Questions to rom gurus, who can help? - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

Hello,
I have some questions, if someone could help me with any of these I would really appreciate it, I am quite newbie, but I learn fast... now the questions:
1. is it possible to full dump the Hermes ROM to microSD using 'd2s' in bootloader? if yes, would it be possible to use 's2d' to restore it?
2. anybody can provide more information on the Hermes ROM layout, virtual and physical memory maps, offsets, sizes, etc..? If yes, how do you find this?
3. anybody managed to run pmemdump or psdread on Hermes?
4. The existing ROM upgrades for Hermes do not have .nbf files, they use a "new(?)" format .nbh, the file RUU.dll has functions GetNBHInfo() and UpdateNBH(), anyone with windows debugging skills could help to decode this format? Inside this file you should find:
- Extended ROM
- OS
- IPL (part of bootloader)
- SPL (part of bootloader)
- Splash screen
- HTC Logo (normally uses the same image as the splash)
- GSM radio code
5. Can someone make something like xda2nbftool to work with this .nbh format?
6. I think the security password should be possible to extract from RUU.dll too, as it calls SecurityPass() function, but I don't know how.
7. Is there an up to date list of bootloader commands? I found those, but I think some info is wrong or missing:
http://wiki.xda-developers.com/index.php?pagename=HimalayaBootloaderCommands
http://www.xs4all.nl/~itsme/projects/xda/bl-ii-usage.html
8. anyone could provide photos of a disassembled device? chipset references, etc...?
9. anyone interested on linux port for Hermes??
BIG thanks

Now I can answer myself some questions... who can answer the rest??
pof said:
1. is it possible to full dump the Hermes ROM to microSD using 'd2s' in bootloader? if yes, would it be possible to use 's2d' to restore it?
Click to expand...
Click to collapse
Nope that I have found.
pof said:
6. I think the security password should be possible to extract from RUU.dll too, as it calls SecurityPass() function, but I don't know how.
Click to expand...
Click to collapse
The password is dinamically generated, changes everytime, here's how to access the bootloader with the right password:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoaderPassword
Also wrote a post in the forum about this, and made a cool pdf explaining the process:
http://forum.xda-developers.com/viewtopic.php?p=346002
BTW, the password seems to be not useful for anything
pof said:
7. Is there an up to date list of bootloader commands?
Click to expand...
Click to collapse
Yes, I've written it on the wiki, but some info is still missing:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader

Related

New version of ER2003Edit (1.2.20) available

Hi guys,
a new version of ER2003Edit is available from the wiki page:
http://wiki.xda-developers.com/wiki/ER2003Edit
New features and improvements:
- provides support for the new upgrade tool version (0.9.1.0) used by the latest T-Mobile and O2 updates
- supports editing of the header information (DeviceID, Operator and Language) in order to circumvent the country code error
- some other fixes and improvements
Best regards,
softworkz
Thnx dude! At last we got a program to modify the header. I guess this makes a lot of XDA owners very happy.
Great work!
Late...
Thanks Softworkz, great work again. It really looks like an even more powerful tool, but there seems to be a little bug (or I am doing something wrong):
After upgrading ER2003Edit to the new version, I cannot open the ms_.nbf anymore. When I try to open the file, ER2003Edit always crashes, although I left the file unbmodified.
Downgraded to the old version again and there it works, although I have to decode and encode the files by myself.
Any suggestions?
No problems opening the ms_.nbf here after doing the upgrade. Running Win XP sp1.
Try uninstalling the old one completely then install the new one...
Works great!
Late...
is it a misunderstanding between header-information and encryping ???
I think Er2003edit does not do the encryption/decryption so far.
Hey Softworkz...
this would be a great improvement as I guess all coming
extended roms will be encrypted.
Alex
Tried uninstalling and re-install but that didn't help. As far as I remember, Softworkz tool is not able to edit encrypted ms_.nbf.
But on my machine (Win XP pro 2002 SP1) the program always crashes when opening an non-encrypted ms_.nbf...
I will use the old one as a workaround, I don't need to change the header so this should be fine.
some programming tips:
It should not be very difficult to implement the xor decryption, just xor each DWORD in the file with 0x25863614 after loading it in memory, and before saving it back to the file.
also, if you verify the header checksum after loading the file, you should be able to detect that the file you are loading is actually a decrypted nbf file.
and another check to see if at offset 0x70040 there is a valid bootsector, with
the 'MSWIN4.1' and 'FAT16' strings should prevent it from crashing on invalid files.
Ouch, I just found out that the wrong version of xda2tools.dll was included with the setup. I have made available a new version (1.2.20) to fix this. (see wiki page)
Some details about ER2003Edit:
You do not need to uninstall old versions before installing newer ER2003Edit versions.
The new version (1.2.x) is able to perform XOR-De-/Encryption. When opening an extended ROM file ER2003Edit first checks if it is encrypted by looking for the presence of the dashes in the header.
If those are present in the right places ER2003Edit opens the file as usual. If the dashes are absent ER2003Edit tries to decrypt with all of the three XOR-Passwords (). If none of those passwords produces a file with a correct header a prompt is shown which lets you enter your own password.
The decrypted (or a copy of the unencrypted) ROM file is saved to the temp folder. When saving with ER2003Edit the file is encrypted again (in case the original file was encrypted) and is saved to the original location overwriting the initial file.
Itsme: The "dash-check" was used because the CRC-check in your code was always true (didn't look into it further).
The new version supports auto-detection of the ROM type in order to edit the header of the other 2 ROM files (NK and Radio_), too. The "error accessing image files" message is now suppressed for these files.
Nevertheless modifying the header of those files is useless and I didn't figure out how to access the file structure in those files (doesn't look like a FAT image).
Best regards,
softworks
Okay, that explains the problems I experienced. As soon as I am back home I will give it a try. If it works it will be a nice & powerful tool...
==> seems to work perfectly. So there are no more obstacles. Next stage will be an Upgrade to 1.66.xx... :shock:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
ER2003 crashes opening new O2 extended ROM Files
Hi softworkz,
first off all thanks for your great work!
Using the new version of er2003 i cant open the ms_.nbf file of the latest O2 upgrade (1.60.52). It crashes every time. Opening and editing my self created ext. ROM based on T-Mobile Update 1.60.07 works great.
Whats wrong with my installation? If you wish i can send u my Win XP error report.
Escargotet
Sorry for posting, was 2 stupid to read forum first!
Sorry for posting, was 2 stupid to read forum first!
Hi all
Please help to clarify as there are some inconsistances...
(or I am wrong, but will run into this problem)
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
So there is a missing link...
Alex
itsme said:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
Click to expand...
Click to collapse
The CRC check does not work in your code. XORing with a wrong password results in the following message:
WARNING: this does not look like a nbf header, possible you provided the wrong password
But this gets printed as a result of the "dash-check". If the crc-check would fail, a different message would be printed:
WARNING: checksum is not ok, possibly you provided the wrong password
But this message never gets printed because (filecrc != crcsum) never occurs (for whatever reason).
Xant said:
Hi all
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
Click to expand...
Click to collapse
No. Er2003Edit can open NK and radio ROM files and edit the header. Er2003Edit automatically re-encrypts the newer ROM files (XOR-Method).
Er2003Edit decrypts older ROM files (DES-Encrpytion), lets you edit the header and save the file but it does not re-encrypt these ones (use xda2nbftool). A message is displayed in this case to remind you to encrypt the file.
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
nargalzius said:
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
Click to expand...
Click to collapse
I knew about this. I was just stating that the header of NK and Radio is irrelevant for the upgrade tool and is not responsible for the country code error.
SPV M1000
Does it work with SPV M1000 version
loade ER2003 started it and stay on the ROM info screen :?

