ATTENTION: Some links may be outdated! Please visit E398mod.com for newer files and news!

Author: Sam
Revision: 2.0
email: thewritingsonthewall[at]gmail.com
Please only email me if there is a definate error in the guide, otherwise use the forums!

Introduction

I wrote this guide to assist those new to modding with upgrading their phones. The actual procedures and files used here were written by other users, please give them credit for their wonderful work. I would like to especially mention TomeQ for figuring out the iTunes hack, but to every user at HowardForums, Motomodders.net and motofan.ru who helped, thank you!

If anyone from Motorola is reading this, maybe you should consider actually innovating and releasing new phone models instead of putting new software on a 2 year old phone, calling it new and selling it at a high price. If you're wondering why the ROKR has not sold well... this is your answer. Maybe all that effort you put into using RSA keys to "protect" your phones you could have could have been used instead to make a better phone.

Anyway, on with the guide!
laugh

IF YOU CHOOSE TO PROCEED BEYOND THIS POINT YOU ARE RESPONSIBLE FOR ANY DAMAGE CAUSED TO YOUR PHONE. IF IT DIES YOU MAY NEED TO SEND IT IN FOR SERVICE. THIS IS UNLIKELY BUT POSSIBLE, SO BE AWARE OF THE RISK YOU'RE TAKING BY MODDING YOUR PHONE

Please read the section below before you continue.

Current limitations of this modification:

Only iTunes version 4.9 will work on Mac or PC
The 100 song limit still applies, as it does on a proper ROKR phone

Pros of doing this modification:

iTunes, which works well
AAC Audio support (within Videos too)
Video Recording (unlimited possible)
Airplane Mode
Install Java to memory card
Better skins (3x4 icons)
Quad-Band GSM support

Cons of doing this modification:

You will void your warranty
Less battery life
Worse "lagginess", menus are slower etc.
No playlist feature in sounds menu
Slower to connect to network

An additional note about "Locked" phones:
If your phone is "Locked" to a certain network, you should be extra careful. The locking procedure can be Flex based or PDS based, which means proceeding here may unlock your phone for you or the procedure may not work at all (you can easily restore a backup). I have seen reports of locked phones refusing to boot after being flashed, so be careful and always make backups.

The "42r-for-all" flash file contains more data than a normal firmware, this data causes your phones PDS section, which stores information unique to your phone to be partially blanked. The phone recovers from this, but it breaks your bluetooth address. As you will read later this is easy to recover from. This blanking is also what may cause locked phones to unlock.

However, do not rely on this to unlock your phone.

1. Converting your E398 to a Faux E1 ROKR

What you'll need for this process:

A working Motorola E398 phone
A USB data cable (you CANNOT use bluetooth!)
Random's FlashBackup v2.5 - available here
Motorola PST - This is copyrighted software, you will need to locate a copy of this on your own.
Bezol's P2KTools 0.8 - available here
The "42r-for-all" Monster Pack firmware - available here or here or here or here or here or here or here

1.1 Backup

You MUST backup EVERYTHING ON YOUR PHONE FIRST. DO NOT SKIP THIS STEP FOR ANY REASON. To get started, turn your phone off and take your TransFlash card out if you have one. You have to remove the battery and take it out the same way you would remove your SIM card. You can leave your SIM card in if you wish, it makes no difference.

Backing up images/ringtones/video:

Turn your phone on, and make sure under "USB settings" that "data/fax connection" is selected NOT "memory card". The location of USB settings varies depends on firmware, it may be under settings or under the connections menu.
If you don't have a USB settings menu just ignore that step, the phone should default to data/fax
Run P2KTools, and plug your phone in.
Make sure the large button on the top left is set to P2K mode NOT AT mode.
Windows should detect the phone in normal (AT mode) then switch it to P2K mode automatically for you. This might take 30 seconds or so to do.
Once this has been done you can "connected" as shown below.

Hit the refresh button to gain a list of files.
Browse to /c/mobile
Inside the folder here you will find any saved pictures/audio, selected the ones you want to save and hit the Download button

Backing up your websessions file

You will want to make a backup of this if you have setup WAP/GPRS from your provider, otherwise you will need to contact them to retrieve your settings.

