Wednesday, February 21, 2007

Debranding w300i walkthrough

Why debrand?
First I want to talk about the pros/cons of debranding. If you have already decided to do it, skip this section; however if you don't know the cons I recommend you read this. I debranded from Cingular; your pros/cons may vary somewhat. I have a Sony Ericsson w300i phone that I got new for Christmas. I immediately began developing software for it. By debranding it, I was able to overcome a major weakness in development, namely I can now test my Bluetooth applications on my phone without getting them signed by Cingular. So, the biggest pro is that you can set permissions on even unsigned Java apps to fairly reasonable defaults if you debrand. Second pro is that some carrier-added limitations are removed. You have to research this to find out what they are. For my phone, Cingular disabled Flash themes. To me, this is not a big deal, because I don't care much about ringtones/themes/etc. Some carriers disable mp3 ringtones; a much bigger deal as far as I'm concerned. On the con side, debranding caused my phone to lose mobiTV, mobiRadio, and mobile e-mail applications that Cingular had installed. It is not currently possible to put these things back on, because they are signed by a Cingular certificate that is stored in the Cingular-branded phones only. Generic debranded phone will not have this certificate. Menus and such moved around, and a few buttons that used to do one thing now do another, but these are minor points. More problematic is that you will void your warranty on the phone, and you might break the phone to the point that you need a service cable to fix it. Finally, as a con, the debranding process will destroy anything you had in your phone, including ringtones and Java games you have purchased, themes, contacts, music, etc. Even if you move your Java games to the memory stick, they will not be there after you debrand. Finally, if you do anything that ruins your phone, I am not responsible. Don't use this as your only source of information. Read up on things first if you don't know what you are doing.

Debranding services
Some cell phone service centers will debrand your phone for you. You can find them with a simple Google search. They charge about $60 for this service, and you generally have to get the phone to them physically, perhaps waiting overnight. If you are not highly technically inclined, go this route. If you might make a typo or you might not understand all of the following instructions, have someone else do it, by all means. Better yet don't do it at all, because you have no real reason to.

Quick and easy debrand
For this phone, it is my belief that if you do a Master Reset from the General Settings menu, you will debrand your phone. The default configuration is to go back to a generic Sony Ericsson file system with only Sony Certificates, etc. This will have the same effect as debranding. You lose the ability to back anything up this way, however, and you also lose all your carrier-provided features, such as ringtones, e-mail programs, etc.

Debranding Servers
There are two companies that I know of that will sell you some software and credits to debrand your phone. These are Wotanserver and Davinci Team. I started to use Wotan Server, which is fairly straightforward, but in the end I opted to do it myself, as described in the rest of this post. To debrand through Wotan Server, you just sign up on the server, pay a little money for a credit, download their client, and you're ready to go. To actually do the debranding, you start the software and follow the instructions. What you have to do is remove the battery from your phone, take out the SIM card and memory card, put the battery back in, and you are ready to connect. To connect, you start the software and wait for it to ask you, then you hold down the "c" button on your phone as you plug the USB cable into it with your other hand. The software will then proceed to flash your phone. As noted earlier, this wipes the phone clean as if you had just bought it. No contacts, etc. You have to go through the setup wizard all over again. If you don't like some of the new settings, you can't really change them unless they are already configurable on the phone. This disadvantage is somewhat mitigated by doing it yourself, because you can go back and hack back into the phone to fix things.

I only recommend this method to programmers and such. With this procedure, you can get into the guts of the phone and look around, and make changes. You can also do all kinds of things that may not even be legal, so be careful. In this instance you are breaking in to the phone. The best-case scenario of doing this, right now, is that you downgrade your main firmware to a more generic version that is not quite compatible with Cingular's file system. Fully charge your phone before you begin.

You will need the following software to get started:
Phone XS++V1.2 or later. At this link are links to the program; it is a free community-created tool for do-it-yourselfers. It comes in a RAR file, so you will need WinRar. You can also get Far manager 1.70 from the same place. Finally, you will need some drivers that some with the Sony Ericsson Update Service. The drivers that come with this will work for your purposes. XS++ installs to the folder you unrar it to; FAR manager and the rest install like normal windows programs and are run from the start menu. Each of these programs may have its own requirements, like Macromedia Flash player, .NET framework, Windows XP, and so on.