Unlock STORAGE on Alpine QTEK 2020i

Is very good day
I speak about QTEK 2020i Alpine and no other
I succeful unlok my STORAGE was as looked after trying to unlok Extended_ROM.
Try this step
1) Go to registry HKEY_LOCAL_MACHINE/System/StorageManager/Profiles/TRUEFFS_DOC
2) Change value in folder "Storage" by other thing example "Toto"
3) Soft Reset your 2020i
4) With Explorer now you must have a folder nammed "Toto" in my example
5) Try to copy or delete inside a file. For me it's working
6) Return in registry, return original value "Storage" in Folder value
7) Soft reset again
In final you must have your original Storage that is now unloked
Let me know if it's correct for you
I'm be happy and to find solution
[/b]
I tried exactly what you said, even that I have tried it before, but it DID NOT work.
that parameter which you changed is just responsible for the name of the folder only, so if you realy could unlock the Storage folder, then it happened with you by chance with another way. if it was just that simple then flashing PPC would solve it also, but it wont, I also tried that.
so please try again to lock and unlock it if u remember the way and tell us in more details. in yours explanations: the name of storage is changed but still I cannot delete or save into it.
on the other hand, if you change the value of MOUNT there to 0 then you will hide your Storage folder, and this is what the LoadvDisk does, it just plays with such a registry parameter, but for unlocking the DLL file is responsible for that, for those who doesn't know what is the DLL, simply I can tell that it is a collection (Library) of functions, now that DLL file has a function that is responsible of unlocking the disk by modifying the non erasable memory ROM. and that is why when you flash the PPC, still your extended rom and Storage is locked, because that data is saved on the ROM that needs a special function and password passed to that function for modifying that data there.
sorry for the long post
Right
In fact i was no certain about "other way" at the moment where i wrote.
Follow exchange about " eNiPlA", i tried modify the tools for SX66 and use it during the test but don't view effect immediatly. It was the same tools that was loocked my storage that today after modification unlock it.
Try this, but i m not certain that to change name of folder in registry is necessary
1) Go to registry HKEY_LOCAL_MACHINE/System/StorageManager/Profiles/TRUEFFS_DOC
2) Change value in folder "Storage" by other thing example "Toto"
3) Soft Reset your 2020i
4) With Explorer now you must have a folder nammed "Toto" in my example
5) USE TOOL ATTACHED HERE and Try to copy or delete inside a file. For me it's working
6) Return in registry, return original value "Storage" in Folder value
7) Soft reset again
IMPORTANT
Don't use this tools (in this state) to lock, but just for UNLOCK Storage . As EMU said, if you try to lock , in fact it lock your STORAGE.
yes, that tool worked alone, just install the tool, run it on your device and try only to unlock (ONLY UNLOCK, DONT TRY ANYTHING ELSE) and it would be ok after a soft reset!
thanks apoujade, can I ask you how did you modify the tool, which tools you used for that, if you had the whole source code can you please send it also, because if you could modify this tool, then we may reach to the Extended Rom easier from it also.
I feel we are very near to the solution....
Hi
This tools came from http://www.myehud.com/xv6600/cabs/ExtTools.exe.
I changed with binary editor string "rEiRaH" with " eNiPlA" wthitout missing 2 space before. It's seems to be made for Audiovox with Extended ROM in target. On Alpine it's work for Storage area.
Hello guys, please help me!
How can I unlock the Extended ROM on my XDA IIi? I've been used the search-function but I haven't found any thing that would heplfull fo rme!
Storage released!
My Alpine's storage was also locked and have been looking for any solution.
Today Asukal informed this thread and I tried ExtTools_modifiedAlpine.exe.
It works quite well and I could unlock my Alpine's Storage area!!
Thanks guys!!
Stop!
Storage is the place where I can install programs and them aren't deleting during a hard reset and a ExtROM is the place for the software that are using by the providers! Are I'm right? :?:
Than it wouldn't be helpfull for me!
animelover said:
Stop!
Storage is the place where I can install programs and them aren't deleting during a hard reset and a ExtROM is the place for the software that are using by the providers! Are I'm right? :?:
Than it wouldn't be helpfull for me!
Click to expand...
Click to collapse
Yes, you are right.
What I thank all friends here is that I could release the lock of Storage which was locked during the operation of finding the way to unlock ExtROM.
So if I try this manual, after that my ExtROM is writeable? That would it be cool!
Hehehehe, space, I want more space for my porgrams! ^^
to clear something out:
everyone is wondering how to unlock the Extended Rom, so as everyone, while we were trying to figure it out, our Storage Folder became also locked (not-writable) so we had another problem, it became our main problem, since the Storage folder should be writable in the normal form, so the ideas in this post are only to unlock the Storage folder and has no relation to the extended rom, so if your Storage folder is already writable, then ignore what is in this form. if you are looking for a solution for your Extended Rom, the answer is: WAIT, we are working on that, and when it is solved most probably you will find the answer in a seperate post..
Good luck to all in the unlocking process..
so Brother EMU, do you already find the way to unlock the Ext Rom of XDA? I upgrade to WM2005, then the tools I used before is mulfucntion.
I am eager to wait for your solutions, tks!
Hi
Without EMEI, i sue two site for french ROM, but other depends what you want (O2, WWE ..)
Mobinaute it's free but you must ask for download DANGAARD ROM
http://www.mobinaute.com/mobinaute/ (search for DANGA)
Brighpoint it's also free, but you must create an account to access download area
http://www.qtekfr.com/modules/news/
Other way, but not the last version is ftp from xda where you search in ALpine folder
ftp://xda:[email protected]/
what do you mean? is there a point to posting the rom download sites???
tia
Works for locked 2i Storage
THANK YOU!
This worked to unlock the Storage folder on my 2i
I didn't even realize that the problem started when I tried to use the extrom unlocking tools, I just found one day that my storage was locked and I could no longer write or delete files from it. That sucked, it took me ages to find this post and now it is fixed. Great!
Re: Storage released!
reveil said:
My Alpine's storage was also locked and have been looking for any solution.
Today Asukal informed this thread and I tried ExtTools_modifiedAlpine.exe.
It works quite well and I could unlock my Alpine's Storage area!!
Thanks guys!!
Click to expand...
Click to collapse
MY XDA2i HAVE THE SAME PROBLEM,CAN YOU SHARE A ExtTools_modifiedAlpine.exe WITH ME?THANK YOU!!!
Re: Storage released!
catcatwh said:
reveil said:
My Alpine's storage was also locked and have been looking for any solution.
Today Asukal informed this thread and I tried ExtTools_modifiedAlpine.exe.
It works quite well and I could unlock my Alpine's Storage area!!
Thanks guys!!
Click to expand...
Click to collapse
MY XDA2i HAVE THE SAME PROBLEM,CAN YOU SHARE A ExtTools_modifiedAlpine.exe WITH ME?THANK YOU!!!
Click to expand...
Click to collapse
Why don't you download from the above link?\
Here is a link again.
http://forum.xda-developers.com/download.php?id=5263&sid=1fb6fbc8c0958abc01e668c52bbb1df3
apoujade said:
I speak about QTEK 2020i Alpine and no other
Click to expand...
Click to collapse
If you are speaking about QTEK 2020i Alpine and no other, WHY ON EARTH YOU OPEN THIS TOPIC AT THE "Himalaya upgrading etc." FORUM?
Thanks
To all the Masters
You're Great
It work's with my Alpine (i-mate PDA2)
i've unlocked my Storage
Thanks

