Outguessing the machine

This is a safe space. No ads, no tracking, 100% written by a human.

Motorola E815 hacking

Posted

by

Tim

Yay, it is done. This phone kicks ass! I ran into some weird problems at first, not mentioned by any advice forum / tutorial / etc., so I wrote this up to hopefully save people with the same issues a lot of debug work.

This entry is here for Google (and ultimately, fellow E815 owners) to find. This document is written for “clueful n00bs”. If you’re modding your phone, it stands to reason that you just got it; otherwise it would be modded already, probably by you, and you wouldn’t be bothering reading guides like this. Everybody is a n00b once, this isn’t something to be ashamed about (despite what 99% of other guides / forums will insinuate). “Clueful”, though, means you know how to read (and re-read if necessary), use Google, follow links to other guides, and find a forum to ask a clear, concise question if you need to. (Don’t ask me! I don’t have time to answer 1000 emails a day.) Not everything is listed here!

Enabling all the stuff VZW crippled:

This is done by flipping bits in the phone’s seem files, most easily by using someone’s already-written seem editor (I used p2kseem.exe). Tutorials for this exist all over the place, so I’m not going to try and reproduce them. What I can do is document the peculiarities I encountered, so that those experiencing the same issues can Google, find this, and save themselves a bunch of time. Keep reading if…

You can’t connect to your phone;

Can’t put the phone in suspend mode using ‘HUBME’ menu code (only needed if you’re not using PST);

Hacky tools (e.g. seem editors, P2KCommander, etc.) report ‘Connected’ but lock up /quietly fail / do nothing / spit weird errors / show a blank screen when you attempt to access the seems (or whatever else you’re doing);

There is no “Accessories Interface” ever installed under Motorola USB Device.

Hacking flow:

To do anything to a shiny new E815 phone, the general flow of operations is as follows:

  1. Obtain a USB cable for the phone
  2. Install the E815 and P2K drivers, using whatever method you prefer
  3. Verify that “Motorola USB Modem” appears in Device Manager when you plug in the handset
  4. Get phone to switch modes from “USB Modem” to “Motorola USB Device” with a list of USB interfaces
  5. Verify that the “Accessories Interface” enables and gets installed by Windows
  6. Fire up your hacky tools and have fun!

The USB Cable:
Google for it, search Ebay, etc. Ideally, you want the Motorola OEM cable WITH charging port (it allows you to plug your phone’s charger into the cable and access the phone while it’s “off” and batteryless, very useful if careless hacking around has bricked your phone!) NOTE: Not all “OEM” cables are created equal! Not all Motorola OEM cables have a charge port; unless your vendor specifically says that it does, you can’t assume anything. My pig-in-a-poke Ebay cable turned out to be one of those without a charge port; part# SKN6311-AAKN4011A. This usually comes with the Motorola Phone Tools CD, but again, check with your vendor and make sure, if you want that software, whether it is included.

Don’t plug in your phone yet! (If you did, impatient bastard, probably nothing bad will happen, but we don’t want to unnecessarily confuse poor old Windows with devices it doesn’t recognize yet. Let’s get those drivers installed.)

Installing the drivers:
UPDATE 2006/10/09: Dan points out a Motorola developer tool that comes with (and may install for you!) the necessary drivers; it also fixes the “p2k-based hacky tools can’t connect to phone” problems.

You can do this one of a few ways. Probably the overall best way is to download a free program called UID Extraction Tool from developer.motorola.com. It was at this url last I checked (8/1/2007). It’s large (a 5MB download or so, but still less than Motorola Mobile Phone Tools (MPT)), but includes all the drivers.

The easy-but-bloated way is to install Motorola’s Mobile Phone Tools (MPT) (if you’re lucky, it came along with your USB cable); it will install all the drivers for you.

The more involved way is to download a “driver pack” someone’s already ripped & zipped; you’ll have to point Windows to .inf files yourself, but less wear & tear on your CD-ROM drive, if you care. You can get a driver pack from the downloads section of motomodders.net (registration required to download), or Google for “E815 drivers” or “E815 driver pack”, etc. If you go the MPT route, make sure to run its LiveUpdate until you’re patched up to the latest version.

Whichever way you go, plug the cable into your computer, THEN plug the cable into your phone. The phone should beep-beeeep; Windows detects a new device(s). If you went the MPT route, you probably go make yourself some tea right now while Windows grinds for a few minutes and auto-installs the device(s). If DriverPack, same thing, except you might have to point windows to one of more *.inf files when it asks for drivers (follow the DriverPack instructions, if any).

