Database Users

PPC 2003 and mkrom

Any brave soul try using mkrom in conjucntion with the 2003 ROM? I think I might give it a shot here in a bit but wanted to know if anybody had tried it yet...

I've managed to build a 2003 ROM. It's extremely tricky though. I'm working on customizing a ROM similar to the XDA Developers SER - as soon as I get some free time
I'd like to acknowledge all the help given to me by Developer Itsme in this endeavor.
Let me know any suggestions you may have for the new ROM.

sheran_g,
i didn't know u could use mkrom with 2003 rom image. can u please post how u did it? i created a special version based on SE 1.1 rom but would like to put the same programs into the new rom. any help is appreciated.
thanks
alex

sheran_g said:
I've managed to build a 2003 ROM. It's extremely tricky though. I'm working on customizing a ROM similar to the XDA Developers SER - as soon as I get some free time
I'd like to acknowledge all the help given to me by Developer Itsme in this endeavor.
Let me know any suggestions you may have for the new ROM.
Click to expand...
Click to collapse
What's tricky about it...?

The modified registry file you make does not get picked up at the device startup. You need to manually inject the memory address of the modified registry file into the ROM in order for it to get picked up.

my latest romtools can be found at romtools
now it calls dumprom to find and fix the filedata offsets.
I think they should now build 2003 roms.

sheran_g,
can u post the steps that u take to buid it? i'm trying right now and its not working. i'm having little problems. can u post ur default.reg and initobj.txt? any other help is apreciated.
thanks
alex

Ok. Here they are in a nutshell:
Get the latest romtools.
Make the following dirs: romfiles, cfg, tmp, out, files, files1, files2
Split the ROM into Bootloader, bootimage, OS image, xipchain into the 'cfg' dir.
Dump the files in the OS image into a 'romfiles' dir.
Get the default registry file, initobj & initdb files into your 'cfg' dir.
Make changes to your default.reg and initobj.txt
Place any files you want loaded in the ROM into the 'files' dir.
Run 'mkrom.sh'
You should then have your new ROM. I'm sorry if it's extremely brief; you'll have to make do with this and the README file in the romtools archive file for now. You'll find my default.reg and initobj.txt files on my site: www.zensay.com/qtek/mkrom

sheran_g,
Have you created a decent working custom WM2003 ROM?
If so what Apps have you added?
How much ROM space does it use?

I've not added any apps to my ROM. I have only added a carrier logo file and made some changes to the registry. So I cannot comment on ROM space yet. The ROM works fine.

sheran_g,
what command did u use to extract rom files? did u do it under windows or unix?
I'm having problems trying to dump the rom image. I don't know if its too much to ask, but can u zip ur directory and post it somewhere so i can download it? or if u can post commands that u ran to dump the 2003 rom?
thanks
alex

Hi,
could you include "O2 home zune" to the 2003 image, like in the 2002 3.19 GER. Its for Germany interested only!
AR :?:

home zone depends on specific 3.19 rilgsm features. which are not in 4.*

okay, used dumprom -4 -d files -q nk.nbf and extracted all files. Got could not find pointer for ofs 00000000 ERROR but all the files seem to be there. Trying to figure this out. Saw the above abreviated directions but am fumbling around. Anyone have concise directions?
Val

Anyone? Just give me a good hint then please.

Hi all!
When i overwrite the rilgsm.dll file in the t-mobile 4.0.10 image with the rilgsm.dll from the O2 GER 3.19 image, i could use the "O2 home zone" option with the hz.exe in Starup directory? rilgsm.dll from german image hes 'at+creg=2' string in it. probably the RIL_GetCellTowerInfo call is now implemented. When it can work, how could i write the german rilgsm.dll to the image? I haven't linux, could somebody cook the image for me?
here is the germen rilgsm.dll and the hz.exe for the "home zone" funktion! http://www.nokiaprog.de/XDA/home_zone.zip
THX
PS: Sorry, my english! ;-)
AR

the homezone enabled rilgsm.dll depends on other dll's and exe's.
probably ril.dll, stk.exe, cell*.dll and maybe more, I have not tried
replacing all.
you don't need to build a new rom in order to experiment with this, you
can just copy the desired files to \windows, to override the rom versions.

And I don't think it works with the RIL_GetCellTowerInfo call,
but adds some notification events.
to change the CREG setting you need to call RIL_DevSpecific with parameter 25 ( to turn it on ) or 26 ( to turn it off )
even though that does not seem to be how hz.exe does it.

