msftool -- Motorola Superfile Editor

[evaldas]

RMaybe we should try to upload a SEEM wit all 1's ?

offset 0x..
bit 1 - lock the phone
bit 2 - initialize flash
bit 3 - empty Neptune chip



What about address map? I'm too lazy to read analyze this shx/neptune code. Why it should be different?

btw this is not exactly related to the topic, but I've tried supplying RLD from 74 firmware for flashing 50 firmware and 50th RLD for flashing 74 firmware and it did work.

[samr7]

What about address map? I'm too lazy to read analyze this shx/neptune code. Why it should be different?

The non-RSA Neptune has some map like this:

00000000 - 02000000: Flash containing firmware code
12000000 - ????????: RAM, including ramldr load address

The RSA Neptune is different:

003FD000 - 00400000: RAM where the ramldr goes
10000000 - 12000000: Flash containing firmware code

btw this is not exactly related to the topic, but I've tried supplying RLD from 74 firmware for flashing 50 firmware and 50th RLD for flashing 74 firmware and it did work.

If you mean swapping the AP ramldrs, that might make sense. BP ramldrs are another story. If the address map difference doesn't kill it, the 74 BP ramldr is RSA-signed, and the ROM code on the RSA Neptune enforces correct signatures on both RAM and flash programs.

[obaidi2005]

thanks allot....