Database Info

How to: CyanogenMod your G1 from scratch incl hardspl

for the t-mobile g1 with 1.6 firmware and some number stuff like drc92 and other G ones that won't cooperate..
to mod it from a stock (t-mobile nl) rom.
What u need :
1 sd-card (preferably more then 128mb)
1 pc running windows (i run win 7 ultimate)
1 usb cord
1 phone-internet connection (there is a wifi version too but since i find it not neccesary i wont link it. instead if you dont have phone internet : just download the packages on pc and put them in the G1)
1 app from market called : mybackup (you can use it for backing up contacts and stuff.. backup to sdcard and copy it to pc)
Backup
-download app MyBackup from the google marketplace and make a backup of programs and contacts (if you dont have phone-internet then get it from pc)
Preparing Gold Card:
- insert sd card into G1 and format it (whatever sd card and whatever format (there is only one on G1 hehe so go find it. also format is to be found in G1.)
- attach to pc and copy the RC7 image(DREAIMG.NBH) on the sd card in the G1 (do not detach from pc, i know you wanted to)
- goto appstore and download terminal emulator (as it says like that)
- open Terminal Emulator on G1
- type:
cat /sys/class/mmc_host/mmc1/mmc1:*/cid
- write down the code somewhere, its ur CID thingy
- push backbutton
Reverse the CID:
Begin: 1c5356555344202010051cc3b7008cf4
1c 53 56 55 53 44 20 20 10 05 1c c3 b7 00 8c f4 (yes i copied it from you thnx - normal code... add the spaces so your CID looks like this (your own CID not this one )
f4 8c 00 b7 c3 1c 05 10 20 20 44 53 55 56 53 1c - reversed one (note the couples are reversed)
00 8c 00 b7 c3 1c 05 10 20 20 44 53 55 56 53 1c - now change the first two digit to 00
so you will have something looking like this: 008c00b7c31c0510202044535556531c (this is example CID so use ur own!)
- goto revskills and get a goldcard image with the code ur having now. revskills page
- now get the mail and save the attachement in a dir
Making your Goldcard:
- right-click and open as admin Hxd editor
- in HxD editor :
- goto extra menu and open disk > choose psysical disk > ur sd card
- goto extra menu and open disk image > choose the received file from mail called : goldcard.img and press ok on the popup saying some about 512
- now go to this tab goldcard and goto topmenu and edit>choose select all and then topmenu again and copy
- now go to first tab (ur sdcard) and select 00000000 to 00000170 with mouse (mark it)
- goto top menu and select edit> write
- now goto top menu and save
- pull the G1 out of pc
- yes you can
- ok now pull the battery out (or shutdown if u have the time)
- press camera button+power so it will give this rainbow 3 color shizzle
- you see a gray screen saying some words you probably wanna read.
- now press power to confirm overwrite the rom thing
- reboot by holding the two phone buttons (hangup and answer)and press menu or home and back (im not sure but one of these work and you see something saying it updates some stuff.
(if this dont work in ur G1 (specially latest versions) you can use a sdhc usb cardreader or a windows mobile phone or anything else with direct disk acces mode , probably nokia and sony ericsson too)
on the next boot you will have the old RC7
(if you have no internet on phone you can skip the next 2 lines and download the package and copy it to the G1 (dont know where so if anyone can tell me it would be nice to help people out )
- fill in your google account stuff
- Download Android "Telnet" application from the Market.
- Download recovery.img and copy it to your SD card. rename it to recovery.img
- Download the Hard SPL and copy the zip file to the SD card. (this is for G1 drea110 htc dream only so be carefull as this stuff can ruin your phone)
- All files must be on the root of your SD card.
- turn off the phone and detach from the pc
Rooting your G1- RC7 phone:
On RC7 Rom and lower, anything you type into your keyboard is also being run in a hidden console with root permissions.
To get root access, do the following:
- Restart your phone. Wait for your phone to start up fully and show the home screen.
- Unlock it by pressing menu after you typed code for sim and it fully started ( it will auto-lock itself)
- Hit the enter key twice,(Yes, it will start up a contact search, so you can see what you type . aint it cool) type "telnetd" and press enter.
- start telnet application you downloaded before on G1 and connect to localhost. (if you dont see localhost and connect window you have wrong app or need to reboot another time). If you connect successfully, you will have a root prompt "#".
Type the following into Telnet (these commands will give you root access for now):
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery.img
cat recovery.img > /system/recovery.img
Power off your phone by pressing send/hangup&menu together when its done.
Now you have the modified recovery and root !
Now that you have root and stuff, you will want to apply "Hard SPL" to your phone. HardSPL includes engineer SPL and is what will allow you to apply any rom image from any other regions
(like UK on US phones, UK on dutch and vice versa), create full backups of your phone, install the latest build from the Android source, enable usb on recovery mode, usually resurrect your phone if it is "bricked" and give you allways root and ability to flash another rom. Allows fastboot. Fastbooting of images allows the flashing of 1:1 images of system, data, boot, cache, pretty much everything.
You have already downloaded the file to your SD card, so now you can apply it.
-Start up in recovery mode by holding home and pressing power.
-You will now enter recovery mode. You should see an exclamation.
-If you do not see a menu on screen, press Alt-L to show the menu. It is supposed to show the modified recovery menu.
-select update from zip to apply the update.zip (hardspl) from the SD card.
-After the update is complete, hold Home and press Back to restart.
ok your G1 europe 1.6 or whatever version is now unlocked.
Installing your modded rom:
now download this europe rom (or here: link ) and this cyanogen update mod
(here are more roms: android-roms make sure you READ what is needed for this roms as these all need different recovey and things which are all nicely written to you in the help and readme files that come with it.)
- copy both files to root of the sd-card
- detach G1 and shut it down
- press home and start to get into the menu
- wipe device
- wipe cache
- install from zip the europe rom and do not reboot or anything else
- install cyanogenMod
- after it finish press both talk&hangup button and tap menu
- its probably giving the recovery menu . take out the battery and put it in and start the phone normally
- wait a long while for the phone to setup and i donno what the heck it needs to do but let it.
enjoy...
THnx to this greatfull forum-members like myself, moneytoo, amon ra, cyanogen, mark_v, persiansown who do this coz few others can and they have a sort of happy feeling doing it.

hi.
this isnt working for me. i used the hex editor to copy sections 00000000 to 00000170 from goldcard.img to my sdcard, then shut down and turned on phone with HOME+POWER, it "hangs" on phone with exclamation mark image. if i press home+power again i'm presented with default android recovery. i did put DREAMIMG.NBH to the root of my sdcard.
that means no confirming anything... what am i doing wrong then?

Seriously, use 1Clickroot.

maxisma said:
Seriously, use 1Clickroot.
Click to expand...
Click to collapse
1clickroot doesn't work with 1.6, does it?

greglord said:
1clickroot doesn't work with 1.6, does it?
Click to expand...
Click to collapse
The new should work in theory.. idk..

greglord said:
hi.
this isnt working for me. i used the hex editor to copy sections 00000000 to 00000170 from goldcard.img to my sdcard, then shut down and turned on phone with HOME+POWER, it "hangs" on phone with exclamation mark image. if i press home+power again i'm presented with default android recovery. i did put DREAMIMG.NBH to the root of my sdcard.
that means no confirming anything... what am i doing wrong then?
Click to expand...
Click to collapse
thats probably coz i mixed up buttons for starting the rainbowscreen updating mechanism.. sorry for that
i dont own or have a G1 so im not used to the button layout
edit: you can in that screen press Alt-L to get the menu , once u have the recovery.img installed it will change there to the menu of the modded recovery

maxisma said:
The new should work in theory.. idk..
Click to expand...
Click to collapse
i have no idea
but it might be handy to put a link to the file you mentioned instead of shouting it without researching the fact whether it works or not in 1.6

can anyone quickly tell me what the advantages of having the hard spl are? all iv done is rooted, (via 1 click) and then flashed cyanogens latest. radio was already up-to-date. just wondered if flashing new spl changes anything? many thanks

Hard SPL enables you to install roms like Hero or others that have a large "update".zip

bbuchacher said:
Hard SPL enables you to install roms like Hero or others that have a large "update".zip
Click to expand...
Click to collapse
Actually...The Haykuro SPL allows that...

Ace42 said:
Actually...The Haykuro SPL allows that...
Click to expand...
Click to collapse
Right. HardSPL (and DangerSPL) are something that allow fastboot. Fastbooting of images allows the flashing of 1:1 images of system, data, boot, cache, pretty much everything.
You should always have HardSPL/DangerSPL installed so you can fastboot a nandroid image as a worstcase scenario.
Jesus, the amount of noobiness is this thread is astounding.

persiansown said:
Right. HardSPL (and DangerSPL) are something that allow fastboot. Fastbooting of images allows the flashing of 1:1 images of system, data, boot, cache, pretty much everything.
You should always have HardSPL/DangerSPL installed so you can fastboot a nandroid image as a worstcase scenario.
Jesus, the amount of noobiness is this thread is astounding.
Click to expand...
Click to collapse
thnx for clearing that out
as i said i dont own a G1 i modded a friends one . so i dont know anything about this G1 but getting a new rom on it hehe.
i choose the hardspl as precaution and it seemed pretty stable from what i read.
i choose the 1.5 recovery as i thought it should have the same recovery image as the rom . dont know about that. it is the 1.4 recovery with some extras which are usefull, cant deny that.
i choose the rom as it seemed to be the most stable at the moment and allows thetering . this is why i needed to rom upgrade in the first place. second place that i just like modding and unlocking so that one can do everything with the device as it is yours anyway.

