How to Reconstruct a Dumped ROM & Reconstructed ROMs - Tilt, TyTN II, MDA Vario III Windows Mobile ROM De

This is the procedure to convert the dumped ROM into NBH "flashable" file. I take no responsability in any damage on your device. If you're not sure what you're doing, take time to learn some basics from wiki.
Well, i manage to reconstruct the spanish dumped rom from my Kaiser. This thread is about how to reconstruct a dumped Kaiser ROM, to have the original ROM that cames with your Kaiser, so you can revert to origin.
1. First of all is to Dump the ROM from your device. For this you only need to go to Pof post here and follow the instructions. After dumping the ROM you'll have 4 RAW files. Take apart in one folder the Part01.raw that contains the XIP and Part02.RAW that contains the IMGFS, both needed for the reconstruction process.
2. Download the WWE BaseROM to use in the reconstruction process here http://rapidshare.com/files/5781641...dio_sign_22.45.88.07_1.27.12.11_Ship.rar.html or http://rapidshare.com/files/1205992....5_radio_sign_22.45.88.07_1.27.12.11_Ship.exe
3. Download the modified version by Alex of Kaiser Kitchen here, that allows to reconstruct the ROM from the dump. The Kaiser Kitchen allows to cook a ROM from a dumped one and from base NBH shipped one. You need to put the NBH file from the step before in the BaseROM folder, and put the RAW files too. Then execute the KAISERKITCHEN.CMD and choose the next options from the menu it this order:
e, b (for dumped ROM), c, b, choose BuildOS tab, Load ROM option, Choose the KaiserKitchen folder, Go > Option, Close BuildOS, in the HRT choose ROM Builder, Choose Kaiser in device list, in the System button choose the os-new.NB file from the Kaiser Kitchen folder, press the BuildROM button and save as RUU_signed.NBH
Thanks to JugglerLKR for help me and the knowledge to solve the issues into reconstructed ROMs, and Alex to make a better script...
Thanks to all the testers who make this work for me
Cheers.

List of Reconstructed ROMs (all BigStorage and only OS)
Spanish HTC 1.56.412.4
Polish HTC 1.56.118.4
Sweden HTC 1.56.413.2
Russian HTC 1.56.411.5
German TMobile 1.56.111.4
UK TMobile 1.56.110.4
Italian HTC 1.56.408.5 or Mirror thanks to udK
German HTC 1.56.407.3
Norwegian HTC 1.56.409.4
Chinesse HTC 1.56.708.3
German Vodafone1.56.162.5
German SwissCOM 1.56.166.2
Netherlands TMobile 1.56.114.4
French Orange 1.81.73.1
Italian Vodafone 1.56.165.5
UK Vodafone 1.56.161.4
UK Orange 1.81.61.2
Danish HTC 1.56.403.3
FIN HTC 1.56.414.2
PTG HTC 1.56.410.2
Croatian TMobile 1.82.119.1 (WWE)
Spanish Vodafone 1.56.164.3
Czech TMobile 1.56.113.4
Slovakia Orange WWE 1.81.68.3 (thanks to Leon.nr)
Czech O2 1.56.405.5 (other version thanks to Leon.nr)
Croatian VIPNet 1.56.405.5
Dutch Vodafone 1.56.172.3
CZech HTC 1.56.405.5
German T-Mobile Austrian Rom 1.62.112.4 with shipped radio 1.27.12.32 (Thanks to GSLEON3)
Portuguese Brazillian HTC 1.88.514.1 (thanks to Denis Costa)
Dutch HTC 1.56.404.6 (thanks to Imperium)
Spain Orange 1.85.75.1

Thanx
That was a wonderfull guide. Now I gonna dump and reconstruct my Swedish rom so I can test the new cooked roms and have my Swedish as backup

batch file for steps 4 to 7: mind the filenames!
Waiting for this explanation I kind of figured out this myself...
Great move to make a tutorial!!!
If it helps, I made two batch files (reconstruct conservative ROM from dump.bat) from step 4 to 7.
All you need is to have an 'original' OS.nb (named Windows.nb in your tutorial) and the Part02.raw in the same directory as this batch file, along with all the programs described in step 1 to 3.
usage:
bigstorage 03_OS.nb Part02.raw
or
conservative 03_OS.nb Part02.raw
It performs the described steps and deletes the files you don't need for the ROM reconstruction.
Note:
I don't take any responsibility for any outcome and consequenses. Make sure you know what you are doing!
All credits go to the makers of the programs needed...
EDIT:
REMOVED THE ATTACHMENT...
NO USE FOR IT WHEN WE CAN USE THE KITCHEN!

By the way...
This should definitely be a sticky!

rvdgeer said:
Waiting for this explanation I kind of figured out this myself...
Great move to make a tutorial!!!
If it helps, I made a batch file (reconstruct conservative ROM from dump.bat) from step 4 to 7.
All you need is to have the 'original' 03_OS.nb (named Windows.nb in your tutorial) and the Part02.raw in the same directory as this batch file, along with all the programs described in step 1 to 3.
Click to expand...
Click to collapse
Thanks for your contribution

I noticed something...
When I flash back my reconstructed ROM I'm missing some icons in settings, for example 'device information'...
Did you notice this too?

Anyone with the dutch T-mobile Dump?

hellejoep said:
Anyone with the dutch T-mobile Dump?
Click to expand...
Click to collapse
http://forum.xda-developers.com/showpost.php?p=1582642&postcount=29

Works Fine
Hello,
I am a newbie here. First I flashed my German TMobile vario III with original HTC rom and found that original HTC rom is somewhat sluggish in performance as comapred to the HTC rom.
I checked this step by step way of building the rom and it works just fine. Great learning experience. Thanks to Pof, Tadzio and yourself for the explanation.
Regards

vijavij said:
Hello,
I am a newbie here. First I flashed my German TMobile vario III with original HTC rom and found that original HTC rom is somewhat sluggish in performance as comapred to the HTC rom.
I checked this step by step way of building the rom and it works just fine. Great learning experience. Thanks to Pof, Tadzio and yourself for the explanation.
Regards
Click to expand...
Click to collapse
Glad to hear helps you...
I add a link to this thread in the Wiki for quick finding...
EDIT: If you guys want, you can upload your reconstructed ROMs to rapidshare or any other site, and i mantain a list of reconstructed ROMs in the first page. This can be ussefull for ppl looking differents languaje ROMs.
Send me a PM if you don't know how to upload or any other issue.

I have the follow error when work with CHT part02.raw (imgfs.bin here)
Any hint?
C:\wm6\ppc\test2>imgfstonb imgfs.bin 03_OS.org.nb.payload 03_OS.new.nb.payload -conservative
ImgfsToNb 2.1RC1
Using conservative mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4690000 bytes (0x8d20 sectors)
to 0x46a0000 bytes (0x8d40 sectors)
Conservative/move mode: imgfs partition overflow! Aborting!
available sectors: 0x8c00, needed sectors: 0x8d40
No problem in -bigstorage mode
C:\wm6\ppc\test2>imgfstonb imgfs.bin 03_OS.org.nb.payload 03_OS.new.nb.payload -bigstorage
ImgfsToNb 2.1RC1
Using bigstorage mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4690000 bytes (0x8d20 sectors)
to 0x46a0000 bytes (0x8d40 sectors)
Not conservative/move mode. Changing imgfsEnd from 0x4ce0000 to 0x4d80000
...
...
ImgFs Flash Region log blocks was 0x232, now is 0x237
Storage Flash Region log block was 0xffffffff, now is 0xffffffff,
Done!

