16 Aug 2007

Nokia N75 Firmware


The Nokia N75 is a new-ish Symbian OS phone released through an initially-exclusive deal with AT&T in the States. A flip-phone, which is rather unusual for Nokia, the N75 shares much in common with the N76, which is also a clamshell but a more obvious direct RAZR competitor (if not a RAZR knock-off.)

The N75 has the advantage of being a Quad-Band GSM phone, which means it'll work in all overseas GSM markets, plus having the UMTS 2100 band for North American 3G support. (It lacks some of the competing phones' higher-speed HSPDA support, but for most uses UMTS should be just fine.)

Since I first started using Nokia Symbians, the Finnish company has split their line of smartphones between Enterprise E-Series and Consumer N-Series. The former is where you'll find Blackberry-style form factors, whereas the latter is where you'll find music-focused phones -- as well as high-end gadgets like the N93.

As mentioned, the N75 was initially a Cingular (later AT&T) exclusive. Though Nokia is now selling the North American N75 directly to consumers as an unlocked phone, that option comes with a $400 price tag. A cheaper route is to get the N75 through AT&T, either as a new customer or as an existing subscriber near the end of your contract. This method gives you deals between $179 and completely free, depending on which matrix of rebates and service agreements and middlemen you choose to go through.

There're two downsides to the contract approach, hardware and firmware. The hardware is easiest to see: AT&T's N75s are branded "Cingular" on the outside. Usually some form of either official factory case replacement spare parts are available to fix this, or a knockoff grey-market case appears a few months after the phone becomes popular (these are either reverse-engineered by taking molds of official service parts, or in some cases run on the same factory lines during the night by unscrupulous contractors.)

So much for outward appearances. I haven't actually changed my case yet, but what I have spent some time on is fixing arguably the bigger problem: carrier lock and AT&T-specific firmware. The first of these is a restriction in the phone's firmware that allows only AT&T (and Cingular Orange) SIM cards to function. This restriction is understandable, given the fact that AT&T is 'subsidizing' the price of the phone anywhere from $200-$400 off retail price, in return for grabbing you as a subscriber for one or two years. (Of course, AT&T pays nowhere near full MSRP for the N75, especially since these phones have AT&T-specific firmware, but to the consumer the net effect is a discount off retail price.)

The good news here is twofold: 1) There are several legitimate reasons why you might need to unlock this 'subsidy' restriction, and 2) AT&T is actually pretty responsive about giving you the unlock code, especially for long-time customers (since 2002 in my case.) The main reason people want to unlock the phone is to use local SIM cards, often pre-paid, in countries where they're traveling for long enough periods of time that international roaming becomes cost-prohibitive. So for example if I'm in Helsinki for a week for a conference, I might want to spend $20 on a Finnish SIM card that gives me a phone number in Finland (so Finns can call me without dialing internationally) and great calling rates to Finnish phone numbers. Since phonebooks became richer than SIM cards could handle, most devices store their address books on local memory and so all your contacts are accessible despite the SIM swap. In addition, as people start having more and more agenda and calendar data on their smartphones, keeping all that information around while using a different SIM card is more important than ever.

There are differing reports on how easy it is to get a Subsidy Unlock Code from AT&T, but this may be due to the fact that not very many people travel overseas extensively in proportion to AT&T's large customer base: some Customer Service Representatives may just be unfamiliar with the unlock procedures. I was able to get an unlock code for my N75 very quickly, about 2 days after making the request. Once you type the magic unlock string of digits into the phone, you'll see a message saying the phone is no longer carrier-locked. (At this point, you could technically sell the phone on eBay for slightly less than $400, but I can't really imagine anybody doing this unless you had another phone you wanted to use instead and didn't mind getting locked into a 2-year, $1,500 contract for the sake of a $400 profit.)

This brings us to the second half of the firmware issue, which is replacing the customized "Cingular" software that's installed by default on all AT&T-subsidized N75s. There are a few different schools of thought on what's added by the carrier versus the original phone manufacturer, but the issue basically parallels the issue of "crapware" or "trialware" that tends to load down new PC's purchased from consumer-focused vendors such as HP and Sony. In the case of the N75, AT&T has added a bunch of demo programs that expire after 30 days of use or have similar restrictions. Inexplicably, they've added in a redundant email program, in addition to the excellent IMAP4/POP/APOP client that Nokia ships on Symbian, which comes configured for Hotmail, Yahoo, AOL and Bellsouth. They've also commandeered the "Music" function on the phone, including the three buttons on the front faceplate, to apply only to their Cingular-branded music player and online store. On the plus side, they do ship a nice Symbian-native IM client which works with MSN, AIM and Yahoo. However the phone's "theme", or visual identity, has also been modified to a rather retina-scarring Cingular Orange:


The phone starts up and shuts down with a long, loud trailer movie of "Cingular 3G" signal strength bars flying around like Superman. And finally, the Cingular firmware doesn't support A2DP, the protocol for stereo audio over Bluetooth. This is strange omission for a music-centric phone, but it may just be that this feature made it into a later version of the phone's firmware than Cingular chose to customize.

