BB5 Downgrade, ERASE, REPAIR, e.t.c) How-To

**shaiksha85** · 14-10-2011, 09:58 PM

Here is simple instruction how-to downgrade new SL3 phones via Erase method.
Also this will be useful for repair phone - like - full SW rebuild ( Erase )

Platforms :

By ONLY USB cable can be done with :
RAPU11 - 6700, E52,E72, 5630, C5, N8, C7, C6-01, C3-01, X3-02, C5-03, E7, E6, E5, X7, T7 and others.
RAPU21 - X3-02, C3-01, 500, 600, 700, 701 and others ...

By FBUS ( RPL BACKUP via JAF box as interface ) + all other via USB can be done with :
RAPIDO - 5530,N97,5800,C6,5250,5230,X6,E71,E75 and others
FBUS needed only for RPL backup (NPC/CCC/HWC sections). Erase, Flash, Repair - possible by USB cable only.

By FBUS ( Log reading ) + all other via USB can be done with :
RAPV4 - X3, 3710, 6303i, 7230 and same ...
FBUS needed only for log read (for security repair operations). RPL backup, Erase, Flash, Repair - possible by USB cable only.

By FBUS can be done with :
RAP3G phones - 6303c, 5130 and same ...
OLD RAPIDO phones - 5800, N81 and same ...
OLD RAPU11 phones - 6700, E52, E72 and same ...

Example with RAPU21 phone - Nokia 500 (RM-750)
Phone version before : 010.31
Needed version to flash : 010.29
Using USB cable.

Actions :

1st step : RPL backup, PM backup, PP backup
2nd step : Erase FLASH
3rd step : Flash needed FW version
4th step : RPL restore
5th step : Repair SDD if needed, do Local SX4 + Upload PM
6th step : Factory sets, edit production data, run phone

Time for all - less than 5 minutes

Logs :
step 1 : Do backups ( RPL, PM, PP )

Code:

Backup Certificates now...
Dead Mode is Selected
Waiting for USB device...
--- Insert cable and charger or press phone's power button! ---
Connection opened successfully
Waiting for communication response...
[BB5 FLASH]: Bootrom Ok!
ASIC ID:       000000030000022600010007400C192103032108
CPU ID :       RAPU v21 , Features : Dead-Test , USBRPL , FullUSB
EM0 ID:        00000C35
EM1 ID:        00000C30
PUBLIC ID:     B83D0000FFFF3C4033D0CE8844612A2C83A4B1FF
ASIC MODE ID:  00
ROOT KEY HASH: 3AB5DB70B45D23F1ADEEBB5734160706
ROM ID:        2CAC45E23BC33C8B
Use RAPUv21_2nd.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing RAWLOADER...
FLIC : 005000EC
Req : XSR 1.6
Use RAPUv21_XSR17_alg.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing PASUBTOC ...
Processing ALG ...
Boot Done! :)
TIME : Boot time : 00:00:02 
Reopening the connection...
Waiting for response: 30
Waiting for response: 29
ADL: Check mode
Select ASIC [C900]
PAPUBkeys : F4C2F0A6BA76F178E59EBE710A8E1C85F3E122C0
ADL: Reading certificates...

Reading NPC certificate...
IMEI : 357924040135287
Reading CCC certificate...
Reading HWC certificate...
Reading R&D certificate...
Reading VARIANT certificate...
Reading PARTNERC certificate...
Reading MDM_KEYS certificate...
Cert Read done!

ADL: Reading certificates done! :)
ADL: Close_Session
Content: 000300000000010000000100000000
ADL: Reboot

Wait, reconneting...

SLx Simlock Data read ... ok
SL3 Simlock Sign read ... ok
WMDRM read ... ok
CRT308 Backup Created
NPC Certificate saved...
CCC Certificate saved...
HWC Certificate saved...
SimLock Data saved...
SimLock Key saved...
WMDRM_PD Data saved...

RPL saved : c:\InfinityBox\BEST\Backup\Cert\357924040135287_2nd.rpl

All done, Disconnecting

Elapsed: 00:00:15
Connect phone on selected interface...

