Related
Okay, so I've tried everything. PDOCREAD, DUMPROM, pget, grab_it, testdump.exe, FiziFetch. I need help with getting at all of the files and doing a complete ROM dump of the device. The only ROM Dump I have is the one that ETEN provides for upgrading the phone, I have attached that here. EUU.exe is the exe you run on the pc, and normally the rom file is called temp.dat, and it uses the other .exe which is compiled for windows ce to the phone to do the updating process.
Any help here would be greatly appreciated. In particular I want btagext.dll in the /Windows directory and full instructions on how to do it myself for other protected files.
The ROM can be obtained by going to updates.eten.ch and downloading the latest English ROM file for the M600. The direct link is here:
ftp://support.com:[email protected]/Download/Updates/M600/ENG/EUU_M600_WWE_R01_100_0171.EXE
To get the ROM file and the update file, goto your documents and settings/profile name/local settings/temp folder and clear out all the files.
Run the .exe you downloaded from above, and then look in the temp folder you just cleared. You should see a temp.dat which is the ROM file, EUU.exe which is the file that facilitates the transfer of the file to the ETEN M600 and another file USBDLUpdate_Console.exe which is a windows CE compiled file that facilitates the flashing process in some way.
Pdocread part of the itsutils is able to read see some of the information on my device:
pdocread –l lists the following:
122.19M FLASHDR
| 1.03M Part00
| 1.52M Part01
| 33.98M Part02
| 85.47M Part03
1.89G DSK1:
| 1.89G SD
STRG handles: a34cc21e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.89G) e3b41b8a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 85.47M) e3b4153e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 33.98M) 83b41436
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.52M) a3b412be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.03M)
However it is not able to do anything other then that. All attempts at trying to access those partitions or device (flashdr) fail with errors such as these (this is just a small list of commands command options i've tried):
C:\itsutils\build>pdocread -d DSK1
ERROR: ITTFFSGetInfo - The handle is invalid.
C:\itsutils\build>pdocread -d DSK1:
ERROR: ITLogDiskInfo - An exception occurred in the service when handling the co
ntrol request.
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C:\itsutils\build>pdocread 0x0 0x200 foo.bin
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CopyTFFSToFile(0x0, 0x200, foo.bin)
ERROR: ITReadDisk - An internal error occurred.
C:\itsutils\build>pdocread -o -p part03
ERROR: ITTFFSGetInfo: outbuf==NULL
WARNING: using default 512 bytes for sectorsize
C:\itsutils\build>pdocread -d FLASHDR -w
ERROR: ITTFFSGetInfo - The handle is invalid.
Re: Need help extracting files from ETEN M600 ROM will pay $
I don't think that you'll be able to get a working dump of btagext.dll or any other system DLL. It does not have relocation information.
temp.dat in eten upgrade is in some strange format, it seems that data blocks are mixed.
What is the result of testdump.exe? I've attached the WM5 build of this program.
Re: Need help extracting files from ETEN M600 ROM will pay $
I've tried that before. That just dumps some information that is in memory. You can see calendar information, contact information, etc. If you put in 128mb which is the ROM size, it says DUMP OK this time (it had filesys errors the time I tried it a couple weeks ago) See here:
http://www.eten-users.net/topic1085
Anyways, in the end it dumps a 64 meg file instead of the 128 you specified, which is just the stuff in memory the 64 megs of RAM that this thing is suppose to have. If you use romdump on that file it doesn't get to many files, just about 30 or so and none of them are very important (most you can get via windows explorer and activesync)
FB
Re: Need help extracting files from ETEN M600 ROM will pay $
why do you think that eten has 128Mb OS ROM? It has only 48Mb ROM, other is left to persistent storage. So these tools would never dump full 128Mb, only 64Mb max.
You should upload somewhere the output of testdump tool, so I can look at it. It should produce _correct_ ROM dump. You just cannot extract files from it correctly. "dumprom" is for older oses, and with "-5" switch it would extract only files from XIP section (about 20 files). Use my "viewimgfs" tool to get everything from IMGFS.
I looked in the control panel, you are right it appears that the system part takes up about 48 mb, with the rest of the 128mb as user storage. It's kind of wierd though that testdump would stop at 64mb, wouldn't it stop at 48mb instead? If not why is it not doing the full 128 mb.
I tried what you had suggested and unfortunately that doesn't work either. I dumped a 64mb image, and a 48mb image. viewimgfs.exe didn't work on those images. I tried prepimgfs on the 48mb one and it couldn't find imgfs start location. I tried it on the 64mb one and it found it but the resulting file was about 256kb with a 4kb "removed_data" file which is definately not right.
