Database Users

Extracting mpx200's ROM?

hi.
How can extract files from a mpx200 rom? I tried to use tools from the forum but with no success. Mpx200's rom is a file with .img extension. As i see so far in forum, rom's file extension for pda is .nbf. Is there any way to convert .img file into .nbf so i can use er2003edit program? Any other idea-guide that could help to extract the rom from my mpx200(wm 2003) would be very welcome. I couldn't find any resources on the web about extracting mpx200 rom and that's why i posted in this forum. I hope that i'm not totally off topic.
Thank you.
Nikos

I had a play with this a while back, to try to get MPX300 compatibility with VJCandela.
I believe the rom files have have a "B000FF header" (open it with a hex editor). Apparently splitrom can reassemble them into a rom we can play with, but it became more urgent to finish VJCandela then continue with this, so I put it aside. If you get anywhere on this, please PM or post so that I can see if I can make VJCandela cross compatible.
Many thanks!
V

I can upload a dumped mpx200 WM5 ROM to xda-developers FTP if needed.
These IMG files are somehow non-standard B000FF, I was unable to use splitrom to convert them to normal file.
You should dump ROM from a device, then remove a hole in the middle (probably MPx200 has 2 ROM chips at different addresses), then edit it manually because some idiot incorrectly edited that ROM to remove DevAuth.exe and broken its internal structure. After that you'll get a complete dump with broken ril.dll and gx.dll.
I wonder how that incorrectly patched ROM can even boot.

That would be interesting Mamaich. I'd appreciate it if you can.
Can we dump a live rom normally then? I'll try to speak to a guy with an MPX300 to get it dumped if possible, and try to upload it if he's successful.
V

hi.
I found so far that it's possible to convert the .img file, which is
used to update mpx200, into a .bin file. I opened the .bin file with a
hex editor and it starts with B000FF as you said. I don't know where i
can use this information or what it means. As you said it's the
header. When i try to dump rom with dumprom.exe i get an error message saying "unable to determine loading offset for out.bin". Looks like i have to find this offset myself and give it to dumprom. Could you help
me somehow on this?
Also where i can read a few things about the rom structure, xip and
stuff to understand what's going on.
Thanks!
EDIT1
Also tried with splitrom.pl.
With command splitrom.pl out.bin it gives me the following
B000FF entrypoint: 00000000
!!! your rom is not known to me: md5:
68847f4d859a242753798d9d0e205144
!!! your bootloader is not known to me: md5:
ea25e7468c09bf09a384a94cb4dcc67c
no operator rom found
no bitmap found
xip regions not found: 82d80000=LANG, 82040000=SMARTFON,
82d00000=OPERATOR, 82f2
0000=OE
And a lazy question. If i finally do it, i will get a folder in my
disk with all windows components unlocked and ready for modification?
EDIT2
Reading a few things about splitrom it says that it can handle bin
files with B000FF header. In our case(mpx200) we have a bin with
B000FF header. Right? So we can use splitrom to make the nk.nbf file.
An example on how to use splitrom.pl is the following.
perl splitrom.pl cfg/rom.nb1 \
-rm tmp/xda1.bin:0x81740000 \
-rm tmp/xda2.bin:0x81b00000 \
-rx tmp/xipchain \
-rb cfg/bootimage.bmp -ob 0x81ec0000 \
-rl cfg/bootloader.nb0 \
-wo nk.nbf -t nbf -n PW10A1-ENG-4.01-007
On the above, he opens rom.nb1 which is his rom file. Probably the
plain rom image format, i don't know the type. Then he refers to
another 2 files xda1.bin and xda2.bin. In my case i have only one
file, out.bin . He also uses bootloader.nb0, i don't have it or
something similar. Finally he writes nk.nbf file and gives it a
header. In my case i will give a B000FF header.
End.

nicktgr15, for extract files from 2002 and 2003 firmware you can use tools from http://onk.nm.ru/mpx200

Great site my friend onk. Great site. I hope i'll find something. Thank you.