Phone found!
Series 60 Device detected!
read info...  - Ok

Operating mode is OK, no need change...
Reading PM from field 0 to 400

Field [1]    31 Record(s)
   Record 0: 10 byte(s) readed - Ok
   Record 1: 94 byte(s) readed - Ok
   Record 2: 110 byte(s) readed - Ok
   Record 4: 10 byte(s) readed - Ok
   Record 6: 110 byte(s) readed - Ok
   Record 7: 450 byte(s) readed - Ok
   Record 8: 10 byte(s) readed - Ok
   Record 13: 110 byte(s) readed - Ok
   Record 15: 30 byte(s) readed - Ok
   Record 16: 30 byte(s) readed - Ok
   Record 17: 30 byte(s) readed - Ok
   Record 18: 30 byte(s) readed - Ok
   Record 19: 30 byte(s) readed - Ok
   Record 22: 24 byte(s) readed - Ok
   Record 26: 10 byte(s) readed - Ok
   Record 27: 36 byte(s) readed - Ok
   Record 28: 110 byte(s) readed - Ok
   Record 29: 10 byte(s) readed - Ok
   Record 30: 36 byte(s) readed - Ok
   Record 31: 24 byte(s) readed - Ok
   Record 32: 216 byte(s) readed - Ok
   Record 33: 36 byte(s) readed - Ok
   Record 35: 24 byte(s) readed - Ok
   Record 36: 24 byte(s) readed - Ok
   Record 38: 216 byte(s) readed - Ok
   Record 39: 36 byte(s) readed - Ok
   Record 40: 24 byte(s) readed - Ok
   Record 41: 216 byte(s) readed - Ok
   Record 43: 36 byte(s) readed - Ok
   Record 44: 216 byte(s) readed - Ok
   Record 45: 216 byte(s) readed - Ok
Field [2]    1 Record(s)
   Record 0: 2808 byte(s) readed - Ok
Field [4]    9 Record(s)
   Record 1: 200 byte(s) readed - Ok
   Record 3: 10 byte(s) readed - Ok
   Record 4: 8 byte(s) readed - Ok
   Record 5: 8 byte(s) readed - Ok
   Record 6: 8 byte(s) readed - Ok
   Record 9: 5 byte(s) readed - Ok
   Record 18: 80 byte(s) readed - Ok
   Record 19: 4 byte(s) readed - Ok
   Record 28: 2 byte(s) readed - Ok
Field [8]    7 Record(s)
   Record 0: 2 byte(s) readed - Ok
   Record 1: 16 byte(s) readed - Ok
   Record 2: 16 byte(s) readed - Ok
   Record 3: 128 byte(s) readed - Ok
   Record 4: 128 byte(s) readed - Ok
   Record 8: 8 byte(s) readed - Ok
   Record 10: 32 byte(s) readed - Ok
Field [11]    5 Record(s)
   Record 0: 4 byte(s) readed - Ok
   Record 1: 4 byte(s) readed - Ok
   Record 2: 4 byte(s) readed - Ok
   Record 3: 4 byte(s) readed - Ok
   Record 4: 1061 byte(s) readed - Ok
Field [12]    1 Record(s)
   Record 0: 8 byte(s) readed - Ok
Field [26]    2 Record(s)
   Record 0: 16 byte(s) readed - Ok
   Record 1: 68 byte(s) readed - Ok
Field [31]    1 Record(s)
   Record 4: 16 byte(s) readed - Ok
Field [44]    1 Record(s)
   Record 0: 1 byte(s) readed - Ok
Field [50]    2 Record(s)
   Record 0: 2 byte(s) readed - Ok
   Record 1: 2 byte(s) readed - Ok
Field [54]    1 Record(s)
   Record 0: 2 byte(s) readed - Ok
Field [96]    2 Record(s)
   Record 0: 2 byte(s) readed - Ok
   Record 1: 20 byte(s) readed - Ok
Field [117]    9 Record(s)
