Database Info

how to unlock rom on treo 750v - made by htc

we are trying to unlock and or dump the rom on the treo 750v. this is a newly released treo made by htc. the treo has an awesome feature called theeaded sms which does chat style sms.
we have tried the grab it program that was on this site with no luck.
does anyone no of a way to get this done? does any have any ideas of why the grab it program doesn't work. does anyone want to help?
thanks, cody

So far we've manage to get someone to try the grab_it tool from
http://forum.xda-developers.com/showthread.php?t=238945
But they are getting a write error. I assumed since the Treo 750v uses a mini-sd card the appropriate version of grab_it would be grab_it_128_minisd_468.exe. I'm trying to get someone to try the grab_it_128_150.exe version to see if that works, since that is the version BeyondTheTech used to extract the Treo 700w rom. The 700w uses a regular sd card though.
I asked the guy that tried grab_it_128_minisd_468.exe what the storage card folder name was set to and they verified that the registry was set to "Storage Card". So it's unclear to me why they are getting a write error. Maybe the minisd version expects something else? The card used was a 2GB minisd so it should have plenty of room for the rom.
Anyone familiar with grab_it know what is different about the minisd version? I read through the thread but it wasn't clear to me what the difference is.

Ok, I'm the one who's run the grabit tool on a 750v
It runs Ok and creates a 128Mb dump.bin file but the file appears to be mostly empty. If I zip the file up it only takes 147Kb which seems to confirm this. Am I doing something wrong or is it a bug in the tool

i have hope 750v user and appreciate your efforts

750v_User said:
Ok, I'm the one who's run the grabit tool on a 750v
It runs Ok and creates a 128Mb dump.bin file but the file appears to be mostly empty. If I zip the file up it only takes 147Kb which seems to confirm this. Am I doing something wrong or is it a bug in the tool
Click to expand...
Click to collapse
Can you upload the bin file please. I think someone here may be able to figure this out by looking at the contents of it.

If anyone has a source for a unlocked 750v let me know i really need one.

File and registry dump.
750v_User said:
Ok, I'm the one who's run the grabit tool on a 750v
It runs Ok and creates a 128Mb dump.bin file but the file appears to be mostly empty. If I zip the file up it only takes 147Kb which seems to confirm this. Am I doing something wrong or is it a bug in the tool
Click to expand...
Click to collapse
Hi, please can you do me favor? I have idea which can help us get SMS threading application and other palm features as well. If isn't possible dump ROM in this moment can you download Total Commander (freeware) http://www.ghisler.com/pocketpc.htm and do following.
1, Create foder on memory card and go to the Total commander.
2, go to the root of your device and copy to SD everything what is possible specially from Windows folder and Program Files (rest will be fine as well)
- this will take some time and in case of problem with file just skip that file.
3, When this will be done please go into the "\\" in the root and then to "registry"
4, now select registry tree one by one and copy again to card.
This will give us most probably files which will be required for hack and registry keys which will be required as well i think.
Thank you very much for your help.

Here's a zipped up copy of the dump.bin file, hope it helps

I extracted that dump.bin and it looks like a 256 byte block of data that is repeated at each 16 meg boundary 8 times.
Does this ring any bells to the experts?
The only readable text is "CHEETAH IPL EVT".

wow! that's great!

I don't have a Cheetah, but there's some info on the hermes forum that might be of interest to you:
http://forum.xda-developers.com/showpost.php?p=1019171&postcount=22

750v_User please try this program to extract the rom image.
unzip and copy TestDump.exe to your device and run it. In the "Path to file" enter the path for the dump file (i.e. \Storage Card\dump.bin). In the "Mbytes to dump" enter 128. Then press the "Dump" button. It should make a dump of the ROM file.
Zip it up and upload here. Thanks!

pof said:
I don't have a Cheetah, but there's some info on the hermes forum that might be of interest to you:
http://forum.xda-developers.com/showpost.php?p=1019171&postcount=22
Click to expand...
Click to collapse
Thanks. That post appears to be for updating the rom. I wonder if there is some key combo like this to extract the rom.

