PROYECTOS ALCATEL MTK CHIPSET--

imei : 356 318020000001

reversed 12d: 100000020813
NCK Code : 938950060489
SPCK Code : 038950080292


100000020813 reversed 12 latest imei digits (318020000001)
938950060489 NCK code
038950080292 SPCK code
--------------------------------
--------------------------------
Phone Imei : 357 873022388655

NCK Code : 277338726619
SPCK Code : 723111946987


556883220378
277338726619 : NCK code
723111946987 : SPCK code
--------------------------------
--------------------------------
Phone Imei : 356 318024364560

NCK Code : 284172888404
SPCK Code : 249535208217

065463420813
284172888404 : NCK Code
249535208217 : SPCK Code

###NCK### ##latest 12 imei digits##
668950000010 000000000010 -> 1*(1+0)= 1 , (1+0)*0= 0
468950000022 000000000011 -> 1*(1+1)= 2 , (1+1)*1= 2
466950000333 000000000111 -> 1*(1+1+1)= 3 , 1*(1+1+1)= 3 , 1*(1+1+1)= 3
244950000222 000000000222 -> 2*(2+2+2)= 1 2 , 2*(2+2+2)= 1 2 ,2*(2+2+2)= 1 2
046950000628 000000000123 -> 1*(1+2+3)= 6 , 2*(1+2+3)=1 2 , 3*(1+2+3)=1 8
804950000000 000000000749 -> 7*(7+4+9)=14 0 , 4*(7+4+9)=8 0 , 3*(7+4+9)=6 0
222950000446 000000000837 -> 8*(8+3+7)=14 4 , 3*(8+3+7)=5 4 , 7*(8+3+7)=12 6
862350008864 000000003814 -> 3*(3+8+1+4)=4 8 , 8*(3+8+1+4)=12 8 , 1*(3+8+1+4)=1 6 , 4*(3+8+1+4)=6 4

000002 243814

our first step will be to sum all digits: 0+0+0+0+0+2+2+4+3+8+1+4=24
then we will calculate a line which is the result of our sum 24 by each digit of imei.

0x24=0
0x24=0
0x24=0
0x24=0
0x24=0
2x24=48
2x24=48
4x24=96
3x24=72
8x24=192
1x24=24
4x24=48

this way we have:
000008 862246

now the second step is based on this chart:


Code:
1 ............... 8
2 ............... 6
3 ............... 4
4 ............... 2
5 ............... 0
6 ............... 8
7 ............... 6
8 ............... 4
9 ............... 2
0 ............... 0 but with a little trick, we have to tak our imei and split it in two halves like this:
000002 243814
and now based on the chart we have two make another line based on the digits in the chart which corresponds to the digits on the imei, and inverse the order. it sounds a little confusing but i know you will understand. so for our imei
000002 243814
we have:
284426 600000
pay attention to halves colors so you can understand it better. you can see, for instance, that for the number 2 you get number 6 and so on.

now third step is to use the following line:
688950 000000
which is the magic line you get when you calculate the nck with all 0 in imei.

if we put all three lines in order we get:
000008 862246
284426 600000
688950 000000
we can easily sum digit by digit, and in this case we get this:
862374 462246
which for our surprise will be the nck for the given imei.

so for imei 000002 243814 we get nck 862374 462246 i have tried we a couple of examples and the result is the same, don't have delphi here with me now but sure someone can code this algo and make more tests to see if everything is correct.

this is another test i did:
000012 243814 --> imei sum: 1+2+2+4+3+8+1+4=25
000050 005050 --> firs line
284426 680000 --> second line
688950 000000 --> third line
862326 685050 --> nck

unlock code (imei 123456789012347):

MD5 ("1234567890123475e8dd316726b0335") = 8f 43 ae 1a 33 19 c6 49 cc 57 40 8b 6a 39 2d 6b

8f xor 33 xor cc xor 6a =1a
43 xor 19 xor 57 xor 39 =34
ae xor c6 xor 40 xor 2d =05
1a xor 49 xor 8b xor 6b =b3

1a3405b3 and 1ffffff or 2000000 = 23405B3

hex2dec (23405B3) = 36963763 -> unlock code


same steps for flash code , only one different

MD5 ("12345678901234797B7BC6BE525AB44")= ..............

byte 0 xor byte 4 xor byte 8 xor byte 12 = 1A
byte 1 xor byte 5 xor byte 9 xor byte 13 = 34
byte 2 xor byte 6 xor byte 10 xor byte 14 = 05
byte 3 xor byte 7 xor byte 11 xor byte 15 = b3

For example:
Code:
XOR(8F h, 33 h)

8F h = 10001111 b
33 h = 00110011 b
=[XOR]===========
BC h = 10111100 b The XOR operation has the nice property that it can be used for encryption,
because the operation can be reversed by XOR'ing with the key.

See here:

Code:
8F h = 10001111 b
33 h = 00110011 b
=[XOR]===========
BC h = 10111100 b <- Result of XOR(8F h, 33 h)

BC h = 10111100 b
33 h = 00110011 b
=[XOR]===========
8F h = 10001111 b <- Original value

alcatel uses sha1 hash on all code calcs
also the input (imei) is swapped, and the output hash is xored
output from that is shifted into the code.. so with normal crypto analysis and calculating.. this one is extreme hard..

models that use provider id are even harder, they also use 2 special hashes based on firmware customise code

Model ____ IMEI ____________ NCK ________ SPCK _____
C700 _____ 000000000000000 _ 0866469964 _ 0149012731


"0866469964" in integer = "33A5484C" in hex

cod[0]=33
cod[1]=A5
cod[2]=48
cod[3]=4C

then... with @SSA explanation:
cod[0] = digist[2] xor digist[7] xor digist[13] xor digist[8] xor digist[12]
cod[1] = digist[9] xor digist[1] xor digist[3] xor digist[14] xor digist[0]

cod[2] = digist[x] xor digist[x] xor digist[x] xor digist[x] xor digist[x]
cod[3] = digist[x] xor digist[x] xor digist[x] xor digist[x] xor digist[x]

missing digits: 4 5 6 10 11 15 16 17 18 19

there is no logic to organize the remaining digits... only analyzing an not-encrypted firmware with IDAPro.

or making a software based in this to analyze by brute force all combinations.

