supersede XIP modules with in RAM copy Question - General Questions and Answers

Hi,
i have dumped the complete image of my xperia and reconstructed the dll's located in the XIP section of the image. I now have access to all the files i am interested in namely coredll.dll. I have disassembled the file with IDA Pro. Now i want to debug an application and singlestep into the coredll.dll as well which is not possible if the system uses the XIP version of the dll. In Volume 10 of the uninformed magazine the author describes a way to supersede the XIP copy of an module by a module in the filesystem.
[question] is there a way to accomplish this ?
Thanks for helping

Related

[Walkthrough] How to Port a ROM [XIP and SYS]

Obligatory Warning Label:
Use this at your own RISK. I cannot be held liable for any damage caused to your device by your own mistakes or by my mistakes in the instructions.
How to port a XIP:
Extract xip.bin from the build you want to port from
Download Bepe's XIPPort
Extract XIPPort to any folder
The folder should contain XIPPort.exe, pkgcommon.dll, and xip.bin you want to port.
Run XIPProt.exe
Press "Dump xip.bin" - This will create an OUT folder
Press "Make Pkgs"
Open the OUT folder and you will find two folders: Files and Modules
Copy the contents of MSXIPKernel and MSXIPKernelLTK with each folder (Files and Modules) and paste them to /ROM/XIP folder and replace. (Note: Don't worry about copying the .txt files, they are not needed.)
Source
How to port a SYS folder
Open your old SYS folder and copy the .VM and WinCENLS_WWE folders into your new SYS folder
Go to your old SYS\Shell and copy shell32.exe and shellres.dll into your new SYS\Shell
Source
Q&A
Q: What is the XIP?
A: It's the kernel of the ROM.
Q: What is the SYS folder?
A: It's where all the new apps included in each Windows Mobile release are stored.
Q: I did all this and I bricked my phone, help!!!
A: First, rest assured. Your phone is not bricked. See THIS thread on how to unbrick your phone. Secondly, refer to Q&A #4.
Q: This is too complicated... but I still want to port my own ROM. What should I do?
A: Easy. Use my EasyPortOven and the process will be automated.
Q: Where do I get the latest SYS folders? XIP's?
A: I don't know... Your guess is as good as mine. I just download Kaiser ROM's that have them since they tend to have the latest and greatest first. Do NOT PM me asking me where to find them.
well done ,thanks.
ivan i love you...lol just kidding silly goose but thanks a million
Ivan:
Can XIP or SYS folders be ported over different language ROMS?
Say... I have my spanish HTC WM6 ROM, can I port an english WM6.1 over it to obtain an unofficial spanish WM6.1?
I assume the XIP folder could be ported but porting the SYS folder would end with a spanish ROM and multiple applications in WWE (without even starting to think about localization codes troubles)
Thanks.
le_hades said:
Ivan:
Can XIP or SYS folders be ported over different language ROMS?
Say... I have my spanish HTC WM6 ROM, can I port an english WM6.1 over it to obtain an unofficial spanish WM6.1?
I assume the XIP folder could be ported but porting the SYS folder would end with a spanish ROM and multiple applications in WWE (without even starting to think about localization codes troubles)
Thanks.
Click to expand...
Click to collapse
You'd have to go through every file in the OEM folder and find every misdirected link (because of the different language) as well as replace every MUI. So in short, no it's not possible unless you have a LOT of time and want to work really hard. What I would do is just use any of the readily available Spanish Herald ROMs to obtain your OEM files.
mm this is a "fast" and dirty way:
If you use in.ex a 19199 build (0409 wwe)
you need to extract all mui files from 04xx (your langauge from another build, if you use wm6.1 you need to use mui from another wm6.1 build)
rename them from 04xx to 0409, replace all in you 19199 build with the new renamed ones
this can be done both in OEM and SYS
The thing is that i'd like to make a herald spanish 6.1 ROM but I can't find none to port on kaiser forums etc, so i was thinkong about alternatives
ivanmmj said:
Obligatory Warning Label:
Use this at your own RISK. I cannot be held liable for any damage caused to your device by your own mistakes or by my mistakes in the instructions.
How to port a XIP:
Extract xip.bin from the build you want to port from
Download Bepe's XIPPort
Extract XIPPort to any folder
The folder should contain XIPPort.exe, pkgcommon.dll, and xip.bin you want to port.
Run XIPProt.exe
Press "Dump xip.bin" - This will create an OUT folder
Press "Make Pkgs"
Open the OUT folder and you will find two folders: Files and Modules
Copy the contents of MSXIPKernel and MSXIPKernelLTK with each folder (Files and Modules) and paste them to /ROM/XIP folder and replace. (Note: Don't worry about copying the .txt files, they are not needed.)
Source
How to port a SYS folder
Open your old SYS folder and copy the .VM and WinCENLS_WWE folders into your new SYS folder
Go to your old SYS\Shell and copy shell32.exe and shellres.dll into your new SYS\Shell
Source
Q&A
Q: What is the XIP?
A: It's the kernel of the ROM.
Q: What is the SYS folder?
A: It's where all the new apps included in each Windows Mobile release are stored.
Q: I did all this and I bricked my phone, help!!!
A: First, rest assured. Your phone is not bricked. See THIS thread on how to unbrick your phone. Secondly, refer to Q&A #4.
Q: This is too complicated... but I still want to port my own ROM. What should I do?
