Docomo Phones by NEC

Check the dumping hardware overview for a list of known preservation hardware.

If you need help, please come chat with us on the Keitai World (previously Keitai Wiki) discord server.

NEC Docomo phones generally run on a customized form of Linux. They use a bootloader related to the one used in Panasonic and Casio Docomo phones. When an NEC phone is properly connected to a debug cable, an LED somewhere on the phone will light up for approximately one second, and then turn off.

The N902i series of phones (N902i, N902iS, N902iL, N902iX) have difficulty connecting to PC. If the phone does not connect properly, there are a few techniques you can try. The results are generally random as to whether these work, and you may need to try the same method multiple times before the phone will connect.

• Use a Linux computer instead of WSL (this is a MUST)
• Boot up the phone once, shut down the phone, then quickly remove the battery and plug it into the PC
• Plug the phone into the PC with the battery inside, then remove the battery
• Follow the steps above, but right after the phone light flashes once, reinsert the battery
• Use the battery in a different phone, boot up that phone, then remove the battery and use it with the phone you are trying to dump
• Cover the ground contact for the phone battery, reinsert the battery, and plug into PC
• If you don't have a battery, boot the phone with an external power supply, remove the power, and quickly plug it into the PC

If you are still having trouble after attempting these steps multiple times, you can reach out in the Keitai World discord channel for help.

Extracting Data

1. ktdumper

Reading File Systems

1. efs2dumper
2. fs-tools (SSR200)
3. Jefferson
4. rfs_dumper.exe
5. yaffs-tools

Ktdumper is a tool for extracting data from feature phones that are compatible with the Foma debug adapter, which includes all Docomo phones and select SoftBank phones. Please note that ktdumper will not work unless you have the Foma debug adapter.

Ktdumper is compatible with Linux and WSL (Windows System on Linux). It can be used as a command line tool or as a live Linux iso with a GUI.

Ktdumper Command Line

sudo ./ktdumper.sh d904i dump_nand

Prerequisites

• Python
• crcmod

  pip install crcmod

• reedsolo

  pip install reedsolo

1. Download dumpefs2
2. Place file dump in main folder and use the following command

   dumpefs.py IN_FILE OUT_FILE.zip

Example

python .\dumpefs.py .\N600i_SKS01880_JTAG.bin output.zip

UPDATED

1. Downlod the ssr200 tools from fs-tools
2. Download assemble_ssr200.py from various-keitai-assemble
3. Place assemble_ssr200.py in the same folder as nand.bin and nand.oob
4. Use the following commands:

   python3 assemble_ssr200.py nand.bin nand_remapped.bin
   python3 carve_nec_fat.py nand_remapped.bin fat_dir
   python3 convert_fat.py fat_dir converted_fat_dir

Note: If you are extracting data from a P2102V, add the “–disable-normalize” option to the 3rd command

python3 assemble_ssr200.py nand.bin nand_remapped.bin
python3 carve_nec_fat.py nand_remapped.bin fat_dir
python3 convert_fat.py --disable-normalize fat_dir converted_fat_dir

The partitions can now be extracted with TestDisk. Generally, games will be located in Partition 3.

The JFFS2 file system can be extracted with Jefferson, which runs on Python. You can install Jefferson in a pre-existing Python using pip:

sudo apt-get install python3-pip
sudo pip3 install jefferson

The following command creates a folder called “jffs2_extracted” to contain the data extracted from nand.bin.

sudo jefferson -d jffs2_extracted nand.bin

If your phone uses onenand, use the following command instead:

sudo jefferson -d jffs2_extracted onenand.bin

Note: You may see the error

data_crc does not match!

The dump may still be working. Let it continue until the process is complete before trying other steps.

Helpful Extra Step: Remove root ownership of the files so they can be moved elsewhere

sudo chown -R <your_username>:<your_username> jffs2_extracted

Troubleshooting

If the jffs2_extracted folder contains no data, the offset will need to be removed from the .bin file.

You can determine the offset two ways:

• Using binwalk, look for the address where the JFFS2 file system begins.

binwalk nand.bin

• Using a hex editor such as HxD, look for the following four bytes:

85 20 19 E0

Or

85 19 02 E0

Delete all data before those four bytes and try again to extract with Jefferson.

Note: It is not possible to undelete files from a JFFS2 file system.

Our extraction method for the M4 file structure is currently incomplete, but our tools are sufficient for extracting apps. You will need scripts from Keitai Scripts on GitHub.

Step 1: assemble_m4.py

The assemble_m4.py will divide the regions of the nor dump

python assemble_m4.py <file name>.bin

Example

python assemble_m4.py N506i-2_PF38F4462LLYDB0-f1.bin

Step 2: convertForEmulator_m4.py

The convertForEmulator_m4.py script will extract the DoJa files from the regions inside the firmware dump.

python convertForEmulator_m4.py m4_out_dir model_name

Example

python convertForEmulator_m4.py N506i-2_PF38F4462LLYDB0-f1.bin_output N506i

Current tools for extracting XSR1 require Windows.

1. Download rfs_dumper_xsr1app.exe from here.
2. The input file should be stripped of everything before the first 91 5A 49 2C header. In HxD, you can do this by going to the menu and selecting Search>Find, then selecting the Hex-values tab and pasting in 91 5A 49 2C. Once you find this location, delete everything before it. Save this new file as input.bin.
3. Place onenand.bin, onenand.oob, and rfs_dumper.exe in one folder. Open a terminal in the folder with the dump (onenand + oob) and rfs_dumper.exe. Use the following command:

   .\rfs_dumper_xsr1app.exe onenand.bin output.bin

The file system can now be read and extracted with TestDisk.

1. Download the yaffs-tools repository from Github
2. Look in the /config folder for the config file that matches your data based on phone model and memory type (MLC or SLC)
3. Fill in the following command based on the file you are trying to extract

   python extract.py <bin file> <output folder> <config>

4. If the data you expect does not appear in the output folder, you can introduce the following arguments:

     -d, --show-deleted, --no-show-deleted
                           Show deleted files in DELETED subfolder.
     -m, --show-missing, --no-show-missing
                           Show entries with missing parents in MISSING subfolder.
     -u, --try-undelete, --no-try-undelete
                           Try to restore latest version of a file marked as deleted.
     -s, --mix-spare, --no-mix-spare
                           Mix spare using filepath '[input (without extension)].oob'.

Example: N-04B MLC

python extract.py -m -u -s onenand_mlc.bin output_dir config/config_n04b_mlc.json

TestDisk can be used on either Windows or Linux. It is available for download here. Once you have downloaded TestDisk, use the program to open your current .bin file.

1. When you open a .bin file with TestDisk, you will have the option to select a media. There should only be

   >Disk <your file>

   Press enter to proceed.

2. When asked to select a partition table type, select None

   [None ] Non partitioned media

3. On the following page, press q to quit or select

   [ quit ]

4. In the new menu, move up the menu and select

   [ Analyse ]

5. Press enter to continue with

   [Quick Search]

6. You should now see a partition labeled with a file system like FAT16 or FAT32. Don’t press ENTER. Instead, press p to list files.
7. Press a to select all files.
8. Press C (note the capitalization and hold the shift button!) to copy the selected files.
9. Choose the output folder. Press C when the folder is correct.

You should now have all the extracted files.

Note: For select devices (such as F905i and D905i), you need to select None → Undelete rather than the usual TestDisk procedure.