nokia-leo

View device specification table
Nokia 6300 4G (nokia-leo)
Released13 November 2020
ModelTA-1286, TA-1287, TA-1291, TA-1294, TA-1307, TA-1324
Specifications
SoCQualcomm MSM8909 Snapdragon 210
(4 x 1.1GHz Cortex-A7)
RAM512MB LPDDR2/3
GPUAdreno 304
Storage4GB eMMC 4.5 (+ up to 32GB microSDHC card)
Network2G GSM, 3G UMTS, 4G LTE Cat4 150/50Mbps
+ EU (except East Ukraine, Azerbaijan, Georgia), APAC: band 1, 3, 5, 7, 8, 20
+ MENA, CN, Nigeria, Tanzania: band 1, 3, 5, 7, 8, 20, 28, 38, 39, 40, 41
+ US: band 2, 4, 5, 12, 17, 66, 71
+ LATAM: band 2, 3, 4, 5, 7, 28
+ ROW: band 1, 3, 5, 7, 8, 20, 38, 40
VoLTE & VoWiFi support
Single or Dual SIM (Nano-SIM, dual-standby)
Screen320 x 240 @ 167 PPI
2.4 inches QVGA TFT LCD, 16M colors
Bluetooth4.0, A2DP, LE
Wi-Fi802.11b/g/n, 2.4GHz, Hotspot
PeripheralsGPS & GLONASS
CamerasRear: VGA, LED flash
Dimensions
(HWD)		131.4 * 53 * 13.7 (mm)
5.17 * 2.09 * 0.54 (in)
Weight107.4 g (3.70 oz)
Ports- microUSB charging & USB 2.0 data transferring port
- 3.5mm headphone jack
BatteryRemovable Li-Ion 1500mAh (BL-4XL), 5W wired charging
(up to 25 days of 4G standby advertised)
KaiOS info
VersionKaiOS 2.5.4
WA VoIPSupported
Build no.10.00.17.01, 12.00.17.01, 20.00.17.01, 30.00.17.01

Table of Contents

Don’t buy a counterfeit

A lot of fake KaiOS phones, like the Nokia 8110 4G, 2720 Flip and 6300 4G are sold at many tech shops and online platforms for amazingly cheap prices; these are not the real ones, and if you were to buy them you wouldn’t be able to get a refund.

Some signs that can indicate a fake KaiOS phone are:

Remember, only buy from trusted, reputable sources, even if they charge more. That extra bit of price usually guarantees that you’re getting a real device.

Differences between US and international variants

“Buying Western-customized products will always give you the best quality possible” is unwise when it comes to consumer electronics, including mobile phones, and the 6300 4G is no exception. When buying the TA-1324 variant of this phone, you should expect:

Don’t buy the US variant of 6300 4G unless you know what you’re doing. Seek the availability of the phone in the closest place or nearby countries to where you are.

Tips and tricks

Known issues

KaiOS-specific

WhatsApp-specific

Secret codes

Tip: You can save these codes as contacts for quick dialing later. When the phone suggests a saved code, you’ll have to press Call to activate the code’s function.

Codes that don’t work

Most of these codes requires userdebug or eng versions to work.

Special boot modes

What the heck is EDL mode?

Qualcomm Emergency Download mode, commonly known as EDL mode, is a special engineering interface implemented on devices with Qualcomm chipsets. It lets you do special operations on the phone that only the device manufacturer can do, such as unlocking the bootloader, read and write firmwares on the phone’s filesystem or recover from being a dead paperweight. Unlike bootloader or Fastboot mode, system files needed by the EDL mode resides on a separate ‘primary bootloader’ that aren’t affected by software modifications.

Aleph Security has a deep-dive blog post into exploiting the nature of EDL mode on Qualcomm-chipset devices that you can read here.