hannip said:
Thanks. That post appears to be for updating the rom. I wonder if there is some key combo like this to extract the rom.
Click to expand...
Click to collapse
Based on the Hermes experience, there's no knonw way yet to extract it in a form that after is flashable on another device, but you can follow these instructions to dump some parts:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
You can also use pmemdump to copy some of the ROM contents to a file. Once you've dumped SPL you can search for strings on it and you'll see the bootloader commands.
HTC has removed all the "d2s, s2d, r2sd..." and like commands in the hermes bootloader, probably you are lucky and you have some command to dump the rom to sd in your bootloader.
Hope that helps

The ROM dump // extract discussion is over my head...one question though has anyone sorted out how to unlock this device?

codyppc said:
we are trying to unlock and or dump the rom on the treo 750v. this is a newly released treo made by htc. the treo has an awesome feature called theeaded sms which does chat style sms.
we have tried the grab it program that was on this site with no luck.
does anyone no of a way to get this done? does any have any ideas of why the grab it program doesn't work. does anyone want to help?
thanks, cody
Click to expand...
Click to collapse
im just a noob but cant we use the combination of StyleTap and AdvBackup to create a complete rom backup of the treo 750v and then grab what we want from that?
will that work????
just tryin to help........

what if someone get the .nbh file..can that be extracted??

750v ROM dump uploaded
I put a rom dump from the TestDump.exe tool on ftp.xda-developers.com. userid: xdaupload pw: xda
file: treo750v_dump_rom.zip
I used the dumprom tool to extract files, but it looks like it's only extracting the first rom section it finds and stops. Can one of the experts take a look at the dump and see if you can extract the other sections please.
Thanks.

What are you getting from the first rom section?
Sounds weird... was the dump complete?

It looked like a bunch of system files. The kernel, img.dll, filesystem drivers and the like.
There is 59MB of data in the dump so there has to be more stuff in there.

Extended ROM

hey Does any one have any tools to unlock the Extended Rom for my Magician (O2 xda2 mini), i wanna install some cabs in there pls do help.

1.Download Resco Explorer or Total Commander (cos you will need either these 2 program to enable "Reveal all files"
2. To unhide the Extended ROM, after you reveal all files, go to your File Explorer (Start, Programs, File Explorer)
3. Using the File Explorer, go to Windows folder and find this file called LoadVDisk.exe and then just run the file
4. Next, using File Explorer again, and go to \My Device and you should see the Extended ROM folder
5. Click on the Extended ROM folder and find the necessary cab file and click on it..
6. soft reset
also the search function is also quite useful. try it once in a while...

hey thanks for the advice will check on it, thank you.

hey man it works so how do i place another program in ext rom and will it be installed everytime i hard reset, and yeah since its unlocked how do i lock it again. than for the help hoping for a reply soon.

u cant place any new programs in the ext ROM. that ROM is supposed to be inaccessible to u. ur ext ROM should be hidden after the soft reset. check it!

You may not be able to place anything in the ExtROM till you unlock it. You have only "unhide" the ROM by running that utility. Till you unlock it you can only read the contents not write into it....

so tell me how do i unlock the ext-Rom of a magician, has anyone got any idea, pls let me know if there are any possibilities, i want to unlock the ext. rom of my O2 xda2 mini, pls help.

There are more possibilities read its content, (unhiding it). One possibility to hard reset it (pressing the Power button while pushing RESET). This will erase every data+programs from the device.
When the 1st boot finishes the ExtROM cabs are beginning to install. You have to Soft Reset the device (pushing RESET) to interrupt it. No cabs will be installed and ExtROM will be readable.

asinan said:
so tell me how do i unlock the ext-Rom of a magician, has anyone got any idea, pls let me know if there are any possibilities, i want to unlock the ext. rom of my O2 xda2 mini, pls help.
Click to expand...
Click to collapse
There are no unlockers for Magician AFAIK. But now most of the people go for big storage hack with which you get 27MB of extra space for storage. Put ExtROM on the SD card. Lots of material avilable on this forum for doing so..

what is the advantage of having a big storage other than ext.Rom, if i need to can i reverse the process back to normal.