I tried it without first running prepareimgfs and it just says "unable to load compress .dll".
I can't send a rom dump of what I have yet as it contains all of my contacts and calender information in looking at the memory dump in a hex editor, I'll have to whip the device clean again and I can send one but that may take awhile, i've got a lot of stuff setup right now.
Any other suggestions?
I found another bit of information. I played around with MTTY, which I know is for HTC devices, just to see what it would do though I thought I would try. It connects to the bootloader, however you never get to a command prompt. It appears that i can send a command, but then it trys to just download a file (the updated ROM). So I'm not sure if anything else can be done with this, I was hoping I could do something like "d2s" but it appears that with MTTY that doesn't seem possible.
I'm wondering if there is some way to map a USB port to a COM port so I can use regular hyperterminal. Does anyone know how to do this as Hyperterminal only supports COM ports...
MTTY is identical to hyperterminal
Ahh okay, it must be that they haven't implemented a nice interface like HTC devices where you can issue all of those commands
Hi!
Until now can you dump it? I can help you dump....
PM me,OK?
Okay, so i've finally been able to get these files from Vijay, however I'm still running into issues as describe here:
http://www.eten-users.net/topic1500
Anyone have any information on how to reconstruct PE files?
My progress so far:
Step 1
C:\Rom>pdocread -l
211.25M (0xd340000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.75M (0x3c0000) Part01
| 93.25M (0x5d40000) Part02
| 111.13M (0x6f20000) Part03
7.61G (0x1e6e80000) DSK1:
| 7.60G (0x1e6a80000) Part00
STRG handles:
handle e74c6a56 7.60G (0x1e6a80000)
handle 874150e6111.13M (0x6f20000)
handle 8749a596 93.25M (0x5d40000)
handle 2749a572 3.75M (0x3c0000)
handle a749a3a2 3.12M (0x31f000)
disk e74c6a56
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874150e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8749a596
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2749a572
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a749a3a2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
* Problems? Try reading this: http://wiki.xda-developers.com/index...s_HowtoDumpRom
Step 2
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3c0000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x5d40000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x6f20000 Part03.raw
Copy files to: C:\Dump
Further:
1. Go to the xda FTP (Polaris-folder) and download a WWE file. (ftp://xda:[email protected])
2. Unzip the download from the xda FTP (Polaris-folder). to c:\XDA
3. Download Kaiser kitchen. It works! (http://forum.xda-developers.com/attachment.php?attachmentid=57639&d=1194700488)
4. Unzip Kaiser kitchen to c:\
5. Copy C:\XDA\ruu_signed.nbh, C:\Dump\part01.raw and C:\Dump\part02.raw in the C:\BaseROM folder
6. Read the cooking manual, do not use 3. flash.cmd (Kaiser Flash), it will not work.
--- at the end of the process (before flashing). ---
7. copy the generated ruu_signed.nbh to the C:\XDA folder.
----- To be safe you should install Hard_SPL at this point-----
http://forum.xda-developers.com/showthread.php?t=351964
8. Go to the C:\XDA folder and execute the ROMUpdateUtility file.*
9. Follow the steps.
Good luck.
* I take no responsibility whatever about you destroying your device.
the point is: how to get the "dumped raw file" back to the machine???
Take the Kaiser Rom kitchen! Modify it for Polaris and follow the procedures.
Kaiser is the best kitchen as it is very near the polaris.
Good luck
Roman
banzro said:
Take the Kaiser Rom kitchen! Modify it for Polaris and follow the procedures.
Kaiser is the best kitchen as it is very near the polaris.
Good luck
Roman
Click to expand...
Click to collapse
I stick with the manual for the Hermes.
Tried the kitchen, but it is not very clear to me.
Can you tell me how to get a ruu_signed.nbh for the Polaris?
I tried using a downloaded custom ROM, nenaming it to ruu_signed.nbh, but that ROM is WWE and my cooked
ROM will be Dutch (NL).
Ok, tried the Kaiser Rom kitchen.
Looks like this is the best option.
I managed to create a Dutch ROM and reflash my device. But it is slow as hell compared to the 6.1 WWE version i tried before.
My ROM lacks radio. Does someone know which file to use when creating the rom.
I'm looking for the radio.nbh
I'm trying to dump my Spanish Polaris ROM and I'm following the steps showed by 'session' but this is the response that I obtain from the DOS session: "Copying D:\Instalacions\hardware\HTC\ROMs\ROM utils\itsutils.dll to WCE:\windows \itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync or maybe your device is application-locked."
Any idea? Someone can help me?
Thanks in advance and sorry for my bad english.