Verify “Modem” installation:
In any event, when all the grinding stops you should get a “Motorola USB Modem” under Modems in Device Manager when you plug in the handset. Now, “modem” is kind of a misnomer here, since it’s actually going through this whole USB -> emulated serial port -> emulated AT modem interface clusterf*ck (if you’re a USB developer, you’re probably with me on this one! ;-), but that’s what they give you, so that’s what you’ll be using. If you’re not getting this, or worse, you’re getting a generic “USB Device” with a yellow exclamation mark after 5-10 seconds, something is wrong. Make sure nothing else phone-related is running when you plug in the handset. In particular, on my machine MPT has this nasty habit of not exiting when it’s been closed, deciding instead to stay around as an unkillable (as Administrator! How’s that?) zombie process until the computer is rebooted. Try rebooting (or failing that, careful application of Reset switch) and plugging in the handset again when Windows returns to life. Leave Device Manager open for the next step.

Switch over from “USB Modem” to “Motorola USB Device” and all its interfaces:

If you already have a “Motorola USB Device” showing in Device Manager with about 3-5 drivers listed under it, and one of them is “Accessories Interface”, congratulations! You can skip this section. If not, keep reading. Is is these interfaces, not the “modem”, that your favorite tools will use to communicate with your phone and work their magic.

Once your phone successfully shows up as a “modem” in Device Manager, there are several approaches to trying to bring up all the necessary USB / diagnostic interfaces; hopefully one of them will work for you. Different strokes for different folks, it seems — what works for one may not work for another depending on software versions, cell carrier, firmware revision, etc. Indeed, the reason I’m bothering writing this is that all the other tutorials out there didn’t work for me. (If you just want one “guaranteed method”, drop down to the Motorola UID Tool method below. One of these other methods is probably faster, but they don’t work on 100% of phones.)

  1. Magic Hacky Tools method: Fire up your hacky tools (p2kseem or whatever), and carefully watch Device Manager. Some such tools should cause the phone to switch over. Again, if Windows hounds you for drivers (DriverPack people), point it to the .inf files that come along with p2k.sys.

  2. Hypterterminal Method: Note, this may only work for older / non-Verizon phones (my VZW 815 doesn’t bring up the Accessories Interface with this method). Once you have the “modem” appearing, connect to using Hyperterminal or similar. At the terminal window, type AT+MODE=8 and press Enter. The phone should switch to USB mode. (This is probably the method most hackytools use; it’s also what PST, described below in case nothing else works, does to switch modes initially.)

  3. Handset Suspend method: With your phone at the home screen, press the Menu button and then QUICKLY key in 048263* (that’s Menu + 0 + HUBME + *) as soon as the menu appears. If it’s working right, you should hear beeps (or DTMF tones) as you key them in, and the menu screen should not change. If punching buttons causes you to select through the menus, or they appear on-screen as a dialed number, back out to the Home screen and try again. (You have to punch all the keys relatively quickly for the phone to recognize them as a special code.) When successful the phone should ask for an Opcode; enter 54* when prompted. The screen should immediately go dark. Your phone is now in Suspend mode, and will stay in this mode as long as you leave it flipped open. Close the flip to exit Suspend mode.

    For the insatiably curious, you can explicitly verify Suspend mode after the screen goes dark by pressing the camera button on the side of the phone; this will turn on the backlight so that you can see the “Success!” message on-screen, indicating successful placement into Suspend mode. Be warned though, once the backlight is on it will stay stuck on for as long as you are in Suspend, so I don’t recommend doing this before a long night of hacking (it will drain your battery).

    Check Device Manager for the necessary interfaces; if they do not appear, continue to…

  4. Motorola UID Tool: Thanks Dan for this information (see comments below). You can download a free program called UID Extraction Tool from developer.motorola.com. It was at this url last I checked (8/1/2007). Upon starting, it switches the phone over to USB/p2k mode AND enables Accessories Interface. It probably does this the exact same way as “PST” below; so no need to scrounge for pirated software :-) As a bonus, it comes with all the necessary drivers (so no more scrounging for DriverPack, either).

  5. Tool of last resort – PST: If none of the above will bring up the necessary USB interfaces, you need to somehow acquire a program called Motorola PST. Current versions are at least 7.xx. (There are other programs called *PST; for example, Qualcomm’s QPST will also recognize your phone, but not enable any special interfaces – you need the Motorola PST program.) PST is copyrighted commercial software; I can’t give any advice on how to obtain such a thing, I can only say that there are a lot of cracked copies floating around Google and the phone-modding boards. Anyway, if this mystical PST software were to be installed, and you were to run “Phone Programmer” from its menu group with your handset plugged in, it would enable three diagnostic interfaces, including the necessary “Accessores Interface”.

