How to mod cg36 and modify ezx_flexbit.cfg A780/E680i

[Halftux]

So we have a nice thread in our A780 section. Maybe it is a bit difficult to understand. So i decided to make a step by step tutorial how to change flexbit. However I recognized that some people want to modify firmware so here I give back what I learned from motorolafans.

My source:

A780 Flex Bit List thx to samr7 and all other for the efforts

Flashkit thx to cyph

And here a nice tool but I will describe the procedure without using it to give more info how it works.

flexbit editor for a780/e680 thx to thelord


You dont need to have a Linux system you have your phone

However I will show it for windows and linux.

Your skills: You know how to telnet, what is linloader and you are brave and keen.


Windows


Requirement: flashkit-0.1.zip, cramfs-e680i.zip, linloader

- extract flashkit on mmca1, extract cramfs-e680i.zip, /mmc/mmca1/cramfs

- disconnect cable, set usb mode to modem

- on your phone go to flash card, go in folder flashkit, execute rwflash.lin now you need to wait 1 min because this loads rwflash.o and takes time

- now connect to a pc and execute acmattach.lin

- telnet 169.254.142.2 enter as root without password

- check for read write status (must be unlocked):

cat /proc/rwflash_status

 cd /mmc/mmca1/flashkit
./start.sh

- "./start.sh" this will start a miniroot and the telnet connection ends. (dont unplug the cable!!)

- telnet 169.254.142.2 10000

- "cat /proc/mtd" gives you list of flashable devices

- copy your mtd6/cg36 to flash card

dd if=/dev/mtd6 of=/mmc/mmca1/setup.cramfs

- exit telnet unplug the mobile it will hang so remove the battery and restart

- telnet again to 169.254.142.2

- unpack cramfs with:

cd /mmc/mmca1/cramfs
./cramfsck -x /mmc/mmca1/modcg36/ /mmc/mmca1/setup.cramfs

- cd /mmc/mmca1/modcg36/ and edit the ezx_flexbit.cfg with vi or other editor. Depends on how you like to edit files on your mobile otherwise copy the file to pc

How to edit see at the end or use flexbit editor

- repacking the cg36:

 cd /mmc/mmca1/cramfs
./mkcramfs /mmc/mmca1/cg36/ modsetup.cramfs

- disconnect cable, set usb mode to modem

- on your phone go to flash card, go in folder flashkit, execute rwflash.lin now you need to wait 1 min because this loads rwflash.o and takes time

- now connect to a pc and execute acmattach.lin

- telnet 169.254.142.2 enter as root without password

- "cat /proc/rwflash_status" it must give an unlocked back then it is ready to flash

 cd /mmc/mmca1/flashkit
./start.sh

- "./start.sh" this will start a miniroot and the telnet connection ends. (dont unplug the cable!!)

- telnet 169.254.142.2 10000

- flash your new cg36 with:

cd /mmc/mmca1/flashkit
flashcp -v /mmc/mmca1/cramfs/modsetup.cramfs /dev/mtd6

- wait until ready exit telnet unplug the mobile it will hang so remove the battery and restart



Linux

Requirement: flashkit-0.1.zip, linloader


- extract flashkit on mmca1, extract cramfs-e680i.zip, /mmc/mmca1/cramfs

- disconnect cable, set usb mode to modem

- on your phone go to flash card, go in folder flashkit, execute rwflash.lin now you need to wait 1 min because this loads rwflash.o and takes time

- now connect to a pc and execute acmattach.lin

ifconfig usb0 192.168.1.5 netmask 255.255.255.0 up
telnet 192.168.168.2

- enter as root without password

- check for read write status (must be unlocked):

cat /proc/rwflash_status

 cd /mmc/mmca1/flashkit
./start.sh

- "./start.sh" this will start a miniroot and the telnet connection ends. (dont unplug the cable!!)

