Skip to content

PADCONF Quest

Jump to bottom
Lukas edited this page Mar 21, 2026 · 3 revisions

The PADCONF Quest

The ongoing battle to read 584 bytes of OMAP3630 pad mux registers from a Nokia E7-00 running Symbian Belle FP1.

Update 2026-03-21: ISI protocol communication WORKING! Phone responds to queries over USB Phonet. Resource scan in progress.

The Scoreboard

Bytes read Bytes needed Crashes caused ISI resources found
0 584 15+ 2 (scanning...)

Breakthrough: ISI/Phonet over USB (2026-03-21)

After days of fighting Symbian kernel security, we went BELOW the OS — directly to the Nokia BB5 platform's ISI protocol over USB.

Working:

  • IMEI read confirmed (354864048650007 — Unit A)
  • Software version read (V 79_sr1_12w18.5, RM-626)
  • Resource 0x0E responds (unknown service)
  • Resource 0xE3 responds (product info variant)
  • Crash-resilient scanner mapping all 256 resource IDs

Setup (Linux):

# Bind cdc_phonet kernel module
echo "3-2:1.14" | sudo tee /sys/bus/usb/drivers/cdc_phonet/bind
sudo ip link set usbpn0 up
# Run scanner
sudo python3 tools/isi_scan.py

Key discovery: Phonet address must be added via RTM_NEWADDR netlink with AF_PHONET (35) family — NOT via ip address add which creates an IPv4 address!

Methods Tried (All Failed Before ISI)

1-7. Symbian-side approaches

All blocked by TCB capability (ROM-only on Symbian). See wiki history.

8. ISI/Phonet Protocol (CURRENT — WORKING!)

Communicating with the phone's BB5 platform via Nokia's proprietary ISI protocol over USB CDC Phonet. Bypasses Symbian entirely.

Tools: tools/nokia_isi.py, tools/isi_scan.py

What's Next

  1. Complete the 256-resource scan (in progress, auto-resumes on crash)
  2. Identify PM (Permanent Memory) read service
  3. Identify hardware register / memory access service
  4. Read PADCONF at 0x48002030

The Nokia ISI Firewall (2026-03-21)

The phone has an actual firewall on its USB service interface.

ISI resource 0x43 (PN_FIREWALL) actively blocks access to all memory and hardware services. Phoenix DLL disassembly reveals what's behind it:

Service Function
PermMemFN Permanent Memory read/write
RegMemFN Hardware register read (PADCONF!)
GenioToolFN GENIO/GPIO pad mux control
DspMemFN DSP memory access
ADCReadFN ADC register reading
FileManagerFN Phone file browser

All require R&D DES Key dongle authentication (FSdongle="1RD").

The firewall responds to probes:

  • msg 0x02: 210200000000 (auth status?)
  • msg 0x04: 230400000000 (config?)
  • msg 0x06: 25060100ffffffffffffffffe06400 (permission mask!)

This is the final boss. Defeat the firewall → read PADCONF.

Attack vectors under investigation:

  1. Extract DK2 DES key from Phoenix DLLs
  2. Replay authentication from USB capture
  3. Analyze firewall permission mask protocol
  4. Nokia Cooker DES key 416ce871c3bd0a28 as candidate

Clone this wiki locally