Once you have all these programs installed, you will need to add a plug-in to FAR manager. First get SEFP v010044 and unzip it to your computer. This will unzip to a folder called SEFP010044, which contains another folder called SEFP. Click on the SEFP folder can copy it. Then go to C:\Program Files\Far\Plugins, and paste SEFP at that level. Next get SEFP v010051 and unrar it and do the same copy/paste trick with SEFP. You do need both SEFP's because the second is an update to the first. This time Windows will warn you that you will
overwrite files, etc., just click yes. Finally, get the final file for your CID49 phone, and unrar it. This is called .zip, but it is actually rar'ed. This, too, has an SEFP folder under it, which again gets pasted into C:\Program Files\Far\Plugins, and again overwrites several files in that folder. Once you are done, go to the folder called C:\Program Files\Far\Plugins\SEFP, and you will see a program called sefp0.10.0.51patch.exe. Click on this program to run it, and it will ask you to apply a patch. Click do it. Nothing much seems to happen, but it is done. Close the window. If you miss any of these steps, you will get various error messages. Note that you are also required to have a regular COM port set up on your computer, even though you won't use it.

The final requirement is to get the firmwares that you are intending to use on your phone. These can be obtained, for example, from Note that this is primarily a Spanish site, which can present some challenges to registration, etc., which is required. You may also have to pay a couple of Euros to get access to the download area. On there, you can get R9A036 main and R9A036 file system, which are the ones you want for the w300i phone only. If you have some other phone, you are responsible for gettting the right firmware files. These won't work, and will kill your phone. You also want the customization files. Unzip/unrar all these and put them in the same folder with PhoneXS++V1.2, which is called that. Then go to your db2010cid49_4_alpha folder, and also get w300_p3k_dcu.49R.ssw and put it in the same folder with the rest. Note that there should be a couple of subfolders called files_to_upload and own_custpack which came from the customization files. Leave this folder structure intact.

Getting started
The first step is to remove your battery so you can take out your SIM card and memory card. Put the battery back in. Then run XS++ by double-clicking on its executable. This will bring up a small screen on which you can press the Start button. Once you do that, you will need to connect the phone, which you do by leaving it off, but holding down the "c" button while you attach it to the USB cable. If it recognizes your phone it will tell you so in the status window and switch to a view where you can put a MAIN file, an FS file, and customize. You may have to unplug the phone, take out the battery, and try again the first time, after it finds the device and so on. You don't ever want to customize with XS++1.2, because it doesn't work right on the w300i. Also, unless you are debranding your phone you don't want to update your file system. Even if you are debranding, you don't want to flash the file system just yet, because you want to back up your old one. It may some day be possible to restore branding when the R4EA031 firmware is found.

Flashing the phone
Now we reach the point of no return. Once you flash the first break-in file, you will be forced to at least update your main firmware (which will probably actually downgrade it to R9A036, unless you can get the right firmware). Click on the ... button on the right of the Main Firmware box in XS++. Then browse to whereever PhoneXS++V1.2 is located, which is where your w300_p3k_dcu.49R.ssw file should be. Choose that file for Main firmware, and make sure you have only checked Flash Main firmware. Click on the Flash button at the bottom, and it will begin. It will only flash 5 blocks this time, and it will probably hang at the end. This should only take about 20 seconds. Once it says 5/5, finishing flash, it will hang, and you can click Stop button, and ignore the warnings. It will say error and it failed, but it didn't. At this point your phone will not turn on, so don't turn it on. Unplug it from the USB cable, and pop the battery out and back in.

