Flashing and hacking the android phone for Japanese Softbank network.

polish english 

Niedawno uczestniczyłem w Google Developer day 2009 w Yokohama, i dostałem za darmo telefon HTC Magic z Google Android – edycja limitowama.
Bardzo fajne i ciekawe urządzonko, ma wszystko czego potrzebuję, ale niestety jak to zwykle w japonii bywa, nie działają w nim MMS’y gdy używam zwykłej karty Sim z mojej komórki.

Historia:

Tutaj, w Japonii, używa się e-maili zamiast SMS, ale to nie są “prawdziwe” maile – to tylko MMS’y ukryte pod postacią emaili i konwertowane w locie przez operatora.
Więc, wysyłając email na adres xx@softbank.ne.jp, serwer skonwertuje go automatycznie do MMS i wyśle do odbiorcy,
i odwrotnie, wysyłając e-mail z telefonu, w efekcie wyślemy MMS’, a serwer skonwertuje go w locie to e-maila i wyśle na swiat.

Odbieranie MMS działa tak: przychodzi specjalnie skonstruowany SMS, zawiera pierwsze 1024 bajty wiadomośći i oprócz tego informacje dla telefonu jak pobrać resztę – poprzez zwykłe HTTP, i tutaj zaczyna się problem, Softbank(moj operator w Japonii) blokuje telefony inne niż sprzedawane przez nich.

Jakby tego bylo mało – oprogramowanie w moim telefonie miało całkowicie wyłączoną obsługę MMS.

Rozwiązanie:

Krok 1:

Robimy kopię zapasową urządzenia (możesz pominąć krok jak jesteś leniwy lub pewny że wszystko się uda ;-) ):

Podążaj za instrukcją na tej stronie:http://android-dls.com/wiki/index.php?title=Magic_Rooting

(Fastboot możesz pobrać ze strony HTC wymienionej w punkcie 2).

W tym kroku jedynie musisz pobrać obraz ‘recovery image’,

http://www.droiddeveloper.com/hrbuilds/recovery-new.img.zip

rozpakować, skopiować do telefonu uzywając:

adb push recovery-new.img /sdcard/recovery-new.img
adb shell sync

Kiedy już plik będzie skopiowany, uruchom ponownie telefon, i w czasie startu trzymaj BACK i POWER wciśnięte – android uruchomi się w trybie fastboot, wpisz:

fastboot boot recovery-new.img

Android uruchomi się z tego obrazu, który pozwoli ci między innymi zrobic backup wszystkiego do karty SD.

Wybierz opcję ‘nandroid backup’ – pliki zostaną zapisane na karcie SD.

NIE MA potrzeby robienia innych krókow z tej strony “root the magic”, one są potrzebne do innych celów, tutaj je pomijamy.

Krok 2:

Jak sprawić aby android obsługiwał MMS (jeżeli twój operator nie blokuje nie-swoich telefonow – to jest jedyny i ostatni krok):

W tym kroku wymienisz całkowicie oprogramowanie urządzenia, ja użylem oprogramowania do urządzenia rozdawanego na Google IO, dzięki temu mam dostęp to kilku funkcji niedostępnych w normalnej wersji, takich jak polecenia i wybieranie głosowe, Amazon MP3 itp.
Niestety jest też i zła strona – to oprogramowanie nie ma obsługi jezyka japońskiego.

Najpierw, upewnij się czy twój android pozwala na wysyłanie MMS, otwórz aplikację Messaging, wpisz tekst, wciśnij menu, jeżeli NIE MASZ opcji “add subject”, “attach” – znaczy że android ma zablokowame MMS.

Podążaj za instrukcją ze strony HTC: http://www.htc.com/www/support/android/google-io-device.html

Nie przejmuj się tym co piszą ze oprogramowanie nie będzie kompatybilne itp. (częściowo mają rację – urządzenia różnią się, ale to żaden problem).

Ja polecam uzyć metody fastboot (nie takie trudne),

Musisz pobrać program ‘fastboot’ z ich strony i 2 obrazy: Radio Image i System Image.

