Database Users

Reversing IMEI-CHECK's Wizard Unlocker :)

Hey Folks,
After a long weekend of reversing I am about 95% done in reversing IMEI-CHECK's unlocker for the Wizard.
The application is protected by Themida which is in my view the leading protector on the market currently (yes better than execryptor).
The unlocker has Ring0 protection, Emulated API's, Resource Encryption + Lots more fun and games.
Now onto what I have found so far.
The GUI stuff:
Code:
set 1 0
set 5 ffffffff
set 2 0
set 6 000000
set 4 000000
progressbar 0 239 0 255 ffffff 100 0
shmsg 0 0 " . : | Wizard Unlock | : ."
info 1
shmsg 3 0 " ..detecting device.."
set 32 2
info 0
shmsg 4 0 " >>> Wizard found"
Is plain to see, but the evil work is well tucked away in a procedure which is pushed onto the VirtualMachine.
So I still need to fish that out (loooonnnng task)...
However the very most interesting part (I find) is the existance of a ROM inside the unlocker.
Now I am not sure if this is the bootloader/gsm rom however it certainly seems VERY interesting that it is included.
Download:
http://rapidshare.com/files/12763879/_00CC0000.mem
For those who wish to analyse it and let me know which it is and if anything has been altered.
It might well just be standard, who knows :S
The following tools are also 'picked up':
Filenames:
Code:
PORTMON.exe
SnoopyPro.exe
Device Monitor.exe
Window Titles:
Code:
Portmon Class
SnoopyPro
USB Monitor
Device Monitor
Serious Serious Kudos to the developer, Very impressive work indeed!
By making this, he has almost made himself a license to print cash.
Since he has NO terms about his programs what so ever then there is no legal problems with what I am doing to his application.
He is probably too scared of HTC anyway, since he is decompiling their firmwares in order to make the product. (Which is outlawed in HTC's terms)
Anyway....
Watch this space

Very interesting, would information gathered from the Wizard unlocker lead to cracking the Treo 750 unlocker? Or any other phone that imei-check supports for that matter?

Whiterat said:
After a long weekend of reversing I am about 95% done in reversing IMEI-CHECK's unlocker for the Wizard.
Click to expand...
Click to collapse
Great, will you disclose your findings? there was an earlier post about the unlocker for G4 wizards, here (see comment #36):
http://forum.xda-developers.com/showthread.php?t=284312
Whiterat said:
However the very most interesting part (I find) is the existance of a ROM inside the unlocker.
Now I am not sure if this is the bootloader/gsm rom however it certainly seems VERY interesting that it is included.
Click to expand...
Click to collapse
It seems that this is the patched SPL that is flashed on the first unlocking step, it is modified so that when it is told to flash an splash screen, it flashes the security area, overwriting the CID.
Whiterat said:
For those who wish to analyse it and let me know which it is and if anything has been altered.
It might well just be standard, who knows :S
Click to expand...
Click to collapse
I will load it at IDA and compare with a normal wizard SPL...
Whiterat said:
Serious Serious Kudos to the developer, Very impressive work indeed!
By making this, he has almost made himself a license to print cash.
Click to expand...
Click to collapse
Yes, the imei-check guys are doing great job with their unlockers... similar method is used in artemis unlocker too. They load a modified SPL in RAM and jump to its physical address from WinCE, this modified SPL shows the DOC ID in help of "set" command and allows flashing unsigned code, then they use obtained DOC ID info to patch the security area by sending a "fake" splash screen, same as in wizard unlocker.
Whiterat said:
Watch this space
Click to expand...
Click to collapse
I will

phoa not much point in me continuing!
You've got the whole lot there!
I'm a lover not a coder, I simply reverse in order to help others succeed.
Since you have all important info anyway, Not really going to be of much help here
P.S do you have any sigs for IDA or any scripts?
I dont like having to sift through manually as binary file......

Whiterat said:
phoa not much point in me continuing!
You've got the whole lot there!
Click to expand...
Click to collapse
Well I didn't want to discourage you on continuing the reversing process, I just pointed you to the thread where we discussed about the unlocking method a while ago...
I admire the fact that you reached that far only disassembling / debugging the binary, what we actually did to have the full process was capturing it with USB monitor; the unlocker can be tricked if you run the usb monitor process as one user, ant the unlocker as a different user, but imei-check seem to have corrected this 'bug' in newer unlockers.
Whiterat said:
Since you have all important info anyway, Not really going to be of much help here
Click to expand...
Click to collapse
We don't have _all_ the important info, we have the commands that the unlocker sends to the bootloader, but the data sent to flash the security area is actually different in every phone, so flashing what is sent in one phone to another phone will actually brick it.
I think it can be helpful if you manage to reverse the algorithm that the unlocker uses to generate the code which is flashed on the security area, this can't be done capturing usb traffic, this has to be reversed from the binary, and Themida is not easy to break as you sure have noticed
Whiterat said:
P.S do you have any sigs for IDA or any scripts?
I dont like having to sift through manually as binary file......
Click to expand...
Click to collapse
No sorry, i don't have any... I am not very used to IDA, started using it few months ago and still learning new things about it everytime I start it

Ah cool I will look into it a bit further
(Need to get a friend to code a tool to remove the junk code)
e.g
PUSH EAX
PUSH EDX
MOV EAX,2282
INC EAX
DEC EDX
POP EDX
POP EAX
Since it is popping those registers off the stack, its actually altered nothing
Themida is a cow, Because my friend didnt manage to make a start on the junk code remover (and I didnt realise there was a virtualised function) I just did each Import by hand (approx 4 hours lol)
Also rebuilt the OEP by hand too, not too hard since it was VC++6.
I have a G4 which I have unlocked with Imei-Calc (thus I have the key file, which I *think* might decrypt parts of the program, or possibly is part of an encrypted rom.)
3 Last things:
1. Can the G3/G4 chip be worked out by IMEI, i.e IMEI represents a date and the chips were only used after a certain date? or is this tool generic for G3/G4 ?
2. Do you have an SPL for 2.08.10
3. How can I dump my SPL (bearing in mind my only minisd has a full backup of my rom, Just in case crossbow gets a little ugly for my liking)
Ohh one last thing, kbdus.dll on Crossbow.....Is there a kbduk.dll as far as you know?
My Wizard has british keyboard and all the chars are shifted +1.....
Thats my next major task I think before continuing on this thing
Btw, To use the usb logger on newer versions of IMEI-CALC, just rename the exe and change the class name

Hi..Answer on the "Last Three Things"
1.) No one cannot identify G3/G4 with imei.If u lok carefully the place below yr battery u will find a"G4" written besides yr imei no.In G3, nothing is written.The most commeon way is to check IPL/SPL .001 in the end is G4.
2) Take a ROM which has 2.08 SPL. and use typho5.exe to dismantle the ROM parts.If ROM is release recently then you will find IPL/SPL for G3/G4 both.Chek the threads here..
3) As such crossbow ROM has no IPL/SPL..if u know what ROM u were using prior to that, u can apply above to dump yr ipl SPL..secondly you can do this with awizard1.3 beta.