APEX.7 said:
can anyone quickly tell me what the advantages of having the hard spl are? all iv done is rooted, (via 1 click) and then flashed cyanogens latest. radio was already up-to-date. just wondered if flashing new spl changes anything? many thanks
Click to expand...
Click to collapse
it is allready answered in the how to ..

I can vouch for the OP tutorial working on the Australian Optus(Singtel) HTC Dreams wtih DRD20 build. Just waiting on that final epic long load up now.

Anacche said:
I can vouch for the OP tutorial working on the Australian Optus(Singtel) HTC Dreams wtih DRD20 build. Just waiting on that final epic long load up now.
Click to expand...
Click to collapse
I'm also G1 / 1.6 / DRD20 ... it's sounds good news for me ...

Hahahhahahh.....
this post should be named "The Most Difficult Way to Root your G1". How bout this.....downgrade to 1.5, DL one click root, and you're done.

Please help!!! Pleasee!
Do help me out on this one. I really can't seem to actually make my SD card into the gold card part. Whenever i plug it in the G1 or on a USB reader it tells me it's damage and needs to format.
i have two questions, Can i flash SPL first, then do a downgrade then flash recovery?
2nd : If i can't then can i flash recovery, flash spl then do a downgrade to RC7?
if so how do i flash my recovery?
DO HELP ME OUT PLEASEE! i've been on this for days!!!

I know that this is going to cause problems and fighting but, I cannot read this thread and not say anything in good conscious.
With the amount of errors and misinformation in this thread, perhaps the OP should leave the tutorials and how-to's to the people that actually HAVE a G1, have modified ROMs on their phone, and can support the questions that are asked in the thread.
Just my two cents, but I have a feeling that my words are supported judging from the general consensus of the previous posts.
~DM

DirectMatrix said:
I know that this is going to cause problems and fighting but, I cannot read this thread and not say anything in good conscious.
With the amount of errors and misinformation in this thread, perhaps the OP should leave the tutorials and how-to's to the people that actually HAVE a G1, have modified ROMs on their phone, and can support the questions that are asked in the thread.
Just my two cents, but I have a feeling that my words are supported judging from the general consensus of the previous posts.
~DM
Click to expand...
Click to collapse
Id have to second that, while I may not have many posts here on XDA,I've rooted and rebuilt and replaced screens from 7 G1's using the how to's and wiki's here on XDA(thanks devs). My thought is if it the current guides work we should prob stick with them unless someone else figures a better faster way.(ie;one click root). By the way,just wanna say,I've never charged anyone to root their phone or fix one. The knowledge I've gained I learned here,it wasn't something I developed and I think its wrong for people to take open knowledge they didn't come up with and charge other people for it like I've seen at some of these cell phone repair shops and on craigslist. If your gonna charge for the knowledge then pay the people you gained the knowledge from. Sorry for going off topic,just had to vent.

incl. ROM now: WM 6 updated Tornado kitchen with SDHC + 28/25MB total/avail storage

