|
Papers |
Hacking the Motorola E815Please notify me of any corrections or suggested additions 
Jonathan A. Zdziarski
Do NOT email me with questions about your phone, or this page will disappear again. [ v710 Info Page | v710/e815 Handset Review | SMIL GW ] Revision History 7/18/2005 - Added How-To for Suspending Handset (instead of using PST) 7/18/2005 - Added 6F/7, 71/5,6,7, 72/0,1,2 GPS Menu Options 7/17/2005 - E815 Page CreatedAbout the Motorola E815 The Motorola E815 is Verizon's first EVDO-Capable handset, capable of viewing Verizon VCast's (streaming video). Its predecessor was the Motorola v710 which, in spite of some nice features, was crippled beyond reason. The E815 is a "new and improved" version of the v710, delivering many of the features users expected to see in its predecessor. It also supports many hidden and locked features the v710 originally didn't, including the Bluetooth OBEX (Object Exchange) service. We'll talk about how to enable some of these hidden features by editing the "seem". What is a seem? The Motorola E815 has what its hardware hackers refer to as a seem. A seem is a portion of nonvolatile memory, usually small in size, containing operational data and parameters. Typical modern Motorola phones include a seem, although they are usually slightly different between manufacturer chipsets. The Motorola E815 has 9,000 (0x2328) unique master seem records, but only really a half dozen that are interesting. Because the information a seem holds cannot typically be altered directly through the handset, specialized software and a USB data cable is required to perform "mods", or modifications. How-To Step 0: To get set up for seem editing, you'll first need a Motorola USB data cable and some software. YOU CANNOT MODIFY A SEEM THROUGH BLUETOOTH. A Motorola USB cable can be purchased for anywhere between $10-$25 on eBay. I highly recommend you buy the OEM cable which includes a port to connect the AC adapter to. If you hose your handset, you may be able to recover if you have one of these cables, as the handset's interfaces are active when the handset is off and charging. On top of this, you'll need the following software:
P2K Seem Once you have all of this software installed, proceed to step 1. * Special thanks to SuperDaveX for porting and maintaining P2K Seem on the v710 and e815. Step 1: The first thing to do is get the handset recognized by your PC and load the E815 drivers. There are two sets of devices your PC will recognize - one when the E815 is in standard operating mode, and another set of devices (including the Motorola test and command interfaces) when the device is in a suspended diagnostic mode. Attach the E815 to the USB cable and your PC. Windows XP will immediately recognize the handset and prompt you for drivers. When prompted, point Windows at the directory containing them. This will likely be C:\Program Files\Motorola\MotoConnect. Once you have the drivers installed, you must place the phone into 'Suspend Mode'. This brings up Motorola's diagnostic interfaces and allows P2K Seem to identify your handset. To do this, type Menu + 0 + HUBME + * (Menu, then 048263*) into the handset. You will be given a prompt for an OpCode. Type in 54* and press OK. The screen will immediately dim. Press the camera button on the outside of your handset to turn the backlight back on, and you should see 'SUCCEED'. Your handset is now suspended - DO NOT CLOSE THE FLIP! You may now be prompted to install additional Motorola drivers. There will be a total of four or five different drivers to install. NOTE: If you are planning on using your E815 on a Macintosh, this is all fine and dandy (the OBEX mod does work on Mac), but you will need to make these initial modifications on a PC. Once you've set up your USB drivers, you're ready to start modding seem data. The P2K Seem tool transfers seem data to/from your handset. In order to use the tool at any time, you'll first need to put your handset into the proper diagnostic mode. Just follow the above instructions. When you close the flip or power cycle the handset, the phone will be returned to normal operating mode. You should hear one USB device disconnect and three more connect. Now fire up the P2K Seem tool. You should see "Connected" at the bottom. If you don't, try disconnecting and reconnecting the handset from the USB cable, or as a last resort try powering down the handset and re-initiating a suspend. Step 2 Once connected, newer versions of P2K Seem will already be configured to download seem 41A, which is the feature seem of the Motorola v710 (the E815's crippled kid sister). Change 41A to 2742, which is the correct value for the E815. (Strangely, 0x41A + 0x2328 = 0x2742). Change the Bytes field from 7A to 90. Before you do any modding, you want to back up your original handset's seem (incase you really screw something up). To do this, click 'Read from Phone'. You should see the data window populate with some data. Now click 'Save to File' and save this in a folder somewhere. Step 3 This is where the fun begins. You can use the seem 2742 chart below to determine which features you want to enable/disable. Simply locate the correct byte in the file and click on it. For example, if you want to edit byte 6A, count from "60". Hexadecimal counts in this order: 0 1 2 3 4 5 6 7 8 9 A B C D E F. When you click on the byte, you'll see a list of "bits" underneath the data window. Each bit is a tiny little switch inside the handset. You can "turn on" or "turn off" whichever switches correspond to features you want to activate/deactivate. Step 4 Once you have finished screwing around, you might want to save your new modded seem to disk; make sure you save it as a different filename from the original. Finally, when you're ready, click 'Save to Phone' and the new data will be written. You will need to restart your phone for the changes to take effect. It's recommended that you yank the battery just to be sure nothing attempts to write to that memory area on shutdown. NOTE: If you've used ##DIALUP to enable dialup networking on the E815, you may need to re-enable it after making your seem edit. What if I hose my phone? If you have the USB cable with a charge port, you should be able to recover from most problems, although SuperDaveX did recently find a way to hose his v710 beyond repair. The E815 interfaces are alive when the phone is off and charging, so if you hose the phone perform these steps:
Isolating Bits I thought it might make sense to write a small How-To for isolating feature bits. This is the process of identifying which offsets and bits affect what features. It's actually quite simple. DISCLAIMER: This could really hose your phone.
Seem Mapping Table The following table represents seem elements which have been discovered and tested on the E815.
Other Hacks Enable Dialup-Networking To enable the Bluetooth DUN (Dialup-Networking) profile, punch ##DIALUP into your handset. Modded Web Browsing If you would like browse the web without using Verizon's web service, you can actually change your home page by downloading a file named WebSession from the handset's root (/) directory and hex-editing it. You will need a program called BitPIM to do this. First, you should go into the handset's "setup" menu (Menu + 0 + 73887 + *) and create a new Web Session. Call it 'Public Proxy' or whatever you like, and get IP/Port info from http://www.publicproxyservers.com. You'll also want to mark it as the default session so that it will be used whenever your browser loads. Once created, install BitPIM, choose "Other CDMA Phone" from preferences and 'auto' for the device's port, then go to "View | File System". Download WebSession and use somethinglike XVI32 to hex-edit the http://homepage portion of the file to whatever home page you would like to use (You are welcome to use mine). Then, just overwrite the old file and restart your phone. Use Your own PIX Server Use an alternative MMS server to send multimedia to your friends or yourself. See http://www.nuclearelephant.com/projects/smilgw/ OpCode Interface Opcode Interface: Menu + 0 + HUBME + * 54* to put phone into suspend mode. See for other opcodes. |
|
|