Zgodnie z instruckjś, zainstaluj Radio Image – prawdopodobnie, twój telefon po restarcie nie wystartuje poprawnie, będzie widoczne logo android ale nic wieęcej (w adb logcat będzie widać że próbuje startować co chwilę) – nie ma co panikować, to normalne.

Wgraj obraz Radio Image na kartę SD poleceniem:

adb push <radio-image-package>.zip /sdcard/update.zip
adb shell sync

wejdz w tryb Recovery przytrzymując HOME podczas startu, potem wybierz opcję ALT+s na ekranie, późśniej HOME+BACK, urządzenie powinno się zrestartować – nie panikuj jeżeli się nie uruchomi.

Jak juz masz wgrany Radio Image – czas na System Image:

Wgraj obraz na kartę SD:

adb push <system-image-package>.zip /sdcard/update.zip
adb shell sync

Wejdź w tryb fastboot (BACK+POWER podczas restartu) – ZAPAMIETAJ wersję ‘hboot’ – będzie ci potrzebna.

Mozesz spróbować wgrać system image już teraz, ale dostaniesz błąd że wersja nie pasuje do twojej wersji hboot (wymagana 1.33.3004, ty masz pewnie 1.33.3005).
Żaden problem – mozemy to obejść :-) .

Co należy zrobić – rozpakować System Image do folderu, znaleźć plik android-info.txt i zmienić wartość opcji ‘require version-bootloader’ podstawiając tam wersję hboot która odczytałeś przy starcie fastboot.
Następnie spakować zawartość folderu do nowego pliku zip, wgrać ten system image na kartę SD.

Więc, już teraz masz wszystko gotowe, spróbuj wgrać ten obraz, NIE ZAPOMNIJ żeby wybrać opcję ‘clean userdata and cache’ – to jest wymagane, bez tego, dostaniesz logo android na ekranie i nic więcej.

fastboot update .zip -w

Krok 3:

(Jeżeli twój operator blokuje nie-swoje telefony):

Musimy zmodyfikować klienta MMS żeby przedstawial sie w sposób bardziej lubiany przez operatora (Jest niewielka szansa ze ten krok rozwiąże twój problem w całości – nie jestem pewny czy wgranie nowej aplikacji MMS odblokuje wysyłanie czy nie – ja przeszedłem przez wszystkie 3 kroki):

Wersja hardkorowa:

Pobierz źrodło android ze strony google, skompiluj, i zainstaluj ten patch:

--- packages/apps/Mms/src/com/android/mms/transaction/HttpUtils.java  2009-06-12 23:56:28.000000000 +0900
+++ packages/apps/Mms/src/com/android/mms/transaction/HttpUtils.java  2009-06-12 23:47:20.000000000 +0900
@@ -220,7 +220,7 @@
 
     private static AndroidHttpClient createHttpClient() {
         AndroidHttpClient client
-                = AndroidHttpClient.newInstance("Android-Mms/0.1");
+                = AndroidHttpClient.newInstance("SoftBank/1.0/705NK/NKJ002/SN001 Android-Mms/0.1 Profile/MIDP-2.0 Configuration/CLDC-1.1");
         HttpParams params = client.getParams();
         HttpProtocolParams.setContentCharset(params, "UTF-8");
         return client;

(Ten patch zmeni tylko UserAgent w kliencie MMS, nie zmieni przegladarki WWW).

Skompiluj źrodło jeszcze raz (jedynie aplikacja MMS zostanie przekompilowana), i zainstaluj swieżą aplikację Mms do androida poleceniem:

adb install -r ./out/target/product/generic/system/app/Mms.apk

Wersja dla leniwych:

Pobierz Ten plik i zainstaluj uzywając adb:

adb install -r Mms.apk

Nie zapomnij skonfigurować APN do MMS, jako ‘apn type’ NIE WPISUJ ‘mms’ – to nie działa.

Wszystkie pliki jakie są potrzebne wgrałem na swoja strone tutaj:
http://kubatyszko.com/filez/

Linki:

Rooting HTC Magic – creating backup

HTC Google IO device support page

Android source

Co dalej: zmienić źrodło jeszcze bardziej – żeby miec ładne menu z edycją UserAgent w aplikacji Mms :-D.

