All about EL71 here and only here !

  • Thread starter Thread starter Abe
  • Start date Start date
@Abe
solution is tested by me , i confirm 100% working

@rango
same for me, maybe Skey have 32 hex like SSMC0509 said in other thread

----------

some server can give Skey from IMEI!! i forget the link, is this possible???
 
Someone can post a working full flash for EL71 Flash Chip : 00208819 (ST).
Tanks
Pandemonio100
 
this is my EL71 info:
Getting Information:
Model: SIEMENS EL71 12 lg35
Phone is in "Normal Mode" mode
IMEI: 358941000965213
SecurityStatus: CustomerMode
HWID: 407
Attention: Not matching HWID and Phone model!
Accumulator Voltage: 4006 mV.
EELITE Info:
Free buffer 200128 bytes, free at all 206304 bytes, free for deleted 206304 bytes.
EEFULL Info:
Free buffer 11840 bytes, free at all 466432 bytes, free for deleted 204352 bytes.
MAP info:
Date: 29/06/06, Variant: A 506,
Std-Map/SW: 1/12, D-Map/Prov.: 100/48
To Get Extended Info - Enter Skey into the phone!
Phone operated: 26044006 sec.
Total Talk time: 84264 sec.
FlashID(1) - Manufact. code: 0089 (Intel), type: 887E.
DisplayID(1,65): Unknown.

and by bsreader i got this ESN +HASH:

now what is the next step??
 
here is it: from working EL71 with ST chip

as i remember it's branded T-Mobile


http://rapidshare.com/files/11832759/EL71_V31_LG35__ST_0020-8819_.rar.html
 
...if you used "Write new bootcore" option, that is results
Download one fullflash file with lower version (FW6 or FW31 - language pack 3):
http://rapidshare.com/files/115231439/EL71_v6_lg3_full.rar
http://rapidshare.com/files/115231914/EL71_v31_lg3_full.rar

Open MS-Dos prompter ( Run-> and type cmd), go to how you have X65flasher folder and type in the DOS window command: x65flasher /b ( this option enable write bootcore)
Connect your phone to X65Flasher using TESTPOINT. Click on Connect (testpoint is connected), push Power on and disconect testpoint (see message in the X65Flasher window). Click on Write flash and select location how is saved fullflash. Wait to finalyse...
Open Papuautils, enter in Service mode and try to unlock phone using SKEY calculation. If not working calculation, click on Power off (from the Settings menu), go to the Codes menu and write manually 12345678 in skey space. Go to the Flash menu, check ReCalculate Keys (automatically checked the other three) and check Pause.
BE CARREFULLY FOR THIS SETTINGS, NOW YOU WILL WRITE THE BOOTCORE AREA!!!!
Connect testpoint and click on Do the Job!
Disconnect testpoint after mesage appair (Pause 3, 2, 1 - you have 3 only seconds to disconnect testpoint!).
Wait to finish, you will see the message: Boot released. Everything is closed.!

Connect again is Service mode (without testpoint) and see in the log if appair: Phone is in "Service Mode". SecurityStatus: "FactoryMode"
Go to the Normal mode (you need again to push shortly the Power key and see if your phone is started.
That is...
dagos
 
Hi to all of you , now i want to update the el71 i have an usb original cable and i download the firmaware everything starts fine the phone is found ok on com 8 start to update everything fine but after 5-7 minutes keeps tell CANOT CONNECT PHONE. CHECK IF ATHACHED CORECTLY.???? please can some one help please , cheers

Erhalte Informationen:
Model: SIEMENS EL71 12 lg1
Telefon ist im "Normal Mode"
IMEI: 358941003257089
SecurityStatus: CustomerMode
HWID: 407
Akkuspannung: 3941 mV.
EELITE Info: free buffer 185280 bytes, free at all 206304 bytes, free for deleted 206304 bytes.
EEFULL Info: free buffer 62432 bytes, free at all 466432 bytes, free for deleted 204352 bytes.
Map Info: Date: 23/08/06, Variant: A 145, Std-Map/SW: 1/12, D-Map/Prov.: 100/56
F
 
Martech can unlock e71 (I didnt tried but that's what they say) via testpoint, so it is probably posible to unlock it via xflasher knowing the right address for stored bootkey and skey in flash...

Any idea where?
 
this is the one that i checked by me and not work, the not accept skey

48373B56A77C1C41C67122BF1487E180
 
Auto Ignition...
Transfer boot...
BOOT is loaded...
Pause 2 sec...
Getting Information...
FlashID: 0089,887E (64Mb) ...(Intel)
EL71 SIEMENS 352849010192783
HASH: C3E74708EA370AB4C87F3735E4F01734
OTP ESN: A9FD826C
OTP IMEI: 352849010192783
Test data bus D0..D15...OK.
Test address bus A2..A22...OK.
Boot released. Everything is closed.
Calculation of keys...
Key not found!


EL71 V39, with papuas 7.9c and 9.1 no keys calculated by test point...
any help please??
 
BouRRi_GSM , i have EL71 dead and after full flash with x65flasher-2103 .It can enter service mode but can not power on !! Please help me !!!
 
1-attash tp to gnd
2-open papua v1.1.1
3-go to flash tab
4-chose pause and 76'5008'5009'5077 in recalculate keys
5-do the job and detash tp wen asck pause 2 second
in few second your fone is unlocked
tested in v23 100/100ok
 
with calculatet keys is the Testpoint not needed for "Recalc all Keys"

@ hdeyda wrong TP picture is a E71 not EL71
 
Additional info - all the info sounds are extremely loud. Empty battery, dialing tone, ringing tone - sometimes it switches to normal after 2-3 rings.

When I look into phone info (second page after *#06#, there is written :
Info tone parameters 0/ROM. On my E71 I have 5/ROM . Could this difference have to do something with it?
 
@nova75c

with TP, use latest Papua and post log here
if u haven't eep backup, ucan't get full repaired EL71 with free tool


easy solution for completely dead EL71 :

1- write Full Flash with V-Klay (depend from Flash type intel or ST)
2- Write original working bcore with V-Klay (or repaired bcore with winhex method 100%)
3- Do repair with SST original

that's how i repair totally dead EL71 and it's 100% working in many pcs
 
Is it possible to calculate Skey & Bkey in fw41 with papua or x65flashor or somehow?
bsReader says:
HASH:9FEFFDBBBE988961EB011D4C426DD5B2
ESN:A3BBD21B
IMEI: 358941005196913
but x65flasher can not calculate the code nor papuautils, the only way is tp (warranty byebye), or is there another methode?
regards
 
Tanks friend please don't remove as i have to wait to download, PLEASE REMEMBER PASSWORD?
Tanks again.
Pandemonio100
 
Back
Top