reflashing original rom

ok right now i'm running the love rom on my g4 wizard. how do i reflash my original cingular rom? i know, it sounds like a nub question but here is the problem. it will flash then hang at 80% and the progress bar will turn red. it will then pick up again and continue to 95% then turn red, fail and say error 326 invalid command. i downloaded the updater directly from htc.
any ideas guys?
Yeah it doesnt work....Your now stuck with the Wizard Love Rom or you can upgrade to another rom but you cant go back to the original Cingular Rom.
internetadam4657 said:
ok right now i'm running the love rom on my g4 wizard. how do i reflash my original cingular rom? i know, it sounds like a nub question but here is the problem. it will flash then hang at 80% and the progress bar will turn red. it will then pick up again and continue to 95% then turn red, fail and say error 326 invalid command. i downloaded the updater directly from htc.
any ideas guys?
Click to expand...
Click to collapse
internetadam4657 said:
ok right now i'm running the love rom on my g4 wizard. how do i reflash my original cingular rom? i know, it sounds like a nub question but here is the problem. it will flash then hang at 80% and the progress bar will turn red. it will then pick up again and continue to 95% then turn red, fail and say error 326 invalid command. i downloaded the updater directly from htc.
any ideas guys?
Click to expand...
Click to collapse
That ROM is for a G3 Wizard, Check your PM's
ok i reflashed with your method and i'm back to my cingular rom. thanks a lot!
(big reason to go back was it was the only rom that my school's wifi app would work with, plus the love rom in combo with orwells wm6 wasn't cool. that splash was ugly IMO)
internetadam4657 said:
ok i reflashed with your method and i'm back to my cingular rom. thanks a lot!
(big reason to go back was it was the only rom that my school's wifi app would work with, plus the love rom in combo with orwells wm6 wasn't cool. that splash was ugly IMO)
Click to expand...
Click to collapse
If you were talkin' to me...glad I could help...one question though...
did your ext Rom install on its own?
no, i still had a blank ext rom as i had to setup all my internet settings, etc again. how can i fix that one?
internetadam4657 said:
no, i still had a blank ext rom as i had to setup all my internet settings, etc again. how can i fix that one?
Click to expand...
Click to collapse
All you have to do is download and install the Ext Rom cabs manually. This may still be available on the ftp. If not PM me.
It worked for me
Thanks a lot ercave1, the ROM flashed flawlessly, however the EXT ROM didn´t came up by itself. The features I´m missing are as follows:
1.- USB switch to select activesync mode to serial or RNDIS is missing, regardless this USB sync to PC (Activesync 4.5) is alive and working well.
2.- ClearVue pdf is missing, not a big loss and I really don´t care since there´s another alternatives to read and diisplay pdf documents.
3.- GetGood and in general all connection settings! I don´t give a s**t!!
4.- MIDlet Manager, big loss... I´m going to keep trying to download Risidoro_Intent_MIDlet_ Manager_V11 whenever the ftp be up and running again. So no worries.
5.- Voice Speed Dialing Settings icon in both the Program ans Setting screens are missing, however the software is running when I press the known VSD button.
6.- Cingular carrierlogo! I don´t care I have my own logo.
And I guess that´s it !
Regardless the comments above, I´d like to learn how to "extract" the correspondent EXT ROM cab files, if you guys have and advice on it would be great.
Thanks again ercave1 for the big help
internetadam4657 said:
no, i still had a blank ext rom as i had to setup all my internet settings, etc again. how can i fix that one?
Click to expand...
Click to collapse
luiggi said:
Thanks a lot ercave1, the ROM flashed flawlessly, however the EXT ROM didn´t came up by itself. The features I´m missing are as follows:
1.- USB switch to select activesync mode to serial or RNDIS is missing, regardless this USB sync to PC (Activesync 4.5) is alive and working well.
2.- ClearVue pdf is missing, not a big loss and I really don´t care since there´s another alternatives to read and diisplay pdf documents.
3.- GetGood and in general all connection settings! I don´t give a s**t!!
4.- MIDlet Manager, big loss... I´m going to keep trying to download Risidoro_Intent_MIDlet_ Manager_V11 whenever the ftp be up and running again. So no worries.
5.- Voice Speed Dialing Settings icon in both the Program ans Setting screens are missing, however the software is running when I press the known VSD button.
6.- Cingular carrierlogo! I don´t care I have my own logo.
And I guess that´s it !
Regardless the comments above, I´d like to learn how to "extract" the correspondent EXT ROM cab files, if you guys have and advice on it would be great.
Thanks again ercave1 for the big help
Click to expand...
Click to collapse
Yes, this is because the Ext Rom was wiped out by the G3 Rom having been flashed on your G4 devices. I don't remember reading about a fix for this, but you may want to search through the forum. The only solution I'm aware of is to install the Ext Rom manually.
