Saturday, December 13, 2008

Hacking the Motorola W385 for Verizon

[Disclaimer:  This guide is incomplete, however, I still think it has useful information, and it definitely is a starting point]

Okay, this is a work in progress, but I think I have enough info to start a tutorial explaining how to flash a Verizon W385 with the Motorola firmware. But wait, that's not all, after flashing, I will have all the steps required to actually get the phone working. It's not the easiest thing in the world, and there are risks, but I think anyone can do it, given the proper directions and resources.

First, there are several things everyone should know before they start flashing a phone.
  • Things can go wrong; in fact, if you aren't careful, you'll be almost guaranteed to mess something up.
  • There are both benefits and setbacks for any given firmware... choose wisely, and BE CAREFUL!!
Here are some of the benefits of the Motorola firmware:
  • Better battery life, and faster charging (It's really true!)
  • More freedom, such as sending music and pictures over bluetooth, being able to easily use the phone with computer software to back up contacts, transfer pictures, music, etc.
  • A built in MP3 player that will play music even when the phone is closed.
  • The ability to change ring styles without opening the phone-via smart key and volume keys.
  • Three different skins to choose from for the phone.
  • There is a Vibe then Ring option
  • There are plenty of different Vibrate styles
  • More options for messaging, internet, and with the proper programs, one can sync their calendar, "datebook" as it's called, and contacts with Outlook.
  • A lock application that allows you to password-protect specific apps on your phone, such as contacts, media, WAP access
  • For me the biggest plus is no annoying Verizon User Interface... I think the VWZ UI is terrible!
Now for the not so good:
  • No world clock
  • No Get-It-Now/Brew Apps
  • No cool picture frames for the pictures you take
  • The outside of the phone has a clock that is vertical on the Moto UI (you will probably hate it at first, but it grows on you... alot.)
  • Your phone number will pop up every time you turn on the phone (there is probably a fix, but I haven't found it.)
  • If you have a problem with your phone and take it in to Verizon, they will probably fuss at you, or just not service it.
  • You will have to be very careful of PRL updates (basically, no more dialing *228 whenever you want.)
  • Say good bye to Vibe and Ring
  • Vibrate seems stronger on Verizon UI
Getting Started:

First, there are several things you will need to commence your operation.

  • The Motorola Drivers
  • Motorola Software Update
  • Motorola RSD Lite (I would suggest at least version 4.4.1)
  • Motorola RSD General (I would look for version 5.2.9)
  • P2Kman
  • P2K Commander or BitPim, but I like P2K Commander better
  • XVI32 (It's a hex editor, but don't worry, I'll show you how to use it.)
  • Mini-usb cable (you likely have one for your camera)
  • You will need lots of patience, time and a reliable computer that won't crash/die in the middle of flashing.
  • This will take awhile, probably an hour or two, so be sure you have some time for a non-working phone.
  • The DST Monster for the Motorola W385
  • The VZW Monster File for the Motorla W385 (in case something goes wrong)
Let the fun begin!

  1. Dial *228 on your phone and press option 1
  2. Then after it is compete, dial *228 and press option 2
  3. Now your phone is updated and ready to be flashed!
  4. Install the Motorola drivers first, then install all the other programs.
  5. Connect your phone to the mini-usb cable and hook it up to the computer.
  6. WAIT until it has configured all the drivers and everything.
  7. Open RSD will probably say something about an incorrect matrix file and big red font will come up. It will tell you to disconnect the phone. Don't worry, it's fine.
  8. Click on Provisioning in the bottom left corner.
  9. In the Settings column on the left, click on the first link and then click the read from phone button... it will probably take awhile. After it is done, click Save File
  10. Important: Make sure you know what you've named them and save them all in a safe place! You WILL need them later!
  11. Go one by one through the settings and save them (with logical names). The only ones you don't need to save are the following: CDMA1X GPS; EVDO; PTT; MDN Based on MEID/ESN; Multiple Loading
  12. After you have saved all the settings from RSD General, make sure you have all the pictures saved and contacts on your phone written down somewhere that you will want later.
  13. Close RSD General and open RSD Lite
  14. IMPORTANT: Make sure you're battery is fully charged and that your computer won't be dying on you for about twenty minutes!
  15. Load the Moto DST into RSD Lite and start the flashing process. This will take a little while, and don't do other stuff on your computer while it flashes the phone.
  16. When it's done, you will be greeted with a totally new phone... yea, it's impressive. However... it won't work... just yet... so just don't freak out.
  17. Now the REAL fun begins. First, you need all those files you saved. Using RSD General, upload each file and then press the button to save it back to the phone. You need to do this one by one.
  18. -------------------------------------GUIDE STOPS HERE FOR NOW------------------------

I recently found some of my old notes on seem edits that re-enable some features here they are below:
This fixes the delivery confirmation on the W385 (It prevents it from sending a delivery confirmation text every time a txt is sent to anyone with a Verizon phone.)