PQillu,
pqillu said:
I'm trying to dump my Spanish Polaris ROM and I'm following the steps showed by 'session' but this is the response that I obtain from the DOS session: "Copying D:\Instalacions\hardware\HTC\ROMs\ROM utils\itsutils.dll to WCE:\windows \itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync or maybe your device is application-locked."
Any idea? Someone can help me?
Thanks in advance and sorry for my bad english.
PQillu,
Click to expand...
Click to collapse
Yes, this problem is wel known. It has something to do with unsigned programs. The solution is modifying your registry:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
can you also explain xip portation in your manual please?
session said:
Yes, this problem is wel known. It has something to do with unsigned programs. The solution is modifying your registry:
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
Click to expand...
Click to collapse
THX for your help.
Now I've my ROM dumped and from now, I'll try to cook my own ROM and also I'll try to recostruct the original ROM in order to prevent possibles crashes.
Regards,
PQillu
Rom Upload
I Have The Same Rom As You Do
__________________
HTC Cruise
Original Spanish ROM
ROM Version: 1.25.412.1 ESN
ROM Date: 13/12/07
Radio Version: 1.58.21.23
Protocol Version: 25.65.30.04H
Can You Please Upload The Rom To The Internet and share the original spanish rom?
Thank You
NDUTU said:
I Have The Same Rom As You Do
__________________
HTC Cruise
Original Spanish ROM
ROM Version: 1.25.412.1 ESN
ROM Date: 13/12/07
Radio Version: 1.58.21.23
Protocol Version: 25.65.30.04H
Can You Please Upload The Rom To The Internet and share the original spanish rom?
Thank You
Click to expand...
Click to collapse
Here you've the link:
http://rapidshare.com/files/95929043/ROM_Original_meva.rar
The main question is how to convert it to a flashable ROM. I'm looking for information but I've no more time to spend for trying solutions. If anyone can help me, I'll appreciate a lot.
PQillu,
banzro said:
Take the Kaiser Rom kitchen! Modify it for Polaris and follow the procedures.
Kaiser is the best kitchen as it is very near the polaris.
Click to expand...
Click to collapse
What do you mean by "modify it for Polaris"? What exactly shall I do?
Alex
Use the Grab-it software.
Jibreil
Can you elaborate on grab-it software?
amarguli said:
Jibreil
Can you elaborate on grab-it software?
Click to expand...
Click to collapse
I was referring to this great software for dumping ROM's
http://forum.xda-developers.com/showthread.php?t=238945
Click to expand...
Click to collapse
Thanks for the information, but actually my question is how to convert dumped files to a flashable ROM using modified Kaiser kitchen. I know how to dump the ROM.
Nobody has an answer?
you can read all about it in the first post, in the wiki-pages and in the kaiser kitchen readme as well.
worked for me.
OK. Thanks. I'll check the readme of kaiser kitchen, because the first post here does not explain what need be changed for Polaris.
After reading readme of kaiser kitchen I have some more questions:
1. If I just want to convert dumped raw files to flashable ROM then I don't need to extract RUU_signed.nbh from WWE "shipped" ROM and put it in BaseROM folder. Instead of this I put Part01.raw and Part02.raw from my dump into BaseROM folder. Is this correct?
2. Does RUU_signed.nbh resulting from the execution of !Cook.cmd script contain also original radio and SPL or OS only?
3. What do I do with Part03.raw and Part04.raw files?
my sd card slot is broken.. it does read any sd card anymore.. i did a factory reset on my rooted nook and now it is stuck to the android "Touch the android to begin" screen and when i touch the android screen nothing happens...
is there a way to enable noogie without sd card? maybe write directly to nook internal storage?
The first way would be if you had installed ClockworkMod recovery as your recovery image.
The other way is to follow the thread on bootloading the new Nook Glow 2 over USB.
http://forum.xda-developers.com/showthread.php?t=2559915
With the correct images you can boot an NST over USB.
what do u mean clockworkmod recovery as my recovery image? Instructions for cwm is to put it on sd card and boot from it... i didn't know you can flash it into the internal storage of nook?