I'm glad you guys got the device running again.
Regards,
ercave1
luiggi said:
Regardless the comments above, I´d like to learn how to "extract" the correspondent EXT ROM cab files, if you guys have and advice on it would be great.
Click to expand...
Click to collapse
What do you mean with 'extract'?
1-From the RUU exe file?
2-From nk.nba?
3-Phone disk dump?
4-WinCE disk reading?
Reflashing ExtROM CID Locked
Who knows Russian go to http://4pda.ru/forum/index.php?showtopic=32996 & read my post
And the one who does not know it?
thanks to: Murchelago
literal from the Russian to English
it is the first step. if someone can polish it (I do not speak English good).....
_________________________________________________________________________________________
Already many know that mun built Shell Of tool, which was capable of pouring axis into Wizard G4 with [lochennym] [Sidom], but to the enormous regret it does not know how to pour with [ekstrom].
Recently it decided to be played a little with the program of nb2nbf and to verify, is it possible by nevertheless any means to renew also Extended Of rom to CID-Locked apparatuses. And which there was my happiness, when I revealed after [pereproshivki] that he renewed.
It decided by the same method to try to flood Splash Of screen and HTC Of logo - everything proved to be very simply.
In view of the small quantity of information on the forum on [devaysu] Of wizard G4, it decided to build brief instruction on its [pereproshivke].
1. We stitch through apparatus by pure piercing - Wizard_Love_2.26.10.2_WWE_Novii+CF2.
http://rapidshare.com/files/8651097/Wizard...E_Novii_CF2.rar
2. By the program of typho5 we unpack nbf the file of piercing, which we desire to pour into the beast.
First we fill up into the folder with the program of nbf, and then start with the parameter of typho5.exe - x nk.nbf. After procedure we obtain several files, in number of which is contained OS itself, Extended Of rom, and also as a rule Splash Of screen and HTC Of logo.
([ZY]. For convenience in the use of program made [batnik]. Simply you will place nbf into the folder and will neglect typho.bat)
3. Now we gather our nbf file, each at will can include any desired components in it, naturally, except axis itself.
4. We go in very [progu] of nb2nbf and we make the following tuning:
- We establish Model ID: WIZARD
Language: it is empty
OEM: it is empty
Operator of version: it is empty
CID: it is empty ([ochen]_[vazhno]); remove the numbers, which are contained inside the field
- We establish [galochku] opposite “File of # 1”, we click on the button of survey (button with three points), we find the file Of extended Of rom' and (in the folder of typho5, the exemplary name of 9b000000-Extension.nb)
- In the field “Of start Of address” we enter 9b00000
- In the field “Of image Of name” we enter Extension Of rom (not Extended Of rom, you be attentive!!!)
- In the point “Of file of # 2” we find Splash Of screen, in the field of address we enter 92000000, in the field “of image of name” we write Splash Of screen.
- In the point “Of file of # 3” we find HTC Of logo, in the field of address we write 9d000000, in the field “of image of name” we write WITH HTC Of logo.
- We press button “Translate”
- Extended ROM is ready, it is possible to stitch through.
Unnecessary for you files it is possible simply not to include, but to insert, for example, only one by [ekstrom].
5. We place the obtained file of nbf into the folder [proshivalshchikom] and start. Procedure as with the usual piercing, lasts in all the pair of minutes.
6. We pour the axis Of shell Of tool' ohm from mun' of a.
Finale - valuable piercing
Don´t know
mestrini said:
What do you mean with 'extract'?
1-From the RUU exe file?
2-From nk.nba?
3-Phone disk dump?
4-WinCE disk reading?
Click to expand...
Click to collapse
I really don´t know from where and how mestrini, that´s the reason why I quoted the word extract and included the word learn
luiggi said:
I really don´t know from where and how mestrini, that´s the reason why I quoted the word extract and included the word learn
Click to expand...
Click to collapse
I enumerated the options since each have its own reason
1- Use Winrar to open RUU.exe and use typhoonnbfdecode.pl to extract the 10MB file (0xA00000 bytes) of the extended rom from nk.nbf
2- oops, same as 1 (and its nk.nbf- not nk.nba). hehe, my mistake
3- use pdocread.exe to read BDTL1 - or TRUEFFS_DOC1 (use my Wizard Service Tool as it can be done with a few clicks )
4- Unhide extended_rom and use Active Sync to copy the files to PC (or, once again use my tool to do the same )
cheers
Sounds great to me!
mestrini said:
I enumerated the options since each have its own reason
1- Use Winrar to open RUU.exe and use typhoonnbfdecode.pl to extract the 10MB file (0xA00000 bytes) of the extended rom from nk.nbf
2- oops, same as 1 (and its nk.nbf- not nk.nba). hehe, my mistake
3- use pdocread.exe to read BDTL1 - or TRUEFFS_DOC1 (use my Wizard Service Tool as it can be done with a few clicks )
4- Unhide extended_rom and use Active Sync to copy the files to PC (or, once again use my tool to do the same )
cheers
Click to expand...
Click to collapse
Thanks a lot mestrini, I appreciate your input and I´ll give it a try right away!