I hope this helps

[GUIDE] ~~[★The Complete Leo Flashing Video Guide★]~~ [Update 14/03/10]

★Useful Links★​ Official HSPL Thread - Bepe [The Actual HardSPL]​ Written Flashing Guide -Mskip [The Best Written Guide Around]
Official Rom Thread -L3v5y[Get All The Offical Roms (And SPL's) Here!]​ Official Radio Thread -Kholk[Very Useful Collection Of Radios]​ Custom Rom Mirrors -zzattack[Useful For A Good List Of Roms With Links To The Original Threads+Fast Downloads]​MTTY Thread - MysticGenius [Bad Flash? Constant Hard Resets? Check Out This Thread From MG!]​
★I Appreciate Comments, So If This Thread Helped You At All, Or If You Have Some Constructive Criticism, Then Post A Reply Letting Me Know★
★Hopefully this compilation of videos
I've been working on for the last week
or so should help you in any of your
queries about using HardSPL. Its designed
for complete noobies which dont know the
first thing about flashing.★
★Once you've watched a few, you will begin to
learn the different acronyms and be able to
recognize certain words and phrases in the
flashing process, but for now, heres a short
word list to get you started.★
★[Word List]★
LEOIMG.nbh/ruu_signed.nbh/[Randomname.nbh] - These are all the actual roms, the things you need to flash, usually they are called one of the first two names, but some rom chefs give their own names to the roms, but you can always distiguish which file you need as it will always be a "nbh" file and will always be the largest file in the archive/folder
SPL - Secondary Program Loader: Loads the actual OS. (The SPL is what lets you flash the different aspects of your device, however the stock SPL is 'CID Locked' which means only official releases from HTC can be installed.
HSPL - A 'custom' SPL created by the dark forces team (bepe and cotulla), this is CID Unlocked and it lets you install custom roms and flash any radio. The reason it is called 'Hard' is because it stays on your device after a flash, unlike 'Soft' SPL which is removed after a flash.
RUU - The official 'Rom Update Utility' from HTC which is used to do all your flashing from your pc, its essentialy a nice user interface for the SPL
CustomRUU - The custom Rom Update Utility from the dark forces team which is designed to be used with the HSPL
ROM - An operating system build from HTC, updated to bring you the newest functions and fixes
Custom/Cooked ROM - An operating system build built on a stock rom, these are created by 'Chefs or Cooks' who use 'Kitchens' to design their own roms to release to the community, these are usually alot better than stock roms and contain lots of custom tweaks from others in the xda community.
[More knowleadgable members please correct me on things I may have got wrong/ used the wrong termonoligy]
[Disclaimer: I will not be held responsible for any damage that may be caused to your device, and be warned flashing HardSPL WILL void the warranty on your device, however it can be removed, thus unvoiding it]
Ok onto the videos!
[Note/Update: In one or more of my videos I say that this will not work locked phones (as in, bought in a contract) this is wrong, HSPL does allow you to flash new roms on to contract phones (for example: flash a custom rom onto a tmobile phone) However it will not unlock the deivce]
1. How To Install HardSPL
[LINK][Estimated Time:7 Minutes]
[NOTE: PLEASE GO INTO YOUR BOOTLOADER BEFORE INSTALLING HSPL AND MAKE SURE YOUR CURRENT SPL IS 1.42.0000, IF IT IS NOT, THE INSTILLATION WILL FAIL!]
Description: This video is intended to run you through the very simple process of flashing HardSPL to your device.
Useful Links
¬HardSPL Thread
HardSPL
¬Windows Mobile Device Center 6.1 32 Bit
¬Windows Mobile Device Center 6.1 64 Bit
2. How To Flash a Custom Rom Via Active Sync (USB)
[LINK][Estimated Time: 10 Minutes]
Description: This video is supposed to show you the process of flashing a custom rom to your device using the supplied standard mini usb cable.
Useful Links
¬Direct Links For Most Custom Roms
¬Windows Mobile Device Center 6.1 32 Bit
¬Windows Mobile Device Center 6.1 64 Bit
3. How To Flash a Custom Rom Via Micro SD Card
[LINK][Estimated Time: 15 Minutes]
Description: This video is supposed to show you the process of flashing a custom rom to your device using the supplied standard micro SD card.
Useful Links
¬Direct Links For Most Custom Roms
¬Windows Mobile Device Center 6.1 32 Bit
¬Windows Mobile Device Center 6.1 64 Bit
4. How To Flash a Stock Rom
[LINK][Estimated Time: 10 Minutes]
Description: This video will show you how to install a stock rom back to your device, so it is just like the day you got it.
Useful Links
¬Official Roms
[IMPORTANT NOTE: YOU CAN NOT INSTALL STOCK ROMS USING AN SD CARD AS IT WILL REMOVE HSPL]
5. How To Flash a Radio
[LINK][Estimated Time: 7 Minutes]
Description: This video is supposed to show you the process of flashing a stock radio to your device.
Useful Links
¬ Radios
6. How To Uninstall HardSPL (Install a Stock SPL)
[LINK][Estimated Time: 25 Minutes]
Description: This video is the longest and is supposed to show you how to remove HardSPL from your device (usually done when sending the phone in for warranty)
Useful Links
¬Official Roms (For Stock SPL's)
WARNING: THIS WILL REMOVE YOUR CURRENT ROM AND INSTALL A STOCK ROM OVER IT
7. How To Flash(Install) A Custom Splash Screen (Thanks jeckyll for the first splash screen and teaching me how to do it)
[LINK][Estimated Time: 5 Minutes]
Description: This video is very quick and will show you how to install custom splash screens (the initial SS with the htc logo and white background)
Useful Links
¬HD2 Bios Splash Screens
¬How To Create A Custom Splash Screen (Thanks pof)
8. How To Flash(Install) A Stock Splash Screen (Uninstall Custom Spash Screen) (Thanks 6Fg8 For The Stock Splash Screen)
[LINK] [Estimated Time: 5 Minutes]
Description: This video is very quick and will show you how to install the original splash screen (the initial SS with the htc logo and white background) over your custom one (will get back warranty)
Useful Links
¬HTC HD2 Original Splash Screen (Thanks 6Fg8)
9. How To Perform A Task 29 Without MTTY(Thanks Doloop For Making This, and ShaDrac for repacking it into an easier single exe)
[LINK][Estimated Time: 7 Minutes]
Description: This video will teach you how to perform a task 29 on your Leo without having to go through the arduous process of installing all the drivers ect for MTTY. Task 29 formats your phone for a cleaner flash
Useful Links
¬Task 29 Thread
¬MTTY Thread (For Reference)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[REQUEST: IF ANY OF YOU GUYS KNOW HOW TO GET EMBEDDED VIDEOS WORKING ON THESE (VBULLETIN POWERED) BOARDS, SEND ME A PM OR POST A REPLY EXPLAINING HOW, I WOULD BE SO GREATFUL
[NOTE: YOU MAY LINK TO THESE VIDEOS AND USE THEM ANYWHERE WHERE THEY WILL HELP A FELLOW LEO USER OUT JUST BE SURE TO PROVIDE A LINK BACK TO THIS THREAD]
If Any Video Links Are Down/ Do Not Appear In Your Country, Post A Message In This Thread And I Will Try And Have It Up ASAP
(Stickied 26/1/10) Thanks
Recieved Donations [/COLOR][/U]
Turborider - 14/03/10 (Thankyou Very Much )

Top Tips, Useful Things & F.A.Q's!
For The REALLY Lazy Man - A Folder Which Already Contains The CustomRUU,
Just Drag And Drop Your Rom File (.nbh) In Here And Run The CustomRUU! **Download** (Extract The Folder From The Zip File)
Making any changes to your phone using HSPL WILL void your warranty, and even if you remove HSPL and, for example, you have a custom rom still on your phone, your warranty will be void. However you can revert anything you do with HSPL thus getting back your warranty, I will make sure each method is on this thread, just make sure to revert everything changed with HSPL before you remove it.
Can I flash backwards? as in - From 1.61 to 1.48. Yes you can, you can flash any rom to any other rom with HSPL (thanks mskip for filling me in )
Always back up your phone. I recomend SPB Backup, it can backup not only contacts, but your whole system (programs, reg tweaks ect) however you may encounter problems if you try to restore everything, because the backup may have been made on a different version of manila/windows mobile
Hard resetting after a flash is usually recomended, it will optimize the rom
Always bare in mind the 2 main different manila versions (2.5.XXXX), 1921 and 1922. 1921 is the older one and so has more mods and tweaks designed specifically for it. 1922 is the newest and not yet totally stable version which doesnt support much yet, (however patchs and updates are starting to surface such as one for HDWall and 25 Shortcuts
If you are getting good signal ect with your current rom, make sure you take note of the radio version, it may be a good idea to back your old radio after flashing a rom if signal is not as good
Usually you will not have to reapply HTC hotfixes as most cooked roms include them in the package, however make sure there arent any recent updates which may not have been cooked in.
