Modify XIP - Windows Mobile Development and Hacking General

Hi, I am trying to modify the XIP of Hermes (e.g. modify boot.hv and FLASHDRV.DLL for big storage). Here's my steps:
>nbsplit -hermes os.nb
>RomMaster -w 5 OS.nb.payload -x -o xip.bin
Run the XIPPORT
"dump xip.bin"
"realloc P"
"build xip_out.bin"
write xip_out.bin to 00320000 of OS.nb.payload
>nbmerge -hermes os.nb
Although I haven't modified any file yet. But the reversed os.nb cannot boot after flashing. Anything I have missed? Any idea? Thanks.

Related

Registry workshop question?

Hi,
I would appriciate if somebody could help me with the following.
Currently I'm trying to build my own wm6 rom and conversion off roms is no problem for me anymore.
Next step is changing and comparing registry hives but I'm stuck a little!
The registry hives I'm talking about are:
-default.hv
-user.hv
I downloaded RGUCOMP and also have the Registry workshop.
What I'm trying to figure out is how can I convert *.hv files to files to working registry string so that I can edit and compare them with the Registry workshop.
I do know this but don't understand:
dump default.hv:
1. SET _FLATRELEASEDIR=.
2. RGUCOMP -o default.hv -nologo > default.txt
3. Add 'REGEDIT4' (first line)
4. Last line MUST be empty
5. Save as UNICODE
... edit the txt file ...
build default.hv:
1. rename default.txt to boot.rgu (same folder as RGUCOMP.exe)
2. SET _FLATRELEASEDIR=.
3. RGUCOMP -b
4. rename boot.hv to default.hv
Enter this: "RGUCOMP -o default.hv -nologo > default.txt
", 'you should not see the reg entries, because "> default.txt" redirects the output to default.txt '.
Is there no solution to convert a *.hv file to a working registry string *.reg?
Or maybe there is a solution to export the registry from my device and convert it to a *.hv
I'm new to this and any help would be higly appriciated!
Greetings, Leo
after :
RGUCOMP -o default.hv -nologo > default.txt
you'll see default.txt contain all the regkey.
since default.txt doesn't contain the first line 'REGEDIT4',
so you need to add it.
it's same in user.hv
Won't get it
Hi Leies,
Thank you for your reply,
still don't understand, do I have to name the file REGEDIT4 .txt after created, or the first line in the opend textfile must be REGEDIT4, and what about the empty line, do I tab twice [ENTER] to have that and save the textfile in unicode? Sorry I'm stupid, but I just don't get it, it stays blank, weird? Can you send me a sample so I can see please?
Greetings Leo
Leies said:
after :
RGUCOMP -o default.hv -nologo > default.txt
you'll see default.txt contain all the regkey.
since default.txt doesn't contain the first line 'REGEDIT4',
so you need to add it.
it's same in user.hv
Click to expand...
Click to collapse
one more question
Can I create a subdirectory for this c:\hv files\.. and place the boot.hv and user.hv together with rgucomp files in here, or should it be in c:\..
Thanks,
Leo
not name the file, it's add at the first line..
did you got the dump folder already ?
default.hv and user.hv are in dump folder after you have extracted imgfs_raw_data.bin by viewimgfs.exe . (maybe different when you use other tool)
rgucomp -o dump\default.hv -nologo > default.rgu (or default.txt as you like)
then, default.rgu will stored in rgucomp.exe same folder, not at dump folder.
It may help, just try for dumping default.hv:
1. SET _FLATRELEASEDIR=.
1b. echo REGEDIT4 > default.txt
2. RGUCOMP -o default.hv -nologo >> default.txt
Click to expand...
Click to collapse
No need the 3rd original step and you should be able to open default.txt with notepad
Hi,
Thanks for your answer.
Still don't work, this is the error:
wmain: (RGUComp) !ERROR release directory ".echo REGEDIT4 " does not exist