Of course, this is only a part of Alcatel C700 algorithm.


@SSA my question, you put real values of cod[0] and cod[1] for the C700 ¿?


Quote:
cod[0] = digist[2] xor digist[7] xor digist[13] xor digist[8] xor digist[12]
cod[1] = digist[9] xor digist[1] xor digist[3] xor digist[14] xor digist[0]

Copyright Statement:
* --------------------
* This software is protected by Copyright and the information contained
* herein is confidential. The software may not be copied and the information
* contained herein may not be used or disclosed except with the written
* permission of MediaTek Inc. (C) 2003
*
******************************************************************************/

/*******************************************************************************
* Filename:
* ---------
* mtk_mcu.h
*
* Project:
* --------
* BootRom Library
*
* Description:
* ------------
* The definition of MediaTek chip types and external clock arguments.
*
* Author:
* -------
* Amos Hsu (mtk00539)
*
*==============================================================================
* HISTORY
* Below this line, this part is controlled by PVCS VM. DO NOT MODIFY!!
*------------------------------------------------------------------------------
* $Revision: 1.13 $
* $Modtime: Dec 28 2005 20:07:46 $
* $Log: //mtkvs01/vmdata/flash_tool/archives/BootRom/mtk_mcu.h-arc $
*
* Jan 2 2007 mtk01413
* [STP100001195] FlashTool v3.1.02 release
* New features:
* 1. [BROM_DLL/DA] Support FOTA(Firmware update Over The Air) download.
* 2. [BROM_DLL/DA] Support MT6223 download.
* 3. [BROM_DLL/DA] Support MT6268T download.
* 4. [DA] Supports new NOR Flash device
* [SPANSION] S29GL128NH
* [SPANSION] S29GL128NL
* [SPANSION] S29GL256NH
* [SPANSION] S29GL256NL
* [SPANSION] S29GL512NH
* [SPANSION] S29GL512NL
*
* Enhancements:
* 1. [DA] Support BBC(Blank Block Check) for NOR Flash Format.
* 2. [BROM_DLL/DA] Support Retransmit mechanism for NAND Readback operation.
* 3. [BROM_DLL] Enhance E-NFB Check.
*
*
* Sep 27 2006 mtk00539
* [STP100001145] FlashTool v3.1.01 release
*
*
* Aug 14 2006 mtk00539
* [STP100001057] FlashTool v3.1.00 release
*
*
* Rev 1.13 Dec 29 2005 10:42:02 mtk00539
* 1. [BROM_DLL] Support new baseband chip MT6226M.
* Resolution for 156: [FlashTool v2.7.1013][BUG FIX] Fix BootROM start command failure while manually selecting NMT6226 or MT6227 baseband chip.
*
* Rev 1.12 Sep 13 2005 13:23:52 mtk00539
* 1. [DA][New] New NOR flash device support [Winbond] W19B320ATB, W19B320ATT.
* 2. [DA][BUG FIX] Fix MT6229 read DSP version failure problem.
* Resolution for 130: [BROM_DLL v2.4.1016][Enhance] Workaround the 1st time power up failure issue when RTC is empty.
*
* Rev 1.11 Jul 24 2005 21:33:14 mtk00539
* 1. Write a new Boot_META virtual function for MT6228.
* 2. Lock power in META mode on MT6228.
* Resolution for 121: [BROM_DLL v2.4.1014][New] Support MT6227 and MT6228 NFB META mode.
*
* Rev 1.10 Jul 22 2005 20:39:10 mtk00539
* 1. [BROM_DLL][New] Support MT6227.
* 2. [BROM_DLL][New] Support MT6228 NFB META mode.
* Resolution for 121: [BROM_DLL v2.4.1014][New] Support MT6227 and MT6228 NFB META mode.
*
* Rev 1.9 Mar 29 2005 20:41:42 mtk00539
* Add MT6228 chip id
* Resolution for 107: [BROM_DLL v2.4.1010][New] Enhance bus test in FlashTest_DA, new INTEL flash support and bug fix.
*
* Rev 1.8 Aug 03 2004 10:42:44 mtk00539
* 1. [DA][BUG FIX] Invoke Board_Schematic()(old name is HW_Init()) before FUTL_CheckDevice(). Because FUTL_CheckDevice() must know the absolute address for each bank.
* 2. [DA][New] Add 12 new flash devices support
* [SAMSUNG]K5A3280YT,
* [TOSHIBA]TH50VPF6782AASB,
