maemo.org - Talk - [HOWTO] Remove security code prompt when turning on N9

maemo.org - Talk (https://talk.maemo.org/index.php)

- Nokia N9 / N950 (https://talk.maemo.org/forumdisplay.php?f=51)

- - [HOWTO] Remove security code prompt when turning on N9 (https://talk.maemo.org/showthread.php?t=88649)

[HOWTO] Remove security code prompt when turning on N9

Hello everyone, friend of mine had a problem - his N9 64GB started to ask for a security code one day after he removed and inserted again the SIM. Interesting is, he never set up a security code, and there is not some default one (like on Symbian) 12345, nor empty on whatsoever. NOKIA services in CZECH republic and not even on international hotlines did not know how to do it, claimed it iw impossible at all to get phone working without losing data. (DATA WERE 1000% IMPORTANT! real man had no backup)

I have managed to "hack" it all using some flashing and a little linux knowledge. Here is the guide:

I've mounted N9 to Linux PC, did a backup of "rootfs" and "userfs" partitions via dd and "MyDocs" partition just copied out what I've needed (not to take 64GB image with dd - would consume many time). After that, N9 shows warning when booting. I've flashed the device with original PR1.3 FW with EMMC.bin. I've flashed even Open-Mode kernel and disabled that scary warranty warning (to make his device look OK when trying to get Nokia warranty service). I've restored backups of 2 partitions and also copied back my files to MyDocs. Device booted up, no warranty warning and no security code prompt. EVERYTHING WORKING, NO DATA LOST! :D

I'll include all downloads & also the step by step guide how to do it.

This is only possible with LINUX PC (so use some e.g. Ubuntu)

DOWNLOADS:
N950 MeeGo kernel:

Code:

http://stskeeps.subnetmask.net/n950liberator/vmlinuz-2.6.32.20112201-11.2-adaptation-n950-bootloader

N950 MeeGo rescue initrd:

Code:

http://stskeeps.subnetmask.net/n950liberator/initrd.img-rescue-2.6.32.20112201-11.2-n950

Linux flasher_3.12.1_i386.deb:

Code:

http://tablets-dev.nokia.com/maemo-dev-env-downloads.php

OpenMode kernel:

Code:

http://maemo.cloud-7.de/HARM/N9/1.3/openmode-kernel/zImage-2.6.32.54-dfl61-20121301

Download FW files including EMMC:

Code:

http://skeiron.org/firmware/N9/40.2012.21.3/

Mine were those 2 /direct link to Nokia/:

Code:

http://nds2.fds-fire.nokia.com/p/d/fds_fire/1205/2811/7048829758/DFL61_HARMATTAN_40.2012.21-3_PR_LEGACY_001-OEM1-958_ARM.bin

http://nds2.fds-fire.nokia.com/p/d/fds_fire/1207/0317/7076789653/5EAFECEB_DFL61_HARMATTAN_40.2012.13-7.CENTRALEUROPE_EMMC_CENTRALEUROPE.bin

STEP BY STEP GUIDE:
1 - Turn off the device, unplug from USB.
2 - Install "flasher" to your pc (it will instal into /usr/bin/)
3 - Copy all files into /usr/bin/ (I assume you have basic UX knowledge)
4 - Start terminal, cd /usr/bin, run below command and then attach phone to USB cable

Code:

sudo flasher --load -k vmlinuz-2.6.32.20112201-11.2-adaptation-n950-bootloader -n initrd.img-rescue-2.6.32.20112201-11.2-n950 --boot

5 - Wait a minute and run "fdisk -l",you should see 3 more partitions (Like this: sdb* are phone ones, your names can differ. sdb1 id 56 or 9GB mass storage MyDocs partition, sdb2 for rootfs 4GB, sdb3 for userfs 2GB)

Code:

rusnak-cobra bin # fdisk -l



Disk /dev/sda: 120.0 GB, 120034123776 bytes

255 heads, 63 sectors/track, 14593 cylinders, total 234441648 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x0008c42a



   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *        2048      585727      291840   83  Linux

/dev/sda2          587774     2539519      975873    5  Extended

/dev/sda3         2539520   234440703   115950592   83  Linux

/dev/sda5          587776     2539519      975872   82  Linux swap / Solaris



Disk /dev/sdb: 64.1 GB, 64130908160 bytes

4 heads, 16 sectors/track, 1957120 cylinders, total 125255680 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x00000000



   Device Boot      Start         End      Blocks   Id  System

/dev/sdb1            1024   112672767    56335872    c  W95 FAT32 (LBA)

/dev/sdb2       112672768   121061375     4194304    0  Empty

/dev/sdb3       121061376   125255679     2097152   83  Linux

rusnak-cobra bin #

6 - Make a backup of those partitions using "dd" utility to place you want. Remember that path, you'll need it! It will show no progress, but you'll notice once it'll complete.