Using the method above, browse to /a/ and find the file Websession (no extensions)
Download it somewhere you wont forget

Backing up your contacts

If you have any contacts stored on your phone, you will want to back these up first. Any stored on your SIM card will be untouched by the flashing procedure. Note that P2KTools sometimes gets confused when you have multiple entries with the same name (but different number types). If you want to be 100% sure you wont lose your phonebook make a hard copy of the numbers on paper.

Disconnect your phone if plugged in
Open P2KTools and switch to AT mode
Wait until you see "connected" in the bottom left
Switch to PhoneBook and hit Read
Hit Backup and save the .csv somewhere

Backing up your SMS Messages

Using the same method as above, open P2KTools in AT Mode
Hit the SMS button and select the message you want to save
Save the .txt file somewhere

Backing up your current phone firmware

THIS STEP IS VITAL, DO NOT SKIP IT.

AT THIS POINT ENSURE YOUR BATTERY IS FULLY CHARGED, OR YOU MAY BE STUCK IN BOOTLOADER MODE WITH NO WAY TO RECHARGE THE BATTERY!

Disconnect your phone from your computer if it's plugged in
Ensure your phone is set to Data/Fax under USB settings if you have this option
Run FlashBackup
In the setup tab, choose a folder to store your backups in
Go to the Backups tab, choose Full Backup and 32MB
Plug your phone into USB port and wait until you see Connected on the bottom left
Press create, and wait for the process to complete, which may take 10-30 minutes.
If you get asked for drivers at any stage here, tell Windows to search for drivers in the directory you have installed Motorola PST to.

At this point the screen on your phone may have garbled text or lines down it. Don't worry, this is normal and will fix itself when you restart the phone.

Wait until FlashBackup has done it's magic and compressed the backup
Browse to the folder you selected earlier
Find the .fbp that was created. Also there may be a .dsc file
Copy these files somewhere as a backup, along with anything else you have already backed up (phone book, pictures etc), maybe burn them to a CD, upload them to the web or store them on a USB flash drive. Just don't lose them!

Now, repeat the process as above but choose PDS Backup
Again, repeat the process but choose Bootloader Backup

1.2 Flashing the 42r MP (ROKR)

Check your Bootloader version by holding down # and * when you power the phone on

You must ensure that under Boot Loader you have 07.D0. If you have something else, DO NOT PROCEED

AT THIS POINT ENSURE YOUR BATTERY IS FULLY CHARGED, OR YOU MAY BE STUCK IN BOOTLOADER MODE WITH NO WAY TO RECHARGE THE BATTERY!

Remove your TransFlash card from your phone
Make sure your phone is in Data/Fax mode under USB settings
Find the directory where Motorola PST is installed and run MultiFlashFlex.exe
If MFF will not open, you haven't "patched" it correctly. I'll let you figure this step out.
Under preferences check the first two boxes
Under Enable Flash check the box and select the 42r-for-all .shx file you downloaded (extract it from the archive file)
Make sure under Enable Flex nothing is selected
Start your phone in bootloader mode, this is done by holding down the star * and hash # keys while powering on.
Plug your phone in and wait for it to appear in the list (it may appear as S FLASH NEPTUNE LTE)
Press start!

If you get asked for drivers at any stage here, tell Windows to search for drivers in the directory you have installed Motorola PST to.

mff 1

THE FLASHING PROCEDURE WILL TAKE 15-30 MINUTES, DO NOT INTERRUPT THE PROCESS IN ANY WAY WHILE IT IS FLASHING.

Looks like we're done here! Now exit MFF, restart your phone and lets see what happens!

It worked!

Congratulations, you just modded your phone. Please move on to the next section for fixing your PDS and updating the firmware to something more modern .

AT THIS POINT ITUNES WILL NOT WORK, YOU WILL GET A ERROR ABOUT ITUNES NOT BEING SUPPORTED ON THIS PLATFORM. PLEASE READ THE NEXT SECTION FOR HOW TO FIX THIS!

russian wtf

Don't worry about the Russian text, that will be fixed very soon

Flashing to a better Firmware.

The 42r-for-all Firmware is very buggy, is missing a lot of stuff and is old. You will immediately want to update to something newer. At the time of writing, there are 42R, 43R, 44R , 45R and 6FR firmwares available. 45R is the best stable choice, but 6FR has unlimited video recording and less Java bugs.