* [TOSHIBA]TH50VPF6783AASB,
* [TOSHIBA]TV00578002AABD,
* [TOSHIBA]TV00578003AABD,
* [Fujitsu]MB84VP24581HK,
* [INTEL]INTEL_28F640W30_B,
* [SPANSION]AM49PDL127BH,
* [SPANSION]AM49PDL129BH,
* [RENESAS]M6MGD13BW66CDG,
* [Winbond]W19B322TM,
* [Winbond]W19B323TM,
* 3. [DA][New] Readback check after WORD program is done, so that DA won't have to keep the chksum.
* 4. [DA][New] Auto-detect baseband chip type.
* 5. [DA][New] Auto-detect external SRAM size.
* 6. [DA][New] Merge MT6205B, MT6218B and MT6219 to an all-in-one DA.
* 7. [DA][New] Merge flash stress test module.
* 8. [DA][New] Modify makefile to build ARM or THUMB code.
* 9. [DA][New] Construct a customization kit for customers to add new flash or SOC checking algorithm by themselves.
* 10. [DA][Enhance] Split out AM29PDL128G function to improve the performance of general AMD callback functions.
* 11. [DA][Enhance] Enhance RX_BUFF_FULL behavior to prevent always retry two times.
* Resolution for 83: [BROM_DLL v2.4.1002] Merge all the DAs into all-in-one DA and fix many bugs and enhancement.
*
* Rev 1.7 May 21 2004 15:44:40 mtk00539
* 1. [brom.dll][New] add J2ME_ROM resource for w04.21 load.
* 2. [brom.dll][New] add MT6217 BootROM.
* 3. [brom.dll][New] add Brom_DownloadData API.
* 4. [brom.dll][New] remove Brom_Verify relative APIs.
* 5. [brom.dll][Enhance] move region overlap checking from Rom_Load() to IsReady() for more convenience.
* Resolution for 70: [BROM_DLL v2.3.1003][New] add J2ME_ROM resource for w04.21 load.
*
* Rev 1.6 Mar 02 2004 00:14:42 mtk00539
* 1. [DA][Enhance] re-assign DA command id.
* 2. [DA][Enhance] add DSP firmware version command.
* 3. [DA][BUG FIX] fix unsigned var in while loop that causes infinite loop.
* Resolution for 53: [BootRom v2.2.1007][Enhance] resource layout error detection.
*
* Rev 1.5 Nov 12 2003 14:14:44 mtk00539
* Add SOC feature
* Resolution for 35: [BootRom v2.1.1005][New] Add SOC feature.
*
* Rev 1.4 Sep 25 2003 13:57:54 mtk00539
* brom.dll v2.1.1001, please see SCR(28) for more details.
* Resolution for 28: [BootRom v2.1.1001][New] See the reasons below.
*
* Rev 1.3 Jun 30 2003 19:24:50 mtk00539
* 1. [brom.dll][Add Features] Split flashtool function into brom.dll
* 2. [brom.dll][Add Features] Add a fake MT6208 bootrom for FlashTool for Pluto version.
* 3. [DA][Add Features] Check format range.
* 4. [DA][Add Features] Report format percentage.
* 5. [DA][Add Features] Support 6208 EVB/CEVB for double flash devices access.
* 6. [DA][BUG FIXED] Fix DA pre-format sector bug, it shouldn't format beyond the max size of flash.
* 7. [DA][BUG FIXED] Fix DA FlashTool MEM_CMD end_addr bug, FlashTool should use (begin_addr+length-1) as end_addr.
* 8. [DA][BUG FIXED] Fix DA AM29DL640D, MB84VD23280FA and TC58FVB64 flash table error.
* Resolution for 12: [BootRom v2.2.1001][New Version] Split flashtool function into brom.dll
*
* Rev 1.2 Jun 11 2003 21:26:24 mtk00539
* 1. Modify BootRom library to support MT6218
* 2. Modify DA to support AM29PDL128G flash
* Resolution for 9: [FlashTool v2.2.1005][Add Feature] Support MT6218 and new flash AM29PDL128G
*
* Rev 1.1 May 20 2003 18:05:46 mtk00539
* add copyright
* Resolution for 6: [FlashTool v2.2][AddFeature] Support 6205/6205B at 13MHz, 26MHz and 52MHz.
*
*------------------------------------------------------------------------------
* Upper this line, this part is controlled by PVCS VM. DO NOT MODIFY!!
*==============================================================================
*******************************************************************************/
#ifndef _MTK_MCU_H_
#define _MTK_MCU_H_

