How to dump rom from TyTn? tried awizard 1.3b2 don't work... - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

don't unlock CID and read only extended rom........
anyone know how to read and write rom on TyTn
I have Italian TyTn
thanks

---

I uploaded your ExtROM to FTP, and updated the information on the wiki:
http://wiki.xda-developers.com/index.php?pagename=Hermes_ExtendedRoms
Can you please edit the page and provide information on which extended rom version is it?
Also it would be useful if you edit the Available Hermes Versions page and add the details on your device under a new ITA row.
Thanks!

---

i wrote i little piece about how to dump some of the roms of the hermes.
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom

---

itsme said:
i wrote i little piece about how to dump some of the roms of the hermes.
Click to expand...
Click to collapse
Many thanks!! I will try and post my results when I get back home.

---

I am always getting this error:
Code:
C:\itsutils>pdocread.exe -l
Copying C:\itsutils\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
I have tried restarting device and activesync several times, I've searched the forum and RTFM, tried to delete the dll using resco explorer, it gets uploaded again, but then I get the error... I'm stuck and can't find a solution, anyone can help?
I am runing a default WinXP SP2 installation on a VMWare virtual machine under Linux, could this be the problem? I've been using activesync without problems to install soft, browse and sync the device.

---

awizard got same error
i got same error with awizard..........

---

probably your device is application locked, see the wiki article.

---

itsme said:
probably your device is application locked, see the wiki article.
Click to expand...
Click to collapse
Thanks!! That was it, I just changed the registry key and did a softreset, and now I can use itstools. I am having some problems, this is what I've done so far:
Code:
C:\itsutils>pdocread.exe -l
114.88M FLASHDR
| 3.12M Part00
| 2.88M Part01
| 50.88M Part02
| 58.00M Part03
968.75M DSK1:
| 968.50M Part00
STRG handles: 834d5e62
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(968.50M) 03958bce
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 58.00M) 239584da
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 50.88M) 039582ce
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 2.88M) 2395828a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 3.12M)
C:\itsutils>pdocread -w -n 0 -t
ERROR: ITTFFSGetInfo: outbuf==NULL
WARNING: using default 512 bytes for sectorsize
real nr of sectors: 1 - 512.00byte (0x200)
C:\itsutils>pdocread -w -n 1 -t
ERROR: ITTFFSGetInfo: outbuf==NULL
WARNING: using default 512 bytes for sectorsize
real nr of sectors: 1 - 512.00byte (0x200)
C:\itsutils>pdocread -w -t
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
real nr of sectors: 6398 - 3.12Mbyte (0x31fc00)
C:\itsutils>pdocread -w 0 0x31fc00 test.raw
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CopyTFFSToFile(0x0, 0x31fc00, test.raw)
C:\itsutils>pdocread -w 0 0x2e0000 test2.raw
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CopyTFFSToFile(0x0, 0x2e0000, test2.raw)
C:\itsutils>pdocread -w 0 0x32e0000 test3.raw
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CopyTFFSToFile(0x0, 0x32e0000, test3.raw)
ERROR: ITReadDisk - Internal error.
C:\itsutils>dir test*
10/08/2006 10:53 3.275.776 test.raw
10/08/2006 10:58 3.014.656 test2.raw
10/08/2006 11:02 3.211.264 test3.raw
3 archivos 9.501.696 bytes
C:\itsutils>
So, I have been able to dump BOOT (coldboot kernel?), and RAWFS (base kernel) but I get this internal error in IMGFS... file test3 should be 58Mb ideally...
Anything else I can try? Thanks again!

---

I attach my itsutils.log file, just in case it can help the troubleshooting...

