HOW TO WORK WITH SEMC ODM PHONES

[the_laser]

some basics

SEMC ODM phones divided on two big branch:

obsolete cheap phones,where each phone has own specific approach
j110,j120,j210,j220,z300,k200,k220,etc

this phones don't have anything common with SEMC structure.

Current generation, so-called S1 phones - they based on TI chipsets, STEricsson (former philips) chipsets
j132,z320,t250,w302,f305,s312,w100,w150,etc.

this phones has S1 SOMC structure: color,cid (aid), signatures,etc.

[the_laser]

FLASHING OF SEMC S1-BASED ODM PHONES

1. select correct model
2. use com/ufs/usb as interface
3. check "signed mode"
3. add to firmware area needed firmware files
4. press flash

notes:
some old locosto s1 phones do not support USB as interface

if you want to flash brown firmware or readout, step 3 will be:
3. check "signed mode","alternative security bypass"


about SEMC S1 ODM files structure:

1. neptune-based (w302,s302,f305) , ST-Ericsson-based (w100,w150)

firmware contains 3 required parts:


- main (ex: R1BA017_1207_9123_GENERIC_HS_YG_RED.software)
- fs (ex: R1BA017_1207_9132_FS_ADRIATIC_HS_YG_RED.software)
- customization (ex: R6A_F305_CDF_1215_9665__FS__Entel_PCS_CL.software)

you need to flash all 3 files to get phone working with desired languages.

F305, S302, W302 SW flash should be done without memory card inserted.
If memory card is inserted during flash the flash can fail.

If you encounter this problem,the phone does not startup correctly after flash, please wait 2-3 minutes
then reinsert the battery and start the phone again.
The phone should now start normally and the SW has been correctly updated.
Please note that the SW is flashed correctly and this will not cause any future startup problem.

2. locosto arima (t250,t280,k330,t303,r300)
contains 2 required parts


- main + language R5CA005_OLGA_ARIMA_AMERICA_2_CXC1251008_RED.softwa re
- customization R7A_CDA102866_307__FS__Movistar_Guatemala.software


3. locosto foxconn (z250,z320,r306,j132)


- main R1BA008_1212_9858_MC_JIALI_RED.software
- icons R1BA011_1211_6339_ICN_JIALI_RED.software
(this files reside in archives like MODELx_FWVER_common.rar)
- fs+language R1BA008_1211_6093_MALAYSIA_JIALI_RED.software
- custpack R9A_R306_CDA_1212_6282__FS__Customized_SG.software

[the_laser]

UNLOCKING OF SEMC S1-BASED ODM PHONES

server-based full signature method

1. select correct model
2. on settings, check "signed mode", "do full unlock instead of usercode reset"
3. back to odm tab
4. press unlock

that method can fix damaged security zone.
that method depends of external service, so it can be offline any time.

standalone patch method

1. select correct model
2. uncheck all settings
3. back to odm tab
4. press unlock

note, that such method will work only for old security locosto-based phones.
if you will get error while attempting to do that method - you have new security phone and should try other methods.

server-based patch method

1. select correct model
2. on settings, check "signed mode", "use alternative security bypass"
3. back to odm tab
4. press unlock

that method can not fix security zone.
that method is standalone in setool2 versions, greater than 1.0

user code reset

1. select correct model
2. on settings, check "signed mode"
3. back to odm tab
4. press unlock

note,that some old firmware not support usercode reset, so if standart code will not work after reset, reflash phone with latest firmware.

[the_laser]

FLASHING OF SEMC ODM PHONES

1. select correct model
2. use com/ufs as interface
3. add to firmware area needed firmware
4. press flash

[the_laser]

UNLOCKING OF SEMC ODM PHONES

broadcom based - z300,j210,j220

1. select model
2. select com/ufs as interface
3. uncheck all settings
4. press unlock
5. power on phone with unsupported sim card, press *<<*, enter readed codes.

if you have "not allowed" while entering codes, just reflash phone

calypso lite based - j110,j120,k200,k220

1. select model
2. select com/ufs as interface
3. uncheck all settings
4. press unlock

for k200,k220 this is full unlock and security zone will be automatically fixed.
for j110,j120 this is special firmware patch - after unlock, power on phone, press *<<* with unsupported card and enter any 8 digits as code for each lock.
phone will accept code and unlock will be permanent.

note, that j110,j120 phones with damaged security zone are not supported.