This kitchen is a continuation of the Nitrogenious kitchen released at XDA-devlopers.
Nothing has changed from the tools side, only subtle adaptations and altered content.
Thanks go to :
all the experts at XDA-developers (too many to list)
Nitrogenious for releasing his WM6 kitchen and the superb WM6 package contained therein.
The original kitchen is found here: http://forum.xda-developers.com/showpost.php?p=2150690&postcount=1
Mind that usage description has to be taken from there!
Cotulla for publishing the OMAP850_SDHC.dll that can handle SDHC cards and llnhhy for putting the crucial REG setting in his published package for the Tornado.
More details are discussed here: http://forum.xda-developers.com/showthread.php?t=576164
SGregory for revealing (at least I found it there) that "format BINFS" can actuall take a parameter that sizes the BINFS partition and thus opens the path to gain device storage space if the ROM gets smaller!
More details on saving space are outlined here: http://forum.xda-developers.com/showthread.php?t=491240
- Sir.B and geistteufel for the Squeezer batches for UPX. XDA-Develpoer threads are:
original: http://forum.xda-developers.com/showthread.php?t=481880 and post of geistteufel (the one used in this release): http://forum.xda-developers.com/showpost.php?p=3540501&postcount=92
Disclaimer:
This is for educational purposes only!
There will be no support for the published content!
Enjoy and contribute.
Warning:
Mind that from the "cooking" or "kitchen" point of view this is for sure an old base and possibly more elaborate tools and definitely newer OS versions exist. The produced files should not be able to "brick" your device if you correctly set the Image Name to "OS" in the last step of the cooking process. IPL or SPL should never be written unless you know exaclty what you do - the kitchen only cooks the OS part! Writing incorrect content to the IPL or SPL area will brick your device for sure, so be careful!
Motivation:
This effort was only done to get a running stable ROM with SDHC support included that occupies as little storage space as possible
still having mandatory elements on board
filling the remaining space with useful tools
Space saving strategies (order of benefit):
outsource parts to SD card where possible (.NET CF 3.5)
compress files (.exe and .dll) that are not stored as modules with UPX where function permitts.
remove files that are not needed for any function
remove media data (ringtones, pictures) and leave only the bare minimum
resize media data where possible to further decrease size
not done, but possible:
- remove optional packages (additional color schemes) (25k)
- remove empty packages (15k)
- summarize registry tweak packages to just one additional package (edit the .rgu) (few kB)
About UPX and builtin BINFS compression:
My experience is that the BINFS compression shrinks a set of example files (.NET CF 3.5 files that reside in the \Windows path) to about 49% while UPX'ed they only take 32% of their initial size. So on average you may gain 17% of the initial filesize in your ROM. The larger the file, the better is usually the gain.
Mind that UPX will only compress exe/dll files (even if they may be named differently, see Total Commander's *.tfx) and does not compress exe/dll that depend on .NET. It works luckily on the .NET CF core parts itself.
You should not compress (even if compression works, these DLLs will not load later):
resource DLLs
menu extension DLLs (context menus)
Updated and altered content:
added SDHC support by replacing the OMAP850_SDHC.dll with an SDHC capable version initially created for the StrTrk. So far there are no negative impacts visible.
altered the titles of the options to indicate the space they take - also UPX'ed size
moved the oemstartup.dll and the relevant pictures to the folder where the optional sounds already resided
added German T9 to the English T9 - so both is installed in the system if you select this. Mind that an additional language is not eating much space (~70k)
added the SafeInboxExtension as an own option to add, removed the InboxExtension from the combined "Group SMS + ..." menu
put moBlue to the latest version (2.1) and adapted rgu content.
added an option for registry changes called "tobbie GUI tweaks" that sum up everything that I think is useful (smaller menus, fonts, scrollbars, value for gamma).
updated the TotalCmd to the latest released version
created several additional packages from the previous default content (CeleTask, ClearType Tuner, ClockOnTop, ComManager, Dopod SIM Manager, .NET CF 3.5, OMAPClock, OxiosAlarms, OxiosMemory)
added a new package for .NET CF 3.5 where the GAC_* files have to reside on SD card. The complemtary ZIP containing the files to copy on SD card are located in the "_Changes" directory.
added the GPSID Settings tool to the GPSID directory
included the SP1 fixes supplied by Nitrogenious (FakeCursor not included)
changed several tweaked menus in the settings -> system tweaks
added options for volume setting of the initial beep and voice tag to the Voice Tag menu in system tweaks, changed category of the [HKEY_CURRENT_USER\ControlPanel\Sounds\VRecBeg] from "Notifcation" to "System" so that only the sounds sent form the VoiceTag are audible when the System sound volume is set to 0.
completely UPX'ed the SYS\MMSCAMCLKSTK *.exe and *.dll (except 2)
replaced the htcmidi.avd with the WM5 version to get back good midi playback,
added the HTCSourceflt.dll (from Nitrogenious SP1) to get midi playback in wmplayer
removed two large files from this directory which are nowhere referenced (CameraRC_*.dll).
updated WM5torage to the latest version (1.90), already setting suitable defaults.
fixed default settings for A2DP
Directory and contents
added a batchfile (you may want to edit) where the %SystemDrive% can be set to any value. This allows to install the kitchen on any drive you like and not on C:\ (the normal systemdrive) as it was mandatory. Mind that the scope of this %systemdrive setting is limited to the batch execution only. You can put the whole environment on a large RAMdisk (~380MB required) - this speeds up the cooking dramatically! A large RAM disk is available from "[ QSoft ] Qualitative Software" (1 year trial for the lite version) - see here: http://members.fortunecity.com/ramdisk/RAMDisk/ramdriv002.htm .
added a subdirectory "_Squeezer" where you find the UPX compression set "Squeezer" also published at XDA-developers (readme contained there). I have used this set to batch compress many files before putting them to ROM.
added a directory "_Changes" where you find the compressed and original versions of the files in equally named subdirectories OEM and SYS like in the WORK path. So in case you want to go back to the non-UPX-ed version they are there. Continuing the UPX-batch directory logic (2_Backup, 3_Compressed) there are further ones (4_removed and 5_changed) to document the changes done to the original content.
The rest of the kitchen is identical to the one Nitrogenious had released.
Download here: http://www.mediafire.com/file/xdiz2xzmote/Tornado_Kitchen_v09_by_tobbbie.exe
Quick Start:
- Unpack to C:\
- read cooking guide at Nitrogen's thread (see above)
- using defaults you get a ROM with: http://www.mediafire.com/file/z3ynij5ynzd/default-settings.gif
- available storage 27,97MB, free after 1.st boot 24,8MB
Correction: If you want to use the moBlue package, please edit the RGU file and add a blank line at the end. Using notepad will ensure that the file stays in unicode format.
Correction-2 (14.10.2010): You will experience that while WMP is playing the backlight will not go off as normal. This can be fixed by replacing the HTCWMPPlug.dll in the \windows directory on the device or in C:\Torn\_Changes\SYS\MMSCAMCLOCKSTK in the kitchen with the attached file.
Please make sure that your device is "SuperCID" before entering the "Format BINFS command. See post 3.
added 20100314: (edited 20100504)
Despite it is really extremely easy to cook your own ROM with the kitchen, let me give you a head start with your old Tornado. I have cooked the default settings to a ROM and added all tools that you need to step from a stock Tornado to the cooked one in a single archive.
Download it from here: http://www.mediafire.com/file/njm040ttoxm/_tobbbie-tornado-WM6(SDHC-NetCF_on_SD).exe
Unpacking it you will find a directory structure:
Code:
_tobbbie-tornado-WM6(SDHC-NetCF_on_SD)
├───1 prepare security
│ ├───1 HTCUnlock
│ └───2 SDA_ApplicationUnlock
├───2 prepare for custom flash
│ └───Utils
├───3 flash latest Radio and SPL
├───4 format BINFS 1b00000
├───5 flash ROM
└───6 copy NetCF to SD
└───Windows
Follow the actions in the directories one-by-one:
You only need to do steps 1 and 3 if you come from an official ROM but Step 2 (lokiwiz) needs only be done once per device.
If you flash another cooked ROM you can start from step 4.
Attention: In case you did not notice yet - the following procedures will completely erase all content that you stored on the device (email, SMS, MMS, ToDo, Contacts - simply everything) - the device will be as if it comes out of the box. So back up your data before you do this!
Here is what to do in detail, how and why:
Prepare security: This means that the restrictive program execution privileges have to be set less firm to allow step 2 to run later.
Connect your Tornado to the PC and let Active Sync connect. First run HTCUnlock-CVS.exe in the directory 1 HTCUnlock. This will install a program on your device. Run the installed program there and restart the device.
After the device has reconnected to Active Sync, on the PC run the program SDA_ApplicationUnlock.exe in the folder 2 SDA_ApplicationUnlock. It should confirm "succesfully unlocked".
Now the device is ready to receive the "SuperCID" that allows to flash any ROM to it, regardless of Operator or Vendor limitations. To be on the safe side later, please enter on the device *#06# and note down the IMEI that the device reports - you will need it later.
This needs only be done once per device - it is a permanent setting that survives all ROM updates.
Go to the folder 2 prepare for custom flash and
make sure there are no files *.bin left from previous device's activities
then execute Lokiwiz.bat. It will prompt you with 4 options:
Code:
U. Unlock
L. Lock
C. CID Unlock (SuperCID)
Q. Quit
--------------------
Type the letter and press Enter:
Input "C" <enter>.
It will copy a program (itsutils) to the device and it should ask you for permission to execute - grant execution and let the batch file continue. You should find 2 new files beside the Lokiwiz.bat (lock-backup.bin and cid-unlocked.bin). Move them to a safe place immediately and do not repeat the procedure or call another option!
Be careful to label these files unambigously (best is to append the device's IMEI to the name - get it with *#06# before and do not use the IMEI printed on the label of the device - as restoring a wrong *.bin file to a device will kill the GSM radio access (Message: Data Crashes, please contact your... when trying to connect to the network with a SIM card inserted).
Now the device is prepared to receive custom ROMs.
Let's first put the last available Radio ROM and SPL (Secondary Program Loader) to the device. Go to the directory 3 flash latest Radio and SPL and execute ROMUpdateUtility.exe. After successfull update the device will restart in the old OS, nothing has visibly changed - you could still use the device as it is, all your data are still there.
Now the preparations start to erase the old OS and flash the new one.
Deactivate USB connections for the Active Sync
Switch off the device and disconnect from USB
Press Camera Key and keep it pushed down while connecting the USB cable to the PC - wait until the 3-color screen appears and release the camera key.
Start ttermpro.exe in directory 4 format BINFS 1b00000
Select Serial and Port USB
Press <enter> in the terminal window, you should get prompt CMD>
enter info 2 <enter> you should see something like:
Code:
Cmd>info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
HTCSSuperCID ' HTCE
Cmd>
The last line must show HTCSSuperCID ' HTCE.
If you see anything else there (e.g. HTCSVODA0504 㱍dHTCE - which is for an Austrian V1240) the lokiwiz in step 2 above did not work correctly. Still you have not destroyed anything (hopefully) - so to get the old OS start up again, enter ResetDevice <enter> - the device will restart and boot again. Think about what went wrong in the previous steps.
The lokiwiz batch file and the tools behind it are very powerful and can kill the GSM radio access of the device. Be careful with the *.bin files and keep those of different devices clearly apart.
In case you see HTCSSuperCID ' HTCE then you can pass the point of no return (after this the OS and all your data are deleted from the device) and enter at the prompt format BINFS 1b00000 <enter>. (The value 1b00000 depends on the ROM size, so if you use a different ROM, the value may also be different.) After a few seconds the prompt returns and the partition where the OS was stored is cleaned up now. The device will not boot beyond the 3-color screen in this state. You need to flash the new OS in the next step - but before this enter ResetDevice <enter> - the device will restart and return to the 3-color screen.
Terminate the tterm.exe, you will not need it any further.
Re-activate USB connections in Active Sync - you may forget it later.
Enter the directory 5 flash ROM and execute ROMUpdateUtility.exe. The procedure looks the same as in step 3 but takes a little longer. Do not get nervous as the time at 100% extends a few minutes. The device will reboot and bring you to the new OS.
The SD card that shall be used in the device needs to have the NetCF 3.5 files copied to the directory \Windows finally. This is NOT on the device but on the card - you can copy it on the PC while the sd card is in a card-reader or when the device has is mounted, there the path is \Storage Card\Windows
If the device had a SIM-Lock and it rejects your SIM, go to the lokiwiz.bat (again move out all *.bin files) and select "U" for SIM Unlock - again move the bin files in the directory to a safe place (but you should never need them). Mind that the "lock_backup.bin" is just a copy of the current encrypted area in the device. So this file is different after each step you completed before. Worse: if you do not save the FIRST lock-backup.bin you can never go back to this state.
Mind that lokiwiz.bat has worked for me on a Telenor Sim-Locked nordic ROM CID-locked QTEK 8310, so it should work for any other device as well. If you get the dreaded "Data Crashes..." message and your restore of the correct lock-backup.bin did not help either - your last resort is the SIM Unlock service here: http://imei-check.co.uk/c600_unlock.php. It costs you some bucks, but they seem to re-create the encrypted area with the matching IMEI of your device putting it in a SIM-unlocked and CID Unlocked state. Cheaper than buying a new device.
After you have sucessfully flashed your ROM - maybe you try cooking one yourself?

The selected default settings fill the ROM up to the last few hundred bytes. Adding options will surely jump over the next MB border and your ROM uploading preparations will have to format BINFS with a larger size.
If you have not read it elsewhere yet, the standard sequence to uplad a ROM is:
1.) cook ROM (OS part)
2.) determine size and format BINFS accordingly
more see this thread: http://forum.xda-developers.com/showpost.php?p=3439787&postcount=1
3.) upload ROM

If you start from scratch - so your device is still "untouched" by any custom ROM, you must prepare your device to allow the loading of a custom ROM. This happens in several steps to overcome the various security levels that try to prevent this:
Application unlock the current operating system. Look for "SDA Application unlock" this runs on the PC and remotely unlocks (via the Active Sync Connection) the security of the Windows Mobile operating system. This allows tools to run that you need for the next step.
Super-CID your device (and check if it worked!). Look for "lokiwiz" ZIP file in the forum here. Despite orginally created for the "Wizard" model, it also works for the Tornado in all respect, so it does the Super-CID and it does the SIM Unlock. I did it myself on a QTEK 8310 with a Nordic ROM and SIM-locked to Telnor.
To check if it worked, connect the device in Bootloader mode to the terminal program and enter "info 2" (without the quotes). It has to show HTCSSuperCID ' HTCE
Do not care about SIM lock yet, you can do that anytime later if necessary.
Good luck!

