i have a Dopod 818 (Magician) and have been trying to change it from chinese to english. Bootloader version is 1.0 i think.
So far : have got the process working fine with MTTY and NTRW 2.0 - have perfrormed backup and restore using the chinese ROM.
I have copied the first 416 bytes from my Chinese ROM and pasted them into the Nowicom English ROM (from www.compactjam.com).
NTRW then fails to write the altered english ROM to the SD card using the command
ntrw write fixed.nb1 g:
it says 'parameter incorrect', and fails to write any bytes. when i write using the original chinese ROM, it actually does write 120Mb, and also reports 'parameter incorrect'. All the files are in the correct root folder etc.
NTRW 2.0 will not even write the unaltered English Magician ROM file to the SD card. However my chinese one still writes fine.
So I'm stuck.
Have done lots of reading and spent many hours trying things, but i think I've hit the wall.
Please help?!
I got the same problem before But ntrw did write the modify rom nto the SD and I put it in my Jam
then start to run the update but at the end it will say Checksum failed, then i do a cold restart...anything alrite I got a CHT rom on my Jam
I have this problem, please try another ntrw.
Fixed most of it:
NTRW 2.0 seems to want to write in 256K sectors. if your ROM file is not exactly a multiple of 256k, it will write the file and then report parameter incorrect. removing a few '0's will fix this error and report accurate bytes writte.
the DOPOD 818 can be upgraded to english. but here are a few things that aren;t easy to find in one place in these posts. i believe this is correct. i have had some great help from Mamaich, and also Willem. these guys have been great, and provided some brilliant info!
i was getting the error
Sections = 1
=============
Not allow update
there is very little info on this, and i found nothing that was accurate until Willem gave me the reason. thanks Willem!
this was because i was writing more that the base OS to the SD card from the device using the commands...
d2s 80000000 02000000
d2s 60000000 00030000
this writes 2 sections to the SD card, as you are effectively copying 2 ROM files from the machine.
for info to brand-newbies...
the cardheader is a block of binary data, starting with 'MAGICIAN'
the section headers look like this:
HTCS80040000023C0000<hexchecksum>
HTCS82c00000013C0000<hexchecksum>
if your backed up file has 2 occurences of 'HTCS...etc' then you have copied 2 sections onto your card.
this is fine as long as the Englosh ROM that you have downloaded also has 2 sections. most only have 1. therefore, the first 416 bytes of original header say there should be 2 sections in the ROM, but your adjusted English ROM file will only have 1. hence the error...
Sections = 1
=============
Not allow update
this is the same error that you will get if you use all 3 d2s commands listed in some of the posts on this site eg
if you are getting sections = 1 error, get a copy of the original ROM, chinese in my case, but only get the O/S. ie
USB> d2s
you are now ready to copy the first 416 bytes of your chinese header into the English ROM.
however, you need to be careful with the bootloader. mine is v1.00. i believe that most of the ROMs are written for bootloader 1.06. so the upgrade will be accepted, but you will NOT have a working English Dopod.
I am trying to work out how to fix this. probably upgrade bootloader, or find a WWE ROM designed for bootloader 1.00.
ben
Re: Chinese to English (Dopod 818) - fails at English ROM Up
coogee said:
Fixed most of it:
NTRW 2.0 seems to want to write in 256K sectors. if your ROM file is not exactly a multiple of 256k, it will write the file and then report parameter incorrect. removing a few '0's will fix this error and report accurate bytes writte.
the DOPOD 818 can be upgraded to english. but here are a few things that aren;t easy to find in one place in these posts. i believe this is correct. i have had some great help from Mamaich, and also Willem. these guys have been great, and provided some brilliant info!
i was getting the error
Sections = 1
=============
Not allow update
there is very little info on this, and i found nothing that was accurate until Willem gave me the reason. thanks Willem!
this was because i was writing more that the base OS to the SD card from the device using the commands...
d2s 80000000 02000000
d2s 60000000 00030000
this writes 2 sections to the SD card, as you are effectively copying 2 ROM files from the machine.
for info to brand-newbies...
the cardheader is a block of binary data, starting with 'MAGICIAN'
the section headers look like this:
HTCS80040000023C0000<hexchecksum>
HTCS82c00000013C0000<hexchecksum>
if your backed up file has 2 occurences of 'HTCS...etc' then you have copied 2 sections onto your card.
this is fine as long as the Englosh ROM that you have downloaded also has 2 sections. most only have 1. therefore, the first 416 bytes of original header say there should be 2 sections in the ROM, but your adjusted English ROM file will only have 1. hence the error...