Powodzenia :-)

84 thoughts on “Flashing and hacking the android phone for Japanese Softbank network.”

  1. Hello,
    Thank you very much for this tutorial,
    and thank you for your mail,
    Maybe you should post the APN for mms settings and explanations?
    I have browsed a lot of websites where the same question is asked but no answer was found.

    Especially the explanation about “default” and “mms” APN TYPE where most usefull :-)

    Thank you!!

  2. Thanks for the interest,

    I will not post settings for softbank here, whoever wants them knows how to contact me…

    Softbank changes apn passwords quite often, mainly because of people posting them publicly…
    I don’t agree with them at all, what’s wrong with giving people plain settings – we pay for it, but that’s their policy and we can’t help much…

  3. Hello Kuba,

    As I wrote in privately, I managed to get MMS working just by installing your patched MMS app. Thank you. :)

    The advantage of not having to flash the firmware is that you keep the Japanese IME, so you can still write Japanese messages etc. I’ll probably try flashing the firmware later on when some more features are available.

    And just for the record, the “mms” APN type only works if you already have another APN set as “default”. If you only have one APN you should let the type empty (or as “default”).

    Take care, and thanks again for figuring this stuff out.

  4. hi!
    I have been trying to set mms the whole day, also with different username password,
    however I can’t get it to work :(

    I am using the silver sim (from my X01t mobile),
    Maybe it has different settings?

    BR

  5. I don’t think it should matter which sim.

    Try doing this:

    Connect phone to PC via USB cable, launch adb with verbose logcat. Watch the log, send mail to your cellphone.
    You should see a bunch of hex characters when it comes – this is the push raw sms – if this comes, and nothing shows up on the phone itself – this means your phone doesn’t recognize push message – it happened to me on original GDDC09 build without any hacks.
    After i flashed mine with IO09 version, at the time of receiving sms it did show the notification (along with sender/subject), with download button – but this wouldn’t work without hacking (under logcat you can see Access Denied error when mms client connects via http to softbank) – this is when you need my patched Mms.apk to fake useragent (it pretends to be some Nokia phone).
    Try this and it should work.
    Also, start small, set just one apn, with exactly the settings i gave you (mms proxy is proxy, not mms server of course) and try again. It works!

    *** If you ever get bored, take the hex sms message form logcat and paste it into any hex->ascii decoder – you WILL see how message looks, it has sender, subject, first xx chars of the email and url instructing phone how to retrieve the rest :-).

  6. Hello,
    With the settings you indicated,
    the only thing that comes out in adb is :

    06-19 11:38:14.905: INFO/InetAddress(122): Unknown host mms, throwing UnknownHostException
    06-19 11:38:14.905: ERROR/SendTransaction(122): java.io.IOException: Cannot establish route for http://mms/: Unknown host
    06-19 11:38:14.905: ERROR/SendTransaction(122): at com.android.mms.transaction.Transaction.ensureRouteToHost(Transaction.java:197)
    06-19 11:38:14.905: ERROR/SendTransaction(122): at com.android.mms.transaction.Transaction.sendPdu(Transaction.java:142)
    06-19 11:38:14.905: ERROR/SendTransaction(122): at com.android.mms.transaction.SendTransaction.run(SendTransaction.java:108)
    06-19 11:38:14.905: ERROR/SendTransaction(122): at java.lang.Thread.run(Thread.java:1058)
    06-19 11:38:14.905: ERROR/SendTransaction(122): Delivery failed.

    just to confirm :
    I set the fields:
    NAME->set,
    APN->set,
    Proxy->set,
    proxy port->set,
    username->set,
    password->set,
    server->not set
    MMSC->set
    MMS Proxy->not set,
    MMS port->not set,
    MCC-> set to default 440
    MNC-> set to default 20
    APN TYPE->not set

    is this correct?

  7. Hmm, i think i get your point, it seems that exactly the same settings work well on my regular cellphone card, but not on new iphone 3G’s card (card registers well, can make calls, but no data connection)…

    Will keep investigating.