---

On the wiki:
note, that with my phone there was a read error in the imgfs, where i had to read one specific 0x800 byte section separately and patch the diskimage to make it work.
Click to expand...
Click to collapse
I guess it is the same error I am getting... so, let's see if it works that way:
Code:
C:\itsutils>pdocread -w 0 0x32e0000 test3_0.raw
CopyTFFSToFile(0x0, 0x32e0000, test3_0.raw)
ERROR: ITReadDisk - An internal error occurred.
C:\itsutils>dir test3_0.raw
10/08/2006 22:22 3.211.264 test3_0.raw
ok, it stops here... i know i have 3211264 bytes which is 0x310000 so I specify this as "start" parameter of pdocread, and as you suggested in the wiki, i read only 0x800 byte:
Code:
C:\itsutils>pdocread -w 0x310000 0x800 test3_1.raw
CopyTFFSToFile(0x310000, 0x800, test3_1.raw)
It worked! Now I should continue reading the rest of the imgfs, I already have 0x310800 byte, so I need to read until 0x2fcf800, right? that is:
Code:
C:\itsutils>pdocread -w 0x310800 0x2fcf800 test3_2.raw
CopyTFFSToFile(0x310800, 0x2fcf800, test3_2.raw)
ERROR: ITReadDisk - An internal error occurred.
And here we are... the same error again!?!?!
I tried with bigger values than 0x800 byte but I do not success on extracting the whole imgfs. Can you please post the commands you used?? Thanks, thanks, thanks

---

Finally i know how it works!
OK, I am stupid, forget my other two previous comments... i think i got the point right now!
I was missing the handle, but for me it's easier to use -d and -p than -h so I did like this to check the sizes:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part00 -t
real nr of sectors: 6398 - 3.12Mbyte (0x31fc00)
C:\itsutils>pdocread -w -d FLASHDR -p Part01 -t
real nr of sectors: 5888 - 2.88Mbyte (0x2e0000)
C:\itsutils>pdocread -w -d FLASHDR -p Part02 -t
real nr of sectors: 104192 - 50.88Mbyte (0x32e0000)
C:\itsutils>pdocread -w -d FLASHDR -p Part03 -t
real nr of sectors: 118784 - 58.00Mbyte (0x3a00000)
Now let's dump every partition:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part00 0 0x31fc00 Part00.raw
CopyTFFSToFile(0x0, 0x31fc00, Part00.raw)
C:\itsutils>pdocread -w -d FLASHDR -p Part01 0 0x2e0000 Part01.raw
CopyTFFSToFile(0x0, 0x2e0000, Part01.raw)
C:\itsutils>pdocread -w -d FLASHDR -p Part02 0 0x32e0000 Part02_0.raw
CopyTFFSToFile(0x0, 0x32e0000, Part02_0.raw)
ERROR: ITReadDisk - Not enough storage is available to complete this operation.
C:\itsutils>dir Part*.raw
10/08/2006 22:52 3.275.776 Part00.raw
10/08/2006 22:53 3.014.656 Part01.raw
10/08/2006 23:00 39.911.424 Part02_0.raw
C:\itsutils>
So I guess this is the error pointed in the wiki... I will try to do the 0x800 byte trick to complete dumping the rest of imgfs.
The file size is 39.911.424 (0x2610000 in hex), so I specify this value as start, and 0x800 byte length:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part02 0x2610000 0x800 Part02_1.raw
CopyTFFSToFile(0x2610000, 0x800, Part02_1.raw)
It worked, now I have to start at 0x2610000 + 0x800 and read the rest of the partition which is 0x32e0000 (total size) - 0x2610800 (what I have already read), so the result is 0xccf800 bytes Iength I need to read:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part02 0x2610800 0xccf800 Part02_2.raw
CopyTFFSToFile(0x2610800, 0xccf800, Part02_2.raw)
And that's it! All dumped successfully
Code:
C:\itsutils>dir Part*.raw
10/08/2006 22:52 3.275.776 Part00.raw
10/08/2006 22:53 3.014.656 Part01.raw
10/08/2006 23:00 39.911.424 Part02_0.raw
11/08/2006 00:02 2.048 Part02_1.raw
11/08/2006 00:06 13.432.832 Part02_2.raw
Now I concatenate the three Part_?.raw files using cat under linux, like this:
Code:
$ cat Part02_0.raw Part02_1.raw Part02_2.raw > Part02.raw
And now I can check the filesize is correct, and I have successfully dumped all 3 partitions:
Code:
C:\itsutils>dir Part0?.raw
10/08/2006 22:52 3.275.776 Part00.raw
10/08/2006 22:53 3.014.656 Part01.raw
11/08/2006 00:10 53.346.304 Part02.raw
Cool :lol:
I will post the dumped rom on FTP and update the wiki with this information

---

There it is:
1. My dumped rom
2. Wiki page updated
itsme: can you explain the process of flashing a device using the dumped rom on the wiki? Thanks!