Sections = 1
=============
Not allow update
this is the same error that you will get if you use all 3 d2s commands listed in some of the posts on this site eg
if you are getting sections = 1 error, get a copy of the original ROM, chinese in my case, but only get the O/S. ie
USB> d2s
you are now ready to copy the first 416 bytes of your chinese header into the English ROM.
however, you need to be careful with the bootloader. mine is v1.00. i believe that most of the ROMs are written for bootloader 1.06. so the upgrade will be accepted, but you will NOT have a working English Dopod.
I am trying to work out how to fix this. probably upgrade bootloader, or find a WWE ROM designed for bootloader 1.00.
ben
Click to expand...
Click to collapse
Dear coogee, thanks for your work. I have some more details want to ask, hope thats don't trouble you too much.
1) Is that mean if I backup all the roms with below commands, I will get three sections? and the header can't use for upgraud?
¨d2s 80000000 02400000¨
¨d2s 60000000 00300000 sd a¨
¨d2s 70000000 01080000 sd a¨
2) do you know now can we make a backup of all roms (OS / Ext. /radio) in one section?
Thanks for your share.
I successfully transfered the Chinese OS to English OS.
I found that the first 416 bytes are different every time I backup from the Chinese OS and not every 416 bytes are valid.
So if you failed to transfer the English OS, try backup again and paste the new 416 bytes into the English OS and transfer again. It may works.
Related
Still no body knows how to unlock the ext-rom? I try everyehere here, but still no one can do it?
I've been wondering that myself since I moved over from a PDA2k and saw how easy it was to do it there with the Unlocker tools.
Apparently, since it's so comparatively new and the architecture is allegedly different from some of the other models, the only individual who went far enough to hack it is no longer active or no longer a willing participant in the community. His much-appreciated hack simply cleared out the Extended ROM area and moved it into the usable Storage memory area.
Until we get more people who are acclimated and bold enough to risk tinkering with their Magician models, it's either an all-or-nothing scenario when it comes to the Extended ROM. For me, I decided to hold out from installing the "BigStorage" hack until I know we can easily go back and forth without jeopardizing our devices with SD card-flashing techniques. There seems to be too many variables (read: ROM variations) to make me feel comfortable about possibly flashing some other carrier's version or rendition of the ROM onto my i-mate NA-850MHz JAM.
Ext rom
Ok Beondthetech I understand - it's not to easy load aplications to ext rom (like MDA2) . We wont personalize our devices after loading system ( after Hard reset ). Aplications like ewallet , callmanager , ... etc. Metod is not relevant. W wont only automatically instal other programs ( not included on rom ). Or what's the metod to enrich orginal rom. But I prefer upload ext rom. Tools like Unhide and Unlock not work ( Error: FL_IOCTL_HW_PROTECTION- Yhe parameter is incorrect). When I try something write i saw Cannot copy : error code 19 The media is write protect (after use loadvdisk.exe) Thanks for all replies . Sorry for my english.
As I understand it, the memory configuration and layout is different between the Blue Angel and the Magician devices, so the Unlock tools won't work.
I decided to remove my Extended ROM portion altogether and use Anansky's BigStorage hack. I now have 27MB of Storage area instead. I copied out the Extended ROM's CAB files and incorporated it into my normal "build" when redoing all my applications on a new device.
How to make your own ExtROM for the Magician
I recently managed to make my own ExtROM for my Magician.
A short howto:
1. First dump your rom to a SD-card, using the well know method.
2. Next get the rom to your pc, using ntrw
3. Using a Hex-editor, copy 2BC019C (HEX) till 3EC019C (HEX) to a file.
4. Mount that file as a virtual Harddisk (I use the virtualdisk-plugin for total commander)
5. Modify your ExtROM on that Virtualdisk.
6. Umount the Virtualdisk.
7. paste the contents of the (modified) file back into the rom-file, at precicly the same position and save it under a different name.
8. put the modified rom back onto your SD-card, using ntrw.
9. Flash your Magician, with the new rom.
Have fun with your modified ExtRom
Re: How to make your own ExtROM for the Magician
DrChair said:
I recently managed to make my own ExtROM for my Magician.