kfluk said:
I have the follow error when work with CHT part02.raw (imgfs.bin here)
Any hint?
C:\wm6\ppc\test2>imgfstonb imgfs.bin 03_OS.org.nb.payload 03_OS.new.nb.payload -conservative
ImgfsToNb 2.1RC1
Using conservative mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4690000 bytes (0x8d20 sectors)
to 0x46a0000 bytes (0x8d40 sectors)
Conservative/move mode: imgfs partition overflow! Aborting!
available sectors: 0x8c00, needed sectors: 0x8d40
No problem in -bigstorage mode
C:\wm6\ppc\test2>imgfstonb imgfs.bin 03_OS.org.nb.payload 03_OS.new.nb.payload -bigstorage
ImgfsToNb 2.1RC1
Using bigstorage mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4690000 bytes (0x8d20 sectors)
to 0x46a0000 bytes (0x8d40 sectors)
Not conservative/move mode. Changing imgfsEnd from 0x4ce0000 to 0x4d80000
...
...
ImgFs Flash Region log blocks was 0x232, now is 0x237
Storage Flash Region log block was 0xffffffff, now is 0xffffffff,
Done!
Click to expand...
Click to collapse
For me sounds like a bad dumping making imgfstonb bad calculating the lenght of imgfs.... can you repeat the dump process and attach the output yo see how goes?
And don't try to flash the result of -bigstorage cause don't work. To work you need to use -bigstoragemove instead of -bigstorage to get the result working.

Thanks for advise. Try to dump the raw ROM now. Post result later.
btw, I don't find -bigstoragemove in imgfs 2 rc1 readme.txt.
Hidden parameter?

ROM re-construction still fail. I post what I did for the ROM re-construction here. btw, my ROM is CHT unlock from HTC.
=================================
C:\wm6\ppc\org_rom>pdocread.exe -l
210.63M (0xd2a0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 73.38M (0x4960000) Part02
| 129.75M (0x81c0000) Part03
3.80G (0xf2e80000) DSK1:
| 3.79G (0xf2a80000) Part00
STRG handles:
handle 85a97436 3.79G (0xf2a80000)
handle 47476c3e129.75M (0x81c0000)
handle 0748310a 73.38M (0x4960000)
handle 474830e6 4.38M (0x460000)
handle a74b1f0e 3.12M (0x31f000)
disk 85a97436
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 47476c3e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0748310a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474830e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a74b1f0e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=====================================================
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x460000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4960000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x81c0000 Part03.raw
=====================================================
copy part02.raw C:\wm6\ppc\org_rom_test1
=====================================================
C:\wm6\ppc\org_rom_test1>dir
Volume in drive C is OS
Volume Serial Number is 34EC-33D3
Directory of C:\wm6\ppc\org_rom_test1
17/10/2007 22:23 <DIR> .
17/10/2007 22:23 <DIR> ..
17/10/2007 22:14 76,939,264 Part02.raw
28/08/2007 21:11 99,219,775 RUU_signed.nbh
=====================================================
C:\wm6\ppc\org_rom_test1>nbhextract RUU_signed.nbh
=== NBHextract v1.0
=== Extract contents from HTC NBH files
=== (c)2007 xda-developers.com
=== by: pof & TheBlasphemer based on itsme perl scripts
Device: KAIS13000
CID: HTC__001
Version: 1.56.405.5
Language: USA
Extracting: 00_Unknown.nb
Extracting: 01_SPL.nb
Extracting: 02_MainSplash.nb
Encoding: 02_MainSplash.bmp
Extracting: 03_OS.nb
=====================================================
C:\wm6\ppc\org_rom_test1>nbsplit -kaiser 03_OS.nb
NBSplit 2.1RC1
Using data chunk size = 0x800 and extra chunk size = 0x8
on file 03_OS.nb
Done.
=====================================================
C:\wm6\ppc\org_rom_test1>ren Part02.raw imgfs.bin
=====================================================
C:\wm6\ppc\org_rom_test1>imgfstonb imgfs.bin 03_OS.nb.payload 03_OS-new.nb.payload -conservative
ImgfsToNb 2.1RC1
Using conservative mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4960000 bytes (0x92c0 sectors)
to 0x4960000 bytes (0x92c0 sectors)
Conservative/move mode: imgfs partition overflow! Aborting!
available sectors: 0x8c00, needed sectors: 0x92c0
=====================================================

kfluk said:
Thanks for advise. Try to dump the raw ROM now. Post result later.
btw, I don't find -bigstoragemove in imgfs 2 rc1 readme.txt.
Hidden parameter?
Click to expand...
Click to collapse
Glad to help...
Really tadzio tools are in Release Candidate, means not finished yet, so this parameters are part of the "testing" phase to get the tools working for Kaiser.
Tadzio makes a great effrot and work on the new version.

kfluk said:
ROM re-construction still fail. I post what I did for the ROM re-construction here. btw, my ROM is CHT unlock from HTC.
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x6e0000, sector 0xdc0
Padding ImgFs from 0x4960000 bytes (0x92c0 sectors)
to 0x4960000 bytes (0x92c0 sectors)
Conservative/move mode: imgfs partition overflow! Aborting!
available sectors: 0x8c00, needed sectors: 0x92c0
=====================================================
Click to expand...
Click to collapse
Well, seems the part02.raw have a problem. Have you tried to dump the part02.raw? do executing imgfstodump imgfs.bin
Take a look at the output of the command and look for an error. If the dump process goes well, then try to dump back the dump folder with imgfsfromdump imgfs-in.bin imgfs-new.bin (the imgfs-in.bin is extracted from origin Windows.nb.payload with imgfsfromnb windows.nb.payload).
The result of this process is a new imgfs-new.bin to use with imgfstonb.exe command.
Say me if this helps you...

I dump again the Part02.raw from kaiser.
After rename Part02.raw to imgfs.bin
I run imgfstodump imgfs.bin
Dump goes well. At least the command complete without problem.
imgfsfromdump fail if do it immediately after dump.
C:\wm6\ppc\org_rom_test1>imgfsfromdump 03_OS.nb.payload imgfs-new.bin
ImgfsFromDump 2.1RC1
Compression DLL does not support compression type ''!
The only different is I extract OS.nb from "RUU_Kaiser_HTC_WWE_1.56.405.5_radio_sign_22.45.88.07_1.27.12.11_Ship".
i.e. full procedure.
1. Get part02.raw from device and rename to imgfs.bin
2. NBHextract RUU_signed.nbh
3. NBSplit -kaiser 03_OS.nb (result two file 03_OS.nb.payload and 03_OS.nb.extra)
4. imgfstodump imgfs.bin (no error)
5. imgfsfromdump 03_OS.nb.payload imgfs-new.bin (error)

kfluk said:
I dump again the Part02.raw from kaiser.
After rename Part02.raw to imgfs.bin
I run imgfstodump imgfs.bin
Dump goes well. At least the command complete without problem.
imgfsfromdump fail if do it immediately after dump.
C:\wm6\ppc\org_rom_test1>imgfsfromdump 03_OS.nb.payload imgfs-new.bin
ImgfsFromDump 2.1RC1
Compression DLL does not support compression type ''!
The only different is I extract OS.nb from "RUU_Kaiser_HTC_WWE_1.56.405.5_radio_sign_22.45.88.07_1.27.12.11_Ship".
i.e. full procedure.
1. Get part02.raw from device and rename to imgfs.bin
2. NBHextract RUU_signed.nbh
3. NBSplit -kaiser 03_OS.nb (result two file 03_OS.nb.payload and 03_OS.nb.extra)
4. imgfstodump imgfs.bin (no error)
5. imgfsfromdump 03_OS.nb.payload imgfs-new.bin (error)
Click to expand...
Click to collapse
This is not valid command "C:\wm6\ppc\org_rom_test1>imgfsfromdump 03_OS.nb.payload imgfs-new.bin"... cause you need to extract the imgfs.bin from the 03_OS.nb, and then use like imgfs-in.bin. Note that the imgfs.bin is inside the 03_os.nb.payload.
The imgfsfromdump commmand takes the dump folder and makes a new imgfs named imgfs-new.bin using imgfs-in.bin to take infor about headers...
Te correct command is imgfsfromdump imgfs-in.bin imgfs-new.bin.
If you want, upload the par02.raw and send me the link. I'll try to repack for you.
Cheers.