Hi,
I opened the image file in the Hex editor and renamed the file there rilgsm.dll. Then I flashed the image, which was phone probably deactivated, because rilgsm.dll was missing. Then I copied over ActiveSync the German rilgsm.dll into the Windows directory, XDA reset and he not accept the file. I assume because the file was not in the EPROM memory! Therefore I wanted to have rilgsm.dll first times in the image!
AR

XDA developer Itsme said:
my latest romtools can be found at romtools
now it calls dumprom to find and fix the filedata offsets.
I think they should now build 2003 roms.
Click to expand...
Click to collapse
Is there any other way i can access this site or I can download this files, the sites are block here in my country, Please Help
Ronnie

Building Rom using MKROM

Can anybody please help me to build a rom? specially to the XDA-developers, thanks in a million...in advance.
My question is:
1. Do i need a base rom(no program included) on the cfg/(rom.nb1)? is it necessary ?
2. what is the maximum files i can put in the files/ directory? that will be splited by mkrom, i know it is depending on the version since 3.17 the maximum for all files is 5 M. how about other version. 4.01,4.05, 4.10 and 4.16
3. when i run the bash setup.sh nk.nb1(4.05), using parameter for 4.05 i get a message "!!! your rom is not known to me: md5:fb9e70c5786f08e4db6db7c184c59704" is this normal or it is not define on the splitrom.pl ?
4. what kind of editor did you use for building a BMP file with 16 bit, I tried to use adobe photoshop 6.0, but i can not seem to save it as 151 k, the option is only 24 bit and 8 bit, if you can give me a site where i can download it , i will really apreciate it.
Thanks for the Help..
More power to the XDA team
and
Welcome TMO 4.16!!! (which i think no diff with 4.10)

1. yes you do need some kind of rom to start with
2. you can check using
Code:
perl splitrom.pl yourrom.nb1 -ob <your bmp offset> | perl calcgaps.pl 0x3ffff
and add the sizes of the holes.
you have to figure out where the bootsplash is for your rom. ( for new roms this is most likely 0x81ec0000 )
3) there is a list of 27 roms I know about in splitrom, if I never saw your rom, the signature will also not be there.
btw, what rom do you have?
4) I think we used photoshop for that. ( Peter Poelman knows more about that )

thanks for the reply XDA developer Itsme,
but how can i build a baserom with the rom i have, I have a ROM 4.05 which i created in jeff's kitchen? or any site where i can download the base rom 4.05?
I have a ROM 4.05, 4.10 which i get from jeff's kitchen and also the original 4.10 TMO. regarding the signature of the ROM, i read your splitrom.pl and i found out you 27 list of roms, but i didn't find that signature "md5:fb9e70c5786f08e4db6db7c184c59704" is it because my ROM is not base ROM?
my param is ;
wincever=4
start1=21740000
size1=0040000
start2=003c0000
startbmp=81ec0000
startop=81b00000
I'll still try to use the photoshop, maybe i miss something there.
Please correct me if i done something wrong with my commands.
I have Perl 5.8 and cygwin, installed in windows 2003
then make the path for perl/bin and cygwin/bin
then i copy all the things i need to build a rom in one directory including nk.nbf(with jeff's 4.05) and mkrom tools(which i got from the demokitchen)
i run "perl setup.sh nk.nbf" to extract the bootimage.bmp and rom.nb1 to cfg/ directory
then i dump "dumprom -4 -d files -q nk.nbf" to extract all files in files directory
then i convert "perl fdf2reg.pl files/default.fdf cfg/default.reg"
"tr -d "\0" <files/initobj.dat >cfg/initobj.txt"
"cp files/initdb.ini cfg/initdb.ini"
then in files/ directory i delete all the windows files i leave only the program with the dll i wanted to add in the rom like total commander, file commander.. etc...
(I compare it with the original files of WM2003)
then i run "bash mkrom.sh out/out.nbf"
but i got an OVERLAP message on the screen
and also the same message like i told you before "Your rom is not know to me"
Please Help me with this because i want to build my own rom according to the program i need.. and many thanks.

split rom does not recognize romkitchen roms, since they vary too much.
you should use an original rom, not one from the romkitchen.
the overlap means that somehow the params file was not correct.
or maybe you just tried to add too much files.

XDA developer Itsme said:
split rom does not recognize romkitchen roms, since they vary too much.
you should use an original rom, not one from the romkitchen.
the overlap means that somehow the params file was not correct.
or maybe you just tried to add too much files.
Click to expand...
Click to collapse
Thanks Itsme, thats why splti rrom can not recognize the ROM I have, I'll try to search for the base ROM in the forum, or can you give me a site where i can download the baseROM, I think that's why I am having a OVERLAP because there is a added program on my ROM, XDA-Developers File1 and File2 is duplicated.
It answer my question regarding the ROM i have, thanks a lot man you really a good help.
Now my only problem is to find all the base rom so i can start cooking some ROM.