A short howto:
1. First dump your rom to a SD-card, using the well know method.
2. Next get the rom to your pc, using ntrw
3. Using a Hex-editor, copy 2BC019C (HEX) till 3EC019C (HEX) to a file.
4. Mount that file as a virtual Harddisk (I use the virtualdisk-plugin for total commander)
5. Modify your ExtROM on that Virtualdisk.
6. Umount the Virtualdisk.
7. paste the contents of the (modified) file back into the rom-file, at precicly the same position and save it under a different name.
8. put the modified rom back onto your SD-card, using ntrw.
9. Flash your Magician, with the new rom.
Have fun with your modified ExtRom
Click to expand...
Click to collapse
Does that remove the simlock?
Re: How to make your own ExtROM for the Magician
Oesie said:
Does that remove the simlock?
Click to expand...
Click to collapse
Nope, it's only a way to customize which things are installed after a hard-reset.
Hi DrChair,
I have a question for you. How did you find out that The LOC 2BC019C (HEX) till 3EC019C (HEX) is the ExtROM ?
Thanks
Hi!
I can not find this section in my file. i use hdd Hex editor. see the attachment. thankx
Pamela said:
Hi!
I can not find this section in my file. i use hdd Hex editor. see the attachment. thankx
Click to expand...
Click to collapse
You miss understand. 2BC019C (HEX) is Location not Content.
ups...
Sorry... :wink:
thankx
Pamela, he is referring to the exact position in the file, not a hex string to search for.
The idea is that you're ripping a chunk out of the ROM dump and turning that into a mountable volume, to which you can modify the contents, then inject the modified chunk back into the ROM dump, then SD-flash your device.
3EC019C hex = 65,798,556 decimal
2BC019C hex = 45,875,612 decimal
65,798,556 - 45,875,612 = 19,922,944 bytes
So, from the ROM dump you make, you'll be ripping out nearly 19 MB into a file that you'll use as a "virtual hard disk" to make changes as necessary.
WinHex and UltraEdit are two good hex editors, and WinHex is good for ripping chunks out and injecting them back in (you don't want to "insert" the code, but replace the 19,922,944 bytes with your modifications - inserting will make the ROM dump file larger and corrupt it).
little_frog said:
Hi DrChair,
I have a question for you. How did you find out that The LOC 2BC019C (HEX) till 3EC019C (HEX) is the ExtROM ?
Thanks
Click to expand...
Click to collapse
I was trying to understand Anansky's bigstorage rom, by comparing it with my own rom, when I stumled over something that looked very much like a FAT16 bootsector. So I had the start-address. Knowing that the size of the ext-rom was 1300000 (hex) it's simple math to find the end-address.
DrChair said:
little_frog said:
Hi DrChair,
I have a question for you. How did you find out that The LOC 2BC019C (HEX) till 3EC019C (HEX) is the ExtROM ?
Thanks
Click to expand...
Click to collapse
I was trying to understand Anansky's bigstorage rom, by comparing it with my own rom, when I stumled over something that looked very much like a FAT16 bootsector. So I had the start-address. Knowing that the size of the ext-rom was 1300000 (hex) it's simple math to find the end-address.
Click to expand...
Click to collapse
Thanks.. DrChair
BeyondtheTech said:
Pamela, he is referring to the exact position in the file, not a hex string to search for.
The idea is that you're ripping a chunk out of the ROM dump and turning that into a mountable volume, to which you can modify the contents, then inject the modified chunk back into the ROM dump, then SD-flash your device.
3EC019C hex = 65,798,556 decimal
2BC019C hex = 45,875,612 decimal
65,798,556 - 45,875,612 = 19,922,944 bytes
So, from the ROM dump you make, you'll be ripping out nearly 19 MB into a file that you'll use as a "virtual hard disk" to make changes as necessary.
WinHex and UltraEdit are two good hex editors, and WinHex is good for ripping chunks out and injecting them back in (you don't want to "insert" the code, but replace the 19,922,944 bytes with your modifications - inserting will make the ROM dump file larger and corrupt it).
Click to expand...
Click to collapse
Wow! Is it possible for any1 to make an App that will do this Automatically? similar to the bytecopy app provided by some1 in this forum(great work btw!)? Or go the distance and upload a cooked ROM with the most useful apps that will go in after a Hard Reset?(based on the experience of the gurus and nice peeps in the house)
Use at own risk.