Seem 2742, bytes 0000, record 0001; offset 0049. Un-check bit 5.
NOW THE MOST IMPORTANT THING TO DO HERE is to quit the program(s), unplug your phone and MANUALLY power cycle it, DO NOT USE ANY SOFTWARE TO DO SO.
Then go back to your 2742 seem, bytes 0000, record 0001:
Offset 003d, bit 1, OFF, then offset 0062, bit 2, OFF.

Seem 2742 Record 0001
Offset 001f, Bit 5 - Off, Enables Settings -> Security -> Restrict Calls
Offset 005F, Bit 4 - On, Enables Multimedia -> Sounds -> Options > Sounds Setup -> Timer
      (Sort've works, the top half of the font gets chopped off)

Offset 0076, Bit 4 - On, Enables Settings -> Phone Status -> Other Info -> Operator
Offset 007b, Bit 5 - On, Enables Messaging ->  Options -> Setup -> Fax Msg Setup
Offset 007b, Bit 6 - On, Enables Messaging -> New Text Msg -> Options -> Message Options -> Subject:
Offset 008a, Bit 7 - On, Enables Messaging -> New Text Msg -> Insert > Contact Info
Offset 008b, Bit 2 - On, Enables Messaging -> Options-> Setup -> Message Setup -> SPAM Filter

Enabling EMS on the W385
Seem 2742 Record 0001
Offset 0045, Bit 1 - On and Bit 7 - On
Offset 0047, Bit 6 - On
Offset 0092, Bit 6 - Off

(I'm not sure what this was... I'm guessing it enables something)
Seems 275a and 275b Record 0001
Offset 00f8, change from 32 to 30
Offset 0136, change from 00 to 01



Zack said...

I'm gonna try to do this, but I see no step 18!

PK said...

Yeah, can you please post what we're supposed to do from step 18 onwards?

What happens after we restore the provisioning info, and what do we need the hex editor for?


tillwhompson said...

Sorry guys, I haven't checked this blog in forever... I've been too busy with personal matters.

That being said... after a year off from this stuff, I'm going to try to see if I can finish the tutorial. it might be a while though, especially since I now use Windows 7, so I'm not sure how things will workout.

That being said, my phone works fine, I even now got it to work with PRL updates. However, I honestly don't remember everything I did, which is why I started writing this blog so I wouldn't forget everything (ha ha).

You'll get very far (as in I believe you should have a working phone, just no texting (as I recall) with this tutorial. But until I have time I can't tell you much else.

The hex editor actually is used to get PRL updates working... there's a seem in the phone that, if you edit it with a hex editor, and put in your phone number, you can get *228 to work without jacking up your phone.

Hope this helps... and I apologize that I haven't had time to finish this.

If you have some technical knowledge... you should be able to at least get a phone that will make and receive calls from this tutorial.

PK said...

Thanks for getting back to us, and sorry to bump an old topic about an old phone. Someone recently gave me a w385 and Verizon's interface is horrible, so I thought I'd give this a shot.

I'll see if I can find out what's necessary to get PRL updates working (maybe with a seem editor), but feel free to let us know if you remember, and any other info you can share would be appreciated.

Thanks again,


tillwhompson said...

Ah no, it's no problem... in fact I'm still using my W385 that I flashed... the call quality is outstanding... battery life is incredible, and the Moto UI isn't bad at all.

I've been trying to just find a way to create a flash file from my phone... but I haven't been able to do it yet.

I love my W385 and may keep it until it literally falls apart... I've replaced the screen and now I'm probably going to have to replace the battery. With the Moto UI I don't think there is a better dumb phone out there.

I just feel sorry that I was one of very few people who figured out how to flash it, yet... I haven't been able to gather all the things I did to do it, lol.

Anonymous said...

Do you have the VZW and DST monster files for the w385 still?

tillwhompson said...

Unfortunately, it doesn't look like I do. If I do find it, I'll let you guys know and post it for download.