Booting into this mode, the phone’s screen will briefly show the ‘enabled by KaiOS’ logo, then turn almost black as if it’s off, but in fact it’s still listening to commands over Qualcomm’s proprietary protocol called Sahara (or Firehose on newer devices). With a suitable digitally-signed programmer in MBN/ELF file format and some instruction-bundled tools, the most popular one being QFIL (Qualcomm Flash Image Loader), one can send commands from a computer to the phone over USB.

You can also force reboot the phone by holding the top Power button and the # key at any time.

EDL programmer for the international version of this phone (not TA-1324) can be found on BananaHackers’ EDL archive site with hardware ID 0x009600e100420029 (a copy is available here). The US version of this phone has been signed with a different PK_HASH and needs a different firehose loader which we currently don’t have in archive.

UART debugging testpoint

As discovered by atipls on Discord, on the mainboard of the 6300 4G, there are 3 UART testing points: RX, TX and GND just above the SIM2 slot. Shorting TX and GND takes you to Fastboot and Linux terminal interface.

Mainboard of a TA-1307 Nokia 6300 4G, with the red arrow pointing to three gold contacts in the middle of the board, those being the UART testpoints in the order of RX, TX and ground

Sideloading and debugging third-party applications

BananaHackers’ definitions put this phone and most other KaiOS 2.5.4 devices in the first category, which means that you can install and debug apps from outside sources, but with a few caveats: apps with ‘forbidden’ permissions, such as embed-apps, embed-widgets and engmode-extension cannot be sideloaded, and you cannot debug apps that came with the device using WebIDE’s Developer Tools (you can, however, see the system’s global warnings and errors with adb logcat).

For detailed instructions, see Sideloading and debugging/WebIDE.

Do note that OmniSD, one of the methods used for on-device sideloading, and many Gerda-related apps requires the navigator.mozApps.mgmt.import API that has been removed from KaiOS 2.5.2.2, and therefore no longer work on this phone. However, the Privileged factory reset feature that could be used on KaiOS 2.5.2 and older can now be activated after permanent rooting to gain privileged userspace session (see Next steps).

To remove unwanted apps from the phone, you can use this fork of Luxferre’s AppBuster which lets you disable any apps you don’t need and enable them again if you want.

ROOT: Boot partition modifying (non-US only)

On KaiOS 2.5.4 devices, such as the 6300 4G and 8000 4G, ADB and WebIDE can be used to install most third-party apps. However, apps with special ‘forbidden’ permissions are not allowed, including most BananaHackers apps with engmode-extension like Wallace Toolbox, which can be used to gain exclusive access of the phone. You also cannot make changes to the system. On the 2720 Flip and 800 Tough with KaiOS 2.5.2.2, with HMD/Nokia Mobile changing their release branches from dev-keys to release-keys, the situation is even worse as you cannot sideload at all.

This is because in order for WhatsApp’s VoIP feature to work on these KaiOS versions, a security module called SELinux is now set to be Enforced which checks and reverts system modifications on boot. To get total read-write access to the devices, you’ll now have to permanently root them by setting SELinux to Permissive mode.

The guide below is based on the main guide from BananaHackers website, but has been rewritten to make it easier to follow. The process will take somewhat considerable 30 minutes to an hour, so do this when you have enough time.

[!IMPORTANT] DISCLAIMER: This process will void your phone’s warranty, disable its ability to receive WhatsApp calls and over-the-air updates, but you can undo this if you save a copy of the original boot partition. However, you might also brick your phone if you make a mistake in the process, so proceed at your own risk and with caution! I won’t be responsible for any damages done to your phone by following these.

Remember, you don’t have to root your phone to do things that usually need root access e.g. you can use this fork of Luxferre’s AppBuster to disable apps from the launcher instead of deleting them with Wallace Toolbox. You can also install CrossTweak, a Wallace Toolbox alternative also made by Luxferre that does not need engmode-extension and therefore can be easily installed on KaiOS 2.5.4 devices.

What we’ll need

andybalholm’s EDL cannot be used on 8000 4G and 6300 4G due to some structural changes within the GPT partition table, which will result in an error AttributeError: 'gpt' object has no attribute 'partentries'. Did you mean: 'num_part_entries'?. Do note that the command structures used between bkerler’s and andybalholm’s are different, which we’ll mention below.