how do you bootload the nook simple touch with glowlight over usb? i don't see how to do it in http://forum.xda-developers.com/showthread.php?t=2559915
i forgot to say it's a nook simple touch with glowlight and not the latest nook glow
edit: can you please attach the exe you have put in the other threads? i think all the attachments have somehow been deleted... i am using win7.. and it detects omap device for only 2-3 seconds... and i can't have time to install the drivers
So as not to bother the other threads with my quesitons... I am posting my results here,
I have modified my android_winusb.inf adding these lines
Code:
[Google.NTx86]
; Nook Simple Touch
%SingleAdbInterface% = USB_Install, USB\VID_2080&PID_0003
%CompositeAdbInterface% = USB_Install, USB\VID_2080&PID_0003&MI_01
; Nook Glow 2
%SingleAdbInterface% = USB_Install, USB\VID_2080&PID_0007
%CompositeAdbInterface% = USB_Install, USB\VID_2080&PID_0007&MI_01
; OMAP3630 bootloader
%SingleBootLoaderInterface% = USB_Install, USB\VID_0451&PID_D00E
; FastBoot
%SingleFastBootInterface% = USB_Install, USB\VID_0451&PID_CAFE
Code:
[Google.NTamd64]
; Nook Simple Touch
%SingleAdbInterface% = USB_Install, USB\VID_2080&PID_0003
%CompositeAdbInterface% = USB_Install, USB\VID_2080&PID_0003&MI_01
; Nook Glow 2
%SingleAdbInterface% = USB_Install, USB\VID_2080&PID_0007
%CompositeAdbInterface% = USB_Install, USB\VID_2080&PID_0007&MI_01
; OMAP3630 bootloader
%SingleBootLoaderInterface% = USB_Install, USB\VID_0451&PID_D00E
; FastBoot
%SingleFastBootInterface% = USB_Install, USB\VID_0451&PID_CAFE
Code:
[Strings]
SingleBootLoaderInterface = "Android Bootloader Interface"
SingleFastBootInterface = "Android FastBoot Interface"
When my nook starts, i don't get "Found new hardware" popup but in device manage, the omap device appears but disappears after 3seconds.... I has an "exclamation" icon to it as you can see and i don't know what this means
So i powered off the nook, ran
Code:
omap3630.exe omap3_aboot.bin u-boot13.bin
from your zip : http://forum.xda-developers.com/showpost.php?p=48633090&postcount=44&nocache=1&z=944385892387572 (that's the only zip still available from you, all your other zips are no more present.. i dunno why)
I get
Code:
Waiting for bootloader...
I powered on my nook but nothing... any idea what's wrong?
yeahman45 said:
So i powered off the nook, ran
Code:
omap3630.exe omap3_aboot.bin u-boot13.bin
...
I powered on my nook but nothing... any idea what's wrong?
Click to expand...
Click to collapse
use u-boot12.bin for a NST or NSTG. uboot13.bin is an experiment for the new NG2 and doesn't work.
straygecko said:
use u-boot12.bin for a NST or NSTG. uboot13.bin is an experiment for the new NG2 and doesn't work.
Click to expand...
Click to collapse
I did try uboo12.bin but did not work...
so decided to boot on my windows xp instead as i felt like win7 was messing up with the drivers and they were not installed properly.. it seems to work with winxp.. here my result:
Code:
U:\nook\usb_loading\experiment3>omap3630.exe omap3_aboot.bin u-boot12.bin
Waiting for bootloader... connected
Received ASIC id, 69 bytes
OMAP36XX, rev 07
Unlocked
ID12: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ID14: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC1: EF3EBF13
CRC2: 00000000
Sending image file omap3_aboot.bin, 3480 bytes... done
Ack: AABBCCDD
Sending image file u-boot12.bin, 170572 bytes...Error sending image data
I don't know why it has an error sending image data
Yes, W7 is difficult with drivers.
I don't have a system here to check that.
They are actually just the stock Windows WinUSB drivers.
I'm not sure about the business with the co-installers.
In any case, you could have clicked on the icon with the warning and tried Update Driver.
"Error sending" is when, for whatever reason, the far end of the USB stops listening.
170572 is the right size.
Did you try it another time?
There is some goofy stuff going on here, maybe a-boot has some incompatibilities.
(Since this is all experimental, I delete older versions when I post a new one.)
I can boot my Touch into a CWR image ok, but I seem to have problems booting a (rooted) stock image over USB.
Renate NST said:
Yes, W7 is difficult with drivers.
I don't have a system here to check that.
They are actually just the stock Windows WinUSB drivers.
I'm not sure about the business with the co-installers.
In any case, you could have clicked on the icon with the warning and tried Update Driver.
"Error sending" is when, for whatever reason, the far end of the USB stops listening.
170572 is the right size.
Did you try it another time?
There is some goofy stuff going on here, maybe a-boot has some incompatibilities.
(Since this is all experimental, I delete older versions when I post a new one.)
I can boot my Touch into a CWR image ok, but I seem to have problems booting a (rooted) stock image over USB.
Click to expand...
Click to collapse
i tried update driver in win7 by manually selecting the inf but it says driver already uo to date.maybe it is cuz my win7 is 64bit. Anyway will use my beloved old good winxp lol. Yup i think my uimage is rooted. Should i do a factory restore and try again? But if that doesnt work i might lose root foreever.
