Hello,
I would like to extract the T9 DLLs from a WM2005 image (WM2k5_1.60a_XDA2_HIMALAYA).
I found some related links:
http://forum.xda-developers.com/viewtopic.php?t=19569
http://www.xs4all.nl/~itsme/projects/xda/dumprom.html
http://www.xs4all.nl/~itsme/projects/xda/spv-romlayout.html
None of these links has helped me though. I did get the nk.nba file. Dumprom doesn't seem to support extracting files from this type of rom, and I don't understand what additional steps I need to go through to do this. Can anyone give some additional clues how I can extract T9*.dll?
I've tried the search function to find this, but didn't find anything really useful. It surprises me, as I thought it would be a common question. Please let me know if there is some description of this that I didn't find when searching.
see http://nah6.com/~itsme/cvs-xdadevtools/dumprom/rdmsflsh.pl
it is not yet completely finished, i still have to figure out how to decompress data.
you have to fiddle a bit with the parameter of the script i think
and you have to extract the mflsh50 image to a separate file first.
the script does not automatically find the starting offset of the msflsh50 filesystem.
and see http://www.xs4all.nl/~itsme/projects/perl/ for nbfutils.
willem
thanks for your help. sadly to say, this is a new area for me. I'd appriciate some more help if possible.
itsme said:
it is not yet completely finished, i still have to figure out how to decompress data.
Click to expand...
Click to collapse
Does that mean it's not yet possible to extract the dlls I asked for?
itsme said:
you have to fiddle a bit with the parameter of the script i think
and you have to extract the mflsh50 image to a separate file first.
the script does not automatically find the starting offset of the msflsh50 filesystem.
Click to expand...
Click to collapse
I think you lost me here . Should I first extract this msflsh50 file? (how?) Then proceed working with this file? A step-by-step guide would be much appriciated
i wrote a wiki page describing how to analyze the rom:
http://wiki.xda-developers.com/index.php?pagename=TyphoonWM2005_RomStructure
will make something similar for himalaya.
In this page , you wrote :
then you can extract the contents of the xip files using DumpRom
mkdir files1 files2
dumprom -5 -d files1 xip1.nb
dumprom -5 -d files2 xip2.nb
Click to expand...
Click to collapse
the "-5" option is in a new version of dumprom ?
TofClock said:
the "-5" option is in a new version of dumprom ?
Click to expand...
Click to collapse
Thanks! However it didn't work as I thought.
Here's what I did:
1. Downloaded "WM2k5_1.60a_XDA2_HIMALAYA.rar", and extracted "nk.nbf"
2. xda2nbftool -x NK.nbf NK.nba 0x20040304
3. dumprom -d files -5 -v nk.nba
Code:
img 00000000 : hdr=900c898c base=900c0000 commandlineoffset=9007ffc0
img 00180000 : hdr=80307a2c base=80040000 commandlineoffset=7fffffc0
block 1 added buf=00440020 02000040
NOTE: removing 941651ee from e32 struct for nk.exe
NOTE: section at 00082000 iso 00009000 for nk.exe
NOTE: section at 0000c000 iso 00009000 for nk.exe
ERROR: could not find pointer for ofs 80307a2c
invalid romhdr ofs 80307a2c
9007ffc0 - 90080000 L00000040 unknown
90080000 - 900c0000 L00040000 NUL
900c0000 - 900c0000 L00000000 rom_00 start
900c0000 - 900c0004 L00000004 JUMP to kernel start
900c0004 - 900c0040 L0000003c NUL
...
So this doesn't appear to work very well. Is nk.nba the same as nk.bin? What am I doing wrong?
THATS TOTALLY AWESOME itsme THANKS FOR CREATING THIS Script .. it is really COOL .. TNX ..
logan said:
TofClock said:
the "-5" option is in a new version of dumprom ?
Click to expand...
Click to collapse
So this doesn't appear to work very well. Is nk.nba the same as nk.bin? What am I doing wrong?
Click to expand...
Click to collapse
for the meantime you can successfully extract the kernel Files of Wm2005 using dumprom -5 .. and you can analyze and extract some files of MSFLASH section of Wm2005 using the rdmsflsh.pl and -t HIMA parameter
-toe
problem is that dumprom does not handle multiple XIP sections in one rom very well.
that is why you should first extract them using
Code:
dump wm2005.img -o 0x400 -e 0x200400 xip1.nb
dump wm2005.img -o 0x210000 -e 0x3e3278 xip2.nb
other than that, dumprom says 'ERROR' maybe a bit too often, when it is not really an error.
toenailed said:
logan said:
TofClock said:
the "-5" option is in a new version of dumprom ?
Click to expand...
Click to collapse
So this doesn't appear to work very well. Is nk.nba the same as nk.bin? What am I doing wrong?
Click to expand...