typedef enum {
EXT_13M = 1,
EXT_26M = 2,
EXT_39M = 3,
EXT_52M = 4,
EXT_CLOCK_END,
AUTO_DETECT_EXT_CLOCK = 254,
UNKNOWN_EXT_CLOCK = 255
} EXT_CLOCK;

typedef enum {
MT6205 = 0,
MT6205B = 1,
MT6218 = 2,
MT6218B = 4,
MT6219 = 5,
MT6217 = 6,
MT6228 = 7,
MT6227 = 8,
MT6229 = 9,
MT6226 = 10,
MT6226M = 11,
MT6230 = 12,
MT6225 = 13,
MT6268T = 14,
MT6223 = 15,
MT6227D = 16,

BBCHIP_TYPE_END,
AUTO_DETECT_BBCHIP = 254,
UNKNOWN_BBCHIP_TYPE = 255
} BBCHIP_TYPE;

#endif

/*******************************************************************************
*  Copyright Statement:
*  --------------------
*  This software is protected by Copyright and the information contained
*  herein is confidential. The software may not be copied and the information
*  contained herein may not be used or disclosed except with the written
*  permission of MediaTek Inc. (C) 2006
*
******************************************************************************/

/*******************************************************************************
* Filename:
* ---------
*  flashtool_api.h
*
* Project:
* --------
*  Flash Download/Readback/Format Library.
*
* Description:
* ------------
*  Exported C interface APIs for FlashTool Library.
*
* Author:
* -------
*  Amos Hsu (mtk00539)
*
*==============================================================================
*           HISTORY
* Below this line, this part is controlled by PVCS VM. DO NOT MODIFY!!
*------------------------------------------------------------------------------
* $Revision$
* $Modtime$
* $Log$
*
* Mar 12 2007 mtk01413
* [STP100001329] FlashTool v3.1.04 release
*
*
* Jan 2 2007 mtk01413
* [STP100001195] FlashTool v3.1.02 release
* New features:
*  1. [BROM_DLL/DA] Support FOTA(Firmware update Over The Air) download.
*  2. [BROM_DLL/DA] Support MT6223  download.
*  3. [BROM_DLL/DA] Support MT6268T download.
*  4. [DA] Supports new NOR Flash device
*         [SPANSION] S29GL128NH
*         [SPANSION] S29GL128NL
*         [SPANSION] S29GL256NH
*         [SPANSION] S29GL256NL
*         [SPANSION] S29GL512NH
*         [SPANSION] S29GL512NL
*
* Enhancements:
*  1. [DA] Support BBC(Blank Block Check) for NOR Flash Format.
*  2. [BROM_DLL/DA] Support Retransmit mechanism for NAND Readback operation.
*  3. [BROM_DLL] Enhance E-NFB Check.
*
*
* Aug 17 2006 mtk00539
* [STP100001057] FlashTool v3.1.00 release
* Apply new auto read back FAT mechanism.
*
* Aug 16 2006 mtk00539
* [STP100001057] FlashTool v3.1.00 release
* Apply new auto format FAT mechanism.
*
* Aug 14 2006 mtk01413
* [STP100001057] FlashTool v3.1.00 release
*
*
* Aug 13 2006 mtk01413
* [STP100001057] FlashTool v3.1.00 release
* New features:
*  1. [FlashTool/BROM_DLL/DA] Provide a method to retrieve Exception Log
*
*
*------------------------------------------------------------------------------
* Upper this line, this part is controlled by PVCS VM. DO NOT MODIFY!!
*==============================================================================
*******************************************************************************/
#ifndef _FLASHTOOL_API_H_
#define _FLASHTOOL_API_H_

#include "mtk_status.h"
#include "brom.h"
#include "DOWNLOAD.H"
#include "flashtool_handle.h"

#ifdef    __cplusplus
extern "C" {
#endif

struct FLASHTOOL_API_HANDLE;
typedef struct FLASHTOOL_API_HANDLE *    FLASHTOOL_API_HANDLE_T;

//------------------------------------------------------------------------------
// accuracy enum                                                                
//------------------------------------------------------------------------------
typedef enum {                            
   ACCURACY_AUTO        = 0,        // auto detect by baudrate
   ACCURACY_1_3        = 3,        //   33%
   ACCURACY_1_4        = 4,        //   25%
   ACCURACY_1_10        = 10,        //   10%
   ACCURACY_1_100        = 100,        //    1%
   ACCURACY_1_1000        = 1000,        //  0.1%
   ACCURACY_1_10000    = 10000        // 0.01%
}ACCURACY;                                
                                         
//------------------------------------------------------------------------------
// com port setting                                                            
//------------------------------------------------------------------------------

#ifndef COM_DEFAULT_TIMEOUT
#define    COM_DEFAULT_TIMEOUT        0xFFFFFFF
#endif
#define    COM_NO_TIMEOUT            0

//------------------------------------------------------------------------------
// DA report structure                                                          
//------------------------------------------------------------------------------
typedef struct {
   // DA version
   unsigned char        m_expected_da_major_ver;
   unsigned char        m_expected_da_minor_ver;
   unsigned char        m_da_major_ver;
   unsigned char        m_da_minor_ver;
   // bbchip
   BBCHIP_TYPE            m_bbchip_type;
   char                m_bbchip_name[32];
   unsigned short        m_bbchip_hw_ver;
   unsigned short        m_bbchip_sw_ver;
   unsigned short        m_bbchip_hw_code;
   EXT_CLOCK            m_ext_clock;
   unsigned char        m_bbchip_secure_ver;
   // NOR flash report
   STATUS_E            m_nor_ret;
   HW_ChipSelect_E        m_nor_chip_select[2];
   unsigned short        m_nor_flash_id;
   unsigned int        m_nor_flash_size;
   unsigned short        m_nor_flash_dev_code_1;
   unsigned short        m_nor_flash_dev_code_2;
   unsigned short        m_nor_flash_dev_code_3;
   unsigned short        m_nor_flash_dev_code_4;
   STATUS_E            m_nor_flash_otp_status;
   unsigned int        m_nor_flash_otp_size;
   // NAND flash report
   STATUS_E            m_nand_ret;
   HW_ChipSelect_E        m_nand_chip_select;
   unsigned short        m_nand_flash_id;
   unsigned int        m_nand_flash_size;
   unsigned short        m_nand_flash_dev_code_1;
   unsigned short        m_nand_flash_dev_code_2;
   unsigned short        m_nand_flash_dev_code_3;
   unsigned short        m_nand_flash_dev_code_4;
   unsigned short        m_nand_pagesize;
   unsigned short        m_nand_sparesize;
   unsigned short        m_nand_pages_per_block;
   unsigned char        m_nand_io_interface;
   unsigned char        m_nand_addr_cycle;
   // internal sram report
   STATUS_E            m_int_sram_ret;
   unsigned int        m_int_sram_size;
   // external ram report
   STATUS_E            m_ext_ram_ret;
   HW_RAMType_E        m_ext_ram_type;
   HW_ChipSelect_E        m_ext_ram_chip_select;
   unsigned int        m_ext_ram_size;

   // MTK Security Platform error code
   unsigned char        m_msp_err_code;

   // CODE area and SEC_RO area download status
   STATUS_E            m_download_status;

   // target boot-up style
   STATUS_E            m_boot_style;

   // current selected DL_HANDLE
   DL_HANDLE_T            m_dl_handle;

} DA_REPORT_T;