    Currently, options are:
    * Softbank somehow blocks imei+card combinations that don’t match iphone+iphone’s card.
    * They use different frequency that my HTC doesnt support – unlikely…
    * The APN for iphone’s card may be different…

  8. Hi,
    Yes I think there is a different settings for :
    -regular phones
    -iphone(black sims)
    -windows mobile (silvers sims)
    I have checked several forums, where they say the APN is different at least for iphone/wm
    hope you find a solution,
    I will report if I find something elsewhere :-)

  9. Hi, and what card do you have ?
    (i have 1 yr old standard cellphone card – silver -apn opensoftbank.* works, and iphone 3gs card – black – apn smile.* works).
    I have sent you the smile.* via email yesterday – does it still not work ?

    And yes, it’s possible wm phones have even different apn (is your card from wm? )

  10. I have a silver sim from a WM phone (X01T)
    I am still looking for the UA for this phone, maybe it’s different?

    I have the correct settings for internet connection, but mms still puzzle me :(

  11. Ok, that sounds like partial success, let’s confirm few things:

    As for APN you should have this:

    NAME->set,
    APN->set,
    Proxy->not set,
    proxy port->not set,
    username->set,
    password->set,
    server->not set
    MMSC->set
    MMS Proxy->set,
    MMS port->set,
    MCC-> set to default 440
    MNC-> set to default 20
    APN TYPE->not set //if you have another apn for the internet with type default, this one should have type mms.

    Now, when you do this, connect phone to pc, launch adb
    (adb logcat -v long ), send mail to yourself (have auto-download ON) and wait for adb logging, first you should see few lines of hex digits – this is push sms coming (you can decode it), and then you should see mms retrieval session, if indeed UA is forbidden you should see access denied errors – try that on fresh Mms.apk with default “Android” UA, and on the one provided by me (“Softbank 705NK***”).
    You can try applying my patch with this UA “SoftBank/1.0/X01T/SCJ001”, then compile and install this Mms.apk on your own. (i still have the source so can do this)- but only try this if 2 previous methods do give you access denied..
    If you still get access denied on all three methods then indeed there may be even different UA for your card, if not – this means some other problem…

  12. Hello,
    indeed I receive the message correctly,
    I can see the subject in the mms app,
    but if I click download then I get a http error: forbidden
    still investigating :-)

  13. Hum, it seems I can’t compile only the mms app,
    Do I need to compile the whole platform?
    if not What version did you use?
    Thank you

  14. Ok, so that’s definitely ua issue.
    1-have you tried my mms.apk ?
    I can compile it for you later if you want, yes it takes to build whole system just for the app.
    Which ua you want to try first?

  15. Yes I have tried your mms.apk,
    I am downloading all the android repository to compile it,
    and I am still looking for the ua for my mobile.

  16. Since it’s wm, maybe you can grep the registry for that…
    Grep for softbank|mms|midp|wap , also if you have filesystem or image access you can run ‘strings’ on it and grep for the ua.

  17. I already looked in the registry :-)
    Maybe After I finish compiling, and tried a few Ua I found online, if it still doesn’t work I will dig more on WM.

  18. HKLM\Software\Motorola\MMS\Sp\UserAgent\UAProfile =
    HKLM\Software\Motorola\MMS\Sp\UserAgent\UserAgent =

    something that i found, after little tweaks you may be able to find your very own UA string…

  19. Ah, you may as well wait 1-2 days for new version of Mms.apk – i’m working on modification that allows user to supply UA string as a setting :-D.

