Hacking the UTStarcom / Audiovox XV6700 / PPC-6700

Author: 6700Phreak  //  Category: Uncategorized

About the Audiovox 6700

The UTStarcom / Audiovox 6700 is probably the toughest and most powerful
implementation of the HTC Wizard platform (CDMA version is called the Apache), a spec used by all the major
carriers who carry similar versions. This particular version, however, is
much more powerful than the K-Jam and other, cheaper versions of the handset
(which are based on the “Magician” platform) as
it comes equipped with a faster processor, more powerful radio, and tougher
casing.


Verizon has made some attempts to tie down the functionality of this phone,
but these changes can be easily un-done. The handset itself is very hackable,
fully-functional (OBEX, OPP, DUN) and even more, there is a simple way to
hard-reset the phone in such a way that Verizon's customizations never even get loaded - which I LOVE.

This page contains a list of the more vital / critical modifications any new
XV6700 user needs to have. There are plenty of other useful pages out there
with customizations for user preference. This page contains the big ones that
are a must-have.

Registry Hacking

Many of the hacks discussed here are registry hacks and require a registry
editor. PHM Registry Editor is a freeware package and is available
here.
A soft reboot will be required after making changes in order for them
to take affect. Just a reminder, do not email me and ask me how to use this.
I will not help you. I don't run a tech support line. I don't care if you
can't figure it out. Go away…

Vital / Critical Hacks

Multi-NAI / Tethering Detection
The NAI (Network Access Identifier) is used by many cellular carriers to
identify whether the handset is accessing data on its own, or is tethered to
another device such as a laptop. This option is enabled by default, which
tells the handset to use a different NAI when tethering. For those of you who
purchased an unlimited data plan, and feel that your carrier is a selfish,
hypocritical and greedy organization that should be dismantled by the FCC and
sold off in a million pieces, you can turn this feature off:

[HKEY_LOCAL_MACHINE\SOFTWARE\OEM\WModem]
"Multi-NAI"=dword:00000000

Enable Bluetooth DUN (Dialup Networking)
NOTE: This is common knowledge, not an original hack by any means

Once Multi-NAI has been disabled, enabling dialup networking is relatively
simple, and will allow you to connect your laptop to your carrier's data
network. If your DUN has been crippled, chances are you're using Verizon.

1. Dial ##3328873 (##FEATURE) and press Talk

2. Enter the unlock code (000000 for Verizon)

3. For each of the two features (”Enable Wmodem” and “Enable BT DUN”):

  • Hilight the feature
  • Click the 'Edit' option
  • Change the value to 'Enabled'

4. Click the OK option, and you will be prompted to soft-reset

Now, whenever you would like to use Dialup Networking (or when pairing your
device), run the “Wireless Modem” application from the Programs menu. If this
does not appear, use File Explorer to navigate to your Windows directory,
then click the WMODEM application (Hint: You'll need to “Show All Files” to
see it). Then:

  • Choose 'Bluetooth' from the dropdown menu
  • Click 'Start'

You will need to turn off any data connection before using WModem

Bluetooth and SDCard Suspend Fix
Both Bluetooth and the SD Card are turned off when the unit suspends. This
can cause a loss of Bluetooth connectivity if using a BT headset, or crash
the system entirely if running an application from the SD card. To correct this,
the following registry modifications tell the OS to put these devices on
active low-power standby, allowing them to be used when needed:

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\State\Suspend]
"btl1:"=dword:00000002
"dsk1:"=dword:00000002

btl1 is the device name for the Bluetooth radio, and dsk1 is the device name
for the SD memory card. For more device information, see HKLM\Devices\Active.

Alternatively, power management for Bluetooth can be disabled completely using
the following registry mod (NOTE: this may adversely affect your battery life):

[HKEY_LOCAL_MACHINE\Comm\Bluetooth device\Parms]
"DisablePowerManagement"=dword:00000001

NOTE: The above hacks have been proven to work, but won't keep the buggy
Bluetooth stack from occasionalloy crashing, which is a whole different issue.
I only experience that once every other day or so, however. If you can't
figure this out, just a reminder - do not email me.
I really could care less about your inability to show off to your nerd
girlfriend by hacking her phone, and if you fall flat miserably on your face,
don't come crying to me about it.

Sound with Power Off

It's pretty important to get event reminders when your PDA is turned off.
Unfortunately the 'Unattended' mode has the sound (wav1) turned completely off
when unattended. You can change this value to '2' to leave the sound on
stand-by. Just as you edited the 'Suspend' power profile above, you can
change this in 'Unattended' in the same place.

Concurrent WiFi and Phone Radio use

Although this feature is enabled in the default firmware, some providers
(such as Verizon) have disabled the ability to use both the WiFi and the
phone at the same time. This registry modification restores this feature:

[HKEY_LOCAL_MACHINE\Services\WirelessMgr]
"MutexFlag"=dword:00000000

NOTE: Booting without the Verizon customizations appears to leave this key
nonexistant, which enabled simultaneous use.
Just to be sure, try turning on WiFi in your ConnManager application, and if
it doesn't turn off the
phone, then you're good to go.

Improving Tower Polling / Ring Response Times
NOTE: This is not an original hack. I found this in a forum.