Thanks!
Thanks a lot. Nice work. Very useful. Could you please post one with a PRO rom, preferably the 6.5 version? Or at least the guidelines to make one?

I will not cook any further - this is why I released the kitchen. The strategies to save space are outlined in detail, so other cooks can take them and incorporate to their ROMs.
For me WM6 is sufficient - I don't need the "goodies" that came after that.

Thanks!
Oh fine. Thanks anyway. What is the perceived space saved from this method? And is there any performance hit?
I've seen that UPX'ing has a lot of performance boost so I'm wondering whether it can be made only to the packages or is it applicable to the exe's and large dll's from the CABs too. Since there are a few applications, which even when added later, install to the device memory directly. In these cases, UPX'ing might be highly beneficial in reducing the size as well as giving a speed boost. Any info on this?

Well, indeed you may think that UPX-ing will decrease performance as the file must be decompressed before running - but the opposite is the case!
you save space (most if installed, a little if in ROM - due to BINFS compression that is there anyway)
you get faster file-read time: This pays for especially well for large files (opera, office, acrobat, TomTom and alike). This will by far gain more than you loose for decompression (which goes directly to memory).
Looking at usual read-speeds of about 1MB/sec and an assumed 10 times faster decompression speed to memory, my feeling is that for speed reasons it will pay best for LARGE files (card and memory installed). Mind that after the file is read and loaded to memory, still the application needs to initialize itself. The last step is the same, no matter if UPX-ed or not.
If you tweak the bits for memory saving on the device it is no harm for anything smaller as well. Usually I stop UPX-ing below 50kB in size, but to have the ROM fit in the MB-frame I wanted to achieve I also had to UPX some smaller files as well. Just compare the directories of Nitrogenious' kitchen release and mine.

Hi,
Thanks for kitchen !
Sorry, I'm a novice in ROM cooking (I just modified a bit a ROM for my HTC Touch, long time ago, but I got no problem with flashing ROMS on HTC devices )
So I got a few questions/remarks.
1. I tried to build a custom ROM, but I got an error after selecting options.
I checked log file (a:\Torn\WORK\temp\log.txt) and I found following message :
Failed to parse value name HKEY_LOCAL_MACHINE\Software\hejhej.org\moBlue!!!
InitRegistry FAILED in file ".\Registry\37771312-772c-4ff9-a0a1-b555ad54a025.rgu" within a few lines of line 10.
ImportFromPackageListStrict: (RGUComp) !ERROR failed importing ".\Registry\37771312-772c-4ff9-a0a1-b555ad54a025.rgu"
wmain: (RGUComp) !ERROR failed building DEFAULT hives
If I uncheck "MoBlue", all is OK, so I think MoBlue package is corrupt.
2. When building with default option, what values to put in nb2nbf (CID and start address) ?
I used same as http://forum.xda-developers.com/showpost.php?p=2150690&postcount=1 (82040000 for start adress and ORG_0401 for CID)
Is this OK?
(my phone is an Orange SPV600, CID unlocked, so I think I can put any value for CID)
3. I didn't really understand how to change ROM size. I checked your thread, but I'm still in the dark.
In nb2nbf, in size column, I got "33357824" = "0x13E20248".
So I used "format BINFS 014000000". Is the the way to go ?
Thanks for answers.

Answers!
1. Even I'm unsure about that.
2. Yes. Just select the OS option and it will fill the address by itself.
3. Yes. That is the method I follow. AFAIK, convert the bytes into it's hex equivalent and choose the nearest <higher> hex number with 5 0's at last.
And from what I understand from his post, if you have a ROM with 29.1 mb size, either reduce it to (29 mb - 64k) or add some apps and increase it to (30mb - 64k), to make the optimum use of the available space.

Hi AlainL,
...will have to look after the moblue part - strange, possibly the wrong format of the file (not unicode stored). The content should be ok. I fixed it after updating from the old moBlue inside the old kitchen to the 2.1 version copying the Registry content of the moBlue branch.
Regarding the address it is easy: when you select "OS" and click in the address field, the address is selected automatically - this is the right one.
Your assumption on the format BINFS <size> is correct. This is the way to format it. But your calculation is wrong. The Hex size of your value is 1FD0000 and thus you have to format with 2000000 or your device will not boot after flashing.

The solution to the moBlue problem in the .rgu is very easy.
Edit the .rgu file and add a blank line at the end - that's all.

Editing .rgu files
Just to be on the safer side:
Don't forget to save it in the Unicode format too. Turn off word wrapping while editing .rgu files.

They are all unicode - so if you edit with notepad it should keep this format.
Special attention is required when adding "Multistring" values to the registry. The can be imported as hex - and this hex code must be in unicode format, so 2 bytes per character.
So when exporting the values from the registry to add them to an .rgu package you must take care of this. Took me some tries until I had the .NET CF 3.5 with separated GAC_* package running.

tobbbie said:
Your assumption on the format BINFS <size> is correct. This is the way to format it. But your calculation is wrong. The Hex size of your value is 1FD0000 and thus you have to format with 2000000 or your device will not boot after flashing.
Click to expand...
Click to collapse
Hi
Thanks all for your answers.
I used the right number.
I just made an error while writing in this thread ("0x13E20248" = "333578824").
This cooking works very well.
I just got a problem, maybe someone can help me.
I added Esmertec Java and installed opera mini 4.2, opera mini 5 beta 2 (latest) and opera mobile 10 beta 2 (latest too).
All is OK with 4.2, but with 5b2 and 10b2, I can't pass license agreement screen, because I can't click on "Accept" button (nor "exit" one), neither with left or right menu button or with cursor.
I thinks it's Opera's fault, but if anyone got a suggestion ...
Finally, I got a question :
Now, I'm using a SPV C600 (Orange), and it doesn't have WiFi.
I plan to buy either a XPA1240 or Qtek 8310 (used, quite cheap), but I need to know if WPA is supported.
I can't check by myself, cause every time I try something related to WiFi, I end with an error "Driver not loaded".

I do not cook java in the device but have it installed on SD card - along with the midlets it will take later. The package I use is called "JBEDROSE" (20080813.2.1) and comes from the Vox forum. I have no problems using later versions of Opera there (including 5ß2). I suspect the accept requires a network connection to the opera server (WIFI or AS), so maybe this is your problem?
The WLAN support WEP, WPA, WPA2 and should also cover hidden SSIDs (but I don't use it). The Reg-Tweak "optimal performance for WLAN" is actually putting the WLAN in a mode that will NOT do continuous transmission (and drain your battery real fast - like in WM5) but in a mode that saves battery without affecting performance.
The prices for used 1240 or 8310 are rising at ebay currently

tobbbie said:
I do not cook java in the device but have it installed on SD card - along with the midlets it will take later. The package I use is called "JBEDROSE" (20080813.2.1) and comes from the Vox forum. I have no problems using later versions of Opera there (including 5ß2). I suspect the accept requires a network connection to the opera server (WIFI or AS), so maybe this is your problem?
Click to expand...
Click to collapse
I tied both with AS or via EDGE/GPRS connected (when loading EULA, netwok is required).
It looks like Opera 5b2 and 10b2 didn't recognized both menu button.
I will still do some tests.
tobbbie said:
The WLAN support WEP, WPA, WPA2 and should also cover hidden SSIDs (but I don't use it). The Reg-Tweak "optimal performance for WLAN" is actually putting the WLAN in a mode that will NOT do continuous transmission (and drain your battery real fast - like in WM5) but in a mode that saves battery without affecting performance.
Click to expand...
Click to collapse
Thanks, great
tobbbie said:
The prices for used 1240 or 8310 are rising at ebay currently
Click to expand...
Click to collapse
Because of your excellenet kitchen ?

Opera 5ß2 works on my Jbed (non cooked as I wrote). The opera 10ß2 is native WM - but said to not support smartphones (non-touchscreen) well, so I stick with Opera-mini for the occasional browsing I do there.

