(2023-11-20) Is this the true end of the epoch for Nokia phones? Not sure yet ----------------------------------------------------------------------------- Finally, something about phones on this phlog. Moreover, about phones of my favorite brand. I could blabber about any (genuine) Nokias from 1993 up to 2023 for hours but there's a single thing I always lacked in them (except KaiOS models which compensate for it with plenty of other issues): ability to edit IMEIs without special boxes or proprietary software. This _might_, however, be about to change sooner than we think. A 30-year epoch of untouchable IMEIs in Nokia non-smartphones might come to an end in the forseeable future. I personally thought it would never be possible until I realized that the newest (2023-made and probably some 2022-made) Nokia feature phones (with non-smartphone hardware, that is) are no longer made in Vietnam like they were before. I also heard HMD had set up some local manufacturing for the Indian market, well, in India, but as I'm not there, this doesn't concern me much. All current-gen Nokia feature phones produced this year onwards and sold where I live — 105-2023 2G, 106-2023, 110-2023 2G, 130-2023 and 150-2023 — are coming to us from China. Yes, officially. These are not fakes. For the first time in history, we see official Nokia-branded keypad phones manufactured in mainland China. This was enough for me to pick one of them and see all the differences from the previous models. As HMD fully stopped announcing the chipset for their GSM-only models, it was a bit of hit and miss for me, but I ordered a new 130. And when it arrived, I was surprised it didn't have Unisoc SC6531F or something like that (I know that the new 105 and probably 106 and 110 do have SC6531E inside), but was still running on MediaTek MT6261D. Anyway, this was only the beginning of my surprises. So, here it is, the model TA-1576, Nokia 130 2023. In some regions, it's called 130 Music, and for the market of mainland China itself it was released as a 125 (probably because they totally missed the real 125... and for the greater good, I must add). It is quite a large barphone, dimensionally similar to the aforementioned 125 but a tiny bit thinner and narrower, which is a good thing in this case, and sporting yet another new removable battery type, BL-L5H with 1400 mAh rated capacity. As if the well-known BL-4UL wasn't good enough for that. Also, it looks like they changed the UI font one more time, no one knows what for. Anyway, judging merely by this amount of NIH syndrome, I thought that the inside of the phone would be just as different. Oh, how damn right I was... You see, I didn't even have to dump the firmware with MTreader, as the main partitions seem to be encrypted anyway, to see the obvious: this phone, or at least its board, was made in a totally different place. In case you didn't know, all of the Vietnamese MediaTek-based Nokias (that were running on MT6260, then MT6260A and MT6261D) tried to conceal in every possible way they were MediaTek-based. The Series30+ was a major overhaul of MAUI, and a good one at that. Not a single MAUI-specific secret code, besides a couple of debug-oriented ones, actually worked on those devices. Microsoft and then HMD spent a lot of effort even to conceal the fact those phones had an AT command interface... Well, not for long, but those events are already history, and I'm glad I was a part of it. But the fact remains the fact: on those Nokias, you couldn't even dial the *#63342835# (*#mediatek#) code and see the "MediaTek" word. If you could do this, it was an outright sign of a fake. Well, guess what: on this new fully official and original 130, you can. You also can enter an engineering menu with *#3646633# (*#engmode#), see the internal software version with *#8375# (*#ver5#), and yes, it's a different screen than what you get on the traditional Nokia's *#0000#, you can also enter a hardware test menu with *#15963#, or run quick tests with *#8378# or stress tests with *#87#. Again, I found all this without being able to fully analyze the firmware dump, but this was already enough for me to realize this firmware is much, much closer to the vanilla MAUI than any of its predecessors. I didn't, however, find the *#15963# code randomly. The phone had a hidden clue where to start looking for it. But what I found is something more. Any MAUI firmware version string, as you might now, contains a hardware revision substring. Usually it's an alphanumeric board identifier followed by the last three characters of the chipset model and then some other data after underscores. If you don't have a way to view this information via codes (which I initially didn't have), you can use various options for AT+EGMR subcommand. I ran the subcommand to get the board ID (AT+EGMR=0,4) and I saw the following string there: SAGETEL61D_11C_HW. This tells us that the chipset inside is indeed MT6261D and this is the revision 11C of the board codenamed SAGETEL. In fact, if we run an Internet search on the complete string, we already can find the device this board already had been used in: Itel IT2160, a barphone from Transsion released in ca. 2018. Of course, only the board is common with this Nokia but this inspired me to download some firmware for this IT2160 (which, of course, wasn't encrypted) and check for some codes from there. And, bizarrely enough, *#15963# was the only new code that actually fit my 130-2023. So, we have pure-MAUI secret codes for version, engineering