The ring response time of the 6700 is fairly poor due mostly to the tower
polling time. Fortunately, the handset includes a custom PST (remember
Moto PST?). To improve the tower polling, do the following:

  • Dial ##778 (PST) on your handset and press Talk
  • Enter the security code (000000 on Verizon)
  • Choose “Modem Settings” off of the PST menu
  • Change “Slot Cycle Index” to 0, or 1. This value is 1.28
    seconds * 2^N, where N is the index. A value of 0 will give you the
    fastest tower polling, but
    most people stick with 1 to avoid excessive battery usage and flooding
    the
    network.
  • Click OK and you will be prompted to soft-reset your handset.

Increase Earpiece Volume / Better Call Quality
NOTE: This too is a hack I found in a forum.


Enhanced Variable-Rate Codec (EVRC) is the default audio codec for this
and most other phones. Unfortunately, call quality suffers to benefit the
amount of bandwidth available on the tower. To improve call quality (which
seems to have the side-effect of also increasing earpiece volume), follow the
same steps as above to enter the PST, but go to the “CDMA Settings” menu.
Change “EVRC Enabled” to “Disable” and change the three values underneath it
(”Home Page”, “Home Orig”, “Roam Orig”) to “Voice 13K”.

Verizon Extended ROM Files

The following files are the custom cabs which get installed upon a hard-reset
of Verizon's XV6700. None of these are vital to the operation of the unit, and
it actually runs much smoother, and with more free memory, without them. To
bypass the installation of these customizations, hard-reset the device and then
press the soft-reset button after initial bootup, just as the window pops up
informing you that they are going to be installed.

If you would like to pick-and-choose which ones to install yourself, you can
simply unlock the extended ROM to access these files. Instructions on doing
this can be found here.

NOTE: If you would like help doing this, DO NOT email me. I don't care if
you think Verizon sucks, and this page is cool. I don't care if you just got this
new phone for Christmas. Go ask someone in a forum somewhere.

It's not necessary to make the ROM writable, and in fact I would recommend
against it. Simply skip the installation of these and then manually install
the ones you want. Personally, my phone is doing just fine with only the
custom ring tones and MMS application installed. Based on an examination of
the files, I believe they serve the following purposes:

Apache_VZW_MMX3.0.6_24.20060124.CAB
Installs ArcMMS and configures for Verizon
(Adds MMS Functionality)
Customize_105201.sa.CAB
Customizes various settings:
Sets Verizon Logo
Adds various help files
Sets up IE Default homepage
Sets Number for Voicemail
[HKEY_CURRENT_USER\Software\Microsoft\Vmail]
"UserProvidedNumber1"="*86"
Sets Multi-NAI (Detection of Tethering, by using a different NAI)
[HKEY_LOCAL_MACHINE\SOFTWARE\OEM\WModem]
"Multi-NAI"=dword:00000001
Sets SMS Priorities
[HKEY_LOCAL_MACHINE\Software\OEM\SMS]
"EnablePriorityHighLevel"=dword:00000001
"PriorityHighLevel"=dword:00000001
Enable_RingTone.sa.CAB
Sets up MIDI Ring tones
Link.sa.CAB
Sets up various application links in the Programs directory
PP_AddRingTone_Apache_205200.sa.CAB
Adds custom ringtones (Ring1, Ring2, Ring3, etc).
PP_AreaCode_Apache_203700.sa.CAB
Adds default "Area Code" option to address book for reasons unknown
PP_DataRetry_Apache_205200.sa.CAB
Sets up connection manager retry settings
PP_Download_Apache_203200.sa.CAB
Sets up "Download" link (useless subsidy marketing crap)
PP_MSFP_Apache_205200.sa.CAB
Sets up Sync Heartbeats (?)
PP_NoLog_Apache_203200.sa.CAB
Sets NoLog option in HTLM\Software\Apps\CabName (?)
PP_SMSACK_Apache_203200.sa.CAB
Sets Delivery Ack on SMS Messages
PP_Version_Apache_207200.sa.CAB
Sets Version in HTLM\Software\OEM\3rdversion MSYSTEM 2.07.200 WWE
PT_BT_Apache_205200.sa.CAB
Appears to set BT Modem strings
Does not appear to be necessary for data operation
PT_HideModeOfOperation_Apache_203200.sa.CAB
Hides the "Mode of Operation" page in Phone settings / options screen
PT_PhoneSettingHelpFile_Apache_205200.sa.CAB
Adds help files
PT_WifiAndRadio_Apache_203200.sa.CAB
Sets MutexFlag to 0, allowing for Phone and Wifi to be used simultaneously
NOTE: Older versions of the Verizon customizations _disable_ this feature.
The default in the latest ROM appears to be enabled for use.
Region.sa.CAB
Sets up Time/Date region in clock
Remove.sa.CAB
Deletes the Add/Remove options for Verizon Customizations
VZWProvision_Signed.sa
Installs Verizon-Signed Certificates, presumably for application installs
VZWProvision.PPC400_2577MTM.CAB
Appears to install custom version of Wireless Sync.
The more generic cab can be installed at http://ota.wsync.com/
NOTE: Wireless Sync is Verizon's sync service, NOT ActiveSync.
You don't need this to run ActiveSync over Bluetooth or WiFi.
SocialTwist Tell-a-Friend

Share/Save/Bookmark