Database Users

WHY ME??

First of all, I'd like to say this is the most positive and progressive forum I've ever joined on the internet so far. You guys not only rock, but also inspire, for which I would like to add to the THANK YOU chorus!
I have spent days and sleepless nights browsing this forum, trying to unlock my T-mobile MDA.
The details are:
-T-Mobile (USA)
-ROM Version: 3.14.40 ENG
-ROM Date: 11/26/02
-Radio Version: 6.18
-Protocol version: 324e4
-Model No.: PW10B1
-IMEI: 35031400086966009
I'm using the USB via the cradle. The XDA unlock gives me an error reading, which is not uncommon elsewhere in this forum. I had to download the SER v 1.2.
Upon download and installation, I copied (via OSImage Tool)as per instuctions and ran programme A, only to get the "error message 007 ....No ROM image file".
At this point I'm pretty exhausted, especially when I see other posts of people who successfully unlocked theirs. I give up on foguring it out myself, so I please need help. Apparently, I'm a total rookie in this field . It would be highly appreciated if someone can be kind enough to please give me a step-by-step guide on the entire process either by replying to this post in this forum or by anyother means to contact me (e-mail, IM, etc) through my profile. I'll have a great sense of achievement and happiness gaining my freedom by eventually unlocking my device this weekend before my trip next week.
Thank You and I appologise to anyone that might be offended by the length of this post :wink:

You can run the file from your desktop, make sure you are synced with the xda, it will update the rom through the usb port. Before you do this it would be a good idea to back up your current rom using the sd bootloader method. Once the special edition rom has completed, just poke the unscrewed top half of the stylus in the hole on the bottom right of your xda, just poke once, wait one minute then poke again. You should tehn have an unlocked xda, you can then restore your original rom by inserting the sd card with your original rom, entering bootloader and pushing the action key when prompted.

Thanks for the response. OK, first, what ecxactly is the bootloader and the "bootloader method'?
Secondly, I tried running the S E ROM and keep getting the error message relating to its inability to find the ROM image.

Where did you download from, what size is the file? The bootloader method is accesssed by pushing the reset with the stylus while holding down the power button, then press the top left key on front of xda, you will see options there, you will not see these options when you restore a ron from sd, all you need do is enter bootloader, the xda will ask if you wish to program the rom, you press the centre of the 4 way jog button and away it go's.

I downloaded from:
http://cuba.calyx.nl/~jsummers/XDA/XDA-developers-SER-v12.exe
It seems to be a 15.4MB file

The file size is correct, you should be able to sync your xda, click on the special edition rom .exe file and it should install to your xda using program a, there is need to use any other tools, as\long as you have a backup of\current rom you have a way back to your original configuration.

I have just downloaded and executed that same file, the first thing that comes up is winzip self extractor, once it has unzipped itself a dos box pops up, it then jumps to program a and commences the install, make sure you are running the file direct from the directory and not from a shortcut, it definitely works.

I did that and I keep getting that bewildering error code 7. Again, I tried unzipping the file first and then run prog A. It went fine until after step #3 then error code 12 pops up: "ROM image is not compatible with my device.............. download utility nd try again...."
This thing seems simple and works for everybody else but me :evil:

at this point, you should use winzip or winrar to extract a file named nk.nbf frim the exe you downloade. then to either use the XDAtools to copy it directly to your XDA ROM, or move the file to SD card using your xda then use the SD flashing method from the bootloader.
good luck ...

Good news & Bad news ...... I was able to run the SER prog. First, I ran the adaptrom file and then programme A. Everything was proceeding fine until it was about 50% and then my system (desktop) froze/crashed. I had no choice but to restart the system. Now the XDA screen has a display with a progress bar and the message: "Upgrading........ It will take about 5 mins.........."
It seems its a curse :twisted: but since I've made some progress, I cant give up now. So I'm determined to succeed by fixing this stuff. My question is Can someone please tell me where to go from here??????? As usual, your patient and kind response is highly appreciated.

