Recent posts

Pages1
#1
Software & Tools / [Tool] BB10MT Usage Documentat...
Last post by feihaibao - Nov 22, 2025, 04:51 PM
BlackBerry 10 MultiTool Documentation

Overview
BB10MT is a cross-platform command-line tool for BlackBerry 10 device manipulation, QNX6 filesystem operations, and autoloader management. Works on both Linux and Windows as an alternative to cap.exe.

Dependencies
BB10MT Depends on the following: libusb, liblzo and fuse on Linux and liblzo, libusb on Windows.

QNX6 Filesystem Operations

Mount QNX6 Image
Code Select
./bb10mt qnx6 mount -i <image_file> -m <mountpoint> [-f] [-d]Options:
  • -i: QNX6FS image file (required)
  • -m: Mount point (required)
  • -f: Run in foreground
  • -d: Enable FUSE debug output (slow)
Compact QNX6 Image
Code Select
./bb10mt qnx6 compact -i <image_file>Reduces image size by removing unused space.

Create QNX6 Filesystem
Code Select
./bb10mt qnx6 mkfs -i <image_file> [-b blocks] [-n inodes] [-s block_size]Options:
  • -b: Blocks count (default: 10240)
  • -n: Inodes count (default: 1024)
  • -s: Block size in bytes, multiple of 512 (default: 4096)
Check/Repair QNX6 Filesystem
Code Select
./bb10mt qnx6 fsck -i <image_file> [-f]Options:
  • -f: Fix errors automatically
QCFM Container Operations

Unpack Container
Code Select
./bb10mt unpack --container <container_file>Extracts all files from a QCFM container.

Pack Container
Code Select
./bb10mt pack -c <output_container> -i <input_file> [-v versions] [-s] [-f]Options:
  • -c: Output container file (required)
  • -i: Input file or comma-separated files (required)
  • -l: Input files list (text file)
  • -v: QCFM versions, comma-separated (default: 2)
  • -s: Add fake signature
  • -f: Include empty blocks (fast mode)
Autoloader Operations

Split Autoloader
Code Select
./bb10mt split -i <autoloader_file>Splits autoloader into individual components.

Create Autoloader
Code Select
./bb10mt autoloader create -o <output_file> -c <cap_file> -i <input_files> [-l files_list] [-v version]Options:
  • -o: Autoloader file (default: autoloader.exe)
  • -c: Own cap.exe file (default: cap.exe)
  • -i: Input files, comma-separated (required unless -l specified)
  • -l: Input files list
  • -v: Cap tail version (default: 2)
Extract CAP from Autoloader
Code Select
./bb10mt autoloader extract -i <autoloader_file> [-c cap_output]Options:
  • -i: Autoloader file (required)
  • -c: Own cap.exe file (default: cap.exe)
Extract RAM Loaders
Code Select
./bb10mt autoloader loaders -i <cap_cfp_file> [-o output_dir]Extracts RAM loaders from CAP, CFP, or autoloader files.
Options:
  • -i: cap.exe/cfp.exe file (required)
  • -o: Output directory (default: ramloaders)
Device Operations

Flash Files to Device
Code Select
./bb10mt flash -i <file1,file2,...> [-v versions] [-r loader_dir] [-d delay]Options:
  • -i: Input file or comma-separated files (required)
  • -l: Input files list (text file)
  • -v: QCFM versions, comma-separated (default: 1,2)
  • -r: RAM loaders directory (default: loaders)
  • -d: RAM loader delay in ms (default: 1000)
Show Device Info
Code Select
./bb10mt info [-d delay]Displays connected device information.
Options:
  • -d: RAM loader delay in ms (default: 1000)
Probe All Loaders
Code Select
./bb10mt loader [-d delay]Options:
  • -d: RAM-loader delay (default: 1000)
Connect to Device via SSH
Code Select
./bb10mt connect -i <ip_address> -p <password> -k <public_key_path>Options:
  • -i: Device IP address (required)
  • -p: Device password (required)
  • -k: Path to RSA public key to install (required)
BAR File Operations

