BB5系列降版的技巧与利弊:
BB5系列降版的技巧与利弊
JAF1.98.5首推降版功能以后！其他刷N机的仪器都紧贴跟进推出降版功能，
共计四种仪器有降版功能，分别是：
UFS-3 HWK正式版 能降级的最低版本平台为:3.04.1
UB 能降级的最低版本平台为:2.20
MT-BOX 能降级的最低版本平台为:1.29.5
JAF 正式版 能降级的最低版本平台为:1.98.5
这些都可以轻松的降级BB5系列的手机了
一；
JAF使用降版功能的技巧：不刷机备份CRT 308和CRT BKP。
以我的经验，刷机时不是每次都能备份成功的，（下面有实例可以看）
所以才需要手动备份,备份不了刷机风险很大，而且刷坏的的机子是
解不了网锁的，SP区域将是：FFFFFFFFFFFFFFF
这样做可以防止刷出网络锁和将串号降成了12345600654321？
方法如下：
只勾上 Use INI和 CRT 308还有CRT BKP这3项,不使用其他任何功能，
（有其他功能在使用的可以将其手动关闭）然后
按FLASH，JAF就会自动备份CRT 308和CRT BKP这两项。
看看N73手动备份的LOG：
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
Backing up CRT data...
Setting FLASH MODE
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Reading NPC certificate...
Reading VARIANT certificate...
Reading CCC certificate...
CCC not available...
Reading HWC certificate...
HWC not available...
Saved to C:\Program
Files\ODEON\JAF\ProgData\35185101866104_CRT_backup_1920134.rpl
Backup CRT OK!
Backing up SIMLOCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\351851018661042_CRT_backup_1921134.pm
Done!
Backup LCK OK!
Done!
Total time: 0 Minutes, 1 Seconds
DCT4/BB5 counter: 88
After flash processing...
Waiting for phone to boot...
Reading...
Phone type: RM-133, Software version: 05wk47v34.1
IMEI: 351851018661042
APE Ver: V 3.0638.0.0.1
30-10-2006
RM-133
Variant Ver: V 3.0638.0.0.1-C9
30-10-06
RM-133
Product Code: 0542531
Done!
一般没什么BUG的机器不要随便就降级，可能会导致更多的BUG出现。
例如N72的5.706版本，虽然有简体中文,但没有CHINA区,很多机子
升完级以后插SIM卡就死机，又或者*#92702689#无法按出,
上网的时候，网站名出现?号,不能正常显示等等问题。
出现的问题简直太多了。
这才需要降版，只要把它们都降级到2.0635.3.0.2的版本，功能一切正常！
（可惜把降级的LOG搞不见了，哎~~~~）
二；
降级的弊端：
S40系统的机器不太适合降级，注意：不是不能，而是不太适合！！
5200和5300的3.93版本都有发信息就死机和发彩信定屏的问题，
但是5200和5300并不适合用来降级，这就关系到了操作系统的问题了，
在很多次的降级功能使用中发觉：
S40操作系统的机子，例如：5200，5200，6131等，在降完了版之后
出现在开机一闪就关机，又或者开机后见到了NOKIA的标志后关机！！
用5针线来降级在HWK和MT上可用，同样也需要在BSI脚（电池检测脚）
加上7.5K电阻，5针线在JAF上是每刷必死的，很多的时候过程完全正常，
刷完到最后一步复位的时候定住了，提示失败！
N80 降级失败，也看到了不能自动备份LCK和BKP，请看LOG：
JAF version 1.98.22
Detected PKEY: 90004BEE
Card life counter: 79.76%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: F:\products\ mPhu#oK'f
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
INI file .ini is missing. Continue searching for second ini type...
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: F:\products\RM-92\N80_4.0632.0.38-prd_western_C00_cc.fpsx
PPM Flash file: F:\products\RM-92\N80_rofx_4.0632.0.38-prd.V14
CNT Flash file: NONE
APE Variant file: F:\products\RM-92\N80_userarea_4.0632.0.38-prd.U01
Languages in ppm: English,Simpl Chinese,Trad Chinese O52
Backing up SIMLOCK data... ( 两个备份都失败了)
Setting local mode...
Failed! Aborting!
Failed to backup LCK...
Preparing for downgrade...
为 降级 做 准备 ...
Failed to prepare for downgrade...
电话 为 降级 准备 好了!
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID: 00
Asic EM ID: 00000B21
Asic Public ID: 01800104DD890054E83D10EE0219921794C03C09
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg 7
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 41 seconds...
Writing...
Stage 1
Sending APE HASH for KEYS
Sending CMT HASH for NOLO
Sending APE HASH for X-LOADER
Sending CMT HASH for KEYS
Sending APE HASH for PRIMAPP
Sending CMT HASH for PRIMAPP
Sending CMT HASH for PASUBTOC
Sending APE HASH for SOS+LOADER
Sending CMT PUB KEYS...
Sending CMT HASH for UPDAPP
Sending APE HASH for SOS*UPDAPP
Sending CMT HASH for ADL
Sending CMT HASH for DSP0
Sending APE HASH for SOS+UZIP
Sending APE PUB KEYS...
Sending APE HASH for PASUBTOC
Sending APE HASH for ADL
Sending APE HASH for SOS+XZIP
Sending APE HASH for SOS*CORE
Sending CMT HASH for MCUSW
Stage 2
Operation took 3 minutes 41 seconds...
Reseting phone...