   Record 0: 4 byte(s) readed - Ok
   Record 1: 3 byte(s) readed - Ok
   Record 2: 6 byte(s) readed - Ok
   Record 3: 1 byte(s) readed - Ok
   Record 5: 10 byte(s) readed - Ok
   Record 6: 8 byte(s) readed - Ok
   Record 8: 42 byte(s) readed - Ok
   Record 13: 3 byte(s) readed - Ok
   Record 14: 3 byte(s) readed - Ok
Field [120]    4 Record(s)
   Record 0: 944 byte(s) readed - Ok
   Record 1: 160 byte(s) readed - Ok
   Record 2: 130 byte(s) readed - Ok
   Record 3: 112 byte(s) readed - Ok
Field [153]    6 Record(s)
   Record 0: 68 byte(s) readed - Ok
   Record 1: 68 byte(s) readed - Ok
   Record 2: 68 byte(s) readed - Ok
   Record 3: 68 byte(s) readed - Ok
   Record 4: 68 byte(s) readed - Ok
   Record 5: 68 byte(s) readed - Ok
Field [193]    4 Record(s)
   Record 2: 8 byte(s) readed - Ok
   Record 3: 32 byte(s) readed - Ok
   Record 4: 32 byte(s) readed - Ok
   Record 9: 64 byte(s) readed - Ok
Field [217]    1 Record(s)
   Record 0: 32 byte(s) readed - Ok
Field [239]    5 Record(s)
   Record 0: 2 byte(s) readed - Ok
   Record 1: 6268 byte(s) readed - Ok
   Record 2: 6268 byte(s) readed - Ok
   Record 3: 6268 byte(s) readed - Ok
   Record 6: 222 byte(s) readed - Ok
Field [291]    1 Record(s)
   Record 0: 92 byte(s) readed - Ok
Field [296]    4 Record(s)
   Record 0: 2 byte(s) readed - Ok
   Record 1: 4 byte(s) readed - Ok
   Record 2: 24 byte(s) readed - Ok
   Record 3: 5 byte(s) readed - Ok
Field [308]    7 Record(s)
   Record 0: 1 byte(s) readed - Ok
   Record 1: 8192 byte(s) readed - Ok
   Record 3: 1 byte(s) readed - Ok
   Record 4: 1 byte(s) readed - Ok
   Record 6: 1 byte(s) readed - Ok
   Record 7: 1 byte(s) readed - Ok
   Record 9: 40 byte(s) readed - Ok
Field [309]    7 Record(s)
   Record 0: 4 byte(s) readed - Ok
   Record 1: 2 byte(s) readed - Ok
   Record 2: 12 byte(s) readed - Ok
   Record 3: 36 byte(s) readed - Ok
   Record 4: 12 byte(s) readed - Ok
   Record 7: 12 byte(s) readed - Ok
   Record 17: 12 byte(s) readed - Ok
Field [313]    1 Record(s)
   Record 0: 320 byte(s) readed - Ok
Field [322]    1 Record(s)
   Record 0: 1 byte(s) readed - Ok
Field [329]    1 Record(s)
   Record 0: 8392 byte(s) readed - Ok
Field [334]    1 Record(s)
   Record 0: 1 byte(s) readed - Ok
Field [341]    3 Record(s)
   Record 0: 1 byte(s) readed - Ok
   Record 3: 4 byte(s) readed - Ok
   Record 4: 4180 byte(s) readed - Ok
Field [354]    1 Record(s)
   Record 0: 15 byte(s) readed - Ok
Field [356]    1 Record(s)
   Record 0: 2 byte(s) readed - Ok
Field [360]    2 Record(s)
   Record 0: 1 byte(s) readed - Ok
   Record 1: 2 byte(s) readed - Ok
Field [369]    1 Record(s)
   Record 0: 40 byte(s) readed - Ok
Field [388]    1 Record(s)
   Record 0: 4 byte(s) readed - Ok
Field [395]    1 Record(s)
   Record 0: 16 byte(s) readed - Ok