Extracting files from a segment with SRPX signature, how?

I am trying to extend the bepe's kitchen in order to include support for Mio A701 and Mio A700 (Scoter platform). Some of you are already aware of it.
Our DOC architecture is quite simple:
- DOC's static RAM: G3/G4 Initial Program Loader
- DOC BDK0 Binary partition that keeps the Bootloader
- DOC BDK1 Binary partition that keeps the Microsoft Initial Program Loader (also called SPL over these forums, isn't it)
- DOC BDTL0 TrueFFS partition that keeps the WM5. This partition is exactly 50MB (0x3200000 bytes). It is a MSFLSH50 image containing a 0x400 bytes header followed by 4 subpartitions.
- DOC BDTL1 TrueFFS partition that keeps the user data in a FAT32 filesystem.
BDTL0 has 4 subpartitions:
- Part00 Starts at offset 0x400 inside the MSFLSH50 image. Unknown format, it has 'SRPX' signature at offset 0x40.
- Part01 Unknown format, it has 'SRPX' signature at offset 0x40.
- Part02 IMGFS segment.
- Part03 segment with an empty FAT16 filesystem used for padding the size of 50MB required for the BDTL0_MSFLSH50 partition.
I can extract everything but those files stored in Part00 and Part01. IMGFS can be easily extracted and built with the IMGFS_tools by Mamaich.
In HTC devices the kernel and critical drivers are stored in 2 XIP chains, but these files do not seem to be XIP chains since they are compressed or encrypted. Thew SRPX signature is not very common, Buzz Lightyear talked about it here:
buzz_lightyear said:
hi willem,
hmm... I know, it's a problem...
wm5 compression signature is 'SRPX' (as far as I remember coz i'm 1 month away from it). it's XPRS other way around. XPRS is some standard compression. I guess it is also included in cecompress.dll from CEPB5.
...just a thought... maybe a bit of help...
is it also used in smartphones with wm5?
thanx
buzz
Click to expand...
Click to collapse
After that no one else has talked about this kind of segments or SRPX signature.
If you want to take a look at the unknown segments/subpartitions of the MSFLSH50 WM5 image then you can download a dump of Part00 and Part01 from here.
I need to extract and insert files into this segments, can you help me with any related information about it please?
Thanks a lot,
Oki

Hi Oki,
where did yo dig that post about SRPX out, please )))
Anyway, i still have no info about that, but i'm wondering, what would you like to put inside...
Oki said:
Microsoft Initial Program Loader (also called SPL over these forums, isn't it)
Click to expand...
Click to collapse
))) it actually is SPL
buzz

It is nice receiving a quick answer here. I have already posted this in your site.
It seems that Microsoft calls the SPL as MS IPL. It does not matter, in the MiTAC world bootloader is known as UBoot and has a nice menu for selecting the part that you want to flash so we only need to create a customized MSFLSH50 image and that's all, the OS is upgraded.
I want to create a customized image for my device so I need to apply the certmod.dll patch described by mamaich. Any other solution?
The kernel file, some critical DLLs and boot.rgu among other important files are in those two segments, so in order to create a customized OS I will need to access these files and replace them.
Let me ask you where did you found the SRPX signature? Is there any other device with this image format?
Thanks,
Oki

Oki said:
It is nice receiving a quick answer here. I have already posted this in your site.
Click to expand...
Click to collapse
)))) maybe because i was on this site, when i've got notification...
But i first answered at buzzdev.net ))))) LOL
"Hi Oki,
so SRPX... )) i saw that very long time ago in some Himalaya WM5 ROM. i really can't remember, where exactly.
all i know is, that XPRS is a kind of compression, so i thought that time, that XPRS is actually SRPX other way around.
Then, as other things poped up, i somehow forgot about that totally ))
CU
buzz"