PPM: F:\products\RM-92\N80_rofx_4.0632.0.38-prd.V14
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID:
Asic EM ID: 00000B21
Asic Public ID: 01800104DD890054E83D10EE0219921794C03C09
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 8 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 1 seconds...
Writing...
Operation took 1 minutes 54 seconds...
Reseting phone...
APE VARIANT: F:\products\RM-92\N80_userarea_4.0632.0.38-prd.U01
Booting phone... .
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID: 00
Asic EM ID: 00000B21
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 7 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 1 seconds...
Writing...
Operation took 1 minutes 0 seconds...
Reseting phone...
Done!
Total time: 7 Minutes, 46 Seconds
DCT4/BB5 counter: 42
After flash processing...
Waiting for phone to boot...
Failed! Aborting!
失败! 结束!
个人感觉用MT的USB来降级是最安全和快捷的，（JAF没有USB降级此项功能）
用法也简单：
一，点MT的USB
二，按Info读出手机信息，确认联机了
三，选好你需要的版本，
四，按降级按钮'BB5 Downgrade'就可以了，
MT将帮你做完一切该做的东东。
看看用MT的USB降级5300的LOG:
Phone is in: Normal mode
Scanning files, please wait...
Done
Selected Highest installed version: 04.71
Model: RM-146 (Cosmo )
V 04.71/28-02-07/RM-146 (c) Nokia.
Production serial number DLK234821
Product code 0532162
Module code 0203051
Basic production code 0530536
Flash code
Order number
Long production SN
MCU SW V 04.71/28-02-07/RM-146/(c) Nokia.
HW 2002
PCI
RFIC 17211721
DSP pb06w14v33
PPM V 04.71/28-02-07/RM-146/(c) Nokia. /R
BT MCM 06cc-P8.0
Retu 32
Tahvo 52
Content Pack Content: r/V 04.71/28-02-07/RM-146/(c) Nokia. /
IMEI: 352772014031833
WARNING:
THE VERSION YOU SELECTED: 03.93
is NOT the highest installed!!!
the highest available is: 04.71
BB5 Downgrade - - - - - - - - - - -
VBat is 4.06V
Vpp pin has 0.09V, Not Connected
Pins:
Mbus 1, Box Tx 1, Box Rx 0, Bsi 0
Phone is in: Normal mode
Found record. Clearing and sending to phone..
============== Staring flash procedure =================
BB5 PM back Phone is in: Normal mode
IMEI: 352772014031833
Backup file: C:\Program Files\GriffinTeam\MT-Box\bb5bckup\RM-146_352772014031833.pm
Processing File: rm146__03.93.mcusw
Boot...
\\?\nmwcd#vid_0421&pid_04b8&if_oth#7&34be52f8&0&05#{4f919102-4adf-11d5-882d-00b0d02fe381}
Sending UPDAPP code
Restarting device...
Pooling for device removal...
Device removed
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[31.75 MB]...
erasing RAP [00000000 to 000006BF]
erasing RAP [000006C0 to 0001FFFF]
erasing RAP [00020000 to 0007FFFF]
erasing RAP [00080000 to 000DFFFF]
erasing RAP [00100000 to 001FFFFF]
erasing RAP [00200000 to 0031FFFF]
erasing RAP [00320000 to 0105FFFF]
erasing RAP [01060000 to 01067FFF]
erasing RAP [01068000 to 0107FFFF]
erasing RAP [01600000 to 01FDFFFF]
erasing RAP [01080000 to 015FFFFF]
in 187.34s
Flash[14.21 MB]...in 106.48s
* * Processed file in 312.69 seconds
Processing File: rm146__03.93.image_ctv_cn
Boot...
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[0.00 MB]...
in 0.11s
Flash[2.57 MB]...in 18.94s
* * Processed file in 19.38 seconds
Processing File: rm146__03.93.ppm_r
Boot...
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[0.00 MB]...
in 0.20s
Flash[5.10 MB]...in 37.55s
* * Processed file in 38.08 seconds
Restarting device...
Pooling for device removal...
Device disconnected.
* * * Phone flashing done in 6:20 minutes
Post Flash serial tunning of phone....
Pooling mode for full factory set...
V 03.93/20-11-06/RM-146 (c) Nokia.
IMEI: 352772014031833
Factory Default Settings...OK
要记得：不开机的机器是不可能用USB来降级和救死机的，
三；
降级的利处：
如果过你的机器是高版本的，而且BUG比较多，降版将是一个好的选择，
3250的4.14与4.21版本应该说还不如3.24的版本好用，也不是说4.14与
4.21版本的BUG多，就是反映各方面很慢，上网各方面还是3.24好用些，
降级后请记得做一次软格机：*#7370#，这样用起来会比较稳定，
下面这部降完机的3250用着用着就出现了白屏，格一次后非常之正常，
用JAF成功降级3250的LOG：
一，手机需要在本地模式LOCAL MODE和测试模式TEST MODE才可以进行降版操作，
所以需要在7针数据线的BSI脚（电池检测脚）加上了7。5K电阻，
二，为防止刷出网络锁,勾上了备份:CRT 308和CRT BKP.