Create BAR Template
Code Select
./bb10mt bar template -p <base_dir> -n <bar_name>Options:
  • -p: Path to base directory (required)
  • -n: BAR name (required)
Update BAR Hashes
Code Select
./bb10mt bar update -p <bar_path>Updates hashes in MANIFEST.MF after modifications.
Options:
  • -p: Path to unpacked BAR (required)
Generate New IDs
Code Select
./bb10mt bar ids -p <bar_path>Generates new IDs in MANIFEST.MF.
Options:
  • -p: Path to unpacked BAR (required)
Install Unpacked BAR
Code Select
./bb10mt bar install -p <bar_path> -m <mount_point>Options:
  • -p: Path to unpacked BAR (required)
  • -m: Path to mount point (required)
Raw Data Operations

Dump Raw Flash Image
Code Select
./bb10mt raw dump -i <input_file> [-o output_dir] [-m mct_offset]Splits raw flash image into individual partitions.
Options:
  • -i: Input file (required)
  • -o: Output directory
  • -m: MCT offset
Split NVRAM
Code Select
./bb10mt raw nvram -i <input_file> [-o output_dir]Splits NVRAM into individual blocks.
Options:
  • -i: Input file (required)
  • -o: Output directory
RCFS Operations
Code Select
./bb10mt rcfs -i <image_file> [-s script_file] [--vmdk]Options:
  • -i: RCFS image file (required)
  • -s: Script file for operations
  • --vmdk: Process as VMWare disk image
Usage Examples

TBD...

Downloads
  • BlackBerry 10 MultiTool (v0.5.0.5) - 03.09.2025 - Download
  • BlackBerry 10 MultiTool (v0.2.1.3) - 24.07.2025 - Download
  • BlackBerry 10 MultiTool (v0.1.0.10) - Download
#2
Dev Resources / [Source Sample] Native Looking...
Last post by Pablo - Nov 22, 2025, 03:31 PM
This is an example of one of my web apps, with its full source for you to do creative solutions fully available on the blackberry.

Demo:
https://subs.waitberry.com/#home

Full Source:
https://subs.waitberry.com/package.zip
#3
Dev Resources / [Blackberry VM] Blackberry 10 ...
Last post by Pablo - Nov 22, 2025, 03:28 PM
Here is all the files you need to run a Blackberry 10 VM

Requirements:
1. VMWare

Notes:
This machine can take a long time to boot, just let it there until it runs, after it boots also wait so it becomes responsive to touch inputs.

Downloads
https://mega.nz/file/AckDgByY#aDktixLKwLbXc1jsm781Jna1FGSeW1LK_vjJmxMuT9I

[Root]
https://forums.crackberry.com/blackberry-10-os-f269/rooting-bb-10-os-simulator-830012/
#4
Dev Resources / [Sample Source] Android Web Wr...
Last post by Pablo - Nov 22, 2025, 03:25 PM
Sample source code to make an Android Web Wrapper Compatible with the Blackberry.

https://github.com/FerreiraPablo/BlackberryAndroidWebWrapperExample
#5
Dev Resources / [Sample Source] Android Applic...
Last post by Pablo - Nov 22, 2025, 03:24 PM
Quick Start Project for an Android Application for Blackberry:
This is a sample Android application specifically designed for BlackBerry devices running Android 4.3 (API Level 18).

https://github.com/FerreiraPablo/BlackberryLegacyAndroidExample
#6
Guides, News & Docs / [FAQs] Frequently Asked Questi...
Last post by Pablo - Nov 22, 2025, 03:16 PM
Here is a little post to answer questions:

Can we currently install unsigned apps?
Technically we can install unsigned packages, but not apps itself the thing that launches them has signature checks.

