Related
After a lengthy discussion with some developers on this board, I'm going to try and see if it is possible to create a Gold Card for the Prophet.
This is a very low level process, so ONLY try to follow along if you really know what you are doing !!!
So, what are we going to do ? well, create an SD image to be able to un-brick a Prophet (hopefully)
As this SD image will try to circumvent the bootloader security it is called a Gold Card.
We will use itsme typhoonnbfdecode.pl to create this image. (Thx to itsme for his great tool set !)
Creating a "normal" SD Image isn't that hard, to trick comes when you need to fool the bootloader and bypass the security.
Steps:
1. Find out what your docuniqueid is (is not be needed, but nice to have anyway)
2. Find out what your cardid is
3. Change the first two digits of the cardid to 00
4. Find out which -p keys to use (my guess is tornado)
5. Extract IPL/SPL/GSM/OS/SPLASH from a original ROM for the correct model (G3 or G4)
6. Use typhoonnbfdecode.pl to create and SD image (gold card)
7. Test the sucker in my bricked G3
So, let's try to get something working:
I will skip step 1 for now as Its not needed.
2. To get the cardit we need to read a memory dump from another Prophet with the sd card inside
pmemmap -s 0x06000000 -w deviceexe.mem -p 0x10000000-0x12000000
we are dumping the section of memory where device.exe is running (you can check this with pps)
In this memory dump we search for the unicode string 'Memory Card'
This is where I am at the moment, as the above was done on another HTC device I think I need to search for a new mem location where the cardid is stored.
So any people reading this that know another way of getting the sd cardid, let me know.
Example cardids:
# 55 4500 accf6300 55 3832314453 4453 03 'UE...c.U821DSDS.' .. my minisd
# 3f 5100 09531f40 03 424d383231 4e49 18 '[email protected]' .. my kingston
# 3f 3c00 65ba4764 07 3832314453 4d54 02 '?<.e.Gd.821DSMT.' .. my daneelec
# 00 4200 0f588942 41 4238323153 4150 01 .... bjorns sdcard
glad to help you
glad to help you un-brick your phone but need more details on these steps.
I am not a programmer so you'll have to explain more.
I do generally pick up these things quick, but will need to point me in the right direction.
AbuYahya said:
glad to help you un-brick your phone but need more details on these steps.
I am not a programmer so you'll have to explain more.
I do generally pick up these things quick, but will need to point me in the right direction.
Click to expand...
Click to collapse
Don't worry, I will update as I find out more
Hi,
Few months back I tried to make one for my Device but was unsuccessfull as I was not able to get DOC uniqueID and finding SD Card's unique ID is hell of a JOB.
So I Quit at that time but after seeing your post, I am again feeling energetic.
However the only method I know is as under.
Dont remember the exact location but will let you know (Taken somwhere from XDA Forum)
Finding out the docuniqueid
it is in memory at 0x8e01509c:
pmemdump 0x8e01509c 0x10
alternatively you can use this:
pdocread -l
Finding out the cardid (this is more difficult)
first find out the section of device.exe with pps usually it is 0x06000000. then save this section to a file using:
pmemmap -s 0x06000000 -w deviceexe.mem -p 0x10000000-0x12000000then in this memory dump, search for the unicode string 'Memory Card':
findstr "Memory Card" deviceexe.memthen dump the memory starting 0x18 bytes before where memory card was found:
dump deviceexe.mem -o 0x90a2a0 -l 0x90this results in something like this:
0090a2a0: 53 42 44 53 ec 00 00 00 f0 6f b7 03 00 00 00 00 SBDS.....o......
0090a2b0: 68 ea 8f 00 00 00 00 00 4d 00 65 00 6d 00 6f 00 h.......M.e.m.o.
0090a2c0: 72 00 79 00 20 00 43 00 61 00 72 00 64 00 00 00 r.y. .C.a.r.d...
0090a2d0: 63 00 65 00 30 00 00 00 00 00 00 00 00 00 00 00 c.e.0...........
0090a2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0090a2f0: 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 ................
0090a300: 30 b1 90 00 68 bf 90 00 70 12 b5 03 5c a9 00 80 0...h...p...\...