Hi nicktgr15!
Any luck with the ROM extraction for MPx200?
Anyone here on this board can comment too.
I went to the link http://onk.nm.ru/mpx200 but can't really get thinks going with the WM2003 for MPx200.
I've the ROM but using dumprom.exe, I got something like 'can't determine the memory offset'.
So...where so I start?
I really need the SIMManager & Resource Manager for my WM5 MPx200.
Also, would like to have the SIM Tool Kit working on my phone since there's no way to interact with the SIM features.
Thanks anyone!

Please Upload the Dumped WM5 MPx200 Rom you are saying about!It will be a huge step!!!We can edit it,fix some bug,even make it work without the need of the SD Card...!!!

I've uploaded ROM dump to uploads/mpx200_dump directory on xda-developers FTP.
Buildimgfs tool is useless on this ROM, because 2 files in it are broken. Maybe addfile/delfile would work (but they would break data in imgfs_removed_data.bin). And of cause you have to manually remove hole inside ROM before working, and inject the removed data back before flashing. And figure out the format of imgfs_removed_data.bin and recreate it yourself.

For dump WM5 files you can use tool http://buzzdev.net/index.php?option=com_remository&Itemid=100&func=fileinfo&id=83
You must create directory "\Storage Card\" on SD and run this program on smartphone
I think this program work on many other devices with wm5
PS. you can read http://www.wce.by/forum/viewtopic.php?t=1517 (Russian language) about tools for firmware

Onk nice site but i can understand a thing!!!
Have you made a fixed version of wm5 for Mpx200?If yes where i can download it?
My goal is to make a cut down wm5 version that can fit on the 32MB ROM of MPx200...can that be possible?

I'm downloadl WM 2005 for MPX200 smartphone Build 14343 from sendmefile , but link id dead ;(
after extract files from archive, I convert part2.bin and part3.bin to CMCS IMGAGE (use BINtoIMG) and flash images to mpx200 (use Motorola Upgrade Wizard 1.8.x)
wm5 for mpx200 used SD card like /Storage on wm2003 and wm2002 (for save config, datafiloes, program etc)
Internal flash used only for firmware
for replace some files from firmware you can place it to /Windows on SD card
BUT! This build of WM5 work on 80-90% of mpx200 devices ;(
some devices can't run wm5.
And the speed of operation WM5 strongly depends of speed used SDcard (x80..x132 recomended)
Your file mpx200_wm5_bin_B00FF.7z (17460816 Bytes) is now online.
Your Download-Link: http://rapidshare.de/files/14495499/mpx200_wm5_bin_B00FF.7z.html
for extract files you must use 7zip archiver www.7zip.org

what?is this a fixed wm5 version?

does it works without the need of the SD?

NO
this version NEED SD

is there ANY chance to remove some files (Images,Sounds,maybe some prorams) from the WM5 ROM and make it work without the need of the SD?
I believe then,the OS would be STABLE and work Faster.
Let's make a Try!!!
What do you think?

part1.bin сontains magneto with use built-in flash memories (WM5 build 14122)
It is necessary to correct a little. Find in an firmware
Code:
0BFC440: 65 6D 72 65 67 69 73 74 │ 72 79 2E 64 6C 6C 00 44 emregistry.dll D
0BFC450: 65 76 41 75 74 68 2E 65 │ 78 65 00 62 74 68 61 74 evAuth.exe bthat
and change DevAuth.exe to AuthDev.exe for disable Device ID check
But this firmware contains one more "protection" - works before some date.
If before flashing set date 2004 - works normally. If the current date - show a modal system window with the message that is the version for developers.
How to disable this "protection" - it is not known yet
And it is not known about locking the register in this firmware
PS: In Firmaware structure ROM similar 2002/2003 is used. Use dumprom for extract files
PPS: my page is updated. Added simple manual about firmware and tools

mamaich said:
I've uploaded ROM dump to uploads/mpx200_dump directory on xda-developers FTP.
Click to expand...
Click to collapse
Can you please upload this dump somewhere once again? as it seems /mpx200_dump is already deleted from FTP.

Custom Splash Screen

Has anyone with a Prophet had any success placing their own custom spash screen on their device? And if so, what program did you use? I keep trying to use aWizard and splash_bmp_to_wizard and both programs give me the following error:
Code:
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 6b 36 02 01 0e 30 02 98 02 0c 05 0d
CopyFileToTFFS<SplashBMP\splash-temp.bin:0, 2d0000, 00002581e>
ERROR: ITWriteDisk - An internal error occurred
Any insight?
Thanks.