以下是成功降级的的LOG：
JAF version 1.98.22
Detected PKEY: 90004BEE
Card life counter: 84.73%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
30107
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: C:\Program Files\Nokia\Phoenix\Products\
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
FILES SET FOR FLASHING:
\Thunder_03.24_Core.fpsx
PPM Flash file: C:\Program Files\Nokia\Phoenix\ProducMCU Flash file: C:\Program
Files\Nokia\Phoenix\Products\RM-38
ts\RM-38
\Thunder_03.24_Variant_11.fpsx
CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_LFFS_Image_CHINA.fpsx
APE Variant file: NONE
Languages in ppm: English,Simpl Chinese
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_Core_CMCC_PROD.fpsx
PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_Variant_88.fpsx
CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_ERASE_LFFS_CMCC_PROD.fpsx
No valid write blocks! Writing will be skiped!
APE Variant file: NONE
Languages in ppm: English,CMCC
Backing up LCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\357934002197019_CRT_backup_1723112.pm
Done!
Backup LCK OK!
Preparing for downgrade...
为 降级 做 准备 ...
Phone ready for downgrade!
电话 为 降级 准备 好了!
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 4 minutes 11 seconds...
Writing...
Stage 1
Sending CMT HASH for MCUSW
Sending CMT HASH for SOS+CORE1
Sending CMT HASH for NOLO
Sending CMT HASH for KEYS
Sending CMT HASH for PRIMAPP
Sending CMT HASH for PMM_CONF
Sending CMT PUB KEYS...
Sending CMT HASH for DSP0
Sending CMT HASH for SOS+ISASW
Sending CMT HASH for PASUBTOC
Sending CMT HASH for UPDAPP
Operation took 4 minutes 7 seconds...
Reseting phone...
PPM: C:\Program Files\Nokia\Phoenix\Products\RM-38\Thunder_03.24_Variant_88.fpsx
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 1 minutes 38 seconds...
Writing...
Stage 1
Sending CMT HASH for SOS+EXT0
Operation took 1 minutes 43 seconds....
Reseting phone...
CNT: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_ERASE_LFFS_CMCC_PROD.fpsx
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
No valid write blocks! Writing will be skiped!
Erasing...
Operation took 0 minutes 55 seconds...
Reseting phone...
Done!
Total time: 12 Minutes, 54 Seconds
DCT4/BB5 counter: 42
After flash processing...
Waiting for phone to boot...
Setting test mode...
Reading...
Phone type: RM-38, Software version: 03.24
IMEI: 357934002197019
APE Ver: V 03.24
16-06-06
RM-38
Variant Ver: V CHINA
01-04-06
RM-38
Product Code: 0526389
Setting FULL FACTORY......Setting test mode...
Setting FULL FACTORY...
Operation took 0 minutes 0 seconds...
Done!
Done!
Done!
降级的另一些技巧：
本人试过把6131从3.72升级到6.10后串号是 12345600654321？了，
而且刷的时候仪器也没有自动备份成功，很是郁闷呐！！！！
其实就是出现了这样的情况也不用慌的，只要你记得机器原来的版本
和使用的语言包，把手机降回原来的3.72版本后，串号自动修复了，
这就是降级的另一个好处：能够自动修复部分机子的串号，连写备份
都免了，爽啊~~~~，不过这种自动修复串号的机会只有30%~40%！！
三分之二的机子不能做到这点！！
这个自己忘了做备份了，顺手就拿了 GCNET 的那份LOG，呵呵，见谅
（GCNET著名的降级教程 ：JAF 1.98.5测试降级N91成功，教程首发）
JAF version 1.98.5
Detected PKEY: 90003499
Card life counter: 76.22%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
30107
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: C:\Program Files\Nokia\Phoenix\Products\
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
INI file .ini is missing. Continue searching for second ini type...
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-43
\RM43_V2.10.013.core
PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-43
\RM43_V2.10.013.11.variant
CNT Flash file: NONE
APE Variant file: NONE
Languages in ppm: English,Simpl Chinese
Backing up LCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\12345610654321?_CRT_backup_125852.pm
Done! （注意备份的串号是：12345610654321?）
Backup LCK OK!
Preparing for downgrade...
Phone ready for downgrade!
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: B54DD73E3966F3C1C6AED2AABE163F7FC25545A9
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006000C192101002200
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C20020572744E51D2E37613D8E2963DF8983336
HASH: E9EFF4BFAA5393217CA6B17755FC3E1400000000
ROM ID: F28A211FCEA7B19D
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv2_2nd.fg
Loader version: 01.0F.02 -> Revision: 0000
Patching CMT boot step2...
CMT Boot Ready
CMT Flash ID: 225000EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.0F.02 -> Revision: 0000
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.1D.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 003600EC
APE Flash Data: 00020000000600000000000000000000
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr_small.fg
Loader version: 01.23.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting RD data...
Public keys not available...
Erasing...
Operation took 0 minutes 40 seconds...
Writing...
Stage 1
Sending CMT HASH for NOLO
Sending APE HASH for KEYS
Sending APE HASH for X-LOADER
Sending CMT HASH for KEYS
Sending CMT HASH for PRIMAPP
Sending APE HASH for PRIMAPP
Sending CMT HASH for DSP0
Sending APE HASH for SOS+LOADER
Sending APE HASH for ADL
Sending APE HASH for SOS+XZIP
Sending APE HASH for PASUBTOC
Sending APE PUB KEYS...
Sending APE HASH for SOS*CORE
Sending CMT HASH for MCUSW
Sending CMT HASH for ADL
Sending CMT HASH for PASUBTOC
Sending CMT PUB KEYS...
Stage 2
Sending APE HASH for SOS+ROFS
Sending APE HASH for SOS+ROFX
Operation took 2 minutes 46 seconds...
Reseting phone...