//------------------------------------------------------------------------------
// prototype of callback function                                              
//------------------------------------------------------------------------------
typedef int (__stdcall *CALLBACK_DA_REPORT)(const DA_REPORT_T  *p_da_report, void *usr_arg);
typedef int (__stdcall *CALLBACK_SET_HIGHSPEED_BAUDRATE)(HANDLE hCOM, unsigned char BaudrateId, void *usr_arg);
typedef int (__stdcall *CALLBACK_DOWNLOAD_PROGRESS_INIT)(void *usr_arg);
typedef int (__stdcall *CALLBACK_DOWNLOAD_PROGRESS)(unsigned char finished_percentage, unsigned int finished_bytes, unsigned int total_bytes, void *usr_arg);
typedef int (__stdcall *CALLBACK_BOOTLOADER_DOWNLOAD_PROGRESS_INIT)(void *usr_arg);
typedef int (__stdcall *CALLBACK_BOOTLOADER_DOWNLOAD_PROGRESS)(unsigned char finished_percentage, unsigned int finished_bytes, unsigned int total_bytes, void *usr_arg);
typedef int (__stdcall *CALLBACK_READBACK_PROGRESS_INIT)(HW_StorageType_E  storage_type, unsigned int rb_addr, unsigned int rb_length, const char *rb_filepath, void *usr_arg);
typedef int (__stdcall *CALLBACK_READBACK_PROGRESS)(unsigned char finished_percentage, unsigned int finished_bytes, unsigned int total_bytes, void *usr_arg);
typedef int (__stdcall *CALLBACK_FORMAT_PROGRESS_INIT)(HW_StorageType_E  storage_type, unsigned int begin_addr, unsigned int length, void *usr_arg);
typedef int (__stdcall *CALLBACK_FORMAT_PROGRESS)(unsigned char finished_percentage, void *usr_arg);
typedef struct {
   unsigned int    m_fmt_begin_addr;
   unsigned int    m_fmt_length;
   unsigned int    m_total_blocks;
   unsigned int    m_bad_blocks;
   unsigned int    m_err_blocks;
} FormatStatisticsReport_T;
typedef int (__stdcall *CALLBACK_FORMAT_STATISTICS)(const FormatStatisticsReport_T  *p_report, void *usr_arg);
typedef int (__stdcall *CALLBACK_POST_PROCESS_INIT)(void *usr_arg);
typedef int (__stdcall *CALLBACK_POST_PROCESS)(unsigned char finished_percentage, void *usr_arg);
typedef int (__stdcall *CALLBACK_SECURITY_PRE_PROCESS_NOTIFY)(void *usr_arg);
typedef int (__stdcall *CALLBACK_SECURITY_POST_PROCESS_NOTIFY)(void *usr_arg);

typedef int (__stdcall *CALLBACK_PROGRESS_INIT)(void *usr_arg);
typedef int (__stdcall *CALLBACK_PROGRESS)(unsigned char finished_percentage, unsigned int finished_bytes, unsigned int total_bytes, void *usr_arg);

//------------------------------------------------------------------------------
// Connect/Disconnect                                                          
//------------------------------------------------------------------------------
typedef    struct {

   // com port timeout setting
   unsigned int            m_com_ms_read_timeout;
   unsigned int            m_com_ms_write_timeout;

   // BootFlashTool arg
   BOOT_FLASHTOOL_ARG        m_boot_arg;

   // security pre-process notify callback
   CALLBACK_SECURITY_PRE_PROCESS_NOTIFY    m_cb_security_pre_process_notify;
   void *                                    m_cb_security_pre_process_notify_arg;

   HW_ChipSelect_E        m_nor_chip_select[2];

   HW_ChipSelect_E        m_nand_chip_select;
   unsigned int        m_nand_acccon;

} FlashTool_Connect_Arg;

typedef    struct {
   
   // DA report
   DA_REPORT_T            m_da_report;

} FlashTool_Connect_Result;

extern int __stdcall FlashTool_Connect(
                       unsigned char  com_port,
                       const FlashTool_Connect_Arg  *p_arg,
                       FlashTool_Connect_Result  *p_result,
                       int *p_stopflag,
                       FLASHTOOL_API_HANDLE_T  *p_ft_handle);

extern int __stdcall FlashTool_Connect_ByhCOM(
                       HANDLE  hCOM,
                       const FlashTool_Connect_Arg  *p_arg,
                       FlashTool_Connect_Result  *p_result,
                       int *p_stopflag,
                       FLASHTOOL_API_HANDLE_T  *p_ft_handle);

extern int __stdcall FlashTool_Disconnect(FLASHTOOL_API_HANDLE_T  *p_ft_handle);

//------------------------------------------------------------------------------
// Post-Process                                                                
//------------------------------------------------------------------------------
typedef    struct {

   // post-process callback
   CALLBACK_POST_PROCESS_INIT            m_cb_post_process_init;
   void *                                m_cb_post_process_init_arg;
   CALLBACK_POST_PROCESS                m_cb_post_process;
   void *                                m_cb_post_process_arg;

} FlashTool_PostProcess_Arg;

extern int __stdcall FlashTool_PostProcess(FLASHTOOL_API_HANDLE_T  ft_handle, const FlashTool_PostProcess_Arg *p_arg);

//------------------------------------------------------------------------------
// Change Baudrate                                                              
//------------------------------------------------------------------------------
typedef    struct {

   UART_BAUDRATE    m_baudrate;
   unsigned char    m_baudrate_full_sync_count;
   
   // set high-speed baudrate callback
   CALLBACK_SET_HIGHSPEED_BAUDRATE            m_cb_set_high_speed_baudrate;
   void *                                    m_cb_set_high_speed_baudrate_arg;
   
} FlashTool_ChangeBaudrate_Arg;

extern int __stdcall FlashTool_ChangeBaudrate(FLASHTOOL_API_HANDLE_T  ft_handle, const FlashTool_ChangeBaudrate_Arg  *p_arg);