What is a Hard or Soft SPL

I allreyd flashed a lot and did use a soft spl, but I do not find a proper
explanation what it is.
So, i Think it is the Bootloader ?
Can anyone tell me what a soft and a hard SPL is and does ?
For what do I need it ?
I just got my new Touch Pro bought in UK and now it is here in Germany and I want a german ROM on it as soon as it is available.
Please don´t write your standard answers like WIKI and Search - a forum is here for communication and I did not find the proper answers - only too long threats
Greetings
Marcus
69reichertm said:
....So, i Think it is the Bootloader ?...
....Can anyone tell me what a soft and a hard SPL is and does ?....
Click to expand...
Click to collapse
Yep your right on that assumption sir The bootloader does alot of the low level handling of the startup process when you power on the device aswell as handling the process when you flash anything to the device...im sure its far more technical than that but thats a starter explanation Essentially you NEED a bootloader for the device to work at all, the case with many of the HTC devices...other devices are different most likely.
Soft SPL: (normally referred to as SSPL) IS loaded into RAM and allows you to perform some of the operations the standard bootloader would do, naturally with some extra functionality (explained later)
HardSPL: Same sort of thing except it is flashed to the device permenantly, so it replaces the HTC bootloader in your devices flash memory.
Both of these tend to safeguard against corrupting the device by having some fancy workarounds and updates to the processes built into the HTC SPL, and the best part is that they allow you to flash ANY ROM you wish therefor allowing us to use Cooked ROMs and various updates like radio updates and etc...frees the device up quite superbly.
69reichertm said:
Please don´t write your standard answers like WIKI and Search - a forum is here for communication and I did not find the proper answers - only too long threads
Click to expand...
Click to collapse
Perhaps some mebers feel like adding a general HardSPL page to the wiki for FAQs like this to be answered better than "Search the forum.." since we know its not that good for finding anything.
The Wiki is there for everyone to use and edit so, learn and pass it on
Just a quick question, does any of this interfere with HTC released updated ROMs? Like, when they release a new version on their site, does having HardSPL prevent you from updating?
Hello !
Thank you for your advise.
One more question:
Should I install Hard or Soft SPL ?
I want to try out many ROMS - I think Hard is better, what do you mean ?
Thank you for your help
By the way:
I am a kind of technican - working in IT for nearly 18 years starting fron Novell, Banyan Vines and DOS up to Windows Vista. Also I am a kind of apple Guru, thats why I have certainly an iPhone 2G and 3G.
For business I use HTC devices sind the first MDA. But I lost track a little sind iPhone.
As I am a technic nerc I sstarted with th the Diamond touch again and I liked the device but i swapped this week to the touch pro because of the keyboard, SD Slot an flash light. I love this device.
By the way I also have the new Samsung Omnia 900 here and an unfun Nokia E71 ( I hate this old symbian - looks like last centuty )
So good night and thank you
Marcus
Jiggs1337 said:
Just a quick question, does any of this interfere with HTC released updated ROMs? Like, when they release a new version on their site, does having HardSPL prevent you from updating?
Click to expand...
Click to collapse
no, raphael hardspl is unsigned, means any rom is allowed, including HTC official roms.
69reichertm said:
One more question:
Should I install Hard or Soft SPL ?
Click to expand...
Click to collapse
you can only install hardspl. the job of soft spl is to install hardspl.
do not ever try any of the following:
- with SSPL, do not flash anything other than the included SPL NBH files. as extra protection the diamond and raphael SSPL's require htchacker sign (except the version jocky edited) and will reject anything that's not an SPL.
- and do not ever try to flash SSPL as an NBH, especially if it is a diamond or raphael.
Im sorry to disagree with your "don't tell me to use the Wiki".
But this is a fairly comprehensive answer to your question: http://wiki.xda-developers.com/index.php?pagename=SPL Questions? straight out the wiki.
Ta
Dave
When flashing a new ROM, do u lose all ur settings? Like installed programs, and other customizations?
Do you lose these by installing Hard-SPL?
Jiggs1337 said:
When flashing a new ROM, do u lose all ur settings? Like installed programs, and other customizations?
Do you lose these by installing Hard-SPL?
Click to expand...
Click to collapse
Yes - Everything Goes.
No.
Ta
Dave
Thanks Dave.
So what do you guys do? Just reinstall everything one by one after you've flashed the new ROM?
Jiggs1337 said:
Thanks Dave.
So what do you guys do? Just reinstall everything one by one after you've flashed the new ROM?
Click to expand...
Click to collapse
There are several things.