Saved as C:\InfinityBox\BEST\Backup\RM-750 Nokia N00_357924040135287_0_400.pm
Done!

Elapsed: 00:00:00

Operating mode is OK, no need change...
Reading Product Profile sets...

   0 - 127
   1 - 0
   4 - 0
   7 - 1
   9 - 0
   34 - 0
   35 - 0
   56 - 0
   61 - 0
   65 - 0
   66 - 0
   69 - 1
   70 - 0
   71 - 1
   78 - 0
   79 - 1
   100 - 1
   130 - 5
   131 - 7
   135 - 0
   138 - 0
   145 - 0
   146 - 0
   147 - 0
   157 - 1
   158 - 1
   164 - 0
   165 - 0
   166 - 0
   168 - 0
   177 - 0
   183 - 0
   192 - 0
   202 - 3
   205 - 0
   206 - 0
   211 - 0
   212 - 0
   214 - 0
   217 - 0
   219 - 0
   220 - 0
   228 - 0

SETS 1
Readed 43 element(s)
Saved as C:\InfinityBox\BEST\RM-750 Nokia N00_357924040135287.pp

Done!

Elapsed: 00:00:00

step 2 : Erase phone

Code:

User ACCEPTED FULL ERASE
Connection opened successfully
Waiting for communication response...
[BB5 FLASH]: Bootrom Ok!
ASIC ID:       000000030000022600010007400C192103032108
CPU ID :       RAPU v21 , Features : Dead-Test , USBRPL , FullUSB
EM0 ID:        00000C35
EM1 ID:        00000C30
PUBLIC ID:     B83D0000FFFF3C4033D0CE8844612A2C83A4B1FF
ASIC MODE ID:  00
ROOT KEY HASH: 3AB5DB70B45D23F1ADEEBB5734160706
ROM ID:        2CAC45E23BC33C8B
Use RAPUv21_2nd.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing RAWLOADER...
FLIC : 005000EC
Req : XSR 1.6
Use RAPUv21_XSR17_alg.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing PASUBTOC ...
Processing ALG ...
Boot Done! :)
TIME : Boot time : 00:00:02 
Reopening the connection...
Waiting for response: 30
Waiting for response: 29
ADL: Check mode
Select ASIC [C900]
PAPUBkeys : F4C2F0A6BA76F178E59EBE710A8E1C85F3E122C0
ADL: Preparing for erase...

Full Erase started...
Asic : CMT , Sub : NAND
Erase Area 0x00000000-0x1FFFFFFF
Erasing Ok , [0F]
Erase done , time : 00:00:01 

ADL: Erase done

ADL: Close_Session
Content: 000205000000000000FFFF00000000
ADL: Reboot
Phone disconected!

Connect phone on selected interface...

step 3 : Reflash phone to desired sw

Code:

Selected FlashSettings : Manual
Check FlashFiles, Please, wait...

Files Set for Flashing :
MCU : RM-750_010.029_71i92_prd.core.fpsx
PPM : RM-750_010.029_04.01_Russian_71i92_prd.rofs2.fpsx
PPM2 : RM-750_010.029_00.01_71i92_prd.rofs3.fpsx
CNT : RM-750_v0.005_APEONLY_prd.fpsx
APE : RM-750_010.029_U01.01_71i92.uda.fpsx
Flashing phone now...
Check files done...
-> SWversion check skipped : Dead mode selected
Dead Mode is Selected
Waiting for USB device...
--- Insert cable and charger or press phone's power button! ---
Connection opened successfully
Waiting for communication response...
[BB5 FLASH]: Bootrom Ok!
ASIC ID:       000000030000022600010007400C192103032108
CPU ID :       RAPU v21 , Features : Dead-Test , USBRPL , FullUSB
EM0 ID:        00000C35
EM1 ID:        00000C30
PUBLIC ID:     B83D0000FFFF3C4033D0CE8844612A2C83A4B1FF
ASIC MODE ID:  00
ROOT KEY HASH: 3AB5DB70B45D23F1ADEEBB5734160706
ROM ID:        2CAC45E23BC33C8B
Use RAPUv21_2nd.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing RAWLOADER...
FLIC : 005000EC
Req : XSR 1.6
Use RAPUv21_XSR17_alg.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing PASUBTOC ...
Processing ALG ...
Boot Done! :)
TIME : Boot time : 00:00:02 
Reopening the connection...
Waiting for response: 30
Waiting for response: 29
ADL: Check mode
Select ASIC [C900]
PAPUBkeys : blank (Erased or HW failure)
ADL: phone is in flash mode
   ===Flashing [MCU]===
Erase : Processing RM-750_010.029_71i92_prd.core.fpsx
Partitioning....
Partitioning Ok...
Erasing....
Erasing Ok...
TIME : Erase time : 00:00:01 
Write : Processing RM-750_010.029_71i92_prd.core.fpsx
CMT: Writing Hash CERT [ADA]
CMT: Writing Hash CERT [KEYS]
CMT: Writing Hash CERT [PRIMAPP]
CMT: Writing Hash CERT [RAP3NAND]
CMT: Writing Hash CERT [SOS+PMML]
CMT: Writing Hash CERT [SOS+DECOMP]
CMT: Writing Hash CERT [PASUBTOC]
CMT: Writing Hash CERT [PAPUBKEYS]
CMT: Writing Hash CERT [GENIO_INIT]
CMT: Writing Hash CERT [SOS*UPDAPP]
CMT: Writing Hash CERT [SOS*DSP0]
CMT: Writing Hash CERT [LDSP]
CMT: Writing Hash CERT [SOS*ISASW]
CMT: Writing Hash CERT [SOS+CORE]
CMT: Writing Hash CERT [SOS+ROFS1]
Total writen 513 blocks
TIME : Write time : 00:00:17 
MCU Write done
ADL: Request programm status
NAND status : 00000001 / 00000001 / 00000000