//------------------------------------------------------------------------------
// Enable WatchDog Timeout                                                      
//------------------------------------------------------------------------------
extern int __stdcall FlashTool_EnableWatchDogTimeout(FLASHTOOL_API_HANDLE_T  ft_handle, unsigned int ms_timeout_interval);

//------------------------------------------------------------------------------
// Download                                                                    
//------------------------------------------------------------------------------
typedef    struct {

   // single DL_HANDLE
   DL_HANDLE_T                        m_dl_handle;

   // multi DL_HANDLE List
   DL_HANDLE_LIST_T                m_dl_handle_list;

   // da report callback
   CALLBACK_DA_REPORT                    m_cb_da_report;
   void *                                m_cb_da_report_arg;

   // DL_HANDLE download progress callback
   ACCURACY                            m_download_accuracy;
   CALLBACK_DOWNLOAD_PROGRESS_INIT        m_cb_download_flash_init;
   void *                                m_cb_download_flash_init_arg;
   CALLBACK_DOWNLOAD_PROGRESS            m_cb_download_flash;
   void *                                m_cb_download_flash_arg;

   // Boot Loader download progress callback
   CALLBACK_BOOTLOADER_DOWNLOAD_PROGRESS_INIT    m_cb_download_bloader_init;
   void *                                        m_cb_download_bloader_init_arg;
   CALLBACK_BOOTLOADER_DOWNLOAD_PROGRESS        m_cb_download_bloader;
   void *                                        m_cb_download_bloader_arg;

   // security post-process notify callback
   CALLBACK_SECURITY_POST_PROCESS_NOTIFY        m_cb_security_post_process_notify;
   void *                                        m_cb_security_post_process_notify_arg;

   // The flag of m_enable_tgt_res_layout_check is used to control whether if target resource
   // layout checking operation will be performed.                                          
   // _TRUE: Enable target resource layout checking operation.                        
   // _FALSE: Disable target resource layout checking operation.                      
   _BOOL                m_enable_tgt_res_layout_check;

   // The flag to check if target side baseband chip version is corresponding to ROM file on PC side.
   _BOOL                m_enable_bbchip_ver_check;

} FlashTool_Download_Arg;

typedef    struct {

   // dummy

} FlashTool_Download_Result;

extern int __stdcall FlashTool_Download(
                       FLASHTOOL_API_HANDLE_T  ft_handle,
                       const FlashTool_Download_Arg  *p_dl_arg,
                       FlashTool_Download_Result  *p_dl_result);

//------------------------------------------------------------------------------
// Readback                                                                    
//------------------------------------------------------------------------------
typedef    struct {
   
   HW_StorageType_E                    m_storage_type;

   RB_HANDLE_T                            m_rb_handle;

   // readback progress callback
   ACCURACY                            m_readback_accuracy;
   CALLBACK_READBACK_PROGRESS_INIT        m_cb_readback_flash_init;
   void *                                m_cb_readback_flash_init_arg;
   CALLBACK_READBACK_PROGRESS            m_cb_readback_flash;
   void *                                m_cb_readback_flash_arg;

} FlashTool_Readback_Arg;

typedef    struct {

   // dummy

} FlashTool_Readback_Result;

extern int __stdcall FlashTool_Readback(
                       FLASHTOOL_API_HANDLE_T  ft_handle,
                       const FlashTool_Readback_Arg  *p_rb_arg,
                       FlashTool_Readback_Result  *p_rb_result);

//------------------------------------------------------------------------------
// Format                                                                      
//------------------------------------------------------------------------------
typedef    struct {
   // automatically format the FAT area on flash
   _BOOL                m_auto_format_fat;
   // enable/disable erase validation
   _BOOL                m_validation;
   // begin_addr and length only take effect when option is m_enable_auto_format_fat is _FALSE
   unsigned int        m_format_begin_addr;
   unsigned int        m_format_length;
} FORMAT_CONFIG_T;

typedef    struct {
   
   HW_StorageType_E                    m_storage_type;

   // format config
   FORMAT_CONFIG_T                        m_format_cfg;

   // only take effect on NAND flash
   NUTL_EraseFlag_E                      m_erase_flag;

   // format progress callback
   CALLBACK_FORMAT_PROGRESS_INIT        m_cb_format_report_init;
   void *                                m_cb_format_report_init_arg;
   CALLBACK_FORMAT_PROGRESS            m_cb_format_report;
   void *                                m_cb_format_report_arg;
   // format statistics callback
   CALLBACK_FORMAT_STATISTICS            m_cb_format_statistics;
   void *                                m_cb_format_statistics_arg;

} FlashTool_Format_Arg;

typedef    struct {

   FormatStatisticsReport_T            m_format_statistics;

} FlashTool_Format_Result;

extern int __stdcall FlashTool_Format(
                       FLASHTOOL_API_HANDLE_T  ft_handle,
                       const FlashTool_Format_Arg  *p_fmt_arg,
                       FlashTool_Format_Result  *p_fmt_result);

//------------------------------------------------------------------------------
// SEC_RO read/write                                                            
//------------------------------------------------------------------------------
typedef struct {
   unsigned int        m_addr;
   unsigned int        m_len;
} SecRO_Info_T;

typedef struct {
   unsigned int        m_len;
   unsigned char *        m_data;
} SecRO_T;

extern int __stdcall FlashTool_SecRO_GetInfo(FLASHTOOL_API_HANDLE_T  ft_handle, SecRO_Info_T  *p_sec_ro_info);
extern int __stdcall FlashTool_SecRO_Read(FLASHTOOL_API_HANDLE_T  ft_handle, SecRO_T  *p_sec_ro);
extern int __stdcall FlashTool_SecRO_Write(FLASHTOOL_API_HANDLE_T  ft_handle, const SecRO_T  *p_sec_ro);