If we can install unsigned apps why can't we run them?
The "Launcher" binary, which delegates the process of running an app to the right runtime. Has a signature check internally that checks the validity of the whole application on startup, and prevents it to run. The only way to run unsigned apps is to have an insecure device

How can i make an app for Blackberry without being able to sign native apps?
Even if we cannot compile apps that can be executed natively on device we have the following alternatives to build apps:
  • Android 4.3 APK: Due to the Android Runtime available on blackberry (Example Projects: Legacy App,Web Wrapper)
  • Web Applications: Any Web App compatible with ES2014 should work fine, with a lot of available APIs like local notifications, workers, filesytem access and more. Is a really viable option for development, if you can get used to the lack of classes and arrow functions.
  • C++ Console Applications: Using the Blackberry NDK is possible to run native C++ Binaries, that can be executed via Term49.

I cannot compile an app and send it to my device in Momentics, why?
You need a developer account from Blackberry and that service is down, and the signing server is also down. And cannot be spoofed because in the end the device OS requires a signature confirmed by Blackberry.

Can i make a backup of my device?
A native system backup, NO, is not possible the method to do that rely on the BBID Servers which are down. You can copy your files, and maybe even dump some partitions but you probably cannot put them back together. Maybe, try it.

Where i can get the firmware images (The Signed Images)?
You need to extract them with tools like Darcy BB Tools or Sachesi, from an Autoloader a little google search should guide you in the right direction. Make sure to use an Autoloader compatible with your specific device.

Can i make CLI applications for the Blackberry?
Yes absolutely, and access a lot of native functionality with pretty good performance overall, There are many ways:
- Python 3.2 : Included in the blackberry, with access to many native features due to QNX Packages integrated on the device.
- BBNDK: Which you can find online, that allow you to build native C++ Console applications for Blackberry.

Also other available ways made by the community. and you can run them using Term49.

Can we change the Insecure Device Flag somehow?
Currently no, we know that it is on boot0 which is read only.

Why don't we replace the "Launcher" binary so it allows to run unsigned applications?
Because its located on the RCFS Partition of the system, which is read only and has a signature, any try of modifying file on this partition will result into a device not booting.

But how do we have custom roms if we cannot modify the system itself?
All of the ROM Mods we have currently leave the RCFS Partition to avoid breaking the signature, and modify the mostly unprotected QNX6 Partition which mostly contains user data directories and settings.

Is it possible to update the Android Runtime?
No, its a signed application, and modifying it or installing it means breaking it.

Can we root the BB10 Devices?
No, is not currently possible to access root privileges, but thanks to Oleksandr one of our greater contributors is possible to impersonate any other user and group in the system.


Is it possible to downgrade a BB10 Device?
Yes it is, Easy Downgrade Guide and another guide

Is it possible to use BBID in today?
No, servers have been down for years now, and tries to spoof and create servers have failed due to many certificated validations and DNS Server requirements. It could be done in the future tho, but it requires a lot of reverse engineering.
#7
ROMs & Mods / [Custom ROM] Clean R2 - Debloa...
Last post by Pablo - Nov 22, 2025, 02:43 PM
Hello! This is the second and probably last revision of the Clean & Bloatware Free Autoloader, removes some more stuff like "Setup" and "Help" from the menu, and also some hidden stuff like Retail Demo and etc...
But the focus on this one is stability, some users reported with the other rom having some problems with specific android apps and i think it could have been related to some changes i did, but in this rom everything should be fix. and Android should be completely unaffected.
Comment: Some people reported issues after doing a secure wipe on their devices after installing this rom, this can be solved by flashing the rom again or flashing the original autoloader.
Use it at your own risk, this is a custom firmware after all...