  20. Ahah I was thinking of doing the same :)
    my mobile phone is Toshiba, and the mms client is softbank proprietary. So I could not find the UA in the registry

  21. I have the menu/setting part ready, now just have to make it affect real mms app’s UA.
    Stay Tuned!

    Few links for you with softbank’s prop mms app ( to strings/grep UA):

    http://forum.xda-developers.com/showthread.php?t=482611
    http://tmk.infeline.org/webpool/index.php?fuseaction=index.blog&id=233
    http://forum.xda-developers.com/archive/index.php/t-472445.html

    I think this one is the best :
    http://blog.lezele.org/bippo/MMSLite.txt
    http://www.jeroblo.com/2008/04/16/x02ht%E3%81%ABmmslite%E5%B0%8E%E5%85%A5/

    That might help you…

  22. Tadaaaaa, made it :-D.

    On the “/filez” link somwhere in this text, there are 2 new files:

    android_mms_useragent_changer_menu.patch
    Mms.apk.MenuUseragentChangerAdded

    It’s pretty self-explanatory, using first you can patch your own source to add user-agent changer into Mms.apk settings,
    the second one is Mms.apk itself (rename before installing). The patched app has default User-Agent the same as original one in source (Android-Mms/0.1),

    By changing it yourself to “SoftBank/1.0/705NK/NKJ002/SN001 Android-Mms/0.1 Profile/MIDP-2” – you achieve the same functionality as installing previous Mms.apk from my site.

    To verify, you can run “adb logcat V”, while sending/receiving MMS, it will print UA string, examples:

    V/HttpUtils( 632): KUBA, UserAgent string: Android Mms/0.1

    V/HttpUtils( 141): KUBA, UserAgent string: Softbank/1.0/705NK/NKJ002/SN001 Android-Mms/0.1 Profile/MIDP-2

    Prefix “^SoftBank” is definitely case-sensitively verified by softbank – once i typed lowercase B and got forbidden…

    Cheers and enjoy :-D. Beers welcome :-D

    Ps. of course (lazy lazy) there is no translations nor locale support :-D, please send me patches for corresponding languages and i’ll add them to patched Mms.apk.

  23. OMG!

    it works!
    I used your apk with some UA I found on the XDA forum,
    and IT WORKS!

    Thank you so much! for all your help! :-D

    Here is my small contribution, the French strings :

    User-Agent String: Réglage du “User-Agent”

    Change MMS HTTP Client User-agent String: Modifier le “User-Agent” pour le client MMS HTTP

    Thanks again for all the help!

  24. Cool, glad i could help, pls share the useragent you used as well :-) so that other ppl can benefit.

  25. Nice, when you have spare minute, please try to play around with the UA string and check what part does affect working/non-working status, i believe they only look at “^Vodafone” part…

  26. Kuba-san,

    #1) will fastboot work on any handset or only developer versions. The HTC docs mention specific bootloaders.

    Based on your comment “change the require version-bootloader to your hboot version” I think it should work on retail handsets too. Is that right?

    #2) What do you think about Hero? I don’t have a handset yet but will need to go the Softbank prepaid SIM-card route and get mail working. Then I’ll need to root it to get a Japanese IME on board. Should I just stick with a Magic handset and follow your instructions here or do you think there will be something for Hero on the xda-developers.com site. The android section on Hero in empty though I see ports of Hero for the Magic handset under Sapphire.

    I appreciate your time and effort!

    Shawn

  27. Hi,

    1.

    There must be some way to flash firmware even on retail ones, but i’m not sure about fastboot.
    Magic supports “standard” firmware update mode (where it displays some icon on the screen), so it’s really hard to say what will happen on retail handsets.
    I guess there’s no better way than walk to Docomo store after July 10th and trying it yourself (i will try to do that :-D ).

    Changing required bootloader version happens IN THE zipped firmware file, so it has nothing to do with handset being retail or not.
    Of course being able to flash it onto the handset depends on fastboot etc.

    2.
    Not sure about hero, haven’t seen it.
    Though, Magic and G1 are exactly the same thing (other than missing keyboard etc).
    Looking at specs, Hero as well has the same cpu, it only has better cam, and mpeg decoder.

    So i guess you could just flash it with whatever is there for magic.
    To get IME, you can flash it with non-retail dev GDDC09 images – on my site.

    Cheers

  28. Kuba-san,

    Thanks and last question. Can I confirm you have data on your handset and not just voice + mail. I know softbank prepaid is just voice + mail.