jcespi2005 said:
This is not valid command "C:\wm6\ppc\org_rom_test1>imgfsfromdump 03_OS.nb.payload imgfs-new.bin"... cause you need to extract the imgfs.bin from the 03_OS.nb, and then use like imgfs-in.bin. Note that the imgfs.bin is inside the 03_os.nb.payload.
The imgfsfromdump commmand takes the dump folder and makes a new imgfs named imgfs-new.bin using imgfs-in.bin to take infor about headers...
Te correct command is imgfsfromdump imgfs-in.bin imgfs-new.bin.
If you want, upload the par02.raw and send me the link. I'll try to repack for you.
Cheers.
Click to expand...
Click to collapse
Hi jcespi2005,
How could I extract the imgfs.bin from the 03_OS.nb?
I am uploading part02.raw to rapidshare, speed is very slow. Will post you the link.
thanks for your patient.
kfluk

Related

Kaiser ROM 1.81.61.2 (Orange UK)

Evening all,
I also have a brand new Orange(UK) branded TyTnII. I have dumped the ROM following the guide http://forum.xda-developers.com/showthread.php?t=334680, however the partition table looks a little different:
C:\Users\***\Desktop\ITS>pdocread -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.63M (0x45a0000) Part02
| 134.13M (0x8620000) Part03
STRG handles:
handle e7489c1a134.13M (0x8620000)
handle 074970e6 69.63M (0x45a0000)
handle e74b0fda 3.50M (0x380000)
handle e74b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074970e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
which meant that the dump commands were:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x45a0000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8620000 Part03.raw
The reconstruction was then as per http://forum.xda-developers.com/showthread.php?t=337066,
using the Windows.nb from http://rapidshare.com/files/65254405/WindowsFRA1.56.406.5.rar
The ROM has been rebuilt with Dark Simpson ROM tool, 7zip'ped and is availiable :
http://rapidshare.com/files/66123403/1.81.61.2.WWE.Orange.UK.7z.html
If anyone wants the RAW files, please let me know and I will zip and up those too. Usual disclaimers about me not being responsible for your bricks apply.
Nicely done......
In your original post about this ROM, I asked if you could post the OS and Build numbers, but you never did (and still haven't!)
Go to Start | Settings | System tab | About - make a note of the line that starts "CE OS......" and post it back here please
Click to expand...
Click to collapse
This is the missing piece of the puzzle so to speak....when this information is available, then the cooks will know if the core of the O/S has been updated etc. before they waste time cooking with it.
Thanks in advance,
Mark.
Mark Crouch said:
Nicely done......
In your original post about this ROM, I asked if you could post the OS and Build numbers, but you never did (and still haven't!)
This is the missing piece of the puzzle so to speak....when this information is available, then the cooks will know if the core of the O/S has been updated etc. before they waste time cooking with it.
Thanks in advance,
Mark.
Click to expand...
Click to collapse
its an old os and build CE OS 5.2.1620 (Build 18125.0.4.2)
^^ yep, what he said!
Thanks Dutty/Rik - glad we've got that cleared up
Mark.
so now what? it is a lie? it doesnt looks like a big update from 1.56 ?
rom
the rom that has been uploaded is that the raw files or a reconstructed rom
many thanks
steven
this was my reconstruction from the raw dump
orange
so if i put one of the other roms on my orange tytn ii could i flash your reconstruction for warranty purposes
do i need any tools to flash the rom
many thanks
steven
Hi Steven,
I hope so! It's the reason I dumped and reconstructed this ROM - I have subsequently flashed the HTC shipped ROM to my Kaiser, and its running so much faster.
Although I have tested re-flashing this ROM to take me back to an Orange branding, I give no guarantees that it will return your Kaiser back to how it was when you bought it, or that it won't turn your Kaiser into the most expensive paper weight you ever bought.
As with everything on XDA-devs, its entirely at your own risk (but i'm glad I gave it a go!)
sirsyco has posted a guide http://forum.xda-developers.com/showthread.php?t=335568 on reverting back to the original ROM, while using POF's Hard-SPL http://forum.xda-developers.com/showthread.php?t=334679 and CustomRRU http://forum.xda-developers.com/showthread.php?t=334890 should provide everything you need to flash to the first HTC shipped ROM, which you will find links to in various places in this forum.
Please note that I only flashed the HTC OS, not the radio stack or the splashscreen.
I am afraid I am not going to provide a step-by-step - all of the guides linked above provide the details to do what you want to do, and I am afraid I am of the opinion that if you don't get what is being described in those tut's, you really should not be dumping and flashing ROM's yourself.
No offence intended, but im not going to lead you out of your depth - I don't want anyone to fry their beloved Kaiser on my instructions!
orange rom
hi rik
no offence taken
can i just ask you when you went from orange to htc did you hard spl then just run the htc shipped rom
how did you just instal the os and not the spl or radio stack
did you notice a difference with the htc rom
many thanks
steven
Rik
Can you tell me...when you flashed the OS only, did you get the SIMLOCK problem?
I think that was the mistake I did... I flashed the whole thing rather than the OS alone... i wasnt aware of this complication in changing other bit besides the OS...
My phone (originally Orange ROM) is still locked (24hrs now) but its usable if you put it on flight mode.. it seems to be faster..menus, keyboard opening response, applcation launch etc.. not sure how much having the phone part switched off effects the performance...
bigchemist said:
I think that was the mistake I did... I flashed the whole thing rather than the OS alone... i wasnt aware of this complication in changing other bit besides the OS...
My phone (originally Orange ROM) is still locked (24hrs now) but its usable if you put it on flight mode.. it seems to be faster..menus, keyboard opening response, applcation launch etc.. not sure how much having the phone part switched off effects the performance...
Click to expand...
Click to collapse
Could possibly be
Could you share radio or raw from this ROM?
Thanks.