    Note for developers: If some wonderful person were able to fire up a USB sniffer (e.g. USBSnoopy or SnoopyPro) before running PST and enabling these interfaces, and save the log, I or another USB guy could probably throw together a program to replicate that “magic” communication and eliminate the need for PST and all the associated Googling, broken RAR files, spyware concerns and/or Russian crack sites entirely. The modding world needs this! Unfortunately, I’ve installed and uninstalled so many random/questionable/homebrew USB devices on my machine, these tools won’t even work correctly on it anymore. Thanks to UID Tool, we don’t really need this anymore :-)

Run the hacky tools:
What you do from here depends on the specific hacky tool(s) you are using. I’m not going to try to keep up with them all; they are numerous.

Problems In Brief:

1) Seem Editor (etc.) doesn’t do anything / freezes up / just sits there: If you (like me) have “tried everything” and every seem editor known to mankind just sits there with a blank screen, and you’re sure you installed the drivers and all that basic stuff, go into device manager and make sure the following interfaces have been enabled (by programs talking to the phone, or Suspend mode) and appear under Motorola USB Device:

Data Logging MCU Interface
Test Command Interface
Accessories Interface

You may see additional interfaces listed, depending on your configuration, but make sure the Accessories Interface at least is present. This was my problem, none of the methods except PST (even suspending the phone) enabled this particular interface, even though the rest (USB control, data, test…) were enabled.

2) Generic “USB Device at USB Device” (yellow exclamation marks) in Stop Devices menu or Device Manager: This appears to be a Windows problem, not a phone problem (powercycling the phone won’t help). Reboot, wait a while and try again. Make sure no phone-related tools (e.g. MPT, including stuck zombie processes) are running. Also, sounds stupid, but never hurts to mention: make sure the data cable is completely and straightly connected to the phone. Both sides may not always “click” into place reliably, resulting in Windows detecting “something” but not being able to talk to it.

3) P2KMan – “failed changing volume” with E815: Don’t use P2KMan to read the filesystem; it won’t work. BitPim will though.

Interfaces I got with…
P2Kseem:
Communications Class – Control Interface
Communications Class – Data Interface
Data Logging MCU Interface
Test Command Interface

PST:
Data Logging MCU Interface
Test Command Interface
Accessories Interface

UID Tool:
Data Logging MCU Interface
Test Command Interface
Accessories Interface

Posted

in

by

Tim

Tags:

Comments

27 responses to “Motorola E815 hacking”

  1. Ev Avatar
    Ev

    GREAT JOB TIM!!! Finally, someone in the know that doesn’t write as if he’s part of some secret society but instead is TRULY trying to spread knowledge. Thanks!

  2. Jesse Avatar
    Jesse

    My back light on my cell phone keeps turning off and stays off for a long time. But you can still see every thing, just that the backlight stays off. And it says in the book that you go to like battery save and pick on but that still doesnt work. Can you help me?

  3. tool vicarious Avatar
    tool vicarious

    Hey
    I am new to this blog.
    I need a new phone!
    Well, strictly speaking I don’t really need a new phone, but I want one!
    I’ve narrowed it down to two choices:-
    Motorola V3
    or
    Nokia 8800
    Help me choose a new mobile!Please…

  4. rize Avatar
    rize

    Tim,

    I was able to download the flash memory (at least I think so). I am attempting to see if I can restore anything that was previously deleted as this does not guarantee it has been erased from flash.

    Do you have any clue the memory map of the E815?
    Do you know where any user data is stored in the memory?
    I do searches within the hex file and do not find text that i would assume would be there. I have seen a few data tables but nothing that makes sense to me yet.

    thanks,
    rize

  5. Dan Avatar
    Dan

    Google found it. Good summary.
    I might point out that PST is not required. If your phone doesn’t switch over from “USB Modem mode” into (p2k) mode, you can use the freely available tool from developer.motorola.com called “UID Extraction tool”

    The first thing this tool does is switch over the phone. As a bonus, it comes with the necessary drivers.

  6. Tom Avatar
    Tom

    Thanks a lot man. For the life of me I couldn’t figure out why pk2seem wouldn’t works. Your awesome!

  7. josh Avatar
    josh

    I just want to know if you can read text messages without opening the phone. In other words, can you read texts on the external display?

    Thanks

  8. Lou Avatar
    Lou

    Confused about all the lingo above, but like others, I was just wondering if old text messages can be retrieved from this type of phone (Motorola E815). When I say old I’m talking those written/received in the last two or three months?

  9. eric Avatar
    eric

    all you have to do is get a bluetooth adapter and the bluetooth software installs the modem drivers itself. find yourself a free dial up service and it connects. theres no need to edit the seem.

