Related
Hi,
I got:
O2 Xda1 -
ROM: 3.17.03 ENG
ROM DATE: 05/15/03
Radio Version: 4.21.00
Protocol: 32S54
on PPC2002 operating system
i got several questions:
a) how to change system to wm2003 ?
b) it is good or bad to change it?
c) does ppc2002 programs run on wm2003?
d) i Cooked rom on yorch page, but at log i see errors:
--- log ---
./mkrom.sh: ../../kitchen.local/mkrom-inc.sh: No such file or directorywrite xip block starting at 81740000, with 2 fileswrite xip block starting at 81b00000, with 128 filesthis rom seems to be 4.00.05 ENG 2003-06-05 ppc2003this bootloader seems to be V5.22 2003-05-15 17:46:55no operator rom found80000000 - 80040000 -- bootloader 0 files 1 modules80040000 - 8015d5d0 9 XIPKERNEL 5 files 5 modules80180000 - 80375bc0 8 KERNEL 10 files 14 modules80380000 - 8064306c 7 OS 20 files 36 modules80670000 - 80be66a8 6 SHELL 107 files 88 modules80c00000 - 8102ce98 5 BROWSING 11 files 36 modules81050000 - 813ef114 4 COREAPPS 95 files 44 modules81400000 - 815d2238 3 EXAPPS 34 files 7 modules815f0000 - 8171bc7c 2 PHONE 56 files 19 modules81740000 - 8177ffd0 10 XDA_DEVELOPERS1 2 files 0 modules81780000 - 81781c34 -- xip chain 11 xip entries817c0000 - 81ae1750 1 MISC 108 files 42 modules81b00000 - 81e5f4e4 11 XDA_DEVELOPERS2 128 files 0 modules81ec0000 - 81ee5800 -- bitmap : 3d541d54 .. 89636863./mkrom.sh: line 132: 17137 Killed perl splitrom.pl $rom_name $romopts -wo $out_name -t $out_type -n PW10A1-ENG-3.16-007Error creating new rom
--- END ---
does this rom made success or no?
and finnaly how to step by step upgrade system using activesync and USB dock station for XDA1 O2....
I hope someone will help ...
Regards
Adam
a) you knew by now ... yorch.net
b) depends on your needs. 2003 is good with GPRS and SMS handling, but miss the Wmodem s/w for example. In general, 2002 is much more stable (no major problems encountered since I went for 4.01.00 tho)
c) most of them do, but heard few stories about some incompatibility
d) I didn't use the kitchen for awhile now, but some people got this error but with a second try it should work fine.
Note: 4.00.05 is a good choice if your XDA is not TMO device
how?
I kitchen NK.nb1 file using yorch and...
I got XDAtools from Xda-developers (full package with programme A)
only thing i dont have is SD card reader and COM cable.
I want to upgrade OS using USB station ... its possible? secure? no problems will be?
should i point into nk.nb1 file and transfer it to device rom directly?
or move nk.nb1 file to sd card (using normal active sync explorer but what to do next?)
Regards
Adam
PS> i dont want to upgrade radio stack , it works fine , the nk.nb1 file doesynt touch it?
Why don't you try the EXE method first ? ... it's much simpler. However, using .nb1 with XDAtools will be almost the same process.
Yes, .nb1 files doesn't touch the RSU
hum
i cooked exe file wchich is 150kb , and the nk.nb1 file is 32mb , so its wery weird ...
the PROGRAMME A readme saying :
Known issues:
Do not upgrade through USB hub, it will cause communication error.
thats why im askin for other possibilities
HELP!
Adam
Yes there is something wrong. The EXE file should not be less than 15 MB.
You better try once more later. Sometimes there might be system problems on the kitchen server.
how about?
How about this problem that only thing i have is USB dock station...
May be something wrong when i want to upgrade os using it?
Other ways maybe?
Regards
PS> please fast ansfer ... i need to do it in 1h :/
adam
Using .nb1 file with XDAtools is the same as using the EXE method (if you open the EXE with Winzip you should see the .nb1 file inside!).
Without having SD reader/writer on your PC, you are stuck with either the EXE method or to use XDAtools.