Reflashing the EEPROM

Hello all...
as in these threads for the Hermes:
http://forum.xda-developers.com/showthread.php?t=322225
and
http://forum.xda-developers.com/showthread.php?t=296936
and
http://forum.xda-developers.com/showthread.php?t=299451
I seemed to have screwed up my EEPROM while flashing to WM6 via HardSPL, the problem is that there was a power outage halfway through the process and now ANY ROM that I flash it to there is NO WIFI... It is there, it just won't work.
I have read that this is due to my EEPROM being screwed up due to bad flashing. Before I say that the MoBo is fried, I would like to try to reflash the EEPROM part
I have tried to mmty and putty and plink while no commands are able to be registered on the s200.
Could anyone with some expertise assist me in rewriting my EEPROM (I have the SPL from a 2.20 official ROM) - I assume that I need to write it back via putty, but I cannot seem to send commands to the device!
PLEASE HELP!
Thanks in advance for any assistance in this matter.
same here...i tried but cant get the commands to work like you...pls let me know if you find a solution.
Off course it will not work, different doc and different addresses
It is your cid block at n1, not the SPL, please use pdocread.exe like this
Pdocread.exe -n 0 0 0xaf0000 spl.nb
pdocread -n 1 0 0x40000 cidblock.bin
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
compress the files using 7-zip ultra compression and send them to my mail
I'll try to help
or the MAC adress can be found @ offset 3e5c in gsmdata.bin
long live Palestine
Jeff said:
I seemed to have screwed up my EEPROM while flashing to WM6 via HardSPL,
Click to expand...
Click to collapse
I think it is not hard SPL
Code:
hard spl G3
99DCC: 00 0D
99DCE: A0 00
99DCF: E1 1A
99DEC: 00 13
99DEE: A0 00
99DEF: E1 0A
99DFC: 00 0F
99DFE: A0 00
99DFF: E1 1A
99FCC: 00 0D
99FCE: A0 00
99FCF: E1 1A
99FEC: 00 13
99FEE: A0 00
99FEF: E1 0A
99FFC: 00 0F
99FFE: A0 00
99FFF: E1 1A
paradis_pal
Chopin,
Mail sent as requested... Thank you IMMENSELY for your attention and assistance.
Pdocread.exe -n 0 0 0xaf0000 spl.nb returns this error:
"ERROR: ITReadDisk : read 00008000 bytes - A device attached to the system is not functioning."
However the other two were successful...
Is this because the SPL is bugged?
I sent you mail back
Again it is not the SPL, sorry the command I wrote was wrong
Pdocread.exe -n 0 0 0x1f0000 spl.nb
Waiting your test, and there is no risk as you have a backup
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
and send the file again
and tell me what is the size of the pdocread and pdocwrite
use the new itsutils tools
and what do u have g3 or g4?
Just to add my $0.02... this thread has helped me somewhat with my Kaiser and @chopin: http://youtube.com/watch?v=MZTGYxVGzQg
seattleweb said:
Just to add my $0.02... this thread has helped me somewhat with my Kaiser and @chopin: http://youtube.com/watch?v=MZTGYxVGzQg
Click to expand...
Click to collapse
youtube is forbbiden in Syria, what is this?
@Jeff
I checked your cidblock.bin and it is correct
but gsmdata.bin is corrupted, try to flash it again
YouTube Link
It is
Arvo Pärt: Silouans Song / Vienna Philharmonic Women
A NEW message now!
"pdocwrite -n 1 -b 0x4000 gsmdata.bin 0x40000 0x4000
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: ITWriteDisk - The drive cannot locate a specific area or track on the disk."
This is with the newer versions of Pdocwrite with the GOOD GSMData...
I am lost at this point...
pdocwrite -n 1 gsmdata.bin 0x40000 0x4000
The Mystery thickens...
With the 104K Pdocwrite I get:
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: could not read 0x0 bytes of preceeding sector data at 0x40000
With the 140K Pdocwrite I get:
CopyFileToTFFS(gsmdata.bin:0, 40000, 00004000)
ERROR: ITReadDisk : read 00004000 bytes - Data error (cyclic redundancy check).
wrong information for me, no one rea this please
You have mail!
Chopin said:
Off course it will not work, different doc and different addresses
It is your cid block at n1, not the SPL, please use pdocread.exe like this
Pdocread.exe -n 0 0 0xaf0000 spl.nb
pdocread -n 1 0 0x40000 cidblock.bin
pdocread -n 1 0x40000 0x4000 -b 0x4000 gsmdata.bin
compress the files using 7-zip ultra compression and send them to my mail
I'll try to help
or the MAC adress can be found @ offset 3e5c in gsmdata.bin
long live Palestine
Click to expand...
Click to collapse
Glad u back from silence...
Nice to see u here
Jeff said:
You have mail!
Click to expand...
Click to collapse
Now I need help
Why in the new itsutils tools the gsm data @ offset 0x10000 with block size 0x4000
In the old one @offset 0x40000 with the same block size?
Is it a joke?
@jeff
But first back up GSM data and send it to my mail
Use the updated change MAC address tool it works now, to restore and write GSM data
kram3r said:
Glad u back from silence...
Nice to see u here
Click to expand...
Click to collapse
thanks my other man
nice to have some people like me, becasue a lot hate me
IT WORKED!
I WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I now have Wifi Back on my Prophet!!!!
All hail Chopin for his concern for the welfare of others, many should make him an example!
Dude, I owe you some virtual beer or something...
I am indebted to you, thank you from the bottom of my heart.
"You shouldn't worry about what some think of you, what you think of yourself is more important." - Jeff
you are welcome
just say please if you like me, Long live Palestine