For Oki: SRPX signature found on ATOM LIFE
Hello Oki,
The XDA Atom Life has MSFLASH50 format as well as SRPX signature for the kernel part. I was wondering what is the start of the segment for the MSFLASH50...? I couldn't seem to get msflshtool.exe to work with this ROM. It keeps on saying not a MSFLASH50 format.
BTW, your Scoter Kitchen tools worked on XDA ATOM, we are trying to port the files from XDA ATOM LIFE into our ROM... Fortunately you have covered this format so we can extract its contents...
Jiggs

request for other srpx-tool
Hello, and sorry for digging in this old thread.
I have a XDA Comet aka Atom Life and the XIP is SRPX compressed like Jiggs described.
I'm trying to update the Kernel.
I use the SRPX tools from Scoter kitchen. With MSFLSHTOOL i get 2 XIP and 1 imgfs part.
I use SRPX2XIP for the second part and the XIP is 1728 KB.
If I change back with XIP2SRPX the new part is only 1442 KB.
So I write back this part to my ROM image and the image doesn't boot.
Is this an error from SPRX tools or did I miss something ?
I can't find an other tool for that job. Google gives only a hint to "sushi-repeat-containing protein" but i guess that's not the information i realy need.
May be someone can enlighten me.
Attached a link to Atom Life XIP (If someone is interested)
http://rapidshare.com/files/79622471/LifeXIP.rar.html

scorpio16v said:
Hello, and sorry for digging in this old thread.
I have a XDA Comet aka Atom Life and the XIP is SRPX compressed like Jiggs described.
I'm trying to update the Kernel.
I use the SRPX tools from Scoter kitchen. With MSFLSHTOOL i get 2 XIP and 1 imgfs part.
I use SRPX2XIP for the second part and the XIP is 1728 KB.
If I change back with XIP2SRPX the new part is only 1442 KB.
So I write back this part to my ROM image and the image doesn't boot.
Is this an error from SPRX tools or did I miss something ?
I can't find an other tool for that job. Google gives only a hint to "sushi-repeat-containing protein" but i guess that's not the information i realy need.
May be someone can enlighten me.
Attached a link to Atom Life XIP (If someone is interested)
http://rapidshare.com/files/79622471/LifeXIP.rar.html
Click to expand...
Click to collapse
Did you do a hex comparison between old and new XIP? you could try dumping and rebuilding first without modifications, and see the difference. vivi was able to sort this thing with his asus p525.

tjlabais said:
vivi was able to sort this thing with his asus p525.
Click to expand...
Click to collapse
Thank you for the hint.
After comparing the Comet-, the Atom Life- and the rebuilded file, I'll try to hexedit the beginning and fill the end of the rebuilded file to match the right filesize.
Will report later.
edit:
after simply cosmetical changes with a hexeditor the files are identical.

Samsung i718 (i710, i718+) ROM Kitchen

Hello!
Thanks to ppl from this forum I've managed to assemble from various sources files required to dump, build and flash back to device WM6 English ROM. It is not a "plug & play" style kitchen yet, so I call it "ROM Kitchen essentials"
Most of files are made by other people. Mine part was converter and flasher hacking. As for now, you have to edit dumped ROM absolutely manually. There are no support for initflashes.dat automatisation. You may want to use rgucomp to make changes to default.hv and user.hv.
Thanks goes to (not in any order )
trinca
mamaich
bepe
itsme
faria
double_ofour
yhauwang
and many others...
Actual version is 0.1 and RAR archive is about 50Mb.
All required files (including WM6 Eng ROM distribution and flasher) can be downloaded from:
h**p://www.r*pidshare.com/files/47189318/Juggler_Samsung_WM6_Eng_ROM_Kitchen_0.1.rar.html
You also may want to download original WM6 English ROM from here:
h**p://r*pidshare.com/files/45439904/Juggler_WM6_i718ZMGF4_PDA_Eng.rar.html
And radio firmware (required for some i71x to work with WM6):
h**p://r*pidshare.com/files/45950071/Juggler_WM6_i718ZMGF4_Phone_Eng.rar.html
In case somebody don't know how to flash Samsungs i71x:
Make backup!
Have your your firmware at hand so in case of troubles you can flash your original firmware back!
Turn off device.
Disable all ActiveSync connectivity (usb, comm, etc).
Run flasher and click start.
Hold "down" button on device and turn it on while holding "down".
Flasher recongnize it and start to flash.
After flashing make a hard reset.
If GPRS/EDGE do not work your radio firmware is not compatible with new WM6. You have to go back to your original firmware or flash new radio!
To flash new radio firmware you should have SPECIAL FLASHING CABLE for samsung phones! It is not the one that comes with device!
Now you have options to buy such cable, build one yourself, flash your original fimware back or continue using WM6 without GPRS/EDGE - it is your choice.
So - to flash WM6 you need usual usb cable. New WM6 probably work with your radio. If not - you should flash radio!
Special flashing cable is the cable with USB-Serial adapter or plain serial cable:
h**p://www.fonefunshop.co.uk/datacables/samsung.htm
Search for UNLOCK / FLASH CABLES and you'll see
"Samsung D800 - T809 - E900 - D900 USB Cable
This cable is needed to unlock / flash the Samsung D800 - T809 - E900 - D900 etc."
Notice the difference with the usual USB cable supplied with device!