Sorry if it sounds too technical, but theoretically, one can go into the bootloader mode of the Magician and just dump the Extended ROM area to the SD card (i.e. d2s 82BC019C 83EC019C [untested!]), then 'ntrw read' it, mount it, edit it, unmount it, 'ntrw write' it, then 's2d 82BC019C 83EC019C' to write it back to the Magician.
I haven't found any documentation on 's2d' so that might be the reason he's dumping the entire ROM, then extracting the Extended ROM portion.
There are a good threads on how d2s/s2d is used on an iPAQ and an XDA II, but I'm sure it can be applied to most Pocket PCs:
http://discuss.pocketnow.com/showthread.php?s=&postid=46855
http://en.pdamobiz.com/en/forum/PDAforum_posts.asp?TID=62&PN=1
And these are possible commands and its arguments for use in the bootloader mode:
http://www.handhelds.org/hypermail/h2200-port/1/0146.html
Hi!
I have problems to mount the file to a disk. What ending should the file have? *.iso *.nrg ???!!!
i also have problems with total commander. the plugin does not work...
Plz HELP!
Pam
Hi!
now i fixed my problems... thankx
But an other question:
Is it possible to create a small ext. Rom only for IIWPO so that the rest of the Storage is useable to install Programms in?
What about a NEW self cooked Rom with IIWPO. There are many threads about this with the other HTC devices. Is it possible with the Magician without loosing the Big Storage??
Thankx. By, Pam
BeyondtheTech said:
theoretically, one can go into the bootloader mode of the Magician and just dump the Extended ROM area to the SD card (i.e. d2s 82BC019C 83EC019C [untested!])
Click to expand...
Click to collapse
That would be d2s 82c00000 83f00000
BeyondtheTech said:
I haven't found any documentation on 's2d' so that might be the reason he's dumping the entire ROM, then extracting the Extended ROM portion.
Click to expand...
Click to collapse
I didn't know that command existed. I thought i tried that once (s2d, without any arguments) to flash back a entire rom when I'd put back the sd-card when i was already in BL-mode, but iirc that gave me an "Invalid Command" message...
Anyways i'll give it another try this weekend.
And thanks for the url's, already googled for boatloader commands but found none
Pamela said:
Is it possible to create a small ext. Rom only for IIWPO so that the rest of the Storage is useable to install Programms in?
Click to expand...
Click to collapse
I'm still trying to figure that out aswell, but uptill now without any succes...
It would be nice to have approx 10 MB ext-rom and the rest added to storage.
Thanks to various pioneers on this forum - I have just updated the Dopod 1.11 CHT ROM to have access to 26.72M Storage.
1. Use the official Dopod link www.dopod.com.tw/download/Dopod818_1110_153_11100_Ship.exe to update the ROM to CHT 1.11.
Use MaUpgradeUt_noID.exe if your pocket pc is not a Dopod 818.
2. Run RomUpdate.exe to dump the ROM to SD Card.
3. Run "ntrw read chtbig.nb1 s:" where s: is the SD drive.
4. Use HexEditor to modify "80 00" to "b8 01" at the following two locations of chtbig.nb1 - 00007e4a and 01fc232e.
5. Run "ntrw write chtbig.nb1 s:".
6. Flash the pocket pc with the new ROM on SD card.
The key is about identifying the right locations of the ROM to modify. Please note that different machines and different ROM versions will have different addresses to modify.
Thanks for your explanation
How to identify the right locations to modify?
I just have my O2 mini upgraded to 1.12.00WWE and would like to modify it to bigstorage.
Regards
Woo ~~ good job !! but can you show more for point 4
Talents said:
4. Use HexEditor to modify "08 00" to "b8 01" at the following two locations of chtbig.nb1 - 00007e4a and 01fc232e.
Click to expand...
Click to collapse
http://forum.xda-developers.com/viewtopic.php?t=23250&sid=97eea813b4222410de0a3e6fbb2f9390
Hey ! I got it. now my O2 had 27MB storage and CHT 1.11 rom . :lol:
I am glad that the method works on the pocket pc of others.
In theory, this DIY method should work for any newly released ROM versions, unless HTC changes the coding structure.
Thanks. It works for me too.
Just a reminder for others: The first boot will takes about 5 mins for formating the storage space.
yes, I have also encountered this problem but my O2 mini is work fine now.
