Phone hacking!
May. 25th, 2006 09:00 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
captpackratDid a bunch of hacking and tweaking on my RAZR today.
(Warning: Everything in this entry violates the warranty. If you try one of these hacks and screw up your phone, Verizon probably won't replace it. Try this at your own risk. Don't blame me if you fry your phone.)
First I downgraded the firmware to version .02, which has the Bluetooth OBEX profiles (Verizon removed OBEX in version .03), then I upgraded to version .04 (If you go from .02 to .04, it keeps OBEX, .03 to .04 does not), so I have the latest and greatest version of the firmware but still have OBEX. .04 is a lot faster than .02 or .03.
Changing the boot and shutdown logos is easy, you just use a program like BitPim to overwrite /motorola/shared/picture/customer_opening.gif and customer_closing.gif on the phone with your own .GIF files. You can also change the outer screen logo by replacing the file /mobile/verizon.gif. (Don't delete the files with BitPim, you'll screw up the phone! Use Overwrite instead)
I also increased the video record time for the normal maximum of 15 seconds to 5 minutes by using BitPim to save the file /brew/mod/arcmedia/arcconfig.ini, opening the saved file in Notepad, changing VidDuration from 15 to 240, then using Overwrite to replace the file on the phone with the new version.
Then I did some seem edits to tweak the system. Seem edits alter the phone's configuration files. Normally only the phone companies do this to enable/disable certain features, but it can be done by the user if you have the right software. (The process isn't for the faint of heart, so I'm not even going to try to explain it. But it involves editing files at the binary level)
Here's the list of seem edits I did:
Seem 296a, Bytes 24, record 0005, Allows you to change the provider name (or remove it entirely) DO NOT check/uncheck anything before letter V or after S.
Seem 2742, Bytes 94, record 0001:
Offset 003f, bit 6 - on, Enables Call Barring Settings > Security > Restrict Calls > Outgoing Calls
Offset 000a, bit 7 - on, Enables Settings > Initial Setup > Backlight > Continuous - Dims Backlight instead of shutting off
Offset 007b, bit 3 - off and bit 4 - on, Gives you Vibrate Then Ring option
Offset 007b, bit 2 - off and bit 7 – on, Gives you Moto ring control (instead of low thru high, you get 1 thru 7)
Offset 006a, bit 0 - on, Allows Bluetooth or USB file transfer in MPT(Sometimes OBEX)
Offset 0006, bit 1 - on, Enables "Siren" Alert
Offset 0038, bit 1 - on, Enables "Continental" Alert
Offset 0038, bit 2 - on, Enables "Classic" Alert
Offset 0038, bit 3 - on, Enables "Attention" Alert
Offset 003b, bit 0 - on, Enables "Moonlit Haze" Alert
Offset 0094, bit 7 - off, Fixes the orange outer screen on the .04 firmware.
(Warning: Everything in this entry violates the warranty. If you try one of these hacks and screw up your phone, Verizon probably won't replace it. Try this at your own risk. Don't blame me if you fry your phone.)
First I downgraded the firmware to version .02, which has the Bluetooth OBEX profiles (Verizon removed OBEX in version .03), then I upgraded to version .04 (If you go from .02 to .04, it keeps OBEX, .03 to .04 does not), so I have the latest and greatest version of the firmware but still have OBEX. .04 is a lot faster than .02 or .03.
Changing the boot and shutdown logos is easy, you just use a program like BitPim to overwrite /motorola/shared/picture/customer_opening.gif and customer_closing.gif on the phone with your own .GIF files. You can also change the outer screen logo by replacing the file /mobile/verizon.gif. (Don't delete the files with BitPim, you'll screw up the phone! Use Overwrite instead)
I also increased the video record time for the normal maximum of 15 seconds to 5 minutes by using BitPim to save the file /brew/mod/arcmedia/arcconfig.ini, opening the saved file in Notepad, changing VidDuration from 15 to 240, then using Overwrite to replace the file on the phone with the new version.
Then I did some seem edits to tweak the system. Seem edits alter the phone's configuration files. Normally only the phone companies do this to enable/disable certain features, but it can be done by the user if you have the right software. (The process isn't for the faint of heart, so I'm not even going to try to explain it. But it involves editing files at the binary level)
Here's the list of seem edits I did:
Seem 296a, Bytes 24, record 0005, Allows you to change the provider name (or remove it entirely) DO NOT check/uncheck anything before letter V or after S.
Seem 2742, Bytes 94, record 0001:
Offset 003f, bit 6 - on, Enables Call Barring Settings > Security > Restrict Calls > Outgoing Calls
Offset 000a, bit 7 - on, Enables Settings > Initial Setup > Backlight > Continuous - Dims Backlight instead of shutting off
Offset 007b, bit 3 - off and bit 4 - on, Gives you Vibrate Then Ring option
Offset 007b, bit 2 - off and bit 7 – on, Gives you Moto ring control (instead of low thru high, you get 1 thru 7)
Offset 006a, bit 0 - on, Allows Bluetooth or USB file transfer in MPT(Sometimes OBEX)
Offset 0006, bit 1 - on, Enables "Siren" Alert
Offset 0038, bit 1 - on, Enables "Continental" Alert
Offset 0038, bit 2 - on, Enables "Classic" Alert
Offset 0038, bit 3 - on, Enables "Attention" Alert
Offset 003b, bit 0 - on, Enables "Moonlit Haze" Alert
Offset 0094, bit 7 - off, Fixes the orange outer screen on the .04 firmware.