We’ll be using open-sourced Python scripts from GitHub for the sake of cross-platform usage (and my obsession of open-source tools), instead of QFIL which is proprietary and only supports Windows.

@cyan-2048 confirmed to me that Zadig 2.5 bundled within the EDL package doesn’t work, so DO NOT USE that. I’ve also specifically chosen version 2.7 as it works best throughout my testing, and the latest 2.8 version of Zadig tool also has troubles detecting the phone’s EDL driver.

If you’re on Linux, Python and ADB can be quickly set up by installing with your built-in package manager. We won’t be covering this here, as each Linux distro has its own way of installing from package manager.

For the sake of simplicity, the guide assumes you’ve moved the Gerda Recovery image and the MBN loader file into the root of EDL tools folder, which you should do for convenience. If you’d like to have those in other folders, change the directory path accordingly.

Part 1: Set up environment for EDL tools

This portion of the guide was taken from Development/EDL tools on BananaHackers Wiki so that you don’t have to switch tabs. Kudos to Cyan for the guides!

Linux

  1. Install Python from your operating system’s package manager e.g. 
    sudo apt-get install python pip3
  2. Then, open Terminal and type this to install the dependencies for EDL tools: 
    sudo -H pip3 install pyusb pyserial capstone keystone-engine docopt
  3. Switch your phone to EDL mode and connect it to your computer.
    • From the turned on state, turn on debugging mode on your phone by dialing *#*#33284#*#*, connect it to your computer and type adb reboot edl in a command-line window.
    • From the turned off state, hold down * and # at the same time while inserting the USB cable to the phone.

In both cases, the phone’s screen should blink with a ‘enabled by KaiOS’ logo then become blank. This is normal behaviour letting you know you’re in EDL mode and you can proceed.

Additionally, if you have issue with device access:

macOS

  1. Follow the instructions to install Homebrew on its homepage. Basically just open Terminal and copy the long streak of code shown on the page, and type your password when prompted.

  2. While you’re in Terminal, type this into the command-line: 
    brew install python android-platform-tools libusb && pip3 install pyusb pyserial capstone keystone-engine docopt
  3. Switch your phone to EDL mode and connect it to your computer.
    • From the turned on state, turn on debugging mode on your phone by dialing *#*#33284#*#*, connect it to your computer and type adb reboot edl in a command-line window.
    • From the turned off state, hold down * and # at the same time while inserting the USB cable to the phone.

In both cases, the phone’s screen should blink with a ‘enabled by KaiOS’ logo then become blank. This is normal behaviour letting you know you’re in EDL mode and you can proceed.

Windows

  1. Head over to Python’s official download page for Windows and download the correct installer for your architecture, or download the latest version of Python from Microsoft Store. If you’re downloading from Microsoft Store, skip to step 4.

  2. Proceed with installing Python as usual. If you choose to customize your installation, include pip. Don’t forget to tick the box next to “Add Python to PATH” to add Python as a global environment variable, otherwise you’ll have a hard time using Python to run scripts later on.

Screenshot of an installation window for Python 3.9 showing two options, 'Install Now' and 'Customize installation', with the checkbox for 'Add Python 3.9 to PATH' being selected

  1. On Windows 10/11, typing python or python3 within Command Prompt/Windows Terminal will run the Microsoft Store version of Python. To override this default into running the locally installed version, head over to Settings, Apps, Apps & features, App execution aliases and toggle off both App Installer (python.exe) and App Installer (python3.exe).