PPM: C:\Program Files\Nokia\Phoenix\Products\RM-43\RM43_V2.10.013.11.variant
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: B54DD73E3966F3C1C6AED2AABE163F7FC25545A9
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006000C192101002200
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C20020572744E51D2E37613D8E2963DF8983336
HASH: E9EFF4BFAA5393217CA6B17755FC3E1400000000
ROM ID: F28A211FCEA7B19D
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv2_2nd.fg
Loader version: 01.0F.02 -> Revision: 0000
Patching CMT boot step2...
CMT Boot Ready
CMT Flash ID: 225000EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.0F.02 -> Revision: 0000
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.1D.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 003600EC
APE Flash Data: 00020000000600000000000000000000
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr_small.fg
Loader version: 01.23.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 2 seconds...
Writing...
Sending APE HASH for SOS+ROFX
Operation took 2 minutes 9 seconds...
Reseting phone...
Done!
Total time: 5 Minutes, 58 Seconds
DCT4/BB5 counter: 242
After flash processing...
Waiting for phone to boot...
Setting test mode...
Reading...
Phone type: RM-43, Software version: w33_06w24v4
IMEI: 358391000913351 （现在是：358391000913351 降级把串号也修复了，呵呵）
APE Ver: (null)
Variant Ver: (null)
Product Code: 0524312
Setting FULL FACTORY......Setting test mode...
Setting FULL FACTORY...
Operation took 0 minutes 1 seconds...
Done!
Done!
Done!
千万注意了：
拷贝版的UFS-3最高只能使用HWK3.03正式版，
因为3.04以上的正式版软件有自动检测功能，检测到有破解程序会自动进行
删除破解程序，导致系统死机不开,更不用说要使用有降版能力的3.04.1
降级时的改线加电阻也很重要，手机如果不能进入不了本地模式LOCAL MODE
和测试模式TEST MODE就无法备份备份CRT 308和CRT BKP，还谈什么降级啊？
改线的电阻值如下：
3250 - 7.5k
5300 - 5.1k
5500 - 5.1k
6125 - 5.1k
6131 - 5.1k
6233 - 5.1k
6270 - 5.1k
6280 - 5.1k
6630 - 5.1k
6680 - 5.1k
6681 - 5.1k
6682 - 5.1k
7370 - 5.1k
E-50 - 5.1k
E-60 - 5.1k
E-61 - 7.5k
E-70 - 5.1k
N-70 - 5.1k
N-71 - 7.5k
N-73 - 5.1k
N-80 - 7.5k
N-90 - 5.1k
N-91 - 7.5k
N-93 - 7.5k
其实我们不可能买那么多不同的电阻的，全部用上7.5k也是可以的！我的线全部
加的是7.5k电阻，不见得会影响使用，改线的目的只是要手机进入local mode
如果你觉得改线很麻烦的话，也可以买一个转换头，10RMB，深圳现在就有卖了，
做工挺漂亮的，不就省下了琐碎的改线问题！
改线后还可能出现另一个问题：
Error sync the phone...
这个问题在论坛上各有各的说法，如果你在改线前这条线是可以正常使用的，
那么，这应该是 BSI脚的对地电阻值不对了，正常应该是68K，但是实际改线
中我碰到了不少线该电阻只有3.8K，不知道做线的厂商搞什么鬼！你只要把
这个电阻改成68K的，Error sync the phone... 的问题可以解决！！
如果你想在JAF上降级又找不到7针线，可以自行DIY一下：
把在MT-BOX 或 UFS-3 用的5针线改成JAF用的7针线：
1 2 3
A 4 5 B
看图：原来是5针的1 2 3 4 5，现在补上A B两针，
一，把原来的1针线转接到B上
二，把第3针短接到A再接电池的负极和9V电池的负极，
三，把空出来的1针接上二极管的负极，二极管的正极接9V电池的正极，
BB5系列降版的技巧与利弊
JAF1.98.5首推降版功能以后！其他刷N机的仪器都紧贴跟进推出降版功能，
共计四种仪器有降版功能，分别是：
UFS-3 HWK正式版 能降级的最低版本平台为:3.04.1
UB 能降级的最低版本平台为:2.20
MT-BOX 能降级的最低版本平台为:1.29.5
JAF 正式版 能降级的最低版本平台为:1.98.5
这些都可以轻松的降级BB5系列的手机了
一；
JAF使用降版功能的技巧：不刷机备份CRT 308和CRT BKP。
以我的经验，刷机时不是每次都能备份成功的，（下面有实例可以看）
所以才需要手动备份,备份不了刷机风险很大，而且刷坏的的机子是
解不了网锁的，SP区域将是：FFFFFFFFFFFFFFF
这样做可以防止刷出网络锁和将串号降成了12345600654321？
方法如下：
只勾上 Use INI和 CRT 308还有CRT BKP这3项,不使用其他任何功能，
（有其他功能在使用的可以将其手动关闭）然后
按FLASH，JAF就会自动备份CRT 308和CRT BKP这两项。
看看N73手动备份的LOG：
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
Backing up CRT data...
Setting FLASH MODE
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Reading NPC certificate...
Reading VARIANT certificate...
Reading CCC certificate...
CCC not available...
Reading HWC certificate...
HWC not available...
Saved to C:\Program
Files\ODEON\JAF\ProgData\35185101866104_CRT_backup_1920134.rpl
Backup CRT OK!
Backing up SIMLOCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\351851018661042_CRT_backup_1921134.pm
Done!
Backup LCK OK!
Done!