Now the default settings are contained in a ready cooked ROM - enjoy!
Appended to the first post:
added 20100314: (edited 20100504)
Despite it is really extremely easy to cook your own ROM with the kitchen, let me give you a head start with your old Tornado. I have cooked the default settings to a ROM and added all tools that you need to step from a stock Tornado to the cooked one in a single archive.
Download it from here: http://www.mediafire.com/file/njm040ttoxm/_tobbbie-tornado-WM6(SDHC-NetCF_on_SD).exe
Unpacking it you will find a directory structure:
Code:
_tobbbie-tornado-WM6(SDHC-NetCF_on_SD)
├───1 prepare security
│ ├───1 HTCUnlock
│ └───2 SDA_ApplicationUnlock
├───2 prepare for custom flash
│ └───Utils
├───3 flash latest Radio and SPL
├───4 format BINFS 1b00000
├───5 flash ROM
└───6 copy NetCF to SD
└───Windows
Follow the actions in the directories one-by-one:
You only need to do steps 1 and 3 if you come from an official ROM but Step 2 (lokiwiz) needs only be done once per device.
If you flash another cooked ROM you can start from step 4.
Attention: In case you did not notice yet - the following procedures will completely erase all content that you stored on the device (email, SMS, MMS, ToDo, Contacts - simply everything) - the device will be as if it comes out of the box. So back up your data before you do this!
Here is what to do in detail, how and why:
Prepare security: This means that the restrictive program execution privileges have to be set less firm to allow step 2 to run later.
Connect your Tornado to the PC and let Active Sync connect. First run HTCUnlock-CVS.exe in the directory 1 HTCUnlock. This will install a program on your device. Run the installed program there and restart the device.
After the device has reconnected to Active Sync, on the PC run the program SDA_ApplicationUnlock.exe in the folder 2 SDA_ApplicationUnlock. It should confirm "succesfully unlocked".
Now the device is ready to receive the "SuperCID" that allows to flash any ROM to it, regardless of Operator or Vendor limitations. To be on the safe side later, please enter on the device *#06# and note down the IMEI that the device reports - you will need it later.
This needs only be done once per device - it is a permanent setting that survives all ROM updates.
Go to the folder 2 prepare for custom flash and
make sure there are no files *.bin left from previous device's activities
then execute Lokiwiz.bat. It will prompt you with 4 options:
Code:
U. Unlock
L. Lock
C. CID Unlock (SuperCID)
Q. Quit
--------------------
Type the letter and press Enter:
Input "C" <enter>.
It will copy a program (itsutils) to the device and it should ask you for permission to execute - grant execution and let the batch file continue. You should find 2 new files beside the Lokiwiz.bat (lock-backup.bin and cid-unlocked.bin). Move them to a safe place immediately and do not repeat the procedure or call another option!
Be careful to label these files unambigously (best is to append the device's IMEI to the name - get it with *#06# before and do not use the IMEI printed on the label of the device - as restoring a wrong *.bin file to a device will kill the GSM radio access (Message: Data Crashes, please contact your... when trying to connect to the network with a SIM card inserted).
Now the device is prepared to receive custom ROMs.
Let's first put the last available Radio ROM and SPL (Secondary Program Loader) to the device. Go to the directory 3 flash latest Radio and SPL and execute ROMUpdateUtility.exe. After successfull update the device will restart in the old OS, nothing has visibly changed - you could still use the device as it is, all your data are still there.
Now the preparations start to erase the old OS and flash the new one.
Deactivate USB connections for the Active Sync
Switch off the device and disconnect from USB
Press Camera Key and keep it pushed down while connecting the USB cable to the PC - wait until the 3-color screen appears and release the camera key.
Start ttermpro.exe in directory 4 format BINFS 1b00000
Select Serial and Port USB
Press <enter> in the terminal window, you should get prompt CMD>
enter info 2 <enter> you should see something like:
Code:
Cmd>info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
HTCSSuperCID ' HTCE
Cmd>
The last line must show HTCSSuperCID ' HTCE.
If you see anything else there (e.g. HTCSVODA0504 㱍dHTCE - which is for an Austrian V1240) the lokiwiz in step 2 above did not work correctly. Still you have not destroyed anything (hopefully) - so to get the old OS start up again, enter ResetDevice <enter> - the device will restart and boot again. Think about what went wrong in the previous steps.
The lokiwiz batch file and the tools behind it are very powerful and can kill the GSM radio access of the device. Be careful with the *.bin files and keep those of different devices clearly apart.
In case you see HTCSSuperCID ' HTCE then you can pass the point of no return (after this the OS and all your data are deleted from the device) and enter at the prompt format BINFS 1b00000 <enter>. (The value 1b00000 depends on the ROM size, so if you use a different ROM, the value may also be different.) After a few seconds the prompt returns and the partition where the OS was stored is cleaned up now. The device will not boot beyond the 3-color screen in this state. You need to flash the new OS in the next step - but before this enter ResetDevice <enter> - the device will restart and return to the 3-color screen.
Terminate the tterm.exe, you will not need it any further.
Re-activate USB connections in Active Sync - you may forget it later.
Enter the directory 5 flash ROM and execute ROMUpdateUtility.exe. The procedure looks the same as in step 3 but takes a little longer. Do not get nervous as the time at 100% extends a few minutes. The device will reboot and bring you to the new OS.
The SD card that shall be used in the device needs to have the NetCF 3.5 files copied to the directory \Windows finally. This is NOT on the device but on the card - you can copy it on the PC while the sd card is in a card-reader or when the device has is mounted, there the path is \Storage Card\Windows
If the device had a SIM-Lock and it rejects your SIM, go to the lokiwiz.bat (again move out all *.bin files) and select "U" for SIM Unlock - again move the bin files in the directory to a safe place (but you should never need them). Mind that the "lock_backup.bin" is just a copy of the current encrypted area in the device. So this file is different after each step you completed before. Worse: if you do not save the FIRST lock-backup.bin you can never go back to this state.
Mind that lokiwiz.bat has worked for me on a Telenor Sim-Locked nordic ROM CID-locked QTEK 8310, so it should work for any other device as well. If you get the dreaded "Data Crashes..." message and your restore of the correct lock-backup.bin did not help either - your last resort is the SIM Unlock service here: http://imei-check.co.uk/c600_unlock.php. It costs you some bucks, but they seem to re-create the encrypted area with the matching IMEI of your device putting it in a SIM-unlocked and CID Unlocked state. Cheaper than buying a new device.
After you have sucessfully flashed your ROM - maybe you try cooking one yourself?

Some updates to the guideline for flashing in the previous and the first post.
be careful with lokiwiz (several hints added)
last resort if you fail to superCID the device: http://imei-check.co.uk/c600_unlock.php
Enjoy - there is no real successor of the Tornado

Thank you for this. I updated my phone because the previous rom was slow and flawed as I discovered. Phone is working great now.

[Tutorial]Gigabyte G1305 / Orange Boston unlock and upgrade to 2.1 with CMLMod 1.5.1