0090a310: ff 00 00 00 00 55 45 00 ac cf 63 00 55 38 32 31 .....UE...c.U821
0090a320: 44 53 44 53 03 ab 40 40 92 ff 4f fa fe c0 83 59 [email protected]@..O....Ynote: that the SBDS signature needs to be there.
the 16 bytes starting at 0x90a315, 55 45 00 ac ... etc are the cardid.
DoCtOr_X said:
Hi,
Few months back I tried to make one for my Device but was unsuccessfull as I was not able to get DOC uniqueID and finding SD Card's unique ID is hell of a JOB.
So I Quit at that time but after seeing your post, I am again feeling energetic.
However the only method I know is as under.
Dont remember the exact location but will let you know (Taken somwhere from XDA Forum)
Finding out the docuniqueid
it is in memory at 0x8e01509c:
pmemdump 0x8e01509c 0x10
alternatively you can use this:
pdocread -l
Click to expand...
Click to collapse
If you look at my post above you can see I'm doing the same
however, pdocread on a bricked phone obviously doesnt work, however the docuniqueid MIGHT not be needed.
for cardid is trickier, as the cardid seems to be hidden on a different memory location then normal (read, older devices)
I'm trying serveral things to get to this
I just bought a new cardreader, so I can continue testing this
Hi,
Wish u best of luck but unfortunately I have no success.
Any Success ????
working on something that might get us a working gold card
stay tuned
Ok, it's possible to create a gold card, meaning, that I can create an SD that will lower the sec level to 0
This is nice, however doesn't help (yet) with the G3/G4 wrong SPL problem.
But it is one step closer as it is now confirmed that you lower the sec level using this method.
Next step will be to see if I can "update" an existing G3 SD Image with the cardid of my card and get it to boot.
I know it might not make sence what I'm saying now, but it's just an update on the progress made so far, and yes I will update the first post with a how to.
more later.
Nice, keep up the good work!
Well Done, I am really amazed.
Thanks & please keep it up.
So am I understanding that right you need another htc which is working to get the cardid? Is it possible to get all that done just with a regular cardreader plugged into the computer?...
cr0ssy said:
So am I understanding that right you need another htc which is working to get the cardid? Is it possible to get all that done just with a regular cardreader plugged into the computer?...
Click to expand...
Click to collapse
It MIGHT be, but I haven't tried that yet
Huh they are very similar
Hi Jesterz so far I have the same problem as you are with my dev g3
with spl from g4
So did you get your device to boot or what ideas do you have
Maybe this will help us Customize_rom_PDAMobiz_Editon_Upgrade_Rom_for_IPLSPL_2.15.0001_v.1.02
Help
Dear Jesterz, could You please help me.I used your RUU-Prophet-g4-AKU2.2-2.20-2.47.21-Jester-r1 to flash my G3 so i did not read carefully your post. It passed but device stills in bootloader mode. Is it possible to solve my problem and how.I have not other prophet to make goldcard. Tnanks in advance
mjankovic said:
Dear Jesterz, could You please help me.I used your RUU-Prophet-g4-AKU2.2-2.20-2.47.21-Jester-r1 to flash my G3 so i did not read carefully your post. It passed but device stills in bootloader mode. Is it possible to solve my problem and how.I have not other prophet to make goldcard. Tnanks in advance
Click to expand...
Click to collapse
Now u must also wait for GoldCrad project....
Yes thank you very much doctor_x so would you please let me know where it is finish and where i can find it
Hi,
If I'm not missing anything, there are actually two types of ID's for SD cards:
1. "Hardware ID", that is truly low-level and is provided by the card manufacturer.
You can use Pocket Mechanic to read it, but I have no idea how you can manage to change it. Please let me know if you have a solution on this one.
2. Let's call it "software id" - an id that you get after your card is formatted (something like a partition id) - you can use a card-reader and some software like Acronis Partition Expert to read and change it.
mjankovic said:
Yes thank you very much doctor_x so would you please let me know where it is finish and where i can find it
Click to expand...
Click to collapse
The main person involved in this project is "Jesterz". I was about to gaveup when jesters started new effort and infused new spirit in the project.
Now lets hope it works but uptill now no breakthrough.
I read somewhere that I dont have to SUPER CID to install a 3rd party ROM, or perhaps our WM6 ROM
"Here is how I got the rom to install without the devauth error.