Total time: 0 Minutes, 1 Seconds
DCT4/BB5 counter: 88
After flash processing...
Waiting for phone to boot...
Reading...
Phone type: RM-133, Software version: 05wk47v34.1
IMEI: 351851018661042
APE Ver: V 3.0638.0.0.1
30-10-2006
RM-133
Variant Ver: V 3.0638.0.0.1-C9
30-10-06
RM-133
Product Code: 0542531
Done!
一般没什么BUG的机器不要随便就降级，可能会导致更多的BUG出现。
例如N72的5.706版本，虽然有简体中文,但没有CHINA区,很多机子
升完级以后插SIM卡就死机，又或者*#92702689#无法按出,
上网的时候，网站名出现?号,不能正常显示等等问题。
出现的问题简直太多了。
这才需要降版，只要把它们都降级到2.0635.3.0.2的版本，功能一切正常！
（可惜把降级的LOG搞不见了，哎~~~~）
二；
降级的弊端：
S40系统的机器不太适合降级，注意：不是不能，而是不太适合！！
5200和5300的3.93版本都有发信息就死机和发彩信定屏的问题，
但是5200和5300并不适合用来降级，这就关系到了操作系统的问题了，
在很多次的降级功能使用中发觉：
S40操作系统的机子，例如：5200，5200，6131等，在降完了版之后
出现在开机一闪就关机，又或者开机后见到了NOKIA的标志后关机！！
用5针线来降级在HWK和MT上可用，同样也需要在BSI脚（电池检测脚）
加上7.5K电阻，5针线在JAF上是每刷必死的，很多的时候过程完全正常，
刷完到最后一步复位的时候定住了，提示失败！
N80 降级失败，也看到了不能自动备份LCK和BKP，请看LOG：
JAF version 1.98.22
Detected PKEY: 90004BEE
Card life counter: 79.76%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: F:\products\ mPhu#oK'f
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
INI file .ini is missing. Continue searching for second ini type...
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: F:\products\RM-92\N80_4.0632.0.38-prd_western_C00_cc.fpsx
PPM Flash file: F:\products\RM-92\N80_rofx_4.0632.0.38-prd.V14
CNT Flash file: NONE
APE Variant file: F:\products\RM-92\N80_userarea_4.0632.0.38-prd.U01
Languages in ppm: English,Simpl Chinese,Trad Chinese O52
Backing up SIMLOCK data... ( 两个备份都失败了)
Setting local mode...
Failed! Aborting!
Failed to backup LCK...
Preparing for downgrade...
为 降级 做 准备 ...
Failed to prepare for downgrade...
电话 为 降级 准备 好了!
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID: 00
Asic EM ID: 00000B21
Asic Public ID: 01800104DD890054E83D10EE0219921794C03C09
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg 7
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 41 seconds...
Writing...
Stage 1
Sending APE HASH for KEYS
Sending CMT HASH for NOLO
Sending APE HASH for X-LOADER
Sending CMT HASH for KEYS
Sending APE HASH for PRIMAPP
Sending CMT HASH for PRIMAPP
Sending CMT HASH for PASUBTOC
Sending APE HASH for SOS+LOADER
Sending CMT PUB KEYS...
Sending CMT HASH for UPDAPP
Sending APE HASH for SOS*UPDAPP
Sending CMT HASH for ADL
Sending CMT HASH for DSP0
Sending APE HASH for SOS+UZIP
Sending APE PUB KEYS...
Sending APE HASH for PASUBTOC
Sending APE HASH for ADL
Sending APE HASH for SOS+XZIP
Sending APE HASH for SOS*CORE
Sending CMT HASH for MCUSW
Stage 2
Operation took 3 minutes 41 seconds...
Reseting phone...
PPM: F:\products\RM-92\N80_rofx_4.0632.0.38-prd.V14
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID:
Asic EM ID: 00000B21
Asic Public ID: 01800104DD890054E83D10EE0219921794C03C09
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 8 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 1 seconds...
Writing...
Operation took 1 minutes 54 seconds...
Reseting phone...
APE VARIANT: F:\products\RM-92\N80_userarea_4.0632.0.38-prd.U01
Booting phone... .
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: 1C80AED26A7C77EAFF4D17CE90DDA64827380C7B
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101003000
Asic Mode ID: 00
Asic EM ID: 00000B21
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 273F6D55DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22E800EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.14.02 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.21.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 00A100EC
APE Flash Data: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr.fg
Loader version: 01.29.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 7 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 1 seconds...
Writing...
Operation took 1 minutes 0 seconds...
Reseting phone...
Done!
Total time: 7 Minutes, 46 Seconds
DCT4/BB5 counter: 42
After flash processing...
Waiting for phone to boot...
Failed! Aborting!
失败! 结束!
个人感觉用MT的USB来降级是最安全和快捷的，（JAF没有USB降级此项功能）
用法也简单：
一，点MT的USB
二，按Info读出手机信息，确认联机了
三，选好你需要的版本，
四，按降级按钮'BB5 Downgrade'就可以了，
MT将帮你做完一切该做的东东。
看看用MT的USB降级5300的LOG:
Phone is in: Normal mode
Scanning files, please wait...
Done
Selected Highest installed version: 04.71
Model: RM-146 (Cosmo )
V 04.71/28-02-07/RM-146 (c) Nokia.
Production serial number DLK234821
Product code 0532162
Module code 0203051
Basic production code 0530536
Flash code
Order number
Long production SN
MCU SW V 04.71/28-02-07/RM-146/(c) Nokia.