Side Note: All camera tweaks from xda users are usually pre cooked in aswell. (Talk about instant meals!)
¬More To Come Over Time

~~~[★Useful Pictures★]~~~​
[Taking requests]
A Healthy HSPL'ed Bootloader​

well done mate this thread will help alot of plp,nice one

[QUOTE='[★]
3. How To Flash a Custom Rom Via Micro SD Card
[LINK][Estimated Time: 15 Minutes]
Description: This video is supposed to show you the process of flashing a custom rom to your device using the supplied standard micro SD card.
[/QUOTE]
Hi,
Nice work, but i dont agree with this video.
you DO NOT have to format the SD card every time you flash.
you just copy it over and and start the flash!
Nice vids though, just abit misleading! and to be honest takes a long time, I have 4Gb of data on an 8Gb card, for me to copy it off, format, flash and copy it back would take the best part of 90 mins!!
SS

SiliconSquirrel said:
Hi,
Nice work, but i dont agree with this video.
you DO NOT have to format the SD card every time you flash.
you just copy it over and and start the flash!
Nice vids though, just abit misleading! and to be honest takes a long time, I have 4Gb of data on an 8Gb card, for me to copy it off, format, flash and copy it back would take the best part of 90 mins!!
SS
Click to expand...
Click to collapse
Huh.. It takes me with my 16gb one about 5 seconds to quick format once Ive dragged things off, Ive heard it is a safe bet so Im gonna leave it like that unless loads moer people feel the same way, Thanks though

To the OP,
Well done for putting these videos up. Should help a few people to better visualise what they need to do.
@ Silicon Squirrel,
You may be right re your point on formatting but I see it as good practice as it forces people to double check that the card is formatted in FAT 32 (a common problem).
WB

wacky.banana said:
To the OP,
Well done for putting these videos up. Should help a few people to better visualise what they need to do.
@ Silicon Squirrel,
You may be right re your point on formatting but I see it as good practice as it forces people to double check that the card is formatted in FAT 32 (a common problem).
WB
Click to expand...
Click to collapse
Thanks And yeah thats a good point

wacky.banana said:
@ Silicon Squirrel,
You may be right re your point on formatting but I see it as good practice as it forces people to double check that the card is formatted in FAT 32 (a common problem).
WB
Click to expand...
Click to collapse
Ok, but once you have done in once you dont need to do it again!! the card doesnt just randomly change file system while in use!!
so yeah i agree format it ONCE the first time you do it, other than that it is a waste of time!
I have never in 15 years of using computers and flash memory EVER heard of that!
SS

[★] said:
Huh.. It takes me with my 16gb one about 5 seconds to quick format once Ive dragged things off, Ive heard it is a safe bet so Im gonna leave it like that unless loads moer people feel the same way, Thanks though
Click to expand...
Click to collapse
Dont get me wrong, it was a constructive criticism.
maybe you could note the fact that they only need to do it once, the first time, to make sure the file system is FAT32. then they would save much time in the future!
Also i wasnt saying the format would be long, i was meaning the copying on and off that is a ball ache!!
SS

SiliconSquirrel said:
Dont get me wrong, it was a constructive criticism.
maybe you could note the fact that they only need to do it once, the first time, to make sure the file system is FAT32. then they would save much time in the future!
Also i wasnt saying the format would be long, i was meaning the copying on and off that is a ball ache!!
SS
Click to expand...
Click to collapse
thats true, it IS a ball ache xD

Good vids and just to echo an above post that seeing it being done makes it so very simple and thanks very much, it certainly helps new people like myself get to grips quickly.
I'd just add in a couple of vids you might want to add a bubble of 'connect via active sync'
About the format thing, meh!.. you get a 2gig card with the phone which is useless really except for rom stuff and the like. I wouldn't bother moving stuff around, just swap the card over.
cheers!
R.

humungousfungusamongus said:
Good vids and just to echo an above post that seeing it being done makes it so very simple and thanks very much, it certainly helps new people like myself get to grips quickly.
I'd just add in a couple of vids you might want to add a bubble of 'connect via active sync'
About the format thing, meh!.. you get a 2gig card with the phone which is useless really except for rom stuff and the like. I wouldn't bother moving stuff around, just swap the card over.
cheers!
R.
Click to expand...
Click to collapse
Ok I'll get on that soon,
And yeah, I just use the 2gb one that comes with it too

Very helpful and clear videos

Thanks alot you just helped a noob here thanks

I think that this thread deserves a sticky.

Yep i vote for sticky aswell. admins please sticky this extremely helpful thread

gsingh7 said:
Yep i vote for sticky aswell. admins please sticky this extremely helpful thread
Click to expand...
Click to collapse
Fatherboard said:
I think that this thread deserves a sticky.
Click to expand...
Click to collapse
Thanks
Glad it helped
Most of the thanks should go to mysticgenius and mskip for teaching me though

[★] said:
Most of the thanks should go to mysticgenius and mskip for teaching me though
Click to expand...
Click to collapse
Whoop +1 for MG!!
although, you put the work in on this thread, and the vids are cool so you deserve credit too!!
Peace bro
SS

Thanks man

This Old iPAQ rx3115 (Other Oldtimers Welcome)

LMAO - No need to say it. I know my iPAQ rx3115 is a dinosaur, but so am I.
However, the damn thing refuses to die and has been a good, faithful workhorse for a loooong time. To me, that speaks to the quality of the hardware. The rx3115 just seems to be built solidly. Sad to say the PocketPC Pro 2003 (SE) operating system is at the bottom rung of the support ladder from M$ and we all know that means it will be phased out soon...
I just can't give up on my trusty rx3115. Hell, even the original battery is still holding a charge really well. And believe me, it hasn't spent a lot of time forgotten and idle despite the constant rotation of new toys that might pass through my hands. It's been used a lot and just keeps on ticking.
So, even though it continues running just fine, I'm now willing to experiment and try to make it more up-to date. Why not tinker with it since all support is fading fast? LOL if I break it now it hardly matters after all these years and I have plenty of other devices to rely on.
So yeah, I'm a bit of a noob (despite being a dinosaur ) who is willing to learn...
First step was to search the Google-sphere. Seems there are a lot more questions than answers out there for rx3115. How to upgrade the OS to WM5 or even WM6.1 Classic? I saw that asked over and over, but very few answers. Most who did reply said, "Try Universal Bootloader and a ROM image for another device..." OK, so that seemed the way to go, but is it?
There are a LOT of dead links for a Universal iPAQ Bootloader out there. I did manage to find a copy @ http://sourceforge.net/projects/ubl/files/ubl/Binaries/ where I selected the GUI version which came as an executable. Double clicking it creates a folder which UBL runs out of.
Caution: My system flagged it as having a Worm in the Vista Driver folders (2... Vista and Vista x64) and the Vista Drivers.exe application.
Who wants Wormy drivers? For that matter, who wants Vista?
I'm not qualified to judge if it is a false positive to some of the developers legitimate code. Maybe someone more savvy might want to take a look at it and make a ruling...
So I sanitized UBL by quarantining and deleting the offenders. Next, I asked Windows 7 to run it under compatibility mode for XP service pack 2. (It looks like it was always an XP box utility anyway.)
Here's a sanitized version of UBL for download. http://www.mediafire.com/file/7anraar1tkc3lz1/BootLoader.rar This is a rar of the extracted file folder (minus the Wormy bits). Just expand it and run "Bootloader.exe" right inside the folder. Maybe someone else will have more luck playing with it than I did.
I could in no way make it communicate with my rx3115 under Windows 7. Mtty always fails to open the port. I tried following the advice of UBL's readme and making a settings.ini file to direct mtty to the right port, but with no luck. IDK - I never wrote an .ini file before. Maybe I messed it up. I tried a few variations (settings/bootloader settings/mtty settings for file names) all with no success.