A: Easy. Use my EasyPortOven and the process will be automated.
Q: Where do I get the latest SYS folders? XIP's?
A: I don't know... Your guess is as good as mine. I just download Kaiser ROM's that have them since they tend to have the latest and greatest first. Do NOT PM me asking me where to find them.
Click to expand...
Click to collapse
Great job bro,
ivan you rock!!
I learn so much from reading your threads.
I think im almost ready to cook a rom.
I was wondering if you could be my mentor??
It works and works very well, however, I have ported from Hermes XIP CE OS 19949 & build 19949.1.1.1
to Atom from orginal XIP and I have CE OS 5.2.1921 & build 19949.1.1.1 (WM6.1) how to gain CE of 19949? thank you very much for sharing.
homer285 said:
It works and works very well, however, I have ported from Hermes XIP CE OS 19949 & build 19949.1.1.1
to Atom from orginal XIP and I have CE OS 1921 & build 19949.1.1.1 (WM6.1) how to gain CE of 19949? thank you very much for sharing.
Click to expand...
Click to collapse
You ported the XIP AND the SYS folder?
Thanks for your reply, yes I did.
homer285 said:
Thanks for your reply, yes I did.
Click to expand...
Click to collapse
Are you using the imgfs.bin/os.nb from the Atom? The only time I've seen that is when you're using the imgfs.bin/os.nb from another device. It "lines up" enough for the ROM to work but somethings like the version numbers don't "line up." I'd need more information to find out what happened. Also, did you change the DPI of the ROM for any reason? or the DPI files?
ivanmmj said:
Are you using the imgfs.bin/os.nb from the Atom? The only time I've seen that is when you're using the imgfs.bin/os.nb from another device. It "lines up" enough for the ROM to work but somethings like the version numbers don't "line up." I'd need more information to find out what happened. Also, did you change the DPI of the ROM for any reason? or the DPI files?
Click to expand...
Click to collapse
yes Im using the Diskimage_Ver.nb0 from Atom in Rom folder, tried by hand and EasyPortOven same result, only build is porting not CE OS info. Perhaps I need a new XIP to try, anyway thanks for this great tool it really makes porting easy, seriously.
Edit: So the trick for me was the Atom needed porting directly, all modules must have address changed and then ported to diskimage_Ver via XIPPORT, drop into Kitchen/ROM folder along with everything mentioned here .
can anyone confirm if this works for the kaiser, and if it doesn't, what to use for the kaiser?
thanks in advance
I've heard that Keeping your original Device MetaData hive files isn't that important as the Hive Files get created.
But just to be on the Sure side.
When you put the Hive files from MetaData folder into the New Build from the Ported Sys.
Won't that make hive files with unneeded Reg entries?
instead of sticking with your original device Hive Files?
€dit: Wrong thread, sorry!
Drivers?
What about the drivers and files specific to the device?
Is it included in the .VM folder? Is it not necessary to copy the .ROM folder too?
So, in essence, I have to just copy the folders you have specified to the new SYS and XIP folders and use BuildOS. To cook a light and clean ROM, only these two folders are enough, right?
BTW, what is the OEM folder for? In the kitchens, I have used, they contain a few folders like OEMAPPS, OEMDRIVERS, etc, which in some kitchens are placed in the SYS folder instead.
I don't know where to place those folders. Is the location of those folders irrelevant? I am kinda noob to cooking. I've played with it a lot of times with mixed results. I am building it for Tornado btw.
rajathvsm said:
What about the drivers and files specific to the device?
Is it included in the .VM folder? Is it not necessary to copy the .ROM folder too?
So, in essence, I have to just copy the folders you have specified to the new SYS and XIP folders and use BuildOS. To cook a light and clean ROM, only these two folders are enough, right?
BTW, what is the OEM folder for? In the kitchens, I have used, they contain a few folders like OEMAPPS, OEMDRIVERS, etc, which in some kitchens are placed in the SYS folder instead.
I don't know where to place those folders. Is the location of those folders irrelevant? I am kinda noob to cooking. I've played with it a lot of times with mixed results. I am building it for Tornado btw.
Click to expand...
Click to collapse
Things have changed a lot since I wrote this... but:
The drivers are in the OEM folder (as well as most of the device specific stuff.)
You need the OEM, SYS and XIP in order to make ANY ROM.
You can move your OEM into your SYS but it makes it harder to port newer builds to your ROM later on.
You only need the .VM folder, not the .ROM folder. The kitchen will autoadjust itself.
Yep its been a long time... but is useful on old kitchens
I gues i have an hybrid
cause the process i use is like EXT packages + OEM packages + SYS + XIP
Something about a platform rebuilder + oldschool buildOS hahaha
Maybe you can help me Ivan using your process to port the xip i DID it! it works the sys too but....
I port the SYS from xbeta.cn hermes WWE, changing the .VM and shellres you know... and the xip usin xipport everything goes fine I port the Xip from Kaiser... but
But now everything i install says certificates untrested... i instal sdkcerts and nothing happends
do you think i port the sys or xip wrong?
thanks in advance I dont have an Herald, I had an hermes... but i think the process is the same...
wm6.5 build 21812