Yes, I guess XP is the way to go right now.
There's a new version of omap3630.exe on the other thread.
Could you check that there and report back here?
Maybe next week I can get my hands on a Win7 box and figure out why the drivers are being such a pain.
Renate NST said:
Yes, I guess XP is the way to go right now.
There's a new version of omap3630.exe on the other thread.
Could you check that there and report back here?
Maybe next week I can get my hands on a Win7 box and figure out why the drivers are being such a pain.
Click to expand...
Click to collapse
i get an error with experiment4 : omap3630.exe is not a valid win32 application
is this for 64bit? i am on 32bit
edit: sorry was a corrupted download.. i ran it.. here's my result:
Code:
U:\nook\usb_loading\experiment4>omap3630.exe omap3_aboot.bin u-boot12.bin
Device in ADB mode
Waiting for bootloader... connected
Received ASIC id, 69 bytes
OMAP36XX, rev 07
Unlocked
ID12: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ID14: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC1: EF3EBF13, CRC2: 00000000
Sending image file omap3_aboot.bin, 3480 bytes... ok
Ack: AABBCCDD
Sending image file u-boot12.bin, 170572 bytes...
Error 0000001F sending image data, sent 0 bytes
Apparently aboot accepted the size parameter, then shut down before the data could be loaded.
This needs some looking into.
Renate NST said:
Apparently aboot accepted the size parameter, then shut down before the data could be loaded.
This needs some looking into.
Click to expand...
Click to collapse
any idea what is wrong? can i try some other tests?
tried experiment 6 and here's the result.. it's waiting for fastboot
Code:
U:\nook\usb_loading\experiment6>omap3630.exe omap3_aboot.bin u-boot12.bin
Waiting for bootloader... connected
Received ASIC id, 69 bytes
OMAP36XX, rev 07
Unlocked
ID12: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ID14: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC1: EF3EBF13, CRC2: 00000000
Sending image file omap3_aboot.bin, 3480 bytes... ok
Ack: AABBCCDD
Sending image file u-boot12.bin, 170572 bytes... ok
Waiting for disconnect... ok
Waiting for fastboot...
and my screen is blank...
btw thx and Merry Xmas Renate
working with experiment 6...cwm boots fine and i tried booting noogie but not sure if it's booted or not as the screen remains blank instead of "Rooting forever"
yeahman45 said:
working with experiment 6...cwm boots fine and i tried booting noogie but not sure if it's booted or not as the screen remains blank instead of "Rooting forever"
Click to expand...
Click to collapse
i think noogie is running fine as my pc detects all nook's partitions .. (boot, rom, nook, etc..) but for some reason i can't write/restore my backup img or when i flash glownooter in cwm, it reboots before flashing is complete (i think i may have not even started)
yeahman45 said:
i think noogie is running fine as my pc detects all nook's partitions .. (boot, rom, nook, etc..) but for some reason i can't write/restore my backup img or when i flash glownooter in cwm, it reboots before flashing is complete (i think i may have not even started)
Click to expand...
Click to collapse
I know you have been doing alot and please double check with others before doing what I suggest. From what I gather you have managed to get your NST running noogie and you want to restore a backup you have already made. I don't what tools you are using to restore/backup but some diskimage tools will not allow writing of partitions on a device where they already exist. So you would have to delete the partition before you restore.
See noogie guide here
Crispy3000 said:
I know you have been doing alot and please double check with others before doing what I suggest. From what I gather you have managed to get your NST running noogie and you want to restore a backup you have already made. I don't what tools you are using to restore/backup but some diskimage tools will not allow writing of partitions on a device where they already exist. So you would have to delete the partition before you restore.
See noogie guide here
Click to expand...
Click to collapse
are you sure? i am not too willing deleting my partitions... if i am not sure that i will be able to recover them... i have restored my img before with no problem using noogie booted via sdcard...
something i noticed too... when restoring my img, it fails at 10% but my nook is still ok.. shouldn't it be in "limbo" state?
also, flashing glownooter in cwm does not work either; it just reboots my nook and realise nothing happened
So did you get ADB over USB with CWM working?
If DevManager is showing ADB Composite Interface you are halfway there.
ADB has a list of known manufacturers of Android devices inside the program.
B&N is not "known".
That's why you have to have an entry in UserName\.android\adb_usb.ini
Code:
0x2080
Renate NST said:
So did you get ADB over USB with CWM working?
If DevManager is showing ADB Composite Interface you are halfway there.
ADB has a list of known manufacturers of Android devices inside the program.
B&N is not "known".
That's why you have to have an entry in UserName\.android\adb_usb.ini
Code:
0x2080
Click to expand...