I won't follow this thread anymore since i have sold my Boston. Anyway you can find more informations on htcmania.com (use google translate if you don't speak spanish)
EDIT: Upgrade to CMLMod 1.5 based on Muchtel ROM (below outdated CML 1.4)
With this tutorial you sould be able to unlock your Orange Boston (aka GigaByte G1305 Codfish, Apanda A60, WellcoM A88, Vibo A688, Cincinnati Bell Blaze f800, Commtiva Z71, Muchtel A1, Chinavision Excalibur, Motorola Greco, Nexian A890) and install CMLMod 1.5.1 (or 1.4) (by c.martinez.lozano) based on the ROM Muchtel 2.1 (eclair)​
Main advantages/disadvantages of CMLMod 1.5.1:
+Unlocked device (can use any SIM)
+Android 2.1 (Eclair)
+Root access with Superuser permissions
+Preinstalled programms and other features
+Easy SD partitioning and more features thanks to the new recovery
+Optional App2SD
+Processor speed adjustable in a range between 122 and 600MHz (with the possibility to set variable processor speed to have performance and longer battery life at the same time)
+Other features: 3 different launchers, flash light, setcpu, app2SD in one click, other preinstalled apps and tweaks
=Camera autofocus not working (like on stock ROM)
=Different UserInterface (in my opinion better, but that's subjective)
-You may loose the warranty on your device
-IMEI may change, to restore your original IMEI use the tutorial in my second post
-Languages not fully implemented (english is working fully, other languages settable with LocaleSwitch but not fully integrated )
Important!!! There may be the risk of damaging your phone in an irreparable way! Be aware also by installing this ROM you will loose your warranty! I do not take any responsability for the status of your device!​
I translated the tutorials on htcmania.com
All credits to c.martinez.lozano and pindemon from htcmania.com
​
Requirements
Hardware requirements:
-Phone model: Orange Boston (aka GigaByte G1305 Codfish, Apanda A60, WellcoM A88, Vibo A688, Cincinnati Bell Blaze f800, Commtiva Z71, Muchtel A1, Chinavision Excalibur, Motorola Greco, Nexian A890)
Edit: never seen a phone with so many different names!!!
-PC operating system: Windows XP 32 bit with SP3 and .NET Framework 2.0 and Winrar installed. Do not try with Windows XP working on a virtual machine!!!. Seems to work also on other Windows 32 bit operating. Does NOT work with Windows7 64 bit
-USB to micro USB cable (comes with the phone)
Software requirements For CMLMod 1.5.1:
Firmware Apanda A60 1.6.2
Firmware CMLMod 1.5.1 (this file already contains RUT 1.2.2 and the Phone drivers)
Additional for CMLMod 1.4 (Outdated):
RUT 1.2.2
Phone drivers
Firmware Apanda A60 2.1.9
Firmware CMLMod 1.4
Tools like adb, fastboot, etc
Ready to start! make sure you have enough battery left (at least 30%)
PART 1: Installing Apanda 1.6.2
Unpack the file Phone drivers on your desktop, or another place, but remember where
install RUT_V1_2_2. At the end you will have to reboot your pc. Reboot it
[*]Unpack the firmware 1.6.2 from the archive Hipi1_6_2.rar and you get a file ending with .nb0
[*]Execute RUT (the shortcut should be on your desktop). The program reminds us to prepare the USB cable and to have all the drivers installed. (For Vista or Seven 32 bit: right click on the RUT shortcut. on the menu select Properties-->Compatibility check Run this program in compatibility mode for: and select Windows XP (Service Pack 3) then press OK, then right click on the Rut shortcut and select Run as administrator)
[*]In the next window, look for the firmware just to unpacked (the .nb0 file) and select it.
[*]The instructions tell you what to do: disconnect the phone from your pc (if connected), remove and reinsert the battery to your phone
[*]Hold the camera button and the volume up button pressed and then press the power button to enter recovery menu.
[*]Once the recovery menu, connect your phone to your computer. If we never connected in recovery, it requires new drivers. They are in the inside the Folder we unpacked in step 1 inside the subfolder AndroidX32 for 32 bit operating systems (if it later asks for drivers again, select the same folder again).
[*]The installer will detect your phone. If not, enter the Device Manager and check that all devices are correctly installed.
[*]From now on, follow the on-screen instructions and wait, it takes a while.
[*]Once complete, we have the new firmware installed. Our phone will restart and (after a while) show us something in chinese. Touch the right on-screen button to select the english language.
[*]When your phone is on check your IMEI by dialing *#06# and then press the call button and write it down. Now check the IMEI written on the phone under the battery. If the IMEI is the same, go on with PART 2. if the IMEI changes, use the tutorial in my second post to restore the original IMEI.
Now your phone is unlocked but you have the chinese version of Android 1.6
PART 2: Installing CMLMod 1.5.1 (for CMLMod 1.4 skip this and go to PART 2 OLD)
Unpack the file CMLMod1.5.rar
Run the programm RUT once again, and select the newCMLMod1.5.nb0 file you got
Repeat the same steps described in PART 1: 6.-10.
Now on your phone open the main menu and then CMLMod1.5 to configure App2SD select Configurar Apps2sd, then partitionar SD the phone will restart into recovery mode.
Now select Partition sdcard, Partition SD and confirm with the Home key. set swap=0, Ext2=512 (is more then enough! you can also set less) and Confirm twice again.
Then press the back button and select APP2SD if you want your apps being installed on your sd in the Ext2 partition.
Attention!!! if after you want your apps being installed on your phone memory you have to make a Wipe, that means, your data will be lost.
Always in CMLMod1.5 you can select a launcher, install flash lite and install setcpu to set the speed of the phone's processor with the possibility of variable speed.
FINISH!!!​
PART 2 OLD: Installing Apanda 2.1.9
Unpack the file Hipi_2_1_9GMS.rar and you get the file Hipi2_1_9_GMS版.nb0. Rename this file in Hipi2_1_9_GMS.nb0 (the chinese symbol can make problems)
Run the programm RUT once again, and select the new Hipi2_1_9_GMS.nb0 file you got
Repeat the same steps described in PART 1: 6.-10.
Now you have the chinese version of Android 2.1
PART 3 OLD: Installing CMLMod 1.4
Unzip the archive CMLMod1.4zip copy the 3 files inside and paste them into the folder A688
Remove and reinsert the battery of your phone
Press and hold the volume down and the end call buttons and then press the power button
Now your phone starts in fastboot mode. Connect it to your PC
Press on your keyboard Windows+R in the pop up window type "cmd" and press Enter
In the dos window type "cd.." (off course without ") and press Enter, until you are in C:\
Now type "cd A688" Enter, then "fastboot getvar version" Enter. If the answer is "0:5" procede, otherwise control if your drivers are correctly installed
Type "fasboot -w" Enter
Type "fastboot flash system system.img" Enter (wait 2-3 min. until it finishes)
Type "fastboot reboot"

Tutorial: Restore your original IMEI
Wrong IMEI seems to lead to a lot of different strange problems while using the phone. So if your IMEI changed after flashing an other ROM it might be better to restore the original one.
All Credits to c.martinez.lozano
Attention!!! this process is delicated!!! I have no responsability for any damages to your phone!​
Dowload this File: and Unpack it to "C:\IMEI"
Go into C:\IMEI and execute setup. This will install PSAS
Execute MadEdit (answer NO), in MadEdit click File-->Open and choose NVList.nvr and we see a lot of numbers
Scroll down until on the left grey side you see "000020C0" and on the same line in the white part you see the numbers ".. .. .. .. 1A 23 45 67 89 AB CD EF...." this is the BAD IMEI
Now open notepad (on your pc) and write down your correct IMEI (found under your battery) putting in front "A" and separing every 2 characters (E.g. if your IMEI is "324867523906130" write "A3 24 86 75 23 90 61 30") and now invert every coupe of letters (in this case you would have "3A 42 68 57 32 09 16 03") *NOTE: thanks to jhonburton for better example
In MadEdit instead of the BAD IMEI "1A 23 45 67 89 AB CD EF" write (replace it) the number you got (in this case "3A 42 68 57 32 09 16 03")
Save the file and close MadEdit
Disconnect from your PC and turn off your phone and restart it into Recovery mode (Camera+Vol. up+Power). Reconnect it to your PC and if necessary install the drivers
Run PSAS (you installed it before) and choose Hardware Forensics-->Use Mobile Ports
Right to Serial Com Port select COM? - Smartphone 2009 Wireless USB Moden. The ? stands for a number. So very important!!! remember for Example if ?=3, remember COM3
Go to the tab Codes (QC) and click on Send SPC
Go to the tab Dialog Port (QC) and on the second drop down menu left to the button Lets go select Restore NVItems (Binary) and then press Lets go
Select the NVList.nrv (we have changed before) and click Open
IMPORTANT Once the process is complete, closed PSAS
Download and install QPST
Launch QPST Configuration
Click on the tab Ports and select Add New Port... and there you write the COM? port you had to remember before (in my example write "COM3") and click OK
In the tab Active Phones now you should see your phone. If not something went wrong.
Click on Start Clients-->SERVICE PROGRAMMING
A window with our phone will pop up. We select OK
Select Load from file and choose the 00000000_sp.qcn inside the folder c:\IMEI and click Open
Click Write to Phone and wait until your phone restarts, with your new IMEI.
Check your IMEI again by dialing *#06# now it should be correct
If your IMEI is still wrong, check accurately if you did everything right (correct number in NRV file etc etc...) if nothing helps procede with following steps:
Turn on the phone in download mode ( Hang up + Vol. Up + Power) and flash Apanda 1.6.2 again
Repeat all the steps of the Tutorial to restore your IMEI
If this didn't help install Apanda 1.6.1 always with the phone in download mode
Repeat all the steps of the Tutorial to restore your IMEI
If you still have problems, try to find another PC with WindowsXP SP3 32bit where you can try again.
Sooner or later you will be able to get you IMEI right (i think so)

thanx a ton suriya I've unlocked my blaze f800

You forget to explain how to use app2sd on CMLMod1.4
Thank's about your translate!!.
Sorry about my bad english

thanks alot. really good tutorial!
i didnt encounter any problems at all, not even those specified by you in the tutorial. as for the underclocked cpu, i see that as an advantage: this android version is faster with lower cpu frequency then the original one (at least for me), and thus, less battery is consumed.
if u dont care about ur phone's warranty (i dont), i really recommend this upgrade.
so far seems stable, but the bug when u place a call and u don't here ringing, persists.
Thanks alot, again!

Is it possible to flash the phone with this room using ROM Manager?
And if following your method do we have to do PART1 of the tutorial? i allready have my phone unlocked and have Android 1.6 for example.
thanks!

I have problem with Imei. After flash it is chaged. And i use this tutorial for restore imei but it didn´t work and my imei is still different thet under battery. And i have problem whit wifi. Maybe bad IMEI is reason for don´t working Wifi
Sorry for my poor english

c.martinez.lozano said:
You forget to explain how to use app2sd on CMLMod1.4
Click to expand...
Click to collapse
I will do as soon as i have my sd (i think it will arrive this week) and i will also translate how to bring it back to 600MHz. By the way, THANKS TO YOU!!!!
floroiu.andrew said:
but the bug when u place a call and u don't here ringing, persists.
Click to expand...
Click to collapse
Explain me better. Do you mean, when you call someone you don't hear this "tuuut-tuuut"? cause if it's that i don't have this bug
by the way if you didn't read it look here, about battery optimization.
nuno_mdj said:
Is it possible to flash the phone with this room using ROM Manager?
And if following your method do we have to do PART1 of the tutorial?
Click to expand...
Click to collapse
ROM Manager doesn't support our phone as far as i know.
I wouldn't skip that part! seems strange but i think i have red that people got trouble if skipping PART 1
gru15 said:
I have problem with Imei. Maybe bad IMEI is reason for don´t working Wifi
Click to expand...
Click to collapse
Try once again step by step. start with PART 1 again. be careful you don't forget anything. Use this version of QPST and a new .nrv file this time. if this does not help we will find a solution together looking step by step (in case c.martinez.lozano is an expert).
By the way wich kind of phone do you have, and from wich country? And wich operating system has your computer?