  10. mmgtaurus Avatar
    mmgtaurus

    Motorola v235 owner:
    Using UID Extraction: I can’t get other devices added except for the motorola USB modem. Any suggestions?

  11. kalabaw Avatar
    kalabaw

    can’t get to the uid extraction tools page so i can’t get my v3x to work with p2k programs. xp tries to install usb composite and ends up looking for motccgp.sys and motccgpfl. can anone help? thanks.

  12. Jill Avatar
    Jill

    have the MOT E815. keypad no longer works, but can turn phone on. have text messages, but unable to access via keypad. how do i “extract” text messages off phone? any help is much appreciated.

  13. RareCactus Avatar
    RareCactus

    Thank you!

    Finally someone wrote a decent guide about using motorola phones.
    I’ve gotten so sick of reading guides that seem like they were written in by 13-year-olds– yours is a welcome relief. (Some guides even showed me quicktime movies of how to click on an installer file! Talk about special education.)

    Unfortunately, I already figured all of this stuff out, no thanks to the guide writers. Yes, including the UID Extraction tool hack, where opening the UID extraction tool in the background will allow P2k commander to work. Eventually, though, I got tired of that, so I installed MPT.

    MPT has never worked for me. I think the reason is because my phone is still “locked.” I have successfully used p2kcommander to get a custom ringtone and background. If I can find a way to back up my phone’s contacts list, my “hacking” will be complete. Unfortunately, every guide I’ve read on the subject just tells me to use MPT to get the contacts, something that I cannot do at present. If I only knew which file the contacts list was stored in, this would be fairly easy, I think. Any thoughts?

  14. OniTekk20 Avatar
    OniTekk20

    Hey all, I got only two of the drivers…

    Data logging interface
    Test Command

    working but still cant install “accessory interface”
    anyone know where i can Download it?

  15. OniTekk20 Avatar
    OniTekk20

    I tried getting the UID Extraction tool but am not sure how to get the
    Accessories Interface out of it…

  16. OniTekk20 Avatar
    OniTekk20

    I got the UID Extraction tool but am not sure how to get the
    Accessories Interface out of it…

  17. darren Avatar
    darren

    E-815 has that brite “Flash” for camera. Anyone figure out how to make that flash when phone rings? I think that would be a super cool feature in office or noisy environments. That flash is bright and would really grab you attention.

  18. Eric Avatar
    Eric

    Great guide! I have been trying numerous guides to get my phone to work with p2k and PST, but have been having no luck though. I have MPT, PST, p2k, and the UID, as well as a seperate file with E815 drivers, but when I connect the phone, even if I direct the new hardware wizard to the E815 drivers folder, I can not get the phone to work. I can get it is be recognized as a Motorola USB device using UID or PST, but then it asks for the drivers again, and no matter what I do, it goes through a cycle where it keeps trying to very ‘data logging interface’ and ‘test command’, but not acessory interface. I have al the tools, but none seem to be able to get my E815 working. Any advice? Thanks.

  19. spencer Avatar
    spencer

    hey,
    I am having serious issues getting my phone to change from a modem into a usb device. It just won’t do it. It shows up as a modem then I tried all of the steps you have listed but maybe you have some other things I could try.

  20. klejdi Avatar
    klejdi

    my phone dont swich on

  21. danny Avatar
    danny

    the screen part of my flip phone came off but i can still dial and receive calls/messages. i was wondering if there is anyway i can read the messages I’m receiving on a computer some how. thanks.

  22. Cell_damage Avatar
    Cell_damage

    hey i have a Motorola E-810 and i would like to turn it in to a mobile number locater for my girlfriend cause i have a problem trusting women so how do i go about doing that i know you can do it i also know its not out so can any one help me if so http://www.gifted222006@yahoo.com is one of the dummy accounts i use a lot so hit me up but i also would like to open it up so i can use it on my sprint account

  23. Cell_damage Avatar
    Cell_damage

    oh yeah i dont have a usb cable i just have a 32mb sd card i can put on the computer so get at me

  24. Derek Avatar
    Derek

    I have a E815 I bought off ebay and its a verizon, I need to hack it so I can use it in Canada on the Bell network, does anybody know how? Thanks

  25. bryan Avatar
    bryan

    can i do this if i just have a sd card with no usb cord??

  26. Shay Avatar
    Shay

    I was fooling around with my E815 while it was closed and some how i accessed my inbox. I can’t remember which buttons i pressed. It would really help if someone could tell me how to do it again. Any suggestions?

  27. kai Avatar
    kai

    my E815 continues to turn off by itself everytime i close it. i dont know what is going on…can you help me please?

Leave a Reply

Your email address will not be published. Required fields are marked *