Not sure
I tried splashing using aWizard 1.3 beta today, created splash BMP file per specs, and used the c option to convert,etc. I got nothing, no msg just aWizard popped back to windows.
It asks me to name the file, and locates the folder, but I don't get the file, and when I name it, generac splash,bmp tried, tried just splash, nothing
There is another program i was looking at that may work for you, I just did not like the idea that Zone Alarm Pro was asking me permission to go on internet with so many seperate modules from this program, so I cancelled the operation, but maybe you would like to look at it.
http://www.ppcsg.com/mobile/index.php/t71471.html

Re: Not sure
Maddogx007 said:
I tried splashing using aWizard 1.3 beta today, created splash BMP file per specs, and used the c option to convert,etc. I got nothing, no msg just aWizard popped back to windows.
It asks me to name the file, and locates the folder, but I don't get the file, and when I name it, generac splash,bmp tried, tried just splash, nothing
There is another program i was looking at that may work for you, I just did not like the idea that Zone Alarm Pro was asking me permission to go on internet with so many seperate modules from this program, so I cancelled the operation, but maybe you would like to look at it.
http://www.ppcsg.com/mobile/index.php/t71471.html
Click to expand...
Click to collapse
That program that you linked to is the program I tried - "splash_bmp_to_wizard", which gave me the same error as aWizard. There was one Dopod 818pro user on that forum so said he had luck with it. So I figured there must be hope, but it's still not working for me. And for future reference, I don't think the program is very harmful - it just unpacks some files to send via activesync to your device.
As far as aWizard goes, let me give you a tip that I found:
Place the aWizard folder in C: to make it read --> "c:\awizard", and then rename the program "awizard". Once you've done that - put your 24-bit BMP into the SplashBMP folder and title it "splash.bmp", next open the program> type c> (you should see in the middle of the screen files numbered 1 and 2) select your file by typing in the corresponding number>hit enter> hit enter again> AND YOU'RE DONE! ....Now if it will only work :?

Hi guys,
I was on that forum too.
I was able to change my splash screen on Dopod 818 pro, using aWiard or the program posted on PPCSG site
I think both use the same technique.
After reflashing my Dopod with the latest iMate ROM, I have not succeeded doing that anymore
So, I guess both programs work on some ROM versions, not on the others.
Looks like they do not work on WM5.2
Anox.

That seems reasonable. Hopefully that will be taken into consideration on the next version of aWizard

Re: Not sure
mcnasby said:
Maddogx007 said:
I tried splashing using aWizard 1.3 beta today, created splash BMP file per specs, and used the c option to convert,etc. I got nothing, no msg just aWizard popped back to windows.
It asks me to name the file, and locates the folder, but I don't get the file, and when I name it, generac splash,bmp tried, tried just splash, nothing
There is another program i was looking at that may work for you, I just did not like the idea that Zone Alarm Pro was asking me permission to go on internet with so many seperate modules from this program, so I cancelled the operation, but maybe you would like to look at it.
http://www.ppcsg.com/mobile/index.php/t71471.html
Click to expand...
Click to collapse
That program that you linked to is the program I tried - "splash_bmp_to_wizard", which gave me the same error as aWizard. There was one Dopod 818pro user on that forum so said he had luck with it. So I figured there must be hope, but it's still not working for me. And for future reference, I don't think the program is very harmful - it just unpacks some files to send via activesync to your device.
As far as aWizard goes, let me give you a tip that I found:
Place the aWizard folder in C: to make it read --> "c:\awizard", and then rename the program "awizard". Once you've done that - put your 24-bit BMP into the SplashBMP folder and title it "splash.bmp", next open the program> type c> (you should see in the middle of the screen files numbered 1 and 2) select your file by typing in the corresponding number>hit enter> hit enter again> AND YOU'RE DONE! ....Now if it will only work :?
Click to expand...
Click to collapse
doesnt work

