Qualcomm-based KaiOS devices should all work with a single code, *#*#33284#*#*, but really only for Nokia 8110 4G, Nokia 2720 Flip and Nokia 800 Tough (all sold all over the world except in North America) and on a couple of very early Alcatel OT-4044x models with KaiOS 1.0 (exactly 4044O and 4044T) this rule can be applied.
The two Alcatel just mentioned were just the first US prototypes put on the market prematurely, that is, before all the US manufacturers of Alcatel devices with KaiOS began to disable the debug mode on them.
All Qualcomm-based devices sold exclusively in the US (Alcatel OT-4044x, Alcatel A405DL, the new Alcatel 4052x and Doro 7050) or Europe (CAT B35, Doro 7060, Maxcom MK241) by default do not have debug mode. Some only have ADB acces, but useless without debugging.
All devices with Qualcomm chipsets that can sideload apps using the "manual jailbreak" or the "cache injection" method will be added on this page.
¶ Qualcomm-based KaiOS Phones
Technically the devices listed here are not the most suitable among KaiOS phones to develop applications, but surely it can be fun to experiment with flashing partitions. Of course, a full backup of the device is always recommended before starting extreme experiments.
It was the first device to include the KaiStore, and for a long time it was a locked device, until we found a solution:
-
Download the firehose for CAT B35: Download
-
Use the EDL.PY tool by Bkerler (GitHub): Qualcomm Sahara / Firehose Attack Client / Diag Tools
Thanks to LiKiWii U (on Discord) for this idea, and Yossi Yehezkel on Google Groups for its experiments. United States now has a newer firmware version on which they can develop applications for KaiOS!
Released in September 2018, CAT B35 is an almost impenetrable device. There are no secret codes useful for debugging, but given the successful experiments and tests carried out by our users, it was possible to start studying and discovering the EDL mode, accessible by holding down the two " * " and " Power " buttons and for this phone we have a firehose loader, which will allow us to "normalize" it. You can download it from here:
- Download the firehose for CAT B35: Download Firehose 0x000940e100000000
Here are listed the nine Qualcomm-based variations of Jio Phone (2017), connected to the best references of the DuckDuckGo search engine, trying to find the more recent firehose available:
F30C - F90M - F120B - F50Y - F250Y - F220B - F10Q - LF2403 - LF2403N
Find out more about JioPhone on the dedicated page: Jio Phone
Other debug-enabled qualcomm phones Debug-Enabled
¶ Jailbreak and root on debug-locked phones
-
Learn more about the EDL tool and commands to the dump of the userdata partition, the following guide has been written taking CAT B35 as an example: EDL tool
-
ADB and Dev Tools using this guide: Enable ADB & DevTools
Also the cache injection method works for them: Cache Injection. This should be enough to get ADB and WebIDE working as them should, so you will be able to perform the sideload and the jailbreak normally, like every other Debug-enabled device!
- If the above procedure is not enough because "permissions are denied" on ADB, you can choose to flash the boot partition (UNSAFE) by enabling ADB support using this guide: Custom Firmware
Remember to keep a clean copy of the /boot partition, in case of notification of the availability of new updates you will have to replace the partition again, but usually points 1 and 2 are sufficient to obtain the privileged mode always, also after the update, without any problem!