---

in my case the read error caused a file corruption when trying to decode the imgfs with rdmsflsh.pl, where the rdmsflsh.pl script ended prematurely.
there was no error printed by pdocread, but the resulting file was still corrupt.
if you run rdmsflsh.pl with the '-v' parameter, and in the output look for the last / highest offset decoded, then check if the rom image contains anything after that offset. there should only be NULs.
the rdmsflsh output should look something like this:
Code:
02aca3c0-02aca400 l=00000040 indexblock filedata for b69277c2-5bd7-41da-9399-4f096341b62c.dsm
02aca680-02acaf14 l=00000894 datablock 0 for indexblock filedata for b69277c2-5bd7-41da-9399-4f096341b62c.dsm
2196 0047 2006-06-12 17:22:12 b69277c2-5bd7-41da-9399-4f096341b62c.dsm
statistics:
16843 [ 0x000041cb ] compressed
23766 [ 0x00005cd6 ] datablocks
1521 [ 0x000005f1 ] ent_fffff6fd
1034 [ 0x0000040a ] ent_fffff6fe
1246 [ 0x000004de ] ent_fffffefb
403 [ 0x00000193 ] ent_fffffefe
1 [ 0x00000001 ] ent_ffffffff
1040 [ 0x00000410 ] files
397 [ 0x0000018d ] modules
1521 [ 0x000005f1 ] sections
2598 [ 0x00000a26 ] uncompressed
02acaf14 is the end of data offset here.
willem

---

itsme said:
in my case the read error caused a file corruption when trying to decode the imgfs with rdmsflsh.pl, where the rdmsflsh.pl script ended prematurely.
there was no error printed by pdocread, but the resulting file was still corrupt.
if you run rdmsflsh.pl with the '-v' parameter, and in the output look for the last / highest offset decoded, then check if the rom image contains anything after that offset. there should only be NULs.
the rdmsflsh output should look something like this:
Code:
02aca3c0-02aca400 l=00000040 indexblock filedata for b69277c2-5bd7-41da-9399-4f096341b62c.dsm
02aca680-02acaf14 l=00000894 datablock 0 for indexblock filedata for b69277c2-5bd7-41da-9399-4f096341b62c.dsm
2196 0047 2006-06-12 17:22:12 b69277c2-5bd7-41da-9399-4f096341b62c.dsm
statistics:
16843 [ 0x000041cb ] compressed
23766 [ 0x00005cd6 ] datablocks
1521 [ 0x000005f1 ] ent_fffff6fd
1034 [ 0x0000040a ] ent_fffff6fe
1246 [ 0x000004de ] ent_fffffefb
403 [ 0x00000193 ] ent_fffffefe
1 [ 0x00000001 ] ent_ffffffff
1040 [ 0x00000410 ] files
397 [ 0x0000018d ] modules
1521 [ 0x000005f1 ] sections
2598 [ 0x00000a26 ] uncompressed
02acaf14 is the end of data offset here.
willem
Click to expand...
Click to collapse
Hi,
how would it work out to dump files from the ROM, such as e.g. ril.dll etc. ?
There is a little software at buzzdev.net called wm5filedump (or so, cannot recall it right now).
If I have it run as is with my German HTC TyTN it runs but doesn't dump anything to the storage card.
As the reason for that I found out - looking at the code using a hex editor - that it obviously tries to save to a directory it creates on "Storage Card".
However on a German localized OS this is "Speicherkarte"...
Managed to rewrite this to "Speicherkarte" for the links shown in the code and actually got lots of files dumped to /dump or /dmp folder on my card.
However some really interesting files were missing, like all those radio library dll's.
Also an other folder the program created, called "modules" stayed empty.
Can anyone prove with the original English OS if something gets dumped there ?
@itsme:
Probably you are very gifted in ROM manipulation. I think I am not as bold as you are, but I'd only like to have the ROM files (the one's you can also see with a good explorer but cannot manipilate because the're ROM; or e.g. the ril.dll which just shows zeros if you view it in a HexEditor etc.) dumped for editing and analysis and maybe a safe way for uploading Splash Screens or so.
Maybe it's possible to look for hidden registry keys that way.
Any ideas ?