Then I used a friend's XP system and got closer... UBL gets past the mtty stage and opens the com with my rx3115, but then the ROM flash just hangs at 0%. I tried several times with no further success. And without the ROM being cooked for my specific device, flashing from the SD card is out.
I was hoping to force flash the Kitchen WM6.1 Classic ROM for rx1950 I got from this xda thread by Victory144 and Guifort: http://forum.xda-developers.com/showthread.php?t=510764 The ROM size is perfect for rx3115!!!
Heck, I even tried looking at the RUU's from valid rx3115 and rx1950 ROM updates and seeing if I could puzzle out how to cobble something with a Hex Editor. But I'm not really qualified for that.
It's been a lot of years and no one has cooked an upgrade ROM for rx3115 yet. At least as far as I can tell. But even recently I've seen rx3115 owners posting to forums and asking for an upgrade. I know I'm not alone in this desire and that's why I started this thread. Maybe some other rx3115 owners will join this discussion. We might just figure something out.
Something else I've begun looking into is installing Linux on my rx3115. It seems possible and there are a few reports of it being done, but little in the way of tutorials for the challenged. More on that later...
Or... maybe I'm crazy... Doesn't the Samsung s3c2440 CPU meet the minimum system requirements (@ 300mhz) for XP Tablet? CPU's can be overclocked anyway and the s3c2440 should be capable of sustained 400mhz efforts. It is set at that speed in some other PDAs The RAM is right at the bottom edge of requirements as well, IF all 64mb can be freed up for the user. Is there a way to boot XP Tablet off an SD card? Could the RAM/ROM chipsets be instructed to act as two RAM slots for that purpose creating 96mb RAM? Am I just a fool?
I welcome any advice, questions, derisive laughter... whatever...
I'll be checking the thread and updating the reports of my efforts.
Thanx for stopping in.

Maybe I'm missing a step...
If I press Mobile Media (button 1) + iTask (button 4) + Power + Reset
I get a blank white screen with the HP logo in the center and the revision #'s on the top...
From here (Bootloader screen - right???) rx3115 will try to flash ROM from an SD card if one is inserted that has a ROM image. Unfortunately I don't have a valid image except the 1.01.11 ROM of WM 2003 that I want to upgrade away from.
However - and this may be where I'm missing a step - without an SD card inserted I can't get bootloader to show USB connection. I've tried every button and combo of buttons I can to try and get USB to show up on the bootloader screen.
I feel like I'm missing something and that next step will allow Universal Bootloader to force flash a WM6.1 ROM under XP.
Any help? Anyone? How to get USB connection for bootloader with rx3115?

Handhelds.org continues to be down for maintenance. They are the distribution and support site for Familiar Linux, an alternative iPAQ OS. They were supposed to be reopened last week...
Angstrom Linux has shown itself capable of running on iPAQ and I found a very in depth tutorial - LOL - but it's in Spanish. I'm sorry to say me Spanish es no bueno. There's even a video on YouTube of Angstrom on an iPAQ rx3115 - so I know it can be done. Again though, it's in Spanish.
Today I'm checking out a "Live RAMdisk" version of Angstrom. It's like a LiveBoot CD Linux. You can boot and run Linux from storage (SD card) without installing. Instead of "try before you buy," it allows you to test before you install. At least I will get a chance to see how the Angstrom OS handles without having to flash my ROM and then reflash if I want to revert to WM 2003.
They have LiveRAMdisk and install versions supported for iPAQ h2200, h3900, h4000 and hx4700. The h5000 series is still in testing. More information is @ angstrom-distribution.org/taxonomy/term/6
I'm going to try the LiveRAMdisk version for the h2200 series as it's closest to rx3115. Same RAM and ROM, but the h2200 uses an Intel Xscale CPU rather than the Samsung... Still, it's the closest hardware match to the rx3115 out of all the supported models.
I'll post back about how AngPAQ handles.

HandHelds.org is still down. A shame since my research indicates Familiar Linux associates closely with PDAs...
Seems Ubuntu had a project they've abandoned or moved beyond (depending on your perspective), but the hardware requirements are way beyond iPAQ. They do have some stables for anyone interested. Google Ubuntu Mobile or Ubuntu MDI. Might be a nice alternative for some earlier tablet users...
Like they say..... BACKUP your data before any major changes!!!
I did try the LiveRAMdisk version of Angstrom Linux for h2200...
The LiveRAMdisk is a 23mb self executing file that you open from the root of your SD card. It was a non-starter. After booting from my SD card the iPAQ froze. I did a hard reset and freed up as much memory as I could from WM 2003 before trying again. Same result.
No worries, restored from backup and all is OK with my rx3115.
Just to be sure I tried with another method called a Loopback Image. I downloaded an Angstrom/Opie (full PDA style GUI) image and a bootloader from the Angstrom repository as another method of running Angstrom from my SD card. You use 7zip to extract the downloaded .bz2 and it inflates into a robust sized image (96mb in the case of h2200). Add the image and the bootloader to the same location on your SD card (preferably root). Execute the bootloader and run Angstrom off of your SD card. This too failed to run after several attempts...
LOL - another hard reset and restore from back up after each try.
I'm convinced it's a hardware incompatibility due to the difference in processors between h2200 and rx3115. But, darn it, if you look at development boards you find that they use Angstrom on boards with the same Samsung s3c2440 CPU that rx3115 has.
Next step is to try and find some of the Angstrom versions used on those development boards... And hope I get more than a bare-bones, command line only GUI.
If you have one of the supported iPAQs (h2200, h3900, h4000, h5000 or hx4700) it may well be worth your while to try running a Loopback Image from your SD or CF card. A full Linux emvironment when you want and you can always hard reset and restore to get back to Windows Mobile. More information can be found @:
(www) linuxtogo.org/gowiki/WinCeQuickInstall

Well, the Angstrom online builder won't give me Opie in a build for a mini2440 board.
I did find a .tar.bz2 that someone built up from Angstrom and marked as "Angstrom-opie-image-glibc-test-20070620-rx3000.rootfs.tar.bz2" (Thanx whynot). If I can convert the extracted .tar to .img I could try a Loopback Image with it from my SD card... Meanwhile, I suppose I have to start learning how to build up the bootloader myself. *sigh* Did I mention that I'm more of a hardware guy?
Handhelds.org still down.
Despite all the Linux talk I'm still trying to get a higher version of WinCE to install on rx3115... Options are good if you can manage to have them.
Ongoing Questions/Help Sought:
1) Anyone have a cooked ROM (or want to cook one) for iPAQ rx3115 that would flash WM5 or WM6.1 Classic to the rx3115?
2) Any help or suggestions with UBL (Universal BootLoader)?
a) Is the UBL I found @ sourceforge really infected with a worm?
(Note that it is marked as uploaded by the original UBL developer chrismrulz)
b) Am I better off leaving out the suspect Vista Drivers and just using an XP box to run UBL anyway?​
3) Why can't I get rx3115 to acknowledge USB under the iPAQ bootloader screen?
4) Could someone go over to HandHelds.org to knock on their door and tell them to get their site back up already?
5) Anyone know how to. or can suggest software to, Convert .tar to .img?
6) Any other Linux Distros I should be looking at as suitable for iPAQ rx3115?
7) Will anyone else post to this thread or am I just Blogging here?
a) Am I boring all the fine xda members?
b) Or are my bungling attempts at least providing a good laugh? ​

Yesterday I checked out NetBSD (Unix). They have prepared distributions for a wide array of PCs and Devices... I took a chance and tried one for Strong ARM iPAQs (even though rx3115 is Friendly ARM). Another no go... But I will say that they have the nicest bootloader of all the options I've worked with so far.
Now that I have my minimum posts in, thanx to Blogging in this thread and trying to help some seemingly lost first time posters, I can finally post outside links to the forum. HUZZAH!!!!