1) use a hex editor on the rom file and search for the devauth.exe string e.g. 44 00 65 00 76 00 41 00
2) between the "devauth" and the "exe" you will see the hex "00 2e".
3) swap these bytes around so they are "2e 00" instead of "00 2e".
4) This will keep te same checksum but will not allow the devauth.exe to run. well it work in my case at least"
Hope it works
Click to expand...
Click to collapse
Will the above method works? because my phone is still under warranty, and i dont want to void it so early
Well. I've spent 1 week. Yes, one week. I haven't been productive at all becacuse I've dedicated more than 16 hours per day to find one stupid answer to this question:
Once you dump the rom of your kaiser into the Part00.raw, Part01.raw, Part02.raw and Part03.raw, how can you create an NBH file?
Listen everybody: I've been looking for this site AND OTHERS, and the only gaseous, not so clear at all, lame answers are: "Oh, oh. You need to use Tadzio´s tools".
And that's it. How the f.... do you think that an answer like that is going to work?
Step by Step instructions, people !!!!!
That's what we need to build knowledgebase.
Most people are lazy and want fast answers with out reasearching. That's why they brick their phones. Others, like me, do our their homework but since there isn't anywhere else to ask, so, I have no choice to create a new thread since there isn't NO G.. D..N answer in the forum or in the site !!!!
I have my eyes squared and peeled of looking google's, live search and yahoo results.
Please, people, lets recreate the scenario:
You have a kaiser (TyTN II or what ever you want to call it) phone and you decide that, before bricking, or, even in case of bricking it, you want to copy your original ROM and have a copy of it and also BUILD, for chrisake, a flashable ROM to make the restore procedure easy and dandy.
You download itstools and execute pdocread.exe -l to get the RAW files.
Once you get your 4 RAW files, THEN WHAT????
All what I could find is that you can use some tools from Tadzio called imgfstools but, again, and so nice from you, NO INSTRUCTIONS AT ALL !!!!
So. Any kind soul to give a DETAILED, step-by-step walk through for a Kaiser?
Thanks, community.
http://forum.xda-developers.com/showthread.php?p=1968557
"How to Reconstruct a Dumped ROM & Reconstructed ROMs" by jcespi2005
goye said:
. . . Once you dump the rom of your kaiser into the Part00.raw, Part01.raw, Part02.raw and Part03.raw, how can you create an NBH file?
. . . So. Any kind soul to give a DETAILED, step-by-step walk through for a Kaiser?
Thanks, community.
Click to expand...
Click to collapse
I think this is the thread you want, "How to Reconstruct a Dumped ROM & Reconstructed ROMs" by jcespi2005
Thanks, but no thanks ....
Thanks community for your fast reply.
Well, actually that article "How to Reconstruct a Dumped ROM & Reconstructed ROMs" (http://forum.xda-developers.com/showthread.php?t=337066) from jcespi2005 sucks.
He doesn't give any details of how to do it.
I did learn a lot from doctaJay's videos (http://forum.xda-developers.com/showthread.php?t=372469) on his series "Cooking Guides for the Ultimate Noobs- Screencasts".
Now that's helping the community.
But, no. I need to build FROM SCRATCH my own NBH files using my Part0x.raw files. I don't need to use any one's RUU_Signed.nbh file to cook mine. I need to create FROM SCRATCH the NBH file only from my RAW files, with out using any other NBH file!
I mean ----
0. You tweak your registry IN YOUR PDA, not the computer, to change a Security Policy key:
HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1
YOU NEED TO USE A Registry Tweaker like RegeditSTG. Google it just as I did.
Once you've done all this, then
1. you pdocread.exe -l your ORIGINAL ROM from your kaiser.
So you get an output like this:
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.63M (0x3a0000) Part01
| 68.50M (0x4480000) Part02
| 135.13M (0x8720000) Part03
STRG handles:
handle a7486c82135.13M (0x8720000)
handle a749618e 68.50M (0x4480000)
handle 074aff52 3.63M (0x3a0000)
handle 074aff76 3.12M (0x31f000)
disk a7486c82
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a749618e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074aff52
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074aff76
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Cute!
2. Step Two is Supposed to be creating your own, personal NBH installer kit from your original dumped ROM without using any other's ruu_signed.nbh downloaded from some guy's ROM kit.