What am I doing wrong?
Please, please, help.
Leo
naboleo said:
It may help, just try for dumping default.hv:
No need the 3rd original step and you should be able to open default.txt with notepad
Click to expand...
Click to collapse
*.hv
Hi thanks again
Will try tomorrow, today I'm having my birthday party
Greetings, Leo
Leies said:
not name the file, it's add at the first line..
did you got the dump folder already ?
default.hv and user.hv are in dump folder after you have extracted imgfs_raw_data.bin by viewimgfs.exe . (maybe different when you use other tool)
rgucomp -o dump\default.hv -nologo > default.rgu (or default.txt as you like)
then, default.rgu will stored in rgucomp.exe same folder, not at dump folder.
Click to expand...
Click to collapse
Did a bat command sample file. Just rename it *.bat instead os *.bat.txt and run it. It should create both user and defaut registry and open them directly in notepad.
Btw : happy birthday !
Found it
Hi,
Thank you Naboleo and Leies
1. set _flatreleasedir=c:\dump
2. RGUCOMP -o default.hv -nologo > default.txt
3. RGUCOMP -o user.hv -nologo > user.txt
Both added first line REGEDIT4, last line empty and saved as unicode!
Done
I'm sooooo happy
Greetings Leo
Again another question
Hi,
I'm making you grazy I know but this is realy important for me, Im almost there building the rom.
Currently I'm busy with RGUCOMP, I converted user.hv to a user.txt file and edited the strings (just some ringtones to delete), now I'm trying to convert back but it doesn't work, it gives some errors.
build user.hv
1. rename user.txt to boot.rgu
2. SET _Flatreleasedir=c:\dumphv (this is my dir)
3. RGUCOMP -b
4. rename boot.hv to user.hv
The errors:
Buildboothive: <RGUCOMP> !ERROR unable to find required source file "Boot.rgu"
ERROR C:\MacB\private\winceos\COREOS\filesys\reg\reghive \.hive c line 877: FS: Registry Exception Handler
wmain: <RGUCOMP> !ERROR failed building BOOT hive
It makes me grazy haha...
Any ideas
Thanks again,
Leo
Laurentius26 said:
Hi,
build user.hv
1. rename user.txt to boot.rgu
2. SET _Flatreleasedir=c:\dumphv (this is my dir)
3. RGUCOMP -b
4. rename boot.hv to user.hv
The errors:
Buildboothive: <RGUCOMP> !ERROR unable to find required source file "Boot.rgu"
ERROR C:\MacB\private\winceos\COREOS\filesys\reg\reghive \.hive c line 877: FS: Registry Exception Handler
wmain: <RGUCOMP> !ERROR failed building BOOT hive
It makes me grazy haha...
Any ideas
Thanks again,
Leo
Click to expand...
Click to collapse
did your rgucomp.exe and boot.rgu in c:\dumphv ?
if yes , just type :
set _FLATRELEASEDIR=.
rgucomp -b
it could be done .
since i'm lazy than u, so i have wrote a *.bat tfile to do extract and repack process .
* remember boot.rgu , you need to rename it to default.hv and copy to "dump" fiolder .
* if you can't directly copy in ( show error ), you may try this command :
attrib -s -r -h dump\default.hv
and then del it .
PS : Happy Birthday Man !
Converting back
@Leies
Thank you for your quick reply's
I love a vampire like you
It doesn't work yet
Two files I've I copied from the dump directory to compile:
-default.hv
-user.hv
Converted them to:
-default.txt
-user.txt
They are in c:\dumphv together with the tools:
-boot.rgu
-cereg400.dll
-make_boot_hv.bat
-rgucomp.exe
How to do this?
default.txt => default.hv
user.txt => user.hv
After that I can copy them back to the dump and start build_imgfs, would be great
I'm enjoying my birthday
Cheers, Leo
Hihi, i seen your post in universal , so i guess that you're cooking a uni rom and using helmi_c method , since i had cooked many for my uni , but not using helmi_c 's method , so maybe something differents ...
ok , let's go ,
