Sony Ericsson ARM Phones 2004/2005

Bruevich · Moderator Joined: 12 Feb 2006 Posts: 225

This group consists of the following sets:

Sony Ericsson
· K600i, K600c, K608i, V600i, V800, V802SE, Z800i, Z800c, W900i, W900c, Z1010i, Z1010c,
· F500i, J300i, J300c, J300a, K300i, K300c, K300a, K500i, K500c, K506c, K508i, K508c, K700i, K700c, S700i, S700c, S710a, Z500i, Z500c, Z500a,
· D750i, K750i, K750c, K758c, W550i, W550c, W600i, W800i, W800c, W810i, W810c, Z520i, Z520c, Z520a.

Phones of the first set are based on a baseband chip (CPU) with ID of 0x7100 (and rarely 0x7000).
Phones of the second set are based on a CPU with ID of 0x8000.
Phones of the third set are based on a CPU with ID of 0x8040 (and rarely 0x8000).

Almost all phones that started to be produced during the year 2005 contain a special flash area called EROM (Extended ROM).
These include all phones from the third set and the first set except Z1010 phones.
The latest phones (like W550i, W550c, W600i, W810i, W810c, W900i and W900c) support firmware upgrading from the phone menu (unless the phone provider has disabled to do so).
For this purpose, they contain a software part called FOTA User Agent (Flash Over The Air).

All these phones are protected by an RSA-based security scheme. It is difficult to overcome this security, we have to search for implementation bugs in original loaders.

Much more important than the phone type is a feature called CID (Customer ID).
Higher CID value usually means less bugs in loaders and therefore stronger security.
So far, these CIDs have been issued for Sony Ericsson phones: 16, 29, 36, 37, 49, 50, 51, 52 and 53.

Another parameter, one should know of, is the flash certificate color:

· Blue - indicates factory usage
· Brown - indicates developer usage
· Red - indicates product usage

The security is strongest with Red flash certificate color, that is why we usually convert "Red phones" to "Brown ones".

Another issue worth noting is that phone manufacturers took some countermeasures against us and disabled firmware startup when certificate change is detected.
This is usually the case with CID37 and later phones. Such phones manifest by a blinking charging LED when attempting to power them on.
It is therefore necessary to restore the flash certificate, to repair EROM or to flash EROM files.