Screenshot of the Apps & features page in Windows 10's Settings app, of which the App execution aliases link is located under the Apps & features section Screenshot of the App execution alias page, where the toggles for App Installer (python.exe) and App Installer (python3.exe) are both turned off. Description says Apps can declare a name used to run the app from a command prompt. If multiple apps use the same name, choose which one to use

  1. Open Command Prompt/Windows Terminal with administrator privileges and run this command to install the required dependencies for EDL: 
    pip3 install pyusb pyserial capstone keystone-engine docopt

Screenshot of a console window showing the successful process of collecting and downloading dependencies after typing the above command

  1. Extract the previously downloaded EDL package, open Drivers, Windows and run Qualcomm_Diag_QD_Loader_2016_driver.exe with administrator rights. Proceed with installation and leave everything as default, restart the computer if it prompts you to do so.

Screenshot of an installation window for Qualcomm's diagnostic driver, in which two radio buttons are shown labelled 'WWAN-DHCP is not used to get IPAddress' and 'ETHERNET-DHCP is used to get IPAddress' respectively. The first button is selected.

  1. Switch your phone to EDL mode and connect it to your computer.
    • From the turned on state, turn on debugging mode on your phone by dialing *#*#33284#*#*, connect it to your computer and type adb reboot edl in a command-line window.
    • From the turned off state, hold down * and # at the same time while inserting the USB cable to the phone.

In both cases, the phone’s screen should blink with a ‘enabled by KaiOS’ logo then become blank. This is normal behaviour letting you know you’re in EDL mode and you can proceed.

  1. To configure the previously installed driver, download and open Zadig 2.7 (do NOT use the one included in the EDL package). Tick Options, List All Devices and select QHSUSB__BULK (your device in EDL mode) in the main dropdown menu. In the target driver box—to which the green arrow is pointing—click the up/down arrows until you see libusb-win32 and then click Replace Driver.

Screenshot of Zadig program with the Option dropdown menu shown, in which the List All Devices option is highlighted and selected Screenshot of Zadig's main interface with the front dropdown list shown listing all devices connected to computer, in which the option for QHSUSB_BULK is highlighted Screenshot of Zadig's main interface with the second label box on the Drivers line, which the green arrow points to, showing 'libusb-win32 (v1.2.6.0)'. Two smaller up/down arrows are shown to the right of that box.

If driver configuration takes too much time and Zadig aborts the process, kill Zadig with Task Manager, exit and re-enter EDL mode on the phone, then try to install again.

  1. If you’re configuring the driver for the first time, an “USB Device Not Recognised” pop-up may appear. Exit EDL mode by removing and re-inserting the battery, then turn on the phone in EDL mode again.

Part 2: Obtaining the boot partition

Nokia 8000 4G and Nokia 6300 4G with bkerler’s EDL

Beware: due to the firehose loader being malfunctioned, the EDL tool only accepts one command each session, after which you’ll have to disconnect the phone and restart the phone in EDL mode. If you try to throw a second command, it’ll result in a bytearray index out of range error.

  1. Turn on the phone in EDL mode.

  2. Open the extracted EDL folder in a command-line shell. Flash the Gerda Recovery image to the recovery partition by typing: 
    python edl.py w recovery recovery-8110.img --loader=8k.mbn

    If the progress bar stops at 99% (and not earlier) and you get error 'usb.core.USBError: [Errno None] b'libusb0-dll:err [_usb_reap_async] timeout error\n' or usb.core.USBError: [Errno 60] Command timed out, this is false. Don’t mind the error and proceed with the next step.

  3. When finished, disconnect the phone from your computer and exit EDL mode by removing and re-inserting the battery.

  4. Then, hold down the top Power button and * to turn on the phone in recovery mode. Connect the phone to your computer again.

[!WARNING] Be careful not to boot into system at this point! As stated above, while SELinux is still in Enforced mode, it’ll try to revert all system modifications on startup, in this case, the custom recovery image we’ve just flashed will be overwritten by the stock one. If you accidentally start into normal mode (with the usual Nokia chime), you’ll have to start over from step 1.

Don’t worry if this boots into a white screen: this is because the display driver for the Nokia 8110 4G included in the recovery image are not compatible with the display of 8000 4G/6300 4G.

Check if ADB can recognise the phone by typing adb devices into the command-line.