The term “Big Storage” in a nut shell is the process of modifying the built in ROM file of the Magician and deleting its “Extended ROM” contents which frees up approx 20Mb of space. This new space or “Storage” can be used to install 3rd party apps etc and won’t be deleted after a hard reset. The only way to restore the contents is by “Flashing” the ROM again with a new complete ROM File. - excerpt from ampda guide

so what is the latest rom with the big storage for a magician. i surely would love to make a switch over. thank you.

The latest and last ROM for the Magician is 1.13 with Radio 1.12. Actually you can convert any ROM to BS.

MiniWeather for the VOX

Hey guys... just released a new chome weather version that should work with the VOX also. Can somebody give it a shot ?

I can't seem to get it to install,
Installation was unsuccessful. The program or setting cannot be installed because it does not have sufficient system permissions.
I'm using version 3 of Zeeshee ROM.
Cheers,

Same for me! Same rom. Btw, both weather progs delete my clock icon and blackscreen is not possible to load. (mini with dr.gonzo 6.1 rom)

Everything works!
Extract from cab all files for Windows directory and place them into the device.
Delete this files from cab and save cab.
Modify cab working.

Works brilliant .. Thanks a lot keep it up ... i like the background on the pictures what you post there . it will be great if you send it as well . cheers

I'm being stupid here.
I still can't get it to work.
Can someone upload the modified cab please.
Thank you.

Unzip attached file.
Copy files from 'Windows' (archive) to 'Windows' (device).
Copy cab to device and run it.
Reboot.
Enjoy!

Excellent!
Thank you for posting.
Regards,

Anyone have a screen shot of what it looks like?

TabletGuru said:
Unzip attached file.
Copy files from 'Windows' (archive) to 'Windows' (device).
Copy cab to device and run it.
Reboot.
Enjoy!
Click to expand...
Click to collapse
Thank you it works perfect now.

Got it to work, sort of, so please help.
weather.yahoo.com gives me NLXX001 as code
Doesn't seem to do anything
(And so is c>f not working)
Are we still using weather.yahoo.com as source?

I had already installed the original MiniWeather on my on my vox (Orange E650) and all was OK except that in portrait mode the weather image didn't show on the clock tab whereas it did in portrait mode. So I decided to install the vox version to see if it would be fixed.
Unfortunately I've found that the files can't be copied over to the device's Windows folder because Resco says they already there as read-only files in ROM and therefore cannot be overwritten. So after installing the 1.0b CAB I get the following error when I initially select options:
Unknown command: "nu=timestamp"
Line 13(\program files\nrg\chomeminiweather\SetOptions.mscr):nu=TimeStamp()
Is there anything that can be done? Would the clock/weather Image have been fixed anyway? If not I'll revert to the previous version
Thanks and nice program !!!

can someoene post a home screen to show how this should look. Its messed up on mine i believe I get 2 panels - the first one works but the image is messed up. The second one says "forecast" but in there it just says "push centre button to update, push right softkey marked options to set your options"
I had trouble copying the two chome files to the windows directory - it said I didnt have permission to copy them.
can anyone assist ?

Frottage........ It sounds like you've had a similar problem to mine above.
If you can't copy the files over the install doesn't work properly.
I've reverted to the non-Vox version and all now seems OK on my Orange E650 with Dr.Gonzo's 5.2.19195 Rom

Try using the Resco Explorer trial to copy them across. It's because the files it's trying to replace are in ROM. Resco worked on my Dr. Gonzo E650.

How to use ROM Extractor ?

I would like to modify shellres.dll.040C.mui (french WM6.0). So, I use first ROM Extractor. I enter \windows\shellres.dll.040C.mui in the field "Save to", and ... when I boot again, the device is frozen on the WM welcome page.
I made the same operation a couple of weeks ago but I was thinking that I made an error when editing the file then copy it on the device.
In fact, the problem seems due to the use of ROM Extractor. Copying the file in \windows seems not so good...
So, where should the file be saved ?

i already asnwered before, get a shellress file found somewhere in the forum(will give you a link if found) and just edit it, as its teh same for almost all the devices, then just cab it up and installit in your device

Ok, but I need a french version and ...
... and, for my understanding, I would like to know how to do that with the ROM extractor. Where should the file be saved ?