   ===Flashing [PPM]===
Erase : Processing RM-750_010.029_04.01_Russian_71i92_prd.rofs2.fpsx
Erasing....
Erasing Ok...
TIME : Erase time : 00:00:00 
Write : Processing RM-750_010.029_04.01_Russian_71i92_prd.rofs2.fpsx
CMT: Writing Hash CERT [SOS+ROFS2]
Total writen 202 blocks
TIME : Write time : 00:00:07 
PPM Write done
ADL: Request programm status
NAND status : 00000001 / 00000001 / 00000000

   ===Flashing [PPM2]===
Erase : Processing RM-750_010.029_00.01_71i92_prd.rofs3.fpsx
Erasing....
Erasing Ok...
TIME : Erase time : 00:00:00 
Write : Processing RM-750_010.029_00.01_71i92_prd.rofs3.fpsx
CMT: Writing Hash CERT [SOS+ROFS3]
Total writen 2 blocks
TIME : Write time : 00:00:00 
PPM Write done
ADL: Request programm status
NAND status : 00000001 / 00000001 / 00000000

   ===Flashing [CNT]===
Erase : Processing RM-750_v0.005_APEONLY_prd.fpsx
Erasing....
Erasing Ok...
TIME : Erase time : 00:00:00 
Write : Processing RM-750_v0.005_APEONLY_prd.fpsx
CMT: Writing Hash CERT [SOS*ENO]
Total writen 17 blocks
TIME : Write time : 00:00:00 
CNT Write done
ADL: Request programm status
NAND status : 00000001 / 00000001 / 00000000

   ===Flashing [APE]===
Erase : Processing RM-750_010.029_U01.01_71i92.uda.fpsx
Erasing....
Erasing Ok...
TIME : Erase time : 00:00:01 
Write : Processing RM-750_010.029_U01.01_71i92.uda.fpsx
Total writen 369 blocks
TIME : Write time : 00:00:14 
APE Write done
ADL: Request programm status
NAND status : 00000001 / 00000001 / 00000000

ADL: Close_Session
Content: 000300000000010000000100000000
ADL: Reboot

Flashing done!
Total flash time : 00:00:42
Reboot phone now...

Reading Phone Info....
Connected phone -   Nokia N00
Software Info:     V 79u_sr1_11w32.1 19-08-11 RM-750 (c) Nokia
IMEI:  12345610654321?
Ape Version: 010.029
Product code:  
Checking...
SimLock status : SimLock is Ok
Security status : Security is Ok
Read Info Done!
Settings After Flash Defaults...
FullFactorySet...OK!
ProductTuneSet...OK!
SwUpgradeSet...OK!
AfterFlash operations done ;D
Done!

Elapsed: 00:01:01
Connect phone on selected interface...