Click to collapse
for the meantime you can successfully extract the kernel Files of Wm2005 using dumprom -5 .. and you can analyze and extract some files of MSFLASH section of Wm2005 using the rdmsflsh.pl and -t HIMA parameter
-toe
Click to expand...
Click to collapse
My dumprom.exe does'nt support the "-5" option ....
A new version ?
tnx so much for the info .. itsme ..
anyway .. how about in himalaya .. this is wat i done .. using the nk.nba
Code:
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb
mkdir files1 files2
dumprom -5 -d files1 kernel.nb
rdmsflsh.pl -t HIMA -d files2 MSFLSH50_2.nb >MSFLSH50_2.log
... did i do it right?? ..
tnx
-toe
toenailed said:
anyway .. how about in himalaya .. this is wat i done .. using the nk.nba
Code:
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb
mkdir files1 files2
dumprom -5 -d files1 kernel.nb
rdmsflsh.pl -t HIMA -d files2 MSFLSH50_2.nb >MSFLSH50_2.log
...
-toe
Click to expand...
Click to collapse
Ok , i use this but ...
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb --> OK , it makes a 256 Kb file
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb --> OK , it makes a 1280 KB file
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb --> OK , it makes a 3328 Kb file
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb --> OK , it makes a 27648 Kb file
mkdir files1 files2 --> OK for this
dumprom -5 -d files1 kernel.nb --> NOT OK , my version of dumprom.exe does not suppor the -5 option ... when i try to use it ,, i've got a screen 'help' that show me all available options :/
Where can i find the dumprom that use the '-5' option ?
Thanks
TofClock said:
Where can i find the dumprom that use the '-5' option ?
Click to expand...
Click to collapse
info: http://www.xs4all.nl/~itsme/projects/xda/dumprom.html
exe: http://www.xs4all.nl/~itsme/projects/xda/dumprom/dumprom.exe
logan said:
TofClock said:
Where can i find the dumprom that use the '-5' option ?
Click to expand...
Click to collapse
info: http://www.xs4all.nl/~itsme/projects/xda/dumprom.html
exe: http://www.xs4all.nl/~itsme/projects/xda/dumprom/dumprom.exe
Click to expand...
Click to collapse
Great thranks man
It works fine .... i'll try to cook the 1.60a rom of WM2005
TofClock said:
It works fine .... i'll try to cook the 1.60a rom of WM2005
Click to expand...
Click to collapse
Are you saying you managed to extract all files from "WM2k5_1.60a_XDA2_HIMALAYA.rar"? It didn't work for me
xda2nbftool -x NK.nbf NK.nba 0x20040304
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb
mkdir files_ipl files_MSFLSH50_1 files_kernel files_MSFLSH50_2
Click to expand...
Click to collapse
This works fine, at least no error indications.
dumprom -5 -d files_ipl ipl.nb
Click to expand...
Click to collapse
This extracts nk.exe (not sure if it's valid or not).
dumprom -5 -d files_kernel kernel.nb
Click to expand...
Click to collapse
This extract a bunch of files, they seem valid (I can see some exports from the dlls etc)
dumprom -5 -d files_MSFLSH50_1 MSFLSH50_1.nb
Click to expand...
Click to collapse
This gives an error message: unable to determine loading offset for MSFLSH50_1.nb
dumprom -5 -d files_MSFLSH50_2 MSFLSH50_2.nb
Click to expand...
Click to collapse
This just hangs forever eating all my CPU
Any ideas? Can anyone share the T9 dlls?
files_MSFLSH50_2 MSFLSH50_2.nb
is not a XIP type rom section.
you can extract it partially using rdmsflsh.pl, but rdmsflsh.pl is not entirely finished. it cannot extract compressed files.
toenailed said:
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb
Click to expand...
Click to collapse
Why i can't use dump? dump=dumprom?
I have try
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
and
dumprom nk.nba -o 0x40040 -e 0x80040 ipl.nb
but it is error
itsme , can yu help me on how to instal the XdaDev::NbfUtils module ...
it's necessary to use the rdmsflsh.pl ...
i've been look your site but i don't understand :/
khengvantha said:
toenailed said:
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
dump nk.nba -o 0x80040 -e 0x1c0040 MSFLSH50_1.nb
dump nk.nba -o 0x1c0040 -e 0x500040 kernel.nb
dump nk.nba -o 0x500040 -e 0x2000040 MSFLSH50_2.nb
Click to expand...
Click to collapse
Why i can't use dump? dump=dumprom?
I have try
dump nk.nba -o 0x40040 -e 0x80040 ipl.nb
and
dumprom nk.nba -o 0x40040 -e 0x80040 ipl.nb
but it is error
Click to expand...