//------------------------------------------------------------------------------
// CustPara read/write                                                          
//------------------------------------------------------------------------------
typedef struct {
   unsigned int        m_addr;
   unsigned int        m_len;
} CustPara_Info_T;

typedef struct {
   unsigned int        m_len;
   unsigned char *        m_data;
} CustPara_T;

extern int __stdcall FlashTool_CustPara_GetInfo(FLASHTOOL_API_HANDLE_T  ft_handle, CustPara_Info_T  *p_cust_para_info);
extern int __stdcall FlashTool_CustPara_Read(FLASHTOOL_API_HANDLE_T  ft_handle, CustPara_T  *p_cust_para);
extern int __stdcall FlashTool_CustPara_Write(FLASHTOOL_API_HANDLE_T  ft_handle, const CustPara_T  *p_cust_para);

//------------------------------------------------------------------------------
// Update FlashTool Config                                                      
//------------------------------------------------------------------------------
typedef struct {
   unsigned int        m_lockdown:1;
   unsigned int        m_disable_code_download:1;
   unsigned int        m_disable_code_readback:1;
   unsigned int        m_disable_code_format:1;
   unsigned int        m_disable_sec_ro_download:1;
   unsigned int        m_disable_sec_ro_readback:1;
   unsigned int        m_disable_fat_download:1;
   unsigned int        m_disable_fat_readback:1;
   unsigned int        m_disable_fat_format:1;
   unsigned int        m_restricted_area_access_forbidden:1;
} SecurityBitCtrl_T;

typedef union {
   SecurityBitCtrl_T    m_bit_ctrl;
   unsigned int        m_uint32;
} SecurityCfg_U;

typedef struct {
   SecurityCfg_U        m_security_cfg;
} FlashToolCfg_T;

extern int __stdcall FlashTool_UpdateConfig(FLASHTOOL_API_HANDLE_T  ft_handle, const FlashToolCfg_T  *p_ft_cfg);

//------------------------------------------------------------------------------
// Get Project ID                                                              
//------------------------------------------------------------------------------
extern int __stdcall FlashTool_GetProjectId(FLASHTOOL_API_HANDLE_T  ft_handle, char *output_buf, unsigned int output_buf_len);

//------------------------------------------------------------------------------
// OTP read/write                                                              
//------------------------------------------------------------------------------
typedef enum {
    PARAM_READ = 0
   ,PARAM_WRITE
   ,PARAM_OPERATION_END
} PARAM_OPERATION;

typedef enum {
    OTP_READ = 0
   ,OTP_WRITE
   ,OTP_LOCK
   ,OTP_WRITE_AND_LOCK
   ,OTP_OPERATION_END
} OTP_OPERATION;

typedef struct {
   unsigned int        m_addr;
   unsigned int        m_len;
   unsigned char *        m_data;
} OTP_T;

extern int __stdcall FlashTool_OTP_CheckDevice(FLASHTOOL_API_HANDLE_T  ft_handle);
extern int __stdcall FlashTool_OTP_GetSize(FLASHTOOL_API_HANDLE_T  ft_handle, unsigned int * otp_size);
extern int __stdcall FlashTool_OTP_Read(FLASHTOOL_API_HANDLE_T  ft_handle, OTP_T * p_otp);
extern int __stdcall FlashTool_OTP_Write(FLASHTOOL_API_HANDLE_T  ft_handle, const OTP_T * p_otp);
extern int __stdcall FlashTool_OTP_Lock(FLASHTOOL_API_HANDLE_T  ft_handle);
extern int __stdcall FlashTool_OTP_LockCheckStatus(FLASHTOOL_API_HANDLE_T  ft_handle);

//------------------------------------------------------------------------------
// Repair Tool : Exception Record Retriever                                    
//------------------------------------------------------------------------------
extern int __stdcall RepairTool_GetDIRInfo( FLASHTOOL_API_HANDLE_T  ft_handle, char * fn_dir);
extern int __stdcall RepairTool_GetExceptionRecord( FLASHTOOL_API_HANDLE_T  ft_handle, char * fn_exceptionlog, char * fn_store);

//------------------------------------------------------------------------------
// ROM Writer : Extract/Inject NFB Images                                    
//------------------------------------------------------------------------------
#define DEFAULT_STORING_EXTRACT_NFB            "C:\\MTK_ExtractNFB.bin"
#define    MAX_FILENAME_LENGTH        256

typedef    struct {
   // post-process callback
   CALLBACK_PROGRESS_INIT                m_cb_progress_init;
   void *                                m_cb_progress_init_arg;
   CALLBACK_PROGRESS                    m_cb_progress;
   void *                                m_cb_progress_arg;
} FlashTool_Progress_Arg;

typedef    struct {
   // dummy
} FlashTool_Progress_RESULT;


extern int __stdcall FlashTool_ExtractNFB( FLASHTOOL_API_HANDLE_T  ft_handle, char * fn_store, const FlashTool_Progress_Arg  *p_pgs_arg);
extern int __stdcall FlashTool_InjectNFB( FLASHTOOL_API_HANDLE_T  ft_handle, char * fn_store, const FlashTool_Progress_Arg  *p_pgs_arg);