Summary:
  • Removes the initial setup, so no need to find workaround to skip it.
  • Removes bloatware and obsolete applications
  • Removed initial setup
  • Changed some URLs, to make request to valid sites. (Some basic ones, nothing really relevant, just to respond with success to the BB so it doesn't retry any more)
  • Removed some unnecessary startup apps.
  • Improvements in battery life.
  • In my opinion, has better performance.
Removed:
  • BOX
  • Evernote
  • Facebook
  • Twitter
  • App World
  • BBM
  • Setup
  • Howto
  • Youtube shortcut
  • And other useless crap...
Stuff that wasn't removed:
  • Adobe Reader and the other document reading apps.
  • Amazon because it's somehow really tightened to the Android Runtime and after removal makes the device behave really slowly.
Known Bugs
  • Secure Factory Resets seem to cause issues, this can be easily solved by reflashing or installing a stock rom.
  • Some people reported not being able to change their Keyboard Distribution to AZERTY.
  • Some Z10 users experience weird and unexpected issues, everyone has a different experience.
Notes:
  • The apps itself are still in the system somewhere, but they will not be executed automatically, neither are they visible or can be run.
Installation:
  • Connect the device via USB to a Windows PC.
  • Run the program.
  • Should install automatically, without any issues.
Specific packages that got removed:
  • "com.twitter",
  • "com.evernote",
  • "com.linkedin",
  • "com.tcs.maps",
  • "com.rim.bb.app.facebook",
  • "com.rim.bb.app.retaildemoshim",
  • "sys.socialconnect.linkedin",
  • "sys.socialconnect.twitter",
  • "sys.socialconnect.youtube",
  • "sys.socialconnect.facebook",
  • "sys.cfs.box",
  • "sys.cfs.webdav.todtm",
  • "sys.cfs.dropbox",
  • "sys.uri.youtube",
  • "sys.weather",
  • "sys.bbm",
  • "sys.appworld",
  • "sys.howto",
  • "sys.help",
  • "sys.firstlaunch",
  • "sys.deviceswitch",
  • "sys.paymentsystem",
  • "sys.setupbuffet"

Download URLs
https://pastebin.com/dL9ScBJW

Note: I don't have all these devices, but i've had confirmation from other users that Passport, Z10 work as expected. So i don't doubt the others do because is basically the same thing.

Special Thanks
u/wumbomumbo - From the Lunar Project Discord Channel, because he found out that the signature verification was happening on a software layer.
Also u/xplanthris that got from u/balika the information that flashing the radio fixed the signature verification error. Error, that i simply bypassed by modifying CAP.
FAQs

When i open the autoloader it inmediately closes?
You need to install Blackberry Link or the Blackberry Drivers Independently if you find them.

Do i need a Windows PC?
Yes.

Can i install it directly from the blackberry without the need of a PC?
No.

Can i install this on BBOS Devices (Not BB10 Ones)?
No.

Will Whatsapp work on this?
No.

i have the drivers but still, the autoloader closes, help?
Use a different USB cable, one that works and transfers data.

My device got in a bootloop after wiping with this rom? What should i do?
Simply, flash an original autoloader, or flash this one again and it should fix the issue.

Will this ROM, Reset my device to its factory state?
Yes all Autoloaders, clear ALL data except for the password of the device. So be careful if you don't want to lose your data. Thats why i try not to release versions often so people don't have to reflash constantly.


Support me!!

If you want to support me in the development for the blackberry, you can become a member on my patreon, so you can gain access to support directly for me and the possibility to request features, and some other tools:
https://www.patreon.com/c/waitberry
Don't forget to check my all my apps and efforts:
#8
ROMs & Mods / [Package] BlackBerry Downgrade...
Last post by Pablo - Nov 22, 2025, 02:34 PM
BlackBerry Downgrade, ROM Mod & .BAR Installer Script

This is a tutorial on how to downgrade a BlackBerry, make modifications to ROMs, and includes my custom .BAR installation script.

IMPORTANT
QuoteThis requires autoloading your device, which will RESET IT TO FACTORY SETTINGS.

Note on Signed Files:
You can get your Signed Files with Darcy BB Tools, which allows you to pull an autoloader and extract the .Signed files to use in this tutorial.
This whole tutorial is also included in the package as a README.md file.