[the_laser]

POSSIBLE PROBLEMS WITH S1 PHONES

damaged trim area , IMEI could not be read, simlocks state "tampered" or "0"

first, we need to restore trim area, for this :

1. select correct model
2. on settings, check "signed mode","enable alternative security bypass"
3. add to firmware area
if you have neptune-based phone - W302_TA.SSW
if you have t280,t303,r306,r300,k330,w205,Tilde phone - R300_TA.SSW
if you have t250 phone - t250_ta.ssw
if you have Z250,z320,t270 phone - z320_ta.ssw
if you have j132 phone - j132_ta.ssw
4. press flash

you can use trim area in .bin format to restore trim area, for this select trim area in misc. edit, check "signed mode","altbypass mode","format gdfs when writing" and press "write gdfs"

now trim area structure restored and phone should be signed with s1 signature server.
it is recommended to restore phone original IMEI first, for this :

1. create text file with contents:
taread:000107D1
2. select proper model, check on settings only "signed mode", select created file in misc. field
3. press "write script", file will be created in form %imei%.txt
4. look at file in notepad, you will see IMEI inside in very simple form, change IMEI to original and save file
5. select changed file in misc. field and again press write script
6. check with identify if you set correct IMEI, repeat 4,5 until success

now you need to unlock phone using signature server, consult corresponding FAQ post for that.

note, that alternative security bypass not available for phones with aid 0004, you can not fix aid004 phone with damaged trim area.

phone simlock okay, not tampered, but phone stucked,slow,rebooting. flashing not help.

most probably, internal file system gone to winds. you need to write fullflash from working phone or write clean file system, then reflash phone
check support area for that files.
please note, that all neptune-based phones can be cured with w302_fullflash,etc (check trim area repair case)
in most cases, alternative security bypass needed for writing fullflash.

note, that alternative security bypass not available for phones with aid 0004.

phone can't be detected at all

semcboot somehow got damaged ( while it is never touched by any process )

procedure to fix:

1. select correct model
2. on settings check "signed mode"
3. add EROM to firmware tab.
if you have neptune based phone: 1207-7713_EROM_S1_NEPTUN_HS_SEMC_SIMLOCK_R7A024.sin
if you have locosto based phone, then select situable from:
J132_EROM_S1_LOCOSTO_HS_USB_R5A038_64k.sin
K330_T280_T270_EROM_S1_LOCOSTO_HS_R5A028.sin
R300_R306_T303_S1_LOCOSTO_HS_R5A031_128.SIN
for w395 CXC1250616_EROM_S1_LOCOSTO_HS_USB_FLAFLA_R5A038.si n will do job
T250_CXC1250616_EROM_S1_LOCOSTO_HS_R5A022.sin
Z250_Z320_EROM_S1_LOCOSTO_HS_R5A023.sin

4.press recovery

check if phone trim area/simlock are okay by doing identify.
repair simlock or trim area if needed.

note, that semcboot repair not available for phones with aid 0004.

[the_laser]

POSSIBLE PROBLEMS WITH ODM PHONES.

phone hang, can't save photo,etc

1. write repair flash from support area
2. unlock phone
3. flash phone with latest firmware


note, that k200,k220 has two flash ic types, select samsung repair flash if you flash manu id=0xEC,
select spansion repair flash for all other types.

[the_laser]

How to enter network unlock code for w150 (Yendo) phone ?


ENTER #123456789# TO CHECK SOFTWARE AND CHECK LOCK STATUS
ENTER #987654321# AND SELECT RED AND PUT CODE