Click to collapse
yup cwm is booting fine device manager detects the nook as adb composite interface but does not show up in adb devices
should i create this file as it does not exist on my winxp... when booted in noogie, i can see my partitions and the apps launcher.apk are present in system/app but when i boot my nook... it shows the android logo and says touch to begin setup.. when i touch on the android logo nothing happens... it is just stuck here... i need to touch change language to get nook setup page... and re-register my nook account... each boot is the same.. need to change language to get nook setup page and redo the whole registration setup to be able to "unlock" the nook menu
yeahman45 said:
yup cwm is booting fine device manager detects the nook as adb composite interface but does not show up in adb devices
should i create this file as it does not exist on my winxp... when booted in noogie, i can see my partitions and the apps launcher.apk are present in system/app but when i boot my nook... it shows the android logo and says touch to begin setup.. when i touch on the android logo nothing happens... it is just stuck here... i need to touch change language to get nook setup page... and re-register my nook account... each boot is the same.. need to change language to get nook setup page and redo the whole registration setup to be able to "unlock" the nook menu
Click to expand...
Click to collapse
ok i created the adb_usb.ini and it detects adb!!! will try to install relaunch and see if it will unblock it
This tutorial is about making a custom ROM for ATIV S or any other Samsung WP8 phone.
Samsung ROM files:
.wp8 - main file with OS and boot
.csc - file with regional info
.smd - ROM for WP7 devices
All those files have (almost) the same format. I call it SMD. Old .smd file can be unpacked using this instruction, back in time smd-tool was made for it, but format changed slightly. This process was only tested on ATIV S.
CSC
.csc files aren't flashed to device, those are just containers for MBN files. And MBN files are copied to DPP during flashing process.
AS ALWAYS YOU ARE MAKING THIS ON YOUR OWN RISK! AND GOOD LUCK
Tutorial contents
Basic:
Making custom CSC (.mbn)
Extracting SMD
How to work with "packed" partitions
What to edit in ROM
Packing SMD
Advanced:
Making CSC from MBN
Making developer ROM
Making custom CSC (.mbn)
Software
sam-tools
Any tool for mounting drive images (OSFMount)
MBN Creator
MBN Creator is a kitchen itself. It has some limitations, but creating MBNs with MBN Creator is very easy. This method is described in the end.
Unpacking CSC files
Official CSCs come in .csc files. Use smd-tool to unpack file.csc to csc_dump folder:
Code:
smd-tool /u file.csc /d csc_dump
Now mount DPP.bin and copy CSC.mbn file from it. Unmount DPP then.
Code:
\Samsung\CSC\CSC.mbn
Now use mbn-tool to extract files from csc.mbn to mbn_dump folder:
Code:
mbn-tool /u csc.mbn /d mbn_dump
Every folder in mbn_dump is for one CSC code. There are 4 files inside every folder (AUT for ex.):
SS_AUT.ini - init values for welcome screen (first boot). Language, region, timezone and carrier.
SS_AUT.reg - registry file.
SS_AUT_AppInstall.provxml - PROVXML file with (and only) install app instructions.
SS_AUT_CSC.xml - PROVXML file.
Warning! There is a size limit for any file ~50KB. MBN itself is limited to DPP free space.
Packing MBN
Code:
mbn-tool /p mbn_dump /f my.mbn /ver I8750OXXCMK2 /subver OXX
CSC version (I8750OXXCMK2) should be greater or equal to your ROM version. Otherwise it will be ignored. DOC2 CSC will work on CMK2 ROM, but not vice versa!
Warning! Official DNI and DOC ROMs don't support custom MBNs.
Using MBN Creator
You can apply predefined tweaks from 1st tab or add your own directly into files. Last tab contains MBN file properties. MBN Creator is limited to only one CSC code.
You can check your work in
Code:
MBN Creator temp
folder. Output file is CSC.mbn.
Flashing MBN with MBN Creator
Reboot phone into Download Mode
Connect to PC and install drivers
Copy or create CSC.mbn file
Press Flash, Scan
Choose CSC code and press Flash
All done. Reset phone. Perform HR if MBN didn't apply.
Warning! MBN Creator can't flash files larger than 64KB.