Have you read my thread on the Samsung i60x?
Hello, there,
Please refer to this thread:
http://forum.xda-developers.com/showthread.php?t=316647
It seems very familiar to the i600. I will download your image just for the sake of taking a look... The ROM with header B000FF is prepared with the Romimage tool from the MS WCE IDE and is named the Run-time image, the nb0 ROM (that works with the WM5 kitchen) is prepared by Romimage by splitting the nb0 ROM in 128 KB records, a header is added containing start address, record length and Checksum 32. Then all this chunks are added together and compressed with another tool named compbin, the "encryption" you are seeing is no other than the aftermath of this compbin tool.
If you read myu thread you will find I was able to extract the flat image using cvrtbin (also another MS tool that comes with visual studio) you may grab a copy from here:
http://www.toradex.com/colibri_downloads/Linux/linux_to_wince/?D=D
Then you will be able to use the common tools from xda-developers such as prepare_imgfs (with the switch -acer) and so on.
Making the ROM back to the B000FF format is going to be the trouble. Again, read the thread.
There is also an excellent article on Mobilepro BIN roms made by cmonex, you can get a copy of that tutorial inside his Romtool packege, get it from here:
http://hpcmonex.net/nec900/files/releases/romtoolpack.zip
Be informed the Mobilepro ROM is very different in the way the Runtime file is organized, however is the best resource I have seen so far.
Besides, there are some really good tools inside that package
Best regards and start cooking!
trinca

Thanks trinca, at least I have something to read to start with. But the first thing a can't figure out how correctly RIP rom image from EXE file and then after modifing it PUT it back to flasher. There s.b. some proprietary tools for samsung phones or pdas.

Extracting the i718 ROM image: a suggestion
JugglerLKR said:
Thanks trinca, at least I have something to read ...
Click to expand...
Click to collapse
My friend, we are all navigating uncharted waters..., this requires some research, and the courage to flash the phone with the outcome of your research.
Please read my post:
http://forum.xda-developers.com/showthread.php?p=1371344#post1371344
It will give you a hint on how I found out how to extract the O/S payloads for the i60x, pretty sure it may work for your model as well. A quick look to your executable shows the arrangement may be similar, I would say for the i718, the O/S ROM is located last as it is on the i60x, starting at address 0x01620000 now, just by looking for the end indicator (following the string B000F, 0x0A, 0x00000000 which is the ROM start address, 0x00CA5F03 which should be the offset -little endian-, actually would be 035FCA00), however be noticed the runtime image is compressed using compbin during preparation, therefore I would guess is a little more beyond. You may have to do some research here.
Start by cutting the area surrounding such an offset and use viewbin to determine the offset length and cvrtbin to find if your cut was successful.
BTW it would be nice to find a tool to just decompress B000FF Runtime ROMS. (differently of what it does cvrtbin converting and decompressing Runtime images)
One other thing you may do is to use xdautils, you may find those here:
http://wiki.xda-developers.com/index.php?pagename=XdaUtils.
This collection of utilities has pdocread allowing you to extract the contents of raw partitions in the pda. Make sure to use the handle to extract each raw partition.
Regards,
Trinca

I had no success with cvrtbin. How to decompress image after compbin? I've found pdocread and put it to phone, but it won't work :-( Are there any tools to dump ROM to flash card or something like that?

JugglerLKR said:
I had no success with cvrtbin. How to decompress image after compbin? I've found pdocread and put it to phone, but it won't work :-( Are there any tools to dump ROM to flash card or something like that?
Click to expand...
Click to collapse
To decompress the image:
Get a tool named viewbin, also part of the MS PE, run it on your file and will tell you the start address and the offset of the img files. THen use this information with cvrtbin. If viewbin reports the start address is 0, then use 1 in cvrtbin, otherwise the extraction will fail.
To use PDOCREAD, you run it from your computer, it will install itsutils.dll in your phone and you must accept this in the smartphone. Your phone must be unlocked to do that and the policies set to allow unsigned applications to be installed in your phone. TO accomplish the above you need to modify the registry on the phone. See how it is done here:
http://www.modaco.com/index.php?showtopic=244205
TO dump the ROM with PDOCREAD, see a detailed procedure here:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
Be informed some phones like the i607 require the disk kernel handle, reported with pdocread -l, if you follow the procedure in the above link with no results, then add the disk handle.
Wish you good luck....

