Doro 7060 / 7050 / 7070

Three different variants: Doro 7060 (DFC-0190) in Europe, 7070 (DFC-0190) in Scandinavia and 7050 (DFC-0180) in the USA. The latter is without the KaiStore. This were one of the most difficult devices to hack. Below is everything we know about this damn device, the worst among all KaiOS phones:

How to jailbreak on Doro-branded KaiOS devices

Step 1: enter in FFBM Mode

FFBM, or "Fast Factory Boot Mode" is the only way to gain unauthorized ADB access on these devices, but without USB debugging or root permissions:

  1. Turn off your Doro and hold Power + Volume Down simultaneously to boot, on the screen The Doro logo appears with the words "Powered by KaiOS" and a small green line with the words "FFBM Mode";

  2. Connect the phone to the PC using an USB cable;

  3. Boot the phone using the ADB command:

adb shell start b2g

how to start the Doro in FFBM

Compared to normal startup, FFBM is much slower. If you unplug the cable, your device will shut down showing the low battery indicator, but nothing is true, don't worry. Everything you can do with a normal adb shell is described in the locked devices page, a category to which the Doro no longer belongs.

Step 2: enable the Developer Menu using the browser

Connect the browser of your phone to https://w2d.bananahackers.net/ to open the Developer Menu from any KaiOS phone, or use https://dorime.surge.sh/ and click on the "DORIME 2" button, this will open the hidden Developer Menu.

Either way, select "Debugger" and enable "ADB and DevTools", a bug icon should appear in the system tray above.

Debug mode will remain until you turn it off from the Developer menu or after a factory reset.

This new method, born on Discord from an idea of ​​Luxferre and Tbrrss, consists of a function that communicates via WebAPI directly with the Settings app locally, and is ideal for temporarily bringing up the Developer menu on any KaiOS phone.

It also works in normal mode, but on Doro-branded devices is totally useless without those permissions only available in FFBM.

Step 3: perform the Jailbreak

To permanently activate the Developer menu, you can use both the classic Jailbreak method with OmniSD (pressing the # key for the "Privileged Factory Reset"), and the new Cache Injection method using Wallace Toolbox (pressing the # key, does not require a factory reset).

Warnings and contraindications

  • The installation of applications through WebIDE is only possible in FFBM mode, while OmniSD and bHacker app install applications normally other apps also in normal mode;

  • It is not possible to use ADB except in FFBM. In normal mode only the "adb devices" command works;

  • It is not possible to use any application to get root, even using OmniBB (busybox is absent on the Doro). The Doro's ADBD binary (in the boot partition) uses permissions that are still too superficial to allow the user to make changes to the system and various customizations.

Other curiosities about the Doro

Boot modes

  • Recovery Mode (Power+Volume Up), secured;

  • EDL (Power+Volume Up & Down combo), no firehoses available;

  • Fastboot (Power+*), not much commands work;

  • FFBM (Power+Volume Down).

Secret codes

  • *#06# - IMEI
  • *#07# - SAR
  • *#2100# - test number for Doro's emergency response service
  • *#*#664#*#* - MMI Test app
  • *#*#258#*#* - firmware build number
  • *#18375# - additional version info
  • *#235543# - LAC and Cell ID
  • *#*#76389273#*#* (*#*#SOFTWARE#*#*) - firmware version
  • *#610000#* - product information app
  • *#13646633# - EngMode app
  • *#787464# - turn STR function on/off
  • *#*#0704#*#* - factory reset (asks for confirmation)
  • *#*#0574#*#* - LogManager app
  • *#73776673# = toggles debug for the "Doro's emergency response service"
  • *#34247678# = toggles diag-mode for USB

Disabled codes

  • *#0606# - MEID
  • *#8378269# (*#TESTBOX#) - should open engmode activity
  • *#*#2637643#*#* - same as TESTBOX
  • *#*#33284#*#* (*#*#DEBUG#*#*) - debug code, it wouldn't work anyway

How to use xpcshell

xpcshell is an XPConnect-enabled JavaScript Shell. It is a console application that lets you run JavaScript code. Unlike the ordinary JS shell (js), xpcshell lets the scripts running in it access XPCOM functionality.

  • Turn on your Doro in FFBM (Power + Volume Down) run the "b2g" process:

adb shell start b2g

  • Once the phone have finished the boot, run the following commands:

adb pull /system/b2g

cd/b2g

adb push libnss3.so run-mozilla.sh xpcshell /data/local/tmp

adb shell

cd /data/local/tmp

chmod 0777 ./libnss3.so ./run-mozilla.sh ./xpcshell

LD_LIBRARY_PATH=/system/b2g ./xpcshell

  • Now you can launch commands in javascript.