Oh, I forgot to add that in addition, now ActiveSinc cannot establish communication with my device, even after restarting it several times and trying to get connected via its program

hey ... no big problem ... relax!
you have to get SD reader/writer and connect it to your PC. move the extracted nk.nbf file to the SD card then insert it into the XDA. goto the bootloader mode (power + soft reset) it should recognize the card content ... just press the middle of the rocker key (action) and you will see hex counter increasing from 000 to 200 ,.. at the end, press hard reset and after 60 sec press hard reset again.
note: make sure your XDA is > 80% charged before start!!
good luck.

Didnt Work
Did exactly as you suggested, but ending up with the same screen "uploading..... It will take about 5 minutes..." :?

Finally made it!!! Thanks guys for all your input. Device works fine, so far, I dont seem to have lost anything! I feel FREE, excited and victorious!!!! YEAHHH!!!!!

[Universal] How to d2s (dump) the ROM

All right... GOOD NEWS story for today!!!
There is no doubt, that our gods are helping us...
Here's what happened to me yesterday.
Yesterday I was dreaming about editing the ROM of Universal/Exec but as you may know, 'd2s' command doesn't work. It just quits with "Not allow operation".
But suddenly, my china god of wisdom whispered to me:
GOD: "hey buzz, you wanna dump the thing? why do you use that old fashioned 'd2s' command to dump it?"
me: "well, that always worked... so what else should i use?"
GOD: "OK, here's a little present for you ) just try 'task 32' )) "
Code:
USB>task 32
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD:Detected one card
SD:ready for transfer OK
d.total_lba=1DC00
d.block_size=200
d.RCA=EC7E
d.drv_type=40000000
d.busWidth=1
Total card size=3B80000
So here it is !!!!
... and LET THE FUN BEGIN!!!
The above story is 100% true, i've made up maybe two words myself...
BTW, this might also work on other "password protected" devices.
THANX
buzz

Buzz, that's great, where the heck did you find that command?
But now that bal666 has that decrypt/encrypt utility of the original NBK files, what would be the benefit of dumping the ROM to the SD card?
Can you restore back to the device from the SD card?
Going by the way of the SD card to dump, extract, modify, write back, then flash may be safer than the Upgrade Utility that keeps my device stuck in Bootloader mode until I go through the whole NK/MS, then Radio upgrade.
So, what's the opposite of 'task 32?'
Thanks!

i'm dumping at the moment, but i would say, that it would be enough to insert the SD card back into the slot and reboot into bootloader mode.
Then you have to wait few seconds till "press power to flash" message appears.
But so far i didn't test it, yet...
Testing right now...
))
buzz

buzz_lightyear said:
i'm dumping at the moment, but i would say, that it would be enough to insert the SD card back into the slot and reboot into bootloader mode.
Then you have to wait few seconds till "press power to flash" message appears.
But so far i didn't test it, yet...
Testing right now...
))
buzz
Click to expand...
Click to collapse
Buzz, it is really good news. At this moment some of Universal (e.g. T-mobile) providers have not released an update yet. So if people can dump their roms on a SD, we at least have a fall back. In case of repairs the Universal will need to be updated again with a rom from the provider.

That is really a fantastic news!
If the restore test is successful, please just let all of us know.
Oh, and look forward to a complete dump backup/restore guide. :wink:

BeyondtheTech said:
But now that bal666 has that decrypt/encrypt utility of the original NBK files, what would be the benefit of dumping the ROM to the SD card?
Click to expand...
Click to collapse
From what I've seen his tool incorrectly decrypts NBF, some blocks are mixed.

hmmm.....
i think that the "task 32' commande needs a little bit more tweaking...
Till now it was just saying OK... ready.. etc., but actually did not the dump... (
Code:
USB>task 32
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD:Detected one card
SD:ready for transfer OK
d.total_lba=F1F00
d.block_size=200
d.RCA=80CA
d.drv_type=40000000
d.busWidth=1
Total card size=1E3E0000
Level = FF
USB>
Well, "Level = FF" sounds like an error to me....
hmmm....
buzz