Downloads

http://ferreirapablo.com/files/impersonation_patcher_v4.zip

The patch contains everything you need to have a ROM that includes:
  • No Bloatware
  • ExFAT Driver included
  • Impersonation for Privilege Elevation
  • Downgrading script to install any older version of BB10


Requirements
  • The Signed File from your device-specific AUTOLOADER.
  • CRITICAL: Make sure to use one that is from a version that is the SAME OR HIGHER than your current OS version.
  • Correct drivers to flash your device installed on your computer (BlackBerry Link drivers or BlackBerry Desktop Software).


How to use

  • Extract your IFS Signed File and RADIO Signed File from your device specific AUTOLOADER.
  • Place the extracted files into the "signed" folder. Name them OS.Signed and Radio.Signed respectively.
  • Run the blackberrysystempacker.exe executable.
  • Wait for the program to finish. You will see a file called Autoloader.exe in the "output" folder. This is your patched Autoloader.
  • Flash the Autoloader.exe file using the same method you would use to flash a normal autoloader.
  • Enjoy your patched autoloader with the new radio and OS files.

Linux Users:
It is currently not possible to generate an autoloader on Linux. However, you can still use bb10_mt to flash the generated signed files using your original Radio.Signed and the generated OS.Signed in the output folder.


Notes
  • This tool includes the mod-nvram binary created by @Oleksandr. It is located in
    Code Select
    /accounts/1000/shared/documents/mod-nvram after flashing.
  • This tool installs the EXFAT Driver, required to read/write to exFAT formatted SD cards.
  • This tool preinstalls term49, a terminal emulator for BlackBerry 10.
  • IMPORTANT: The impersonation patch is only applied on the first boot after flashing the autoloader. If you want to keep the impersonation patch, follow the instructions below.

Downgrading

After patching and flashing the autoloader, you can downgrade your device to a previous OS version if you wish.
NOTE: YOU CAN ONLY DO THIS ON THE FIRST BOOT AFTER FLASHING THE AUTOLOADER.

  • Open Term49 (the terminal emulator installed by the patched autoloader).
  • Go to the documents directory by typing:
Code Select
cd /accounts/1000/shared/documents
  • Use the NTO Group impersonation by running:
Code Select
/q/g_nto
  • Run the mod-nvram binary:
Code Select
./mod-nvram -d
[/list]

This will clear the blocked OS versions, allowing you to run any older Autoloader.
If you want to revert back to the original autoloader, just flash the original autoloader again.


Keeping the Impersonation Patch on the Next Boot

If you want to keep the impersonation patch, follow these steps:

  • After flashing the patched autoloader, go to Term49.
  • Go to the installer directory by typing:
Code Select
cd /accounts/1000/shared/.installer
  • Execute the installer by typing:
Code Select
./run.sh
[/list]

This will set the impersonation patch to be reinstalled on the next boot, and will also install any .bar files located in the downloads/documents directory. Running this program on every boot will ensure that the impersonation patch is always available.


How this works

There are a couple of files with different responsibilities in the patch:
  • blackberrysystempacker.exe: The main program that packs the signed files into an autoloader and applies the changes.
  • patch.txt: Defines a series of instructions that the packer will follow to apply the changes.
  • config.json: Defines the configuration for the packer program (paths to signed files, output directory, etc).

#9
Software & Tools / [OS Modding] Blackberry System...
Last post by Pablo - Nov 22, 2025, 02:25 PM
Blackberry System Packer

Overview
This tool allows you to modify signed Blackberry firmware images without ignoring their signature validation. It provides a command-line interface for common patching operations on Blackberry system files, a proof of concept for the modification of images with QNX6 filesystems.

Developed by Pablo Ferreira for educational purposes, this tool is not affiliated with Blackberry or Research In Motion.

Source code published for the first time on 3/3/2025

Features
Patch signed Blackberry firmware images
Preserve image signatures while modifying content
Command-line interface for batch processing
Support for common Blackberry firmware formats

Github Repository: https://github.com/FerreiraPablo/BlackberrySystemPacker
Releases: https://github.com/FerreiraPablo/BlackberrySystemPacker/releases

Pages1