I've read that you need Tadzio's imgfstools for doing so. See?
Even Tadzio's, the creator of the tool doesn't even explain, men and women !
That's pretty much f...ed up !
3. Open and HardSPL your phone BEFORE doing ANY FLASHING TASKS or you would really end up with a nice paper holder on your desk.
4. You should find a way to back up your RADIO ROM.
That's something completely differerent from the OS ROM. Many people complains that once they use some guy's ROM kit, their phones stop working in their networks.
Me, I live in Japan. I can't just download what ever ROM kit and flash my Kaiser, since in Japan my phone provider, E-Mobile, uses a weird 1700 Mhz W-CDMA frecuency, and most of the ROM kits are flashed for GSM networks and different 800Mhz - 1900 Mhz and 2100 Mhz GSM/GPRS networks.
Many stupidly think that flashing a phone's OS is a matter of downloading a g.. d...ed ROM and "bingo", you got your phone done. Actually, because following this guy jcespi2005's ROM (I can't blame him. You can't blame no one for flashing and messing your own ROM, I want to make that CLEAR), my phone doesn't work.
So .... You have to be careful and teach others to be careful, but the best way is to do a comprehensive, all in one step-by-step guide that will clearify most of the doubts of people.
5. Cook your own ROM's
I think, personally, that following these steps will prevent most people of bugging their phones and, at least, in the worse scenario, be able to some how restore most of the original condition of the kaiser so we can claim service or guarantee.
---------------------------------------
We have our RAW files from scratch, dumped BEFORE DOING anything that potentialy might brick our kaiser.
Now, before cooking and all that (again, thanks doctaJay for your screencasts, you da man !), I need to know:
HOW CAN I BUILD AN IMAGE FILE FROM TOTALLY SCRATCH JUST USING MY OWN RAW FILES !!!
It is said that we can use imgfstools from tadzios, but, as usual, not even a g.. d..med clue here !
Instructions !!
I can commit to post a nice, very in depth screencast for all of the people, but, please, I need to create from scratch, with out using ANYONE's dumped image NBH or ROM, a ROM file.
It's as simple as this: How did the FIRST PERSON IN this community manage to create FROM SCRATCH a NBH from his/her RAW files? And let it be told: FOR A KAISER, for chrisake ! Don't compare apples with oranges, even if they tend to behave alike.
See? That's the nature of the question. I'm not interested in COOKING A ROM, using as a base someone else's ROM.
That's the question, community.
Believe me, once I have all these steps mastered, I will make videocasts (screen casts) in both English and Spanish (Maybe Japanese as well).
So, help me out to help others and in tha way we can help new users in a better way !
Thanks !
i don't know how much reading you did in either post from the other guys but the threads they posted give you a STEP-BY-STEP walkthrough, if you can't read the walkthrough then you're a f*****g idiot and you shouldn't be trying any of the $h1t you are trying to do. READ i read through both of those threads posted and now i can dump a rom and cook one for the hell of it, mine only go to me but whatever. your steps only say "2. Step Two is Supposed to be creating your own, personal NBH installer kit from your original dumped ROM without using any other's ruu_signed.nbh downloaded from some guy's ROM kit.
I've read that you need Tadzio's imgfstools for doing so. See?
Even Tadzio's, the creator of the tool doesn't even explain, men and women !
That's pretty much f...ed up !" well that's not an answer. don't creat a thread just to ***** about how you want an answer, write your own damn program and DIYFS if you want to do everything from scratch.
personally i thank each and every member who has contributed anything, because without the guys here i would still have a stock att rom(minus bloat). thank you chefs and all others that have allowed my phone to be as great as it can be
STEP 1: Extract the RAW (IMGFS) file to a dump directory
imgfstodump part02.raw
fgs......how much more info do you need.
from the rom reconstruction thread.
jcespi2005 said:
2. Download the WWE BaseROM to use in the reconstruction process here http://rapidshare.com/files/5781641...dio_sign_22.45.88.07_1.27.12.11_Ship.rar.html
3. Download the modified version by Alex of Kaiser Kitchen here, that allows to reconstruct the ROM from the dump. Follow the guide included in the Readme using WWE from previous step and to will get you reconstructed ROM from your device.