#ifdef    __cplusplus
}
#endif

#endif

417490746399044 8F 08 14 47 09 47 36 99 40 04 08 14 47 09 47 36 99 40 04 04 40 99 36 47 09 47 14 08
849036306448972 8F 08 48 09 63 03 46 84 79 02 08 48 09 63 03 46 84 79 02 02 79 84 46 03 63 09 48 08
914764738377371 8F 08 19 74 46 37 38 77 73 01 08 19 74 46 37 38 77 73 01 01 73 77 38 37 46 74 19 08
756669290934831 8F 08 57 66 96 92 90 43 38 01 08 57 66 96 92 90 43 38 01 01 38 43 90 92 96 66 57 08
032409882720458 8F 08 30 42 90 88 72 02 54 08 08 30 42 90 88 72 02 54 08 08 54 02 72 88 90 42 30 08
624290229213696 8F 08 26 24 09 22 29 31 96 06 08 26 24 09 22 29 31 96 06 06 96 31 29 22 09 24 26 08
709050948210366 8F 08 07 09 05 49 28 01 63 06 08 07 09 05 49 28 01 63 06 06 63 01 28 49 05 09 07 08
129558581503873 8F 08 21 59 85 85 51 30 78 03 08 21 59 85 85 51 30 78 03 03 78 30 51 85 85 59 21 08
553569553385411 8F 08 55 53 96 55 33 58 14 01 08 55 53 96 55 33 58 14 01 01 14 58 33 55 96 53 55 08
124080938089377 8F 08 21 04 08 39 08 98 73 07 08 21 04 08 39 08 98 73 07 07 73 98 08 39 08 04 21 08
622078934373814 8F 08 26 02 87 39 34 37 18 04 08 26 02 87 39 34 37 18 04 04 18 37 34 39 87 02 26 08
037535539437375 8F 08 30 57 53 35 49 73 73 05 08 30 57 53 35 49 73 73 05 05 73 73 49 35 53 57 30 08
147355258785067 8F 08 41 37 55 52 78 58 60 07 08 41 37 55 52 78 58 60 07 07 60 58 78 52 55 37 41 08
570324877711559 8F 08 75 30 42 78 77 11 55 09 08 75 30 42 78 77 11 55 09 09 55 11 77 78 42 30 75 08
064809434203819 8F 08 60 84 90 34 24 30 18 09 08 60 84 90 34 24 30 18 09 09 18 30 24 34 90 84 60 08
676708196968123 8F 08 76 76 80 91 96 86 21 03 08 76 76 80 91 96 86 21 03 03 21 86 96 91 80 76 76 08
030510463984275 8F 08 30 50 01 64 93 48 72 05 08 30 50 01 64 93 48 72 05 05 72 48 93 64 01 50 30 08
232902822418221 8F 08 32 92 20 28 42 81 22 01 08 32 92 20 28 42 81 22 01 01 22 81 42 28 20 92 32 08
634686732031458 8F 08 36 64 68 37 02 13 54 08 08 36 64 68 37 02 13 54 08 08 54 13 02 37 68 64 36 08
082372664816739 8F 08 80 32 27 66 84 61 37 09 08 80 32 27 66 84 61 37 09 09 37 61 84 66 27 32 80 08
802361045248493 8F 08 08 32 16 40 25 84 94 03 08 08 32 16 40 25 84 94 03 03 94 84 25 40 16 32 08 08
202539895287950 8F 08 02 52 93 98 25 78 59 00 08 02 52 93 98 25 78 59 00 00 59 78 25 98 93 52 02 08
941178372807646 8F 08 49 11 87 73 82 70 46 06 08 49 11 87 73 82 70 46 06 06 46 70 82 73 87 11 49 08
077220200838523 8F 08 70 27 02 02 80 83 25 03 08 70 27 02 02 80 83 25 03 03 25 83 80 02 02 27 70 08
617735572862526 8F 08 16 77 53 75 82 26 25 06 08 16 77 53 75 82 26 25 06 06 25 26 82 75 53 77 16 08
233956976059812 8F 08 32 93 65 79 06 95 18 02 08 32 93 65 79 06 95 18 02 02 18 95 06 79 65 93 32 08
174948405681944 8F 08 71 94 84 04 65 18 49 04 08 71 94 84 04 65 18 49 04 04 49 18 65 04 84 94 71 08
667052650356337 8F 08 66 07 25 56 30 65 33 07 08 66 07 25 56 30 65 33 07 07 33 65 30 56 25 07 66 08
555040890469653 8F 08 55 05 04 98 40 96 56 03 08 55 05 04 98 40 96 56 03 03 56 96 40 98 04 05 55 08
020825190235869 8F 08 20 80 52 91 20 53 68 09 08 20 80 52 91 20 53 68 09 09 68 53 20 91 52 80 20 08
624129218364220 8F 08 26 14 92 12 38 46 22 00 08 26 14 92 12 38 46 22 00 00 22 46 38 12 92 14 26 08
632625235358844 8F 08 36 62 52 32 35 85 48 04 08 36 62 52 32 35 85 48 04 04 48 85 35 32 52 62 36 08
817339251187610 8F 08 18 37 93 52 11 78 16 00 08 18 37 93 52 11 78 16 00 00 16 78 11 52 93 37 18 08
773045569194089 8F 08 77 03 54 65 19 49 80 09 08 77 03 54 65 19 49 80 09 09 80 49 19 65 54 03 77 08
470203139357018 8F 08 74 20 30 31 39 75 10 08 08 74 20 30 31 39 75 10 08 08 10 75 39 31 30 20 74 08
186480047967466 8F 08 81 46 08 40 97 76 64 06 08 81 46 08 40 97 76 64 06 06 64 76 97 40 08 46 81 08
403534857882594 8F 08 04 53 43 58 87 28 95 04 08 04 53 43 58 87 28 95 04 04 95 28 87 58 43 53 04 08
402051156852608 8F 08 04 02 15 51 86 25 06 08 08 04 02 15 51 86 25 06 08 08 06 25 86 51 15 02 04 08
259602097875124 8F 08 52 69 20 90 87 57 21 04 08 52 69 20 90 87 57 21 04 04 21 57 87 90 20 69 52 08
565870086662832 8F 08 65 85 07 80 66 26 38 02 08 65 85 07 80 66 26 38 02 02 38 26 66 80 07 85 65 08