---

Sorry for the delay in answering.. i run rdmsflsh.pl with my Part02.raw file, it reads the whole file without any errors.
Code:
c:\xda>mkdir files
c:\xda>rdmsflsh.pl -d files Part02.raw
[...]
1334 0047 2006-01-24 11:37:24 direct16.2bp
1334 0045 2006-01-24 11:29:32 alerts.bmp
1334 0047 2006-01-24 11:38:28 PNotes.2bp
1263 0047 2006-01-24 11:29:44 seekthumb96S.gif
1256 0047 2006-01-24 11:38:28 question.bmp
1248 0045 2006-05-30 09:59:42 ding.amr
statistics:
16595 [ 0x000040d3 ] compressed
22868 [ 0x00005954 ] datablocks
1521 [ 0x000005f1 ] ent_fffff6fd
767 [ 0x000002ff ] ent_fffff6fe
1013 [ 0x000003f5 ] ent_fffffefb
398 [ 0x0000018e ] ent_fffffefe
768 [ 0x00000300 ] files
397 [ 0x0000018d ] modules
1521 [ 0x000005f1 ] sections
2490 [ 0x000009ba ] uncompressed
Now I have extracted all the files contained in the imgfs. (will put them in ftp later, so anyone can have a look....)
What I want is to create a .NBH file and replace the HERMIMG_Dopod_1.23.707.1_SHIP.nbh contained in CHT9000_ENG.exe, so we can use the RUU (Rom Upgrade Utility) with our extracted rom files. I have been playing with romtools, but I can't figure out how to "join" all rom files into a valid .nbh file.
itsme: can you point me to the right directon? Thanks for your help