So far, we know that BigStorage can be created for 1.11 or 1.12 ROMs by replacing 80 00 with b8 01 at the following two locations:
English version (i-mate JAM, T-mobile compact, etc.)
7e32 and 211e32e
French version (qtek, etc.)
7e32 and 212332e
German version (T-mobile compact, etc.)
7e32 and 213232e
Traditional Chinese version (Dopod 818, O2 Asia, etc.)
7e4a and 1fc232e
Simplified Chinese version (Dopod 818, etc.)
7e42 and 1fc232e
It seems that the two locations change with the language, rather than the brand. Older ROM versions have different locations.
Could anybody provide the locations of other language versions for the reference of those who need them?
Please note that some have reported success in creating the BigStorage by replacing the bytes at the first location only, leaving the second location unchanged.
For those who need a summary of the steps:
1. Dump your original ROM to SD card. (romupdate.exe and ntrw.exe)
2. Edit your own ROM. (hex editor)
i.e. search for the two locations in the ROM with "02 00 00 80 00 20" and replace 80 00 with b8 01.
3. Write the edited ROM back to the Magician and hard reset your machine. (ntrw.exe)
That's it!
- no more downloading of others' BigStorage ROMs
- no need to replace the first 416 bytes
- no more unsolicited splash screens
- a simple, safe, do-it-yourself method to create your own BigStorage based on whatever ROM version you already have or upgraded.
Thank you so much.
I have an Italian ROM. Can anybody give me some help?
Talents,
A good assurance for people....
Nice one
I put this together with bits taken from this forum
Does anyone know if this will work for older versions of the ROM (i.e. 1.03 or 1.06)? I still am having problems with the GPRS with the newer ROMs so I would like to apply the BigStorage to older ROMs.
Thank you,
F
I used this method on the 1.03 wwe version and it is working perfectly. I used the same method as described. Found the two locations made the changes etc. and all is well.
Thanks, I will try it out
NTRW PROBLEM
Everytime i try to run NTRW
i get the following message
USAGE: NTRW FILE DRIVE:
and it doesn't create a file
what am i doing wrong?
Re: NTRW PROBLEM
micha said:
Everytime i try to run NTRW
i get the following message
USAGE: NTRW FILE DRIVE:
and it doesn't create a file
what am i doing wrong?
Click to expand...
Click to collapse
You seem to have an old version of ntrw. Get the latest one (2.0) from this forum's FTP server.
Cheers
Daniel
Worked for me with French_11202_125_11210 8)
The first reboot took more than 5 min though.
glad to know that it works on your French ROM.
We should have warned everyone to be patient with the first boot up after upgrading. It takes 5-10 minutes to format the BigStorage, with the screen apparently "stuck" at the splash screen.
I've found a .nb1 file for BigStorage on the ftp server of this forum. I think it's the BigStorage version for ROM 1.12. Is it possible to use that file and enable BigStorage without a cardreader?
For example, when you execute the upgrade program an TEMP directory is created with a bunch of files in it. If I were to copy those files (which also include some .nb1 files) and replace one of those with the one I found on the ftp, would that give me BigStorage?
Welrogie,
I was actually thinking the same thing as you...
Although if it were possible, I'm sure someone would have posted somewhere on this site anyway (?)
BigStorager work great for 1.12 FR ROM
many thanks
your post is excellent, did it to a 1.12 and no probs, please just check the pdf instruction sheet as it mentions 2 different file names, 1 to download from SD card and another to upload, maybe I misread it but I just uploaded the modified version of the file I downloaded and it all went swimmingly. cheers
Just carrying out a few 'test' searches on rom files to locate the necessary information...
On the 3 that I have performed the search on, i seem to find the bytes ok but the locations never matches the one stated by Talents and others. Does it matter that they appear in different locations than the ones specified?
Thanks.
Hi all, my english is very bad - sorry for that!
I want the 16mb Paging Pool on my O2 German Rom, how can i chance ist?
Or can make this somebody?
Please - Please help me, please
Hi,
i tested it with the newest German O2 ROM. You must install the O2 ROM on youre device and backup the OS ROM with awizard (start command line under windows when youre device is connected, start awizard, at first option e then u and then b). After this you can edit the nk.nbf file with a hexeditor how Yunshen in his thread wrote http://forum.xda-developers.com/viewtopic.php?t=63505 and Hard Reset the device.