  29. Hi, I have voice+data+mail+anything else, not sure about prepaid, i have normal cellphone post-paid card and iphone card as well.

  30. wow, I’m using GDD09 phone with Softbank SIM. Very much same as you and wondered why my MMS receive only header ;-) yay, thanks for information!

    BTW, you’ve already heard someone done thing on 1.33.3005? My friends using docomo model asking heavily how to root their phone :)

  31. Hi, in very short, i don’t think it’s a problem to root/reflash 1.33.3005 – using any other images available, you can edit required hboot version by unzipping/rezipping image files ;-) – and fastboot will not complain even a bit…

  32. Faster than lighthing, as always :-).
    I saw the docomo retail one, and it seems to have very ordinary fastboot, besides simlock and different hboot ver it feels just like my GDDC09.

  33. Kuba,

    thanks for all this info, very useful. However I’m wondering if you’ve seen this before –

    >adb install -r Mms.apk
    1626 KB/s (567891 bytes in 0.341s)
    pkg: /data/local/tmp/Mms.apk
    Failure [INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES]

  34. I think it has to do with the fact that this is a stock Hero ROM – on a phone purchased in the UK.

    As you didnt sign the mms.apk with the same cert that the original was signed with it’s impossible to overwrite it. adb uninstall didn’t work and so I’m going to have to try to rm within the shell and then push your .apk (or alternatively an mms.apk that I found on xda – http://forum.xda-developers.com/showthread.php?p=4234709 )

    will backup and then root before I try that of course.

    cheers,

    mils

  35. So backed up the system.. rooted the device (was pretty simple really)

    Now I get the following:
    failed to copy ‘Mms.apk’ to ‘/system/app/Mms.apk’: Read-only file system

    it’s blind leading the blind time around here..

    mils

  36. That is interesting, if i remember, installing my Mms.apk caused original one to be removed from system apps and new one installed under use apps.
    But i’m not sure whether adb is trying to remove old app or install new one in it’s place.
    What OS are you running ?

    Mine was compiled for cupcake.

  37. So Kuba what do I need to do to make similar MMS UA-string modications to my Hero Mms.apk? I suppose this is going to require decompiling, adding the appropriate hard-coded MMS UA-string and then recomping the .apk?

  38. Hmm, im not sure actually, os version looks the same as mine, never played with Hero.
    It’s interesting why my app doesn’t get installed, maybe your operator did something with certificates so that it requires apps to be signed appropriately…
    Do you mind sharing your rom backup so that i can try it in emulator ?

  39. Hello:

    Thank you Kuba for your script. I’m currently trying to use a prepaid SIM card from a Softbank 730SC Phone. I’m using a User Agent String of the format listed above SoftBank/1.0/###@@/@@001 and settings that enable sending of MMS, but prevent me from receiving or downloading messages. Has anyone else experienced this issue or can comment on it?

  40. Hi,

    I’ve sent you settings to your email.
    I’ve never tried prepaid cards – it’s very likely settings will be different.

    While you send/receive mms try using adb logcat and looking for access denied messages – these prove it’s UserAgent problem, if you get any other error, it must be some other problem.

  41. Hello,

    I live in Japan and use silver SIM of softbank in NOKIA.

    I purchased HTC Hero yesterday.

    I installed your Mms.apk, but transmission and reception of MMS is not possible.
    Besides, it starts and I force you and am finished in a few minutes.

    I read an article to be said to be different from G2,G1 in handling of Mms.apk in xda-developer.com.

    http://forum.xda-developers.com/showthread.php?t=542540

    In addition, transmission and reception of MMS is not done in a certain Mms_softbank.zip in this site either.

    If you have some information, about a method to make Hero and Mms.apk for SOFTBANK, I ask me for advice from you.

    Or I am happy when I challenge SOFTBANK of Hero with you.

    Best Regards.

  42. kei_ef_2000, I haven’t really played with Hero yet, could you rip off your Hero rom and give it to me somehow so that i can try it out myself ?
    If i can access Hero rom, then maybe i can hack Mms.apk somehow. Otherwise the only access i have is official source code on google.
    Thanks.

Leave a Reply