Saturday, December 13, 2008

Hacking the Motorola W385 for Verizon

[Disclaimer:  This guide is incomplete, (HDD with original files was lost) however, I still think it has useful information, and it definitely has some good info if you're into hacking old phones and still manage to have the software mentioned below]

Edit: Removed old broken links on 2018-12-20

Okay, this is a work in progress, but I think I have enough info to start a tutorial explaining how to flash a Verizon W385 with the Motorola firmware. But wait, that's not all, after flashing, I will have all the steps required to actually get the phone working. It's not the easiest thing in the world, and there are risks, but I think anyone can do it, given the proper directions and resources.

First, there are several things everyone should know before they start flashing a phone.
  • Things can go wrong; in fact, if you aren't careful, you'll be almost guaranteed to mess something up.
  • There are both benefits and setbacks for any given firmware... choose wisely, and BE CAREFUL!!
Here are some of the benefits of the Motorola firmware:
  • Better battery life, and faster charging (It's really true!)
  • More freedom, such as sending music and pictures over bluetooth, being able to easily use the phone with computer software to back up contacts, transfer pictures, music, etc.
  • A built in MP3 player that will play music even when the phone is closed.
  • The ability to change ring styles without opening the phone-via smart key and volume keys.
  • Three different skins to choose from for the phone.
  • There is a Vibe then Ring option
  • There are plenty of different Vibrate styles
  • More options for messaging, internet, and with the proper programs, one can sync their calendar, "datebook" as it's called, and contacts with Outlook.
  • A lock application that allows you to password-protect specific apps on your phone, such as contacts, media, WAP access
  • For me the biggest plus is no annoying Verizon User Interface... I think the VWZ UI is terrible!
Now for the not so good:
  • No world clock
  • No Get-It-Now/Brew Apps
  • No cool picture frames for the pictures you take
  • The outside of the phone has a clock that is vertical on the Moto UI (you will probably hate it at first, but it grows on you... alot.)
  • Your phone number will pop up every time you turn on the phone (there is probably a fix, but I haven't found it.)
  • If you have a problem with your phone and take it in to Verizon, they will probably fuss at you, or just not service it.
  • You will have to be very careful of PRL updates (basically, no more dialing *228 whenever you want.)
  • Say good bye to Vibe and Ring
  • Vibrate seems stronger on Verizon UI
Getting Started:

First, there are several things you will need to commence your operation.

  • The Motorola Drivers
  • Motorola Software Update
  • Motorola RSD Lite (I would suggest at least version 4.4.1)
  • Motorola RSD General (I would look for version 5.2.9)
  • P2Kman
  • P2K Commander or BitPim, but I like P2K Commander better
  • XVI32 (It's a hex editor, but don't worry, I'll show you how to use it.)
  • Mini-usb cable (you likely have one for your camera)
  • You will need lots of patience, time and a reliable computer that won't crash/die in the middle of flashing.
  • This will take awhile, probably an hour or two, so be sure you have some time for a non-working phone.
  • The DST Monster for the Motorola W385
  • The VZW Monster File for the Motorla W385 (in case something goes wrong)
Let the fun begin!

  1. Dial *228 on your phone and press option 1
  2. Then after it is compete, dial *228 and press option 2
  3. Now your phone is updated and ready to be flashed!
  4. Install the Motorola drivers first, then install all the other programs.
  5. Connect your phone to the mini-usb cable and hook it up to the computer.
  6. WAIT until it has configured all the drivers and everything.
  7. Open RSD General...it will probably say something about an incorrect matrix file and big red font will come up. It will tell you to disconnect the phone. Don't worry, it's fine.
  8. Click on Provisioning in the bottom left corner.
  9. In the Settings column on the left, click on the first link and then click the read from phone button... it will probably take awhile. After it is done, click Save File
  10. Important: Make sure you know what you've named them and save them all in a safe place! You WILL need them later!
  11. Go one by one through the settings and save them (with logical names). The only ones you don't need to save are the following: CDMA1X GPS; EVDO; PTT; MDN Based on MEID/ESN; Multiple Loading
  12. After you have saved all the settings from RSD General, make sure you have all the pictures saved and contacts on your phone written down somewhere that you will want later.
  13. Close RSD General and open RSD Lite
  14. IMPORTANT: Make sure you're battery is fully charged and that your computer won't be dying on you for about twenty minutes!
  15. Load the Moto DST into RSD Lite and start the flashing process. This will take a little while, and don't do other stuff on your computer while it flashes the phone.
  16. When it's done, you will be greeted with a totally new phone... yea, it's impressive. However... it won't work... just yet... so just don't freak out.
  17. Now the REAL fun begins. First, you need all those files you saved. Using RSD General, upload each file and then press the button to save it back to the phone. You need to do this one by one.
  18. -------------------------------------GUIDE STOPS HERE FOR NOW------------------------

I recently found some of my old notes on seem edits that re-enable some features here they are below:
This fixes the delivery confirmation on the W385 (It prevents it from sending a delivery confirmation text every time a txt is sent to anyone with a Verizon phone.)

Seem 2742, bytes 0000, record 0001; offset 0049. Un-check bit 5.
NOW THE MOST IMPORTANT THING TO DO HERE is to quit the program(s), unplug your phone and MANUALLY power cycle it, DO NOT USE ANY SOFTWARE TO DO SO.
Then go back to your 2742 seem, bytes 0000, record 0001:
Offset 003d, bit 1, OFF, then offset 0062, bit 2, OFF.



Seem 2742 Record 0001
Offset 001f, Bit 5 - Off, Enables Settings -> Security -> Restrict Calls
Offset 005F, Bit 4 - On, Enables Multimedia -> Sounds -> Options > Sounds Setup -> Timer
      (Sort've works, the top half of the font gets chopped off)

Offset 0076, Bit 4 - On, Enables Settings -> Phone Status -> Other Info -> Operator
Offset 007b, Bit 5 - On, Enables Messaging ->  Options -> Setup -> Fax Msg Setup
Offset 007b, Bit 6 - On, Enables Messaging -> New Text Msg -> Options -> Message Options -> Subject:
Offset 008a, Bit 7 - On, Enables Messaging -> New Text Msg -> Insert > Contact Info
Offset 008b, Bit 2 - On, Enables Messaging -> Options-> Setup -> Message Setup -> SPAM Filter

Enabling EMS on the W385
Seem 2742 Record 0001
Offset 0045, Bit 1 - On and Bit 7 - On
Offset 0047, Bit 6 - On
Offset 0092, Bit 6 - Off

(I'm not sure what this was... I'm guessing it enables something)
Seems 275a and 275b Record 0001
Offset 00f8, change from 32 to 30
Offset 0136, change from 00 to 01