Pick one of the newer firmwares from my website (make sure you look in the E398 R373 section) , or from one of the forums. I'm going to use Sudadi's 6FR Final MP as it has very nice graphics and a new font (which looks suspiciously like the Nokia font!). You flash the new firmware exactly the same as the previous 42r-for-all firmware, just select the new one inside MultiFlashFlex. Some firmwares will not have iTunes included, some may have features missing. Currently I would recommend either Sudadi's BluZre MP or muncheno's PCMMod MP 1.4d.

The picture below shows my phone running Sudadi's 6FR Final MP with the Tunes skin and a wallpaper from my site.

Fixing your PDS (to restore your Bluetooth address).

I recently added this section to the guide, as before I didn't realise what the 42r-for-all file did to your phone. Basically it blanks a section of your phone's memory, the "PDS" which contains things like your IMEI code and Bluetooth address. The phone repairs the IMEI section, but your Bluetooth address will not be restored, it will be FF:FF:FF:FF:FF:FF instead of your real address (for example. 43:B4:5A:33:DD:6F). This means some Bluetooth devices will not "see" your phone, mostly BT headsets.

You don't absolutely have to fix this for your phone to function normally. If you never plan to use Bluetooth then you can ignore this next step. However, you should do it anyway, as it's a very short process and easy to do. All you need to do is restore your old PDS backup. Your phone will convert it to work with the ROKR firmware and your bluetooth address will be intact.

You must have an older PDS backup, it can be from ANY previous firmware (stock, i398 etc.) as long as it's from BEFORE you flashed 42r-for-all. If you don't have an old PDS backup then the process is MUCH harder, read the bottom of this page. If you do have your old PDS backup, proceed ahead.

Run Flashbackup, and find an old (before 42r-for-all, see above) PDS backup
Ensure YOU made this file, it's not from someone else's phone
Turn your phone on in BL mode
Run FlashBackup, switch to backups, change to PDS Backup and press the "..." button to choose your PDS backup
Press Restore and answer yes

Now power your phone back on. It appears nothing has changed, but read my "My Bluetooth is dead!" page under "Here’s how to determine if you have this problem". The second method is easiest to follow. As long as it shows your BT address is not FF:FF:FF:FF:FF:FF you have fixed your PDS and your Bluetooth should be fine!

This is the end of the first section of the guide. At this point you should have a fully working 6FR (or whichever firmware you chose) based phone. However iTunes will not work, and the later sections deal with this. The process is not difficult, but be careful.

If you do not wish to use iTunes:
You can remove iTunes from the phone completely, and use the built in audio player or a Java player for audio. This will also result in better battery life, as iTunes is not constantly running. To delete iTunes, follow these steps:

Open P2KTools, connect your phone and press Refresh
Wait until the files have loaded, and browse to /c/mobile/kjava
Delete any file named j2me0.* (there will be a few with different extensions)
Restart the phone

You may still receive a message on startup about iTunes not working. Currently I don't know how to fix this, but it's not a big deal.

1.3 Restoring your previous settings

All you need to do here is the opposite of the backup steps, so copy your Websession file back to the phone and any ringtones/pictures/video using P2KTools in P2K mode. When that's done, switch to AT mode and upload your contacts and any messages you want.

Check out this page for details of where system files go.

1.4 Fixing iTunes Method 1!

Introduction
This process is more complex than simply flashing a new firmware, and there is an increased risk of damaging your phone. You must manipulate the PDS Data on your phone, which is unique to every phone and you cannot use another person's PDS backup. If you follow the guide carefully, you should be fine. If you get stuck at any point, please read the forums at MotoModders and HowardForums for help.
        What you'll need for this process:
        A working Motorola E398 phone with "42r" or later Firmware (see above)
        A USB data cable (you CANNOT use bluetooth!)

        TomeQ's 0371_0001.seem - available here or here or here
        P2KSeem Editor - available here or here
        Random's FlashBackup v2.5 - available here
        XVI32 Hex Editor - available here
        PDSTool - available here or here or here
        WinRAR - available here

BEFORE PROCEEDING, ENSURE YOU HAVE MADE A FULL 32MB BACKUP MADE WITH FLASHBACKUP, AND YOUR BATTERY IS FULLY CHARGED

Check that your phone fully works with the ROKR firmware (everything except iTunes)
Format your TransFlash card, by going to Settings > Phone Status > Storage Devices > Middle button and format. Make sure you've backed up anything on there that you wanted!
Rename TomeQ's 0371_0001.seem to 01C4_0001.seem
Run P2KSeem, and make sure your phone is connected
Click load from file and select the 01C4_0001.seem file
Make sure under Seem you have 01C4 and under Record you have 0001 for both 'Load' and 'Save'
Press Save To Phone, and press yes