Far manager
Now run FAR manager from the start menu. Once it comes up, hit F11, which isn't even onscreen. This will give you access to the Plugins menu. From here, choose SEFP. This can be done by hitting the S key, which in the future you will want to do to not upset your settings. Here are some troubleshooting tips from

  1. If you get the error: "Unknown exception", Exception address: 0x7C812A5B...... The plugin will be Unloaded!
    This is a bug. It's because you don't have any COM-ports, so create a fake COM-port connection. I did it with my BT Dongle.
  2. if you get the error: " can be used with Service Cable ONLY".... browse to the SEFP folder and patch sefp.dll with sefp0.10.0.51patch.exe.
Choose DCU-60 cable, 115200, and w300_w810_z550_ in the three menus. Note that you make your choices simply by browsing over these choices without even clicking. This is easy to mess up. When you have your choices solid, approach the Enter The Matrix button from the bottom so you don't browse over your choices.
  1. If you get the error: "Script error code 0"
    This is because you didn't put in the SEFPv010044 before you put in the SEFPv010051. You have to do both, because the second one is just an update to the first. Then after that you have to do the sefp0.10.0.51patch.exe as described above.
This will ask you to connect your phone, which you do by holding down the C button and plugging it in. Soon a menu will come up on the left side with the words FLASH and FS. The flash feature doesn't work for FAR manager, so choose FS by double-clicking. This will then download some more things to your phone, and eventually after a nervous pause, your phone's file system will appear on the left side of the screen. Since you didn't yet flash your file system, you can make a backup of the one on the phone. That is accopmlished by choosing each of ifs, tpa, etc., and choosing the copy option from the bottom of the screen. This will coply the folder and all its contents to the location on the right side of the screen (C:\Program Files\Far by deafult). Once you have backed up your file system, click the .. on the left side. It will ask you if you want to close the CSFS loader, just say yes.

Flashing and customizing
Note that this section is unnecessary if you just wanted to hack in to your phone and not debrand it. You can still do all kinds of things with FAR manager without debranding, but you will need to do the next section steps to get your phone to run again. For now you will pop the battery out and put it back in, and start XS++ back up. Choose the start button, connect the phone as usual with "c" button held down, and select Flash File System. Now go choose the W300i_R9A036_FS_AMERICA_1_RED49.fbn file that you downloaded earlier, and start the flash. This will erase everything in your phone and start fresh. This task should complete normally without hanging. When it is finished, you are still not done. Disconnect, pop the battery out and in, and go back to FAR manager. Choose F11, S, keep the settings and Enter The Matrix, then FS. This time, you will want to find the folder where you put your customization files, called own_custpack. Open that folder on the right panel, and you should see the tpa folder on the right. There will also be a tpa folder on the left. Select the lone tpa folder on the right, and choose copy. This puts the folder from the disk onto the phone to customize it. Now the phone is debranded. Click the .. again on the left, until it asks you to exit CSFS loader, say yes. Finally you are done and ready to restore the main firmware. Remove and replace the battery.

Restoring the main firmware
This is the step that is necessary whether you debrand your phone or not. Start XS++ again. Check the Flash Main firmware checkbox only. Select the W300i_R9A036_MAIN_NAM_1_RED49.mbn file, and then choose the Flash button. This will start the process of copying about 336 blocks to the phone. When this completes, which should finish normally, your phone is ready. Disconnect it, take the battery out and put the SIM card and memory card back in, and turn it on. This should be the first time you actually turn on your phone since you started. It won't work anywhere in between. It will go through the original setup if you debranded it, otherwise it will just start as your normal phone; however some things will no longer work because of the step backward in firmware. In particular, a Cingular branded phone will have the Cingular Music menu item show up as Missing, but it will still work. Other things may not work so well.


Leo said...

My Se W300i needs a camera Driver update after the Sony update was run. I Downloaded a CAmera Driver Ver 1.2 but need advice/help on how to install the driver to the phone useing XS++ and Far

elhaf said...

Following the above instructions about using Far, you will have to put your phone into the mode where you can break in via Far Manager. Then on the left, go to the folder ifs, within that settings, and within that, camera. From there select the camera driver camdriver0.dat, and save it somewhere on your computer via copy. Then on the right, browse to the folder on your computer where you put the 1.2 driver, and select the camera driver on the right, from where it is on your computer, and choose copy. This will copy it to the phone to the current directory. Be sure to save your old one first though, just in case.