Click to expand...
Click to collapse
sure i admit, that's not that much info, which is why i gave u the link to doctajay's screencasts, watch all his videos, everything you need is there. what more do you want?
I forgot to mention: My network is not GSM or similiar and I can't smoke my Radio
tubaking182 said:
i don't know how much reading you did in either post from the other guys but the threads they posted give you a STEP-BY-STEP walkthrough, if you can't read the walkthrough then you're a f*****g idiot and you shouldn't be trying any of the $h1t you are trying to do. READ i read through both of those threads posted and now i can dump a rom and cook one for the hell of it, mine only go to me but whatever. your steps only say "2. Step Two is Supposed to be creating your own, personal NBH installer kit from your original dumped ROM without using any other's ruu_signed.nbh downloaded from some guy's ROM kit.
I've read that you need Tadzio's imgfstools for doing so. See?
Even Tadzio's, the creator of the tool doesn't even explain, men and women !
That's pretty much f...ed up !" well that's not an answer. don't creat a thread just to ***** about how you want an answer, write your own damn program and DIYFS if you want to do everything from scratch.
personally i thank each and every member who has contributed anything, because without the guys here i would still have a stock att rom(minus bloat). thank you chefs and all others that have allowed my phone to be as great as it can be
Click to expand...
Click to collapse
Also, I already mentioned this (who's not reading?):
goye said:
4. You should find a way to back up your RADIO ROM.
That's something completely differerent from the OS ROM. Many people complains that once they use some guy's ROM kit, their phones stop working in their networks.
Me, I live in Japan. I can't just download what ever ROM kit and flash my Kaiser, since in Japan my phone provider, E-Mobile, uses a weird 1700 Mhz W-CDMA frecuency, and most of the ROM kits are flashed for GSM networks and different 800Mhz - 1900 Mhz and 2100 Mhz GSM/GPRS networks.
Click to expand...
Click to collapse
That's why I need to create my own ROM from SCRATCH, not taking other ROMs as a base.
For Cooks
The main reason for creating this thread is that many here in this forum have asked me for the method to change the pagepool of the later ELFin ROMs that are based on the 2.20.xxx.xx stock roms. Incidentally, these ROMs are also used for the ELFs.
Firstly, I must thank duttythroy's thread HERE in the Kaiser forum that inspired me to successfully search for the illusive pagepool offsets in the ELFin ROMs, which I was searching for months. Following the same modus operandi, the unique hex string pattern responsible for the pagepool was found to be:
|03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
This walkthrough is targeted at the more advance users i.e. Chefs and I shall not be responsible for any damages to your devices if you do not follow the instructions given below.
For Regular Non Cooking Users please Look at The Second Post with the Multi PP Changer (Beta For Now)
Let me do a walkthrough on how to change the ELFin's 12MB Default Pagepool to 18MB Pagepool and other pagepools of your desire
[12MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| ELFin's Default Pagepool
[16MB Pagepool] |10 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[18MB Pagepool] |12 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[24MB Pagepool] |18 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
To begin with, we will need a few stuff to perform the pagepool change:
- OS.nb or .NBH file (your targeted 2.20.xxx.xx ROM)
- A Hex Editor [Hex Edit Free 2.5] to edit the offsets
- Alot of guts.... keke
1. [HOW TO CHANGE ELFIN'S PAGEPOOL]
Step 1: Open the OS.nb or .NBH file with a Hex Editor
Step 2: Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| (Two addresses should be found)
Step 3: At the first address found, change the first two bytes "03 15" to "12 16" for 18MB pagepool
Step 4: Repeat Step No.3 at the 2nd address found
Step 5: Save & Exit the Hex Editor
Step 6: If you are using the OS.nb, start cooking your new ROM with it
Step 7: Flash the new .NBH file to your ELFin and enjoy the 18MB True Pagepool
For other pagepool sizes, change the first byte "03" to "XX" hex value corresponding to your desired pagepool in Step No.3 & 4. (Remember that this is hex value, i.e. "10" = 16MB, "12" = 18MB, "18" = 24MB, etc.)