[REQ] HTC Youtube Player (Reg) Tweaks

Does Anybody know how to change the TempFileLocation to SD-Card?
I found an Registry string, but if i change it eg. to 2 than the Youtube Player hang while loading the Video
"HKLM/Software/HTC/YouTube/TempFileLocation with a value of 1
Also the downloaded Temp.3gp from Youtube can not be played with any Player, also VLC on my Computer says that he can not play the file.
Is there Anyway to download thwe Videos with the HTC Youtube Player, like on the Iphone (eg. MxTube)? I tried several Registry stings but no one work.
I only found out that the EnableSW improves the Video quality very, but while on loading the file it is a little bit frameskipping.
Thanks for helpful answers.
greetz

I'm trying to find answer to the same question. Someone pls help.

Silentd said:
Does Anybody know how to change the TempFileLocation to SD-Card?
I found an Registry string, but if i change it eg. to 2 than the Youtube Player hang while loading the Video
"HKLM/Software/HTC/YouTube/TempFileLocation with a value of 1
greetz
Click to expand...
Click to collapse
Looking for an answer as well...
Did you try changing the PurgeMinStorage value to a higher one?

About the "TEMP.3gp" file
I ran TrID on the file and it gave this:
Code:
TrID/32 - File Identifier v2.02 - (C) 2003-06 By M.Pontello
Definitions found: 3975
Analyzing...
Collecting data from file: C:\Users\HS\Desktop\Temp.3gp
100.0% (.SKC) ISIS sketch (1001/2)
hmmmm!! seems irelevent any Ideas??
by the way did you try to set the registry key to "0" ??!!

Guess I DID IT!!!!!!!!!!!!!!
Scaning the file in hex editor for media headers brought this up
"....ftypmp42....isomavc1mp4"
YES!!
It IS mp4
The hex address was
Code:
0x318
then I just cut from there up ie:
From the top of the file
Code:
0x0
To
Code:
0x317
The Header Must Be Like this
Code:
00000000h: 00 00 00 1C 66 74 79 70 6D 70 34 32 ; ....ftypmp42
And also renaming the file to something.mp4
wheeeww......now it works..!!!!
seems google was adding some sort of additional herder!
If you don't know hex editing don't bother it aint that important is it?
PS:Your file might be something else (not mp4) then the header will have to
change but I guess the additional header is the same length!?
correct me if I'm wrong!

Hello!
I hacked HTCYouTubeService.dll in the context of cache location....
Now you need to create a directory \Storage card\YT (new youtube cache location) and copy content of \Windows\YouTube to it
After that necessary to install sdkcert.cab and Allbest_mod_htc_you_tube_dll.cab...

[Help] Transparent Taskbar and softkey bar for WM 6.1

Hi all,
Solved
http://forum.xda-developers.com/showthread.php?t=647579
http://forum.xda-developers.com/showthread.php?t=660557
Please help me to make transparent taskbar and softkey bar for my device.
My Rom Gen.Y D2X R2.6[WM6.1 21056][SENSE2.5.2012]
Thank you

Thanks Ham3r and volDeus

Hey Andy, I really like your landscape theme!! How did you do that? I cant find anything stable that changes the look of the landscape mode. Can you please share with me?

Step by step what I did :
1a) find your shell.exe and aygshell.dll from this thread http://forum.xda-developers.com/showpost.php?p=6128208&postcount=2
- drag and drop the shell32.exe and aygshell.dll over reversmode.exe http://forum.xda-developers.com/attachment.php?attachmentid=320295&d=1272915476 (a new folder called shell32.exe and aygshell.dll will be created containing the modules S000,S001,S002)
- edit S001 (shell32.exe and aygshell.dll) with http://dc109.4shared.com/download/55582286/a3a84a1c/HxDen.zip?tsid=20100531-002647-822c3f70 where the value (FF 00 00 00 FF FF FF FF change to 00 00 00 00 FF FF FF FF). Detail read http://forum.xda-developers.com/showthread.php?t=647579
- drag and drop shell32.exe and aygshell.dll folder over recmod.exe http://forum.xda-developers.com/attachment.php?attachmentid=307757&d=1271046055 (now we have shell32.exe and aygshell.dll in folder)
- copy shell32.exe and aygshell.dll (already recmod) to device  windows
Note : backup your shell32.exe and aygshell.dll before you overwrite. I rename my original shell32.exe to shell32.bak and aygshell.dll to aygshell.bak
- Soft reset
1b) OR take shell.exe and aygshell.dll from .nbh file with htcRIE_0.5.0.12.exe http://forum.xda-developers.com/attachment.php?attachmentid=307759&d=1271046055
2) download and install volDeus BG Tweak v0.6b4.CAB http://forum.xda-developers.com/attachment.php?attachmentid=313053&d=1271788254
- open BG Tweak v.06b4
- set background, select background, accept (this for full image portrait, make sure don’t prees portrait/landscape)
- set background, select background, press portrait/landscapte, accept (this for landscape)
Note : I used BG Tweak v.0.6b4 for made background full screen support portrait / landscape and made background alignment / centre
My tranparent shell32.exe and aygshell.dll bulid 21056
http://rapidshare.com/files/399597580/21056_Transparent.rar.html