Phone found!
Series 60 Device detected!
read info...  - Ok

step 4 : Restore RPL ( I was use AUTO method - on RPL file select - just Press Cancel and BEST ask to AutoSearch file ) It is fast and useful method.

Code:


Seek file for this phone....
-----------------------------
- > RPL file found for this phone!
- > NPC Found in : 357924040135287.rpl
Check RPL file...
NPC Data found! (CMT)
CCC Data found! (CMT)
HWC Data found! (CMT)
SimLock Data found!
SimLock key found!
WMDRM key found!
-----------------------------

Reboot....
Connection opened successfully
Waiting for communication response...
[BB5 FLASH]: Bootrom Ok!
ASIC ID:       000000030000022600010007400C192103032108
CPU ID :       RAPU v21 , Features : Dead-Test , USBRPL , FullUSB
EM0 ID:        00000C35
EM1 ID:        00000C30
PUBLIC ID:     B83D0000FFFF3C4033D0CE8844612A2C83A4B1FF
ASIC MODE ID:  00
ROOT KEY HASH: 3AB5DB70B45D23F1ADEEBB5734160706
ROM ID:        2CAC45E23BC33C8B
Use RAPUv21_2nd.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing RAWLOADER...
FLIC : 005000EC
Req : XSR 1.6
Use RAPUv21_XSR17_alg.fg  ,  Rev : 3.0  Ver : 11.34.0 
Processing PASUBTOC ...
Processing ALG ...
Boot Done! :)
TIME : Boot time : 00:00:02 

Reopening the connection...
Waiting for response: 30
Waiting for response: 29
ADL: Check mode
Select ASIC [C900]
PAPUBkeys : F4C2F0A6BA76F178E59EBE710A8E1C85F3E122C0
ADL: Preparing for write certificates...

Erase NPC... Ok
Writing NPC... Ok
Erase CCC... Ok
Writing CCC... Ok
Erase HWC... Ok
Writing HWC... Ok

ADL: Writing Flash certs done! :)

ADL: Close_Session
Content: 000300000000010000000100000000
ADL: Reboot
Wait, reconneting...
Check phone mode...
Phone in Local mode
Seting Test mode... wait...
Test mode set

Writing SimLock Key...   Ok!
Writing SimLock Data...  Ok!

SDD Key status : SDData Damaged!!!!! :(
 - > Do REPAIR SDD , Local SX4 if needed 

SimLock status : SimLock is Ok
Security status : Security is Ok
-----------------------

PA_SimLock Version : 
PA_SL3 phone detected ,  SP_CODE_LEN : 15

WMDRM_PD key sent... Ok

Done!

Step 5 : BEST show us needed actions in previous log - Need repair SDD, after Local Sx4 auth

Code:

Phone found!
Series 60 Device detected!
read info...  - Ok

Repair SD procedure started...

Phone Imei: 357924040135287
Key file exists, no need to read...
Operating mode is OK, no need change...
Writing Super Dongle Key...   Ok!
Done!

Local SX4 procedure started...

Phone Imei: 357924040135287
Use custom key...
Step 1...
Step 2...
Step 3...
SX4 Auth - Ok
Upload PM checked
Uploading RF/Battery tune to phone...
Using : RM-750.pm
Operating mode is OK, no need change...

Field 1
   Record 0 write - Ok
   Record 1 write - Ok
   Record 2 write - Ok
   Record 4 write - Ok
   Record 6 write - Ok
   Record 7 write - Ok
   Record 8 write - Ok
   Record 13 write - Ok
   Record 15 write - Ok
   Record 16 write - Ok
   Record 17 write - Ok
   Record 18 write - Ok
   Record 19 write - Ok
   Record 22 write - Ok
   Record 26 write - Ok
   Record 27 write - Ok
   Record 28 write - Ok
   Record 29 write - Ok
   Record 30 write - Ok
   Record 31 write - Ok
   Record 32 write - Ok
   Record 33 write - Ok
   Record 35 write - Ok
   Record 36 write - Ok
   Record 38 write - Ok
   Record 39 write - Ok
   Record 40 write - Ok
   Record 41 write - Ok
   Record 43 write - Ok
   Record 44 write - Ok
   Record 45 write - Ok
Field 2
   Record 0 write - Ok
Field 4
   Record 1 write - Ok
   Record 3 write - Ok
   Record 4 write - Ok
   Record 5 write - Ok
   Record 6 write - Ok
   Record 9 write - Ok
   Record 28 write - Ok
Field 309
   Record 0 write - Ok
   Record 1 write - Ok
   Record 2 write - Ok
   Record 3 write - Ok
   Record 4 write - Ok
   Record 7 write - Ok
   Record 17 write - Ok

Check ST_SECURITY now...
Security status : ST_SECURITY => OK

Done!