2. [HOW TO CHANGE ELF'S PAGEPOOL]
Through comparison, I also discovered that the ELF's Default Pagepool is 8MB and is different from the ELFin's 12MB Pagepool within the same ROM. I reckoned then that it must be determined by a different set of bytes in the unique hex string pattern and discovered that they are "02 15", the fifth and sixth bytes of the string pattern:
[8 MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| ELF's Default Pagepool
[4 MB Pagepool] |03 15 A0 03 | 04 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[6 MB Pagepool] |03 15 A0 03 | 06 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[0 MB Pagepool] |03 15 A0 03 | 00 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|
Step 1: Open the OS.nb or .NBH file with a Hex Editor
Step 2: Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| (Two addresses should be found)
Step 3: At the first address found, change the 5th & 6th bytes "02 15" to "04 16" for 4MB pagepool
Step 4: Repeat Step No.3 at the 2nd address found
Step 5: Save & Exit the Hex Editor
Step 6: If you are using the OS.nb, start cooking your new ROM with it
Step 7: Flash the new .NBH file to your ELF and enjoy the 4MB True Pagepool
For other pagepool sizes, change the fifth byte "02" to "XX" hex value corresponding to your desired pagepool in Step No.3 & 4. (Remember again that this is hex value, i.e. "04" = 4 MB, "06" = 6 MB, "00" = 0 MB, etc.)
3. [EFFECTS OF ZERO PAGEPOOL:]
No pagepool or zero pagepool will force the device to go into the dynamic mode where the entire RAM can be used for pagepooling without limits. Your device should be snappier but your used RAM memory might suffers at times. Appear to work well for devices like Elf, Prophet, etc with low RAM memory of 64MB and below. Some tests carried out by the Dynamic Duo ababrekar and htctouchp had confirmed this phenomenon. Tests on Kaiser with 128MB RAM had shown disastrous results: the kaisers were just crawling very slowly... hehe. Some people sweared by it and said it's SUPER-FAST! Well, this you got to find out by yourself...
NOTE: I have intentionally described the steps in details in the hope that someone who is good in programming will develop a simple "Change Pagepool" program that can do all these with the simple click of a few buttons. Better still if the progam can change the pagepool of the ROM that is in use through USB activesync...That will be the day!
HAVE FUN & ENJOY YOUR TRUE PAGEPOOL!
For Reference: SPB Benchmarking on the different pagepools done by pof and Larentius26
For those who want to change pagepool in ELF, the easy way using USB Activesync, download the small Change Pagepool App (ELF) created by tabi13 below:
ChangePPvAS
Universal Page Pool Changer - for Elf/Elfin only
This tool provides support for both Elf/Elfin and 1.1x/2.2x/3.xx ROMs, so it is a true universal Page Pool Changer. It will write to the appropriate area in memory, reboot your device and then read back the new value. This method is much faster than changing the page pool in the ROM file by hand, which requires re-flashing the entire ROM.
To use this: Unzip the attachment, connect your device to ActiveSync and then run pp.bat.
USE AT YOUR OWN RISK. BETA VERSION ONLY SO FAR. ENSURE YOU HAVE THE USPL INSTALLED!
This program would not have been possible without people like Swiftblade, tabi13, ayyu3m, htctouchp, Noonski and other cookers providing the offsets/strings to write to as well as testing it.
Posts for this Universal Testing PP Changer starts here:
http://forum.xda-developers.com/showpost.php?p=2585064&postcount=123
UPDATE: Now working with all 3.xx ROMs, INCLUDING 3.xx ROMs with ULDR removed.
STILL TO DO: 2.xx ROMs with ULDR removed
SCREENSHOT #1 - Changing Page Pool:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
SCREENSHOT #2 - Reading back the new value after reboot (reboot time is partly dependent on the new page pool size):
I will need feedback for the following:
1) Elf with 2.2x ROM
2) Elfin with 2.2x ROM
3) Elf with 1.1x ROM
4) Elfin with 1.1x ROM (NOTE: don't flash a 1.1x shipped ROM on your Elfin! Use just the OS ROM)
5) Elfin with 2.81 ROM*
6) Elf with 3.xx ROM
7) Elfin with 3.xx ROM
*It looks like Elfins that come installed with a 2.81 stock ROM do not contain the Page Pool values at the expected locations. If you however flash the dumped 2.81 ROM to a non-2.81 Elfin, the PP is read correctly on the non-2.81 Elfin.
cool walkthrough brother.. cool.. keep it up.. hope to see a nice pagepool changing software someday by some programmer
Swiftblade said:
Oops... some errors here. Thanks bro for pointing them out. I will edit them in a moment.