Code:

rusnak-cobra bin # sudo dd if=/dev/sdb2 of=/home/rusnak/Plocha/N9/rootfs_backup.img

8388608+0 read

8388608+0 written

4294967296 copied bytes (4,3 GB), 176,508 s, 24,3 MB/s

rusnak-cobra bin # sudo dd if=/dev/sdb3 of=/home/rusnak/Plocha/N9/userfs_backup.img

4194304+0 read

4194304+0 written

2147483648 copied bytes (2,1 GB), 88,6495 s, 24,2 MB/s

rusnak-cobra bin #

7 - In a common way, copy the files from biggest partition = 9 or 56GB sdb1 (Documents, DCIM, Downloads, whatever you need, not all the trash!) Put it anywhere you want you'll copy those files via mass storage once it'll end up all successfully.
8 - Unplug the device, flash the device running these commands, plug it after executing the command! (It'll erase all user data including the security lock, flash phone to look like new including the mass storage)

Code:

sudo flasher --erase-user-data=secure -fF DFL61_HARMATTAN_40.2012.21-3_PR_LEGACY_001-OEM1-958_ARM.bin -F DFL61_HARMATTAN_40.2012.13-7.CENTRALEUROPE_EMMC_CENTRALEUROPE.bin -R

9 - Turn it on, tur on developer mode, devel-su and pass, execute this command in terminal and turn it off again.

Code:

disclaimer-cal remove View-openmode

10 - Reflash device with Open-Mode kernel now (if you already have this problem, you can do it, why not)

Code:

sudo flasher -a DFL61_HARMATTAN_40.2012.21-3_PR_LEGACY_001-OEM1-958_ARM.bin -k zImage-2.6.32.54-dfl61-20121301 --flash-only=kernel --suppress-warranty-warning -f

11 - Do not turn on the device! Do what is in point 4 and after waiting a minute check by fdisk -l like in point 5
12 - Restore back the partitions backup into a phone using dd utility. It will show no progress, but you'll notice once it'll complete. Outpust should be common like in point 6.

Code:

sudo dd if=/home/rusnak/Plocha/N9/rootfs_backup.img of=/dev/sdb2

sudo dd if=/home/rusnak/Plocha/N9/userfs_backup.img of=/dev/sdb3

Now you have back your phone with NO SECURITY LOCK, NO DATA LOST and with OPEN-MODE KERNEL in it :)

My THANKS belongs to smarter people of MeeGo community: CODeRUS, itsnotabigtruck, rainisto

Re: [HOWTO] Remove security code promt when turning on N9

So basically it was just flashing the open mode kernel that did the trick...

Re: [HOWTO] Remove security code promt when turning on N9

no, it was really erasing completely whole phone. just reflashing it even with openmode did nothing at all, phone still wanted the code. after erasing all it was possible to turn on device, but I had a problem with accessing mydocs partition, so I hat to flash once again :) with emmc. then did the trick with replacing partitions from backup to have all data back and voila...

Re: [HOWTO] Remove security code promt when turning on N9

One minor comment here, as you suggest using dd for backup.

I always use tar because it only copies the logical filesystem hierarchy, as opposed to dd which copies the low-level disk format bytes.

Using tar is good enough because the filesystem does not contain anything "hidden" outside the directory areas, it is just normal unix filesystem. When you dd it, you end up with huge file that contains propably mostly empty area, with tar you only copy the parts that are necessary :)

I have done this a LOT so I can assure you it works :D

Another nice thing with tar backups, you can keep them on your PC and later selectively restore files from there if you manage to botch up something while experimenting. If your backups are dd'ed files, it's just chunk of data, you cannot easily fish out single files from it. (well of course you can do tha, but you need to mount it on loop fs and that's an extra hassle...)

Re: [HOWTO] Remove security code promt when turning on N9

maybe this is improvement :) users can try. surely someone who could not turn on phone without the code would be happy for any solution in that case :)

Re: [HOWTO] Remove security code promt when turning on N9

I am still new to N9, but I think erasin full deletes also lock code, or?
So why did you flash open mode kernel? Default/stock should have worked too! Of course together with eMMC.
Please correct me if I am wrong (speaking from N900 background).