HW 2002
PCI
RFIC 17211721
DSP pb06w14v33
PPM V 04.71/28-02-07/RM-146/(c) Nokia. /R
BT MCM 06cc-P8.0
Retu 32
Tahvo 52
Content Pack Content: r/V 04.71/28-02-07/RM-146/(c) Nokia. /
IMEI: 352772014031833
WARNING:
THE VERSION YOU SELECTED: 03.93
is NOT the highest installed!!!
the highest available is: 04.71
BB5 Downgrade - - - - - - - - - - -
VBat is 4.06V
Vpp pin has 0.09V, Not Connected
Pins:
Mbus 1, Box Tx 1, Box Rx 0, Bsi 0
Phone is in: Normal mode
Found record. Clearing and sending to phone..
============== Staring flash procedure =================
BB5 PM back Phone is in: Normal mode
IMEI: 352772014031833
Backup file: C:\Program Files\GriffinTeam\MT-Box\bb5bckup\RM-146_352772014031833.pm
Processing File: rm146__03.93.mcusw
Boot...
\\?\nmwcd#vid_0421&pid_04b8&if_oth#7&34be52f8&0&05#{4f919102-4adf-11d5-882d-00b0d02fe381}
Sending UPDAPP code
Restarting device...
Pooling for device removal...
Device removed
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[31.75 MB]...
erasing RAP [00000000 to 000006BF]
erasing RAP [000006C0 to 0001FFFF]
erasing RAP [00020000 to 0007FFFF]
erasing RAP [00080000 to 000DFFFF]
erasing RAP [00100000 to 001FFFFF]
erasing RAP [00200000 to 0031FFFF]
erasing RAP [00320000 to 0105FFFF]
erasing RAP [01060000 to 01067FFF]
erasing RAP [01068000 to 0107FFFF]
erasing RAP [01600000 to 01FDFFFF]
erasing RAP [01080000 to 015FFFFF]
in 187.34s
Flash[14.21 MB]...in 106.48s
* * Processed file in 312.69 seconds
Processing File: rm146__03.93.image_ctv_cn
Boot...
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[0.00 MB]...
in 0.11s
Flash[2.57 MB]...in 18.94s
* * Processed file in 19.38 seconds
Processing File: rm146__03.93.ppm_r
Boot...
Pooling for ADL device...
\\?\nmwcd#vid_0421&pid_0105&if_oth#7&f749889&0&00#{4f919102-4adf-11d5-882d-00b0d02fe381}
Erase[0.00 MB]...
in 0.20s
Flash[5.10 MB]...in 37.55s
* * Processed file in 38.08 seconds
Restarting device...
Pooling for device removal...
Device disconnected.
* * * Phone flashing done in 6:20 minutes
Post Flash serial tunning of phone....
Pooling mode for full factory set...
V 03.93/20-11-06/RM-146 (c) Nokia.
IMEI: 352772014031833
Factory Default Settings...OK
要记得：不开机的机器是不可能用USB来降级和救死机的，
三；
降级的利处：
如果过你的机器是高版本的，而且BUG比较多，降版将是一个好的选择，
3250的4.14与4.21版本应该说还不如3.24的版本好用，也不是说4.14与
4.21版本的BUG多，就是反映各方面很慢，上网各方面还是3.24好用些，
降级后请记得做一次软格机：*#7370#，这样用起来会比较稳定，
下面这部降完机的3250用着用着就出现了白屏，格一次后非常之正常，
用JAF成功降级3250的LOG：
一，手机需要在本地模式LOCAL MODE和测试模式TEST MODE才可以进行降版操作，
所以需要在7针数据线的BSI脚（电池检测脚）加上了7。5K电阻，
二，为防止刷出网络锁,勾上了备份:CRT 308和CRT BKP.
以下是成功降级的的LOG：
JAF version 1.98.22
Detected PKEY: 90004BEE
Card life counter: 84.73%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
30107
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: C:\Program Files\Nokia\Phoenix\Products\
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
FILES SET FOR FLASHING:
\Thunder_03.24_Core.fpsx
PPM Flash file: C:\Program Files\Nokia\Phoenix\ProducMCU Flash file: C:\Program
Files\Nokia\Phoenix\Products\RM-38
ts\RM-38
\Thunder_03.24_Variant_11.fpsx
CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_LFFS_Image_CHINA.fpsx
APE Variant file: NONE
Languages in ppm: English,Simpl Chinese
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_Core_CMCC_PROD.fpsx
PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_Variant_88.fpsx
CNT Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_ERASE_LFFS_CMCC_PROD.fpsx
No valid write blocks! Writing will be skiped!
APE Variant file: NONE
Languages in ppm: English,CMCC
Backing up LCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\357934002197019_CRT_backup_1723112.pm
Done!
Backup LCK OK!
Preparing for downgrade...
为 降级 做 准备 ...
Phone ready for downgrade!
电话 为 降级 准备 好了!
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 4 minutes 11 seconds...
Writing...
Stage 1
Sending CMT HASH for MCUSW
Sending CMT HASH for SOS+CORE1
Sending CMT HASH for NOLO
Sending CMT HASH for KEYS
Sending CMT HASH for PRIMAPP
Sending CMT HASH for PMM_CONF
Sending CMT PUB KEYS...
Sending CMT HASH for DSP0
Sending CMT HASH for SOS+ISASW
Sending CMT HASH for PASUBTOC
Sending CMT HASH for UPDAPP
Operation took 4 minutes 7 seconds...