Creating firmware for unknown device

Sorry for my English...
A situation means following:
There is smartfon Ginza MS100, made a company Lenovo to order of to one known Russian company and spreads only in Russia. I am for him flasher, which is obtained insiders from an this company but firmware for device are not present and how to use flasher nobody knows. It would be desirable to create firmware on the basis of WM6. Is it possible? Are there what that general facilities? Is there possibility to tear out driver from the already existent firmware and to build them in what that base (if it exists)? What will say on this occasion?
Are there what that general facilities of tearing out of the native firmware from a device? A device can be loaded in what that Engine Test and during connecting to the computer of windows requires a driver, this driver is (for OMAP 750).
* Windows Mobile 5.0 Smartphone Edition
* Texas Instruments OMAP 750, 200 MHz
* 64 Mb RAM / 128 Mb ROM
* miсroSD
* display 1.8", 176x220, 64 k colors
* GSM 850/900/1800/1900
* GPRS: class 10
* miniUSB
* Bluetooth 1.2
FLASH: M - systems (Disk On Chip) M08832-d16-v3-X-P
RAM: HYE18M512 (160BF75)
Yes, any WM5 device can be converted to WM6.
You will either need to figure out how to use the flasher, or see if you can use pdocread and pdocwrite from itsutils. Search the forums for itsutils. To use itsutils, the device also needs to be Application Unlocked. I have found itsutils and SDA_Application_Unlock.exe both work fine on non-HTC devices like Samsung SGH-i607 for example.
There are many steps to this though. The first is to dump your existing ROM. For this, you use pdocread from itsutils.
Follow the instructions here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
Once you get past that step, the other steps are:
1. Extract XIP.
2. Replace MSXIPKERNEL in XIP with WM6 MSXIPKERNEL.
3. Extract SYS and OEM from dump.
4. Replace SYS folder with WM6 SYS folder.
5. Flash phone and hope it boots.
That's just a brief overview, there is much more to do within each step, so see if you can get a dump with pdocread first and we'll go from there.
C:\itsutils>pdocread -l
59.94M (0x3bf1000) TrueFFS
| 1.37M (0x15fc00) Part00
| 2.50M (0x280000) Part01
| 44.13M (0x2c20000) Part02
54.20M (0x3632000) TrueFFS
| 1.37M (0x15fc00) Part00
| 2.50M (0x280000) Part01
| 44.13M (0x2c20000) Part02
STRG handles:
handle 87a20756 54.14M (0x3623200)
handle a7a7d932 44.13M (0x2c20000)
handle 67a7d736 2.50M (0x280000)
handle 87a7d712 1.37M (0x15fc00)
disk 87a20756
3 partitions, 1 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7a7d932
3 partitions, 1 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 9b 28 02 02 23 1f 11 29 1b 02 07 be
disk 67a7d736
3 partitions, 1 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 9b 28 02 02 23 1f 11 29 1b 02 07 be
disk 87a7d712
3 partitions, 1 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 9b 28 02 02 23 1f 11 29 1b 02 07 be
in the manual on step 7
pdocread -h 0xHANDLVALUE 0 0xSIZEVALUE diskimage.nb or pdocread -d storename -p partitionname StartValue LengthValue file.raw
in my case:
HANDLVALUE?
SIZEVALUE?
storename?
partitionname?
StartValue?
LengthValue?
Don't worry about that line in Step 7, you are ready to go to Step 8.
Where the example has FLASHDR, you would use TrueFFS.
On Step 9, also use TrueFFS instead of FLASHDR, and use the hex size values obtained in Step 8.
Code:
C:\itsutils>pdocread -w -d TrueFFS -p Part00 -t
real nr of sectors: 2814 - 1.37Mbyte (0x15fc00)
C:\itsutils>pdocread -w -d TrueFFS -p Part01 -t
real nr of sectors: 5120 - 2.50Mbyte (0x280000)
C:\itsutils>pdocread -w -d TrueFFS -p Part02 -t
real nr of sectors: 90368 - 44.13Mbyte (0x2c20000)
C:\itsutils>pdocread -w -d TrueFFS -p Part00 0 0x15fc00 Part00.raw
CopyTFFSToFile(0x0, 0x15fc00, Part00.raw)
C:\itsutils>pdocread -w -d TrueFFS -p Part01 0 0x280000 Part01.raw
CopyTFFSToFile(0x0, 0x280000, Part01.raw)
C:\itsutils>pdocread -w -d TrueFFS -p Part02 0 0x2c20000 Part02.raw
CopyTFFSToFile(0x0, 0x2c20000, Part02.raw)
C:\itsutils>
14.03.2008 18:36 1*440*768 Part00.raw
14.03.2008 18:37 2*621*440 Part01.raw
14.03.2008 18:43 46*268*416 Part02.raw
With no errors
Dump uploaded here: http://rapidshare.com/files/99502959/Ginza_MS100_Russian_Rom.zip.html
how I must do next steps?
Once you get past that step, the other steps are:
1. Extract XIP.
2. Replace MSXIPKERNEL in XIP with WM6 MSXIPKERNEL.
3. Extract SYS and OEM from dump.
4. Replace SYS folder with WM6 SYS folder.
5. Flash phone and hope it boots.
Code:
C:\itsutils>pdocread -t
real nr of sectors: 122880 - 60.00Mbyte (0x3c00000)
C:\itsutils>pdocread 0x0 0x3c00000 dump.nb0
CopyTFFSToFile(0x0, 0x3c00000, dump.nb0)
14.03.2008 20:05 62 914 560 dump.nb0
uploaded here: http://rapidshare.com/files/99521029/Ginza_MS100_Russian_dump.zip.html
Code:
C:\itsutils>pdocread -n0 -t
real nr of sectors: 4 - 256.00kbyte (0x40000)
C:\itsutils>pdocread -n0 0x0 0x40000 spl.nb0
CopyTFFSToFile(0x0, 0x40000, spl.nb0)
14.03.2008 20:08 262 144 spl.nb0
uploaded here: http://rapidshare.com/files/99522575/Ginza_MS100_Russian_spl.zip.html
[Core OS]
Windows Mobile-based Smartphones
[Versions]
SYS: 5.1.15671.3300
OEM: 5.1.0.3300
SYS: 1.0.4294.0
SYS: 5.1.15671.0
[Language]
0409 - English (United States)
0419 - Russian (Russia)
[DPI]
96
[Certificates]
CN=Microsoft Windows Mobile PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Windows Mobile 5.0 - Lenovo Root
[Missing Manifests]
b5332311-48f1-4b76-ad70-8efa5db8fa3a.dsm
06643136-a4b6-e0d8-67f2-1e3b621844f8.dsm
42d1aab7-6dfa-4c03-9797-d66f7620883d.dsm
65a5386c-0b77-c0b9-d673-4daafbf007aa.dsm
Sounds like you already figured out how to extract the dump and use PKGTOOL to separate into SYS and OEM, correct?
Either Part00.raw or Part01.raw is your XIP. The easiest way to find out which is the XIP is by using XIPPORT. Take each one and make a copy. Rename the copy to XIP.BIN and put in the same folder as XIPPORT. Then run XIPPORT and do a "Dump XIP.BIN". This will create an OUT folder. The one that creates an OUT folder with folders Modules and Files is the XIP.
Once you have the XIP dumped to an OUT folder, click "Write Maps". Then click "Make Packages". In Files and Modules will be the folder MSXIPKERNEL. Delete that folder in both Files and Modules and replace with MSXIPKERNEL from WM6. In MSXIPKERNEL from WM6, there may be a file oxast0.dll and hd.dll, you can remove them. This will make more space. Then use the tool M'Reloc to change the addresses of the modules to fit (use MAP.txt as your guide). You will also have to manually change the same addresses in ImageInfo.txt for each module. Once that's done, click "Realloc P". If that crashes, just click "Write Maps" and look in MAP.txt for anything with !!!!!!!! which means there's overlap. You'll have to tweak addresses or change XIP size by making changes on ROMHDR.txt. Once you have an XIP with no errors, write XIP_OUT.BIN. At this point, I don't really know what to do because I use the Rom Update Utility that HTC has for their phones, but I think you might be able to use PDOCWRITE to write the new XIP into the phone as I believe that was its intended purpose. If your new XIP boots, then the rest is easy. You would just replace the SYS folder of your WM5 with the SYS folder from WM6. Then run G'Reloc to relocate any modules. After that, run BuildOS which makes a dump folder. Then using Tadzio's tools (IMGFSFROMDUMP), you can build that back into a .bin file. After that, for HTC devices I convert .bin to .nb file with XIP embedded, and then an .nbf or .nbh file to flash using HTC's ROMUpdateUtility, but if you don't know what the normal format is for the flasher, you might just try pdocwrite to write the .bin file directly to the phone.
It normally will not brick the phone if you don't overwrite the bootloader, so be very careful not to accidentally overwrite the bootloader in any way. There is no easy way to repair the phone if the bootloader has been overwritten.
In fact, it is probably best for now to try to figure out how the flash utility for that phone works. For example, what kind of file format does it need?
It's safest to use the flash utility for your phone because there is usually a way to recover from a bad flash or one that doesn't boot.
For example, what kind of file format does it need?
Click to expand...
Click to collapse
I attached scrin from flasher
Greetings,
I have a PN820 Smartphone from Verizon (CDMA), and wonder if I could dump the rom, and update it to wm 6.x?
using pdocread -l:
55.95M (0x37f2000) TFFS
| 1.19M (0x12fc00) Part00
| 2.19M (0x230000) Part01
| 52.57M (0x3492000) Part02
59.94M (0x3bf1000) TFFS1
| 59.88M (0x3be2000) Part00
968.75M (0x3c8c0000) DSK1:
| 968.50M (0x3c880e00) Part00
STRG handles:
handle 03fabf8e968.50M (0x3c880e00)
handle 43f93a66 59.88M (0x3be2000)
handle a3f932e2 52.57M (0x3492000)
handle 23f930e6 2.19M (0x230000)
handle 43f930c2 1.19M (0x12fc00)
disk 03fabf8e
0 partitions, 0 binary partitions

ROM dumping for dummies!?