Click to collapse
dump is not same as dumprom ....
you can download dump.exe HERE
and dumprom.exe with the "-5" option usable HERE
Ok , i've succefully installed the XdaDev::NbfUtils package
But i'm unable to extract files from MSFLSH50_2.nb
The script says to me
00000200: magic =00000000 != 2f5314ce
at M:\Qtek\MAGNETO\WM2k5_1.50i.96_XDA2_HIMALAYA\rdmsflsh.pl line 123
Click to expand...
Click to collapse
but no file in files2 :/
@TofClock
im so sorry if i mislead you ..
it should be "-t hima" not "-t HIMA" not capital letter as
Code:
perl rdmsflsh.pl -t hima -d files2 MSFLSH50_2.nb >MSFLSH50_2.log
make sure also to run the vcvars32.bat .. ..
-toe
Sorry. I need some help. I can't fight more
First, using Wizards ROM. It's simple:
Code:
dumprom -5 -d BootFiles nk.nba
rommaster -w 5 -d boot.hv -a boot.hv -o new.nba nk.nba
Everything looks almost good.
The same, but using BA WM5 ROM [both mamaich wizard port v2a and tuatara] - nothing looks good. Both dumprom and rommaster produces tons of errors.
Can anybody help? Please.
Ok. I've found the way, how to extract boot.hv. Here: http://forum.xda-developers.com/viewtopic.php?p=105694.
But still can't replace. Please help.
Hi, I am trying to modify the XIP of Hermes (e.g. modify boot.hv and FLASHDRV.DLL for big storage). Here's my steps:
>nbsplit -hermes os.nb
>RomMaster -w 5 OS.nb.payload -x -o xip.bin
Run the XIPPORT
"dump xip.bin"
"realloc P"
"build xip_out.bin"
write xip_out.bin to 00320000 of OS.nb.payload
>nbmerge -hermes os.nb
Although I haven't modified any file yet. But the reversed os.nb cannot boot after flashing. Anything I have missed? Any idea? Thanks.
sorry for that , It seems solved
He everyone,
I try to use Kaiser_Kitchen to compile ROM ,
but finally found one thing.....
the first step extract OS.nb cannot flash ROM
1.NBHtract RUU_signed.nbh
2.use Htcrt , choose Polaris , Model POLAxxxxxx , System OS choose OS.nb
3.use Polaris CustomRUU flash ROM , but stop at "Smart Mobility" screen.
If I just use CustomRUU flash Rom , everything ok ,
If extract OS.nb then compact NBH , can't flash Rom
how can I do ?
ps. tool is from Swtos :
http://forum.xda-developers.com/showthread.php?t=373482&highlight=Swtos_WM6.1_polaris_kitchen
sorry for that , It seems solved , but I have problem dump XIP from other rom.(my ROM still fail , too)
still trying.............
..\tools\RomMaster.exe -x -w 5 -b 0x320000 OS.nb.payload -o xip.bin
this the error code:
[Info] It is a common ROM.
[Error] File is damaged, end address small than start address.
[Error] File is damaged, end address small than start address.
xip.bin: No such file or directory
RomMaster.exe -x -w 5 -b 0x020000 OS.nb.payload -o xip.bin
udK said:
RomMaster.exe -x -w 5 -b 0x020000 OS.nb.payload -o xip.bin
Click to expand...
Click to collapse
It works ..........
Thanks very much
Hi All,
I am trying to extract the xip.bin portion from the NK.NBA file (mpx200).
When I use rommaster I get an xip.bin file which I can use with XIPPORT but I don't like the size of this file. I do get usable files as output from XIPPORT
I use:
ROMMASTER -w 5 -b 0x001000 nk.nba -x -o xip.bin
it produces:
C:\romtool\XIPtool>rommaster -w 5 -b 0x01000 nk.nba -x -o xip.bin
[Info] It is a common ROM.
[Warning] o32_rom(0x820c5ea0)'s o32_data at 0x00000000 is zero.
[Warning] Found dif-referenced region [OLD] Address=0x821732a0 Length=0x00
014e00 ObjectType=0x00200000
[Warning] Found dif-referenced region [New] Address=0x821732a0 Length=0x00
014e00 ObjectType=0x00008000
[Warning] Memory Block(0x80141000,0x8019ad0c) overlap with Block(0x80142d3
c,0x80142d68).
[Info] New rom filename is 'xip.bin'.
xip.bin is now 33.936.532 bytes ?? it should not be so big ??
Using the file with XIPPORT produces about 1,78 Mb of usable data. I can unpack and pack the modules and files just fine.. creating an xip_out.bin however is not the same size
xip_out.bin is 33.927.840 bytes ??
Any ideas what I'm doing wrong???
Thanks
Thanks to all the ROM Guru's for not keeping this secret
I thought that you guys would be happy when someone is still interested in supporting this old device ??
Anyway to answer my own question:
dump -o 0x140000 nk.nba xip.bin
use this xip.bin in xipport
dump / add / delete / modify as required
write address in xipport 140000
write back in nk.nba
For what you do it?
For istall WM 6.1 ?