when you use "rgucom -b" , the file name of default.hv should rename to boot.rgu , after rgucom success , it'll create a file "boot.hv" and copy it to dump\ and rename to default.hv ,
same as user.hv , should rename to boot.rgu when "rgucom -b" , after rgucom, it'll create a file "boot.hv" and copy it to dump\ and rename to user.hv ,
maybe you can use this to create a bat file and it will auto finish for you .
you can add "pause" if you like to see some information when batch runs.
cd\
cd temp
copy default.rgu boot.rgu
set _FLATRELEASEDIR=.
rgucomp -b
PAUSE
attrib -s -r -h dump\default.hv
del dump\default.hv
copy boot.hv dump\default.hv
del boot.hv
del boot.rgu
copy user.hv boot.rgu
set _FLATRELEASEDIR=.
rgucomp -b
attrib -s -r -h dump\user.hv
del dump\user.hv
copy boot.hv dump\user.hv
del boot.hv
del boot.rgu
PAUSE
BuildImgfs
PAUSE
make_imgfs nk.fat -nosplit
Your so helpful
I'm starting to love you.
That's dangerous isn't?
Anyway, thank you, thank you, thank you
Will let you know how rom is progressing if you like?
Leo
Leies said:
Hihi, i seen your post in universal , so i guess that you're cooking a uni rom and using helmi_c method , since i had cooked many for my uni , but not using helmi_c 's method , so maybe something differents ...
ok , let's go ,
when you use "rgucom -b" , the file name of default.hv should rename to boot.rgu , after rgucom success , it'll create a file "boot.hv" and copy it to dump\ and rename to default.hv ,
same as user.hv , should rename to boot.rgu when "rgucom -b" , after rgucom, it'll create a file "boot.hv" and copy it to dump\ and rename to user.hv ,
maybe you can use this to create a bat file and it will auto finish for you .
you can add "pause" if you like to see some information when batch runs.
cd\
cd temp
copy default.rgu boot.rgu
set _FLATRELEASEDIR=.
rgucomp -b
PAUSE
attrib -s -r -h dump\default.hv
del dump\default.hv
copy boot.hv dump\default.hv
del boot.hv
del boot.rgu
copy user.hv boot.rgu
set _FLATRELEASEDIR=.
rgucomp -b
attrib -s -r -h dump\user.hv
del dump\user.hv
copy boot.hv dump\user.hv
del boot.hv
del boot.rgu
PAUSE
BuildImgfs
PAUSE
make_imgfs nk.fat -nosplit
Click to expand...
Click to collapse
Last one
Hi Leies,
Must be something else!
Here's my story if you want to read.
My device: Universal
The rom I'm trying to build is WM6
I'm using a nk.nba ('Rom' folder) out of Helmi_C's kitchen.
The only thing I want to do is to take some ringtones out there!
So here it is:
cd\
cd\dump
prepare_imgfs nk.nba -nosplit
viewimgfs imgfs_raw_data.bin
dump directory created.
Take the ringtones out.
Maybe here I'm going wrong, I need to edit User.hv and default.hv to take the registry values out, wright ?
It works ok if I leave User and default.hv beside but when i look in my phone under ringtone settings the values are there but when I select them as ringtone the ringtones don't exist's, so that's uckly.
Yes, and I also edited the initflashfiles.dat in the responsable OEM
Next I copy to the dump directory:
boot.rgu
cereg400.dll
make_boot_hv.bat
rgucomp.exe
cd dump
set _flatreleasedir=c:\dump
RGUCOMP -o user.hv -nologo > user.txt
I edit the text and save it as unicode textfile.
Still in dump directory.
RGUCOMP -b
So know user.txt is in boot.rgu
I change the name to user.hv
Same for default.hv
batchfile's are coming later, I'm not so fast as you
Both I copy back to my dumped 'rom' (from here I took them in the first way, so I overwrite them with the new ones)
build_imgfs imgfs_raw_data.bin
make_imgfs nk.nba
Done, ready to use for kitchen. (but not when I edit the *.hv?)
Cheers, Leo
b.t.w. You builded some Roms before for the Universal isn't?
I need to no this please, because I've got the feeling that I'm close to rombuilding, this is the last key that has to suite.

