Database Users

Jeff's Exe

OK, I'll start by saying sorry for my stupidness and thankyou for listening to my plea.
I downloaded Jeff's XDA special edition .exe file and unzipped it to a Dir seeing all the files needed to upload a new ROM to my XDA.
I (in all my wisdom) decided to run the osimagetool with the --register and proceeded to right click on the nbf 30mb rom image and selected burn...thinking this was the way to do it (not even trying to run the original exe)
The "programme a" program started and started updating my xda. It started off updating and after a few seconds i heard the "BLIMP" of the activesync telling me it has disconnected, then another blimp telling me it had restarted and re-connected to active sync, but the loader on the screen quickly zipped to 100% done and told me to remove and reboot the xda. The xda however was telling me "upgrading... It will take about 5 minutes". Urk
Now im left with an XDA that sit's on this upgrading screen even after reboot of it.
OK... ive done wrong.. im silly... would any one step up and help me out here (BIG PLEASE AND TY also). Ive got an XDA serial cable sitting here next to me as well as the usb cradle (which im sure wont help now the xda cant run active sync)....
Ideas? Can i run the original rom uploader (xredit?) rather than osimagetool with the serial cable to upload either the new rom i have or the rom i backed up of my old device before doing all this (yes i did back it up to my harddrive first - phew?).
Thanks for reading, and i hope someone can point me to a place in the forum where all people like me end up, or even better send me an email pointing me in the right direction.
Thank you! (email Tony at [email protected])
Note: my original version was 3.17.03 and the "programme a" upgrade program said it was upgrading to 3.16.

can you tell me what splitrom says about the nk.nbf that is now in the 'english' subdirectory of the path
pointed to by the registry key "Software\\XDA Developers\\OsImageWriter", "Programme A Path" ( in current-user )

thanks for coming back to me.
unfortionately, i dont have perl installed on my windows xp machine so the batch file you linked to do doesnt work. If you have a link for a perl install anywhere I'll be happy to install and run it.
In the key you mentioned, here is the value: D:\XDAtools-Jeff\binaries
The directory i unzipped Jeff's version of your tools to.
Im not sure if you perl script does other things, so in the meantime, i'll go and try and find perl (im sure ive installed it on a work machine i had years ago - seem to remember adding local path variables for it)... i'll check my cd archive for it.
Thanks for the help, much appriciated
Tony.

perl can be obtained from either http://www.cygwin.com/setup.exe or http://www.activestate.com/Products/Download/Download.plex?id=ActivePerl

cheers, i'll dl then run the script....
n1 guv

C:\Documents and Settings\tkett.ADPLATES>D:\splitrom.bat
Can't locate List/Util.pm in @INC (@INC contains: C:/Perl/lib C:/Perl/site/lib .
) at D:\splitrom.bat line 86.
BEGIN failed--compilation aborted at D:\splitrom.bat line 86.
^^
Thats the error message i get when running that perl script.
Ive searched the hdd for Util.pm and its sitting in my c:\perl\lib\sgi dir
Things just arent going right for me at the mo.

this module is standard with perl 5.8, with perl 5.6 you have to install
it manually.
as a quick fix, you may also just add a 'min' function manually
Code:
sub min {
my $min;
for (@_) {
$min= $_ if (!defined $min || $_ < $min);
}
return $min;
}
and uncomment the line
Code:
#use List::Util qw(min);

C:\Documents and Settings\tkett.ADPLATES>D:\splitrom.bat
Usage: splitrom <romimage(s)> [options]
-wx xipchain where to write xipchain
-wo osrom where to write output image
-wb bitmap where to write bitmap
-wl bootloader where to write bootloader
-rl bootloader which bootloader to use for NBF
-n nbfinfotext what NBF header to use [ex: PW10A1-EN
-ri nbfinfofile or where to read NBF header info from
-wi nbfinfofile where to save NBF header info
-rx xipchain where to get xipchain from
-rb bitmap where to get bitmap from
-rm [email protected] insert new romsection.
-ob offset where to find the bootup image
-oe offset the end of the desired os image ( def
0000 )
-t NBF | B000FF | NB? | IMG type of result image (default is NB1)
^^^^ Ive put your routine in replacement of that line and am given the options above when running splitrom now. What parameter would you like me to run ?
As always.... a big thanks for the help.
Tony

Itsme, thanks for your interest in my problem. And im very glad people like you are around to help
I have however and thankfully repaired the fault.
Here, (for other newb's like me that get stuck) is how i done it:
I had already backed up my ROM using the osimagetool program to a nb1 file on my pc called "oldrom.nb1". Now because my XDA wasnt booting into Pocket PC windows, i couldnt use active sync to sent the rom image I backed up, back to the XDA...so I had to go and buy a cheap SD reader from my local Dixons store and run osimagetool again. This time writing the rom i had backed up to the SD card in the new SD reader.
Then I rebooted the XDA into the bootloader (hold down the top power button and do a soft reset) and selected to reflash the XDA using the SD card.
If you havent already backed up your rom from your xda to file, then I presume, you have to find another person with an XDA so you can download thers to your SD card (once your in the bootloader menu, press the contacts button to get the options to dump their rom to your card). OR find an NB1 file on the internet that matches your phone version.
These may be simple instructions for most of you, but i've seen a few posts that directly relate to the problem i had, and saw people crying for help, just like i did...hopefully this will help those few.
I did also have a serial cable, and im sure there is a way to upload roms you have on your pc to the XDA via that (using the xda developers old rom tool), but im afriad i didnt read into that after finding out this method. (this way may be better for the skint people who dont want to buy an SD reader, but can get hold of a serial cable for cheap)
REMEMBER FOLKS
It was silly of me to try and flash the device in the first place without reading loads and loads of entries on these forums and really finding out what is going on instead of just flashing blindly in the hope that it would work first time.... please dont follow my lead. :shock:
Thanks again for your help Itsme...and one last question... do you think that with that registry entry as it was above, that i can try again with the .exe jeff made (possibly downloading it again in case of corruption)
(yes i am a glutten for punishment)
Tony

still I'd like to know what went wrong in your case.
can you type 'splitrom nk.nbf' ( in the 'english' subdirectory )

sure:
D:\XDAtools-Jeff\binaries\English>splitrom.bat nk.nbf
this rom seems to be 3.17.03 ENG 2003-05-15 o2euro
this bootloader seems to be V5.15 2002-06-06 20:29:17
no bitmap found
80000000 - 80040000 -- bootloader 0 files 1 modules
80040000 - 8026a804 -- kernel 13 files 11 modules
802c2000 - 8057d330 9 OS 15 files 32 modules
80580000 - 8075a69c 8 SHELL 79 files 27 modules
80780000 - 80a13b04 7 BROWSING 9 files 14 modules
80a40000 - 80d8a33c 6 COREAPPS 46 files 30 modules
80dc0000 - 80ebd150 5 SYNC 12 files 22 modules
80ec0000 - 810388e0 4 24MAPPS 13 files 13 modules
81080000 - 81348248 3 24MCONSUMER 69 files 1 modules
81400000 - 81401484 -- xip chain 8 xip entries
81440000 - 817f6f14 1 MISC 209 files 40 modules
81940000 - 81d2d2b5 -- operator rom 81 files
Tony.

ahhh... haNG ON.... the one i used was in the .exe's folder.. not jeffs tools folder:
D:\XDA-developers-SER-v12\English>splitrom.bat nk.nbf
this rom seems to be 3.16.52 ENG 2003-03-10 XDASER-12
this bootloader seems to be V5.22 2003-05-15 17:46:55
no bitmap found
80000000 - 80040000 -- bootloader 0 files 1 modules
80040000 - 8026a804 -- kernel 13 files 11 modules
802c2000 - 8057d330 9 OS 15 files 32 modules
80580000 - 8075a69c 8 SHELL 79 files 27 modules
80780000 - 80a13b04 7 BROWSING 9 files 14 modules
80a40000 - 80d8a33c 6 COREAPPS 46 files 30 modules
80dc0000 - 80ebd150 5 SYNC 12 files 22 modules
80ec0000 - 810388e0 4 24MAPPS 13 files 13 modules
81080000 - 81348248 3 24MCONSUMER 69 files 1 modules
81400000 - 814019a4 -- xip chain 10 xip entries
81440000 - 817f6f14 1 MISC 209 files 40 modules
81800000 - 818e0c14 10 XDA_DEVELOPERS1 13 files 0 modules
81940000 - 8198b6e5 -- operator rom 20 files
819c0000 - 81ee9a58 11 XDA_DEVELOPERS2 202 files 0 modules
hence the 3.16 now.

Hi Ajkett,
Thanks for sharing your knowledge of how to resolve your problem with us. I have however used a new 64 mb sd card to flash my old rom (3.16) to it before trying out the Jeff rom kitchen exe and thank god things are fine for me. Now I have bought a cheap 6 in 1 card reader/writer and would like to keep the old rom in a safe place in my hard disk hence freeing my sd card so that I could use it. I have read those threads in the rom tool section many times and still can't work out how to use the osimagetool. When I clicked on it, it gives me the interactive screen but always do not read my sd card. Even with the card reader, it seems to "think" that the sd card is unformatted and ask to format the card for me. Now the question is whether the rom is inside or not? How can I use the rom tools to read the sd card and copy the rom to the hard disk? What does a rom file appear as? Is it like the nk.nb1 file created in Jeff's rom kitchen?
Cheers
Vic

ahhh your trying to read the rom from the sd card after dumping it to the sd card from the xda?
the way i got it onto my harddrive was without an sd card. Just run the osimage tool and select the xda current memory as the source and then type c:\oldrom.nb1 as the destination.... it will use activesync to read the rom straight from the device.... you dont need the sd card to back it up.
Then when i ****ed my xda up, i run the osimage tool again and wrote from source - oldrom.nb1 to the sd card reader to a formatted sd card.
When it writes it, it gets rid of all the formatting so you wont be able to see whats on it on your pc....the only thing its good for then is to use on the xda to overwrite the rom, until you format it again that is.
Its not like a file on the sd card... its like a bootdisk with the rom written in a way that the xda will understand that its a bootdisk and will boot from it to overwrite itself... like the file is in raw format... not a nb1 file or anything (looks like lots of gobbledigoop) and the pc will not read it.

Thanks Ajkett,
Thanks for your kind reply anyway.
Got it done. The osimagetool could read but I did not write the path correctly; it has to be rom.nb1 apparently for it to work. I even used the card reader and managed to write the rom again the same way to my hard disk. I hope this is the correct way of doing it and it seems that the rom.nb1 file on my harddisk is about 30.5 mb which is probably about right for the old 3.16 rom I had dumped onto it by the XDA.
What puzzles me is that if it can read as source rom.nb1 file when you say you rewrite it to the sdcard, it becomes mumbo jumbo again but it should flash ok within bootloader mode via the XDA. Is this correct?
Cheers
Vic

yep your correct... even thogh it doesnt write a nice 30mb rom.nb1 file to your sdcard, the xda still reads it to boot from.... it must need it a raw info.

use mkrom to cook 4.00.xx rom, a tutorial and bug report

Spent a lot of time on it, trying to figure out what went wrong with mkrom when cooking 4.00.xx roms. finally figured it, well, almostly. here is a short step by step tutorial for people who do not want to set up the complicated kitchen but wish to use mkrom as in the good old 3.17 time.
I assume you already know the rom flush process already, if given a NBF file. also you need a linux box with perl.
I know quite a few people struggled and have not had a clue. and I believe there is some bugs in the mkrom package that gives the trouble.
1. download the newest mkrom from http://xda-developers.com/~itsme/download/mkrom_136.zip. this is the only piece of software you would need.
2. unpack it to, say mkrom, directory. then make directories cfg
3. get hold of a copy of rom file and its corresponding paramter files. the parameter files can be obtained from the demo kitch download ftp://kitchen:[email protected]/data look inside the "00_base ROM" and the parameter files should be under cfg directory of each rom directory. bascially the parameter files tells mkrom, where to start to put added files and how large space there is. there are two blocks of space that can be used. so the file has format
wincever=4
start1=81740000
size1=00040000
start2=81b00000
size2=003c0000
startbmp=81ec0000
startop=81b00000
the first three lines are same for all 4.00.xx roms, start2 varies for different roms, startbmp is also the same for all roms. startop should be the same as start2. size2 will be startbmp-start2, remember they are all in hex. you can calculate how large space there is once you get hold of the start2 parameter.
anyway, put the parameter files under the mkrom/cfg directory, with name "params"
4. copy a rom file (.nbf), say rom.nbf, into mkrom directory and run "./setup rom.nbf". this will creates several files under cfg.
5. mkdir a directory mkrom/romfile, enter it and make another directory file , then type "../dumprom ../cfg/rom.nb1 -4 -d file"
here comes the first bug. the setup.sh tells you that dumprom can only be used in windows box. but in fact, there is a compiled dumprom for linux in the directory (you might need to set it to be executable though). however, this linux version does not put extracted files into the "file" directory as it is supposed to, instead it just write file as "file\xxx" where xxx is the actual file name extracted from rom. it is a bug but as long as we know it, not a big deal. the is someone posted a correct version of dumprom in this forum though.
6. you should be able to find three files (or with the "file\" prefix added) with name default.fdf initobj.dat initdb.ini. these are the three files that needs to be process as indicated by setup.sh. follow the instruction to create the default.reg initobj.txt initdb.ini and copy them to cfg directory.
7. make a directory mkdir/files. you are ready to create a clean rom now by running "./mkrom output.nbf", the created output.nbf should be fine.
So far so good, followed the instruction of mkrom. next would need to add our files. then comes the problem. if you add files into the mkrom/files directory, and run "./mkrom output.nbf" again, it is almost definitely that the created rom is bad. I am not 100% sure why, but here is what I believe:
the mkrom script scan files in the "files" directory and put files in there into the "files1", "files2" directory, each of them is supposed to fill the two space in rom starting from "start1" and "start2" in parameter file. the size of files under "file1" should be less than "size1", similar "files2" and 'size2". when mkrom does this, it is highly possible that the three critial files "default.fdf, initobj.dat, initdb.ini" are placed into "files2" directory instead of "files1" directory and renders the rom bad.
here is what I did
edit the mkrom.sh, delete the line that splits files in "files" into "files1, files2" directory. change the three lines that convert the three critial files so that these three files are created in "files1" directory instead of "files" directory. then put your files into "files1" and "files2". just be careful, keep the size less than specified by "size1" and "size2".
then you can run "./mkrom.sh output.nbf" as before, and the resulted rom will be good.
hope this helps. however still a couple of problems
1. the fdf2reg.pl won't recoganize the default.fdf extracted from 4.00.21 rom or 4.01.00 rom
2. if i change the content of initobj.txt, the created rom won't boot. I might have done something wrong in initobj.txt though. but I used to be able to do this for 3.17 rom
3. I did not try to modify registry, as my only purpose is to put my files into ROM to save space. all registry can be done later by installing the software and choose not to overwrite existing files in ROM. must simpler.

the unix version of dumprom does not decompress files, that is why your default.fdf etc seem corrupted.
this is because I only have the decompression code in the form of a binary library, which I have not figured out how to link to under linux.
the only use of dumprom under unix is to find the offsets in rom where filepointers to default.fdf etc should be patched.
I should maybe disable the '-f' option in dumprom for the unix version, to make things less confusing.

but it looks to me that the dumprom under linux worked for pre- 4.00.16 rom. only not for after 4.00.21 roms. so are they different?

maybe the default.fdf was not compressed in the 3.x roms?
I am quite sure it does not work for compressed files under linux - I just did not implement the compression routines.

dumprom worked with 4.00.05 4.00.11 4.00.16 roms. I cooked 4.00.11 and 4.00.16 roms, and the rom was fine. I never used windows box during the process. only when i tried 4.00.21 and 4.01.00, there was error. anyway, i don't care, since I need as much rom as possible and 4.00.11 seems to be the best choice for me.
thanks for writting mkrom, a terrific tool. I don't like the way xda-developers.com promoting kitchen but not mkrom. mkrom is much simpler to setup and run, as long as you know about linux. the kitchen is much more complicated to get it to work and most people don't actually need such flexibility I believe.

ok i installed cygiwin and was with u till step 5, then i am lost.. when i run step 6 dumprom (in DOS) gives me an ewrror here atr the first few lines from dumprom( wiht latest ATT official release)
img 00000000 : hdr=8c0a1000 base=8c078000 commandlineoffset=8c077fe0
img 00040000 : hdr=800cdde0 base=80000000 commandlineoffset=7fffffe0
img 00180000 : hdr=8024db88 base=80000000 commandlineoffset=7fffffe0
img 00380000 : hdr=8039b334 base=80000000 commandlineoffset=7fffffe0
img 00670000 : hdr=80be2c40 base=80000000 commandlineoffset=7fffffe0
img 00c00000 : hdr=80e99400 base=80000000 commandlineoffset=7fffffe0
img 01050000 : hdr=813efc74 base=80000000 commandlineoffset=7fffffe0
img 01400000 : hdr=815d2ba4 base=80000000 commandlineoffset=7fffffe0
img 015f0000 : hdr=815f0650 base=80000000 commandlineoffset=7fffffe0
img 017c0000 : hdr=81bba0a4 base=80000000 commandlineoffset=7fffffe0
ERROR: could not find pointer for ofs 8c0a1000
invalid romhdr ofs 8c0a1000
ERROR: could not find pointer for ofs 00000000
7fffffe0 - 80000000 L00000020 unknown 30315750 452d3142 412d474e 2d30332e 2d353030 62373239 2d2d2d2d 2d2d2d2d
80000000 - 80000004 L00000004 romsection id=ea0003fe
80000004 - 80000040 L0000003c NUL
80000040 - 80000048 L00000008 'ECEC' -> 8c0a1000
errorsgalore...
so help me here how do i make sure the files extracted are all good also the size (as per ) windows explorer is 33+ not sure how all has been installed in the 32mb rom

did you get default.fdf initobj.dat initdb.ini out of dumprom. dumprom also reported tons of errors but as long as you get the three files out, it is ok.

Dumprom tries to figure out for each byte in the rom what it does. If it doesn't know it says 'unknown' this is not an error, just that dumprom could not determine the use of this byte. The 'could not find 00000000' message means that it encountered a NULL pointer somewhere in rom where it did not expect it, the other one is a pointer to RAM, which dumprom does not know exists. You can safely ignore these errors.
Dumprom was initially written to assist in figuring out what I did not know about the rom, so it tries to figure out stuff that is unknown. Later I added the code to extract files to it. Maybe I should split dumprom in one research tool, to do a detail examination of the rom, and one tool to only extract files.
Most files in rom are compressed, that is why they are more than 33M when uncompressed.

ok i understande the messages...
now here is what i did
ran ssnap and got a picture of the OS and did a compare and have a list of entries i want to add to registru and a folder with bunch of subfolders that need to be added on install
not sure how step 6 goes.. to convert the files to .reg and .txt and how/where do i add my files and registry entries....
any tips...

update...
i did fdf2reg and made a .reg file added my entries in there and then ran reg2fdf to recreatre the fdf...
i hope this is right now i need to fig out how to specify where the files i want added are to be copied i mean some go into windows some in new filders that need to be created...
plz tell me how to go forward.

you don't need to re-create the fdf file again, mkrom does it for you, you only need to take care of the default.reg file under cfg
I am not sure whether you can put files under directories other than \windows only. I did not try that. I suppose all files under /files1 and /files2 go to \windows directory just they happen to locate in different memory location in ROM

Unable to access NK.nbf (version 1.72.00) from i-mate

Hi there,
I'm new here, infact, this is my first post !
I'm a mobility engineer and have been given the task of creating an SOE for our company's PDA units. we use the i-mate (as is stated in my profile).
I have no troubles adding what i need to for my extended ROM(ms_.nbf). what I need to do is gain access to the main ROM (NK.nbf) I have "WM2003 ROM Image Editor", and a password list supplied, but none of them work, I have scoured google looking for ways to access my ROM, but all hits refer to is older versions.
as stated above, my ROM version is 1.72.00. I need access to this so I can tailor the complete operating system to my requirements.
If anyone can help me with this, I'll be eternally gratefull.
Also, is there an easy way to gain access to the ROM on other devices?
As, I'm sure that once I have cracked the ROM, created my SOE, that the device itself will become obsolete, and I will have to start again on other hardware.
I did use the search function in the forum, unfortunately, I couldn't find what I needed. So appologise if something along this topic has been posted before.
Thanks in advance!!!

you may use xda2nbftool.exe to calculate password of your ROM, as far as I remember it is "-t" switch. Then you can dump the ROM contents with dumprom.exe. You cannot modify the rom by rom kitchen because it is for XDA1, but you can modify its source code. And in general you should not modify ROM. Everything you need can be done by modifying the extended rom.
Also, is there an easy way to gain access to the ROM on other devices?
Click to expand...
Click to collapse
On most devices ROM is located in the first 32 MB of physical memory. You should use VirtualCopy function to access them and dump to storage card or anywhere you like.

thanks for your reply mamaich.
when i use xda2nbftool.exe, it seems to only reveal passwords for ms_.nbf and radio_.nbf.
when i use NK.nbf as the input file, it doesn't even check it.
would you know what syntax i would use to reveal the password of NK.nbf?
I tried -t as you suggested, but it didn't seem to help. I ran the xda2nbftool.exe to bring up a list of switches, but alas, i am new to this, it didn't seem to work for me no matter what i tried.
reason i would like to get into the ROM, is so I can have a look at how the OS works, starts etc etc.
The SOE i need to make is for several of our clients, some of who are government and financial institutions and they have many requirements. I have been able to add alot to my SOE viia the extended ROm, as you just suggested, but I want to have more control over what goes onto the unit.

The password for ROM is 0x20040304:
C:\PocketPC\Tools\xda2nbftool.exe -x NK.nbf NK.nba 0x20040304
You may calculate it yourself. Just look into NK.NBF with any hex editor. Starting from offset 0x50 you'll see bytes:
0000000050: 04 03 04 20 04 03 04 20 ...
in "normal" ROM these bytes are zeroes. So the XOR password would be: 0x20040304 (just reverse the byte order).

mamaich, thank you.
I now have a NK.nba file.
get prepared for a stupid question.
How do I get to the contents on the .nba file. to the level where i can modify the operating system ?

twinair said:
How do I get to the contents on the .nba file. to the level where i can modify the operating system ?
Click to expand...
Click to collapse
There is no tool that can modify XDA2 ROM. It is possible to modify rom kitchen to support XDA2, but noone has done that.
Currently you can dump nk.nba with command:
dumprom.exe -4 -d c:\1 nk.nba
(this would dump all files to c:\1 directory)
and later you can modify nk.nba with any hex editor if you need to patch the existing program. I've successfully patched it when I was playing with BT drivers.

mamaich, you've been a great help.
I have managed to extract all the files. now I can see what I can modify.
thanks again.
Hopefully I can provide some input to these forums.
I have been doing some things to our PDA's that no one else is doing. we are totally customising our devices.
While I am at it, we could do with someone who is a serious developer who know's his ****!
I have only been a member for a couple of days, but I can already see you know what you are on about. Are you interested in some work at all?
If you are, let me know, I can tell you what we need. I think you would fit the description

twinair said:
Are you interested in some work at all?
If you are, let me know, I can tell you what we need. I think you would fit the description
Click to expand...
Click to collapse
Sounds interesting. Can you contact me by ICQ 70241285 or send more information by PM?

mamaich said:
The password for ROM is 0x20040304:
C:\PocketPC\Tools\xda2nbftool.exe -x NK.nbf NK.nba 0x20040304
You may calculate it yourself. Just look into NK.NBF with any hex editor. Starting from offset 0x50 you'll see bytes:
0000000050: 04 03 04 20 04 03 04 20 ...
in "normal" ROM these bytes are zeroes. So the XOR password would be: 0x20040304 (just reverse the byte order).
Click to expand...
Click to collapse
Sir,
I got a Question, I follow what U say to to for this Radio _.nbf , But in offset 0x50 ..seem to be something different, can U help me to try ?
THe Radio had attached ...thx

The ExtRom Research thread (Trinity/Hermes, maybe others)

While cooking my german GPS rom I noticed that there is very little information about the ExtROM nb format. Right now we can't extract it, we can't rebuild it, we can't resize the partition.
So I figured it was time to put some research into the matter. I made a package that contains the following:
- 04_ExtROM.nb (from RUU_Trinity_HTC_GER_1.23.407.2_103_6275_1.38.00.11_108)
- extrom_dump.raw (a dump of the extrom area after flashing it)
- Content (content of the extrom, copied from device after unhiding)
The idea is to analyse how files are written from NB to flash and how they are stored inside the NB. The format should be identical with Hermes and maybe other devices.
The goals of this research are:
1) understanding the Extrom NB format
2) making an extraction tool for getting files out of extrom.nb files
3) making a rebuild tool that allows us to make custom extrom.nb files
4) Resizing the Extrom partition
Please post your findings in this thread, you can also contact me on IRC (#xda-devs on irc.freenode.net
Here's the file:
http://rapidshare.com/files/24740192/ExtromResearch.rar.html

Here's what I found out so far (only worked on it for a few minutes):
R1:
The Extrom nb seems to hold 7 versions of each file, probably for 7 different languages. Search for PP_AKv33-DefaultPage_ and you'll find:
PP_AKv33-DefaultPage_FIN-040b.CAB
PP_AKv33-DefaultPage_WWE-0409.CAB
PP_AKv33-DefaultPage_WWE-0409.CAB
PP_AKv33-DefaultPage_RUS-0419.CAB
PP_AKv33-DefaultPage_FRA-040c.CAB
PP_AKv33-DefaultPage_GER-0407.CAB
PP_AKv33-DefaultPage_FIN-040b.CAB
Those occur in the 7 different config.txt files. Maybe those cabs are not all really in the NB, at the very least they must be very similar. Otherwise it wouldn't be so easy to compress. I found 7 occurences of several cab files in the NB by searching for the first few bytes of them.
R2:
The raw dump does not contain the config.txt files (at least I couldn't find them). Maybe config.txt gets stored elsewhere. I also didn't find the cabs in the dump so far, maybe a different format or a bad dump.
I had used
pdocread.exe -w -d EXT_FLA -p Part00 0 0xa00000 extrom.raw
R3: Only one of the 7 files in NB actually is actually in the ExtROM content.
My conclusion from R1 and R3:
The extrom.nb holds information for different languages or OS versions. Depending on some information only one of those actually gets flashed.

I'm finding it strange that the extracted ext_rom and the dumped ext_rom haven't the same structure.
I own a wizard (Qtek9100) and using Typho5 to extract it from the RUU and using podcread to dump it from the phone i always get a FAT16 image file. I can then use a program like Winimage to browse and edit it as i like.
Are you sure the extracted ext_rom is correct?

I believe I did everything correctly, yes.
Trinity and Hermes are different from Wizard but my dump also seems to be FAT16. If you have experience with it could you please see if the Wizard tools work on my dump?
R4: The filesystem used for ExtROM seems to be TFAT16 (Transaction-Safe FAT).
The NB files contains 90 TFAT16 occurences. I'll see if there are tools for viewing/editing TFAT16.

ZakMcRofl said:
I believe I did everything correctly, yes.
Click to expand...
Click to collapse
If you remove the first 0x1040 bytes from the nb file you get something looking like a FAT16 image, but still not working correctly. I wonder if the nbh decoder by itsme as a bug that produces a corrupted extension_rom?
ZakMcRofl said:
Trinity and Hermes are different from Wizard but my dump also seems to be FAT16. If you have experience with it could you please see if the Wizard tools work on my dump?
Click to expand...
Click to collapse
I did I downloaded your dump and used Winimage to check the raw file and it showed an empty confused FAT16 image
ZakMcRofl said:
R4: The filesystem used for ExtROM seems to be TFAT16 (Transaction-Safe FAT).
The NB files contains 90 TFAT16 occurences. I'll see if there are tools for viewing/editing TFAT16.
Click to expand...
Click to collapse
Winimage allows it. There's a tutorial by Faria on how to cook ext_roms and flash it back to wizards and winimage is advised
cheers

This post says otherwise (regarding TFAT16, not FAT16)
The simpliest method.
1. Take MS_.NBA (a decrypted version of MS_.NBF). Open it in any hex editor, and search for bytes "EB FE 90 4D 53 57 49 4E 34 2E 31 00" ("ыРMSWIN4.1", there would be "FAT16" string a bit lower). The string should be found near offset 0x70000. Extract everything starting from the place you've found and up to the end of file to a file named "extrom.img"
2. Open "extrom.img" in WinImage, edit it as you like, save the file
3. Open the hex aditor and place modified "extrom.img" to the same place in MS.NBA file where it was before extraction.
that's all. Convert NBF to NBA and flash your ROM.
The same method cannot be used on Universal. It has TFAT16 instead of FAT16, WinImage knows nothing about TFAT and destroys FAT table. But there is a simple workaround.
Click to expand...
Click to collapse
Source: http://forum.xda-developers.com/showpost.php?p=847312&postcount=10

Well, winimage works perfectly with wizard nb files (decrypted nbf files)

Yes, apparently Wizard uses FAT16 whereas Universal (and Trinity Extrom) use TFAT16. The former can be opened, the latter not.
I'm currently compiling a file list for further analysis.

ZakMcRofl said:
Yes, apparently Wizard uses FAT16 whereas Universal (and Trinity Extrom) use TFAT16. The former can be opened, the latter not.
I'm currently compiling a file list for further analysis.
Click to expand...
Click to collapse
Maybe that's why Wizard's extended roms get corrupted when users try to delete files in it. Perhaps WM5 or WM6 use TFAT16 upon rebooting and it
screws up the reading

Filelist
I took the content files and searched for their occurrences in extrom.nb.
Here is the filelist with hex positions:
Code:
0x0000A280 BT_Table.CAB
0x0001F3B0 Config.txt (FIN)
0x00020A08 HTC_WM5DST_signed.cab
0x000485D0 MP_CVSDcpl_20060920.cab
0x000685B0 PP_AKv30-DefaultPage_ALL.CAB
0x0007DCF8 PP_AKv33-DefaultPage_???.CAB
0x00093850 PP_ExtVersion.xml
0x000956C8 PP_FixITS2654_SMD.CAB
0x000A2800 BT_Table.CAB
0x000B7930 Config.txt (WWE)
0x000B8F88 HTC_WM5DST_signed.cab
0x000E0B50 MP_CVSDcpl_20060920.cab
0x00100B30 PP_AKv30-DefaultPage_ALL.CAB
0x0012B7B8 PP_ExtVersion.xml
0x0012D630 PP_FixITS2654_SMD.CAB
0x0013A768 BT_Table.CAB
0x0014F898 Config.txt (WWE)
0x00150EF0 HTC_WM5DST_signed.cab
0x00178AB8 MP_CVSDcpl_20060920.cab
0x00198A98 PP_AKv30-DefaultPage_ALL.CAB
0x001C3720 PP_ExtVersion.xml
0x001C5598 PP_FixITS2654_SMD.CAB
0x001D26D0 BT_Table.CAB
0x001E7800 Config.txt (RUS)
0x001E8E58 HTC_WM5DST_signed.cab
0x00210A20 MP_CVSDcpl_20060920.cab
0x00230A00 PP_AKv30-DefaultPage_ALL.CAB
0x00246148 PP_AKv33-DefaultPage_???.CAB
0x0025BCA0 PP_ExtVersion.xml
0x0025DB18 PP_FixITS2654_SMD.CAB
0x0026AC50 BT_Table.CAB
0x0027FD80 Config.txt (FRA)
0x002813D8 HTC_WM5DST_signed.cab
0x002A8FA0 MP_CVSDcpl_20060920.cab
0x002C8F80 PP_AKv30-DefaultPage_ALL.CAB
0x002DE6C8 PP_AKv33-DefaultPage_???.CAB
0x002F4220 PP_ExtVersion.xml
0x002F6098 PP_FixITS2654_SMD.CAB
0x003031D0 BT_Table.CAB
0x00318300 Config.txt (GER)
0x00319958 HTC_WM5DST_signed.cab
0x00341520 MP_CVSDcpl_20060920.cab
0x00361500 PP_AKv30-DefaultPage_ALL.CAB
0x00376C48 PP_AKv33-DefaultPage_GER-0407.CAB
0x0038C7A0 PP_ExtVersion.xml
0x0038E618 PP_FixITS2654_SMD.CAB
0x0050DE80 MP_CVSDcpl_20060920.cab
0x00527EE8 Config.txt (FIN)
0x005282F8 HTC_WM5DST_signed.cab
0x005C9298 PP_AKv30-DefaultPage_ALL.CAB
0x005DE9E0 PP_AKv33-DefaultPage_???CAB
0x005F4538 PP_ExtVersion.xml
0x005F63B0 PP_FixITS2654_SMD.CAB
R5: Files are stored sequentially for each language.
I haven't found where the offsets and how the offsets are stored, maybe relative to the beginning of a language section. I haven't found the absolute offsets anywhere yet.

Samsung i718 (i710, i718+) ROM Kitchen

Hello!
Thanks to ppl from this forum I've managed to assemble from various sources files required to dump, build and flash back to device WM6 English ROM. It is not a "plug & play" style kitchen yet, so I call it "ROM Kitchen essentials"
Most of files are made by other people. Mine part was converter and flasher hacking. As for now, you have to edit dumped ROM absolutely manually. There are no support for initflashes.dat automatisation. You may want to use rgucomp to make changes to default.hv and user.hv.
Thanks goes to (not in any order )
trinca
mamaich
bepe
itsme
faria
double_ofour
yhauwang
and many others...
Actual version is 0.1 and RAR archive is about 50Mb.
All required files (including WM6 Eng ROM distribution and flasher) can be downloaded from:
h**p://www.r*pidshare.com/files/47189318/Juggler_Samsung_WM6_Eng_ROM_Kitchen_0.1.rar.html
You also may want to download original WM6 English ROM from here:
h**p://r*pidshare.com/files/45439904/Juggler_WM6_i718ZMGF4_PDA_Eng.rar.html
And radio firmware (required for some i71x to work with WM6):
h**p://r*pidshare.com/files/45950071/Juggler_WM6_i718ZMGF4_Phone_Eng.rar.html
In case somebody don't know how to flash Samsungs i71x:
Make backup!
Have your your firmware at hand so in case of troubles you can flash your original firmware back!
Turn off device.
Disable all ActiveSync connectivity (usb, comm, etc).
Run flasher and click start.
Hold "down" button on device and turn it on while holding "down".
Flasher recongnize it and start to flash.
After flashing make a hard reset.
If GPRS/EDGE do not work your radio firmware is not compatible with new WM6. You have to go back to your original firmware or flash new radio!
To flash new radio firmware you should have SPECIAL FLASHING CABLE for samsung phones! It is not the one that comes with device!
Now you have options to buy such cable, build one yourself, flash your original fimware back or continue using WM6 without GPRS/EDGE - it is your choice.
So - to flash WM6 you need usual usb cable. New WM6 probably work with your radio. If not - you should flash radio!
Special flashing cable is the cable with USB-Serial adapter or plain serial cable:
h**p://www.fonefunshop.co.uk/datacables/samsung.htm
Search for UNLOCK / FLASH CABLES and you'll see
"Samsung D800 - T809 - E900 - D900 USB Cable
This cable is needed to unlock / flash the Samsung D800 - T809 - E900 - D900 etc."
Notice the difference with the usual USB cable supplied with device!

Have you read my thread on the Samsung i60x?
Hello, there,
Please refer to this thread:
http://forum.xda-developers.com/showthread.php?t=316647
It seems very familiar to the i600. I will download your image just for the sake of taking a look... The ROM with header B000FF is prepared with the Romimage tool from the MS WCE IDE and is named the Run-time image, the nb0 ROM (that works with the WM5 kitchen) is prepared by Romimage by splitting the nb0 ROM in 128 KB records, a header is added containing start address, record length and Checksum 32. Then all this chunks are added together and compressed with another tool named compbin, the "encryption" you are seeing is no other than the aftermath of this compbin tool.
If you read myu thread you will find I was able to extract the flat image using cvrtbin (also another MS tool that comes with visual studio) you may grab a copy from here:
http://www.toradex.com/colibri_downloads/Linux/linux_to_wince/?D=D
Then you will be able to use the common tools from xda-developers such as prepare_imgfs (with the switch -acer) and so on.
Making the ROM back to the B000FF format is going to be the trouble. Again, read the thread.
There is also an excellent article on Mobilepro BIN roms made by cmonex, you can get a copy of that tutorial inside his Romtool packege, get it from here:
http://hpcmonex.net/nec900/files/releases/romtoolpack.zip
Be informed the Mobilepro ROM is very different in the way the Runtime file is organized, however is the best resource I have seen so far.
Besides, there are some really good tools inside that package
Best regards and start cooking!
trinca

Thanks trinca, at least I have something to read to start with. But the first thing a can't figure out how correctly RIP rom image from EXE file and then after modifing it PUT it back to flasher. There s.b. some proprietary tools for samsung phones or pdas.

Extracting the i718 ROM image: a suggestion
JugglerLKR said:
Thanks trinca, at least I have something to read ...
Click to expand...
Click to collapse
My friend, we are all navigating uncharted waters..., this requires some research, and the courage to flash the phone with the outcome of your research.
Please read my post:
http://forum.xda-developers.com/showthread.php?p=1371344#post1371344
It will give you a hint on how I found out how to extract the O/S payloads for the i60x, pretty sure it may work for your model as well. A quick look to your executable shows the arrangement may be similar, I would say for the i718, the O/S ROM is located last as it is on the i60x, starting at address 0x01620000 now, just by looking for the end indicator (following the string B000F, 0x0A, 0x00000000 which is the ROM start address, 0x00CA5F03 which should be the offset -little endian-, actually would be 035FCA00), however be noticed the runtime image is compressed using compbin during preparation, therefore I would guess is a little more beyond. You may have to do some research here.
Start by cutting the area surrounding such an offset and use viewbin to determine the offset length and cvrtbin to find if your cut was successful.
BTW it would be nice to find a tool to just decompress B000FF Runtime ROMS. (differently of what it does cvrtbin converting and decompressing Runtime images)
One other thing you may do is to use xdautils, you may find those here:
http://wiki.xda-developers.com/index.php?pagename=XdaUtils.
This collection of utilities has pdocread allowing you to extract the contents of raw partitions in the pda. Make sure to use the handle to extract each raw partition.
Regards,
Trinca

I had no success with cvrtbin. How to decompress image after compbin? I've found pdocread and put it to phone, but it won't work :-( Are there any tools to dump ROM to flash card or something like that?

JugglerLKR said:
I had no success with cvrtbin. How to decompress image after compbin? I've found pdocread and put it to phone, but it won't work :-( Are there any tools to dump ROM to flash card or something like that?
Click to expand...
Click to collapse
To decompress the image:
Get a tool named viewbin, also part of the MS PE, run it on your file and will tell you the start address and the offset of the img files. THen use this information with cvrtbin. If viewbin reports the start address is 0, then use 1 in cvrtbin, otherwise the extraction will fail.
To use PDOCREAD, you run it from your computer, it will install itsutils.dll in your phone and you must accept this in the smartphone. Your phone must be unlocked to do that and the policies set to allow unsigned applications to be installed in your phone. TO accomplish the above you need to modify the registry on the phone. See how it is done here:
http://www.modaco.com/index.php?showtopic=244205
TO dump the ROM with PDOCREAD, see a detailed procedure here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
Be informed some phones like the i607 require the disk kernel handle, reported with pdocread -l, if you follow the procedure in the above link with no results, then add the disk handle.
Wish you good luck....

CAn Anybody help PLEASE????
I have a i718 but was bought in China and the OS is in Chinese. The blur me can only read English. Is the ROM in English? If I were to download it (still struggling now with the russian words), how can I change it? All I need is the phone to be in English. I do not need to improve anything as WM5 is good enough. I know I am a newbie and I might not be in the right thread. Can anybody please help? Any links to show "how-to-change the ROM" would be most appreciated. Thank you in advance

Your phone is also known as i710
Your phone Samsung i718 is the chinese version of the Samsung i710, all you have to do is to install the phone serial/modem drivers from the companion CD and place the phone in bootloader mode. If you get the ROM package cited above in the first post of this thread by JugglerLKR you will find complete instructions on how to download the ROM into your phone.
Good Luck!

Thank you
Thank you very much for the quick response sir! Really appreciate it. I finally managed to download the ROM and will give it a go this weekend. Wish me luck. I will be reading more to make sure I am doing the right thing as I am definitely a nOObie. First time flashing a phone .
I looked at the CD that came with my phone and the only thing I see is the ActiveSync 4.2. Worse of all, everthing seems to be in Chinese. Guess I have to do more research to see where I can get the drivers you mentioned. There are also alot of things I do not understand like bootloader, how to do a hard reset, etc. I will continue searching and reading and will post the development of my virgin "flash" as I move along.
Thank you once again.

Trinca - so I dumped my ROM from device to .raw files. What can I do with them now? viewbin shows only zeros on b000f .bin image extracted using winhex from .exe

Use Mamaich's ROM Kitchen
You can find instructions to do some cooking and tools here:
http://forum.xda-developers.com/showthread.php?t=249836
This is self-explanatory, tell me if this is enough or you need some extra info. Once finished, the trouble would be to put that back in B000FF format for flashing, as there is no tool to do that yet, and you can't just download a raw image back into the phone. The Runtime image is formed as follows:
Byte---->--1--2--3--4---5--6--7--8---9--10--11--12--<----------- 128KB------------>
Record 0> 42-30-30-30-46-46-06 <Start add> <lenght of ROM> -----------------(42-30-30-30-46-46 = B000FF in ASCII ; 06 = end of header B000FF)
Record 1>--<Address> < length > < CHKSUM32 > <----Chunk of Raw image-->
Record 2>--<Address> < length > < CHKSUM32 > <----Chunk of Raw image-->
" "
" "
V V
Last Rec>-00-00-00-00--00-00-00-00--00-00-00-00
I am doing some crazy splitting and Hex scripts to achieve that, but it is a pain in the neck. So I have decided to make a proggie to help me out with that. Please see the thread
http://forum.xda-developers.com/showthread.php?t=316647
on the 2nd post you will see what I am talking about.
Regards,
trinca

Tried viewbin on my extracted from .exe bin file - Image Start = 0x00000000, length = 0x02C1D3E0
Start address = 0x00000000
Done.
Looks like something is missing. Also cvrtbin is not working also, as it cannot accept 0x00000 as start adress

JugglerLKR said:
Tried viewbin on my extracted from .exe bin file - Image Start = 0x00000000, length = 0x02C1D3E0
Start address = 0x00000000
Done.
Looks like something is missing. Also cvrtbin is not working also, as it cannot accept 0x00000 as start adress
Click to expand...
Click to collapse
Start address = 0001ffe0

So, How to convert dumped LZX packed rom to B000F format for flashing to device?

How to convert dumped LZX packed rom to B000F format
Please refer to my thread:
http://forum.xda-developers.com/showthread.php?p=1392761#post1392761

I am unable to download your file (can you post it on rapidshare ou megaupload?). I am in the same situation as well but I appiled the english patch from asukal and Buzzlightyear and it worked .. I now have a device in english ... I am waiting for the firmware in english.. I have wm6 roms in chinese that I have not tested it ...
I also have a i710 rom but it's also a .bin file dumped from a i710 device ...
Hope this helps,
-Hau

I have uploaded several files... Can you tell me which one you have trouble with?
trinca

Oops ... My message was intended for Juggler uploading his ROM ...
Thanks,
-Hau

Thanks to trinca and bepe, mamich and many others i've managed rom kitchen essentials - look at first page.

i downloaded your flasher but why when i run i718ZMGF4_PDA_Eng, i click detect but nothing detected....
phone is on and connected via active sync