Click to expand...
Click to collapse
thanks for such an explanatory post bro
i've one question though. i modified the PP of my ROM to 16 MB and after flashing just when i got the prompt for screen alignment, i got some errors showing some exe's not able to run namely replog.exe, tskschedule.exe and 3-4 others. i didnt modify anything else in the ROM.
how is the he value calculated? i want a 6mb pp for which i dont know what the hex value would be.. is there a calculator or something? so i wont have to ask each time
htctouchp said:
thanks for such an explanatory post bro
i've one question though. i modified the PP of my ROM to 16 MB and after flashing just when i got the prompt for screen alignment, i got some errors showing some exe's not able to run namely replog.exe, tskschedule.exe and 3-4 others. i didnt modify anything else in the ROM.
Click to expand...
Click to collapse
Hi htctouchp.. did you change the "03 15" at both occurrences in the .nbh files. The patterns should only appear twice, if not somethings is very wrong.. just curious.. you use os.nb or .nbh file?
Swiftblade said:
Hi htctouchp.. did you change the "03 15" at both occurrences in the .nbh files. The patterns should only appear twice, if not somethings is very wrong.. just curious.. you use os.nb or .nbh file?
Click to expand...
Click to collapse
actually i tried this just 5 mins before ur post, in the manner explained by dutty(and ameet), first edited the S000 of nk.exe and then modified the os.nb and while editing the os.nb, i found this pattern just once, not twice.
ababrekar said:
how is the he value calculated? i want a 6mb pp for which i dont know what the hex value would be.. is there a calculator or something? so i wont have to ask each time
Click to expand...
Click to collapse
Some numbers in hex:
"00" = 0
"01" = 1
"02" = 2
"03" = 3
"04" = 4
"05" = 5
"06" = 6
"07" = 7
"08" = 8
"09" = 9
"0A" = 10
"0B" = 11
"0C" = 12
"0D" = 13
"0E" = 14
"0F" = 15
"10" = 16
"11" = 16+1 = 17
"12" = 16+2 = 18
"13 = 16+3 + 19
.....
Swiftblade said:
Some numbers in hex:
"00" = 0
"01" = 1
"02" = 2
"03" = 3
"04" = 4
"05" = 5
"06" = 6
"07" = 7
"08" = 8
"09" = 9
"0A" = 10
"0B" = 11
"0C" = 12
"0D" = 13
"0E" = 14
"0F" = 15
"10" = 16
"11" = 16+1 = 17
"12" = 16+2 = 18
"13 = 16+3 + 19
.....
Click to expand...
Click to collapse
cool.. so for 4mb pp, i have "04 16"
for 6mb pp, i should have "06 16"
and for 8mb pp, i should have "08 16"
rite? thanks for the prompt reply brother
htctouchp said:
actually i tried this just 5 mins before ur post, in the manner explained by dutty(and ameet), first edited the S000 of nk.exe and then modified the os.nb and while editing the os.nb, i found this pattern just once, not twice.
Click to expand...
Click to collapse
hi htctouchp... the string pattern in Kaiser is different from ELFin and that explained why you found it once. So you probably edited some .exe program instead of pagepool.
Search the string pattern as given above and try it again. Should work and forget about nk.exe, just do it on the .NBH file straightaway and re-flash it back to your device. Cheers.
Swiftblade said:
hi htctouchp... the string pattern in Kaiser is different from ELFin and that explained why you found it once. So you probably edited some .exe program instead of pagepool.
Search the string pattern as given above and try it again. Should work and forget about nk.exe, just do it on the .NBH file straightaway and re-flash it back to your device. Cheers.
Click to expand...
Click to collapse
no bro...i meant i only used that method..but the string which i used was the same as the one mentioned by u.
htctouchp said:
no bro...i meant i only used that method..but the string which i used was the same as the one mentioned by u.
Click to expand...
Click to collapse
What ROM are you using? 1,17.xxx or 2.20.xxx ??