Re: [HOWTO] Remove security code promt when turning on N9

just to keep all data. if you dont need the data you can just reflash phone with erasing.

Re: [HOWTO] Remove security code promt when turning on N9

erasing full deletes also lock code. that is why I did disk copy using DD.
openmode kernel is here included only for add more value to phone, nothing else. anyway, you have possibility to suppress warning message, as that will be shown once you will connect phone to PC again when trying to recover backup back to N9 using DD.

Re: [HOWTO] Remove security code prompt when turning on N9

Hello,

I did the steps 1 - 4. The phone shows a warning (I think that's right), but if I type "fdisk -l", I can't see any sdb partitions. :mad:
Any help?

Greetings from Germany!:)

Re: [HOWTO] Remove security code prompt when turning on N9

even after few minutes? logest I needed to wait were 4 minutes.

Re: [HOWTO] Remove security code prompt when turning on N9

Quote:

Originally Posted by justfive (Post 1338046)

Hello,

I did the steps 1 - 4. The phone shows a warning (I think that's right), but if I type "fdisk -l", I can't see any sdb partitions. :mad:
Any help?

Greetings from Germany!:)

Do a "dmesg" and look for the last few lines.
There should be something about connecting USB devices, if it is recognizing the exported partitions correctly.

Some linux distros do not mount volumes automatically, so you need to do that by hand.

Re: [HOWTO] Remove security code prompt when turning on N9

Quote:

Originally Posted by juiceme (Post 1338126)

How should I mount these partitions. I can't see them in the Disk Utility.

P.S. I'm using Linux Mint 14

Re: [HOWTO] Remove security code prompt when turning on N9

Well, post the output of your "dmesg" to pastebin.com so I can see how the partitions are detected.

Re: [HOWTO] Remove security code prompt when turning on N9

I think these are the important lines (those with usb).

http://pastebin.com/cccja9PB

Re: [HOWTO] Remove security code prompt when turning on N9

OK, it looks like now that the USB device cannot be exported as a mapped partition. Did you correctly shut down the device (long 8s press on the power button) before flashing the device wth the MALF removal kernel?

The device must be completely off, it will boot up after the flasher uploads the maintatance kernel to it.

If that does not work, there are alternate methods, you can boot the device up with MOSLO kernel or ubiboot-02 kernel and try to telnet into the device if the export still does ot work with those.

Re: [HOWTO] Remove security code prompt when turning on N9

It doesn't boot up. It stops at the warning message.

Re: [HOWTO] Remove security code prompt when turning on N9

Suddenly it's working!

After downloading this file: http://juiceme.cloud-7.de/ubiboot/ub...biboot-01-mtd5

I typed:

sudo flasher --load -k zImage_2.6.32.54-ubiboot-01-mtd5 -n initrd.img-rescue-2.6.32.20112201-11.2-n950 --boot

Then I pressed the power button and it's booting. No Data Lost!

But now the device is showing up a warning message at boot and asking for email passwords every time! Any solutions?

Re: [HOWTO] Remove security code prompt when turning on N9

OK, nice to know you got in :)

The reason it now shows the "scary warning" is because you are in open mode. The aegis security framework of your device is now in a half-working state.

The reason the device asks for the passwords is because originally the password storage was created using the aegis closed mode keys, and now your device wants to use open mode keys.

Solution to the second problem is easy. You need only delete the password storage and recreate it, then it will use the open mode keys and no longer ask the parrwords again.

Solution to the first problem is a bit more difficult. The removal of the open-mode warning can only be done when you are in closed mode, before entering open mode. So, if you want to get rid of that warning, you need to first back up everything and then reflash the device clean as that is the only way to go to open mode. Then you need to restore the backups.

Re: [HOWTO] Remove security code prompt when turning on N9

Quote:

Originally Posted by Rusnak-COBRA (Post 1314406)

4 - Start terminal, cd /usr/bin, run below command and then attach phone to USB cable

Code:

sudo flasher --load -k vmlinuz-2.6.32.20112201-11.2-adaptation-n950-bootloader -n initrd.img-rescue-2.6.32.20112201-11.2-n950 --boot

After 10 minutes "fdisk-l" shows only /dev/sda and no other partitions, while the device continues to show the warning screen.. I don't know what to do

Re: [HOWTO] Remove security code prompt when turning on N9

can any one please help how to do this in windows pc?