Motorola Razr V3x Personalization Guide (MoGu V3xPG) V2.5
(Volume 1 - Primary Mods)
V3X Personalization Guide-V2-5-eb-v1-061205.doc 92 of 227
ebentley
Disclaimer: Last thing I want to see as a result of this study is a bunch of files with bugs floating around and killing
people's phones. Once you possess certain knowledge, you have to be responsible for your action, and don't even
think about blaming me if something goes wrong. You should attempt this hacking at your own risk.
Recommended Tools for Hacking
RandomSHX - You can extract BIN files from SHX as well as create SHX from BIN files with this program (You will
mainly use this program) Randomx, Thanks!!!
XVI32 - This a hex editor. Feel free to use other hex editors if you have one, but XVI32 does work for me very well.
MFF - Most of you already have this program, and used for flashing/flexing.
* In our Hacking Talk, we will use 9CR Monster Pack, so that we can speak the same language on the subject.
Structure of Monster Pack
When you extract BIN files from Monster Pack SHX file using Random SHX, you will see 8 BIN files including Header
file and List file. I have examined Monster Packs from various Motorola models, and the file structures are all the same
regardless.
BIN 0 - Address None - SHX Header
BIN -
BIN 2 - Add
BIN 3 - Add
BIN 4 - Address
BIN 5 - Address 10F4 - LP CG 4
BIN 6 - Address 10D0 - DRM graphics CG 15
BIN 7 - Address 11FE - Sig CG 18
LST - Addre N
First thing th y res,
and study. T s
SHX Header (B
This Header file is the most important part. Take a closer look at it! (RandomSHX does NOT calculate Header
automatically, so you have to do the work)
Starting from Offset 3B6, you will see Addresses of each BIN files represented in reverse way. For example, 3B6 &
3B7 = FD 03 BIN 1 Boot Loader file
Next, take a look at the values in Offsets 3B8 & 3B9. Open up BIN 1 Boot Loader. Compare the last 4 digits of the last
offset of BIN 1 and offsets 3B8 & 3B9 from the BIN 0. Now you see those values are represented in reverse order.
Offset 3CC & 3CD represents Checksum of BIN 1 Boot Loader. This is true with all the BIN files.
One more important offset that you need to edit if you wanna compile different files, such as reflash, reflash_mlp, lp,
flexlash files, is the Offset 3B0. Take a look closely how those values differ from file to file.
I've been trying to explain the structure as simple as possible, and I hope you are clear on the topic that I've covered
so far. Now, next step would be the real application.
Application - Compiling MP with LP
1 Address 03FD - Boot Loader(RAM Downloader)
ress 1008 - Flash Main File(Mem. Map & Flash) CG 1
ress 1114 - Flex File CG 2
1004 - PDS CG 3
ss one - List File
at ou need to do is open up BIN files and List file with a hex editor, take a good look at the file structu
is a good place to start!
hi
IN 0)
To Next Page
Loading...
Need help?
General
