PDA Flash & Unlock

[Willin08]

SEMC PDA phones has two revisions of chips. "NEW" and "OLD".


- "NEW" revision has changed security system and can not be made standalone.

If you have NEW revision of Smart Phones you can do the following:

- Free Flashing (Process PDA update files must not be checked)!

- Flashing with SERVER - It is needed only if you want to Process PDA update files (Change CDA)!!

- Unlock with SERVER (CSCA-based unlock). See this thread for unlocking:
PDA Unlock - Top Sony Forums


- "OLD" revision has just impoved security and can be breached

!!!!!!!!!(NO ANY SERVER IS NEEDED FOR ALL OPERATIONS)!!!!!!!!!!

- UNLOCK
- FLASH
- Update CDA
- Read/Write GDFS
- Rebuild (Change) IMEI

INSTRUCTIONS FOR FLASHING:


1. Download needed firmware package. For example: R3B01_CDA162007_1_ACPU_HE_Generic_World1.zip
NOTE: Do not UnZIP this package,just LOAD IT AS IT IS!!

2. Install drivers for flashing. For that, poweron smartphone in FW update mode.
- for P990/M600 press and hold "@" on TURNED OFF phone, then attach DCU-60.
- for W950 press and hold "C" on TURNED OFF phone, then attach DCU-60.
Windows will ask you for a drivers. Drivers are in setool2\drivers\SmartphoneDrivers directory.


3. Determine security type - press 'Identify':

OLD SECURITY TYPE:

PLEASE IGNORE "PRESS POWER ON" MESSAGES !!!!
detected MASTER on COM41, SLAVE on COM42
Open COM port OK
ChipID:7100,EMP protocol:0301
PHONE IS RED RETAIL PRODUCT
FLASH CID detected:49
Speed:921600
DB2000 only supports 460800,fallback.
Flash ID check:8964
Flash props sent ok
OTP LOCKED:1 CID:49 PAF:1 IMEI:3593150000XXXX CERT:RED
FLASH CID:49 COLOR:RED
phone model: M600i
part number: FAD-3022012-BV
Phone part version: CXC162037 R1B01 
organizer part version: CXC162071 R1B01 
CDA part version: CDA162011/2 R1B01 
CCPU part version: CXC162098 R1A09 
USERCODE:0000

NEW SECURITY TYPE:

PLEASE IGNORE "PRESS POWER ON" MESSAGES !!!!
detected MASTER on COM41, SLAVE on COM42
Open COM port OK
ChipID:7100,EMP protocol:0301

NEW SECURITY MODEL DETECTED
PHONE IS RED RETAIL PRODUCT
FLASH CID detected:49
Speed:921600
DB2000 only supports 460800,fallback.
Flash ID check:8964
Flash props sent ok
OTP LOCKED:1 CID:49 PAF:1 IMEI:3593150000XXXX CERT:RED
FLASH CID:49 COLOR:RED
phone model: M600i
part number: FAD-3022012-BV
Phone part version: CXC162037 R1B01 
organizer part version: CXC162071 R1B01 
CDA part version: CDA162011/2 R1B01 
CCPU part version: CXC162098 R1A09 
USERCODE:0000

4. Flash.
- IF phone has OLD SECURITY TYPE, just press 'Flash' button.
- IF Phone has NEW SECURITY TYPE and you want to flash it without changing CDA (Process PDA update files must be unticked), just press 'Flash' button.
- IF Phone has NEW SECURITY and you want to update/change CDA, tick 'Process PDA update files', check 'USE SERVER FOR CSCA FLASH/UNLOCK' and press 'Flash' button.


What is Process PDA?

If checked CDA will be changed. Example:

W950i with GENERIC firmware flashed with ACPU_NI_Trade_Hong_Kong without the
"process PDA update files" tickbox, the software info screen would look something as follows:

PDA software version:
CXC 162088 R1B01 <-- original s/w that came with smartphone
CXC 162101 R1B01 <-- new s/w flashed with SEtool

CDA version:
CDA162014/2 R1B01 <-- this was the original firmware
CDA162017/48 R1A12 <-- this is the new firmware flashed via SEtool

If the box is ticked, then only the last line of each section is shown - or, in other words,
how a standard set (with the respective firmware) would be.


This is from the Offial SETool box Help.