So i have Orange Boston from Slovakia and i am using WIN vista 32-bit. I read original post on htcmania but it is spanish so i dont understand everything, but some people write there that this tutorial must be use whe RUT is in download mode while i am installing 1.6.2 rom. I don´t know when is RUT in download mode...
And your qpst want serail !!!!

gru15 said:
So i have Orange Boston from Slovakia and i am using WIN vista 32-bit. I read original post on htcmania but it is spanish so i dont understand everything, but some people write there that this tutorial must be use whe RUT is in download mode while i am installing 1.6.2 rom. I don´t know when is RUT in download mode...
And your qpst want serail !!!!
Click to expand...
Click to collapse
Sorry i replaced the qpst links.
ok... not download mode but compatibility mode.
you right click on tha RUT shortcut. on the menu select Properties-->Compatibility check Run this program in compatibility mode for: and select Windows XP (Service Pack 3) then press OK
Now right click on the RUT shortcut again and select Run as administrator.
Try that way. then try that imei stuff again!
cheers
P.S. Anyway if you know where you can use an XP (32 bit) with SP3 i am confident everything will work if you do it step by step

ok IMEI is correct now. But i have a problem with wifi. On any 2.1 rom cant find any network but when i flash 1.6.2 it find. So i dont know where is a problem.

gru15 said:
ok IMEI is correct now. But i have a problem with wifi. On any 2.1 rom cant find any network but when i flash 1.6.2 it find. So i dont know where is a problem.
Click to expand...
Click to collapse
Ok good you restored your IMEI. About WIFI. Best thing is if you ask on htcmania because i don't know what to do.
When you have an answer and corrected your problem please post it here. So i add it to first post cuz other people may have the same issue.

CMLMod 1.5 with some nice new features is on the way!!!

there is in italian version too?

gru15 said:
So i have Orange Boston from Slovakia and i am using WIN vista 32-bit. I read original post on htcmania but it is spanish so i dont understand everything, but some people write there that this tutorial must be use whe RUT is in download mode while i am installing 1.6.2 rom. I don´t know when is RUT in download mode...
And your qpst want serail !!!!
Click to expand...
Click to collapse
dont remember exactly, but in some parts of the tutorial, you have to "Run as administrator" the given applications (RUT, etc). i used win7 32bit, and no problem.

ady_uaic said:
there is in italian version too?
Click to expand...
Click to collapse
No. But with LocaleSwitch you can select italian then most things are in italian. Settings (impostazioni) is still in English, and no italian dictionary on the stock keyboard. you can install another keyboard, to solve this. But wait for CML 1.5. Maybe some better.
floroiu.andrew said:
dont remember exactly, but in some parts of the tutorial, you have to "Run as administrator" the given applications (RUT, etc). i used win7 32bit, and no problem.
Click to expand...
Click to collapse
Yeah thanks for your confirmation. I wrote it on the first page.
cheers suriya

oki..thx for info. but, what does exactly that locale switch app? what are the changes?

Please add Nexian A890 (Indonesian version of this device) on the list too. Here, in Indonesia, we can bring it to the official service center to upgrade it.

ady_uaic said:
oki..thx for info. but, what does exactly that locale switch app? what are the changes?
Click to expand...
Click to collapse
with it you can select languages wich are present in the phone. Italian is also partially present. most things then are in italian. except the settings menu, the camera menu, the date on the lockscreen and maybe something else
minori_aoi said:
Please add Nexian A890 (Indonesian version of this device) on the list too.
Click to expand...
Click to collapse
thanks mate. added

It worked on my Cincinnati bell Blaze,but I can't get the IMEI to change. all works but
the Internet connection, WIFI does work.
Thanks for the 2.1 Upgrade

[Q] Qtek 8310

My phone is only three color mode, if i switch on. I try different rom upgrade but nothing. What i can do?

A little more information is needed:
What does the 3 color screen tell?
What happens if you execute a ROM update?
How do you try to make the ROM update, shipped ROM (which) or a cooked ROM (which)?
Has the device ever worked?
Which ROM was on the device before it got stuck in bootloader (3 color screen)?

Tri-color screen meant by bootloaderit (red, green, blue). When I try to update the ROM, it shows that it would be done, but the re-launch the bootloader all the time. Try a different ROM, which is designed for the HTC Qtek 8310 and the Tornado. WM6, WM61 and WM65. WM5 device worked before, more detailed version i dont know. letter on the screen IPL: 2.00 SPL: 2.00.0009

It seems that the loaded ROM does not succeed to load. If you load a shipped ROM everything outlined below should be done automatically for you, so if that does not work as well, then the device may be broken. So check first if you can load a shipped ROM again.
For cooked ROMs you need to prepare the BINFS to match the size of a ROM before you load it. As you succeed in loading any ROM, the device seems to be CID unlocked already. Check the following:
Connect the device in bootloader mode. Switch off, then keep camera button pressed and insert USB cable.
Disable USB for Active Sync (Connection settings of AS).
startup a terminal program that can connect via USB (e.g. TTerm pro)
connect ot the USB port
press enter
Command prompt appears
enter "info 2" (no quotes) enter
read the last line, it should give something like "HTC SuperCID". If not, then you must CID unlock the device first. Lookup the relevant threads for the cooked ROMs or search for Lokiwiz.
If the device is already SuperCID, then you must match the BINFS formatted size to be larger or equal the ROM size (OS partition). For most cooked ROMs it is the binary file size. Relevant actions are also described in some cooked ROM threads, e.g. mine - see my signature.

What is shipped ROM? Original Rom? I do not have it.
Tera Term
info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
HTCSBPT_0501 Lqœ»HTCE
I try unlock SuperCID with program lokiwiz02b.
But nothing happend.
machinagod's HTC Wizard Unlocker v0.2
NOW WITH CID Unlocking POWER!
--------------------
WARNING: This tool is highly experimental!
I will NOT be held responsible for any problems caused by this tool.
--------------------
Thanks to xda-developers, spv-developers, and especially itsme by the work they
released. This solution would not be possible without them.
--------------------
U. Unlock
L. Lock
C. CID Unlock (SuperCID)
Q. Quit
--------------------
Type the letter and press Enter: c
CID unlocking mobile... DO NOT DISCONNECT UNTIL THE PHONE REBOOTS!
What i try next?

IF your OS is not up, then the lokiwiz will not do anything to your device!
With THIS status you should not succeed in doing any update or format your BINFS. You first need to get the original OS up and running again before you van get any further on changing your OS. The steps to take are:
Get old OS running up again
Application unlock the old OS
CID unlock the device (backup your *.bin files!)
load new OS
1.) is your problem currently. There are several ways to achieve this, try a hard-reset first, this should work for your device:
switch off device
press L+R softkey and hold both
switch on device and keep L+R softkey pressed
wait until prompt and act accordingly
device will reboot to OS
OK now?

I do not have the original OS or even the old OS. After a hard reset as well as the OS does not come up.
# Switch off the Device
# Softkey Press L + R and hold Both
# Switch the device and keep L + R softkey presses
Press 0 to restore factory default. Other key to exit
I press 0
After hard reset load the bootloader again.

OK, then you need to load the CID matching old OS via the shipped ROM standard procedure. Look to: http://www.shipped-roms.com/shipped/Tornado/ and get 8310_2090_253121_020900_to_dan_eur_ship.exe
Execute it on the PC while the device is connected in bootloader mode. If that does not work, then try other ROMs in the same directory until you succeed with the loading.
Mind that a first boot takes 3-5 minutes, so be patient if the bootloader is not coming up any longer. Also do not interrupt the ROM loading in the first steps when the upload has started. It is normal that there are phases where the progress bar does not move. I think the sequence is per partition (IPL, SPL, Splash, OS): load to RAM (bar progressing), load from RAM to ROM = flashing (no bar progress, but color change of bar at the end). The large OS partition is loaded at the end of the sequence so the second step will take some time - be patient.
Good luck!