---

ghl10000 said:
how would it work out to dump files from the ROM, such as e.g. ril.dll etc. ?
[...]
I'd only like to have the ROM files (the one's you can also see with a good explorer but cannot manipilate because the're ROM; or e.g. the ril.dll which just shows zeros if you view it in a HexEditor etc.) dumped for editing and analysis.
Click to expand...
Click to collapse
1) Download ActiveState perl from here:
http://www.activestate.com/Products/Download/Download.plex?id=ActivePerl
2) Open perl package manager and run 3 commands:
Code:
ppm> repository add itsme http://www.xs4all.nl/~itsme/projects/perl/ppm
ppm> install XdaDevelopers-NbfUtils
ppm> install XdaDevelopers-CompressUtils
You should see something like this:
Code:
PPM - Programmer's Package Manager version 3.4.
Copyright (c) 2001 ActiveState Software Inc. All Rights Reserved.
Entering interactive shell. Using Term::ReadLine::Perl as readline library.
Type 'help' to get started.
Setting 'target' set to 'ActivePerl 5.8.8.817'.
ppm> repository add itsme http://www.xs4all.nl/~itsme/projects/perl/ppm
Repositories:
[1] ActiveState Package Repository
[2] itsme
ppm> install XdaDevelopers-NbfUtils
====================
Install 'XdaDevelopers-NbfUtils' version 0.20 in ActivePerl 5.8.8.817.
====================
Downloaded 36872 bytes.
Extracting 20/20: blib/lib/XdaDevelopers/NbfUtils.pm
Installing C:\Perl\site\lib\auto\XdaDevelopers\NbfUtils\NbfUtils.bs
Installing C:\Perl\site\lib\auto\XdaDevelopers\NbfUtils\NbfUtils.dll
Installing C:\Perl\site\lib\auto\XdaDevelopers\NbfUtils\NbfUtils.exp
Installing C:\Perl\site\lib\auto\XdaDevelopers\NbfUtils\NbfUtils.lib
Installing C:\Perl\site\lib\auto\XdaDevelopers\NbfUtils\NbfUtils.pdb
Files found in blib\arch: installing files in blib\lib into architecture depende
nt library tree
Installing C:\Perl\site\lib\XdaDevelopers\NbfUtils-perlonly.pl
Installing C:\Perl\site\lib\XdaDevelopers\NbfUtils.pm
Successfully installed XdaDevelopers-NbfUtils version 0.20 in ActivePerl 5.8.8.8
17.
ppm> install XdaDevelopers-CompressUtils
====================
Install 'XdaDevelopers-CompressUtils' version 0.30 in ActivePerl 5.8.8.817.
====================
Downloaded 103843 bytes.
Extracting 24/24: blib/script/cecompr_nt.dll
Installing C:\Perl\site\lib\auto\XdaDevelopers\CompressUtils\CompressUtils.bs
Installing C:\Perl\site\lib\auto\XdaDevelopers\CompressUtils\CompressUtils.dll
Installing C:\Perl\site\lib\auto\XdaDevelopers\CompressUtils\CompressUtils.exp
Installing C:\Perl\site\lib\auto\XdaDevelopers\CompressUtils\CompressUtils.lib
Installing C:\Perl\site\lib\auto\XdaDevelopers\CompressUtils\CompressUtils.pdb
Files found in blib\arch: installing files in blib\lib into architecture depende
nt library tree
Installing C:\Perl\site\lib\XdaDevelopers\CompressUtils.pm
Installing C:\Perl\bin\CECompressv3.dll
Installing C:\Perl\bin\CECompressv4.dll
Installing C:\Perl\bin\cecompr_nt.dll
Successfully installed XdaDevelopers-CompressUtils version 0.30 in ActivePerl 5.
8.8.817.
ppm>
3) Then download the dumped roms from TyTN or Dopod 838 from here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_DumpedRoms
4) Download rdmsflsh.pl script, here:
http://nah6.com/~itsme/cvs-xdadevtools/dumprom/rdmsflsh.pl
5) The contents of imgfs are on Part02.raw, to extract them just run these commands in the same dir you have Part02.raw:
Code:
mkdir files
rdmsflsh.pl -d files Part02.raw
Hope that helps