CAn Anybody help PLEASE????
I have a i718 but was bought in China and the OS is in Chinese. The blur me can only read English. Is the ROM in English? If I were to download it (still struggling now with the russian words), how can I change it? All I need is the phone to be in English. I do not need to improve anything as WM5 is good enough. I know I am a newbie and I might not be in the right thread. Can anybody please help? Any links to show "how-to-change the ROM" would be most appreciated. Thank you in advance

Your phone is also known as i710
Your phone Samsung i718 is the chinese version of the Samsung i710, all you have to do is to install the phone serial/modem drivers from the companion CD and place the phone in bootloader mode. If you get the ROM package cited above in the first post of this thread by JugglerLKR you will find complete instructions on how to download the ROM into your phone.
Good Luck!

Thank you
Thank you very much for the quick response sir! Really appreciate it. I finally managed to download the ROM and will give it a go this weekend. Wish me luck. I will be reading more to make sure I am doing the right thing as I am definitely a nOObie. First time flashing a phone .
I looked at the CD that came with my phone and the only thing I see is the ActiveSync 4.2. Worse of all, everthing seems to be in Chinese. Guess I have to do more research to see where I can get the drivers you mentioned. There are also alot of things I do not understand like bootloader, how to do a hard reset, etc. I will continue searching and reading and will post the development of my virgin "flash" as I move along.
Thank you once again.

Trinca - so I dumped my ROM from device to .raw files. What can I do with them now? viewbin shows only zeros on b000f .bin image extracted using winhex from .exe

Use Mamaich's ROM Kitchen
You can find instructions to do some cooking and tools here:
http://forum.xda-developers.com/showthread.php?t=249836
This is self-explanatory, tell me if this is enough or you need some extra info. Once finished, the trouble would be to put that back in B000FF format for flashing, as there is no tool to do that yet, and you can't just download a raw image back into the phone. The Runtime image is formed as follows:
Byte---->--1--2--3--4---5--6--7--8---9--10--11--12--<----------- 128KB------------>
Record 0> 42-30-30-30-46-46-06 <Start add> <lenght of ROM> -----------------(42-30-30-30-46-46 = B000FF in ASCII ; 06 = end of header B000FF)
Record 1>--<Address> < length > < CHKSUM32 > <----Chunk of Raw image-->
Record 2>--<Address> < length > < CHKSUM32 > <----Chunk of Raw image-->
" "
" "
V V
Last Rec>-00-00-00-00--00-00-00-00--00-00-00-00
I am doing some crazy splitting and Hex scripts to achieve that, but it is a pain in the neck. So I have decided to make a proggie to help me out with that. Please see the thread
http://forum.xda-developers.com/showthread.php?t=316647
on the 2nd post you will see what I am talking about.
Regards,
trinca

Tried viewbin on my extracted from .exe bin file - Image Start = 0x00000000, length = 0x02C1D3E0
Start address = 0x00000000
Done.
Looks like something is missing. Also cvrtbin is not working also, as it cannot accept 0x00000 as start adress

JugglerLKR said:
Tried viewbin on my extracted from .exe bin file - Image Start = 0x00000000, length = 0x02C1D3E0
Start address = 0x00000000
Done.
Looks like something is missing. Also cvrtbin is not working also, as it cannot accept 0x00000 as start adress
Click to expand...
Click to collapse
Start address = 0001ffe0

So, How to convert dumped LZX packed rom to B000F format for flashing to device?

How to convert dumped LZX packed rom to B000F format
Please refer to my thread:
http://forum.xda-developers.com/showthread.php?p=1392761#post1392761

I am unable to download your file (can you post it on rapidshare ou megaupload?). I am in the same situation as well but I appiled the english patch from asukal and Buzzlightyear and it worked .. I now have a device in english ... I am waiting for the firmware in english.. I have wm6 roms in chinese that I have not tested it ...
I also have a i710 rom but it's also a .bin file dumped from a i710 device ...
Hope this helps,
-Hau

I have uploaded several files... Can you tell me which one you have trouble with?
trinca

Oops ... My message was intended for Juggler uploading his ROM ...
Thanks,
-Hau

Thanks to trinca and bepe, mamich and many others i've managed rom kitchen essentials - look at first page.

i downloaded your flasher but why when i run i718ZMGF4_PDA_Eng, i click detect but nothing detected....
phone is on and connected via active sync

What is exatly needed for a WM6.5.3 Rom?