Flashing MBN with stock Downloader
Open .wp8 and .mbn files
Check "Select" and uncheck everything but "CSC"
If flasher asks you about something click NO
Extracting SMD
Software
sam-tools
Any tool for mounting drive images (OSFMount)
Unpack
Unpack file.wp8 to dump folder
Code:
smd-tool /u file.wp8 /d dump
Output example:
Code:
Partition name NAND off N size ROM off R size Part. ID Type Status
GPT 00000000 00000800 00200C00 0000FC00 00000000 00000000 [ OK ]
SECURE 00000800 00000800 00210800 00000400 00000001 00000000 [ OK ]
DPP 00001000 00004000 00210C00 00800000 00000002 00000000 [ OK ]
SBL1 00008000 00000BB7 00A10C00 0016A400 00000003 00000000 [ OK ]
SBL2 P 00009000 00000BB7 00B7B000 0016A400 00000004 00000000 [ OK ]
SBL3 0000A000 00000FFF 00CE5400 001F8000 00000005 00000000 [ OK ]
UEFI S 0000B000 00001387 00EDD400 00207C00 00000006 00000000 [ OK ]
RPM 0000D000 000003E7 010E5000 0006E400 00000007 00000000 [ OK ]
TZ 0000E000 000003E7 01153400 0006E400 00000008 00000000 [ OK ]
WINSECAPP 0000F000 000003FF 011C1800 0007E000 00000009 00000000 [ OK ]
PLAT 0001A000 00003FFF 0123F800 00742800 0000000A 00000000 [ OK ]
EFIESP 00020000 0001FFFF 01982000 0094A400 0000000B 00000000 [ OK ]
MMOS 00046000 0002403F 022CC400 0440B800 0000000C 00000000 [ OK ]
MainOS 0006C000 004B295F 066D7C00 61F20000 0000000D EACCE221 [ OK ]
Data 00520000 01838FFF 685F7C00 02920000 0000000E EACCE221 [ OK ]
Output files:
header - header of SMD
GPT - partition table
PLAT, EFIESP, MMOS - partitions with FAT file system
MainOS and Data - NTFS partitions
other files - bootloader and other low level stuff
DPP partition isn't flashed to phone. In wp8 file it's empty.
EACCE221 means that partition is packed.
How to work with "packed" partitions
Software
sam-tools
Any tool for mounting drive images (OSFMount)
Unpack
Large zero areas are cut off from those partitions. image-rebase can restore such files.
Code:
image-rebase /u MainOS.bin /o MainOS.img
You can now mount and edit MainOS.img.
Warning! Data partition is very large and almost empty.
Pack
First of all slice image file:
Code:
image-rebase /s MainOS.img /z 2048
This command will cut off zero areas larger than 2048 sectors (1MB).
MainOS.img.xml is a template file.
Now you can glue files together using template:
Code:
image-rebase /p MainOS.bin /t MainOS.img.xml
What to edit in ROM
CSCMgr
This service applies MBN file. The idea is to downgrade it to CMK2 (GDR3) version. To do so replace those files:
system32\CSCMgr.dll
system32\CSCMgrSvc.dll
system32\drivers\CSCMgrSvc.dll (yes, it's a copy)
FCRouter
This service is used by Samsung system tools to perform actions with high privileges. Files:
system32\FCRouter.dll
system32\FCRouterProxy.dll
system32\drivers\FCRouter.dll
system32\drivers\FCDriver.dll
Registry hives
Code:
system32\config
You can edit those hive as you want. But HR will destroy all you work.
OSRepack
It a simple tool to work with packages on mounted partitions. Available here.
SDelete
There is a tool called SDelete which can fill all free space on a drive with zeros.
Code:
sdelete -z X:
Very useful for non-developer ROMs.
Packing SMD
Software
sam-tools
Hex editor (HxD)
Pack MainOS image
Code:
image-rebase /s MainOS.img /z 2048
image-rebase /p MainOS.bin /t MainOS.img.xml
Prepare SMD header
It's not really a header but a first part of file. This file can be used as template for your later work. It contains all partitions except MainOS.
Code:
smd-tool /info file.wp8
This command will give you some info about SMD file structure. Open it in hex editor and copy all data up to MainOS ROM offset to a new file. Add Data.bin to this new file.
There are some structures at the start of file. For example:
4D 61 69 6E 4F 53 00 00 00 00 00 00 00 00 00 00
00 C0 06 00 5F 29 4B 00 00 7C FF 08 00 0E AD 61
1F 1F 1F 1F 00 00 00 00 21 E2 CC EA 00 00 00 00
2B C2 5E C9 6A 2F 0B E1 6F 1C 95 FC 49 FF E9 FD
Start and length are colored.
Warning! Those numbers are little endian (12345678 = 78 56 34 12)
Replace Data Start with MainOS Start. You can use Ctrl+C & Ctrl+B (copy and paste with replace).
Replace MainOS Start with length of this (template) file.
Save file.
Adding MainOS
Add MainOS.img to your template.
Replace MainOS Length with length (in bytes) of MainOS.bin file.
Replace 16 bytes at offset 0x50 with zeros.
Count MD5 hash of the file (HxD can do it) and write it at 0x50 (^C & ^B).