---

This is the last output part of rdmsflsh.pl -v Part02.rom, using my TyTN extracted imgfs:
Code:
[...]
02a87340-02a87374 l=00000034 name entry fileent 191672
fileent 191672: direct16.2bp
02a871c0-02a87200 l=00000040 indexblock filedata for direct16.2bp
02a87b80-02a87c09 l=00000089 datablock 0 for indexblock filedata for direct16.2bp
1334 0047 2006-01-24 11:37:24 direct16.2bp
02a873a8-02a873dc l=00000034 name entry fileent 191776
fileent 191776: alerts.bmp
02a87c40-02a87c80 l=00000040 indexblock filedata for alerts.bmp
02a87c80-02a87fc2 l=00000342 datablock 0 for indexblock filedata for alerts.bmp
1334 0045 2006-01-24 11:29:32 alerts.bmp
02a8803c-02a88070 l=00000034 name entry fileent 191880
fileent 191880: PNotes.2bp
02a88200-02a88240 l=00000040 indexblock filedata for PNotes.2bp
02a88240-02a885fc l=000003bc datablock 0 for indexblock filedata for PNotes.2bp
1334 0047 2006-01-24 11:38:28 PNotes.2bp
02a880d8-02a8810c l=00000034 name entry fileent 192036
fileent 192036: seekthumb96S.gif
02a88b00-02a88b40 l=00000040 indexblock filedata for seekthumb96S.gif
1263 0047 2006-01-24 11:29:44 seekthumb96S.gif
02a88140-02a88174 l=00000034 name entry fileent 192140
fileent 192140: question.bmp
02a89000-02a89040 l=00000040 indexblock filedata for question.bmp
1256 0047 2006-01-24 11:38:28 question.bmp
02a881a8-02a881dc l=00000034 name entry fileent 192244
fileent 192244: ding.amr
02a891c0-02a89200 l=00000040 indexblock filedata for ding.amr
1248 0045 2006-05-30 09:59:42 ding.amr
statistics:
16595 [ 0x000040d3 ] compressed
22868 [ 0x00005954 ] datablocks
1521 [ 0x000005f1 ] ent_fffff6fd
767 [ 0x000002ff ] ent_fffff6fe
1013 [ 0x000003f5 ] ent_fffffefb
398 [ 0x0000018e ] ent_fffffefe
768 [ 0x00000300 ] files
397 [ 0x0000018d ] modules
1521 [ 0x000005f1 ] sections
2490 [ 0x000009ba ] uncompressed
So, I guess 2a89200 is my end of data offset here. I used hexdump to see if I have only NULs (0x00) after this or not, and this is what I get (first column is the offset):
Code:
2a891b0 9003 043f bf90 0e00 00b8 303c 0458 5800
2a891c0 2004 e59b 10d1 e1d3 7848 0000 8222 04e0
2a891d0 9330 049b 0419 2411 2054 9302 02e5 9931
2a891e0 3fe7 0804 e35e 3d22 3004 e083 30b2 3ad3
2a891f0 1d04 0439 7827 3008 e082 98f2 8a02 3820
2a89200 3000 59d2 5355 9888 5103 16e1 089c 2085
2a89210 e083 0199 98f2 f201 d920 df00 d108 08d8
2a89220 d804 d308 08df 0c95 08df 9fd1 4104 9801
2a89230 5a04 5004 98a0 f100 01b5 8555 047e be18
2a89240 8508 07f8 f8d3 9507 02e1 5300 12e1 08be
2a89250 00bf b90c fc00 d10c 08d8 d804 5f08 2208
So, I guess my resulting file is also corrupted, there is data until the end of the file:
Code:
32dff50 ff7d babd ffbd 0007 f7f4 f7f7 ebde cede
32dff60 cedf d3bd adbd adc7 b694 0094 38ff 8c12
32dff70 8cae 0010 9631 0179 555a b76b 0202 0017
32dff80 05ff 053f 5a11 846d 0508 002f 32ff 035f
32dff90 3f02 ff05 3fa7 1111 0028 0329 1318 ff7d
32dffa0 928c bd8c bdb6 11ff 1004 b6b5 10b5 ad00
32dffb0 adb2 b6ad a5ad a5b2 0010 b294 949c 8cb2
32dffc0 840f 84ae 0028 1480 0178 149f 17ff 1a3f
32dffd0 2f1d ff00 3f65 9505 0040 0017 11ff 181f
32dffe0 87f1 1f7c ff96 7d31 0e69 0013 005f 7f06
32dfff0 ff1f 1752 6500 053f 95ff 116f 5214 846d
32e0000

---

probably the corruption is a block of NULs.
you should look for an error message stating an invalid magic number found.
can you attach the entire output of "perl rdmsflsh.pl -v romimg.nb"
willem

---

itsme said:
probably the corruption is a block of NULs.
you should look for an error message stating an invalid magic number found.
can you attach the entire output of "perl rdmsflsh.pl -v romimg.nb"
willem
Click to expand...
Click to collapse
Here it is! sorry for the delay
I don't see the "invalid magic number", only this:
$ cat RDMoutput.txt |egrep -i "(invalid|magic)" |head -n 3
00000200-00000204 l=00000004 dirblock magic
0002c200-0002c204 l=00000004 dirblock magic
0002f800-0002f804 l=00000004 dirblock magic

---

Another Dump!
All,
Followed the instructions, no problems.
Well one small one - i don't get any errors dumping the ROM! all three files dump with straight commands - no funny 0x800 fix required. I'm wondering if i've done something wrong - any comments?
Andrew.