1- Go back to the kitchen and cook an .exe rom (RUU). The size must be at least 15MB. When downloading the upgrades, make sure that the download was complete (watch the size)
2- After totally charging battery, back up personal data and applications, remove the SIM card, make a standard hard reset, then put the XDA in the cradle. Cancel the synchronization at this point.
3- Install the RUU (you cooked). Do not touch the device all through the installation process.
4- In the end, remove it from the cradle, make a hard reset (twice, separated by 1 minute)
5- Better complete startup settings (mainly owner information and device id name in Settings/About) before putting in the cradle
6- Put it again in the cradle, synchronize.
OPTIONAL: If needed (and available !), install the RSU upgrade. Do not touch the device all through the installation process. In the end, remove it from the cradle, make a soft reset: the installation process continues. Do not do anything but wait till the end.
Put SIM back. Sof reset.
If you have XDATools you can copy a .nb1 or .nbf file to the SD card with the XDA in the cradle. Then you'd use the Wallaby bootloader to install the upgrade from the SD card. I've read too many tales of woe from a failed .EXE upgrade to ever try that route with a cooked ROM.
Another advantage of XDATools is that writing to the SD card is sigfnificantly faster than using the SD Card reader method with XDArit.
If you use XDATools in this way you don't need an SD card reader, nor do you need to play with Programme A.
Just my 2 cents...
OK!
Everything worked fine when i upgraded to 4.00.05 ENG using kitchen .exe
BOOYAH!
is there 4.01.00 ENG (no t-mobile) avail?
Regards
Adam
no... as far as I know... CMIIW
Hi ,
Just downloaded the ER2003 EDIT utility to modify the Extended ROM in my XDA2.
Previously I also downloaded some ROM files available from this web site. Like the RUU15283wwe_cdl.exe
What I am missing now is how to create my own Extended ROM.
The question is the ER2003 Edit asks for an NBF file.
What I have is only EXE file that when I install, automatically decompress and they try to install directly on the pocketPC.
Am I missing something?
Is it possible to have the Extended ROM .NBF file of the Imate version?
Thanks and regards,
Claudio.
Claudio,
Just extract the ROM image (the exe file) with Winzip to a new folder.
Then you can open the ms_.nbf file with er2003edit.
Grtz,
Jos
Thanks for your prompt reply.
I unzipped the file and it comes out an EXE file. When I double click on the EXE file it does not decompress into files, but it starts an InstallShield Wizard, and it begin an installation process.
Can I modify this?
Claudio,
Just unzip this file again with Winzip in a new folder.
You should get 6 files:
- HimaClearJumpCode.exe
- HimaGetDeviceData.exe
- HimaUpgradeUt.exe
- ms_.nbf
- NK.nbf
- Radio_.nbf
The extended ROM is contained in the ms_.nbf file.
When you change the ROM, you should also modify the config.txt file in the ROM.
The ROM upgrade of the XDA can be started with HimaUpgradeUt.exe.
Grtz,
Jos
Hi,
alternatively: When the Installshield setup starts, browser to your temp folder and you will find the extracted files in a sub-folder. Just copy the files to another folder and close the Installshield wizard (which will delete the original extracted files)
Password
It asks me for a password so i can open the rom file..... Can someone help?
I'have got the same problem asking me for a password
HELP ANYONE??????????????????????
me too , all passwords not working. Ive got the lastest release ..
someone asked me to specify the type from the Open Dialogue option
i mean choose :
1- File -> Open Rom Image
2- from the opened box change the drop down option from :
[ WM2003 Auto-Detect ROM *.nbf ] ---> to [WM2003 Extended Rom (ms_.nbf) ]
and it should solve the problem ..
I've tried it but it gave me same password error ...
any help
Hi!
I used tool and instruction at Mr Buzz's website http://buzzdev.net/index.php?option=com_content&task=view&id=65&Itemid=1 to change Nk.nbf(WM 2005 rom for Uni) to Fat 16 Nk.nba.
This tool did well, but when I used dumprom.exe:
>dumprom.exe nk.nba -5 -d .
- to extract this nba file, It extracted only about 39 files such as:
device.exe
default.hv
imgfs.dll
mspart.dll
OEMExtDLL.dll
......
Great that these files were not corrupted, but I want all the files in rom , and it extracted only 39 files, pure!!!!
Can any one help ?
hi.
How can extract files from a mpx200 rom? I tried to use tools from the forum but with no success. Mpx200's rom is a file with .img extension. As i see so far in forum, rom's file extension for pda is .nbf. Is there any way to convert .img file into .nbf so i can use er2003edit program? Any other idea-guide that could help to extract the rom from my mpx200(wm 2003) would be very welcome. I couldn't find any resources on the web about extracting mpx200 rom and that's why i posted in this forum. I hope that i'm not totally off topic.
Thank you.
Nikos
I had a play with this a while back, to try to get MPX300 compatibility with VJCandela.
I believe the rom files have have a "B000FF header" (open it with a hex editor). Apparently splitrom can reassemble them into a rom we can play with, but it became more urgent to finish VJCandela then continue with this, so I put it aside. If you get anywhere on this, please PM or post so that I can see if I can make VJCandela cross compatible.
Many thanks!
V
I can upload a dumped mpx200 WM5 ROM to xda-developers FTP if needed.
These IMG files are somehow non-standard B000FF, I was unable to use splitrom to convert them to normal file.
You should dump ROM from a device, then remove a hole in the middle (probably MPx200 has 2 ROM chips at different addresses), then edit it manually because some idiot incorrectly edited that ROM to remove DevAuth.exe and broken its internal structure. After that you'll get a complete dump with broken ril.dll and gx.dll.
I wonder how that incorrectly patched ROM can even boot.
That would be interesting Mamaich. I'd appreciate it if you can.
Can we dump a live rom normally then? I'll try to speak to a guy with an MPX300 to get it dumped if possible, and try to upload it if he's successful.
V
hi.
I found so far that it's possible to convert the .img file, which is
used to update mpx200, into a .bin file. I opened the .bin file with a
hex editor and it starts with B000FF as you said. I don't know where i
can use this information or what it means. As you said it's the
header. When i try to dump rom with dumprom.exe i get an error message saying "unable to determine loading offset for out.bin". Looks like i have to find this offset myself and give it to dumprom. Could you help
me somehow on this?
Also where i can read a few things about the rom structure, xip and
stuff to understand what's going on.
Thanks!
EDIT1
Also tried with splitrom.pl.
With command splitrom.pl out.bin it gives me the following
B000FF entrypoint: 00000000
!!! your rom is not known to me: md5:
68847f4d859a242753798d9d0e205144
!!! your bootloader is not known to me: md5:
ea25e7468c09bf09a384a94cb4dcc67c
no operator rom found
no bitmap found
xip regions not found: 82d80000=LANG, 82040000=SMARTFON,
82d00000=OPERATOR, 82f2
0000=OE
And a lazy question. If i finally do it, i will get a folder in my
disk with all windows components unlocked and ready for modification?
EDIT2
Reading a few things about splitrom it says that it can handle bin
files with B000FF header. In our case(mpx200) we have a bin with
B000FF header. Right? So we can use splitrom to make the nk.nbf file.
An example on how to use splitrom.pl is the following.
perl splitrom.pl cfg/rom.nb1 \
-rm tmp/xda1.bin:0x81740000 \
-rm tmp/xda2.bin:0x81b00000 \
-rx tmp/xipchain \
-rb cfg/bootimage.bmp -ob 0x81ec0000 \
-rl cfg/bootloader.nb0 \
-wo nk.nbf -t nbf -n PW10A1-ENG-4.01-007
On the above, he opens rom.nb1 which is his rom file. Probably the
plain rom image format, i don't know the type. Then he refers to
another 2 files xda1.bin and xda2.bin. In my case i have only one
file, out.bin . He also uses bootloader.nb0, i don't have it or
something similar. Finally he writes nk.nbf file and gives it a
header. In my case i will give a B000FF header.
End.
nicktgr15, for extract files from 2002 and 2003 firmware you can use tools from http://onk.nm.ru/mpx200
Great site my friend onk. Great site. I hope i'll find something. Thank you.
Hi nicktgr15!
Any luck with the ROM extraction for MPx200?
Anyone here on this board can comment too.
I went to the link http://onk.nm.ru/mpx200 but can't really get thinks going with the WM2003 for MPx200.
I've the ROM but using dumprom.exe, I got something like 'can't determine the memory offset'.
So...where so I start?
I really need the SIMManager & Resource Manager for my WM5 MPx200.
Also, would like to have the SIM Tool Kit working on my phone since there's no way to interact with the SIM features.
Thanks anyone!
Please Upload the Dumped WM5 MPx200 Rom you are saying about!It will be a huge step!!!We can edit it,fix some bug,even make it work without the need of the SD Card...!!!
I've uploaded ROM dump to uploads/mpx200_dump directory on xda-developers FTP.
Buildimgfs tool is useless on this ROM, because 2 files in it are broken. Maybe addfile/delfile would work (but they would break data in imgfs_removed_data.bin). And of cause you have to manually remove hole inside ROM before working, and inject the removed data back before flashing. And figure out the format of imgfs_removed_data.bin and recreate it yourself.
For dump WM5 files you can use tool http://buzzdev.net/index.php?option=com_remository&Itemid=100&func=fileinfo&id=83
You must create directory "\Storage Card\" on SD and run this program on smartphone
I think this program work on many other devices with wm5
PS. you can read http://www.wce.by/forum/viewtopic.php?t=1517 (Russian language) about tools for firmware
Onk nice site but i can understand a thing!!!
Have you made a fixed version of wm5 for Mpx200?If yes where i can download it?
My goal is to make a cut down wm5 version that can fit on the 32MB ROM of MPx200...can that be possible?
I'm downloadl WM 2005 for MPX200 smartphone Build 14343 from sendmefile , but link id dead ;(
after extract files from archive, I convert part2.bin and part3.bin to CMCS IMGAGE (use BINtoIMG) and flash images to mpx200 (use Motorola Upgrade Wizard 1.8.x)
wm5 for mpx200 used SD card like /Storage on wm2003 and wm2002 (for save config, datafiloes, program etc)
Internal flash used only for firmware
for replace some files from firmware you can place it to /Windows on SD card
BUT! This build of WM5 work on 80-90% of mpx200 devices ;(
some devices can't run wm5.
And the speed of operation WM5 strongly depends of speed used SDcard (x80..x132 recomended)
Your file mpx200_wm5_bin_B00FF.7z (17460816 Bytes) is now online.
Your Download-Link: http://rapidshare.de/files/14495499/mpx200_wm5_bin_B00FF.7z.html
for extract files you must use 7zip archiver www.7zip.org
what?is this a fixed wm5 version?
does it works without the need of the SD?
NO
this version NEED SD
is there ANY chance to remove some files (Images,Sounds,maybe some prorams) from the WM5 ROM and make it work without the need of the SD?
I believe then,the OS would be STABLE and work Faster.
Let's make a Try!!!
What do you think?
part1.bin сontains magneto with use built-in flash memories (WM5 build 14122)
It is necessary to correct a little. Find in an firmware
Code:
0BFC440: 65 6D 72 65 67 69 73 74 │ 72 79 2E 64 6C 6C 00 44 emregistry.dll D
0BFC450: 65 76 41 75 74 68 2E 65 │ 78 65 00 62 74 68 61 74 evAuth.exe bthat
and change DevAuth.exe to AuthDev.exe for disable Device ID check
But this firmware contains one more "protection" - works before some date.
If before flashing set date 2004 - works normally. If the current date - show a modal system window with the message that is the version for developers.
How to disable this "protection" - it is not known yet
And it is not known about locking the register in this firmware
PS: In Firmaware structure ROM similar 2002/2003 is used. Use dumprom for extract files
PPS: my page is updated. Added simple manual about firmware and tools
mamaich said:
I've uploaded ROM dump to uploads/mpx200_dump directory on xda-developers FTP.
Click to expand...
Click to collapse
Can you please upload this dump somewhere once again? as it seems /mpx200_dump is already deleted from FTP.
While cooking my german GPS rom I noticed that there is very little information about the ExtROM nb format. Right now we can't extract it, we can't rebuild it, we can't resize the partition.
So I figured it was time to put some research into the matter. I made a package that contains the following:
- 04_ExtROM.nb (from RUU_Trinity_HTC_GER_1.23.407.2_103_6275_1.38.00.11_108)
- extrom_dump.raw (a dump of the extrom area after flashing it)
- Content (content of the extrom, copied from device after unhiding)
The idea is to analyse how files are written from NB to flash and how they are stored inside the NB. The format should be identical with Hermes and maybe other devices.
The goals of this research are:
1) understanding the Extrom NB format
2) making an extraction tool for getting files out of extrom.nb files
3) making a rebuild tool that allows us to make custom extrom.nb files
4) Resizing the Extrom partition
Please post your findings in this thread, you can also contact me on IRC (#xda-devs on irc.freenode.net
Here's the file:
http://rapidshare.com/files/24740192/ExtromResearch.rar.html
Here's what I found out so far (only worked on it for a few minutes):
R1:
The Extrom nb seems to hold 7 versions of each file, probably for 7 different languages. Search for PP_AKv33-DefaultPage_ and you'll find:
PP_AKv33-DefaultPage_FIN-040b.CAB
PP_AKv33-DefaultPage_WWE-0409.CAB
PP_AKv33-DefaultPage_WWE-0409.CAB
PP_AKv33-DefaultPage_RUS-0419.CAB
PP_AKv33-DefaultPage_FRA-040c.CAB
PP_AKv33-DefaultPage_GER-0407.CAB
PP_AKv33-DefaultPage_FIN-040b.CAB
Those occur in the 7 different config.txt files. Maybe those cabs are not all really in the NB, at the very least they must be very similar. Otherwise it wouldn't be so easy to compress. I found 7 occurences of several cab files in the NB by searching for the first few bytes of them.
R2:
The raw dump does not contain the config.txt files (at least I couldn't find them). Maybe config.txt gets stored elsewhere. I also didn't find the cabs in the dump so far, maybe a different format or a bad dump.
I had used
pdocread.exe -w -d EXT_FLA -p Part00 0 0xa00000 extrom.raw
R3: Only one of the 7 files in NB actually is actually in the ExtROM content.
My conclusion from R1 and R3:
The extrom.nb holds information for different languages or OS versions. Depending on some information only one of those actually gets flashed.
I'm finding it strange that the extracted ext_rom and the dumped ext_rom haven't the same structure.
I own a wizard (Qtek9100) and using Typho5 to extract it from the RUU and using podcread to dump it from the phone i always get a FAT16 image file. I can then use a program like Winimage to browse and edit it as i like.
Are you sure the extracted ext_rom is correct?
I believe I did everything correctly, yes.
Trinity and Hermes are different from Wizard but my dump also seems to be FAT16. If you have experience with it could you please see if the Wizard tools work on my dump?
R4: The filesystem used for ExtROM seems to be TFAT16 (Transaction-Safe FAT).
The NB files contains 90 TFAT16 occurences. I'll see if there are tools for viewing/editing TFAT16.
ZakMcRofl said:
I believe I did everything correctly, yes.
Click to expand...
Click to collapse
If you remove the first 0x1040 bytes from the nb file you get something looking like a FAT16 image, but still not working correctly. I wonder if the nbh decoder by itsme as a bug that produces a corrupted extension_rom?
ZakMcRofl said:
Trinity and Hermes are different from Wizard but my dump also seems to be FAT16. If you have experience with it could you please see if the Wizard tools work on my dump?
Click to expand...
Click to collapse
I did I downloaded your dump and used Winimage to check the raw file and it showed an empty confused FAT16 image
ZakMcRofl said:
R4: The filesystem used for ExtROM seems to be TFAT16 (Transaction-Safe FAT).
The NB files contains 90 TFAT16 occurences. I'll see if there are tools for viewing/editing TFAT16.
Click to expand...
Click to collapse
Winimage allows it. There's a tutorial by Faria on how to cook ext_roms and flash it back to wizards and winimage is advised
cheers
This post says otherwise (regarding TFAT16, not FAT16)
The simpliest method.
1. Take MS_.NBA (a decrypted version of MS_.NBF). Open it in any hex editor, and search for bytes "EB FE 90 4D 53 57 49 4E 34 2E 31 00" ("ыРMSWIN4.1", there would be "FAT16" string a bit lower). The string should be found near offset 0x70000. Extract everything starting from the place you've found and up to the end of file to a file named "extrom.img"
2. Open "extrom.img" in WinImage, edit it as you like, save the file
3. Open the hex aditor and place modified "extrom.img" to the same place in MS.NBA file where it was before extraction.
that's all. Convert NBF to NBA and flash your ROM.
The same method cannot be used on Universal. It has TFAT16 instead of FAT16, WinImage knows nothing about TFAT and destroys FAT table. But there is a simple workaround.
Click to expand...
Click to collapse
Source: http://forum.xda-developers.com/showpost.php?p=847312&postcount=10
Well, winimage works perfectly with wizard nb files (decrypted nbf files)
Yes, apparently Wizard uses FAT16 whereas Universal (and Trinity Extrom) use TFAT16. The former can be opened, the latter not.
I'm currently compiling a file list for further analysis.
ZakMcRofl said:
Yes, apparently Wizard uses FAT16 whereas Universal (and Trinity Extrom) use TFAT16. The former can be opened, the latter not.
I'm currently compiling a file list for further analysis.
Click to expand...
Click to collapse
Maybe that's why Wizard's extended roms get corrupted when users try to delete files in it. Perhaps WM5 or WM6 use TFAT16 upon rebooting and it
screws up the reading
Filelist
I took the content files and searched for their occurrences in extrom.nb.
Here is the filelist with hex positions:
Code:
0x0000A280 BT_Table.CAB
0x0001F3B0 Config.txt (FIN)
0x00020A08 HTC_WM5DST_signed.cab
0x000485D0 MP_CVSDcpl_20060920.cab
0x000685B0 PP_AKv30-DefaultPage_ALL.CAB
0x0007DCF8 PP_AKv33-DefaultPage_???.CAB
0x00093850 PP_ExtVersion.xml
0x000956C8 PP_FixITS2654_SMD.CAB
0x000A2800 BT_Table.CAB
0x000B7930 Config.txt (WWE)
0x000B8F88 HTC_WM5DST_signed.cab
0x000E0B50 MP_CVSDcpl_20060920.cab
0x00100B30 PP_AKv30-DefaultPage_ALL.CAB
0x0012B7B8 PP_ExtVersion.xml
0x0012D630 PP_FixITS2654_SMD.CAB
0x0013A768 BT_Table.CAB
0x0014F898 Config.txt (WWE)
0x00150EF0 HTC_WM5DST_signed.cab
0x00178AB8 MP_CVSDcpl_20060920.cab
0x00198A98 PP_AKv30-DefaultPage_ALL.CAB
0x001C3720 PP_ExtVersion.xml
0x001C5598 PP_FixITS2654_SMD.CAB
0x001D26D0 BT_Table.CAB
0x001E7800 Config.txt (RUS)
0x001E8E58 HTC_WM5DST_signed.cab
0x00210A20 MP_CVSDcpl_20060920.cab
0x00230A00 PP_AKv30-DefaultPage_ALL.CAB
0x00246148 PP_AKv33-DefaultPage_???.CAB
0x0025BCA0 PP_ExtVersion.xml
0x0025DB18 PP_FixITS2654_SMD.CAB
0x0026AC50 BT_Table.CAB
0x0027FD80 Config.txt (FRA)
0x002813D8 HTC_WM5DST_signed.cab
0x002A8FA0 MP_CVSDcpl_20060920.cab
0x002C8F80 PP_AKv30-DefaultPage_ALL.CAB
0x002DE6C8 PP_AKv33-DefaultPage_???.CAB
0x002F4220 PP_ExtVersion.xml
0x002F6098 PP_FixITS2654_SMD.CAB
0x003031D0 BT_Table.CAB
0x00318300 Config.txt (GER)
0x00319958 HTC_WM5DST_signed.cab
0x00341520 MP_CVSDcpl_20060920.cab
0x00361500 PP_AKv30-DefaultPage_ALL.CAB
0x00376C48 PP_AKv33-DefaultPage_GER-0407.CAB
0x0038C7A0 PP_ExtVersion.xml
0x0038E618 PP_FixITS2654_SMD.CAB
0x0050DE80 MP_CVSDcpl_20060920.cab
0x00527EE8 Config.txt (FIN)
0x005282F8 HTC_WM5DST_signed.cab
0x005C9298 PP_AKv30-DefaultPage_ALL.CAB
0x005DE9E0 PP_AKv33-DefaultPage_???CAB
0x005F4538 PP_ExtVersion.xml
0x005F63B0 PP_FixITS2654_SMD.CAB
R5: Files are stored sequentially for each language.
I haven't found where the offsets and how the offsets are stored, maybe relative to the beginning of a language section. I haven't found the absolute offsets anywhere yet.