There are a few things I've got for download by anyone interested.
Here's the Universal BootLoader with GUI for iPAQ from chrismrulz, without the suspect Vista Drivers. So (I believe) it only works on XP boxes.
http://www.mediafire.com/file/7anraar1tkc3lz1/BootLoader.rar
I had tried a few overclock programs recently... ClockWizard, Pocket Hack Master and XCPUscalar.
ClockWizard is freeware and worth exactly that IMHO. I found it buggy to run...
Pocket Hack Master supports a lot of processors including the s3c2440. I got a version from somewhere with a working serial#. Again, I didn't care for it despite rave reviews elsewhere for other devices.
XCPUscalar worked the best for me, even though there is no official support for Friendly ARM. I found a version which is a free install cab of this $ware. There are a few tricks for some to get the scaling feature to work and that helped me get her configured... I included a .txt of the advice.
All 3 overclocks in one .rar file are here:
http://www.mediafire.com/file/636a5cl8ofzaa2z/OverClock.rar
As a "best of" I broke out XCPUscalar separately.
http://www.mediafire.com/file/z593cqhbnvegpg9/XCPUScalar.arm.CAB
Along with the advice .txt.
http://www.mediafire.com/file/igoragriu8lc2ha/XCPU tricks.txt
Here's the LiveRAMdisk of Angstrom Linux for iPAQ h2200.
http://www.mediafire.com/file/i61956852696grp/Angstrom-x11-image-liveramdisk-2007.12-h2200.exe
Just load it on your SD card and execute it from there to boot into Angstrom. Check out their guide to installing Angstrom under WindowsCE.
http://www.linuxtogo.org/gowiki/WinCeQuickInstall
Of the two methods (LiveRAMdisc or Loopback Image), I think Loopback Image seems more promising...
Check their Repository to see which machines are supported by stable releases.
http://www.angstrom-distribution.org/releases/2007.12/images/
Or visit http://www.angstrom-distribution.org/ for more information. They are heavily into embedded.
Here's the NetBSD files I grabbed all in one .rar file. This executable will boot NetBSD for the following devices: IPAQ h3100, h3600, h3660, h3900, Jornado 720(US/Many Europe/Japan) & Jornado 820(US/Japan).
http://www.mediafire.com/file/ync2ltv3l7oo4si/NetBSD.rar
Inside the folder are the 3 files you need to boot NetBSD under WindowsCE (hpcboot.exe, netbsd-IPAQ.gz and netbsd-IPAQ.symbols.gz) Put all three files on the root of your memory card and execute bootloader to boot into NetBSD.
Also in the .rar is a list of the md5 checksums for each file.
NetBSD has a lot of support for older hardware. Look them up: http://netbsd.org/
Or check out their long list of supported machines.
http://netbsd.org/ports/
If anyone needs a widget for verifying md5 checksums under Windows OS, here's an outstanding one from Jem Berkes. I've used this freeware many times (On XP and Win7). A nice, small footprint program that just works great.
http://www.mediafire.com/file/bhebw4ozo6dz767/md5sum checker.rar

rx3115
I have an rx3115 also. I have tried angstrom, with no luck. I am following your progress.

Thanks for the reply, kati. Now I don't feel so lonely.
And I added a Thanks to your meter for your post in this thread:
http://forum.xda-developers.com/showthread.php?t=472643
It seems like your post there got a cook interested in our device. I posted some links and PMed him some info. I'm keeping my fingers crossed. Maybe he can port over the WM 6.1 Classic ROM that was among the links I sent him. (Thanks tomcug)
Meanwhile...
Handhelds.org is still down.
Angstrom has added a new release (2011.03), but the online builder still won't include Opie in the .tar for mini2440 boards (my best hope for a working Angstrom straight from the source).
I'm still holding out hope for the "Angstrom-opie-image-glibc-test-20070620-rx3000.rootfs.tar.bz2" that I found.
http://www.mediafire.com/file/f2fsd...age-glibc-test-20070620-rx3000.rootfs.tar.bz2
I just need to find the right kernel and HaRet bootloader for it to run from SD card...
I'm basing that work on this document for installing a Loopback Image which I got translated from Portuguese (Thanx Rubberman).
http://www.mediafire.com/file/ci92vshhpojbyb8/AngPAQ rx3115.pdf
And I'm following the progress of whynot on another board where he documents his efforts to port Angstrom onto rx3115.
Here's a couple more things available for download...
The last official WM 2003 update (1.01.11) with installer
http://www.mediafire.com/file/i6k0935chhkgzlh/iPAQ rx3115 ROM 1_01_11.exe
The cooked ROM of WM 6.1 Classic designed for the rx1950. (.nbf file only)
http://www.mediafire.com/file/iu9p815w3yjpy6h/CEOS.nbf
In case any other cooks want to look at it. At 27.82mb it would just fit on rx3115 and may benefit from being trimmed down. Or someone might have more luck flashing it with the UBL mentioned above.
Here's the whole kitchen package from Victory144 and Guifort
http://www.mediafire.com/file/nna2yo92q2beiik/Flasher_Hp_Ipaq_rx1950_ENG_WM6.1.rar
It includes the installer and the .cab for the appropriate version of Mobile Office.
And just the Office cab for any WM 6.x users who may need it
http://www.mediafire.com/file/nmz3sbyuxan7c4e/office_wpc_WM6.CAB
LOL it seems rx3115s are popping up out of retirement (at least from what I see in the Googlesphere). In case any resurrected machines need it, here's the Daylight Savings Time patch for the new DST schedule.
http://www.mediafire.com/file/i51hkr3c8ep8t5e/Daylight Savings Fix.exe
Stay tuned... I'm still working on Linux booting from an SD card.

rx3115 user whynot has been having some luck getting Angstrom to boot from an SD card. I'm trying to get the proper kernel and HaRet from him. Here's his thread:
http://www.linuxforums.org/forum/mobile-devices/175821-ipaq-hp-rx3115.html
Today I uploaded ActiveSync 3.7.1 in an attempt to help xda member Orangekid sync an old device under Windows XP. If anyone else wants this fossil it can be downloaded from here:
http://www.mediafire.com/file/88xr4pjl14x7883/ACTSYNC_3_7_1.rar

A couple more things I uploaded to help others...
Uedit32 Hex Editor:
http://www.mediafire.com/file/6r8ffn1fq3bh9mu/uedit32.exe
mtty11a a command console for sending commands to iPAQ.
http://www.mediafire.com/file/7srppxvnr728ime/mtty11a.exe
A tutorial on How to install a different language ROM in your PDA I grabbed from another site and turned into a PDF:
http://www.mediafire.com/file/5e48n571jg1adqb/How to install a different language ROM in you PDA.pdf
LOL helping him has helped me... I hope. I may have a better idea of how to use a Hex Editor to change the WM 6.1 ROM and make it installable for rx3115.
I've also learned how to use mtty to make a backup of the ROM image on iPAQ to an SD card. I'll post details here later IF anyone posts that they are interested. I'd rather get back to work on my projects than spend time blogging right now.

LMAO - Handhelds.org is still down. They are one month overdue for coming back online.
I tried a few new ways to get the Kitchen ROM for rx1950 to flash to rx3115. No luck again.
tomcug has apparently given up on cooking a WM6.1 ROM for rx3115...
whynot finally replied to my query with a few tips and hints... I'll be making another run at getting Angstrom Linux to boot from SD card soon...

RumoredNow said:
LMAO - Handhelds.org is still down. They are one month overdue for coming back online.
I tried a few new ways to get the Kitchen ROM for rx1950 to flash to rx3115. No luck again.
tomcug has apparently given up on cooking a WM6.1 ROM for rx3115...
whynot finally replied to my query with a few tips and hints... I'll be making another run at getting Angstrom Linux to boot from SD card soon...
Click to expand...