Elapsed: 00:00:01

Upload done

Step 6 : Do factory Sets and Run phone

Code:

Checking StartUp data ...
-----------------------
SDD Key status : SDData is Ok
SimLock status : SimLock is Ok
Security status : Security is Ok
-----------------------

PA_SimLock Version : 
PA_SL3 phone detected ,  SP_CODE_LEN : 15

Done!

Resetting selected items...
Check phone mode...
Phone already in Test mode, skip change...
Settings Full Factory Defaults...
Set OK!
Settings Software Upgrade Defaults...
Set OK!
Settings Service Centre Defaults...
Set OK!
Settings Production Tune Defaults...
Set OK!
Settings User Data Defaults...
Set OK!
Settings Leave Factory defaults...
Set OK!

Elapsed: 00:00:01

Warranty IMEI restore Ok

Writing product data...
Changing Manufacturing date to : 09/2011 Ok 
ProductCode change to 059G733 Ok
Setting HWID to 2000 Ok
Setting Warranty IMEI to 357924040135287 Ok
Write done

Set phone in Normal mode...
Restarting...

Done!
Connect phone on selected interface...

What we have in result :

Code:

Reading Phone Info....
Connected phone -    Nokia N00
Software ver : V 79u_sr1_11w32.1 19-08-11 RM-750 (c) Nokia
IMEI    :      357924040135287
Ape Ver :      010.029
APE Var :      010.029010.029.04.01010.029.00.01
APE ADSP:      256
DSP Ver :       79u_sr1_11w32
APE Test:      RM-750_010.025v0.005
PPM     :      
CNT     :      
Product SN   :     2C1FB18AA
Product code :     059G733
Base Prd.code:     059F2J8
Module code  :     0204861
Long Prod.SN :     0
Hardware info=======
HWID  : 2000
Retu  : 35
Tahvo : 00
Batery: 4144 mV
Camera: 
CMT BT: 
APE BT: HCI Version 4 (rev. 192). LMP Version 4 (rev. 16651). Manufacturer 15.
APE HW: 256
LCDVer: 
RF ic : 
Lock info ===========
IMEI       : 357924040135287
IMEI spNet : 3A 75 29 04 04 31 25 08 
IMEI svNet : 33 75 29 04 04 31 25 08 F1 

Conf key     : 0000000000000000
Provider key : 2440700000000000
Provider    : AT&T;U.S.A. (3650)
Counters   : Key 0  [3] , Fbus 0  [10]
Blocks      : 7

LOCK STATUS :
=============================
BLK : 1
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 2
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 3
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 4
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 5
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 6
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
BLK : 7
 Lock1:Open Lock2:Open Lock3:Open Lock4:Open Lock5:Open
=============================
LOCKS :  All Open
=============================
CRT308 Backup Created

User code : Crypted
UserDataExLevel : Low [Gallery] 

Done!

Also such type of operation can be used for rebuild sw in phone - if exist some bugs, non-stable work and much others.

For BACKUP RPL from DEAD phones can be used this way :

1st step : Backup NPC (it very important - by USB - RAPU11, RAPU21, RAP4, BCM, or Fbus - RAPIDO, RAP3... )
2nd step : Erase NPC ( Erase mode - select NPC/CCC/HWC )
- If local exist - do READ PM , READ RPL. SIMLOCK SAVED - It is critical part. Now can be done Erase and anything else.
- If no Local exist - Flash LATEST WS version, ENO. If local will be - READ PM, READ RPL. SIMLOCK SAVED - It is critical part. Now can be done Erase and anything else.
- If still no local - better digg HW first.