Unplug your phone, turn it off then turn it back on

If you get a SIM PIN error (wont accept your PIN), then something went wrong, just restore your backup and retry

Assuming that went OK, we need to run FlashBackup and make a PDS backup
Ensure your phone is in Data/Fax mode under USB settings
Run FlashBackup, wait until your phone connects
Make sure under Setup you choose the folder where you want to store the backup
Make sure it's set to PDS Backup (not Full Backup) and hit Create

THE BACKUP PROCEDURE WILL TAKE ABOUT A MINUTE, DO NOT INTERRUPT THE PROCESS IN ANY WAY WHILE IT IS WORKING.

Now we go to the directory you told FlashBackup to store your files and find the saved file. There may be many files here, you need to find the one that is PDS Only and has just been created (check the dates on the file). The filename will be similar to "E398 PDS Backup (05-11-14_125544).fbp"
Copy this file to another folder somewhere
Rename this file to .cab instead of .fbp (FlashBackup compresses any binary backups using the .CAB compression format)
If you have WinRAR installed, double click on the .cab file and it should open with two files inside. If you don't have WinRAR, download the free trial version

Extract the backup file to the folder that you have extracted PDSTool to, and rename the file to pds-original.bin
Run PDSTool, open the pds-original.bin file and press parse

Go back to the folder where PDSTools and your PDS backup are, and you will find a new folder called seems
Open this folder and find the file "0371" and delete it

Still inside the seems folder, rename the file 01C4 to 0371
Still inside the seems folder, make a copy of the file 01C3 (copy-paste)
Still inside the seems folder, rename the copy of 01C3 to 01C4 (the file 01C3 is now the same as 01C4
Go back to PDSTool and switch to assemble mode

Set version to 4 and put 9 in the second box
In PDSTool, browse to the seems folder. If it does not appear, try going up a directory then back down
You should see all the seems on the box in the right, click the first one, hold down shift, scroll to the last one, and click the last one so you select every file in that directory

Press the assemble button, you should see a checksum value and some other stuff at the bottom of PDSTool
Go back to your seems folder and a new file called PDS.bin should have been created

Run XVI32 and open the PDS.bin
This looks difficult but it's not, just find the string PDS_4009 on the right
Click on the 4 (before 009) and press edit menu in XVI32, and choose Overwrite String
Put 4013 in the box and press OK

Voila, it should have changed to 4013! (make sure you didnt overwrite anything else!)

Save the file in XVI and then quit
Copy the PDS.bin file to the directory where FlashBackup stores your backups.
Rename it to something meaningful, for example PDS_modded_for_iTunes.bin
Run FlashBackup and you should get a message about finding uncompressed backups
Press OK

Change mode to PDS Backup
Now under Restore backup press the ... button and choose the PDS file (it has been compressed for you remember)

Ensure your have the phone is connected message on the bottom left, and hit Restore! Press OK when prompted.
Turn your phone off and on again

YOUR PHONE SHOULD REBOOT AND ITUNES SHOULD BE WORKING, IT MAY TAKE A WHILE TO LOAD THOUGH

Success!

Congratulations and enjoy your new phone. Please read the section on iTunes PC for compatbility notes.

My phone is dead

Don't worry, it's possible to recover from most things going wrong. Check the forums at MotoModders and HowardForums for help.

1.5 Fixing iTunes Method 2!

This method has fewer steps, but is a little more complex and messing with RAMldr can destroy your phone. Just be careful.

What you'll need for this process:
        A working Motorola E398 phone with "42r" or later Firmware (see above)
        A USB data cable (you CANNOT use bluetooth!)