Help ! Where the file must be extracted ?
Which value to enter in the field "Save to" ?
1. "\"
2. "\windows"
3. "\shellres.dll.040C.mui"
4. "\windows\shellres.dll.040C.mui"
If I choose option 4 (the most logical for me), my device cannot boot (it's frozen on the Windows welcome page) even if I don't modify the file.
040C is a french version.
Anyway, if I get the english version as proposed, where the file must be installed ?

[Q] HP rx1950 English ROM

first to post here
as i saw that HP rx1950 has got a Windows Mobile 6.1 Custom ROM..
but my device doesn't have the same language as the custom ROM pack, so i can't update it...
i've searched through the forum and the internet... there had been some ROMs posted,, but the links were dead already
anyone who still have this device, hope u can kindly extract the Stock WM5 English ROM for me
thanks a lot for your help, and sorry for my poor english..
martin

Just upgrade you phone, language of your current ROM doesn't make a difference .

Here is a kitchen ROM of WM 6.1 Classic for rx1950 from xda members Victory144 and Guifort.
http://www.mediafire.com/file/nna2yo92q2beiik/Flasher_Hp_Ipaq_rx1950_ENG_WM6.1.rar
I agree with tomcug. It should flash your ROM to WM 6.1 regardless of the language. You need to use it on a Windows XP computer with ActiveSync installed though...
Here is the original thread for more help:
http://forum.xda-developers.com/showthread.php?t=510764

RumoredNow said:
Here is a kitchen ROM of WM 6.1 Classic for rx1950 from xda members Victory144 and Guifort.
http://www.mediafire.com/file/nna2yo92q2beiik/Flasher_Hp_Ipaq_rx1950_ENG_WM6.1.rar
I agree with tomcug. It should flash your ROM to WM 6.1 regardless of the language. You need to use it on a Windows XP computer with ActiveSync installed though...
Here is the original thread for more help:
http://forum.xda-developers.com/showthread.php?t=510764
Click to expand...
Click to collapse
I've read the post.. there're two methods to flash the WM6.1 ROM, by SD or through USB.. but i failed with a message "Wrong Image" after cloning the image to SD card, and the lauguage problem while flashing through USB with stock update utility (that maybe some lock by HP on language. mine is Chinese Traditional, but the update image is English..)
therefore, that'll be fine if the English Stock ROM is available.. btw, is there any program to flash that bypass the lock??
or how to change the language option of the ROM generated by kitchen?
i am not very familiar to configure the kitchen
thank you for your help

Here is a very technical discussion of 2 methods for installing different language ROMs.
http://www.tweaks2k2.com/How_to/39xxROMlang.htm
You will need a HexEditor:
http://www.mediafire.com/file/6r8ffn1fq3bh9mu/uedit32.exe
And a mtty program:
http://www.mediafire.com/file/7srppxvnr728ime/mtty11a.exe
BUT - at the end of method two when the author says - At the terminal screen type "lnb nk.nb0" at the USB prompt. (That means: Load the ROM nk.nb0)
INSTEAD - use the command "l nk.nb0"
That may be a typo - or the difference in mtty versions used by myself and the author...

thank you for your suggestion, i see that the ROM file structure of 3950 is a bit similar to rx1950, so i will try to change that
i've got the kitchen and the whole system downloaded from the site u suggested, but i just can't figure out how to change the language code of the output file while building the ROM , so that i can fool the ROM Update Utility and flash the ROM to my PDA..
wt's Build_XIP?
do u hv any suggestions? thx again
martin