NBHextract to nb , but just Htcrt.exe cannot flash rom

sorry for that , It seems solved
He everyone,
I try to use Kaiser_Kitchen to compile ROM ,
but finally found one thing.....
the first step extract OS.nb cannot flash ROM
1.NBHtract RUU_signed.nbh
2.use Htcrt , choose Polaris , Model POLAxxxxxx , System OS choose OS.nb
3.use Polaris CustomRUU flash ROM , but stop at "Smart Mobility" screen.
If I just use CustomRUU flash Rom , everything ok ,
If extract OS.nb then compact NBH , can't flash Rom
how can I do ?
ps. tool is from Swtos :
http://forum.xda-developers.com/showthread.php?t=373482&highlight=Swtos_WM6.1_polaris_kitchen
sorry for that , It seems solved , but I have problem dump XIP from other rom.(my ROM still fail , too)
still trying.............
..\tools\RomMaster.exe -x -w 5 -b 0x320000 OS.nb.payload -o xip.bin
this the error code:
[Info] It is a common ROM.
[Error] File is damaged, end address small than start address.
[Error] File is damaged, end address small than start address.
xip.bin: No such file or directory
RomMaster.exe -x -w 5 -b 0x020000 OS.nb.payload -o xip.bin
udK said:
RomMaster.exe -x -w 5 -b 0x020000 OS.nb.payload -o xip.bin
Click to expand...
Click to collapse
It works ..........
Thanks very much

Extracting XIP.bin from NK.NBA (MPX200)

Hi All,
I am trying to extract the xip.bin portion from the NK.NBA file (mpx200).
When I use rommaster I get an xip.bin file which I can use with XIPPORT but I don't like the size of this file. I do get usable files as output from XIPPORT
I use:
ROMMASTER -w 5 -b 0x001000 nk.nba -x -o xip.bin
it produces:
C:\romtool\XIPtool>rommaster -w 5 -b 0x01000 nk.nba -x -o xip.bin
[Info] It is a common ROM.
[Warning] o32_rom(0x820c5ea0)'s o32_data at 0x00000000 is zero.
[Warning] Found dif-referenced region [OLD] Address=0x821732a0 Length=0x00
014e00 ObjectType=0x00200000
[Warning] Found dif-referenced region [New] Address=0x821732a0 Length=0x00
014e00 ObjectType=0x00008000
[Warning] Memory Block(0x80141000,0x8019ad0c) overlap with Block(0x80142d3
c,0x80142d68).
[Info] New rom filename is 'xip.bin'.
xip.bin is now 33.936.532 bytes ?? it should not be so big ??
Using the file with XIPPORT produces about 1,78 Mb of usable data. I can unpack and pack the modules and files just fine.. creating an xip_out.bin however is not the same size
xip_out.bin is 33.927.840 bytes ??
Any ideas what I'm doing wrong???
Thanks
Thanks to all the ROM Guru's for not keeping this secret
I thought that you guys would be happy when someone is still interested in supporting this old device ??
Anyway to answer my own question:
dump -o 0x140000 nk.nba xip.bin
use this xip.bin in xipport
dump / add / delete / modify as required
write address in xipport 140000
write back in nk.nba
For what you do it?
For istall WM 6.1 ?