Very soon I will receive a new phone (TyTnII) and I would want a full backup of my phone. The new phone will be flashed with my current phone and thus containing all my current settings and software. I think the only way to do this, is by dumping (cooking) and restoring (flashing) a ROM of my current phone. -Maybe I could be wrong-
Is there a "dumping ROM" -thread for dummies? In each and every thread there are parts of the solution, but nowhere a step-by-step description is to be found. In most of the threads people mention the programming code they use to dump a ROM, is a user-friendly user interface (GUI?) for cooking and flashing already available? Btw, after reading and searching on this superb site for some 3 days, I found out all I needed to know about flashing. Currently using a Dutty ROM with separately flashed RADIO. LAS, for cooking no solution seems to be at hand.
Hoping to find a solution, if you are so kind to respons, please no "use the search-section" or "read W.I.K.I. please" - been there, done that - and make sure to use all related links. Maybe this thread might become a first try to build a real "Cooking and flashing for dummies".
With kind regards,
Gert Beckers
Belgium
GertBeckers said:
Very soon I will receive a new phone (TyTnII) and I would want a full backup of my phone. The new phone will be flashed with my current phone and thus containing all my current settings and software. I think the only way to do this, is by dumping (cooking) and restoring (flashing) a ROM of my current phone. -Maybe I could be wrong-
Is there a "dumping ROM" -thread for dummies? In each and every thread there are parts of the solution, but nowhere a step-by-step description is to be found. In most of the threads people mention the programming code they use to dump a ROM, is a user-friendly user interface (GUI?) for cooking and flashing already available? Btw, after reading and searching on this superb site for some 3 days, I found out all I needed to know about flashing. Currently using a Dutty ROM with separately flashed RADIO. LAS, for cooking no solution seems to be at hand.
Hoping to find a solution, if you are so kind to respons, please no "use the search-section" or "read W.I.K.I. please" - been there, done that - and make sure to use all related links. Maybe this thread might become a first try to build a real "Cooking and flashing for dummies".
With kind regards,
Gert Beckers
Belgium
Click to expand...
Click to collapse
Are you sure you've read all the Relevant wiki pages?
This has instructions for Dumping and Reconstructing a ROM.
If you want to read these and make you own tutorial, feel free, but don't ask others to do it for you.
Kyphur says it best: http://forum.xda-developers.com/showpost.php?p=2031989&postcount=45
Ta
Dave
"IF YOU DON'T CARE ABOUT UNDERSTANDING THE JOURNEY THEN YOU PROBABLY SHOULDN'T BE HERE IN THE FIRST PLACE." is exactly what I mean with "In each and every thread there are parts of the solution". Nowhere the -part- of the solution is in clear english. Can I give you an example from your link?
How to dump a ROM :
"$ ./pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
?????????????????????????????????????????????????????????????????????
Maybe some people forget that not everybody is a programmer! Seems to me something is missing here? Anyone can explain to me what the h*ll this means?
Next line:
"DUMP THEM!
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw"
And again something seems to be missing here. Maybe some people forget that not everybody is a programmer!
Anyone can explain to me what the h*ll this means?
Thus my remark:
"Hoping to find a solution, if you are so kind to respons, please no "use the search-section" or "read W.I.K.I. please" - been there, done that -" Maybe -I admid- I should have added: "Are you sure you've read all the Relevant wiki pages?" and "If you want to read these and make you own tutorial, feel free, but don't ask others to do it for you."
Good teachers are just thais hard to find. Thanks for the response anyway, but I will just keep on looking for a clear and understandable explanation and/or guideline.
kind regards,
Gert Beckers
Belgium.
GertBeckers said:
Maybe some people forget that not everybody is a programmer!
Click to expand...
Click to collapse
This is XDA-Developers and your posting in the ROM Development forum. A certain level of understanding is expected.
May I suggest you look at backup software such as Sprite or SPB Backup instead or dumping and reconstructing your ROM.
Thanks
Dave
Sprite backup works great and btw Gert,
those are command line instructions-pretty straightforward actually.
Thank you for your reply , I used "SPB Backup". I just hope this nifty little tool will also make a backup of all installed software (but I doubt it).
Btw, my new 8GB Ultra II SD SDHC Memory Card just arrived!
Sir Thanks-a-lot,
Gert Beckers
GertBeckers said:
Thank you for your reply , I used "SPB Backup". I just hope this nifty little tool will also make a backup of all installed software (but I doubt it).
Btw, my new 8GB Ultra II SD SDHC Memory Card just arrived!
Sir Thanks-a-lot,
Gert Beckers
Click to expand...
Click to collapse
Sprite does-use it all the time, not sure about SPB, haven't used it.
GertBeckers said:
Thank you for your reply , I used "SPB Backup". I just hope this nifty little tool will also make a backup of all installed software (but I doubt it).
Btw, my new 8GB Ultra II SD SDHC Memory Card just arrived!
Sir Thanks-a-lot,
Gert Beckers
Click to expand...
Click to collapse
SPB Backup 2.0 will backup your entire ROM won't it?
Dave
This is becoming less and less of a developer site and more and more of a whinning, lazy a$$, "help me do what I can't do for myself". These users aren't even willing to read and then they retort back with indignation.
By the way, DaveShaw is kind of a big deal here. He doesn't have over 1200 posts because he is too lazy to read or do some research on his own. He has been helping and developing. Show some respect or be ready to be ignored.
kimtyson said:
This is becoming less and less of a developer site and more and more of a whinning, lazy a$$, "help me do what I can't do for myself". These users aren't even willing to read and then they retort back with indignation.
By the way, DaveShaw is kind of a big deal here. He doesn't have over 1200 posts because he is too lazy to read or do some research on his own. He has been helping and developing. Show some respect or be ready to be ignored.
Click to expand...
Click to collapse
... and hot water might have been invented on this "whining-site" over and over again. Thank you for you constructive info and positive feedback.
Since everything is going downhill, and most of you are having a bad day, it might be the moment to close this topic?
Sir Grins-a-lot,
Ger Beckers
This topic shouldn't be opened.
Gert,
I'm not having a bad day.
The ROM dumping instructions are in command line format and as Dave has pointed out, all that info is available in the ROM dumping thread. Read it and try it yourself, works great to dump ROM's.
kristoff_sz said:
This topic shouldn't be opened.
Click to expand...
Click to collapse
I agree. Can we drop this, please.
When a Moderator get's on this thread should be closed.
-Question asked, advice given. End of Discussion.
Dave
hey man,
Well, I haven't tried it, but here's some easy step-by-step instructions on how to dump a ROM:
1. I just put all the necessary files in this folder:
http://www.mediafire.com/download.php?jc1xtnpqnxj
Download it and extract it to your C: drive.
2. Plug in your device
3. Open a Command Prompt and type in the following:
Code:
cd C:\
Code:
pdocread -l
This should bring output something like this:
Code:
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M ([COLOR="orange]0x380000[/COLOR]) Part01
| 69.38M ([COLOR="orange"]0x4560000[/COLOR]) Part02
| 134.38M (0x8660000) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Look at the orange items at the top. I've made these orange to make note that when you do this, those numbers will probably be different. So, open Notepad and copy and paste the numbers you see there. Now do this:
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="orange"]0x380000[/COLOR] Part01.raw
NOTE: Replace the orange numbers with the first set of numbers you took down.
Do the same with this, except replace the orange numbers with the second set of numbers you took down:
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="orange"]0x4560000[/COLOR] Part02.raw
NOTE: this line might take a while, but don't close the window until it's done.
OK, if done correctly, you should have Part01.raw and Part02.raw in your C:\ drive.
Now, download this file:
http://www.megaupload.com/?d=5NA811QP
and extract it to your C: drive
Now go to your C drive, cut Part01.raw and Part02.raw and paste them in C:\kaiserkitchen\BaseROM.
Now download this file:
http://210.64.124.194/download/TyTN II_SEA_WM6.1_Upgrade_20080602.zip
and take the RUU_signed out of it and place it in C:\kaiserkitchen\BaseROM
then go into C:\kaiserkitchen, double-click on KaiserKitchen.cmd, press e, then press b.
4. Cook the ROM.
Now cook the ROM by following the steps here:
http://wiki.xda-developers.com/index.php?pagename=Kaiser ROM Kitchen Tutorial
although, make sure you do not add any packages
You're done, hope it helps
Eric Draven,
Finally some one who understands the true meaning of a forum!
Thanks a lot for the clear and understandable explanation. I'm sure that I will finally be able to cook my own ROM, I hope that this tread might be used by plenty other seekers At least finally the title of the thread correspond with its content!
Just one last question; at the end of your reply you wrote: "although, make sure you do not add any packages" What kind of packages do you mean? Is installed software considered "packages"?
Sir Thanks-a-lot,
Gert Beckers
Belgium
Eric Draven,
Finally some one who understands the true spirit of a forum: helping others! At last the title of the thread corresponds with its content! No *****ing or wining, just helping! Respect!
I hope this final and conclusif answer might help tons of others in cooking their own ROM!
What do you mean with: "although, make sure you do not add any packages". Is any installed software considered "packages"?
Sir Thanks-a-lot,
Gert Beckers
Belgium
GertBeckers said:
Eric Draven,
Finally some one who understands the true meaning of a forum!
Thanks a lot for the clear and understandable explanation. I'm sure that I will finally be able to cook my own ROM, I hope that this tread might be used by plenty other seekers At least finally the title of the thread correspond with its content!
Just one last question; at the end of your reply you wrote: "although, make sure you do not add any packages" What kind of packages do you mean? Is installed software considered "packages"?
Sir Thanks-a-lot,
Gert Beckers
Belgium
Click to expand...
Click to collapse
Packages are the Equivelant of CABs that you use when Cooking ROMs.
i.e. You would use a new Dialer Package and Cook that into your ROM, rather than install a CAB.
When using the Kitchen, you get to pick what packages you would like.
All of this is in the ROM Cooking Wiki.
Thanks
Dave
Dave- Finally someone who understands the true spirit of a forum: helping others to help themselves.
GertB- You remain thick as a brick! And you double posted.
Oh, and though you "are sure you will finally be able to cook your own ROM" I am not as confident. You don't even understand what packages are. I suggest you stop posting and begin reading a little. Then best of luck to you. I will wait with baited breath for your excellent ROM addition to the forums.
Here is a link to the ROM KITCHEN TUTORIAL, http://forum.xda-developers.com/showthread.php?t=349895&highlight=ROM+cooking+WIKI, posted before you decided to join the party. I'd say "title of the thread correspond with its content".
kimtyson said:
GertB- You remain thick as a brick! And you double posted.
Click to expand...
Click to collapse
I believe that was a mistake, and I'm pretty sure he did not mean to bump this thread
@GertBeckers: Yes, when I say "Do not add any packages" I am talking about the software you would usually add when cooking a ROM