Another very interesting command and it's output:
Code:
USB>info 2
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD:Detected one card
SD:ready for transfer OK
d.total_lba=F1F00
d.block_size=200
d.RCA=80CA
d.drv_type=40000000
d.busWidth=1
Total card size=1E3E0000
HTCSDOPOD601 «Jú½HTCE
USB>
Code:
USB>info 7
HTC Integrated Re-Flash Utility for bootloader Version : 1.40h, UNIVERSAL HW Version : 1.00
Built at: Sep 2 2005 15:14:29
Copyright (c) 1998-2005 High Tech Computer Corporation
Turbo=312, Run=208
Memory Frequency = 208 MHz
SDRAM Frequency = 104 MHz
Board ID is: 5
USB>
buzz

buzz_lightyear said:
Code:
Board ID is: 5
Click to expand...
Click to collapse
Hi Buzz,
is it possible to make memory dumps
in the bootloader without entering a password ?

cr2 said:
buzz_lightyear said:
Code:
Board ID is: 5
Click to expand...
Click to collapse
Hi Buzz,
is it possible to make memory dumps
in the bootloader without entering a password ?
Click to expand...
Click to collapse
not in bootloader...
but i'm able to dump DOC and memory using RapiEnabler and itsutils.
buzz

buzz_lightyear said:
but i'm able to dump DOC and memory using RapiEnabler and itsutils.
Click to expand...
Click to collapse
Hmm. What part of the DoC ? All 128 MB ?
There is also OTP and other stuff.
As you can guess, i'd like to dump the whole 64MB RAM (or as much as possible) while the bootloader is running, not
in wince.

Maybe you should try 'r2sd' ?

mamaich said:
BeyondtheTech said:
But now that bal666 has that decrypt/encrypt utility of the original NBK files, what would be the benefit of dumping the ROM to the SD card?
Click to expand...
Click to collapse
From what I've seen his tool incorrectly decrypts NBF, some blocks are mixed.
Click to expand...
Click to collapse
He stated that as long as you don't change the header information, it will encrypt and decrypt properly.
As a precaution, I took the NK.NBF, decrypted it to NK.FAT, then reencrypted it and did a successful byte-comparison.
I did the same with my modified NK.FAT file with my injected custom splash image and it encrypted and decrypted properly.
The biggest test was flashing it, and man, I was sweating buckets during the process. But, the flash came through successful for me and now I have the first custom splash screen on the Universal.
It's fun to break news or be the first guinea pig to try it out, just as long as it comes out successful! :lol:

The password doesn't seem do do anything.
The level of access is determined by your CID.
If your CID is 11111111 you have a SuperCID, which enables all the operations. I'm trying to track down where the CID is stored.
Bye,
Ricardo

go beyoundthetech !!!!
now only if you could post a step by step for all us goofs out here...
also im wondering with your genius if you could use the recently posted tools here to make custom universal rom (minus the ie explorer, file explorer etc) and teach us how to do that aswell!!!!

buzz_lightyear said:
i'm dumping at the moment, but i would say, that it would be enough to insert the SD card back into the slot and reboot into bootloader mode.
Then you have to wait few seconds till "press power to flash" message appears.
But so far i didn't test it, yet...
Testing right now...
))
buzz
Click to expand...
Click to collapse
My 9000 has a SuperCID. I managed to dump and flash the rom using these techniques.
Bye,
Ricardo

BeyondtheTech said:
He stated that as long as you don't change the header information, it will encrypt and decrypt properly.
As a precaution, I took the NK.NBF, decrypted it to NK.FAT, then reencrypted it and did a successful byte-comparison.
I did the same with my modified NK.FAT file with my injected custom splash image and it encrypted and decrypted properly.
Click to expand...
Click to collapse
I decrypted nk.nbf to nba with his tool, and decrypted the same file with alpinenbfdecode.pl script. Files are different after some offset. So there should be a bug in his util, because alpinenbfdecode.pl is known to produce working files. I had no time for more tests.