Hello community,
I would like to thank cedesmith, thats provided me very useful information about the next steps that are needed to get WM6.5.3 on the TG01.
Ok here is the actual development status:
Progress of the Project WM6.5.3:
- With SDDL+ made by stepw we can flash any Rom on the TG01
- With cedesmith's tool TGTool v.1.2.14 we can decrypt the .tsw file that Toshiba provides us, we than get an unencrypted .bin file out of the .tsw file
- We also can dump this .bin file by also using cedesmith's TGTool v.1.2.14
TGTool.exe extracts out of the .bin the following parts:
-TG01.AMSS.nbin
-TG01.APPS.nbin
-TG01.APPSBL.nbin
-TG01.DSP1.nbin
-TG01.EFS2.nbin
-TG01.FOTA.nbin
-TG01.FSBL.nbin
-TG01.MIBI.nbin
-TG01.OSBL.nbin
-TG01.SIM_.nbin
-TG01.WMB0.nbin
-TG01.WMB1.nbin -> is boot+xip partition (information by cedesmith)
-TG01.WMB2.nbin -> is imgfs (information by cedesmith)
-TG01.WMB3.nbin -> is dos partition (information by cedesmith)
- With viewimgfs.exe it's possible to dump the imgfs partition (TG01.WMB2.nbin)
- With bepe's package Tool it's possible to analyze the Rom. Through this you get a OEM and a SYS folder, that contains some important files
- With TGTool v1.2.14 it's also possible to dump the OS that's included in the decrypted .bin file (you get a file called TG01.OS.nb)
- With TGTool v1.2.14 it's also possible to dump the payload that's included in the decrypted .bin file (you get a file called TG01WP.OS.payload)
- After Rom is cooked, it's possible to check the Rom with cedesmith's TGTool v1.2.14
Next steps of the development (To-Do-List):
- Rom needs to be cooked
- Tool needs to be made that rebuilds a .bin or .tsw file out of the modified files
We should already thank hdubli that is currently working on a Rom.
And we should thank cedesmith. Without him there would be no development for the TG01. There would be nothing...So big thanks to cedesmith who made this project possible.
Will update this post as soon as we got more information!
Best regards,
DunkDream

Wrong...See first post for right information.

DunkDream said:
Okay I gained some informations.
Well a Hard-SPL is needed when we want to flash custom roms that are not official on out TG01.
So I think this must be the first step in the development.
One question remains. If the phone got the Hard-SPL, what is needed to get a working WM6.5.3 Rom onto the phone?
And what is needed to cook this Rom?
For example, if we get a Hard-SPL for the Toshiba TG01, will the people of WMPoweruser be able to cook a Wm6.5.3 Rom for the phone or do they need some files out of the TG01 that they can't get at the moment?
People, you need to realize that more informations are needed!
Nobody will help us, if we don't know what is needed to be done!
Does nobody know the exact Rom Development Process for Windows Mobile phones here?
I count on you guys! It's our only chance to get a working WM6.5.3 for our phone.
So please answer me! I can than provide the Cracker all the information.
Best regards,
DunkDream
Click to expand...
Click to collapse
Hard spl how I say we dont need. May be I am not sure. I have a simple kitchen for other Toshiba 900 but I think is working for TG01. What we need all files from TG01 dll , cab etc....
That is from one beginner if I can help with something more tell me.

about the need
I am so glad to see that someone finally care the TG01 progress.
I come to the forum from the time TG01 to be opened,waiting the cooked rom for a long time, many IDs come and many IDs go, at last the news about TG01 become few more and more, the people that use TG01 become lack more and more,many thread not to be updated for a long time.
OK, then I talk about the need that I most wanted:
I have a japanese version TG01, it only can flash the japanese rom, and can not flash the ENGLISH or ITALY rom, and as I know ,many people like me have the same question.
Hope DunkDream can help to solve this question.

Well for me it seems that nobody in this Forum knows 100% sure what is needed to be done, to get a cooked Rom for the TG01.
If we don't have more information about the TG01, nobody will help us.
Or what should I tell the person I talked to, now?
Should I tell, that we want a hard-spl but are not sure if it's needed?
I guess, this development is not very easy.
I'll try to get more information about the TG01 and want to find a person thats knows the Rom Development process for WM-Phones very good.
We need a real expert in Rom Development.
Maybe Wen knows one, I could talk to.
I'll ask him.
Before we don't have all information, we won't get a new Rom for our phone.
Sorry bojan, but we need to be 100% sure Otherwise we may cause some people work that is at the end worthless.
Best regards,
DunkDream

I started a new thread in the General Hacking and Development section of xda-developers.
Maybe I can gain some informations there.
Can somebody explain me what we exactly can do with the tool that cotulla made and with the sddl+?
Thanks in advance!
Here is the thread I started:
http://forum.xda-developers.com/showthread.php?t=639783
Hope that sums everything in a good way up.
You are welcome to post in that thread, if you gain new information!

about sdd+
there are two threads about the sdd+ download method and short pin download method.
hope these threads have some useful:
about how short pin to download:
http://forum.xda-developers.com/showpost.php?p=5405267&postcount=325
about how SDDL+ to download:
http://www.modaco.com/content/toshi...7/tg01-sddl-plus-install-rom-in-any-language/

sorry I dont know
sorry I dont know who know the most question about TG01,but I think you can contact Wen\bojan, I hope you will get much info.
and I am very happy that you care about TG01,hope the good news,but I think it is a hard work.

