Database Users

HTC Artemis ExtROM working again

This message is intended to you all who tried to unlock the ExtROM of HTC Artemis and ended with not working ExtROM.
I am not sure if I can 100% document how I have achieved it, but I will try to do my best
You will need:
-collection of tools attached to this post
-WinRAR http://www.winrar.com/
-Winimage http://www.winimage.com/
First you will need an extrom image file, its part of the nbh image which you can unpack from the original image using winrar.
To extract the extended ROM image use the tool NBHextract.
command: NBHextract image.nbh
It will extract about 6 nb files one of them will be xx_ExtROM.nb.
You can check the content of the image with WinImage, you can also customize the image by removing or adding other cab, xml or exe files.
Remember only signed files will be executed.
Connect the phone to PC, you don't need to configure ActiveSync for synchronization.
From command prompt start following commands to enable RAPI:
cecopy EnableRapi.cab dev:\
cecopy Cert_SPCS.cab dev:\
cerun.exe -b CE:\Windows\wceload.exe \Cert_SPCS.cab /noui
cerun.exe -b CE:\Windows\wceload.exe \EnableRapi.cab /noui
pdocread -l
The STRG handles section from the output is what we will need for next commands.
STRG handles:
handle cdfc4c7e 1.89G (0x79120e00)
handle 8e9e43d2 14.99M (0xefc400)
handle aea981c6 38.24M (0x263e000)
handle eeae71ae 50.95M (0x32f4000)
handle cfb25ef6 2.94M (0x2f0000)
handle 2fb25ea2 3.06M (0x30fc00)
Insert the handle "code" of the ExtROM partition (the one about 15MB big) to following commands:
one for reading the current extrom from the phone
pdocread -h 0x8e9e43d2 0 0xf00000 extrom.ima
and other one to write the prepared image to the phone
pdocwrite -h 0x8e9e43d2 -v extrom.nb 0x000000 0xf00000
Remember the handle code changes every restart.
After you write the image to the phone do a hard reset.
Press both SW keys and use the Stylus for pressing the soft reset button, keep holding the soft keys until a message appears then press the green answering/calling button to format the phone (Hard Reset).
After hard reset and completing the touch screen adjusting wizard should load the ExtROM automatic setup like before.
Remember after hard reset you need to re-enable RAPI in case you want read or write the phone again.
Your device doesn't have to bee CID unlocked to be able write the images to the phone using this procedure.
Although this procedure seems to be pretty easy be careful Be sure you have at least one working ship update from your provider in case things go wrong.
I have also successfully written the OS.nb from the original HTC ship update and PDAmobiz releases with the same procedure.
Good luck!

Finally...using this method I've managed to repair my extrom. Few weeks ago I deleted all files in extended rom (using Total Commander) and was never able to restore it again (copying files gives error message 29 access denied). Now its all restored again...jaaaaiiii
instead of hardreset i did softreset because i didn't want to install all apps again

This is great! I'm now using my own customized Ext_rom. Thank you very much.

does this method allow one to unhide and unlock the ext_rom? Up to now I have not been able to really unlock the ext_rom.
thanks,

apap said:
does this method allow one to unhide and unlock the ext_rom? Up to now I have not been able to really unlock the ext_rom.
thanks,
Click to expand...
Click to collapse
No, this is not to unlock or unhide the ext_rom. With this method, you can just customize (adding or deleting files) your ext_rom image file on your PC. Then you can write your customized ext_rom back to your Artemis.

size of ext rom
i need to change size of ext rom on artemis.
regards.

Not working properly(((
Hi
I have used this method described above to re-write my Extrom with new items in there, its went OK, BUT the issue is that now Extrom doesnt start automatically after hard reset...it is just seats silently in the memory...just it. Can anyone help to activate it.
Thanks

hi I've one proble, I'm stop on the hangle step,, whot is handle? how I can see the right handle code? And how I can rebuild the custom rom and install it in my phone?
bye.

STRG handles
Hi PiGeonCZ
thanks for your method
pls explain what STRG handles/volumes associated with Windows.nb, Radio.nb, IPL.nb etc , as for example i wanted to upgrade my radio.nb or os.nb but does not know which string handle to work with.
and how to activate Extrom as now it is not loaded itself after hard reset.
thanks