Click to collapse
I'm still following ya I may not have an rx1950 but I think it's cool to see what other people on here can do. I'm rooting for you!

Great thread! I just recently started searching for Linux options for the two H3835's I have gathering dust. I retired them long ago for more modern hardware.
Now my kids (8 and 6) have taken over my (and my wife's), Android phones to play games on every time we get in the car. So I thought I'd see what I could do with the old iPaqs to make gaming devices for the kids. But before I can try to get any games running, I have to get an OS on them.
Anybody out there having any luck with the H3835? It appears from the Angstrom Forums that the "lightning fast" 206mhz StrongArm processor isn't up to the task of running Angstrom.
Handhelds.org is still down, so I can't try Familiar yet. I read somewhere else that the delay in bringing the site back up is due to the developers & site admins being adversely impacted by Nokia's recent decision to cease development on Maemo/Meego in favor of Windows Mobile 7. If that's the case, maybe it will be down permanently?
Sadly, I'm a compulsive tinkerer with old hardware and I may not be able to rest until I get it working or brick the silly things.

Thanks for joining my thread Markedswan.
Yeah, Handhelds.org is still down... Interesting rumor - I think I read on a wiki page that there is a split among the developers over some code. The server owner may have frozen access pending legal clarifications. LMAO - It's supposed to be Open Source.
I too am a relentless tinkerer. I understand the upgrade or brick it mentality.
First thing I did was look up the h3835 specs on www.pdadb.net That Intel StrongARM SA-1110 CPU looked familiar from my research so I double checked...
NetBSD (Unix) supports lots of old hardware. Your CPU is in their Tier I support group (the highest level of support). http://netbsd.org/ports/#ports-tier1 (The hpcarm listing.) Clicking that link shows that your processor is supported. http://netbsd.org/ports/hpcarm/#processors
h3835 is not listed specifically, but your system architecture is the same as the h3600 series. The only difference is you have twice the ROM. The NetBSD package that I tried should boot on h3835 from the SD card.
http://www.mediafire.com/file/ync2ltv3l7oo4si/NetBSD.rar
or if you prefer to get it from the source
http://ftp.netbsd.org/pub/NetBSD/NetBSD-5.1/hpcarm/
Don't forget the MD5sum checker if you need it. A list of the MD5 sums for each file is in the NetBSD folder.
http://www.mediafire.com/file/bhebw4ozo6dz767/md5sum checker.rar
Good luck and be sure to go to http://netbsd.org/ for documentation and support help.

Interesting
Interesting work going on here. Have you tried Android 0.8? It seems to be the most light-weight and flexible choice of Android out there.

Hmmm... That's a thought. I'll definitely look into it. I'm still trying to block out some time to get Angstrom to boot up. I finally got a working (or so my source says) HaRet. I just need the right Linux image.
But I'll give Android 0.8 a try for sure.

I've read that Android was too much for these devices. Memory on Android devices is in the Gigibytes (my phone has 10 GB on board I believe) while the iPaqs have less than 100mb typically (mine has 96mb between the RAM and ROM). I have no idea if that is truly the case though. Maybe with a decent size CF or SD card on board?
Rumorednow: NetBSD looks promising from what I've read on the website. Do you know off hand what window manager options will work with the handhelds? I wasn't seeing anything in the packages specifically for handhelds, maybe I missed something. I'll dig deeper, but thought I'd ask in case you knew.
I have the Compact Flash jacket for my 3835, so was thinking about trying Debian (which I'm more comfortable with) & can boot off a 1 GB Compact Flash card. Debian's site says the ARM version was designed with XScale processors and some of the custom router processors in mind, but the instruction set is specficially called out as being V4 for maximum compatability (the StrongARM in my iPaq uses the V4 instruction set) rather than the V5 native to the XScale series which came after StrongARM was introduced. So maybe it will work? I believe OPIE works with Debian as a window manager and that seems pretty slick and well supported.
I'll be living out of a suitcase for work pretty much all of May, so I'll have some time to tinker on this more in the evenings then. But, maybe someone will have it all figured out by then though?

Markedwsan said:
I've read that Android was too much for these devices. Memory on Android devices is in the Gigibytes (my phone has 10 GB on board I believe) while the iPaqs have less than 100mb typically (mine has 96mb between the RAM and ROM). I have no idea if that is truly the case though. Maybe with a decent size CF or SD card on board?
Rumorednow: NetBSD looks promising from what I've read on the website. Do you know off hand what window manager options will work with the handhelds? I wasn't seeing anything in the packages specifically for handhelds, maybe I missed something. I'll dig deeper, but thought I'd ask in case you knew.
I have the Compact Flash jacket for my 3835, so was thinking about trying Debian (which I'm more comfortable with) & can boot off a 1 GB Compact Flash card. Debian's site says the ARM version was designed with XScale processors and some of the custom router processors in mind, but the instruction set is specficially called out as being V4 for maximum compatability (the StrongARM in my iPaq uses the V4 instruction set) rather than the V5 native to the XScale series which came after StrongARM was introduced. So maybe it will work? I believe OPIE works with Debian as a window manager and that seems pretty slick and well supported.
I'll be living out of a suitcase for work pretty much all of May, so I'll have some time to tinker on this more in the evenings then. But, maybe someone will have it all figured out by then though?
Click to expand...
Click to collapse
The packed android kernel is only 30 or 40 mb if i'm not mistaken. You would have the whole thing from there.

Hi I'm new and registered specifically because of this thread. I gotta agree with you, waaay too little support for the rx3115. I love this iPaq, have 2 of them and I use them for everything (especially with the nifty universal remote feature, I run around and turn things on and off and annoy my girlfriend a lot). As great as I think it is, it really needs some updating in any way possible really.
Great job on pushing forward with all the different options. Anything you need a second tester on just give me a shout, my 2nd one can be used as a guinea pig

Also... What happened to handhelds.org? I check in every day wishing for a shinning ray of hope that they'll be up and running again soon

[REF] Help for Bricked Phones - TG01 Users, Be Aware!

Flashing different custom ROMs, some of us, sooner or later, are meeting ONE TERRIBLE PROBLEM - device getting bricked... Unfortunately, might happend...
With new developments of feropont we are getting, finally, updated (in the meaning of ballanced and smooth "relationship" between hardware and software) device. He, certanly, done jobs, Toshiba supposed to do before releasing the device.
... And it is real pain - inability to enjoy using such improved device...
As a members of xda-developers community, we become pretty skillsful resolving different problems - we have huge support over here - this is one of the reasons for opening this thread - to get help, and help others. Again - everyone of us can meet the problem.
I am a hard user of Windows Mobile from early years when Dell Axim just came to public. TG01 - my last device, in which I found full functional Pocket PC and pretty developed cell phone - all in one , and with my accurate attitude in using my "toy" I did not expect to fall victim of software glitch... But it happened!
My particular problem is really unusual – I cannot flash ANY custom made ROM (even earliest – see pere’s ROM table), But I am ABLE to flash any official ROM (!?)
We discussed the problem with feropont, he found it pretty unusual - I am inviting you to open discussion here, in one place, related to most common problems TG01 Users can meet… and hope, I'll find solution for my problem, as well.
Following, I would like to provide with links to previous answers to came across problems – all about TG01. (send me links – you consider helpful – will post them here in a first page).
Two brick variants from mirolg
Short Pins Illustration from kevinpwhite
TG01 Downloader TG01 Driver TGTool contains TG Tool
Smart Quote:
fxdjacentyfxd said:
1) always check .tsw file in prg directory via tgtool.exe software
2) from time to time I execute chkdsk utility to check SD card.
Only after point 1) and 2) I start sdll+ uploader.
Regards
fxdjacentyfxd
Click to expand...
Click to collapse
Another try...
Pere's TG01 Cooked ROMS' Table

eskyt said:
My particular problem is really unusual – I cannot flash ANY custom made ROM (even earliest – see pere’s ROM table), But I am ABLE to flash any official ROM (!?)