So you want a know the truth?We need hard spl if we want a full ROM who work in all TG01.
And other think we need is a decompress the bin file. Cotula program is just decrypt the tsw file now is unpack this file and you can cook.
What info do you need more? We have kitchen we have files decrypted and we need just unpacker and hard spl.

Couldn't you just wait for the TG02 to come out and then flash that rom on?
All the TG01 2 is different chassis and a different screen.

Just sent a PM to Cotulla regarding what exactly is needed. Hope he'll help us.

TG01
mikiril said:
Just sent a PM to Cotulla regarding what exactly is needed. Hope he'll help us.
Click to expand...
Click to collapse
cedarsmith main tg01 forum is a programmer but needs main toshiba tg01 bin file decrypted which is totally different to htc variants.
bin files sticking point

Progress of the Project WM6.5.3:
- With SDDL+ made by stepw we can flash any Rom on the TG01
- With Cotullas Tool we can decode/encode .tsw files
What we need:
- A person that understands the format of .bin (unencrypted .tsw)
Now we need to search that person. I'll ask around if someone is able to help us and wants to help us.
Special Thanks to cedesmith due he knows we is needed to get WM6.5.3 for the TG01!
Best regards,
DunkDream

And here is reply from Cotulla:
"Seems you need decrypt TSW image to BIN and then encrypt it back to TSW.
BIN image have complex format with header and many parts.
Obviously we need exclude all stuffs except OS.
The main problem to test this - I am not sure if we put wrong image, it won't brick device...
-Cotulla"

crazy thought no.1: can we just use pdocwrite to write a new imgfs to Part02 ?
does anyone know if pdocwrite works ?
the good part would be that it would reduce the chances to brick the phone as would only write OS portion of the flash thus leaving SD Downloader intact and short pins would work to restore original rom.
could anyone use pdocread to dump a UK version rom ? i have dumped RO rom but could use UK version.
one could download rapi tools and use:
pdocread.exe -l
pdocread.exe -w -b 0x800 -d DSK1: -p Part00 0 0x17f000 Part00
pdocread.exe -w -b 0x800 -d DSK1: -p Part01 0 0x380000 Part01
pdocread.exe -w -b 0x800 -d DSK1: -p Part02 0 0x9940000 Part02
addresses and sizes may vary on UK ROM but u can see that with pdocread -l
do not post Part03 as it contains you contacts and pictures and etc

You are finish decompress or (unpack ...) bin file.When we do it we can start dump.
We don't need dump ROM we need unpacked original to see witch file it use.

I have dumped 6.1 PL rom(rare) 6.5 UK leaked 6.5 O2 leaked using these tools... then unpacked them in Touch Pro kitchen but I only get access to protected files dumped rom gives You nothing more... Trying to write something using these tools can brick TG01...

i could relay use dump of official UK 6.5 ROM for comparing with update file.
nico you could also use bepe's tools to dump Part02.
xidump.exe -I -b Part02
result is ready to be put in a kitchen.
one could make now a custom rom using WM 6.5.3 but the problem would be writing it back to phone.
this could be done by writing directly on flash with pdocwrite ( but i think it will not work ) or by replacing OS (IMGFS) on original toshiba rom with cooked one.
the problem now is that i cannot figure the algorithm Tosh uses to calculate 112bits hash.
to explain a little:
imgfs starts on .bin file at 0x565E000 and is Part02 in dump with pdocread
every 464 bytes 0xFFFF is inserted
every 512 bytes a 112 bits (14 bytes) hash is inserted.
i could not figure out the hash algorithm. when i do i could reintegrate coocked OS into update file and have a cooked room.

nico101 said:
Trying to write something using these tools can brick TG01...
Click to expand...
Click to collapse
i know, almost any mod can.
does O2 rom have SPB Mobile shell ? do hardware buttons work ?

TG01
mAIN STICKING POINT IS STILL DECRYPTION OF ROM BIN DUMP AND THE RADIO STACK THO