  1. Navigate the command-line to the extracted platform-tools folder (if needed) and pull the boot image from the phone with ADB by typing: 
    adb pull /dev/block/bootdevice/by-name/boot boot.img

    You should now see /dev/block/bootdevice/by-name/boot: 1 file pulled, 0 skipped. and have a copy of the boot partition with the size of 32.0MB (32,768KB). Fetched boot image will be saved to the current directory.

  2. Reboot the phone into normal mode by typing adb reboot into the command-line, or remove and re-insert the battery. Our custom Gerda Recovery partition will now be overwritten by the default one.

You can disconnect the phone from your computer for now.

Nokia 2720 Flip and Nokia 800 Tough with andybalholm’s EDL

Unlike the 6300 4G and 8000 4G, our phones’ EDL loader properly works with both reading and writing, so the steps are more straightforward.

  1. Switch your phone to EDL mode and connect it to your computer.
    • From the turned on state, turn on debugging mode on your phone by dialing *#*#33284#*#*, connect it to your computer and type adb reboot edl in a command-line window.
    • From the turned off state, hold down both side volume keys (2720 Flip) or both D-Pad Up and Down keys (800 Tough) at the same time while inserting the USB cable to the phone.

In both cases, the phone’s screen should blink with a ‘Powered by KaiOS’ logo then become blank. This is normal behaviour letting you know you’re in EDL mode and you can proceed.

  1. Open the extracted EDL folder in a command-line shell. Extract the boot partition of the phone by typing either of these commands depending on which file you have: 
    python edl.py -r boot boot.img -loader 2720.mbn

    python edl.py -r boot boot.img -loader 800t.mbn
  2. When finished, reboot the phone into normal operation by typing either of these into the command-line, or remove and re-insert the battery: 
    python edl.py -reset -loader 2720.mbn

    python edl.py -reset -loader 800t.mbn

You can disconnect the phone from your computer for now.

[!WARNING] Copy and keep the original boot partition somewhere safe in case you need to restore to the original state for over-the-air updates or re-enabling WhatsApp calls.

Part 3: Modifying the boot partition

Automatic patching with 8k-boot-patcher

  1. Follow Docker’s tutorial on installing Docker Desktop. Once set up, open the program, click Accept on this box and let the Docker Engine start before exiting.

Screenshot of a window titled as 'Docker Subscription Service Agreement' which declares that you will have to accept Docker's Subscription Service Agreements, Data Processing Agreement and Data Privacy Policy in order to use the program, and the free scope of it is limited to personal and small business uses. The window also lists the options to view the full agreements, accept them or reject and close the program.

  1. Clone/download the boot patcher toolkit by typing this into a command-line window. This will download the toolkit and have Docker set it up. Do not omit the dot/period at the end of this command, this tells Docker where our downloaded toolkit are located on the system. 
    git clone https://gitlab.com/suborg/8k-boot-patcher.git && cd 8k-boot-patcher && docker build -t 8kbootpatcher .

Screenshot of a macOS Terminal window showing some logs in purple text after typing the command above

  1. Copy the boot.img file we’ve just pulled from our phone to the desktop and do not change its name. Type this into the command-line to run the modifying process: 
    docker run --rm -it -v ~/Desktop:/image 8kbootpatcher

Screenshot of a macOS Terminal window listing a list of processed files after typing the command above

That’s it! On your desktop there will be two new image files, the modified boot.img and the original boot-orig.img. You can now head to part 4.

Screenshot of boot.img and boot-orig.img files as shown on desktop

Manual patching with Android Image Kitchen

  1. Extract the Android Image Kitchen tools and copy the boot image we’ve just obtained over to the root of the extracted folder.

Screenshot of a list of folders and files contained in the extracted Android Image Kitchen folder

  1. Open the folder in a command-line window and type unpackimg boot.img. This will split the image file and unpack the ramdisk to their subdirectories.

Screenshot of a Windows Command Prompt window showing some logs of the boot partition extracting process after typing the command above

[!WARNING] Be sure to edit the files correctly, else the phone won’t boot!