Luckily, there's a way to get rid of all this Cingular-added stuff and restore the phone back to the way the Finns intended. It does required getting the Subsidy Unlock Code, as I mentioned above -- for some reason this controls some variables which we need to have complete access to. Once you have an unlocked Nokia N75 ready, however, the actual process is not that difficult. First, we're going to need a program called Nemesis Service Suite, which allows you to change some low-level attributes of the phone. In particular, we need to change the Product Code from 0527376 (the subsidized Cingular model) to 0541358 (the Unbranded model.)

To do this, start the software and hit "Scan" if your phone doesn't show up at first. Then press "Read" to get the current values from your phone. Then check the "Enable" box next to "Product Code," which tells the software that it's only that field you want to modify. Type the new code 0541358 into the box, and hit "Write."


Now we have a phone which is electronically indistinguishable from the $400 unlocked model that Nokia will sell you -- and thus we can use all of Nokia's software update tools to bring it up to the most recent firmware version.

Although the phone itself has a Update Firmware Over-the-Air function, this struck me as a potentially bad idea given the 70mb firmware size. Instead, I chose to run Nokia Software Updater, a PC application. (You can choose a similar phone such as the N76 -- all that matters is that you get the program downloaded and installed.) Connect up the Pop-port to USB cable that shipped with the phone:


Sure enough, the program recognized my phone as having firmware 10.1.273 and offered to upgrade it to 10.2.055. The actual download of the 70mb firmware took quite a while (perhaps because the app is set to look for a European server?) but with a full battery charge and a solid data cable connection the result was a clear success:


With the N75 reset to its original identity and functionality, it's all set to accompany me to Uppsala where it will receive a Swedish SIM and thus a local phone number.

ADDENDUM 8/28/2007:

I happened to have two different N75's paired to my MacBook, with different firmware versions (Nokia and AT&T.) Mac OS X 10.4.10 lists the following differences between which Bluetooth profiles are exposed:

10.1.273 (Cingular)10.2.055 (Nokia)
SDP Server SDP Server
AVRCP Target
Hands-Free Audio Gateway Hands-Free Audio Gateway
Headset Audio Gateway Headset Audio Gateway
Audio Source
SyncMLClient SyncMLClient
OBEX File Transfer OBEX File Transfer
Nokia OBEX PC Suite Services Nokia OBEX PC Suite Services
Nokia SyncML Server Nokia SyncML Server
OBEX Object Push OBEX Object Push
Dial-Up Networking Dial-Up Networking
Imaging Imaging

The obvious differences are the AVRCP Target and the mysterious "Audio Source" profile. The former lays the groundwork for home audio integration, as well as possibly allowing sophisticated interaction between a phone and a A2DP headset. As for what the "Audio Source" profile is, I have no idea -- OS X Tiger doesn't really support A2DP, so it's unlikely that Apple is just calling it that by another name. If I still had my Leopard install running I could see what that returned... or, perhaps I'll see what a more sophisticated 3rd-party service sniffer can discover about the N75.

One thing to note -- though I'm not a huge fan of carriers doing their own firmware, neither is it the case the Cingular/AT&T necessarily "crippled" the N75 from having A2DP. (I'm sure AT&T stores would love to sell marked-up A2DP headphones with as many phones as possible.) What's more likely is that A2DP was either not ready or too buggy in the firmware that AT&T began work on, and after it was they had the problem of how communicate to customers about esoteric technical things like firmware flashing. In any case, I see A2DP as a 'no-fault' exclusion from the subsidized N75, which nevertheless justifies flashing the phone to the latest and greatest from Finland.

ADDENDUM 1/19/2008:

Just updated my MacBook to Leopard (10.5), which exposes one additional service: SIM Access. This is mainly used for automobiles with Bluetooth integration, to allow you to access your phonebook from the in-dash radio/entertainment system. I don't know if this feature was in the Cingular firmware, but I don't remember seeing the menu to enable it.

Most of the technical information about debranding this phone was discovered and publicized in this thread at HowardForums.

Previous: | Next: