Axim X50v WM5 dump - Windows Mobile Development and Hacking General

Hi there. I've embarked on a side project to introduce IMAP folder prefix support into Mobile Outlook. I love hacking things up so I'm expecting a lot of fun with ARM disassemblies to come. 8)
Just getting underway I've captured a 128MB ROM dump with buzz's excellent grab_it tool. Browsing some of the documentation on the Wiki I found suggestions to use prepare_imgfs from WM5EditROM to isolate the IMGFS data, which seems to work but causes rdmsflsh.pl to only output a few files before failing.
Instead, I tried feeding the raw captured ROM to the same script with a good deal of success. I now have a lot of files (looks like the complete set) with realistic looking file sizes and content, but I am a little concerned by some errors (warnings?) produced along the way for various files:
no decomp !!!: 000006e6->00001000 indexblock section S000 for jscript.dll
Click to expand...
Click to collapse
Tracing the Perl error leads to a failure of the LZX_DecompressDecode() routine, despite successfully matching the LZX compression type in the header. Could this lead to corruption of the files for which this error is given?
Thanks for any help you can offer. Given the posts I've read through so far and the tools I've downloaded, this seems like an excellent development community.

Related

XDA-developers ROMkitchen: cook your own ROMs

Announcing: ROMkitchen
Special Edition ROMs are soooo yesterday.... We're proud to unveil our largest project yet: ROMkitchen. Now you too can modify your ROM to contain precisely what you need. Create your personal ROM, based on the ROM you like.
Wanna see: Have a look at our showroom kitchen to see what we mean. As you can see the showroom kitchen shows the PPC2002 based 3.17.03 ROM released by O2, as well as the 4.00.05 Microsoft WM2003 test ROM. Neither of these ROMs is really present though: you need to download the scripts, include your own ROM images, and run the scripts on your own unix machine. But once you do, you and your friends can create ROMs to your heart's content.
Why didn't we just include these files and make it all work? Because we're not licensed to distribute these ROMs, that's why.
So now what?
Play around to see if you like it.
download all the files visible when logging in using FTP to xda-developers.com username 'kitchen', password 'kitchen'.
Put them on your own unix machine, which should be capable of executing php scripts, and which should have a 'little' memory, disk and processing power left over. (We're afraid ROMkitchen wasn't built with resource-efficiency in mind.)
Add your own ROM files, see the readme files in the "data/00[...]/_/cfg" directories for details.
Notes:
If you set up your ROMkitchen, make sure you only use it for yourself, and with ROMs you legally own. We're not responsible for abuses.
If you use an ftp-client which can ignore files which are newer on your side, you can regularly check for updates and always have the newest kitchen.
ROMkitchen does not yet support outputting self-extracting binaries a-la Jeff's exe. We're working on that.
ROMkitchen currently supports English language ROMs only. We're working on this too.
The welcome exe is back in ROMs made with it: a little too much hassle to make our own. So you'll have to go through the silly tutorial every cold-boot.
XDAunlock is missing still. (It will be incorporated, but most people will be making 4.00.05 ROMs, and it doesn't work on that anyway...)
How does it work?
The ROMkitchen consists of a number of php scripts that present the form with all the options to choose from, and which copy files ready for our 'mkrom' utility to process. If you take a look you can see the raw structure of the data that is presented and inserted into the ROM. We'll find some time soon to explain, but you can already learn quite a bit if you look at the files and directories carefully.
xda-developers u are AWESOME
I'm going to try it as soon as i get home tonight. So all that is needed at first is a 2003 or 2002 image file?
thanks
alex
This looks awesome
Is it possible to run this program on Cygwin ? I have configuered the Cygwin download to include Bash and Perl but can't find a reference to dd. I confess that although I have a reasonable amount of programming experience I have never used Unix before so don't even know how to invoke the scripts so any help would be much appreciated.
Richard
just uploaded everything to my unix box and tried to run setup.sh from 4.00.05 directory. i also uploaded bootloader.nb0 and rom.nb1 files to the cfg directory. when i run ./setup.sh this is what i get:
[[email protected] _]# ./setup.sh
Usage: splitrom <romimage(s)> [options]
-wx xipchain where to write xipchain
-wo osrom where to write output image
-wb bitmap where to write bitmap
-wl bootloader where to write bootloader
-rl bootloader which bootloader to use for NBF
-n nbfinfotext what NBF header to use [ex: PW10A1-ENG-3.16-007]
-ri nbfinfofile or where to read NBF header info from
-wi nbfinfofile where to save NBF header info
-rx xipchain where to get xipchain from
-rb bitmap where to get bitmap from
-rm [email protected] insert new romsection.
-ob offset where to find the bootup image
-oe offset the end of the desired os image ( default: 0x81f00000 )
-t NBF | B000FF | NB? | IMG type of result image (default is NB1)
also when i tried to convert the default.fdf file to default.reg i get error saying "unknown fdf file signature" and it creates a 0 byte default.reg file.
any help is appreciated. i know i'm asking too many questions, but same happened with ur mkrom tools and once i got answers from u i was able to build roms without any problems.
thanks
alex
Hold on a tick, if you guys added one more feature it would go nova, however. Some features I would like to see is the ability to mix drinks, roll joints, cook dinner, and cure premature baldness/cancer.
It would also be nice if you could arrange for the program to be delivered to my house by the drunken, naked Chinese twins, Fok u and Fok me.
You guys are the bomb. Keep up the great work!
-
# Put them on your own unix machine, which should be capable of executing php scripts, ...
Click to expand...
Click to collapse
this implies that you should also have setup a webserver, for running the php scripts.
you will have to change the 'splitrom' commandline in setup.sh depending on what source file you have.
it is not a configure all automatically script, just a guide, to what sort of is supposed to happen for setup.
Holy Cow, you guys are amazing....
This is just a short message to say I'm fighting with it as we speak. My friend's box does have PHP, this is good. I've already found that it needs two subdirs under its root ('download' and 'workspace') to be world-writeable. Took me a while to figure that one out. Haven't got it running yet though, this ROM setup.sh thing is far less than intuitive. But I have the two ROMs which have all the other mumbo-jumbo done: 3.17.03 and 4.00.05, and I will get this to run, if it's the last thing I do.
Jeff (Just back from the U.S., up since 4 am, severe jetlag)
Jeff Summers said:
I've already found that it needs two subdirs under its root ('download' and 'workspace') to be world-writeable.
Click to expand...
Click to collapse
Whoops... I guess you're right, that should have been documented. The things you take for granted sometimes...
Thanks, and good luck...
Thanks
hey, you are doing a great job guys, keep it up.
welcome back Jeff Summers.
Othman
OK, here's the status:
I'm close, really close. It wouldn't detect my OS, the bash on the system I'm on is in /usr/local/bin instead of /bin and now it's complaining about a missing perl file. I'm working on it though...
probably you are missing http://search.cpan.org/author/GBARR/Scalar-List-Utils-1.11/
which is included with perl 5.8, but not with perl 5.6.*
if you don't have root access to you box, you can also install ( see the README for build instructions ) list-utils in your home directory, by editing the generated Makefile, and changing 'PREFIX=$(HOME)', and then adding
Code:
export PERL5LIB=$HOME/lib/perl5/site_perl/5.6.*
to your environment. ( with '*' your perl version )
It's working
It's working!!!
With a little help, I got it to work !!!
Have a look at http://cuba.calyx.nl/~jsummers/ROMkitchen
I just created my first ROM!
Hi, I tried create 4.00 based Rom on Jeff web and it works... thanks.
I discovered only small problem, that there are not installed links in Programs to extra included programs. But I can do it manually for now.
I tried to start my version of romkitchen on my notebook but I was stopped on integration PHP to IIS. I tried some last installer php-4.3.2-installer.exe for Windows but I got CGI error when I tried to access index.php. I'll work on it.
I hope that it will run too, like mkrom on Cygwin.
aleho said:
Hi, I tried create 4.00 based Rom on Jeff web and I works... thanks.
I discovered only small problem, that there are not installed links in Programs to extra included programs. But I can do it manually for now.
Click to expand...
Click to collapse
Ah, you haven't noticed that we put these in subfolders maybe. Go to Programs, and you should see subfolders. If you unchecked the option to put in these subfolders, then you have also unchecked everything 'below' that, meaning you haven't installed these programs.
I tried to start my version of romkitchen on my notebook but I was stopped on integration PHP to IIS. I tried some last installer php-4.3.2-installer.exe for Windows but I got CGI error when I tried to access index.php. I'll work on it.
I hope that I will run too, like mkrom on Cygwin.
Click to expand...
Click to collapse
Go for it...
Ah, you haven't noticed that we put these in subfolders maybe. Go to Programs, and you should see subfolders. If you unchecked the option to put in these subfolders, then you have also unchecked everything 'below' that, meaning you haven't installed these programs.
Click to expand...
Click to collapse
I had unchecked only few of programs to fit in ROM 4.00 free memory.
But folders in Programs like Phone, System tools,... were not in this case created, but they were checked.
jeff: great work...
one bug i found: when i disable the modify rom and add programs i get an error: Warning: Invalid argument supplied for foreach() in /home/jsummers/public_html/ROMkitchen/processor.php on line 480
i wanted to get the orig 4.00.05 rom without modifications
Jabba
REQUEST: zipped Kitchen
Hi !
Thanks all developers! Great work
One request though: please put a zipped version of your ROMKitchen at your ftp -> downloading hundreds of files is a mess *g*
Thanks... Jabba
This is so frustrating: I had it working perfectly, and now all of a sudden it stopped working. I'm working on it...
It's working now. Not really sure what was up, but it seems to have fixed itself.
Nice!!! These new ROMs are sooo cool. All the programs are stored in neat subfolders with icons....
I did find that D9 and PocketCHAT (The EVB apps) do not yet work on WM2003. It complains some EVB shared files are still missing.
Hi Jeff, just to say I've successfully used your ROM builder principally it has to be said to get hold of 4.00.05 so I only choose the Hot Fix item.
Checked in startup (which I've not looked in before) to see the hotfix and its there, there is also aFlashman, cFlashman Handsfree poutlook, SMSReciever, stk & Ussd. Are these part of the normal ROM? Just want to check that the thing is running as lean and clean as it can.
Many Thanks

WM5 ROMfiles dumps [files, modules and registry]

Hello.
History:
My Qtek9090 running WM5 has good CPU, fast graphics and very, very slow filesystem. I'm looking for something, may be for fatfsd.dll extracted from another PDA. And I cann't find it
There exists very handy utility WM5 Files Dumper [thanks buzz_lightyear ]
I think it is a good idea to upload dumps of all files from our PDA's. It would be a good source of information and source of code bricks to cook patches and updates.
Such a dump should contains all files and modules [extracted both from bootloader and OS] and full dump of registry. It should be as clean as possible - just after hard reset, before entering PIN, before adding any contacts and any patches.
Tommorow I will try to upload WM_5_03_02_WWE_built_1337_42_BlueAngel_by_mamaich.zip.
And again - thanks to our master hackers
I'm looking for something, may be for fatfsd.dll extracted from another PDA. And I cann't find it
Click to expand...
Click to collapse
And even if you'll find it - it would not work on your device. It is always XIP.
And it would not speedup your device - it has a slow ROM.
mamaich said:
/me said:
]I'm looking for something, may be for fatfsd.dll extracted from another PDA. And I cann't find it
Click to expand...
Click to collapse
And even if you'll find it - it would not work on your device. It is always XIP.
Click to expand...
Click to collapse
Probably you are right I'm a lame, but I afraid, that it is true.
But: as I understand: XIP means "eXecute In Place". Dll's as modules are executed from slow ROM [and there is no shadow RAM] [and there is no way to cache them]. Dll's as files are loaded into RAM, and then executed. Correct me, if its not true.
We have plenty of RAM, so [probably] it is possible to load a lot of dll's into RAM instead executing them from [slow] ROM.
Dlls created with "WM5 Files Dumper" - looks good. I would have to analyze them several times, I would have to ask master hackers is it true, but I would try to load them into RAM.
mamaich said:
/me said:
I'm looking for something, may be for fatfsd.dll extracted from another PDA. And I cann't find it
Click to expand...
Click to collapse
And it would not speedup your device - it has a slow ROM.
Click to expand...
Click to collapse
Yes, of course.
But SPB benchmark told me:
Reading files from \somewhere is 4 times slower then WM2003. It is a good value.
Write files into \somewhere is 6 times slower then WM2003. It is also a good value.
But:
Copy files [OS level] is two times faster than read them and write back. It is not good value.
Retrieve filenames from huge directory is 10-12 times slower, than WM2003. It is also not a good value [it should be comparable to reading files, ie. 4 time slower]
There are two ways:
1. there is something wrong within fatfsd.dll,
2. overhead of executing fatfsd in place is not acceptable,
3. my benchmarks are wrong [I have not enough time to benchmark filesystem without cache
/me said:
Tommorow I will try to upload WM_5_03_02_WWE_built_1337_42_BlueAngel_by_mamaich.zip.
Click to expand...
Click to collapse
It is here: ftp://xda:[email protected]_WWE_built_1337_42_BlueAngel_by_mamaich.zip
If you think it is a good idea to share WM5 code bricks, upload your your clean dump into
ftp://xda:[email protected]/Uploads/RomFiles_dumps
UserName and Password is here: http://wiki.xda-developers.com/index.php?pagename=BA_FTP_Site search for "xdaupload".
baniaczek said:
But: as I understand: XIP means "eXecute In Place". Dll's as modules are executed from slow ROM [and there is no shadow RAM] [and there is no way to cache them]. Dll's as files are loaded into RAM, and then executed. Correct me, if its not true.
Click to expand...
Click to collapse
There are 3 types of DLLs used on WM5. First type - normal files, they are loaded into RAM, fixups are processed, etc. They are slow to load (due to fixup processing), but would execute from RAM. Second type - XIP, which are executed directly from ROM and would work slowly. In BA this set of files is executed directly from ROM:
Code:
device.exe
filesys.exe
nk.exe
busenum.dll
cecompr.dll
ceddk.dll
certmod.dll
coredll.dll
crypt32.dll
devmgr.dll
diskcache.dll
fatfsd.dll
fatutil.dll
fsdmgr.dll
fsreplxfilt.dll
hd.dll
imgfs.dll
msflash.dll
mspart.dll
osaxst0.dll
pm.dll
regenum.dll
relfsd.dll
It is much less than was in WM2003.
And WM5 added a new filesystem - IMGFS. It contains compressed modules split to sections, but they are fixed to specific addresses in RAM, they are decompressed to these constant areas and executed from RAM. They are similar to XIP as they also don't contain relocations, but would work fast. I don;t know the correct termin for this type of files.
To replace files in XIP section you'll need this tool - http://forum.xda-developers.com/viewtopic.php?t=33321
if you overwrite any of files I've wrote here by a CAB file or other method without modifying ROM - their old versions would be used instead because they are loaded much earlier than all filesystem drivers.
Thanks mamaich
Registry Question
thanks for the files baniaczek!
does anyone know which file or how the other OS registry entries (the ones not in the boot.hv) get created? There are so many more in a full registry.
thanks!
P.S. thanks mamaich for the great tools!
Re: Registry Question
OS imports *.RGU files on hard reset, and it also reads mxip_*_*.provxml files that also can setup registry items. On Universal and similar devices registry can be set by CAB files in extended ROM.
If you add a new RGU file to OS image it would not be processed. Maybe they should have DSM file with the same name, or be mentioned in [HKEY_LOCAL_MACHINE\System\ObjectStore\RegistryUpdate] key or in packages.sof. I don't know. I always add keys to default.hv/user.hv or edit existing RGU files.

Extracting DLL from Toshiba e740 ROM

First of all, excuse me, because this surely can be considered offtopic, but I'm getting desperate.
The problem is that I need to extract the DDI.DLL file from a Toshiba e740 ROM, I found the dumprom.exe utility that is using the same file in the examples of use that the one I'm trying to extract ddi.dll from:
nk-e740-1.0618.0409.bin
I'm not sure about the version of this ROM, but I think it's a PocketPC 2002 version. When I just invoke:
dumprom.exe -d rom nk-e740-1.0618.0409.bin
I'm just getting lines with the text:
error decompressing xxxxxxxxxxxxxxxxxxxxxx
When I use the '-3' flag, I got none of those errors, and I have a DDI.DLL file (and a lot of other files), but is unusable for disassembling in Ida Pro. It seems that some sections are corrupted or not correctly extracted. For example, the rva for the exported functions seems not to be present. Anyway, looking for ASCII strings, I'm able to find the names of all the functions in some locations of the file.
When I try to get some info with peinfo.pl, for example, it dumps me the error:
cannot find rva 0001d7b0 for exporttable
Another extracted files seem to be fine, and at least I'm able to see the export table.
What's the problem? Is this just what I have into the ROM, or perhaps I'm missing something or is dumprom.exe failing for this ROM?
Excuse me for posting here with an actually not related XDA problem, but this is the only resource I've found that seems to give me some hope to go ahead.
Regards and thanks a lot for reading me.
Probably dumprom is incompatible with such old OSes. You can manually set RVA and other addresses in a dumped DLL, or modify its sources.
Anyway, I'm not getting significant errors while executing with '-3'. The only strange messages are:
ERROR: could not find pointer for ofs 00000000
and some:
addr1 - addr2 Llen unknown some values here
And also some:
addr1 - addr2 Llen NUL
Are these actually errors, fatal errors, or just warnings?
Talking about setting rvas manually. How could I tell what RVA values should I use? Is there any information available about doing such a thing?
Thanks a lot.
sirfred said:
Talking about setting rvas manually. How could I tell what RVA values should I use? Is there any information available about doing such a thing?
Click to expand...
Click to collapse
Al; information regarding ROM structure can be found on MSDN and in Windows CE shared source code. You should look there. I don't remember, but dumprom should output it to console during dumping.
Or you can just guess these addresses

Decrypting Apache ROMs?

So, I've been learning about all this rom cooking you guys have been doing, and I'm really excited. I've got an Apache, and I want to start building custom ROMs, but it looks to me like none of the avaliable software can decrypt the apache .nbf files. Is that right? What can we do to fix that? It looks like xda3nbftool.exe could do it if we had the password, which I haven't been able to find... Do we have that password? If not, how were the other ones found? I have a good grasp of all the other ROM cooking tools, so all I need is to be able to decrypt the files... I want A2DP and Push e-mail too!
Thanks,
-Taylor
no one?
-Taylor
I am so glad that people are working on this. It was a serious let down when the rom update for the 6700 had no A2DP.
please if any of the gods here can help it would be greatly apreciated by a lot of people.
thanks
I hope someone is able to port A2DP to the PPC-6700 (Apache) soon. I am hearing about new & older phones daily that are supporting A2DP, just not the 6700!
I'd also love to see someone cook up a rom with A2DP built in as well. There is a lot of talent here, and you've all been very helpful in the past. Maybe we can keep this streak up?
$50 from me to anyone who can get me A2DP on my apache. lol
-jeff
for what its worth, im willing to help test any files, roms, hacks, cracks, or whatever to get this workin. i wanted a2dp and avrcp, and have been sorely disappointed since i got my 6700...its sad when the 6600 has it and the 6700 doesnt. i shoulda bought an older, outdated phone, it'd have been better.
Facegarden - I hope someone can help with your request
Facegarden, I have been tracking your committment to getting A2DP working on the PPC6700 phone. I hope one of the other developers can offer you the assistance you are requesting. Sadly I am not able to offer more than my words of encouragement and my phone as your guinea pig.
Casey
Facegarden - I hope someone can help with your request
Facegarden, I have been tracking your committment to getting A2DP working on the PPC6700 phone. I hope one of the other developers can offer you the assistance you are requesting. Sadly I am not able to offer more than my words of encouragement and my phone as your guinea pig.
Casey
Add me to the list!!
Sign me up! I am also interested in A2DP support in the Apache (XV6700).
I can't help with coding but willing to beta test. This issue needs to be solved, there are older phones (PPC) and Palm devices supporting this.
If WiFi needs to be turned off because of RFI, so be it, that's no big deal!
Anyone?
Hey, I'm glad you guys are supporting this.
Here's what I know, and what you can do to help:
The files we need to decode are .nbf files, extracted from the .exe file for sprint's update. Just throw the sprint installer (found here: http://www4.sprint.com/pcsbusiness/downloads/APAC_SPCS_20600_300_11200_ship.exe ) into WinRAR, and it will extract it (yes, some .exe files can be extracted... I didn't know that at first...)
Anyway, once it's extracted, you should have one folder, with two folders inside. The interesting one for now is the "output" folder, which contains some encrypted ROM images, including nk.nbf, the encrypted main ROM. This is where apache owners seem to be stuck. Scripts and programs have been written for the other devices' ROMs to decode them into a workable file (an .nba file). We need to figure out how those decryption keys were determined, so we can do that with our files.
Furthermore, someone needs to help us make a program to actually do the decryption if existing tools don't work, because as much as I can use existing software, I can't code this kind of stuff for crap (i can do microcontrollers though! )
Anyway, there are some perl scripts that seem interesting, but from what I can tell, they don't work with Apache ROMs...
So, here are some more links to help:
More info on TyphoonNbfTool, the perl script (though it has been compiled in various flavors into .exe files by some nice people), can be found here:
http://forum.xda-developers.com/viewtopic.php?t=43689
I looked a bit for the different .exe versions of TyphoonNbfTool mentioned in that thread, but only came up with v05 attached to one of the posts... Maybe the Apache has a header like the others? v05 didn't seem to work.. maybe the others? I haven't had a chance to look hard enough for those .exe files yet (i've been really sick the past few days ), but maybe they'l work?
Also, in the perl script itself, there is some mention of an apache key or something, so if anyone know's what that's about, it's here:
http://nah6.com/~itsme/cvs-xdadevtools/xda2nbftool/typhoonnbfdecode.pl
Note that all that "Typhoon" stuff is supposed to be for just an HTC device called the Typhoon, but it seems like people have used it for other devices successfully...
Some other links:
A Universal ROM decoder (works great on Universal ROMs, but not on ours) http://buzzdev.net/index.php?option=com_content&task=view&id=65&Itemid=1
Once a ROM is decoded, these tools are used:
http://forum.xda-developers.com/viewtopic.php?t=34171
And the "A2DP for all devices" thread on here:
http://forum.xda-developers.com/vie...stdays=0&postorder=asc&highlight=a2dp&start=0
So yeah... Poke around, see what you can find...
If anyone knows or uncovers how these keys were discovered, help us out! Thanks!
-Taylor
And any "prize money" for this should go to the forum itself, they need donations to keep this great forum running!
-Taylor
you can use alpinenbfdecode.pl to decode apache roms.
willem
btw, the apache keys are already known, see typhoonnbfdecode.pl.
you can find them by looking for des encryption code in the radio rom.
in v1.03.00 they are the 0x18 bytes right before the key-permutation table in the rom.
.... you find the des tables by looking for instance for the bytes '38 30 28 20 18 10'
willem
Hey, sweet! Yeah, i thought i saw those keys in typhoonnbfdecode.pl, but I wasn't sure what to make of them, since i couldn't get the typhoonnbfdecode.exe to work on them... Anyway, I'll have to do some searching to figure out how to use those perl scripts, but if you have any advice I'm all ears. For now, I'm off to class. Thanks!
-Taylor
I managed to decode the Apache rom...
I started with the file
APAC_SPCS_20600_300_11200_ship.exe
I ran the file while the phone was NOT connected to the computer. I then went to the windows temp directory and pulled out nk.nbf and moved it to my linux machine (I hate perl... but I can at least get it to work under Linux)
I then used alpinenbfdecode.pl to decode the nk.nbf file to nk.nba
perl alpinenbfdecode.pl -d nk.nbf nk.nba
I then moved the nk.nba file back to my windows box and used the imgfs_tools
prepare_imgfs.exe nk.nba -nosplit
viewimgfs.exe imgfs_raw_data.bin
This dumps the decoded files to their own directories.
I confirmed that the decode was successufl by pulling the solitare.exe from the dump and moved it to my 6700 and it ran thereby confirming a successful decode.
Unfortunately, I don't know what I need to do next to incorporate A2DP.
atomclock said:
I managed to decode the Apache rom...
I started with the file
APAC_SPCS_20600_300_11200_ship.exe
I ran the file while the phone was NOT connected to the computer. I then went to the windows temp directory and pulled out nk.nbf and moved it to my linux machine (I hate perl... but I can at least get it to work under Linux)
I then used alpinenbfdecode.pl to decode the nk.nbf file to nk.nba
perl alpinenbfdecode.pl -d nk.nbf nk.nba
I then moved the nk.nba file back to my windows box and used the imgfs_tools
prepare_imgfs.exe nk.nba -nosplit
viewimgfs.exe imgfs_raw_data.bin
This dumps the decoded files to their own directories.
I confirmed that the decode was successufl by pulling the solitare.exe from the dump and moved it to my 6700 and it ran thereby confirming a successful decode.
Unfortunately, I don't know what I need to do next to incorporate A2DP.
Click to expand...
Click to collapse
bump
currently there are no tools to encrypt the nba files back to nbf - so far noone has managed to write something that computes the right checksum for the compressed images.
Yeah... What has to be done to get that to work? Can we use crc32 to compute the checksum and manually change it? I tried, but I can't find the location of the checksum in the file, which I would assume is other people's problem as well... But shouldn't we be able to take an unmodified file, and then calculate it's checksum with crc32, then find that value in a hex editor? I also tried that, but it doesn't work... Is the checksum encoded as well in the encoded files?
I'd really love to figure this out now, because the sprint people have been able to copy some a2dp files directly and, along with a registry edit, get a2dp working. It doesn't work on verizon phones though... something about sprint's update that verizon never got... I want to take their update and change the device info to match ours, but I can't get the checksum right!
Also, what happens if I succeed, and in the process copy a sprint radio rom to my phone? Do I then have a sprint phone instead?
-Taylor
the problem is not where it is stored in the file, i know that.
but when you change the file, you have to recalculate it, and produce the correct value, there i am missing something.
just have not take the time to look at it.
willem
hmm... so crc32 doesn't work then? well let us know if you figure it out!

Scoter Kitchen Release

The Scoter Kitchen team is proud to release the first release of the kitchen. This kitchen incorporates all the tools used by Oki and the rest of the team to decode, modify, and rebuild ROMs. It includes a help system that is meant to be clear to new users, and useful to old pros. Of course, this is only the first release, and thus will have bugs, and areas in need of improvement. This Kitchen is based on Bepe's WM5 Kitchen, and many of his tools. Special thanks to Mamiach, itsme, machinagod, gmap, buzzlightyear, and many others. Oki started the initiative, and we in the team are grateful for allowing us the privilege of contributing. There are also many additional tools not directly used for general ROM analyzing that can be found throughout. The kitchen is designed to be sleek and clear for the new user, while still containing all relevant tools for every part of the build process. This post is one of many across multiple forums. We are opening up development to all, and ask for volunteer translators. We will coordinate through forums primarily, but later plan on PM's, e-mail, etc. to effectively coordinate further development of the Scoter Kitchen. In addition, the kitchen is designed to extract most HTC ROMs, but it has it's limitations in the tools included, and the outlined process which are in the help files. Again, this will become better implemented through the help of the community. Now though this Kitchen is designed primarily for the Scoter, we intend to make this kitchen the primary hub for all PDA customization across all WM5 platforms. This post will be posted on many forums, and since the team members communicate primarily w/ English, we ask that those respond to this thread in English, or at least include an English translation. As a last note, you are solely responsible for any damage to your device or computer that might result from the use of the Scoter Kitchen, or any of it's parts. The following posts are left blank and will be filled w/ info later. Here are the download links:
http://www.MegaShare.com/107480
http://rapidshare.com/files/15460590/Scoter_Kitchen_1.0.exe.html
Regards,
Jason
Kitchen Team Members
Oki
JKR
DwD
Theo - Greek translation
Nadavi
gerttom
Preaper
Friends of the kitchen
Bepe (done as much as any other member and is considered an incredible contributor, and even that doesn't give him enough credit)
Kinger
blueboy
Marshal
cyril - French translation
bakker_be - Dutch and German translation
kterz
Regards,
Jason
Reserved,
Regards,
Jason
Bakup Files Of 0 Bytes
i had done a backup with ur utilites but the size of BDK0,BDK1 & BDTL0 is 0 byte why it is so ?????????? I stop here and wating for reply
to bad these dont work for the hermes .nb and .nbh files.. hopefully in the future it can be integrated..
shogunmark said:
to bad these dont work for the hermes .nb and .nbh files.. hopefully in the future it can be integrated..
Click to expand...
Click to collapse
Yep, we plan to add the nbhextract to the tools. And as far as the backup utility, that only works for the Scoter. We don't own htc devices, so that why we've asked the community to fill in the gaps. The extraction is universal, since there will be back and forth on various ROMs. The ROM installer also only works for the scoter. So, some info on these and anything else that the HTC community would like added, just tell us how. We can't really test these things, so we rely on you guys. At some point, the installer will ask what device you have, and install apps that apply to your individual devices.
Regards,
Jason
thats cool.. integrating the the hermes stuff will be difficult at this time anyway since we dont have a good set process on everything, we are still fighting the possibility of bad nand blocks with some cooked roms.. Something that i think would be really cool would be a full blown GUI with all these features built in..
here's some release notes I posted over at Buzz's site
JKR said:
4d45h said:
Questions.....
1. What is OS.bat. It says missing OS.bat when I click Cooker and start the build OS.
2. Where do you put pakages inside LOC(Bepe ways of cooking)
3. What is CEImage.bin? Is it the same as nk.nba base ROM Bepe ways.
Thanks and what a great tool.
Click to expand...
Click to collapse
1. That is a file created when you decode a ROM. I'm not sure what exactly it is for, bepe could answer that.
2. You can't use the current Kitchen ROM archives. The Scoter Kitchen incororates some more advanced versions of bepe's apps. The best way to describe the current situation is that bepe's WM5 Kitchen is version 1.0, and the Scoter Kitchen is 2.0. Since bepe was a big part of the Scoter Kitchen development, this should make sense. Keep in mind that this is not ready to be a replacement to bepe's kitchen yet, because it is only setup for building ROMs for the Scoter. We released it to all for many reason: 1) To speed up the development of the Kitchen for use w/ other devices, 2) it currently seems to be the most complete set of tools and help files for decoding ROMs, 3) the help files have a lot of info that may be interesting to many users. Most notable tools from bepe that are in the Scoter Kitchen are: DMP2PKG.exe, and PKG2DMP.exe. These tools actually have their own UI's that are fairly impressive. So to answer you question, you'd need to decode your current ROM and then begin modify that. Oki is the ROM hacker on the team. Essentially what he does, is extract the drivers (in the OEM folder) from various ROMs for our device, picks the best ones, adds in the SYS files and then puts in the packages for various apps. Anyways, bepe combined the LOC and SYS folders together into the SYS folder. for aesthetic reasons, the SYS folder is referred to as the OS folder in the build room. This is only a short cut name, and actual folder is still called SYS and is located in the Utilities folder.
3. Yes, this is in the help files in file:///C:/Scoter%20Kitchen/Utilities/Tools/Excess%20stuff/J-Guide/Extraction%20Room.htm?zoom_highlight=.bin .nb, .bin, and .nba are handled in the same way. just copy the location i posted into your browser address box.
Regards,
Jason
Click to expand...
Click to collapse
JKR said:
A few release notes. The install directory is C:\Scoter Kitchen. You will also see an uninstall script in c:\. This obviously uninstalls the Kitchen, everything is removed (including any work files in the kitchen) except the desktop shortcut. Also, since the imgfs tools are used so much by ROM cookers including myself, the Kitchen will place a copy of the imgfs tools in the %SystemRoot%\system32\ directory. This allows these tools to be opened by any command box w/o having to change directories. As you explore the kitchen you will see readme files in almost all folders, describing what is in that particular folder. Lastly, you will see like 15 command box shortcuts throughout the kitchen, this just makes things easier since their working DIR is the one they are placed in.
Regards,
Jason
Click to expand...
Click to collapse
Nobody here seems to be too forthcoming w/ info about other devices. Now I could go and search for all this info on my own, but then I probably wouldn't have the time or energy to modify the kitchen accordingly. W/ that said, I'll list some specific questions.
1. What programs are required for installing ROMs on various devices, and what are the procedures?
2. Are other devices capable of changing just the CE image through the boot loader, or does this have to be done using itsme tools? And what is the procedure?
3. Is the page pool setting in the same address on all HTC ROMs, or does this vary from model to model?
4. Explain the whole IPL and radio rom issue.
5. What would you like added to this kitchen?
You could just point me to specific posts too. Like I said, the Kitchen is completely functional for us Scoter guy's, so we won't spend the hours and hours required to research this stuff, since we won't get any benefit. But if some direction is given, we are willing, and wanting to expand our kitchen for use w/ other devices.
Regards,
Jason
I thought that it is just for Mio, and a little more documentation to it will be nice, thanks
xplode said:
I thought that it is just for Mio, and a little more documentation to it will be nice, thanks
Click to expand...
Click to collapse
Well it is fully functional for the Mio, but most all tools are here on this site. The two things specific to the Mio are the ROM backup utility, and the ROM update utility. Everything else applies to the HTC community. We are hoping that somebody will point us in the right direction for the equivalents of the two previously mentioned tools. Now as far as the documentation, yes, we plan to expand it. However, what specifically do you feel should be added?
Regards,
Jason
First of all, this's a very FANTASTIC tool!
In the BEPE's ROM Kitchen, there's an initflashfiles.txt file in the folder of each OEM apps which is used to create shotcut or copy/move files, its content will be combined with others into the initflashfiles.dat. Does this file still make sense in your kitchen?
BrightMoonHeart said:
First of all, this's a very FANTASTIC tool!
In the BEPE's ROM Kitchen, there's an initflashfiles.txt file in the folder of each OEM apps which is used to create shotcut or copy/move files, its content will be combined with others into the initflashfiles.dat. Does this file still make sense in your kitchen?
Click to expand...
Click to collapse
yep
Regards,
Jason
@JKR
I have reach up to using the DMP2PKG.exe stage, which can see the files in the *.dsm (see attached pic).
How to extract the files in the *.dsm?
How do I use RECMOD.exe?
CWKJ said:
@JKR
I have reach up to using the DMP2PKG.exe stage, which can see the files in the *.dsm (see attached pic).
How to extract the files in the *.dsm?
How do I use RECMOD.exe?
Click to expand...
Click to collapse
Hi,
You probably read the help files, huh? Yeah, those are dated, my bad. You don't actually have to touch DMP2PKG. The extract modules/files has dmp2pkg already scripted. At the time I wrote the help file, bepe didn't allow for command line commands. He has since, and I have scripted for it since. The following is an excerpt that I post over at Buzz's site.
JKR said:
Ahhh, I see problem. the .dat file needs to be in one of the folders, the OEM one i think. When Oki (rom team member) creates a file set, he includes the .dat file in the same folder that mxip_lang.vol is in, on our device it's 6acba9af-b4de-c7a3-802b-91ff1f140caf, but is probably different on yours. Anyways, I'm not sure where you got the idea to drag those to the tools folder, if it's in the help file, please tell me where. I've just re-looked at the help files, and they are quite dated. I've added a lot of automation to the process. Sorry for that. The correct procedure to extract a rom and rebuild it is to extract a .bin, .nba, .nb, or .nb0 file from your rom image. Then drag it to the extract modules. Open in another window the build room. put the .dat file (if it was placed in the modules folder) in the OEM folder. Drag all the contents of the OEM folder to the OEM shortcut in the build room. Drag all the contents of the SYS folder to the OS shortcut. Place the .bin or equivalent file in the rom template folder, and place the boot.rgu file in the \rom template\xip folder. The boot.rgu may be different for different devices, so use one that works on your device. I don't remember where exactly we got ours from, but I think it may have been from bepe's file set for his kitchen. Now launch the cooker. In the end, you should have a .bin file in c:\Scoter kitchen, aka one level up from the build room. hmmm, looks complicated. This is in the help files, but like I said, I need to update them, we were anxious to release the kitchen, since it had been under development for so long.
Regards,
Jason
Click to expand...
Click to collapse
As one more note, you probably wouldn't have to worry about the missing entries in the dmp2pkg interface. Probably just dated references from your ROM, it's a custom ROM?
Regards,
Jason
The rom is custom rom by Helmi, AKU3.5 v1.3, see my signature.
I will take sometime to digest you writings.
Still have not able to extract the *.dll, *.exe, *.hv, etc.
Will try adding & delete files later.
@JLR
I am back, manage to get some time to try the extract problem I faced.
Thanks, the extract works.
See the attached zip file of extracted files' directory list.
I have some questions,
1. what "<DIR> SYS" does, seems to have some *.dsm and some repeated DLLs.
2. If I do not need some *.exe, *.lnk, *.etc files, I just delete them?
3. How do I know that I fully deleted the files related to the feature that I do not want?
4. How do I know which corresponding *.dsm to be deleted?
5. How do I know which files goes to which directory in the \Windows\ of PPC?
6. How do I add files, how do I know what *.dsm to add and the name of the directories with very long string.
Questions please...
What is the importance of extracting files compared to extracting modules?
I have a base nbf file that I converted to nba file, that I want to modify to add the apps to build the ROM, I am confused as to which one I need, is it the files or the modules?
Great work! Thx for very useful tools!
What about map.txt support that helps to replace the GUIDs with the actual Package Names? I seen it in Bepe's kitchen...
JKR said:
Reserved,
Regards,
Jason
Click to expand...
Click to collapse
I need help. I was able to run the cooker file without any errors. Now what?
How can I recreate the .nbf file? Where can I find it? Should I be looking at the DUMP folder?

Categories

Resources