Build_XIP... I think that is something for a different device. confused
_____
The following is based on research and guesswork. I make NO CLAIM that it will work and not damage your device... TRY AT YOUR OWN RISK.
_____
If my experiments with mtty and my reading of the How to install a different language tutorial are correct, all you need is:
mtty11a.exe to send commands to your iPAQ.
The English WM 6.1 ROM Image (CEOS.nbf) you want to upgrade to.
And Uedit32 to edit the ROM.
Put all 3 files in the same folder. It will be easiest to create a new folder on desktop with whatever name you like.
_____
This is for a Windows XP computer. That is what you have, yes?
First be sure to BACKUP your iPAQ and put all files in a safe place on your PC.
Next - remove the battery and any SD cards from the rx1950. Wait at least 10 minutes for the internal battery to discharge so that the iPAQ is cleared of all memory except the ROM you want to overwrite.
_____
Now we want to save the Chinese ROM you have so we can restore it if anything goes wrong. Best to be safe, yes?
Do you have a spare SD card at least 256mb? If not, use the one you normally have in rx1950... See why we saved all your files first?
Kill ActiveSync by opening Task Manager>Processes. Look on the list for wcesmgr.exe and wcescomm.exe. Highlight each one and click on End Process. With ActiveSync killed you can now "talk" to iPAQ with mtty.
DO NOT PUT IN THE BATTERY. Attach the iPAQ to the PC with the USB cable AND the AC Power Cord. Turn the iPAQ on and manually enter Bootloader Mode. (Google tells me for rx1950 you - press following buttons simultanously
Contacts + Mail + Reset for as long as your PDA boots)
Insert the SD card where you want to save the Chinese WM 5 ROM.
Go to the folder where you saved the 3 files you need and double click mtty11a.exe. That opens a box called "Open port setting." Scroll down the list in "Port" and look for \\\WCEUSBSH001. That is the port you want. I noticed that the end number (001) changes with each use of mtty. Never mind the number so much, \\\WCEUSBSH00x is what you want - that is your iPAQ. Select that port and click on the "OK" button.
It should open a command terminal (white window). Press enter until USB> appears in the window. I only needed to press enter once, but some tutorials say keep pressing until it appears. (?)
At the USB> prompt type r2SD and press enter. This will have mtty command your iPAQ to dump your ROM image onto the SD Card as RAW DATA. Wait for the progress bars on iPAQ screen to finish and you get a completed message.
Save this SD card in a safe place. This is your Recovery Image to restore the iPAQ back to the ROM you started with. The card is not formatted in a way that you can open and read with Windows XP so do not try putting it in a card reader right now - XP will want to format it and we don't want that to happen.
_____
If you need to recover your iPAQ at any point...
Unplug the iPAQ from PC and AC power cords. Remove battery and SD card. Wait 10 minutes to reset memory.
Insert SD card with Recovery Image. Plug in the AC power cord. Turn on iPAQ. Enter Bootloader Mode. iPAQ will see the Image on the SD card and offer you the option to Flash your ROM or exit. Pick the option to flash your ROM.
The iPAQ will Hard Reset after it flashes and then you can remove the SD card with the Recovery Image and do a Restore from the files you saved on PC and/or your regular SD card and the Backup we did at the beginning of this experiment.
_____
Now that we are safe, we can start to try and change the English WM 6.1 ROM so you can flash it to your iPAQ.
I read the "How to install a different language" tutorial quite a few times. Here are my calculations for what we need:
Original checksum
minus HexSum of ENG (45+4E+47 = DA)
equals change value
or
ECEC
-DA
= EC12
HexSum of CHT (43+48+54 = DF)
plus change value
equals new checksum
or
DF
+ EC12
= ECF1
Then that means we change ENG (code for English) to CHT (code for Chinese Traditional) and also change the Checksum from ECEC to ECF1 and we can get the ENG ROM to load on your CHT rx1950.
_____
Now you need to edit the ROM. Go to the folder where you saved the 3 files you need and double click uedit32.exe to open the Hex Editor. Click on "File>Open" and navigate to the folder where you put your files. Select CEOS.nbf and Uedit will open it.
10 lines down (line 00000090h) the file says "..........ENG.hp"
Next line 000000a0h says "iPAQ rx1950...."
This may or may not be the place to change - But I believe it is the right spot to tell any updater program what iPAQ version to update...
Scroll down to line 00000ea0h where it says "..........ECEC^a"
Next line 00000eb0h says ".e^a..........."
I believe that is the ROM Checksum and then an order to verify the checksum from iPAQ...
Scrolling down farther to line 00001ec0h it says " iPAQ rx1950..6."
Next line 00001ed0h says "00.00 ENG......."
I believe this tells any updater program what version is being flashed. But it may need to be changed...
So my best guess is:
At the first spot ENG is listed (line 00000090h) you need to edit ENG to CHT
At line 00000ea0h you need to edit ECEC to ECF1
Make these changes with Uedit32 and then click "File>Save as" and label the file "Test.nbf" saving it to the folder we have been using. (Note that mtty and any files you want to flash MUST be in the same directory.)
In Uedit32 click on "File>Close All Files" and exit Uedit32. Now you have 2 versions of the ROM in your folder...
_____
mtty still open and iPAQ connected?
If not - connect iPAQ as above (no battery or SD card, wait ten minutes, connect with USB and AC power, put rx1950 into Bootloader Mode). Open mtty. Navigate to your port and get a USB> prompt.
At USB> type in "l Test.nbf" (no quotes) and it should try to flash the edited ROM to rx1950.
If it was edited wrong you will get an error message something like "Header request time out."
_____
If it doesn't work that way it shouldn't affect your iPAQ and a Hard Reset should be all you need to restore your system. If that fails we have the SD card Restore Image we made earlier.
Delete the Test.nbf file from the folder and try editing CEOS.nbf again.
Try changing the Checksum and the second time ENG is listed:
At line 00000ea0h you need to edit ECEC to ECF1
At line 00001ed0h you need to edit ENG to CHT
Save as Test.nbf and have mtty "l Test.nbf" again
If it fails, delete Test.nbf
The last try would be by editing the Checksum and both times ENG is listed:
At line 00000090h you need to edit ENG to CHT
At line 00000ea0h you need to edit ECEC to ECF1
At line 00001ed0h you need to edit ENG to CHT
Save as Test.nbf and have mtty "l Test.nbf" again
_____
I hope one of these works for you. Please let us know what happens.
Thanks.