- telnet 192.168.168.2 10000

- "cat /proc/mtd" gives you list of flashable devices

- dd command this copy mtd6/cg36 to the flash card

dd if=/dev/mtd6 of=/mmc/mmca1/setup.cramfs

- exit telnet unplug the mobile it will hang so remove the battery and restart

- copy setup.cramfs frome phone to pc

- mount the cramfs, pack it, extract it to a new folder:

mkdir /mnt/setupcg36
mount setup.cramfs /mnt/setupcg36 -t cramfs -o loop
tar zcvf setup.tar.gz /mnt/setupcg36
mkdir /modsetup
cd modsetup
tar zxvf /setup.tar.gz

Now make your changes see below or use flexbit editor

- repack to cramfs with:

mkfs.cramfs setupcg36 modsetup.cramfs

- copy modded file to flash card

- "disconnect cable, set usb mode to modem"

- on your phone go to flash card, go in folder flashkit, execute rwflash.lin now you need to wait 1 min because this loads rwflash.o and takes time

- now connect to a pc and execute acmattach.lin

- telnet 192.168.168.2 enter as root without password

- check for read write status (must be unlocked):

 cat /proc/rwflash_status

 cd /mmc/mmca1/flashkit
./start.sh

- "./start.sh" this will start a miniroot and the telnet connection ends. (dont unplug the cable!!)

- telnet 192.168.168.2 10000

- flash the new cg36 with:

cd /mmc/mmca1/flashkit
flashcp -v /mmc/mmca1/cramfs/modsetup.cramfs /dev/mtd6

- wait until ready exit telnet unplug the mobile it will hang so remove the battery and restart.


How to edit flexbit.cfg


I will explain it with usbnet function:

For the usb net function you need to set bit 0x68 to 1
0x68 is hex and in dec it is 104 is easier to count in dec

ezx_flexbit.cfg in A780 looks for example like this one:

[SYS_FLEX_TABLE]
0 = 1208178625
1 = 2651944960
2 = 2160525571
3 = 1676540
4 = 403917575
5 = 679739392
6 = 0
7 = 0
8 = 2147483648

samr7:"Each line is a base-10 integer representing 32 flex bit locations. The first integer contains flex bits 0-31, the second 32-63, etc.. The most significant bit of the integer represents the first flex bit on the line, the second most significant bit is the second flex bit, etc.. Some lines might be omitted, and default to zero."

The formula to test a flex bit is:
Line = floor(Bit / 32)
BitSet = (Value[Line] & (1 << (31 - (Bit % 32))))

Now calculated binary content of values from lines 0-8 (32bit)

    dec[bit]  hex[address]         binary numbers from values       hex[values]  
0: [   0-31 | 0x0  -0x1f ] 0100 1000 0000 0011 0101 0111 1100 0001 (0x480357c1)
1: [  32-63 | 0x20 -0x3f ] 1001 1110 0001 0001 0111 1000 0000 0000 (0x9e117800)
2: [  64-95 | 0x40 -0x5f ] 1000 0000 1100 0111 0000 0001 0000 0011 (0x80c70103)
3: [ 96-127 | 0x60 -0x7f ] 0000 0000 0001 1001 1001 0100 1111 1100 (0x001994fc)
4: [128-159 | 0x80 -0x9f ] 0001 1000 0001 0011 0100 1011 0000 0111 (0x18134b07)
5: [160-191 | 0xa0 -0xbf ] 0010 1000 1000 0100 0000 0000 0000 0000 (0x28840000)
6: [192-223 | 0xc0 -0xdf ] 0000 0000 0000 0000 0000 0000 0000 0000 (0x00000000)
7: [224-255 | 0xe0 -0xff ] 0000 0000 0000 0000 0000 0000 0000 0000 (0x00000000)
8: [256-287 | 0x100-0x11f] 1000 0000 0000 0000 0000 0000 0000 0000 (0x80000000)

Get hextool from sourceforge

bit 104 is in line 3 and needs to be set to one.

