Dead wlan due to erased eeprom? *SOLVED* - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

Needed tools:
PuTTY ver.6 or above
Plink
Active Sync 4.5
any Hex editor
MTTY1.exe ver 1.11a
Windows PC
SPL 2.30 Olipro
SPL 1.01 MFG pack
SPL 1.10 Oli w/custom RUU
SPL 1.04 w/custom RUU
DUTTY'S Good .NB Tool
Win Rar
Hermes with working wlan
There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.
Steps for Working Wlan Device:
You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)
then use DUTTY'S Good .NB Tool...
http://forum.xda-developers.com/showthread.php?t=296311
...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)
Download PuTTY and Plink and copy them into your C:\Windows\Temp folder
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
Put your device in bootloader mode and disable USB connections in Active Sync
Connect to the PC and open PuTTY
Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...
http://forum.xda-developers.com/download.php?id=9864
... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.
Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.
Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.
Go to START/RUN/CMD
This opens a DOS window. Change directories to C:\Temp and type the following:
plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)
Now type the following and hit ENTER (once) after each command:
task 32
password 0000000000000000 (that's 16 zeros)
set 1e 1
rbmc me.txt 500a0000 40000
that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.
When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.
Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:
In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".
You now have the eeprom flash file to be transfered to the non working device...
Steps for Non-working Wlan Device:
Using the methods on MrVanx's downgrading SPL page...
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG
Read the full instructions before flashing.
Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.
Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt
Now type the following:
task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000
Hitting ENTER after each command.
When it's done, close MTTY and reboot your device and verify that your Wlan is now working...
Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)
BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:
plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800
watch your file grow to 128 MB.
If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...
Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.
Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.
*NOTE* Olipro just posted later in this thread
"just to point out guys;
to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"
another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...
Member alakentu has translated this method into Spanish. The thread is here:
http://forum.xda-developers.com/showthread.php?t=364751
***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***
For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.

---

cool !! I try this if i found a phone with no dead wlan

---

nice.........

---

It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.

---

Would it be possible for someone to extract the eeprom file from a working wlan device, "zero-out" the MAC address portion, or replace with 'FF' or some other 'dummy' value, and post this here, so those of us without access to a working device can use to flash our damaged devices?
By "blanking-out" the MAC address in the attached file, you dont risk having your MAC address used by everybody, so there is no "legal" risk, and help us without a working device to fix ours...
Thanks for the solution guys and hopefully you can post the file here for us to use.
Good work !!

---

Thank you very much for this solution !!!! Great job!
But as said chrisvor, could you post an extract of a working Eeprom for thoose who don't have one please...
Thank you !

---

drummer,
first of all is to say thanks to you all who put in their time and effort in resolving this problem
so my question is... can you post the file of working wlan bit for us, without that i can't solve this problem... =(

---

Thanks!!!
Thank you so much for this!!!!
I will try to reviving my X01HT WiFi later!
Great Job!!!!

---

Someone has repaired his hermes ??

---

nicoebra said:
Someone has repaired his hermes ??
Click to expand...
Click to collapse
I did. And so did Laikos. Actually, he fixed his about 20 minutes before I did, he is a better editor than I am. Why do you think we did the research? We both had devices with non-working wlans, and now they're working again.
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.

---

laikos said:
It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.
Click to expand...
Click to collapse
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...

---

pop20032004 said:
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...
Click to expand...
Click to collapse
How did you come to that conclusion?
All Laikos was suggesting, is you could type in the data, rather than replace the data by "cloning" it from another's device. Once you know the offsets, which you do if you read this technique, it's quite easy, although time consuming. So far, each file we have examined have had the identical wlan signatures, and identical first three numbers of the MAC address. That suggests that HTC was assigned a set of MAC addresses by OUI for their use.
BTW, using SPL 2.30 oli, you can change your backup CID, and model number (Hermes 100, 200, 300, or whatever you want to change it to like "Hermes 911").

---

Help
I believe that would be better than someone give the instructions detailed for those that they do not have other device to the hand to extract the EEPROM, extract your corrupt EEPROM and edit it.
In my case, live in Mexico city and these devices are extremely rare of seeing by here.
As soon as if someone can help me to obtain the file of a EEPROM will be I thanked what is.

---

Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
i can't edit file " herm1.nb"
you can guide again or help me to edit my file.

---

Hello,
Is it normal that my file herm1.nb is rained large that 30Mo at the time of that creation, thank you.
-------------
Edit:I excuse myself I have to make an error the first handling, I succeeded in having the file herm1.nb has 256 Ko (262 ' 439 bytes).
If I do not modify the mac address that you it will occur on the other apparatus, thank you

---

drummer10630 said:
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.
Click to expand...
Click to collapse
@drummer10630: I do appreciate all your and Laikos efforts to solve this problem and to let the whole community know the method so everybody can fix their devices... however, the reason I asked if anybody could post the file was not a sign of "laziness", rather it is due to the lack of friends who have a TyTN or who want to void their warranty by flashing a non-official bootloader in order to "do me the favor" of extracting their eeprom data.
If any of you guys have extracted the eeprom and you have edited it to include your MAC address, could you please edit a COPY of this file, put "FF" in all the bytes of the MAC address (which is the only thing that "ties" this file to your purchased device and hence yourself), and post it here for us "tytn-friend-less" people to use?
Many thanks for EVERYBODY's efforts in solving this
Thanks and kudos go to Pof and Oli ofcourse, due to whom none of this would be ever possible !!
Chris

---

I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?

---

jrp said:
I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?
Click to expand...
Click to collapse
According to the #1 post, you HAVE TO follow the instructions, i.e. downgrading to SPL 1.04, 1.01 MFG, Olipro 2.30, in order to save the eprom from the working device.... no shortcut I'm afraid

---

I removed the lines 00000000-00000140
But I do not have information with the line 0001F850 and 0001F860 is this normal? , thank you.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

Quick question.... Could I dump the WLAN eeprom from a Wizard? Dont think so, but I thought I'd ask since I have a wizard lying around too....