Save this file as .wp8
You can check numbers you entered with following command:
Code:
smd-tool /info custom.wp8
Warning! This .wp8 file can only be flashed with Downloader v3.54
Making CSC from MBN
Software
Hex editor (HxD)
Pack
Open CSC file in HxD.
At 0x00A00C00 it has MBN file contents.
Replace it with your MBN and fill rest of the CSC with zeros.
Warning! This file can't be unpacked with this instruction because FAT is broken. You can unpack it manually.
Correct MD5 as you did for WP8 file.
Warning! This CSC can fool Downloader but not phone. New CSCMgr will still ignore custom MBN.
Making developer ROM
Such ROMs can be directly mounted with OSFMount.
This command will pseudo slice MainOS.img:
Code:
image-rebase /s MainOS.img /z 4000000
Entire partition will be in one piece.
If you pack SMD with this file you can mount it and edit without repacking SMD.
In OSFMount enter offset equal to MainOS ROM offset + 0x1000.
Don't forget to recalculate MD5 after edit.
OMG, WOLF! People tell me that my tutorials are too long. But you are a true match for me!! :highfive:
Congrats on this great achievement! :victory:
Wow! Huge thanks for rewriting these tutorials in English; I wasn't expecting you to do it so soon! Can't wait to play around and to see what others come up with.
I play around with the replacement of files FC Router + WP8 Diag on my GT-I8750 (from the SM-W750V, SPH-I800, SGH-I187, SGH-T899M), in the end everything works.
Powered mode Smart Download.
so I could be possible to use ATIV S version of CSCMgr on SE. And SE then will have custom MBN
Yea, that's what I gathered from the info as well. Unfortunately I won't have time to try this out for another 4-7 days but I'll let you know if I do. And if you (or anyone else) feels like whipping it up and you need someone to try it, shoot me a PM.
Added info about sdelete and OSRepack to "What to edit in ROM"
I have an idea to record full process of ROM making and upload it on Youtube. Will it be useful?
Added poll.
What is this key? It was found by navigating to*#*#4636#*#*
Interesting find I too wonder what it is
Sent from my LEX727 using Tapatalk
HewettBR said:
What is this key?
Click to expand...
Click to collapse
I've no idea yet what it's used for, but I can tell you where it is stored:
The full key is stored in the partition "letvconfig":
Code:
/dev/block/bootdevice/by-name/letvconfig
While the total size of the partition is 524288 bytes (= exactly 512K) only the first 32 bytes seem to contain this LeKey and the remaining 524256 bytes are all zero.
When you are root you can easily dump this partition via adb shell:
Code:
# dd if=/dev/block/bootdevice/by-name/letvconfig of=/sdcard/letvconfig.img bs=512
And display the content with hexdump (or any other hex-editor):
Code:
# hexdump -C /sdcard/letvconfig.img
00000000 62 35 .......................................... |b5a4xxxxxxxxxxxx|
00000010 ....................................... 33 33 36 |xxxxxxxxxxxxc336|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
(Note that I replaced my actual code with "........" and "xxxxx" here as I don't want to post it in public.)
androcheck said:
I've no idea yet what it's used for, but I can tell you where it is stored:
The full key is stored in the partition "letvconfig":
Code:
/dev/block/bootdevice/by-name/letvconfig
While the total size of the partition is 524288 bytes (= exactly 512K) only the first 32 bytes seem to contain this LeKey and the remaining 524256 bytes are all zero.
When you are root you can easily dump this partition via adb shell:
Code:
# dd if=/dev/block/bootdevice/by-name/letvconfig of=/sdcard/letvconfig.img bs=512
And display the content with hexdump (or any other hex-editor):
Code:
# hexdump -C /sdcard/letvconfig.img
00000000 62 35 .......................................... |b5a4xxxxxxxxxxxx|
00000010 ....................................... 33 33 36 |xxxxxxxxxxxxc336|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
(Note that I replaced my actual code with "........" and "xxxxx" here as I don't want to post it in public.)
Click to expand...
Click to collapse
Is this key used to play with bootloader?
I am having a le Pro 3 AI and i am unable to save my unlock settings on bootloader / use baseband with unlocked bootloader. But what i do find is their bootloader has a fastboot command.
fastboot oem key
may be that can give us more access.May be , just assuming , this key can provide access to more features?
prateekkej said:
Is this key used to play with bootloader?
fastboot oem key
may be that can give us more access.May be , just assuming , this key can provide access to more features?
Click to expand...
Click to collapse
Great idea, I also think that this key can be useful.
I'm also having AI, so if you'll find a way to use a key with our device to make some profitable unlock, please update me to.