My Storage was after this only 40MB instead of 44MB before. I have not testet my Neo more with this rom because i want use a newer ROM with Aku2.3 and the German O2 have only Aku20.
thanks, i have do this, but it create a nba file not a nbf file, how can i change ist without damage my device
Edit:
I have download the original O2 Update and extrected the *.exe, the was the nk.nbf, but i can´t find the 03EC8AE with the hexeditor???
Can you tell us where to find the right Line in the Hex Code ?
The Line given in your Link is for AKU 2.3 and does not exist in the official O2 Rom (or i did not find it)
Thanks !!!
Hello,
i have used the search/goto function from my HexEditor and have found the adress.
from Yunchen
The value at address 03EC8AE defines the size of page pool, by default it is "C0 00". Changing it to "00 01" can increase the size of page pool from 12MB to 16 MB.
Click to expand...
Click to collapse
http://forum.xda-developers.com/viewtopic.php?t=63505
After recover and hard reset my Neo i have 4 MB less then before. How stable the system runs i cant say. It was very fast but i have testet then other ROMs and have now the orig O2 ROM without pagingpool in use because i have not enough time this days for testing.
first to post here
as i saw that HP rx1950 has got a Windows Mobile 6.1 Custom ROM..
but my device doesn't have the same language as the custom ROM pack, so i can't update it...
i've searched through the forum and the internet... there had been some ROMs posted,, but the links were dead already
anyone who still have this device, hope u can kindly extract the Stock WM5 English ROM for me
thanks a lot for your help, and sorry for my poor english..
martin
Just upgrade you phone, language of your current ROM doesn't make a difference .
Here is a kitchen ROM of WM 6.1 Classic for rx1950 from xda members Victory144 and Guifort.
http://www.mediafire.com/file/nna2yo92q2beiik/Flasher_Hp_Ipaq_rx1950_ENG_WM6.1.rar
I agree with tomcug. It should flash your ROM to WM 6.1 regardless of the language. You need to use it on a Windows XP computer with ActiveSync installed though...
Here is the original thread for more help:
http://forum.xda-developers.com/showthread.php?t=510764
RumoredNow said:
Here is a kitchen ROM of WM 6.1 Classic for rx1950 from xda members Victory144 and Guifort.
http://www.mediafire.com/file/nna2yo92q2beiik/Flasher_Hp_Ipaq_rx1950_ENG_WM6.1.rar
I agree with tomcug. It should flash your ROM to WM 6.1 regardless of the language. You need to use it on a Windows XP computer with ActiveSync installed though...
Here is the original thread for more help:
http://forum.xda-developers.com/showthread.php?t=510764
Click to expand...
Click to collapse
I've read the post.. there're two methods to flash the WM6.1 ROM, by SD or through USB.. but i failed with a message "Wrong Image" after cloning the image to SD card, and the lauguage problem while flashing through USB with stock update utility (that maybe some lock by HP on language. mine is Chinese Traditional, but the update image is English..)
therefore, that'll be fine if the English Stock ROM is available.. btw, is there any program to flash that bypass the lock??
or how to change the language option of the ROM generated by kitchen?
i am not very familiar to configure the kitchen
thank you for your help
Here is a very technical discussion of 2 methods for installing different language ROMs.
http://www.tweaks2k2.com/How_to/39xxROMlang.htm
You will need a HexEditor:
http://www.mediafire.com/file/6r8ffn1fq3bh9mu/uedit32.exe
And a mtty program:
http://www.mediafire.com/file/7srppxvnr728ime/mtty11a.exe
BUT - at the end of method two when the author says - At the terminal screen type "lnb nk.nb0" at the USB prompt. (That means: Load the ROM nk.nb0)
INSTEAD - use the command "l nk.nb0"
That may be a typo - or the difference in mtty versions used by myself and the author...
thank you for your suggestion, i see that the ROM file structure of 3950 is a bit similar to rx1950, so i will try to change that
i've got the kitchen and the whole system downloaded from the site u suggested, but i just can't figure out how to change the language code of the output file while building the ROM , so that i can fool the ROM Update Utility and flash the ROM to my PDA..
wt's Build_XIP?
do u hv any suggestions? thx again
martin
Build_XIP... I think that is something for a different device. confused
_____
The following is based on research and guesswork. I make NO CLAIM that it will work and not damage your device... TRY AT YOUR OWN RISK.