Reseting phone...
PPM: C:\Program Files\Nokia\Phoenix\Products\RM-38\Thunder_03.24_Variant_88.fpsx
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 1 minutes 38 seconds...
Writing...
Stage 1
Sending CMT HASH for SOS+EXT0
Operation took 1 minutes 43 seconds....
Reseting phone...
CNT: C:\Program Files\Nokia\Phoenix\Products\RM-38
\Thunder_03.24_ERASE_LFFS_CMCC_PROD.fpsx
Booting phone...
CMT Boot Data:
Asic ID: 000000010000022600010006010C192101001101
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C400107237551562090962CC572C0825EB2A3C9
HASH: BAF3A9C3DBFA8454937DB77F2B8852B100000000
ROM ID: 191EC665DFAAF68F
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv3_2nd.fg
Loader version: 01.10.02 -> Revision: 0000
Patching CMT boot step1...
Patching CMT boot step2...
Patching CMT boot step3...
CMT Boot Ready
CMT Flash ID: 22FE00EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.10.01 -> Revision: 0000
Patching CMT loader step1...
Patching CMT loader step3...
CMT Loader Ready
Operation took 0 minutes 6 seconds...
Reading Public keys...
Getting Public Keys...
No valid write blocks! Writing will be skiped!
Erasing...
Operation took 0 minutes 55 seconds...
Reseting phone...
Done!
Total time: 12 Minutes, 54 Seconds
DCT4/BB5 counter: 42
After flash processing...
Waiting for phone to boot...
Setting test mode...
Reading...
Phone type: RM-38, Software version: 03.24
IMEI: 357934002197019
APE Ver: V 03.24
16-06-06
RM-38
Variant Ver: V CHINA
01-04-06
RM-38
Product Code: 0526389
Setting FULL FACTORY......Setting test mode...
Setting FULL FACTORY...
Operation took 0 minutes 0 seconds...
Done!
Done!
Done!
降级的另一些技巧：
本人试过把6131从3.72升级到6.10后串号是 12345600654321？了，
而且刷的时候仪器也没有自动备份成功，很是郁闷呐！！！！
其实就是出现了这样的情况也不用慌的，只要你记得机器原来的版本
和使用的语言包，把手机降回原来的3.72版本后，串号自动修复了，
这就是降级的另一个好处：能够自动修复部分机子的串号，连写备份
都免了，爽啊~~~~，不过这种自动修复串号的机会只有30%~40%！！
三分之二的机子不能做到这点！！
这个自己忘了做备份了，顺手就拿了 GCNET 的那份LOG，呵呵，见谅
（GCNET著名的降级教程 ：JAF 1.98.5测试降级N91成功，教程首发）
JAF version 1.98.5
Detected PKEY: 90003499
Card life counter: 76.22%
P-key nokia module version 01.00
Detected JAF INTERFACE version: 01.AC, Driver version: 40000, Library version:
30107
JAF DCT4/BB5 LOADERS DIR: C:\Program Files\ODEON\JAF\Flash\
JAF DCT4/BB5 PRODUCT DIR: C:\Program Files\Nokia\Phoenix\Products\
JAF USB LOADERS DIR: C:\Program Files\ODEON\JAF\FlashUSB\
JAF DCT3/DCTL LOADERS DIR: C:\Program Files\ODEON\JAF\Flash3\
Changing mode...Done!
FILES SET FOR FLASHING:
MCU Flash file: NONE
PPM Flash file: NONE
CNT Flash file: NONE
APE Variant file: NONE
INI file .ini is missing. Continue searching for second ini type...
Changing flashing settings...
FILES SET FOR FLASHING:
MCU Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-43
\RM43_V2.10.013.core
PPM Flash file: C:\Program Files\Nokia\Phoenix\Products\RM-43
\RM43_V2.10.013.11.variant
CNT Flash file: NONE
APE Variant file: NONE
Languages in ppm: English,Simpl Chinese
Backing up LCK data...
Setting local mode...
Reading IMEI...
C:\Program Files\ODEON\JAF\ProgData\12345610654321?_CRT_backup_125852.pm
Done! （注意备份的串号是：12345610654321?）
Backup LCK OK!
Preparing for downgrade...
Phone ready for downgrade!
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: B54DD73E3966F3C1C6AED2AABE163F7FC25545A9
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006000C192101002200
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C20020572744E51D2E37613D8E2963DF8983336
HASH: E9EFF4BFAA5393217CA6B17755FC3E1400000000
ROM ID: F28A211FCEA7B19D
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv2_2nd.fg
Loader version: 01.0F.02 -> Revision: 0000
Patching CMT boot step2...
CMT Boot Ready
CMT Flash ID: 225000EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.0F.02 -> Revision: 0000
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.1D.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 003600EC
APE Flash Data: 00020000000600000000000000000000
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr_small.fg
Loader version: 01.23.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting RD data...
Public keys not available...
Erasing...
Operation took 0 minutes 40 seconds...
Writing...
Stage 1
Sending CMT HASH for NOLO
Sending APE HASH for KEYS
Sending APE HASH for X-LOADER
Sending CMT HASH for KEYS
Sending CMT HASH for PRIMAPP
Sending APE HASH for PRIMAPP
Sending CMT HASH for DSP0
Sending APE HASH for SOS+LOADER
Sending APE HASH for ADL
Sending APE HASH for SOS+XZIP
Sending APE HASH for PASUBTOC
Sending APE PUB KEYS...