Hi andy,
I'm trying to make my bars transparent as you did but am having some problems, could you give me a hand?
1. I used the htcRIE_0.5.0.12.exe to extract the folders shell32.exe and aygshell.dll from .nbh
2. Edited S001 from each folder as indicated by Ham3 and saved.
3. I dragged and droped each folder over recmod.exe recreating the files shell32.exe and aygshell.dll
4. In this step I have some problems, I could not renaming the original files as you stated. I tried using Total Commander but not renamed! So I had to overwrite the two files also using Total Commander.
5. After I overwrite the files I rebooted. And my phone did not start. It hangs at the first flash screen.
I do not know for sure what I did wrong and why they did not work!
But the thread Ham3r he says it is required ROM dump, but I think that you could do it without that. Right?
I noticed that when I saved the edited S001 file was created a S001.bak in each folder. I have to leave this files inside each folder or remove it before dragging to recmod.exe? I just leaved, this could be the problem?
btw, I am trying to do this in my Kaiser with ROM [05 \ 03 \ 10] Stylez Black v.5 WM6.1 D3D 21051 101MB Full \ Manila Light 2.6 Theme [Final][/URL] and the Ham3r thread not say anything about the 21051 version, the problem may be here?
I would love to hear your opinion on my case.
EDITED: I just read valDeus thread and realized that my files are corrupted. My Shell32.exe is with "314.0 k" and aygshell.dll is with "472 b" according to Total Commander. I may have to ask the chef to these files from my ROM!
Thanks

hi bernabap,
Sorry, I not have idea why this can make your phone failed boot
I don't think required ROM dump cause longice also did it without dump (maybe we same ROM) http://forum.xda-developers.com/showthread.php?p=6000971&highlight=transparent+taskbar#post6000971
My ROM build 21056 --> Shell32.exe = 314 kb, aygshell.dll = 347 kb.
Hopely you solve your problem soon

Thanks andy for your reply.
valDeus said: "If your shell files are not approximately 750-850kb for shell32.exe and 350-450kb for aygshell.dll THEY ARE CORRUPT! and will cause your device to fail at boot."
And I see that your sehll32.exe is outside this range (Shell32.exe = 314 kb) and you still got it. I do not know why I could not have success but may be because my ROM was made with bepe's platformrebuilder.
Anyway I already asked my ROM chef if he can get me the files.
Thanks

Your rom is already Patched thats why drop and replace worked
Other roms especially the stock official roms from HTC will hang after reset if you do the manual drop and replace files method.
Yup i extracted aygshell and shell32 ,hex edited the values, used recmode etc then
used voldeus bgtweak (placed the modified aygshell and shell32 into the root of the internal storage) applied the tweak then soft reset and presto, hang.
Ive done this 4 times and had to hard reset.
Ham3r mentioned about nk.exe having to be patched.
then also having the dumped rom autocertified so this technique can work.
How do i exactly do that?

hii all please teach me step by step to adding transparent softkey bar on my samsung c6625 a.k.a valencia thanks before.. please reply me via pm

Toshiba TG 01 Testmode (WindowsMob)

Here i found a EXE for service Mode.
If somebody need this here is the EXE ( It´s an hidden EXE)
I add an screenshot