UC is short for User Customisation; it is in all the Kaiser ROM's nowadays. l3v5y's Raph ROMs also have it.
Links: l3v5y's ROMs & Main UC Thread.
I use UC to install programs, Provisioning XML (as part of UC) to change registry settings, my xcopyce application to copy folders and active sync to copy contacts, calender etc.
Ta
Dave
Ok, thanks. Seems very complicated. Having to write XML files and such.
when running RaphaelHardSPL-Unsigned_190_1_3.exe, it says all information will be lost on my device. Are you sure i dont lose everything when installing Hard-SPL?
Jiggs1337 said:
Ok, thanks. Seems very complicated. Having to write XML files and such.
when running RaphaelHardSPL-Unsigned_190_1_3.exe, it says all information will be lost on my device. Are you sure i dont lose everything when installing Hard-SPL?
Click to expand...
Click to collapse
I can't say. I haven't done it, what says you will lose all the info, the RUU or the thread? If it's the RUU, then you should be OK, it's probably the standard message that the proper RUU (used for carrier ROM upgrades) has.
UC is good, takes maybe an hour or two to get setup, but once done, you don't have to do it again and it makes flashing so much fun. I started with just installing CAB's and Copying files, then went onto ProvXML for my registry settings next. The latest version of Schap's Advanced Config (3.0) can export tweaks into a Prov XML file for you. It is worth it if you flash your ROM as often as I do.
Dave
I do love this kind of stuff. Any new gadget i get, i like to do this kinda stuff with it. But its a little overwhelming in this case .
So, using UC, i can set it up so that my settings, such as email accounts, wifi networks + passes, notify settings, etc, as well as all the programs are restored after a ROM flash?
To do this i have to manually go through my registry to find the entries for each of these settings though? No way to just extract my current unflashed devices settings to a file that the new ROMs then use? That would be nice
Jiggs1337 said:
I do love this kind of stuff. Any new gadget i get, i like to do this kinda stuff with it. But its a little overwhelming in this case .
So, using UC, i can set it up so that my settings, such as email accounts, wifi networks + passes, notify settings, etc, as well as all the programs are restored after a ROM flash?
To do this i have to manually go through my registry to find the entries for each of these settings though? No way to just extract my current unflashed devices settings to a file that the new ROMs then use? That would be nice
Click to expand...
Click to collapse
We are getting a little off topic of the OP now but...
Any tweaks done with schaps Advanced Config can be easiler exported using a "export" menu option.
If you export your registry after flashing, and again after you have all your settings setup right, you can Diff then using a Diff Program and copy the changes into your ProvXML file. Most PPC Regedit programs can export.
Any more on UC, I'd have a read of the UC thread and ask any questions in there. Myself and l3v5y keep and eye on it most of the time and should be able to help fairly quickly.
Ta
Dave
Hello
So my Threat became quite interesting.
One last question foe me.
What File should I download to HARD SPL my Touch Pro.
Is there a file which includes all ? I mean I do not have to modify files inside the cabinet or so ?
Is there a fast link ?
Thank you for all the help - now lets start using the Touch - weekend is near
69reichertm said:
Hello
So my Threat became quite interesting.
One last question foe me.
What File should I download to HARD SPL my Touch Pro.
Is there a file which includes all ? I mean I do not have to modify files inside the cabinet or so ?
Is there a fast link ?
Click to expand...
Click to collapse
lol, sure, there is only one package, and you simply click the EXE and it goes
http://forum.xda-developers.com/showthread.php?t=410150
Is it possible to use those backup softwares? Like Spb Backup for example that say "ROM Upgrade Mode — now it's possible to restore data after the ROM upgrade"? Instead of UC and such?
there is a IPL initial program loader (sort of bios)
a SPL secondary program loader (kinda like the ntloader)
and there is a service mode (3 color screen) (the flashprog)
then we have a RUU remote unit upgrader
mft masterfile table
mbr master boot record
and some other shizzle
the device switches the output of the internal usb when device is in 3 colorscreen to a service mode which allows it to overwrite the internal flashdrive .. pretty neat as what it actually does is switching to an internal flashprogrammer which programs the internal flashdrive. this is the same process as is used for your pc at home to update the bios.
the CID celloperator identification code (used for blocking certain rom upgrades)
enjoy..
Soft SPL quesiton
I have a SPV M700 and it's unlocked. I want to install Schaps rom. I have the folowing SPL version 1.07.000. I have't managed to install hard spl. Can I use soft spl to flash it? Can I permanently brake it?