buzz_lightyear said:
Another very interesting command and it's output:
Click to expand...
Click to collapse
Hi buzz,
i can run "rbmc", but don't get where is this c:\test\mem.nb located.
Is it used by the mtty download protocol ?
I can't test it because mtty is not working
for me in windowz

cr2 said:
buzz_lightyear said:
Another very interesting command and it's output:
Click to expand...
Click to collapse
Hi buzz,
i can run "rbmc", but don't get where is this c:\test\mem.nb located.
Is it used by the mtty download protocol ?
I can't test it because mtty is not working
for me in windowz
Click to expand...
Click to collapse
looks like rbmc is running up to the point, where it should start saving the dump (
same as task 32
(
buzz

OK, so here is, how it should be:
Dump Bootloader:
Code:
USB>task 32
USB>d2s 70000000 80000
OS ROM + splash:
Code:
USB>d2s 70100000 3FA0000
XtendedROM:
Code:
USB>d2s 74100000 A00000
Radio ROM:
Code:
USB>d2s 60000000 a24200
If you want to have them all on single SD card, you must add "sd a" at the end of each command except the first one.
Example to dump/backup OS + XtendedROM + Radio:
Code:
USB>d2s 70100000 3FA0000
USB>d2s 74100000 A00000 sd a
USB>d2s 60000000 a24200 sd a
buzz

Writing to NAND question

Hello.
I wish to try to write down something in OneNAND flash on HTC Gene, using samsung's low-level driver. Reading has already turned out well.
Somebody has an experience in such affairs?
Two questions interest:
- To make changes only to one sector, it is necessary to erase at first all block, and then to write down all sectors back?
- How it is achieved, that during erasing/writing executing of my code is guaranteed did not interrupt by sheduler of windows?

Thanks all for the help
I managed to modify contents of OneNAND on Gene.
The program, unlock extrom on Gene is as a result created. Some other devices (Excalibur, Vox) contain Samsung's OneNAND chip too, and is possible, this method will be applicable and on them.
http://forum.xda-developers.com/showthread.php?p=1769523#post1769523

[Help]stuck with spl 3.03 boot screen

Hello
I tried to install a rom 3.14 on a htc hd 2 sfr (French operator) from the SD card! I find myself with an spl 3.3 that refuses to install another rom! sfr never gives an offcial rom! Now when I start my htc I end up with the boot loader screen!
impoissble to make a gold card because no way to get the CID from ans sd card!
i need your help plz

please i dont want to throw from the window!

Have you tried flashing the 3.14 rom through usb instead of the sd card

yes got an invalid vendor id! the probleme is that sfr is a **** operator! not even the original rom released ti the public

my hope is to get an hsp4 but nobody is working on it

Did you have hspl on the rom before flashing if so you need to remove the hspl and then flash the 3.14 rom if you look in the threads there is a how to i use the artemis rom which is 3.14 based and can be flashed with sspl

projektk said:
impoissble to make a gold card because no way to get the CID from ans sd card!
Click to expand...
Click to collapse
use a friends phone to get the cid, or a laptop, or any other winmo device. Doesnt have to be YOUR phone.

samsamuel said:
use a friends phone to get the cid, or a laptop, or any other winmo device. Doesnt have to be YOUR phone.
Click to expand...
Click to collapse
i have a laptop with an sd card readrer! do you knwo how to get the CID with it?
ps: i cant use sspl iam stuck in bootloader screen