  1. Let the editing begin! First, open ramdisk/default.prop using Notepad++ and change:
    • line 7: ro.secure=1 -> ro.secure=0
    • line 8: security.perf_harden=1 -> security.perf_harden=0
    • line 10: ro.debuggable=0 -> ro.debuggable=1

Screenshot of the original content of the default.prop file Screenshot of the modified content of the default.prop file

  1. Open ramdisk/init.qcom.early_boot.sh in Notepad++ and add setenforce 0 as a new line at the end of the file.

Screenshot of the modified content of the init.qcom.early_boot.sh file

  1. Go back to the root Android Image Kitchen folder and open split_img/boot.img-cmdline in Notepad++. Without adding a new line, scroll to the end of the first line and append androidboot.selinux=permissive enforcing=0.

Screenshot of the modified content of the boot.img-cmdline file

  1. Open ramdisk/init.rc (NOT ramdisk/init) and delete line 393 setprop selinux.reload_policy 1 or mark a comment as shown. This will ultimately prevent SELinux from overwriting the policy changes we made above.

Screenshot of the modified content of the init.rc file, with line 393 marked as comment. This has the same effects as deleting the line altogether.

  1. (Optional) If you wish to disable the Low Memory Killer function, now’s a good time to do so! In the same ramdisk/init.rc file, after line 420, make a new line and add: 
    write /sys/module/lowmemorykiller/parameters/enable_lmk 0

    Indent the new line to match up with other lines as shown.

Screenshot of the modified content of the init.rc file, with line 421 added to disable the Low Memory Killer module

  1. And that’s a wrap! Open the root Android Image Kitchen folder in a command-line window and type repackimg to package our modified boot partition.

Screenshot of a Windows Command Prompt window showing some logs of the boot partition repacking process after typing the above command, but has a signing error at the end

If you happen to encounter an error during the signing process, that’s likely because the process uses java to power the boot-signer.jar sequence and you don’t have it installed. The image will still be packaged and ready for flashing, but if you’re a perfectionist, you can install JRE and try again.

Screenshot of a Windows Command Prompt window showing some logs of the fully successful boot partition process

If the newly packaged image is barely over 1/3 the size of the original image, it’s a normal behaviour and you can proceed.

Part 4: Flashing the modified boot partition

  1. Turn on your phone in EDL mode and connect it to your computer.

  2. Move the newly created boot.img, unsigned-new.img or image-new.img to the EDL tools folder and open a command-line window within it. From here type either of these commands depending on which image file you have: 
    python edl.py w boot boot.img --loader=8k.mbn

    python edl.py w boot unsigned-new.img --loader=8k.mbn

    python edl.py w boot image-new.img --loader=8k.mbn

    For Nokia 2720 Flip and Nokia 800 Tough with andybalholm’s EDL:

    python edl.py -w boot boot.img -loader 2720.mbn

    python edl.py -w boot boot.img -loader 800t.mbn

    Again, if the progress bar stops at 99% and you get a timeout error, this is because the phone doesn’t send any indicator information back to the EDL tool when in fact the image has been successfully written. Don’t mind the error and go on with the next step.

  3. Restart the phone to normal operation mode by typing python edl.py reset. And we’re done!

If you still have the original boot partition and wish to revert all the messes and damages, connect the phone to your computer in EDL mode, move the image file to the EDL tools folder, open a command-line window within it and type these one-line at a time:

python edl.py w boot boot.img --loader=8k.mbn
python edl.py reset

Demostration of a command-line window showing the results after typing the first command above

Next steps

Screenshot of a WebIDE window in which the location of Device Preferences is highlighted in the right pane and the value of devTools.apps.forbiddenPermissions has been emptied

Source code

HMD Global/Nokia Mobile has published the device’s source code for its Linux 4.9 kernel, B2G and certain third-party libraries used in this phone, which can be downloaded directly from here.

Note that the source code released does not contain proprietary parts from other parties like Qualcomm.