Rebuild Treo Pro pt-BR ROM Released

As I have posted on this thread I've dumped the ROM from my spanking new Palm Treo Pro (pt-BR).
After a (what seems) long while I found here some instructions on how to rebuild a ROM from the raw files.
Here's a complete step-by-step of what I have done in order to release this ROM:
Download the ITS Utils, although only the pdocread.exe is used.
Download the NightRaven's WM6.1 Stock ROM that will be used as a template in later steps.
Download the Rebuild ROM utilities that will be used to repack the files. The needed files are located in the ManualRebuild sub-folder.
Connect the USB cable between the computer and the Treo and get them to sync.
Run pdocread -l to list the contents of the ROM. in my case the results were:
Code:
189.50M (0xbd80000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.75M (0x3c0000) Part01
| 73.38M (0x4960000) Part02
| 109.25M (0x6d40000) Part03
14.50M (0xe80000) EXT_FLA
| 14.50M (0xe80000) PART00
5.00M (0x500000) MS_FLAS
| 5.00M (0x500000) PART00
STRG handles:
handle#0 874c0ae6 5.00M (0x500000)
handle#1 66f6528a 14.50M (0xe80000)
handle#2 e7488592 109.25M (0x6d40000)
handle#3 c74aacde 73.38M (0x4960000)
handle#4 874aacba 3.75M (0x3c0000)
handle#5 e74aab0a 3.12M (0x31f000)
disk 874c0ae6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 66f6528a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e7488592
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74aacde
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874aacba
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74aab0a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Run pdocread -w -d FLASHDR -p Part00 -t -b 0x800 to get the exact size of the partition 00.
In my case it is:
Code:
real nr of sectors: 1598 - 3.12Mbyte, 0x31f000
Which means that the actual size of the partition 00 is 0x31f000.
Run pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw to dump the first partition to your hard drive.
Do the last two steps for partitions 01, 02 and 03.
From NightRaven's file, extract the RUU_Signed.nbh file.
Run NBHExtract RUU_Signed.nbh to extract the 00_OS.nb file.
Run NBSplit -data 2048 -extra 8 00_OS.nb to split the .nb file into .extra and .payload.
The Part01.raw file is (according to the tutorial I based this one) the XIP.bin that needs to be implanted on the payload.
Run ImplantXIP.exe -xip Part01.raw -payload 00_OS.nb.payload to implant the XIP into the payload.
Here's the result of mine:
Code:
Implantxip & Payload Resizer v. 1.1 by ervius!!!
BLOCKS SIZE IS: 00020000
ROM Block is : 00000800
NO ImgStart....
From IMG Value: 00340000 - NON ULDR Reducing...
....................................
Preparing payload to be resized.....
....................................
Before:
XIP.BIN Target Size: 003C0000 AdjSize: 003BFFFF
ULRD in Payload Start:00001000 Size:0001EFFF End:0001FFFF
XIP in Payload Start:00020000 Size:0031FFFF End:0033FFFF
IMG in Payload Start:00340000 Size:042FFFFF End:0463FFFF
FAT in Payload Start:04640000 Size:1877FFFF End:1CDBFFFF
After:
XIP.BIN Target Size: 003C0000 AdjSize: 003BFFFF
ULRD in Payload Start:00001000 Size:0001EFFF End:0001FFFF
XIP in Payload Start:00020000 Size:003BFFFF End:003DFFFF
IMG in Payload Start:003E0000 Size:042FFFFF End:046DFFFF
FAT in Payload Start:046E0000 Size:1877FFFF End:1CE5FFFF
Payload resized and XIP Inserted into: 00_OS.nb.payload
According to several sources the Part02.raw is the actual OS, as it can be verified by running ViewIMGFS Part02.raw, which will create a folder named Dump with all the files of the OS (IMHO I believe that IMGFS stands for IMaGe File System), along with a dump_Memorymap.txt that contains information regarding how the ViewIMGFS program read the Part02.raw file.
Run ImgfsToNb Part02.raw 00_OS.nb.payload 00_OS-new.nb.payload -bigstoragemove to implant the OS into the payload. Note that the new file has a -new suffix on the filename, it's necessary for the merge ahead.
That's the result of my run:
Code:
ImgfsToNb 2.1rc2
Using bigstorage mode
Sector size is 0x800 bytes
Writing imgfs to offset byte 0x3e0000, sector 0x7c0
Padding ImgFs from 0x4960000 bytes (0x92c0 sectors)
to 0x4960000 bytes (0x92c0 sectors)
Not conservative mode. Changing imgfsEnd from 0x46e0000 to 0x4d40000
Partition entry before:
File System: 0x25
Start Sector: 0x000007c0
Total Sectors: 0x00008600
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x1f
Last Head: 0x3f
Last Sector: 0x01
Last Track: 0x236
Partition entry after:
File System: 0x25
Start Sector: 0x000007c0
Total Sectors: 0x000092c0
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x1f
Last Head: 0x3f
Last Sector: 0x01
Last Track: 0x269
Partition entry before:
File System: 0x04
Start Sector: 0x00008dc0
Total Sectors: 0x00030f00
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x237
Last Head: 0x3f
Last Sector: 0x01
Last Track: 0x272
Partition entry after:
File System: 0x04
Start Sector: 0x00009a80
Total Sectors: 0x00030240
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x26a
Last Head: 0x3f
Last Sector: 0x01
Last Track: 0x272
ImgFs Flash Region log blocks was 0x218, now is 0x24b
Storage Flash Region log block was 0xffffffff, now is 0xffffffff,
Done!
Run NBMerge -data 2048 -extra 8 00_OS-new.nb to merge back the extra space into the .nb file.
That's the result of mine:
Code:
NBMerge 2.1rc2
Executing NBMerge.exe with data chunk size = 0x800 and extra chunk size = 0x8
on file 00_OS-new.nb
Partition 0: start sector: 0x00000002, total: 0x0000003e
first used: 0x00000002, used: 0x00000001
Partition 1: start sector: 0x00000040, total: 0x00000780
first used: 0x00000040, used: 0x0000064f
Partition 2: start sector: 0x000007c0, total: 0x000092c0
first used: 0x000007c0, used: 0x000092c0
Done.
Now come the trick part. First I've tried to use Olipro's NBHUtil to build the .nbh file and although it does have the PANT100 configuration it didn't create the .nbh file, but it did provide me with assurance -- by reading the NBHUtil.xml file -- that the Kaiser device has the same configuration of the PANT100. So I used Dark Simpson's HTC Rom Tool version 1.1.4 to build.
Run htcrt
Navigate to ROM Builder tab.
Select the Kaiser device.
Change the device name to PANT100**
Change the version to 1.65.28.25 because that's the version of this ROM.
Change the language to 0416 because that's the language of this ROM (pt-BR).
Click on the [...] button next to the OS: label, and select the 00_OS-new.nb file.
Click on the [Build!] button.
Read carefully the message boxes telling about the possible dangers of making a ROM, and click on [Yes] on the first one, [No] on the second one.
Give a meaningful name for the .nbh file like TreoPro.pt-BR.1.65.28.25.nbh
If everything went according to plan, you should have a flashable Unbranded Windows Mobile 6.1 pt-BR ready to be flashed.
I've put a small ZIP file with all the tools required to reproduce this steps, as well as the ROM file I've made.