_____
If my experiments with mtty and my reading of the How to install a different language tutorial are correct, all you need is:
mtty11a.exe to send commands to your iPAQ.
The English WM 6.1 ROM Image (CEOS.nbf) you want to upgrade to.
And Uedit32 to edit the ROM.
Put all 3 files in the same folder. It will be easiest to create a new folder on desktop with whatever name you like.
_____
This is for a Windows XP computer. That is what you have, yes?
First be sure to BACKUP your iPAQ and put all files in a safe place on your PC.
Next - remove the battery and any SD cards from the rx1950. Wait at least 10 minutes for the internal battery to discharge so that the iPAQ is cleared of all memory except the ROM you want to overwrite.
_____
Now we want to save the Chinese ROM you have so we can restore it if anything goes wrong. Best to be safe, yes?
Do you have a spare SD card at least 256mb? If not, use the one you normally have in rx1950... See why we saved all your files first?
Kill ActiveSync by opening Task Manager>Processes. Look on the list for wcesmgr.exe and wcescomm.exe. Highlight each one and click on End Process. With ActiveSync killed you can now "talk" to iPAQ with mtty.
DO NOT PUT IN THE BATTERY. Attach the iPAQ to the PC with the USB cable AND the AC Power Cord. Turn the iPAQ on and manually enter Bootloader Mode. (Google tells me for rx1950 you - press following buttons simultanously
Contacts + Mail + Reset for as long as your PDA boots)
Insert the SD card where you want to save the Chinese WM 5 ROM.
Go to the folder where you saved the 3 files you need and double click mtty11a.exe. That opens a box called "Open port setting." Scroll down the list in "Port" and look for \\\WCEUSBSH001. That is the port you want. I noticed that the end number (001) changes with each use of mtty. Never mind the number so much, \\\WCEUSBSH00x is what you want - that is your iPAQ. Select that port and click on the "OK" button.
It should open a command terminal (white window). Press enter until USB> appears in the window. I only needed to press enter once, but some tutorials say keep pressing until it appears. (?)
At the USB> prompt type r2SD and press enter. This will have mtty command your iPAQ to dump your ROM image onto the SD Card as RAW DATA. Wait for the progress bars on iPAQ screen to finish and you get a completed message.
Save this SD card in a safe place. This is your Recovery Image to restore the iPAQ back to the ROM you started with. The card is not formatted in a way that you can open and read with Windows XP so do not try putting it in a card reader right now - XP will want to format it and we don't want that to happen.
_____
If you need to recover your iPAQ at any point...
Unplug the iPAQ from PC and AC power cords. Remove battery and SD card. Wait 10 minutes to reset memory.
Insert SD card with Recovery Image. Plug in the AC power cord. Turn on iPAQ. Enter Bootloader Mode. iPAQ will see the Image on the SD card and offer you the option to Flash your ROM or exit. Pick the option to flash your ROM.
The iPAQ will Hard Reset after it flashes and then you can remove the SD card with the Recovery Image and do a Restore from the files you saved on PC and/or your regular SD card and the Backup we did at the beginning of this experiment.
_____
Now that we are safe, we can start to try and change the English WM 6.1 ROM so you can flash it to your iPAQ.
I read the "How to install a different language" tutorial quite a few times. Here are my calculations for what we need:
Original checksum
minus HexSum of ENG (45+4E+47 = DA)
equals change value
or
ECEC
-DA
= EC12
HexSum of CHT (43+48+54 = DF)
plus change value
equals new checksum
or
DF
+ EC12
= ECF1
Then that means we change ENG (code for English) to CHT (code for Chinese Traditional) and also change the Checksum from ECEC to ECF1 and we can get the ENG ROM to load on your CHT rx1950.
_____
Now you need to edit the ROM. Go to the folder where you saved the 3 files you need and double click uedit32.exe to open the Hex Editor. Click on "File>Open" and navigate to the folder where you put your files. Select CEOS.nbf and Uedit will open it.
10 lines down (line 00000090h) the file says "..........ENG.hp"
Next line 000000a0h says "iPAQ rx1950...."
This may or may not be the place to change - But I believe it is the right spot to tell any updater program what iPAQ version to update...
Scroll down to line 00000ea0h where it says "..........ECEC^a"
Next line 00000eb0h says ".e^a..........."
I believe that is the ROM Checksum and then an order to verify the checksum from iPAQ...
Scrolling down farther to line 00001ec0h it says " iPAQ rx1950..6."