I try all ROM's but always give me ERROR 294 INVALID VENDOR ID.
And now the phone does not start anymore. No picture. I dont know what happend

This seems to prove that the device has something broken.
Make sure that the battery gets charged while the device is off. Despite the device was connected to USB all the time there is no charging happening in bootloader mode. Wait until the green light is there again before you continue - power drain in bootloader mode is quite heavy.
When none of the shipped ROMs work for upload, it really gets hard to load back an OS running on that for further steps :-(
There is a procedure called "Gold Card method", the rough procedure is (only did that once years back - so this is no step-by-step guide):
Prepare the card so that the bootsector contains the magic device specific "Gold Card" signature. For that you need a trial version of PSAS, and a working windows mobile device(!).
then you would have to load the *.nbh file that gets uploaded to the device (and fails) to that mini-SD card root directory,
rename it to TORNIMG.NBH there
load the card to the device,
then reboot to bootloader (Camera + on)
and hope it gets it loaded
A detailed procedure is described for the Excalibur device but this works equally well for Tornado if you adjust the relevant parts (PSAS is the success of QMAT). Mind that the miniSD card should be in really good condition (fresh full format, check that the file loaded can be read byte-identical from it). If the loading from the card fails or corrupts the IPL/SPL while loading then your device is really bricked. It happened to me with an Excalibur (read the whole thread linked above) - so be extra careful (though - what do have to loose?)!

WM 6 dual language (ENG/GER) Tornado kitchen with SDHC + 28/25MB total/avail storage

Finally the long promised kitchen with dual language support (English/German) for the Tornado. It benefits from the experience I made with creating the Hurricane kitchen and is a merge from the (unpublished) bi-lingual older Tornado Kitchen and the one for Hurricane. It is still the same old OS Version as in my previous kitchen (and the one from NitroGenious) - but some things have improved:
put the kitchen anywhere in the path, no fixed path needed
support for German language in all system menus and applications, including all tweaks and OEM applications (as far as available).
full Direct 3D support (TI drivers work in this ROM)
full support for all 4 key devices and WMP with selectable keyboard driver
still memory tweaked as in the previous kitchen, but some files have been re-compressed without icon compression - to speed up explorer icon access.
The related batch for the _squeezer (UPX) was improved.
quirks left from previous kitchen have been resolved
some more tweaks
reorganized the OEM and SYS folder to have only true generic OS parts in the SYS folder - this should ease future OS porting
For the basic instructions and explanations, please read the older Tornado Kitchen threads my previous Tornado Kitchen and NitroGenious Tornado Kitchen.
For preparing yourself about what cooking is and get started with understanding what you do, look at my Beginners Guide to Windows Mobile (prepare for cooking).
The needed files are shared at mediafire. Make sure to push the "(i) Details" button on top of the list.
You also find a pre-cooked ROM with common content (e.g. NetCF 3.5), so you may want to try that before cooking yourself. Don't forget to format the BINFS correctly before loading the new OS.
The history is:
- Nitrogen Kitchen
- my older Tornado Kitchen
- my Hurricane Kitchen
- this kitchen
Future may be:
- Tornado cooking based on OSBuilder
- Typhoon cooking based on OSBuilder
- mind that Hurricane will not cook with OSBuilder

The ready-made ROM is shared at the same folder as the kitchen. To get a quick start you have to:
For a device that has never seen a custom ROM, download the file "tobbbie_prepare-flashing-(one-time-per-device).zip", unpack it to any folder and find the tools needed for accepting custom ROMs.
For an already Super-CID device, get the file "tobbbie_nk-default-eng_ger-corrected_WM6.zip", unpack it in the same folder as the other zip. Then:
Run "1 as.exe" and kill active Sync
Remove a memory card from the device if there is any inside.
Put the device in bootloader mode (switch off, then press and hold camera key while connecting USB) and connect to the PC
Run "2 mtty...exe" on the PC - you should see a "USB" button on the right of the pop-up coming after some time, press that. In the terminal window press enter to get a prompt. If the USB button is not there, make sure Active Sync is not running.
Enter "info 2" (no quotes) and press enter, you see some lines of feedback, there must be something with "HTC Super CID"
Enter "format BINFS 1c00000" (no quotes), enter - wait for completion
Enter "ResetDevice" (no quotes, UPPER and lowercase exactly as given)
Wait for reboot of device, you get the device in 3 color screen now again
close the terminal window (Ctrl-F4) or the whole mtty (Alt-F4)
Start "3 ROMUpdateUtility.exe" and follow instructions

...reserved for even more further info

I don't understand how to let work the german language on my phone. i download 3 package but i don't know how to begin.

Hm... seems like you have no background on mobile phones ROM update?
The reasons what to do and how to do it are explicitly described in my first kitchen thread in the first post: http://forum.xda-developers.com/showpost.php?p=5386878&postcount=1
Sequence is:
prepare the device that the current OS allows access to system resources that allow later to open the door for cooked ROMs (application unlock)
open the door for cooked ROMs (Super CID) -> this is permanent for this device
flash new ROM (can be any cooked ROM).
If you want the German ROM you find the .nbf file in the mediafire share listed in the first post of this thread.
Please report on your:
device:
actions done so far including results of each step

Hello,
but i do already all this steps with success and my phone works but only with english language.
i also load the german nbf file but its remain only the english language. in in the mediafire share listed, are so many files. What i need exactly? probaly i try it with the wrong file.
p.s. Sorry for my bad english. Im german

Then you are at 95% and miss the simple device configuration, go to:
Start: Settings
-> Regional Settings
--> Language: Deutsch
--> Locale: German (Germany)
There (if you like):
--> Long Date style: middle option (I patched the NLS for this to be available)
You get 2 infos to restart the device (for Language and for Locale), confirm with OK.
Then leave the settings with "Done".
Now press short power: select "Reboot"
Now you have set the device to German.
For Certain applications you may have to do the setting to German within the application, e.g. in CE-Commander - some do not have the option to switch to German.

I also do this. If i go to settings, i can only select the english language and not the German.
In Locale i can select Germany.
p.s. i used this file: tobbbie_nk-default-eng_ger_WM6.nbf

You have to load the correct .nbf file!
The folder where the romupdateutility.exe is located must only have ONE .nbf file contained, otherwise you cannot predict which will be loaded. Look up the first post in this thread for the right file.
Most probably you loaded the .nbf from the first released plain English ROM.
To load a new ROM you must:
1.) format BINFS <right size>, for the ROM located as listed it is "format BINFS 1c00000"
2.) ResetDevice -> Bootloader
3.) rumupdate... with right .nbf
CID Unlock is permanent, latest SPL and Radio as well - no need to repeat any of these actions.
All details are listed in the relevant ROM threads.

Sorry but i don't understand which right file you mean.
The needed files are shared at mediafire? There are 5 files with many folder.
please have patience with me

You managed to load the pure English ROM - that is a start and you seem to have succeeded with most tasks:
- CID Unlock is done: otherwise you would not be able to load a cooked ROM
- WM6 ROM is loaded: only English as Language Selection
You now only need to re-do the tasks to format the BINFS and then load the ROM to the device. In the FLASH folder you should delete the old .nbf file and replace it with the one in the ZIP here: http://www.mediafire.com/?vdsgjg13v9cfnsj.

Please look up post 2: http://forum.xda-developers.com/showpost.php?p=13176294&postcount=2
I have simplified some things and also corrected a minor bug in the ROM and kitchen that had the backlight stay on while mediaplayer was on playback.

great job, mate!

until here:
# Run "1 as.exe" and kill active Sync
# Put the device in bootloader mode (switch off, then press and hold camera key while connecting USB) and connect to the PC
# Run "2 mtty...exe" on the PC - you should see a "USB" button on the right of the pop-up coming after some time, press that. In the terminal window press enter to get a prompt. If the USB button is not there, make sure Active Sync is not running.
# Enter "info 2" (no quotes) and press enter, you see some lines of feedback, there must be something with "HTC Super CID".
everything ok.
in the windows appears:
Cmd>info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
***** user area size = 0x3C8C0000 Bytes
HTCSSuperCID ' HTCE
But if i enter "format BINFS 1c00000" without quote, i have no completion.
cmd>format BINFS 1c00000
or i enter ResetDevice, my device dont reset.
What the error?

Remove the memory card from the device and then re-do the action.
You have a card of 1 GB in the device - you can find it here:
+StorageInit
***** user area size = 0x3C8C0000 Bytes
The device must not have a memory card inserted while doing these things.

I remove the memory card but i have the same problem:
Cmd>info 2
GetDeviceInfo=0x00000002
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
HTCSSuperCID ' HTCE
Cmd>format BINFS 1c00000
Cmd>ResetDevice
Cmd>

This is weird - what device do you have?
Did you update your SPL and Radio to the latest versions (as advised in the "...one time per device" ZIP)? What is the SPL Version on your device?

If i put the device in bootloader mode, there stand in the red color: Tornado IPL 2.00, Tornado SPL 2.00.0014. In the green color Tornado IU.

This is ok - as it should be for IPL and SPL. Now check the following while in bootloader mode connected to mtty:
try to enter just "format BINFS" <enter>
What is the result (should be ok after a short while)?
enter "format BINFS 123" <enter>
What is the result (should be an advice on the valid values as 123 is not a valid one)?
If the first one works, but the second does not, you can still load the ROM, however the free storage space (for installing programs) will be less than what it could be.
Again for curiosity: which Tornado device is that (O2 XDA phone or Qtek 8310)?

Hello,
this is the result:
Cmd>format BINFS
Cmd>format BINFS 123
Cmd>
i have a O2 XDA
thank you for the help