Downgrade Nokia 5800 XpressMusic V50

How I downgraded my Nokia XpressMusic 5800 to firmware 40.0.05 from firmware 50.0.05




What

Im making this post to show you that downgrading firmware of a 5800 XpressMusic is a possibility, although please keep in mind that this requires special hardware and a somewhat expert knowledge in flashing and troubleshooting bricked phone issues. Incorrect procedure and mistakes made during the process will end up transforming your 5800 to a $380 paper weight.  Even though I write this guide as 15 minute operation, it took me more than 5 hours to figure this out properly.







Why

I was running on firmware 40.0.05 and after the recent 50.0.05 update was released, I rushed in and installed it as most forums reported it as a whole new firmware with loads of new features. Yeah, in fact it was a good firmware, with a new music player, a new browser interface and Kinetic Scrolling in the menu.

Although the firmware was packed with new features, it was a complete failure to me. There were several bugs, and some of them were too hard to ignore. A list of bugs can be found over at the Nokia support forum discussions.  The phone’s interface was quite slow and it was so noticeable as the previous one was fast and split-second responsive. Above everything, the most annoying part was with GPS and the Music Player, which are two most crucial features I need in my 5800.

With

To do this you need the following
1. JAF Flasher Unit (Box)
2. MX Key Dongle
3. Nokia 5800 FBUS Cable
4. Internet
5. MX Key Software (MobileEx Professional)


How

Install MX key software, update it if necessary. Open it and connect using Potato Flasher interface. The whole process will be done by communicating with the phone using a FBUS cable and JAF / MX key hardware with the MX software interface.

Before trying out anything, the so called issue with downgrading firmware is that the 308 and 120 Fields of the PM is read only. Therefore downgrading a phone results in a bricked or a Watch dog timer activated phone. To avoid this mess you need to SX4 authorization to update these fields. That is why you need the MX key.

First make a backup of your phone in following order using MX key software interface and FBUS.
Full RPL backup
Full PM backup
SIMLOCK Backup (Just to be on the safe side)
BB5 Ask files (Again, just a precaution)

Once the backups are made, place the files in a secure place. If you lose em, you kiss your phone goodbye.  I already did once when MX key was not so popular, and I was unaware of such downgrade bricking issues.

Connect the Phone in FBUS mode and Full erase the phone using a BB5 ERASE file or MX software’s erase option. I used the software’s native erase option as it reads the memory addresses manually and does a pretty good job wiping it off.  Once it is done and confirmed, pace the V40 firmware files in a folder and open it in the flasher interface.

Since it’s a manual flasher interface, you need to provide the files in the following order. Double click each item to open and add the firmware file.

MCU – Core File (Usually around 100+ MB)
PPM – ROFS2.V01 file (Usually around 24MB – 30MB)
CNT – ROFS3 file (usually around 1MB – 10MB)

If the APE variant is required, open UDA.fpsx file in APE v Option.


Flash the firmware and let the phone reboot.

The phone might power up , or it might just go into local mode automatically. Once it connects, do a BUS check or SCAN and go to the advanced options. Select Restore SD and the MX key will write the RPL file which contains your SIMLOCK and IMEI data. Once it is done the phone will reboot and during the bus check it will say security test failed. Now go to the PM function and write the PM file (all fields). During the operation, the software will prompt you to skip 1field and 320 field of the phone, and SKIP them without selecting overwrite. The phone will reboot once again and it will show as all security tests are passed. Remove FBUS and reboot. You’re back on V40.

NO it didn’t !

Make sure you erased the existing memory area before flashing the older firmware.



If the simlock data is corrupt, or the phone restarts in 3 minutes (Watch Dog timer) write the RPL back using Restore SD option.



If the security test keeps failing. Write the PM fields using super dongle auth. If it still doesn’t work, google for RM-356 PM files.



If the HWC test check keeps failing write an RPL that is made from a RM-356 without IMEI data. Google will find you a one from a popular forum.  



Make sure you obtained firmware from a reliable source such as Navifirm.