Next line 00001ed0h says "00.00 ENG......."
I believe this tells any updater program what version is being flashed. But it may need to be changed...
So my best guess is:
At the first spot ENG is listed (line 00000090h) you need to edit ENG to CHT
At line 00000ea0h you need to edit ECEC to ECF1
Make these changes with Uedit32 and then click "File>Save as" and label the file "Test.nbf" saving it to the folder we have been using. (Note that mtty and any files you want to flash MUST be in the same directory.)
In Uedit32 click on "File>Close All Files" and exit Uedit32. Now you have 2 versions of the ROM in your folder...
_____
mtty still open and iPAQ connected?
If not - connect iPAQ as above (no battery or SD card, wait ten minutes, connect with USB and AC power, put rx1950 into Bootloader Mode). Open mtty. Navigate to your port and get a USB> prompt.
At USB> type in "l Test.nbf" (no quotes) and it should try to flash the edited ROM to rx1950.
If it was edited wrong you will get an error message something like "Header request time out."
_____
If it doesn't work that way it shouldn't affect your iPAQ and a Hard Reset should be all you need to restore your system. If that fails we have the SD card Restore Image we made earlier.
Delete the Test.nbf file from the folder and try editing CEOS.nbf again.
Try changing the Checksum and the second time ENG is listed:
At line 00000ea0h you need to edit ECEC to ECF1
At line 00001ed0h you need to edit ENG to CHT
Save as Test.nbf and have mtty "l Test.nbf" again
If it fails, delete Test.nbf
The last try would be by editing the Checksum and both times ENG is listed:
At line 00000090h you need to edit ENG to CHT
At line 00000ea0h you need to edit ECEC to ECF1
At line 00001ed0h you need to edit ENG to CHT
Save as Test.nbf and have mtty "l Test.nbf" again
_____
I hope one of these works for you. Please let us know what happens.
Thanks.
thanks for your suggestions very much!!
but i get the File CRC checksum error when using the stock update utility,
and through mtty.exe, it shows "Header Request Time out" also, in both i changed the first mentioned "ENG" to "CHT", second time and both times ...
all failed
would there any way to flash it through SD (by creating a suitable .nb0 file?) ?
hurray!!!!
i've cheated the HP ROM Update Utility (RUU) to accept to update an English ROM to a Chinese machine !!!
i use WinHex to replace the ENG with CHT, CHT with ENG,, and it's OK now!!!!
anyway, thank you very very very much for your sincere help!!!!!!!!!
Really marvellous!!!
HUZZAH and Congratulations martinhy!!!!!
I'm glad you got it to work.
I was at the keyboard for about 4 hours playing with the files last night and was afraid that my guess was wrong (as it turns out it was). So I'm really surprised and pleased that you solved it.
You just edited the RUU??? All other files in the kitchen folder stay the same???
Cause I need to cheat it and make it change from rx1950 to rx3115... I'll be trying your method soon.
it's troublesome to change ,, or i can say, cheat, the ROM file (.nbf) itself, coz it has checksum .. and the algorithm may be difficult to guess, and changing with different versions of iPAQ,
but the RUU itself doesn't have the integrity check, so it's cheatable
anyway, thx for your effort to help me
i can't be sure whether your guess is wrong, coz when i download the stock ROM, i.e. "l CEOS.nbf" to the iPAQ, through mtty, i also says "header request timed out"..
so i can't be sure whether there's problem for the way to edit the ROM, or the iPAQ doesn't support such mtty method...
or........
. becoz i'm a newbie, maybe i've got something wrong though...
*sigh*
When I try to change the RUU from rx1950 to rx3115 and run the rx1950 upgrade kitchen I get the CRC error...
When I try to change the .nbf and put it in with a rx3115 update package I get 244 Error (model ID)...
When I pull on my hair it comes out in big chunks...
I think I need a lot more study and a new toolkit...
that's maybe quite a challenge to flash ROMs from other models rather than language... both models are not compatible
martinhy said:
hurray!!!!
i've cheated the HP ROM Update Utility (RUU) to accept to update an English ROM to a Chinese machine !!!
i use WinHex to replace the ENG with CHT, CHT with ENG,, and it's OK now!!!!
anyway, thank you very very very much for your sincere help!!!!!!!!!
Really marvellous!!!
Click to expand...
Click to collapse
can you help me do that ? thanks