XIP extracting ... going from RUU/WWE to XIP.BIN

Starting with ababrekar's brilliant expose' on how to manually port an XIP from one device to another, there has been a great deal of attention paid to the process of getting the XIP.BIN isolated from the rest of the ROM.
I thought that I could try to contribute with the information others have shared with me. Ultimately, it may prove to be beneficial if there were a development thread dedicated to extracting the XIP.BIN.
credit to dcd, vetvito, ababrekar, gguruusa, lennysh. noonski and of course, all those who develop and update the various tools!
First off, you're best off if you start with a RUU/WWE from HTC/Sprint/Bell. etc.
1) The very first step in this process is to extract the NBH file that includes the OS. Do this by using WinRAR or WinZip to open the executable and look for the largest file with the extension NBH. In the case of our example, that file is VOGUIMG.nbh.
2) The next step is to break VOGUIMG.nbh into it's various pieces by executing the following:
Code:
nbhextract.exe VOGUIMG.nbh
The result is the following screen output:
Code:
=== NBHextract v1.0
=== Extract contents from HTC NBH files
=== (c)2007 xda-developers.com
=== by: pof & TheBlasphemer based on itsme perl scripts
Device: VOGU10000
CID: VZW__001
Version: 3.14.605.1
Language: USA
Extracting: 00_SPL.nb
Extracting: 01_MainSplash.nb
Encoding: 01_MainSplash.bmp
Extracting: 02_SubSplash.nb
Encoding: 02_SubSplash.bmp
Extracting: 03_Unknown.nb
Extracting: 04_OS.nb
We are after the XIP, which is contained within the file 04_OS.nb
3) The next step is to break 04_OS.nb into it's various pieces by executing the following:
Code:
nbsplit.exe –titan 04_OS.nb
The result is the following files:
Code:
04_OS.nb.extra
04_OS.nb.payload
We're still not there yet, as the XIP is contained inside 04_OS.nb.payload.
The address where the XIP.BIN ends can be found with imgfsfromnb:
Code:
rename 04_OS.nb.payload to OS.nb.payload
imgfsfromnb OS.nb.payload imgfs.bin
output:
Sector size is 0x800 bytes
ImgFs partition starts at 0x00680000 and ends at 0x05680000
Dumping IMGFS at offset 0x006c0000 (size 0x04fc0000)
Click to expand...
Click to collapse
In the next step, we use RomMaster and we feed it the start address and end address of the XIP.
Remember, these start and end addresses will vary from device to device and in the case of the same device but a custom rom, the address can vary from one custom rom to the other.
Ababrekar has suggested "the best way to find out the start address for each partition would be from the LBA in MBR region"
In the case of the Vogue, when dealing with non-custom ROMs, the XIP usually begins at 0x00320000.
So, the start address is 0x00320000 and you use imgfsfromnb.exe to get the end address 0x006c0000 and feed these two parameters as part of the input to RomMaster:
Code:
RomMaster.exe -x -w 5 -s 0x00320000 -e 0x006c0000 OS.nb.payload -o xip.bin
What this does is output a file (XIP.BIN) comprised of all the data between the two (-s START -e END) addresses (-s 0x00320000 -e 0x006c0000) fed into RomMaster.
XIP.BIN
None of this have I discovered myself. It is a compilation of instructions that I received from members credited above. What we could do with this thread is use it as a discussion point for others who have or are having problems getting the XIP out of the os.nb.payload.
Best regards,
-boggsie
bookmarked!
thank you very much for this information!
Awesome to see people like you getting such amazing info ot inthe open This is bound to help many Thanks and bookmarked to keep an eye on it
Do you know a way to get the XIP from a *.bin emulator image?
frauhottelmann said:
Do you know a way to get the XIP from a *.bin emulator image?
Click to expand...
Click to collapse
Anyone found answer for this?

A programe about XIP.BIN of Blue Angle?

I'm learning rom building.
I used Rommaster.exe to extract XIP.BIN from nk.nba.But nothing (had not xip.bin-no thing).I made Bat file with code:
Code:
RomMaster.exe -w 5 -b 0x001C0080 nk.nba -x -o xip.bin >nul
mkdir XIP
dumprom xip.bin -5 -d XIP >nul
But only XIP Folder was made.In XIP folder- no thing.
=>>>Please help me how to extract XIP.BIN From nk.nba???
Thanks a lot.
Please help me how to extract XIP.BIN From nk.nba???
I made XIP.BIN successfully.

Categories

Resources