SYS question

Ok,
Searched a lot but can't figure this one out:
If I download an extracted SYS folder (tried many!) often the modules miss the actual files inside...
for example the module (map) beam.exe contains:
- imageinfo.bin
- imageinfo.txt
- S000
- S001
- S002
- S003
but it does not contain the actual beam.exe.
Only in very rare occasions I find the files in place. If I extract SYS myself from a working rom they are there....??
I know that beam is not an essential module but I have the same problem with other modules (poutook, tmail).
If I use a SYS in my kitchen without the 'actal' files the produced ROM is unusable. I can imagine the files are stored in the bin or in the S00* files but my kitchen (ervius package tool) does nothing with it.
Can somebody help me out?

dll reconstruction of xip files in wm6

Dear All,
i'm owner of omnia i900 from samsung, and i'm bit interested in adroid os and what would be eventual possibilities to port it to this pda/phone. I'd like to copy driver files from /windows/ directory on the phone and disasseble it to see the init of lcd etcetc. These files are copy-protected so I gues they are sort of executable-in-place because they do a core of wm6 system. is there any way how to disassemble/copy/reconstruct them? i've been looking around, but didn't find any specific info.
i'd be happy for any useful info.
thx.
d.
dejfson said:
Dear All,
i'm owner of omnia i900 from samsung, and i'm bit interested in adroid os and what would be eventual possibilities to port it to this pda/phone. I'd like to copy driver files from /windows/ directory on the phone and disasseble it to see the init of lcd etcetc. These files are copy-protected so I gues they are sort of executable-in-place because they do a core of wm6 system. is there any way how to disassemble/copy/reconstruct them? i've been looking around, but didn't find any specific info.
i'd be happy for any useful info.
thx.
d.
Click to expand...
Click to collapse
It's possible to disassemble and reconstruct the dlls. You would first have to download a ROM update for the phone and then dump the PDA part of the ROM using the an omnia kitchen. All this can be found over @ the MoDaCo forums. When you look in the ROM folder inside the XIP folder there will be the dlls you need. You should then get the IDA disassembler and disassemble the dlls with that. After finding the routines you need you'll need to get the HAReT bootloader and the Linux kernel to patch. from there on in you'll need to read up on dzo's android linux for the Vogue and HAReT's documentation and go from there. Hope it helps...
Sorry for late response. Sort of busy. Thanks for info. Very useful. I'll try to look into....
d.
XIP again?
Dear All,
maybe someone could give me some hint. I've got all the drivers I need thanks to post of Soul_Est. Unfortunately this is not a complete solution for me.
When I try to disassemble e.g. zylonite_usb driver, it ask me for reference to ceddk.dll library. this is unfortunately XIP file, therefore no ceddk.dll exists as this library is spread over many files (imageinfo.bin, imageinfo.txt, s000,s001,s002,s003). Of course when I cancel import of this DLL, the IDA disassembler will put into the decompiled zylonite_usb code links to call functions as CEDDK_37, CEDDK_62 etcetc. It would improve my guessing of what happens by degree of order if I would be able to import this CEDLL XIP file into IDA, thus instead of CEDLL_37 call I could see real function name...
could someone smart tell me how to do this? how can I prepare these ceddk files in order to import them into IDA?
thanksalot
You could use ervius' buildos + pkgtools 4.3beta1 to re-assemble the module as it's called into the file you need. I can't remember where I found it though. You could also look into the haretconsole to look into the function calls. Documentation is here: http://www.handhelds.org/moin/moin.cgi/HaRET_20Documentation
There is also someone porting the Linux kernel to the Omnia as well. You should check here: http://forum.xda-developers.com/showthread.php?t=431329
The two of you could possibly work together on the project.
moved to the Q&A section