Why you shouldn't buy the Doro

The Doro is a device geared for elderly people, yes, to lead them to suicide ahead of time. No KaiOS device has such a different system ROM, heavily customized by the manufacturer, and totally bad:

  • it is not possible to change the arrangement of the icons in the menu;

  • it is not possible to set a ringtone other than the stock ones (all horrible);

  • the applications are grouped into submenus, in order to complicate your life;

  • if you start the music player, you cannot close the flip otherwise the app closes in the background, and you have to reopen it from the Multimedia apps submenu;

  • if you write a message, the notifications cover the text field;

  • the settings menu has 5 different themes, that have in common that they all suck.

In the end, you cannot get root privileges to remedy all this crap (for now), but on the other hand jailbreak has been made possible (September 2020), yes, after two years from the official release on the market (September 2018) of this device that I myself am ashamed to call it such!

Just take a Nokia 2720 Flip, it's a thousand times better!

Customizations: how to make Doro a better KaiOS phone

Given the previous reasons for not buying a Doro 7050/7060/7070, here are a few small steps to make it a better phone.

Requirements (Doro customization Kit)

First of all, restart the phone in FFBM and make sure you have installed OmniSD or Wallace Toolbox to install packages in the format compatible with them, this will allow us to get the Firefox OS Stock Settings app, reported to us by GulTIon. I put this app together with others to install with WebIDE in an archive called "Doro customization Kit.zip" to unzip on your PC:

The apps contained in this archive are:

  1. Settings from Firefox OS (package in OmniSD format);

  2. the Launchers from Nokia 8110 4G and Nokia 2720 Flip (necessary to move applications in the grid view, to add links from the browser and to prevent the closing of applications in use when the flip closes);

  3. another Settings app from the Nokia 8110 4G (needed to set the time and other indicators on the home screen);

  4. three applications from the Nokia 2720 Flip (the File Manager, Music and Gallery);

  5. and for the first time I want to introduce a brand new Luxferre's app that hides (but does not remove) the superfluous icons from the menu, AppBuster. Here is the page of the repository:

Obviously this app is also included in the archive with the other apps to be installed with WebIDE.

Proceedings

  1. Reboot the Doro in FFBM and connect the device to WebIDE;

  2. Install the Launcher of the Nokia 8110 4G / 2720 Flip using WebIDE, it will be hidden but must be there;

  3. Install the Firefox OS Settings app using OmniSD or Wallace Toolbox, then use it to change the Home screen. After selecting the new one, the new Settings app should disappear, but it is simply hidden. In the meantime you will have the Nokia 8110 applications menu, with all the advantages associated with it, but it is not enough integrated with the new phone;

  4. Install the Settings app of the Nokia 8110 4G using OmniSD or Wallace Toolbox, then set the clock on the Home screen;

  5. Optionally you can sideload the apps from Nokia 2720 Flip using WebIDE, if you don't like the stock ones;

  6. Install AppBuster using WebIDE to hide icons you don't want to see in the apps menu (all newly installed apps are listed in chronological order from first to last, after the pre-installed apps, in case you want to distinguish between the three Settings apps, for example) then press # to reboot;

  7. After the reboot (in normal mode), the themes will be integrated with the new interface.

Contraindications and known problems

  • The default language of the Firefox OS Settings app is irremediably in English, so the applications menu with the 8110 Launcher will show all apps in English;

  • By selecting the app options from the Launcher you can't read the option, but you can easily guess. On the contrary, in the quick shortucut's menu there is no selection color, but you can guess from the title what we have selected;

  • Using the Settings app of the Nokia 8110 4G, the entries from the Settings app of the Doro will disappear, but it is possible to reset everything with a restart. I suggesto to hide the first one using AppBuster;

  • The notifications menu cannot be opened with the 8110 Launcher;

  • The 2720 Launcher cannot show all the icons for the stock apps;

  • The list view does not show the selection for both launchers;

  • For both Nokia Launchers the volume keys do not work.

A curiosity about the debugging

After this change, it will be possible to enable / disable debugging using the secret code *#*#33284#*#*, obviously it will still be necessary to reboot into FFBM to use ADB and DevTools.

How to change ringtones and notification tones

Install the FabianOvrWrt's Explorer app from KaiStore, or from the bHacker app if you prefer.