[How To]Gold card method to unbrick HTC Monet/Lobster device?

Hi All
Do you have any ideas?
How to unlock this device?
As in the topic...
Nokser said:
Hi All
Do you have any ideas?
How to unlock this device?
As in the topic...
Click to expand...
Click to collapse
it is better you find out - http://psas.revskills.de
and learn PSAs 1.08 was released, I am confident that you can develop it to your device
and as a friend, I can only help with this
I search people.... You have a HTC Monet, please write in this topic
How "bricked" is your device - i.e. which state can you get it when switching on?
tobbbie said:
How "bricked" is your device - i.e. which state can you get it when switching on?
Click to expand...
Click to collapse
This Device run only in Bootloader mode(tri color screen etc)
Problem is.... this phone not have a Official/Ship firmware
Well then the sequence is:
Hard-Reset (L+R Softkey method)
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?)
Official firmware (see above)
Gold Card will not help for loading a cooked ROM as it still needs a signed ROM (despite ignoring the Carrier).
tobbbie said:
Well then the sequence is:
Hard-Reset (L+R Softkey method)
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?)
Official firmware (see above)
Gold Card will not help for loading a cooked ROM as it still needs a signed ROM (despite ignoring the Carrier).
Click to expand...
Click to collapse
Hard-Reset (L+R Softkey method) -> Not Working
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?) -> Not Working
Official firmware (see above) -> Not Find, and not get from Virgin Mobile/HTC
Sad situation - you will have to google around, possibly find owners where you could get at R2SD backup from (if that works for this device). I found this query not so long ago: http://forums.phone-tools.cn/showthread.php/31636-Htc-lobster-700tv-how-can-i-unlock-with-xtc-clip-%28virgin-mobile%29
Do you know if this device has the M-Systems DiscOnChip (like older Wizard and Typhoon(Hurricane/Tornado) or already newer/other encrypted storage?
You could as well try the guys at IMEI-check.UK - they are very knowledgeable and may have a system backup of the supported devices in their drawer (just in case..). Maybe they can fully CID Unlock the SPL on that device and allow the flashing of a cooked ROM (is there any)?
tobbbie said:
Sad situation - you will have to google around, possibly find owners where you could get at R2SD backup from (if that works for this device). I found this query not so long ago: http://forums.phone-tools.cn/showthread.php/31636-Htc-lobster-700tv-how-can-i-unlock-with-xtc-clip-%28virgin-mobile%29
Do you know if this device has the M-Systems DiscOnChip (like older Wizard and Typhoon(Hurricane/Tornado) or already newer/other encrypted storage?
You could as well try the guys at IMEI-check.UK - they are very knowledgeable and may have a system backup of the supported devices in their drawer (just in case..). Maybe they can fully CID Unlock the SPL on that device and allow the flashing of a cooked ROM (is there any)?
Click to expand...
Click to collapse
I understand, but not have a good solutions. i see all this pages... and nothing
My dad still has his Monet on the stock ROM.
IF you can give me simple instructions to follow to dump the ROM, I can do it when I next see him (within the next few months).
Safest method should be to have a GoldCard created and then do a R2SD backup on that card. The R2SD command should be available from the "GoldCard - SuperCID" SPL.
If that works, nothing on the device itself has to be changed and the complete ROM is dumped on the card. In turn that memory card can then be dumped to a file, zipped and shared.
I said simple I've not ever researched gold card and to be honest don't have the inclination to do so. if you could give me clear step by step instructions with links to needed files, I can help.
Well - I don't need it, its Nokser
So he surely will tell you a step-by-step action what to do, maybe even prepare a package for you. It will require downloading a program that can create the Gold Card (psas.revskills.de), have a suiting SD card, as small as 64MB, but any less than 2 GB will do it, a normal USB cable, a PC, a Terminal Program (mtty) and finally one out of a set of tools that can handle the created image.
If all is prepared well, the total time to execute all actions would be ~half an hour (the dump on the device is just a minute!), but you should calculate a little more for this one time action.
Thanks for offering your help to save one of a species from the dumpster!
grayme said:
I said simple I've not ever researched gold card and to be honest don't have the inclination to do so. if you could give me clear step by step instructions with links to needed files, I can help.
Click to expand...
Click to collapse
Hi
Please, you first dump and write in attach. bootloader section
...just to complement the GoldCard idea:
When writing back the dump to a card for loading the broken device, the bootsector of that card may require to be a "gold card" too. Since the Gold Card key is related to the device and the Serial number of the card, the key contained in the bootsector of the dump will not fit to the serial of the new card Nokser has to use.
So after the dump was written back to the card, the PSAS has to write the goldcard-key to the new card again (which is different as the serial of the card is different).
I wish you luck getting that operation done!
I want Bootloader, because in this file is writing all info from load all parts and method backup. All abouts from boot file is importand.
If we IDA execute this file, then we see -> how to get any section and name sectiors
Bootloader (IPL and SPL) are part of the "R2SD All" backup. You can patch them later. Makes no sense to only do partial R2SD backups.
tobbbie said:
Bootloader (IPL and SPL) are part of the "R2SD All" backup. You can patch them later. Makes no sense to only do partial R2SD backups.
Click to expand...
Click to collapse
I understand, but this function is not working in my phone
Also not with "goldcard" inserted? Can PSAS make a GoldCard for Lobster/Monet?
tobbbie said:
Also not with "goldcard" inserted? Can PSAS make a GoldCard for Lobster/Monet?
Click to expand...
Click to collapse
In "goldcard", i don't have any results

Categories

Resources