If you are using the 2.20.xxx rom and editing the .NBH file, the addresses found should be at 0X438DC and 0X353637... try searching again...
Swiftblade said:
What ROM are you using? 1,17.xxx or 2.20.xxx ??
If you are using the 2.20.xxx rom and editing the .NBH file, the addresses found should be at 0X438DC and 0X353637... try searching again...
Click to expand...
Click to collapse
yup, the strings are at these very addresses mentioned by u bro and i use 2.20.xxx ROM
Excellent.... have been waiting for this. Good job!
THANK YOU!
thank you!
Finally I am able to get new ROMs with proper 4MB pagepool on my puny Elf!!!
Tried the trick on Ameet's 4.01 UC rom, and it worked.
zeflash said:
THANK YOU!
thank you!
Finally I am able to get new ROMs with proper 4MB pagepool on my puny Elf!!!
Tried the trick on Ameet's 4.01 UC rom, and it worked.
Click to expand...
Click to collapse
pkoper said:
Excellent.... have been waiting for this. Good job!
Click to expand...
Click to collapse
We are here to share and it's good to know that it is of help to you bros.... Enjoy the true pagepool... keke c",)
htctouchp said:
yup, the strings are at these very addresses mentioned by u bro and i use 2.20.xxx ROM
Click to expand...
Click to collapse
How did it go? Manage to solve the problem? I re-look your problem and it might not be related to the pagepool changing.
I suspect one or two things: UC and/or SQM removed from your Rom... ?? And again I may be very wrong.... Cheers.
Swiftblade said:
I suspect one or two things: UC and/or SQM removed from your Rom... ?? And again I may be very wrong.... Cheers.
Click to expand...
Click to collapse
even i can find only one instance of the hex string if i try to edit the nbh or nb file directly.. but i have the sqm removed from my rom, is that why?
ababrekar said:
even i can find only one instance of the hex string if i try to edit the nbh or nb file directly.. but i have the sqm removed from my rom, is that why?
Click to expand...
Click to collapse
They are 2 separate issues. I'm saying that if SQM module in WM6.1 is not removed properly, it can cause some of the .dlls not loading as mentioned by Aman.
Ameet bro... you mean you can only find one instance of the hex string in your roms? Only possibility of that happening is when the nk.exe in the XIP was removed during porting.... Now this get me thinking, maybe we need to hex edit only once, i.e. the higher offset at 0X353637....ummh...
The one instance of hex string is at the higher offset address in your case?
Swiftblade said:
They are 2 separate issues. I'm saying that if SQM module in WM6.1 is not removed probably, it can caused some of the .dll not loading as mentioned by Aman.
Ameet bro... you mean you can only find one instance of the hex string in your roms? Only possibility of that happening is when the nk.exe in the XIP was removed during porting.... Now this get me thinking, maybe we need to hex edit only once, i.e. the higher offset at 0X353637....ummh...
The one instance of hex string is at the higher offset address in your case?
Click to expand...
Click to collapse
yes it is the highest offset.. but i tried this trick on a rom in which i had already hex edited the sooo in nk.exe and then after cooking i could find only one instance.. but the trick of directly editing nb file didnt work for me (or maybe i did something wrong, which i'll try again) but the nk.exe trick and then nb files worked like a charm for me
ababrekar said:
even i can find only one instance of the hex string if i try to edit the nbh or nb file directly.. but i have the sqm removed from my rom, is that why?
Click to expand...
Click to collapse
Well, I found 2 instances of the hex chain in your 4.01 rom (nbh direct edit). You might want to check again
Hi,
I start this thread to help people like me to solve costum rom issues...
I've install Costum rom like RR, Tipsy, lineage, ... always same issues:
1- phone data wire lost/disconnect all the time
2- if someone call me and it miss, when I push on recall it dial without the "+" like in France :
incoming call is 06 88 61 03 93 ... redial is 33 6 88 61 03 93 and not+33 6 88 61 03 93... "unknown number !"
does anyone could corrected these issues ?
Best resgards
i think you lost efs. If you didn't backup your efs you are in deep hole my friend..
if you have backup just flash it with TWRP.
im using ambasadii v18 and rom create efs_backup folder after flashing, then i save it on sd card and im save
I have G935S any custom rom I flash my Capacitive buttons dont work works on stock though
same issue!