Start hextool and put number from line 3 in the field called dec. See attached pictures.
Line 3 is 96 to 127 so you need to count from left to right.
In hextool its bit 24 push the zero and you get your new dec number: 10065148
Write this number with a unix compatible editor (utf-8, 8bit) to line 3 in ezx_flexbit.cfg
Thats it

other things in cg36 that are for interest:
ezx_system.cfg
ezx_realplayer.cfg
ezx_opera.cfg
ezx_idle.cfg
ezx_fmradio.cfg

No need to flash everytime when you want to try out different configurations.

There are two solutions to move the file to a writeable place. Bind a file from memory or make a symlink into the flash file and put the file on e.g. flash card. Example folder "/mmc/mmca1/.system". So you need to copy your file to this folder.


Method 1:

For the symlink you need to edit the cg with linux not with the phone or you compiled the command.

Go to the folder were your file should be.

ln -s /mmc/mmca1/.system/ezx_flexbit.cfg ezx_flexbit.cfg

Method 2:

For binding a file you need a startup folder/file. You can also mod cg33 first and at a startup folder. Here is the script for your startup file:

if [ -f /mmc/mmca1/.system/ezx_flexbit.cfg ]
then
cp /mmc/mmca1/.system/ezx_flexbit.cfg /tmp/ezx_flexbit.cfg
mount --bind /ram/tmp/ezx_flexbit.cfg /usr/setup/ezx_flexbit.cfg
fi

Now it is easy to make changes, after that only restart.


Good luck and fun with modding.

DISCLAIMER: Use this guide only if you are truly interested in this topic. If you care for warranty and other such things, this guide is not for you.
Always back up your data, and keep it on your computer at all times, in case you need to flash again.
Motorolafans.com cannot be held responsible for any damage that occurs from following this guide. [disclaimer from Konig] anyway i think it's better to put something like that. Don't fear it works..

[Konig]

Awesome work!!!

[sabrod]

If we had a nice thead, now we have the damn good tuto, Very cool from you , man!!!

[Halftux]

I made some edits and added links to needed software in first post....

I collected all bits i found on the net. So no warranty. However i tested several bits and all i tested was working.
I dont know if realy all working for both A780/E680i. My interest was mainly in A780. When you find differences or new flexbit report it please.

General:
0x3F - PST test commands (laforge) start ap_tcmd or not
0x4B - Voice Recognizer
0x91 - p2p Bell sound establishment
0x92 - P2P
0x99 - Motion dream network broadcast
0x9B - SIP Network telephone
0xA2 - Qt application installer (MPKG)
0xAA - WVIMPS IM client (debug)
0x8F - 143rd is 1, row 4 =, in the photographic camera establishment, in the shutter sound appears the static sound the option. Tacitly approves is 0 
0x90 - 144th is 1, row 4 =, after photographs, the picture is shown. Tacitly approves is 0 
0xAD - 173rd is 1, row 5 =, 680i closes the pressed key lock, A780 gathers the lid to press the camera key to be allowed to open the camera the function. Tacitly approves is 0. 
0x100 - controls whether voicenote or vr is launched when the voice button is pressed

Setup:
0x68 - USB Net mode available (AT+MODE=11(cdc), not 99)* I think it depends on firmware.
0x9A - Content Channels available
0xAC - Installs software to have the choice to install "to initialize under", tacitly approves for the memory and the card
0x74 - 116th is 1, row 3 =, the handset accesses the net has "possibly to have to charge the extra telephone conversation fee, continues the" prompt, this prompt which accesses the net for handset Opera, is not the prompt which JAVA accesses the net appears. Tacitly approves is 1 
0xAE - "my procedure" alters to "treasure chest", "browser" alters to "motion dream network"

Opera:
0x6F - Browser Cache
0x7E - "Additional charges may apply" warning on startup
0xA5 - operaOpens the animation