I hope this is helpful to someone, and I plead to the cook gurus on this forum to check if I did everything right.
Now I need a brave enough person to see if the ROM is OK because I admit I'm too scared to try it myself and brick my phone.
-----
Palm Treo Pro Rebuild ROM Utilities (zipped)
Palm Treo Pro pt-BR 1.65.28.25 ROM File (zipped)
hi man i flash my pro with u rom and work perfet!! thks man ;D
waltercell said:
hi man i flash my pro with u rom and work perfet!! thks man ;D
Click to expand...
Click to collapse
Thanks... I really appreciate!
new rom
Hi I am downnloading now. Will let you know how I get on Cheers
what's the benefit of this process being done?
Thanks. I used the info to build the stock ROM in Spanish.
Man, i would like to thank you. Since the release of the HardSPL I was studying a way to make a pt-br ROM.
So, I´ve flashed my dad´s phone with your ROM some days ago and up to now, everything is going fine with his Treo Pro.
But i have to admit that i´m like that ==>
I just read this part of your post today: "Now I need a brave enough person to see if the ROM is OK because I admit I'm too scared to try it myself and brick my phone."
sentencedbr said:
Man, i would like to thank you. Since the release of the HardSPL I was studying a way to make a pt-br ROM.
So, I´ve flashed my dad´s phone with your ROM some days ago and up to now, everything is going fine with his Treo Pro.
But i have to admit that i´m like that ==>
I just read this part of your post today: "Now I need a brave enough person to see if the ROM is OK because I admit I'm too scared to try it myself and brick my phone."
Click to expand...
Click to collapse
Valeu!!
Eu fiz isso antes de qualquer alteração no meu Treo pra ter um backup caso alguma coisa desse errado. Eu queria uma ROM em inglês, já que todo meu sistema em casa é em inglês, porque eu trabalho com desenvolvimento de sistemas e as coisas tendem a sair primeiro em inglês.
Translation for the non Portuguese speakers:
Thanks!!
I did that before any updates in my Treo to have a backup in case something went wrong. I wanted an English ROM, once that my whole system at home is in English, because I work as a software developer and all the good stuff comes first in English.
Man, I'll try by myself to backup my rom here. Your dump is from a unbranded Treo?
Finally, with your explanation is possible to build a 6.5 rom?
Thanks a lot!
Build 28205 PLEASE!!
i have tried several times to build my own ROM for my Treo Pro with no success... I am currently running the BigE ROM 23511 but would LOVE to have the current (28205) build!
Is there any amount of pleading I can do to persuade you (or someone) to build it? I have collected a great deal of the HTC cabs for many things (new phone canvas, ArcSoft MMS 5.2.2, etc.) which would go great in the new ROM too. Please get back to me and let me know if you can help.
Thanks in advance!
PJonDevelopment, your rom is from the unlocked and unbranded brazilian's version? If yes, you can put this in a mirror please, i'm having troubles in the download.
PJonDevelopment,
First, thanks a LOT for the rom, great to use a native language on the phone.
Nevertheless, I'd like to ask, thinking about develoiping a 6.5 pt-BR ROM? I've been trying the 6.5 ROMs, and there are some nice improvements there I'd like to have, but keeping the portuguese basis...
I'm willing to try any ROMs you may want to test, if you give it a shot.
Best regards,
Roger.
rgkamei said:
PJonDevelopment,
Nevertheless, I'd like to ask, thinking about develoiping a 6.5 pt-BR ROM? I've been trying the 6.5 ROMs, and there are some nice improvements there I'd like to have, but keeping the portuguese basis...
I'm willing to try any ROMs you may want to test, if you give it a shot.
Best regards,
Roger.
Click to expand...
Click to collapse
Hey, it's a good idea! I'll find the way to put portuguese in a 6.5 rom. If someone wants to help I'll be grateful
i like your tutorial on how to dump and rebuild your rom but could you tell me where you found out your rom version and language number thanks
DeveuS said:
i have tried several times to build my own ROM for my Treo Pro with no success... I am currently running the BigE ROM 23511 but would LOVE to have the current (28205) build!
Is there any amount of pleading I can do to persuade you (or someone) to build it? I have collected a great deal of the HTC cabs for many things (new phone canvas, ArcSoft MMS 5.2.2, etc.) which would go great in the new ROM too. Please get back to me and let me know if you can help.
Thanks in advance!
Click to expand...
Click to collapse
Deveu.. i'm currently running Zevot's 23511-V1.2 on my sprint's treo pro, and it's working great. Could u plz tell me why u prefer the 28205 build, and since u r saying it's current.. why can't u have it? Am I missing something!
Thnx!!
Hi guys. Today I cooked a 21884 build and it's working fine on my treo. It's in english yet, next step is to port this to another language, like portuguese. Till now no have success in porting the building process generates a lot of errors that I don't know the origins, but still trying.
I have a doubt with step 7 and 8 in the above mentioned instructions...
7. Run pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw to dump the
first partition to your hard drive.
8. Do the last two steps for partitions 01, 02 and 03.
For Part00.raw we have set the Start as 0 and end as 0x31f000, should we use "0" for even Part 01,02 and 03 ?
PJonDevelopment said:
As I have posted on this thread I've dumped the ROM from my spanking new Palm Treo Pro (pt-BR).
Click to expand...
Click to collapse
I can't get htcrt.exe to load any devices in the "build tab"...looks like the configuration file is missing ?
am I missing anything ?
Some confusion....
jaypro said:
Deveu.. i'm currently running Zevot's 23511-V1.2 on my sprint's treo pro, and it's working great. Could u plz tell me why u prefer the 28205 build, and since u r saying it's current.. why can't u have it? Am I missing something!
Thnx!!
Click to expand...
Click to collapse
I think the was some confusion as to which build I am running... At the time of my post, I was running the BigE ROM 23511... since then I have flashed up to the BigE ROM 23518... The improvements are few, but ok. mostly, The BigE change was in the software which was included in the build (namely the upgrade of Office Mobile 2010, Screen Lock, addition of versions of telenav, sprint navigation and a few others.
To tell you the truth, I think the previous build I was running (23511) was more STABLE, but I DO like the newer software.
What I was referring to was the AVAILABILITY of the 28205 build package but that nobody seems to have done ANYTHING with it... The 28205 rollup package was posted by Da_G quite a while ago. As of yet I have still seen anyone even attempt anything close to the 28205 build... still waiting and searching!
is there a way to rebuild the rom with all four .raw files thanks for a great tutorial

Categories

Resources