Sending APE HASH for SOS*CORE
Sending CMT HASH for MCUSW
Sending CMT HASH for ADL
Sending CMT HASH for PASUBTOC
Sending CMT PUB KEYS...
Stage 2
Sending APE HASH for SOS+ROFS
Sending APE HASH for SOS+ROFX
Operation took 2 minutes 46 seconds...
Reseting phone...
PPM: C:\Program Files\Nokia\Phoenix\Products\RM-43\RM43_V2.10.013.11.variant
Booting phone...
APE Boot Data:
Asic ID: 17100708
Asic Mode ID: 00
Asic Public ID: B54DD73E3966F3C1C6AED2AABE163F7FC25545A9
HASH: 49A97E826B93BA20B7ED0B082475C00500000000
ROM ID: 1DFD66132C872FD4
CMT Boot Data:
Asic ID: 000000010000022600010006000C192101002200
Asic Mode ID: 00
Asic EM ID: 00000352
Asic Public ID: 0C20020572744E51D2E37613D8E2963DF8983336
HASH: E9EFF4BFAA5393217CA6B17755FC3E1400000000
ROM ID: F28A211FCEA7B19D
CMT Boot File: C:\Program Files\ODEON\JAF\Flash\rap3gv2_2nd.fg
Loader version: 01.0F.02 -> Revision: 0000
Patching CMT boot step2...
CMT Boot Ready
CMT Flash ID: 225000EC
CMT Flash Data: 00000000000000000000000000000000
CMT Loader: C:\Program Files\ODEON\JAF\Flash\RAP3Gv3_algo.fg
Loader version: 01.0F.02 -> Revision: 0000
CMT Loader Ready
APE Boot: C:\Program Files\ODEON\JAF\Flash\helen3_2nd.fg
Loader version: 01.1D.00 -> Revision: 0000
Patching APE boot step1...
Patching APE boot step2...
Patching APE boot step3...
APE Boot Ready
APE Flash ID: 003600EC
APE Flash Data: 00020000000600000000000000000000
APE Loader: C:\Program Files\ODEON\JAF\Flash\h3_sam_nand_xsr_small.fg
Loader version: 01.23.00 -> Revision: 0000
Patching APE loader step1...
Patching APE loader step2...
Patching APE loader step3...
APE Loader Ready...
Operation took 0 minutes 9 seconds...
Reading Public keys...
Getting Public Keys...
Erasing...
Operation took 0 minutes 2 seconds...
Writing...
Sending APE HASH for SOS+ROFX
Operation took 2 minutes 9 seconds...
Reseting phone...
Done!
Total time: 5 Minutes, 58 Seconds
DCT4/BB5 counter: 242
After flash processing...
Waiting for phone to boot...
Setting test mode...
Reading...
Phone type: RM-43, Software version: w33_06w24v4
IMEI: 358391000913351 （现在是：358391000913351 降级把串号也修复了，呵呵）
APE Ver: (null)
Variant Ver: (null)
Product Code: 0524312
Setting FULL FACTORY......Setting test mode...
Setting FULL FACTORY...
Operation took 0 minutes 1 seconds...
Done!
Done!
Done!
千万注意了：
拷贝版的UFS-3最高只能使用HWK3.03正式版，
因为3.04以上的正式版软件有自动检测功能，检测到有破解程序会自动进行
删除破解程序，导致系统死机不开,更不用说要使用有降版能力的3.04.1
降级时的改线加电阻也很重要，手机如果不能进入不了本地模式LOCAL MODE
和测试模式TEST MODE就无法备份备份CRT 308和CRT BKP，还谈什么降级啊？
改线的电阻值如下：
3250 - 7.5k
5300 - 5.1k
5500 - 5.1k
6125 - 5.1k
6131 - 5.1k
6233 - 5.1k
6270 - 5.1k
6280 - 5.1k
6630 - 5.1k
6680 - 5.1k
6681 - 5.1k
6682 - 5.1k
7370 - 5.1k
E-50 - 5.1k
E-60 - 5.1k
E-61 - 7.5k
E-70 - 5.1k
N-70 - 5.1k
N-71 - 7.5k
N-73 - 5.1k
N-80 - 7.5k
N-90 - 5.1k
N-91 - 7.5k
N-93 - 7.5k
其实我们不可能买那么多不同的电阻的，全部用上7.5k也是可以的！我的线全部
加的是7.5k电阻，不见得会影响使用，改线的目的只是要手机进入local mode
如果你觉得改线很麻烦的话，也可以买一个转换头，10RMB，深圳现在就有卖了，
做工挺漂亮的，不就省下了琐碎的改线问题！
改线后还可能出现另一个问题：
Error sync the phone...
这个问题在论坛上各有各的说法，如果你在改线前这条线是可以正常使用的，
那么，这应该是 BSI脚的对地电阻值不对了，正常应该是68K，但是实际改线
中我碰到了不少线该电阻只有3.8K，不知道做线的厂商搞什么鬼！你只要把
这个电阻改成68K的，Error sync the phone... 的问题可以解决！！
如果你想在JAF上降级又找不到7针线，可以自行DIY一下：
把在MT-BOX 或 UFS-3 用的5针线改成JAF用的7针线：
1 2 3
A 4 5 B
看图：原来是5针的1 2 3 4 5，现在补上A B两针，
一，把原来的1针线转接到B上
二，把第3针短接到A再接电池的负极和9V电池的负极，
三，把空出来的1针接上二极管的负极，二极管的正极接9V电池的正极，