch! :)
Post a Comment

<< Home

Powered by Blogger