thanks for your suggestions very much!!
but i get the File CRC checksum error when using the stock update utility,
and through mtty.exe, it shows "Header Request Time out" also, in both i changed the first mentioned "ENG" to "CHT", second time and both times ...
all failed
would there any way to flash it through SD (by creating a suitable .nb0 file?) ?

hurray!!!!
i've cheated the HP ROM Update Utility (RUU) to accept to update an English ROM to a Chinese machine !!!
i use WinHex to replace the ENG with CHT, CHT with ENG,, and it's OK now!!!!
anyway, thank you very very very much for your sincere help!!!!!!!!!
Really marvellous!!!

HUZZAH and Congratulations martinhy!!!!!
I'm glad you got it to work.
I was at the keyboard for about 4 hours playing with the files last night and was afraid that my guess was wrong (as it turns out it was). So I'm really surprised and pleased that you solved it.
You just edited the RUU??? All other files in the kitchen folder stay the same???
Cause I need to cheat it and make it change from rx1950 to rx3115... I'll be trying your method soon.

it's troublesome to change ,, or i can say, cheat, the ROM file (.nbf) itself, coz it has checksum .. and the algorithm may be difficult to guess, and changing with different versions of iPAQ,
but the RUU itself doesn't have the integrity check, so it's cheatable
anyway, thx for your effort to help me

i can't be sure whether your guess is wrong, coz when i download the stock ROM, i.e. "l CEOS.nbf" to the iPAQ, through mtty, i also says "header request timed out"..
so i can't be sure whether there's problem for the way to edit the ROM, or the iPAQ doesn't support such mtty method...
or........
. becoz i'm a newbie, maybe i've got something wrong though...

*sigh*
When I try to change the RUU from rx1950 to rx3115 and run the rx1950 upgrade kitchen I get the CRC error...
When I try to change the .nbf and put it in with a rx3115 update package I get 244 Error (model ID)...
When I pull on my hair it comes out in big chunks...
I think I need a lot more study and a new toolkit...

that's maybe quite a challenge to flash ROMs from other models rather than language... both models are not compatible

martinhy said:
hurray!!!!
i've cheated the HP ROM Update Utility (RUU) to accept to update an English ROM to a Chinese machine !!!
i use WinHex to replace the ENG with CHT, CHT with ENG,, and it's OK now!!!!
anyway, thank you very very very much for your sincere help!!!!!!!!!
Really marvellous!!!
Click to expand...
Click to collapse
can you help me do that ? thanks