i managed to get this infos using a c# program
C:\Users\acer\Desktop>ReadCID.exe
\\.\PhysicalDrive1 F:\
--------------------
Raw CID Bytes: 96-00-B5-3C-88-A0-38-47-32-30-44-53-4D-54-02-00
--------------------
Manufacturer ID: 2
OEM ID: TM
Product Name: SD02G
Product Revision: 3.8
Product Serial Number: a0883cb5
Manufacture Date: 6/2009
--------------------
Raw CSD Bytes: 00-80-16-80-FF-FF-FF-A9-83-5A-5B-5A-00-2E-00-00
--------------------
CSD Version 2 bit value: CSD Version 1.0
Data Read Access Time 1 (TAAC): 2ms
Data Read Access Time 2 (NSAC): 0
Max Data Transfer Rate: 50Mbit/s
Card Command Classes: 010110110101
Max Read Data Block Length: 10
Partial Blocks For Read Allowed: True
Write Block Misalignment: False
Read Block Misalignment: False
DSR Implemented: False
Device Size: 3751
Max Read Current @ VDD Min: 100mA
Max Read Current @ VDD Max: 200mA
Max Write Current @ VDD Min: 100mA
Max Write Current @ VDD Max: 200mA
Device Size Multiplier: 15
Erase Single Block Enable: True
Erase Sector Size: 128
Write Protect Group Size: 1
Write Protect Group Enable: False
Write Speed Factor: 32
Max Write Data Block Length: 2^10
Partial Blocks For Write Allowed: False
File Format Group: False
Copy Flag (OTP): False
Permanent Write Protection: False
Temporary Write Protection: False
File Format: 0
can some one please make me a gold card?

please i need your help! iam desperate

not sure if the format for the cid is correct (i remember reading it should be reversed when not using psas) so i did both.
9600B53C88A03847323044534D540200
0002544d534430324738a0883cb50096

thanks ! you make happy! havent triy it yet! but what you done is enough
send you a little something for your help

how to write the img file to sd card without the phone! ujsing a laptop sd readrer?

projektk said:
how to write the img file to sd card without the phone! ujsing a laptop sd readrer?
Click to expand...
Click to collapse
well, therein lies the problem. If you managed to get the correct CID, then you should be OK. If it turns out you have a USB type card reader it wont work.
gotta go, sick child, ill write a fuller response in an hour or so

OK, as mentioned in your PMs, you have a PCI reader, so you should be good to go.
have a look at THIS for how to write the img to sd card, but switch reference to phone in hard disk for your card in card reader. the process is the same.
Start at the line 'Get HxD Hex Editor, '

samsamuel said:
well, therein lies the problem. If you managed to get the correct CID, then you should be OK. If it turns out you have a USB type card reader it wont work.
gotta go, sick child, ill write a fuller response in an hour or so
Click to expand...
Click to collapse
hope nothing serious for the kid!
i was trying to write it using winhex but some windows 7 compatibilie issues! i will try HxD Hex Editor and post the result
thanks alot

Rom is updating right now! gold card creation succesful! i will create a post with a tutorial for other people with the same probleme !
thanks sam for your help!

a few tips to solve the probleme
http://forum.xda-developers.com/showthread.php?t=874304

use hspl2 .
flash hspl 2.08
flash a coustom rom, other that 3.14 made.
i got the same problem ... solved like this

hspl2 dont work with spl 3.03

Serious help needed on flash dump

Hello all..
i have a serious problem with a industrial knitting machine. This machine works on a Windows CE 3.00 platform that for it's own turn, is compiled on a 16MB DiskOnChip. Unfortunatly. This DiskOnChip (from MSystems) has a damaged boot (or so it seems).. and no longer boots the machine. We actually don't know if it is the boot... but sure it seems so.
So.. what is the problem.. you may say? Well.. the Italian knitting machine's manufacturer has gone bankrupt... and the machine no longer has support. We have no software for it or Operating System for it! Also.. the MSystems is no longer available... and although it has been acquired by sandisk, sandisk does not give support has well on data retrieval.
All we have is a raw flash dump that we made on the diskonchip's Samsung k9f2808u0b NAND IC. This is based on TFFS .. but although i have read almost everything that there is on the web about this (including XDA) i seem to be unable to extract the internal NAND image files. I have used, RvSkills, NAND extractor, etc... without success..
When we open the raw dump with a hex editor... the data seems to be there... but i don't seem to be able to retrieve the file structure. We really need this machine working.. and this is our only solution.. any help would be highly appreciated.
Any XDA's Diskonchip Wizard reading this post or any WinCE Master over here that can help us? We really don't know what else can we do to retrieve the data from the NAND RAW dump.