and test menus for this phone (and I'm pretty sure they are the same for 150-2023 too). The main mystery, however, remains unsolved: are the IMEIs here editable in any way? Well, my first thought would be to go the traditional AT command route (by the way, yes, you have to sacrifice the USB storage mode if you set the PS config to USB in the respective engineering menu setting). So I tried AT+EGMR with corresponding parameters (AT+EGMR=1,7,"[new_imei]" for SIM1 and AT+EGMR=1,10,"[new_imei]" for SIM2) but got "CME ERROR: unknown" in both cases, while the read commands (AT+EGMR=0,7 and AT+EGMR=0,10 respectively) do work fine. In the Vietnamese MediaTek-based Nokias though, the write commands worked too but the result was ignored due to the NVRAM protection. Here, it just looks like it was disabled on the AT command processor level, whether or not protection is still there, I don't really know. Not gonna lie, if I find a working code for this, it will become my favorite post-2013 Nokia. For now, I'm stuck. There is, however, some hope based on what I have seen with *another* NVRAM field in the same area: PSN. PSN (product serial number) is the Nokia's name of the internal serial number that all phones like this have, be they on MediaTek or Unisoc. It's assigned fully independently of IMEIs and, in case of MediaTek, can be accessed with AT+EGMR command too under the field #5: AT+EGMR=0,5 for reading and AT+EGMR=1,5,"[new_sn]" for writing. The biggest problem, however, is that the PSN itself takes 25 characters, but the NVRAM field for it reserves 63 bytes and it actually is padded with whitespaces and ends with "10P" substring that's not a part of the serial number per se. But that's not all: it turns out that AT+EGMR command itself doesn't check the input length for this field, so if you don't include the padding, you can easily misalign all the subsequent NVRAM fields and mess up all calibration until you enter a 63-character long PSN. And guess what: this field is actually editable and unprotected in this Nokia. So, in theory, by manipulating its contents, we could manipulate all fixed-length fields/files that come after PSN in that area. But that's something that has yet to be investigated. For now, the IMEI question remains open. From the normal user's perspective, some very strange decisions had been made there as well. For instance, this phone has absolutely no way of viewing images from the SD card and absolutely no way of setting them as wallpapers. I didn't use any of the previous iterations of 130 and can't say whether or not this is the case for them, but to me it sounds most illogical. Luckily, there are 6 pre-installed wallpapers, but what's the reason to limit the choice if you definitely allow to set your own ringtones here? Although this is a strange one too — you can't do this from the profile or general tone settings, only from the SD file manager itself. Same for message and alarm tone customization. In the mass storage connection mode, the phone gets identified as "0e8d:0002 MediaTek Inc. phone (mass storage mode) [Doro Primo 413]". They didn't even try to conceal anything at this point. But I also had a trouble connecting *just to this Nokia* in the Mass Storage mode from my Arch Linux (Garuda), until I found out I had to comment out the following line in /lib/udev/rules.d/40-usb_modeswitch.rules file: ATTR{idVendor}=="0e8d", ATTR{idProduct}=="0002", RUN+="usb_modeswitch '/%k'" After that, everything went smoothly. Except, of course, the transfer itself being extremely slow. If you have a card reader and have a large amount of music to move, it will be your best bet. And, besides music (+ custom ringtones and audio recordings), there's pretty much nothing else you can use the SD card for in this phone (yes, even the phonebook VCard backup is scrapped). The player, by the way, is marketed as the central feature of this 130 and can be quickly entered by long-pressing the central D-pad key. On the first run, it scans the entire card for music files and generates the @Playlists/audio_play_list.sal file, whose format matches the one I described in my MAUI knowledge base ([1]). It also creates some temporary copy of this file's previous version, audio_play_list.sal.tmp, and the MyFav.sal playlist file that reflects your "Favorites" player selection. As far as I have seen, the format of MyFav.sal is exactly the same, with the only visible difference being that the "Favorites" entries end with the 01 00 bytes instead of 00 00 bytes in both audio_play_list.sal and MyFav.sal files. Out of all this, what conclusions can I make? Is this really the end of the epoch for Nokia featurephones? Not quite yet, but it is very close to that. I mean, it still is a genuine Nokia, cased into very hard polycarbonate plastic, having some IP52 dustproof rating, booting extremely fast, offering good sound capabilities and (I suppose) not having any trojans in its firmware. But in terms of how this firmware differs from all other China-originated phones (and we see a proof that the hardware literally is the same as one of them), the difference is almost non-existent now. And the only thing that globally keeps this firmware from being fully identical is not the S30+ UI on top of MAUI, it is the uncertainty about whether or not boxless/dongle-less IMEI editing is possible here. That's why my research in this area needs to continue, regardless of how long the pause has been. --- Luxferre --- [1]: gopher://hoi.st:70/0/docs/own/maui-kb-mt6261.txt