Porting XIP to Prophet

Can i ask and please be simple with the Answer as i am a total neewbie to this area of ROM building
I have downloaded a XIP and SYS build 21042 but it is in Modules and to use it in XIP kitchen or similar it needs to be a bin file or that's what it asks for can i please ask is there a simple way to convert this XIP to bin file (also XIP in my prophet Kitchen is the same in modules
This is driving me to despare i have read the Manual porting tutorials but that is way above my level i have no programing skills so it looses me

Porting XIP from Kaiser 6.1 Rom

I am learning how to cook a Kaiser 6.5 Rom using osKitchen and just wanted confirmation that I am doing this right.
Any help / advice / redirection will be appreciated.
Thanks for reading.
---------------------------
Using htcRIE_0.5.0.12, I have dumped the XIP from WM 6.1 Rom (RUU_Kaiser_O2_UK_3.29.206.0) and get the following output:
XIP
-OEM
--LangDB
--OEMXIPKernel
-SYS
--MSXIPKernel
--MSXIPKernelLTK
--WinCENLS_WWE
1) LangDB is an empty folder with only a dsm file inside. Hence I have excluded this folder from my kitchen.
2) In OEMXIPKernel I have replaced cecompr.dll with the contained in Post 9 of this thread (http://forum.xda-developers.com/showthread.php?t=438676) that supports LZX compression. I have also deleted nk.exe folder to use the one contained in osKitchen (modified to work with 6.5 kernel). Should all other files / folders in OEMXIPKernel including boot.hv and boot.rgu be left untouched or is there scope for modification / tweaking?
3) MSXIPKernel - Deleted this folder and simply replaced with the one contained in 6.5 SYS package (build 28205). I have deleted mem card encription mencfilt.dll since I read that it is safe to do so.
(a) do I need to edit the dsm file to remove reference to mencfilt.dll or does Bepe's package rebuilder automatically create new dsm files?
(b) since the file size of modules in donor and source MSXIPKernel are different, do I need to manually reallocate the addresses of each module or is that automatically done during the cooking process?
4) MSXIPKernelLTK - Same again. Deleted this folder and simply replaced with the one contained in 6.5 SYS package (build 28205). This folder only contains a dsm file so I guess no reallocation is required.
5) WinCENLS_WWE - With this one I am not sure. Initially I thought of deleting this as well since it is contained in 6.5 SYS package. But elsewhere it was suggesting that this is not allowed since the Rom may not boot. OndraSter suggested that I transfer the wince.nls file into OEMXIPKernel and delete the WinCENLS_WWE folder. If i did this then
(a) do I need to edit the dsm file in OEMXIPKernel folder to add reference to wince.nls?
(b) should I delete the WinCENLS_WWE folder from 6.5 SYS folder to avoid duplication (although file sizes are different)?
Anyone willing to spare some time to help please?
Not sure why you are using ROM Editor to do this; it would be so much easier just to use osKitchen or Ervius and dump that ROM, then all you'd have to do is copy/paste. I'm also learning, but I'll answer what I know.
1)I do the same. Almost all chefs delete almost all the .dsm/package.ini files in their kitchen folder before cooking with osKitchen or Ervius's VK. I don't know why it is possible to cook without them, but it's easier then maintaining them and saves a tiny bit of space. It is also why almost all cooked ROMs are not able to be dumped as per OEM ROMs--the file associations and shadows are gone (which is what the .dsm/package.ini files provide).
2)Let me preface by saying that ideally, you shouldn't be touching anything in the OEM/MS kernel. 1st q: If you are using osKitchen, why are you doing this? It can compress with XPR or LZK out-of-box . 2nd q: The nk.exe is modified to use more RAM, not to work with WM 6.5. Kaiser doesn't have a native WM 6.5 nk.exe, so chefs use an older 6.1 nk.exe from a released ROM and patch it to use more memory if they want.
3)I've never deleted that, but this is otherwise correct. (a) You could use DSM editor and remove that one file association yourself. (b) Automatic, as I've never reallocated anything in the kernel and my ROMs cook perfectly.
4)This is correct.
Last one I don't know. I've never done any of that and my ROMs cook/work fine. If I did what OndraSter recommended, I still wouldn't do either (a) or (b) because I don't think it matters to the kitchen script--he would have probably told you to do that as well.
Thanks for responding to the distress signal.
Quetzecotyl said:
Not sure why you are using ROM Editor to do this; it would be so much easier just to use osKitchen or Ervius and dump that ROM, then all you'd have to do is copy/paste. I'm also learning, but I'll answer what I know.
Click to expand...
Click to collapse
I use the ROM editor since I get an error whilst using osKitchen to extract RUU_signed. Infact there is also a warning that pops-up explaining that this utility in osKitchen is awaiting a rewrite and to expect failures.
Quetzecotyl said:
1)I do the same. Almost all chefs delete almost all the .dsm/package.ini files in their kitchen folder before cooking with osKitchen or Ervius's VK. I don't know why it is possible to cook without them, but it's easier then maintaining them and saves a tiny bit of space. It is also why almost all cooked ROMs are not able to be dumped as per OEM ROMs--the file associations and shadows are gone (which is what the .dsm/package.ini files provide).
Click to expand...
Click to collapse
Thanks. This is solved .
Quetzecotyl said:
2)Let me preface by saying that ideally, you shouldn't be touching anything in the OEM/MS kernel. 1st q: If you are using osKitchen, why are you doing this? It can compress with XPR or LZK out-of-box .
Click to expand...
Click to collapse
I was getting errors with osKitchen when using the original 6.1 cecompr.dll. It is only when I replaced it with the version in the referenced post that the errors disappeared.
Quetzecotyl said:
2nd q: The nk.exe is modified to use more RAM, not to work with WM 6.5. Kaiser doesn't have a native WM 6.5 nk.exe, so chefs use an older 6.1 nk.exe from a released ROM and patch it to use more memory if they want.
Click to expand...
Click to collapse
Thanks for the clarification .
Quetzecotyl said:
3)I've never deleted that, but this is otherwise correct. (a) You could use DSM editor and remove that one file association yourself. (b) Automatic, as I've never reallocated anything in the kernel and my ROMs cook perfectly.
Click to expand...
Click to collapse
Thanks. This is solved .
Quetzecotyl said:
4)This is correct.
Click to expand...
Click to collapse
Thanks. This is solved .
Quetzecotyl said:
Last one I don't know. I've never done any of that and my ROMs cook/work fine. If I did what OndraSter recommended, I still wouldn't do either (a) or (b) because I don't think it matters to the kitchen script--he would have probably told you to do that as well.
Click to expand...
Click to collapse
When I dump the 6.1 ROM, wince is part of the XIP. The recent 6.5 releases (28008 and 28205) contain wince as a SYS package in folder WinCENLS_WWE. This is what confuses me - is wince device specific or is it build specific .
If I place the wince from 6.1 ROM in OEMXIPKernel and also select the one in 28205 SYS as an ingredient, then either I am duplicating (and possibly creating a conflict since the file sizes are different) or the kitchen script is smart enough to ignore one of these?
This has also been discussed at http://www.everythingdiamond.info/showthread.php?t=444&page=46 but without any strong conclusion.
Has anyone else experimented with wince?
OK, about WinCE--I wanted to make sure, but skimming through my build logs for a time, I don't think I've ever had that in my SYS. WinCE must be device specific because it is part of the OEMXipKernel, and I've used the same one (ie, OEMXipKernel) maybe 30+ times and can not recall ever seeing a wince.nls in my SYS updates. I've only cooked the 21xxx and 23xxx WM6.5 COM branches, but I can't help but think that the WinCE in your SYS update comes from the device the SYS dumpers used. If I were you, my first go around I would exclude it and use the one from your OEMXip. If for some reason your ROM doesn't boot (it could be so many other things), try replacing your wince.nls with the one from your SYS update (highly doubt this).
BTW, I recommend using Ervius for dumping, as it has never given me any issues.
I think what you say seems logical. I will give it a try and feedback how it went. Thanks once again.
If you dump it via my kitchen and put name Kaiser, it should autogenerate all Sources folder with OEM, original SYS and put NK and XIP on right places actually. (I tried it on newer version of Kaiser's ROM when I was making this dumper so it should work fine.)
And if you restart kitchen, it will load all things automatically (or I hope so, I haven't tried the new UI yet, I'm still at the old one since I actually prefer it...)
I get an error when dumping using your kitchen. I have posted the exception text in your thread.
ps: This is sorted. My RUU_Signed.nbh was not in root of osKitchen dir but a different dir where I place my ROMs.

Categories

Resources