We discussed the problem with feropont, he found it pretty unusual - I am inviting you to open discussion here, in one place, related to most common problems TG01 Users can meet… and hope, I'll find solution for my problem, as well.
Click to expand...
Click to collapse
Hi.
What method of flashing You used to utlize ?
I can confirm only that using 3-pin metods ( as always I say - absolutely do not use this method if You really do not have to. ) should be involved only for official roms . Someone will say not true. I say I had always problems to flash custom roms utilizing this method so always, I repeat always, flash only any official rom this way. Never have had any problems with official roms but always problems with custom roms including "terrible" messages like "NAND flash error". Maybe flashing custom roms this method cause such big problems in the future ? It seems to be service mode not normal flashing mode so who knows what wrong can wait for us if rom is not official.
Anyway utilizing sdll+ software seems to be ok both for official and custom roms.
I have not had any slightest problem with it.
Sometimes people are gilty themselves. Flash strange custem roms with God knows where custom bootloaders and it is enough. For example, Nokser has bricked His tg01 and only JTAG can help him. Too much experiments with unknown matter and disaster is ready. Many people tried His last rom and who knows whether they are next candidactes to have unresolved problems with their tg01s.
Regards
fxdjacentyfxd

Flashing any device always has a risk attached, whether that be a Toshiba TG01 or a pc motherboard bios, still as long as procedures for flashing are followed correctly nobody should have many problems, but obviously bad things can happen, how many motherboards have died on a bios flash for example?
Flashing TG01 is no more risky than flashing other devices, however what you flash it with is the area where risk becomes involved.

I think what is needed is a tool for HTC devices called 'task 29' basically when we flasg custom ROMs over and over again, some roms are bigger than others etc, so they dont overwrite all system files, therefore, old system files from the previous ROM is left in the new ROM. this corrupts the phone, therefore you expeirience bugs. We need a tool like task 29.
but personally i dont/ havent faced any of these problems... *touch wood*

Thank yo guys!
To fxdjacentyfxd - thank you for sharing thougts.
I am exactly an example of "next candidacte" - I always was extremly carefull and used sdll+ only. I even did not know how to use3 pin method (feropont, many thanks him, instructed me).
I guess, (really just guess), my problem came from corrupted .tsw file - you know, we can see full sized file on memory card, when (factually) copying process was interrupted...
This is the riddle - what "changed" in the boot area, that compel my device to accept officials ROMs only (and only through 3 pin method), when customs (through sdll+) stopping it on Toshiba logo...
To olyloh6696 - yes, feropont had mentioned this future in privet correspondence - would be good to have it!
To (InsertNameHere) - "obviously bad things can happen" - supposed to be motto of this thread

eskyt said:
To fxdjacentyfxd - thank you for sharing thougts.
I am exactly an example of "next candidacte" - I always was extremly carefull and used sdll+ only. I even did not know how to use3 pin method (feropont, many thanks him, instructed me).
I guess, (really just guess), my problem came from corrupted .tsw file - you know, we can see full sized file on memory card, when (factually) copying process was interrupted...
This is the riddle - what "changed" in the boot area, that compel my device to accept officials ROMs only (and only through 3 pin method), when customs (through sdll+) stopping it on Toshiba logo...
Click to expand...
Click to collapse
Accordingly to what You wrote about corrupted .tsw file I forgot to mention that after every copy of new .tsw to prg directory on SD card I :
1) always check .tsw file in prg directory via tgtool.exe software
2) from time to time I execute chkdsk utility to check SD card.
Only after point 1) and 2) I start sdll+ uploader.
Regards
fxdjacentyfxd

fxdjacentyfxd said:
B] always [/B] check .tsw file in prg directory via tgtool.exe software
Click to expand...
Click to collapse
That is smart! Did not know it before. Hope, other users will take it into consideration...

eskyt said:
That is smart! Did not know it before. Hope, other user will take it into consideration...
Click to expand...
Click to collapse
Reading posts about bricked tg01s I got to conclusion that some bricks were really becuase of corrupted .tsw or logical errors on SD card. So I have always thought it is worthy to waste 1 minute to check .tsw in prg directory than irreversibly bricked tg01.
P.S. Your case is really very, very strange. To "damage" bootloader it accepts only official roms.... I can not belive in it. Must be other explanation.
Regards
fxdjacentyfxd

fxdjacentyfxd said:
Must be other explanation.
Click to expand...
Click to collapse
... - and I am trying to find solution...

i agree with olyloh6696's opinions
when we flashed roms so many times,maybe our phone's NAND flash appear some bad blocks.it's really like the problems in HTC phones.
Maybe use Tgdownloader flash an Official rom will helpfull with this problem.
Anyway,when we cook roms,tgtool always check if there's any error in our custom rom,and we just make changes in OS partition,didn't change/edit anything with the Bootloader or Radio.So i must say the most possibility that brickes our phone should be the Flashing Progress.

eskyt said:
This is the riddle - what "changed" in the boot area, that compel my device to accept officials ROMs only (and only through 3 pin method), when customs (through sdll+) stopping it on Toshiba logo...
Click to expand...
Click to collapse
It is similar I wrote in my first post. Typically ( I am not going to check more ) I am not able to flash rom via 3-pin method if rom is not official. It seems I have always had this feature. I had maybe free "bricks" since I have tg01 , because of my experiments with drivers and so that to flash any good rom via 3-pin it had to be always official rom ! Fortunately sdl++ works fine for any rom.
Did You flash many custom roms ? Maybe one of them is "this one" and it is worthy to find out which it is.
On the other hand as I remember tgdownloader has feature to upload different areas of the rom separately ( boot area too ).
Maybe someone brave could upload this method boot area ? If it works You could upload Your boot area too.
I know, it is hardcore
Regards
fxdjacentyfxd

ffboy2009 said:
i agree with olyloh6696's opinions
when we flashed roms so many times,maybe our phone's NAND flash appear some bad blocks.it's really like the problems in HTC phones.
Maybe use Tgdownloader flash an Official rom will helpfull with this problem.
Anyway,when we cook roms,tgtool always check if there's any error in our custom rom,and we just make changes in OS partition,didn't change/edit anything with the Bootloader or Radio.So i must say the most possibility that brickes our phone should be the Flashing Progress.
Click to expand...
Click to collapse
yes, as no tool exist, the best method for us is for every ROM flash:
1) Hard Reset Current ROM
2) Flash Stock ROM
3) Hard Reset Stock ROM
4) Flash New ROM
5) Hard Reset
You could even go as far as Reflashing the same ROM over the same ROM again to eliminate further errors.
This is the recommended precedure to follow, however I usaully miss out steps 1,2,3.

My bootloader is dead and i don't have a solution...
Maybe one... bay Riff Box

Nokser said:
My bootloader is dead and i don't have a solution...
Maybe one... bay Riff Box
Click to expand...
Click to collapse
Well, I remember wonderfull times when any bootloaders were in OTP ROM or EPROM. None possibility to "kill" the device. Today is to be cheap, easy, universal and we pay for it.
Regards
fxdjacentyfxd

fxdjacentyfxd said:
Today is to be cheap, easy, universal and we pay for it.
Click to expand...
Click to collapse
...So true.
By explanation of feropont official ROM supposed to "zap" like kind of bad blocs in a flash memory (if any exist...), but, as we can see on my example Toshiba is "writing" every thing above of exist information without "cleaning" inside flash like task29 HTC is doing... He also mentioned that problems, mostly, becoming not in a boot area, but later, on the level of (qoute) "kernel initialization, xip..." - I am not prepared enough technically to discuss this llevel, but it is seems for me like I will stay with Malaysian ROM for ever...

eskyt said:
...So true.