Anonymous said...

Hi Elhaf:
I am also trying to use this for my w300i. I can follow most of it, but am confused at the customization (tpa) part.
Once I download the CDA (customization file from topsony) I unzip it and have the TPA folder, but I dont know where to put the tpa folder so I can use it in step 2. According to the instructions,you say to : Unzip/unrar all these and put them in the same folder with PhoneXS++V1.2, which is called that.
and then further in your instructions you say: Choose F11, S, keep the settings and Enter The Matrix, then FS. This time, you will want to find the folder where you put your customization files, called own_custpack. ...but they were put in the XS++ file (mentioned above) I dont know where to put it...


Greg said...

Do you happen to have your custom/final file available? topsony is restricting access now.
I have everything else (latest firmware,patches, etc).

Greg said...

ooh. almost forgot...when I DO have the 'customize' option selected, the 300 is already there with the american pack (apparently part of the latest version of xs++ ??) that sufficient enough?

Anonymous said...

after using this method I can no longer use SMS -- I think the settings may have been wiped.

I have backed up the folders as mentioned. Is it possible to retrieve the SMS service settings or something similar to get SMS working again?

Anonymous said...

nevermind, the SMS wasn't broken after all

elhaf said...

I apologize for the confusion about the customization folders. It really doesn't matter where you put them as long as you find them from Far Manager at the point mentioned. you should select the TPA folder on both sides and then choose copy.

elhaf said...

To Greg, you should not use the customization step from phonexs, unless they have updated that program to use the new methods. Otherwise it takes forever to break in, and I don't think a breakin is ever guaranteed. The method I describe with Far Manager should take less than half an hour.

elhaf said...

To Anonymous, if your SMS settings go away, you can have them reset by Cingular (now AT&T) help or by the sony ericsson website. They send you a text message with the SMS settings in it, and it all works magically. Note also that you should now use the Cingular R4EA031 file system and main files for flashing from phonexs.

Ambra said...

I'm gettin creazy searching the flash for this phone in hebrew, my e-mail is ...if someone can tell me where to find it without pay, please!!!!

Anonymous said...

hey the file SEFP v010044 and SEFP v010051 are not opening it giving a link error could you please upload them so i could continue my process thanks in advance.

Anonymous said...

hey ambrasaf you can go to and get any firmware you need the only problem is the forum is in CZECH which's going to be a challenge to register but once your done with registration the site could me changed to english and you could choose from the SONY ERICSSON any model you have it will give you any file you need. hope this will HELP

Anonymous said...

I noticed that you said that you had a w300i from Cingular/ATT and you're from the United States. I was wondering if you still had the cust pack for that region.. I'm also confused about FAR manager because it tends to just lock up and not do anything when I use it the way you've told us to - It doesn't show the phone's filesystem or anything. It just says "%100" and stays there.

Mellie Jeen said...

Hi there,

I am trying to unlock my W200i, but I've run into problems because it appears to be a CID53. Can you make any suggestions on how I could unblock it? XS++ doesn't recognise the phone.


elhaf said...

As far as I know, you are out of luck on this.

Swadeep said...

To elhaf,

I am stuck at the far manager part. I am waiting for the it to show up the Filesystem as you have said, but it doesnt, its been 2 hrs now. Kindly help!! Is there any thing i need to do at this stage.

elhaf said...

It should take only a few seconds to come up, not two hours. There must be an error. Make sure you have installed both patches one after another in the FAR manager. Also, it is possible that newer w300i's won't work with this old information, if SE added a new firmware. That is their job.

Swadeep said...

Thank you for the info. Well I have somehow managed to debrand it, but the FM Radio is not working. I have the frequency range but when I tune I dont get any channels, instead their is a very low gushing sound. Is there anything else I need to do to fix that?

Onion said...

I love you. Absolutely amazing, this worked.

Anonymous said...

Does anybody know how to do hard(master) reset with keypad code or through usb cable?