E200命令集


info
*********************************************************************
info 1
显示BOOTLOADER版本信息
info 2显示机器信息
*********************************************************************

defrag
*********************************************************************
暂时没有弄明白意思
*********************************************************************

xStorage
*********************************************************************
重新启动(但似乎不是硬启动）至少O2上面不是！
*********************************************************************

binfs
*********************************************************************
暂时没有弄明白意思
*********************************************************************

msys
*********************************************************************
暂时没有弄明白意思
*********************************************************************

dbgtool
*********************************************************************
dbgtool ?
dbgtool [Type [Value1 [Value2]]]
Type(hex) 0: ASIC2 register read and [value1](hex) is address, [value2](hex) is ignore.
Type(hex) 1: ASIC2 register write and [value1](hex) is address, [value2](hex) is value.
Type(hex) 2: ASIC2 register dump and [value1](hex),[value2](hex) are ignore.
Type(hex) 3: Sony LCM write and [value1](hex) is address, [value2](hex) is Value.

Default Value: Type = 0xFFFFFFFF, Value1 and Value2 are both 0.
*********************************************************************


password
*********************************************************************
密码有3个其中一个是"9128283942"
*********************************************************************

shmsg
*********************************************************************
在机器上显示字符的命令
*********************************************************************

set
*********************************************************************
set ?
USE: set [Type Value]

Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.

Current flag settings:
Type 1(Operation mode flag): cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_wFColor=(0x0).
Type 5(Background color): g_wBColor=(0xFFFF).
Type 6(Set color of screen): None.
Type(hex) 32: Get card security level.
*********************************************************************

checksum
*********************************************************************
checksum ?
USE: checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*********************************************************************

wdata
*********************************************************************
升级时用的，威力巨大，使用不当。。。。。。死定了！
*********************************************************************

rbmc
*********************************************************************
rbmc ?
USE: rbmc [Filename StartAddr Len]

Read back the memory content from the specified address to the host
and save the data to specified file name.
FileName : Full file path for saving data of memory.
StartAddr : Start address of memory.
Len : How many bytes will be read.
*********************************************************************

qfs
*********************************************************************
这个应该不用说什么了吧？
*****

我会根据我的研究情况修改上面的命令，并贴出使用方法！

有用的应该是rbmc和wdata，可以把ROM读出来，写回去，这样应该至少可以研究出改IMEI，骗过老外的解锁程序，呵呵
另外不知道有没有程序可以跟踪老外的解锁程序和手机之间的通信内容，应该也可以分析出来。