By explanation of feropont official ROM supposed to "zap" like kind of bad blocs in a flash memory (if any exist...), but, as we can see on my example Toshiba is "writing" every thing above of exist information without "cleaning" inside flash like task29 HTC is doing... He also mentioned that problems, mostly, becoming not in a boot area, but later, on the level of (qoute) "kernel initialization, xip..." - I am not prepared enough technically to discuss this llevel, but it is seems for me like I will stay with Malaysian ROM for ever...
Click to expand...
Click to collapse
The main trouble is that the TG01 really does not make a general cleaning of flash Task 29 by analogy HTC devices. Judging from the descriptions of problems, bootloader is absolutely not damaged, it allows you to upload the whole flash ROM is not just any official ROM. The problems begin during kernel initialization XIP at the first boot device on any custom ROM. Every chef in the community TG01 anyway does not collect the full XIP, all cut-ins debuggers and encryption (kd.dll hd.dll mencfilt and etc). Unfortunately I have no time but first and foremost I would like to cook a custom ROM with the full original XIP, that would finally remove the issues in which there were bad blocks of flash in the kernel XIP or OS.nb.
Thx

feropont said:
The main trouble is that the TG01 really does not make a general cleaning of flash Task 29 by analogy HTC devices. Judging from the descriptions of problems, bootloader is absolutely not damaged, it allows you to upload the whole flash ROM is not just any official ROM. The problems begin during kernel initialization XIP at the first boot device on any custom ROM. Every chef in the community TG01 anyway does not collect the full XIP, all cut-ins debuggers and encryption (kd.dll hd.dll mencfilt and etc). Unfortunately I have no time but first and foremost I would like to cook a custom ROM with the full original XIP, that would finally remove the issues in which there were bad blocks of flash in the kernel XIP or OS.nb.
Thx
Click to expand...
Click to collapse
Thanks feropont.
Very interesting. You mean that if I cook my rom not removing any .dll from original XIP I will have more "safe" rom. Have any of mentioned dll's like for debug any influence on rom speed ( can be switched on-off after flashing ) ?
Bootloder part seems to be possible be overwritten too in some cases. Example, Noksers works.
Regards
fxdjacentyfxd

fxdjacentyfxd said:
Thanks feropont.
Bootloder part seems to be possible be overwritten too in some cases. Example, Noksers works.
Regards
fxdjacentyfxd
Click to expand...
Click to collapse
Unfortunately I can disappoint you, this is not an example of a new bootloader, and the result work of a new OEM, in particular, changed the entrance to the bootloader. Bootloader by definition can not be in OS.nb, he placed in the common part of the file .TSW who all mistakenly called RADIO, and if elementary compared Hex, the differences are almost no. Located in the very first sectors and is called MIBIB_BOOT.
Code:
*** MIBIB_BOOT Region Info ***
Region 0: "MIBI " start: 0 size: 80 r-size: 32 Ver: 0x0000 SubVer: 0x0000
Region 1: "SIM_ " start: 80 size: 48 r-size: 0 Ver: 0x0000 SubVer: 0x0000
Region 2: "FSBL " start: 128 size: 32 r-size: 24 Ver: 0x0000 SubVer: 0x0000
Region 3: "OSBL " start: 160 size: 32 r-size: 24 Ver: 0x0000 SubVer: 0x0000
Thx

feropont said:
Unfortunately I can disappoint you, this is not an example of a new bootloader, and the result work of a new OEM, in particular, changed the entrance to the bootloader. Bootloader by definition can not be in OS.nb, he placed in the common part of the file .TSW who all mistakenly called RADIO, and if elementary compared Hex, the differences are almost no. Located in the very first sectors and is called MIBIB_BOOT.
Click to expand...
Click to collapse
I have always thought , this device starts as typical ( known from microprocessors equpipped with boot section ) always from bootloader part but other circumstances decides whether after power up bootloder:
1) boot the system and "jump" to it
2) do other action like flash upload - check 3-pin condition or condition forced by sdll+ software
That is why I do not understand why Nokser can have completely dead device and not damaged bootloader.
Regards
fxdjacentyfxd

Since moving to Android I noticed most roms come with an md5 to check against the downloaded copy before flashing, just in case there is any corruption. Maybe a good idea to take a similar approach with tg01 roms.
I don't own my th anymore but flashed it in excess of 100 times using both sddl+ and 3 pins and never had any problems.
Sent from my Desire HD using XDA App

Kernals, Nand, full functioning Android?

I gave my Dad my old blackstone when my Desore turned up.
He has winged that he can't get the marketplace and about all those general WinMo issues that people have (it dead etc)
I can't find a clear message on the status of NANDROID for blackstone.
TIAD8s site has NAND versions that are missing bluetooth or other funcitons
It appears there are basic functions that are lost according which kernal is being run.
I'm willing to do one completely convoluted install just to get Froyo style on my dads phone but only once. I never have trouble with new flashing procedures (slow and steady wins the race) but I don't want to hand him back the phone broken especially as he uses hands free in the car
So - can anyone say categorically that a NAND version work fully?

Categorically: Not yet. Wondering if ever...

Forget it...

Think Tiad8 only has test team working on a NAND build anyway?
Not seen it in action yet

Kernals?! ....

I find deliberate typos (NOT TEXT SPEAK) can get people to engage.

olly230 said:
I find deliberate typos (NOT TEXT SPEAK) can get people to engage.
Click to expand...
Click to collapse
Is that also why you called it a "Desore" instead of Desire?
lol, you made a typo or you just didn't know. No need to try and rationalize it .

t8 let people wait and wait.
though it's good to try, we don't know whether he really works on it as he start many threads to other device besieds HD.

arrrghhh said:
Is that also why you called it a "Desore" instead of Desire?
lol, you made a typo or you just didn't know. No need to try and rationalize it .
Click to expand...
Click to collapse
Desore was a proper typo, I'll put my hands up to that

Tiad8's just kidding us, it will send to test team files from NVIDIA Tegra device. Only RUU_signed is working, but I think it's my modded LK Bootloader from Rhodium (with modified mtype). Something's wrong with this nand.
I have runned this but touchscreen not working properly and I don't have GSM.

MietasSR said:
Tiad8's just kidding us, it will send to test team files from NVIDIA Tegra device. Only RUU_signed is working, but I think it's my modded LK Bootloader from Rhodium (with modified mtype). Something's wrong with this nand.
I have runned this but touchscreen not working properly and I don't have GSM.
Click to expand...
Click to collapse
I thought you were part of his developer team because he now give credits to you for your ruu and recovery.img (at last he ist starting to do this: giving credits) in the NAND download post.
With your post here I had to smile a little: now your name is connected to the "null nands" for many consumers in tiad8's forum. Even I thought you're part of it now and that's why I tried the build yesterday again: Boot partition to small and Kernel not working.
I think now it's getting to the critical point in the NAND experiments: correct or good partition sizes for NAND (some members there startet to change partition values in the image files with a hex editor) and more important: building a working kernel with modules for Blackstone NAND.
Until now all experiments reached a few preparing goals: getting a working .nbh for starting into fastboot, getting a recovery.img for a working CWM etc.
But now (if I am completely wrong please correct me, I really want to know) you have to change partition and ram parameters in clk and hope you will spare the protected parts.
And after that: Kernel and Modules for Blackstone on Nand. I am starting to believe here would be the real point for developers.
I started to build Kernel and Modules, a Boot Environment (initrdgz) from git and packed them with changed parameters in a Tinboot-Package. I can flash with the .nbh, I can boot, I got a lot of errors in init first, but I succeeded in running and loading the kernel, I get access to the changed mtd partitions etc. Debugging on Blackstone with Echo "" ist quite funny.
I got stuck when I tried to cp files from SD card to the /system partition (which is mounted r/w) - I can cp files from / to /system anyway. Big ?? for me. But I like to play with it a little more, because I learned a lot.

ThaiDai said:
I thought you were part of his developer team because he now give credits to you for your ruu and recovery.img (at last he ist starting to do this: giving credits) in the NAND download post..
Click to expand...
Click to collapse
Me Too!! Does this mean you are working on different things?