        RAMldr - available here or here or here
        TomeQ's 0371_0001.seem - available here or here or here
        Bezol's P2KTools 0.8 - avilable here or here or here
        XVI32 Hex Editor - available here
        PDSTool - available here or here or here
        WinRAR - available here

BEFORE PROCEEDING, ENSURE YOU HAVE MADE A FULL 32MB BACKUP AND A PDS BACKUP MADE WITH FLASHBACKUP, AND YOUR BATTERY IS FULLY CHARGED

Check that your phone fully works with the ROKR firmware (everything except iTunes)
Format your TransFlash card, by going to Settings > Phone Status > Storage Devices > Middle button and format. Make sure you've backed up anything on there that you wanted!
Rename TomeQ's 0371_0001.seem to 01C4_0001.seem
Run P2KSeem, and make sure your phone is connected
Click load from file and select the 01C4_0001.seem file
Make sure under Seem you have 01C4 and under Record you have 0001 for both 'Load' and 'Save'
Press Save To Phone, and press yes

Unplug your phone, turn it off then turn it back on

If you get a SIM PIN error (wont accept your PIN), then something went wrong, just restore your backup and retry

Unplug your phone, turn it off, and turn it back on in Bootloader mode (hold down star and hash when turning on)
Run RAMldr and plug the phone in, wait until RAMldr detects it
In RAMldr set the base address to 03FD0000 and entry address to 03FD0010
Click Send Ramldr and choose ldr.bin

Make sure the log shows the above (maybe without the squares in there)
In RAMldr set the base address to 10010000 and the entry address 10020000.
Press Save Mem
The log will say DUMP 10010000 OK.
In the directory that ldr.bin is, a file called 10010000 will be saved
Make sure the size is 65 536 bytes (64 kilobytes)

Now open PDSTool and open the 10010000 file, and press Parse

Inside the directory where the 10010000 file was, a new directory called seems has been made
Open this directory and delete 0371
Rename 01C4 to 0371
Copy 01C3 and rename it to 01C4
Now choose assemble in PDSTools, browse to the seems folder and select all the files
Make sure version is set to 4009

Go back to your seems folder and a new file called PDS.bin should have been created

Run XVI32 and open the PDS.bin
This looks difficult but it's not, just find the string PDS_4009 on the right
Click on the 4 (before 009) and press edit menu in XVI32, and choose Overwrite String
Put 4013 in the box and press OK

Voila, it should have changed to 4013! (make sure you didnt overwrite anything else!)

Save the file in XVI and then quit
Make sure your phone is in Bootloader mode
Open RAMldr again and set base address to 03FD0000 and entry address to 03FD0010
Make sure the phone is connected and choose Send Ramldr
Choose ldr_pds.bin

You should have got the above to appear
Now press ERASE in RAMldr, ACK ERASE should appear after ACK JUMP in the log

In RAMldr, set the base entry to 10010000 and press Send Binary.
Find the PDS.bin that PDSTool made and select it".

Hopefully you got the same message as above!
Upnplug and restart your phone, iTunes should now be working!

Success!

Congratulations and enjoy your new phone

My phone is dead

Don't worry, it's possible to recover from most things going wrong. Check the forums at MotoModders and HowardForums for help.

1.6 iTunes on the PC

Make sure you phone is set to Memory Card mode in USB settings, load iTunes and plug the phone in. It will be slow, but it should appear there. Make sure that under options (on PC), under Phone you allow transcoding of high bitrate files to 128Kbit AAC or many files will not transfer over.

At the moment it seems that only iTunes version 4.9 will work, NOT 5 or 6. Apple must have added extra protection against modding into the later versions, I would imagine it checks your IMEI against a list of valid ones or something similar. Unfortunately I don't know of a way around this yet. Hopefully some of the russian geniuses are working on Fixing this!

Older versions of iTunes are available to download from PlanetMirror

1.7 Disaster Recovery

Your phone may seem completely dead, but don't worry its possible to recover from almost anything short of physical damage.

Firstly, if your phone can turn on, try restoring your fullbackup. If you didn't make a backup, you're an idiot and the process is much harder but not impossible. If your phone wont turn on, try the force boot method. If that doesn't work, head over to Motomodders and Howardforums for help. Read the stickied threads and use the search feature before you post your own thread.

A good place to start would be Bobzilla's survival and revival guide.

1.8 Credits

Thank you to everyone from Motomodders, Howardforums, Motofan.ru. Specifically TomeQ for the iTunes PDS patching method, but to everyone else as well.

Table of Contents:

1.1 Backup
1.2 Flashing the 42r MP (ROKR)
1.3 Restoring your previous settings
1.4 Fixing iTunes Method 1!
1.5 Fixing iTunes Method 2!
1.6 iTunes on the PC
1.7 Disaster Recovery
1.8 Credits

1. Converting your E398 to a Faux E1 ROKR