PiGeonCZ said:
This message is intended to you all who tried to unlock the ExtROM of HTC Artemis and ended with not working ExtROM.
I am not sure if I can 100% document how I have achieved it, but I will try to do my best
You will need:
-collection of tools attached to this post
-WinRAR http://www.winrar.com/
-Winimage http://www.winimage.com/
First you will need an extrom image file, its part of the nbh image which you can unpack from the original image using winrar.
To extract the extended ROM image use the tool NBHextract.
command: NBHextract image.nbh
It will extract about 6 nb files one of them will be xx_ExtROM.nb.
You can check the content of the image with WinImage, you can also customize the image by removing or adding other cab, xml or exe files.
Remember only signed files will be executed.
Connect the phone to PC, you don't need to configure ActiveSync for synchronization.
From command prompt start following commands to enable RAPI:
cecopy EnableRapi.cab dev:\
cecopy Cert_SPCS.cab dev:\
cerun.exe -b CE:\Windows\wceload.exe \Cert_SPCS.cab /noui
cerun.exe -b CE:\Windows\wceload.exe \EnableRapi.cab /noui
pdocread -l
The STRG handles section from the output is what we will need for next commands.
STRG handles:
handle cdfc4c7e 1.89G (0x79120e00)
handle 8e9e43d2 14.99M (0xefc400)
handle aea981c6 38.24M (0x263e000)
handle eeae71ae 50.95M (0x32f4000)
handle cfb25ef6 2.94M (0x2f0000)
handle 2fb25ea2 3.06M (0x30fc00)
Insert the handle "code" of the ExtROM partition (the one about 15MB big) to following commands:
one for reading the current extrom from the phone
pdocread -h 0x8e9e43d2 0 0xf00000 extrom.ima
and other one to write the prepared image to the phone
pdocwrite -h 0x8e9e43d2 -v extrom.nb 0x000000 0xf00000
Remember the handle code changes every restart.
After you write the image to the phone do a hard reset.
Press both SW keys and use the Stylus for pressing the soft reset button, keep holding the soft keys until a message appears then press the green answering/calling button to format the phone (Hard Reset).
After hard reset and completing the touch screen adjusting wizard should load the ExtROM automatic setup like before.
Remember after hard reset you need to re-enable RAPI in case you want read or write the phone again.
Your device doesn't have to bee CID unlocked to be able write the images to the phone using this procedure.
Although this procedure seems to be pretty easy be careful Be sure you have at least one working ship update from your provider in case things go wrong.
I have also successfully written the OS.nb from the original HTC ship update and PDAmobiz releases with the same procedure.
Good luck!
Click to expand...
Click to collapse
if I want to read Os.nb wich is the correct script?
pdocread -h 0x8e9e43d2 0 0xf00000 extrom.ima is your exemple, 0 (zero) is the partition disk of ext rom, so i can try to insert 3 (three), the right partition of my OS (58 mb) rom and insert 0xf000000? it's all right?
es: pdocread -h 0x???????? 0 0xf000000 OS.ima (?= my handle), it's all right???

Work Great

For PiGeonCZ, I need your help for two question:
I've do all your steps, and I can read all ext-rom from other P3300 and i can write the new one in my O2 phone, but when I press the hard reset the ext rom still in loop when try to install the ttn.cab, why? I've try to delete ttn and the relative row in config.txt but the rom still in loop when try to install the other file (defoult page....)
my second question is about the OS dump. My friend have the original italian language of P3300, and he has dumped all his OS.nb whit this parameter:
es: pdocread -h 0x???????? 0 0xf000000 OS.ima (?= his handle), it's all right???
0f000000 (one zero plus of extrom exemple, all right?)
but about the end of all process, he have an error about impossible to read the right sector why? is there a mode to backup the OS.nb, and so how I can read if it's is all right dumped?? (do you know any program to read .nb file?) do you know any program to recompile the nba rom?
best regard.

@thefamous
Try to put the lines with ttn setup at the end of the config.txt. Before the "LOCK: Disabled" line. It worked for me.
This thread is about the extrom, please keep it clean of other things.
Anyway. You don't need to use handles when reading the whole OS image. Try following command: pdocread 0 0x3900000 OS.nba

PiGeonCZ said:
@thefamous
Try to put the lines with ttn setup at the end of the config.txt. Before the "LOCK: Disabled" line. It worked for me.
This thread is about the extrom, please keep it clean of other things.
Anyway. You don't need to use handles when reading the whole OS image. Try following command: pdocread 0 0x3900000 OS.nba
Click to expand...
Click to collapse
thanks, I've try to change the line of ttn setup in config.sys but now still in loop on PP_DefaultPage_WWE.CAB. I've try to modify this line (cut and paste it below LOK: line) but still loop on the other file.. do you have any solution? I'll try to re install the original ext rom and all work well.
this is my original config.sys
LOCK:Enabled
EXEC:\Windows\cusTSK.exe \Windows\HTC_Default.tsk
CAB: \Extended_ROM\MP_CVSDcpl_20060718.cab
XML: \Windows\MP_MMS3.5_HTC_Generic_Artemis_060818.xml
CAB: \Extended_ROM\PP_DefaultPage_WWE.CAB
XML: \Extended_ROM\PP_ExtVer.xml
CAB: \Extended_ROM\MP_ttn.cab
CAB: \Extended_ROM\MP_TT6_Voice13_ITA.cab
CAB: \Extended_ROM\PP_RemoveBTlnk.cab
CAB: \Extended_ROM\ST_PatchPeripheral.cab
CAB: \Windows\PP_CommManager_Patch_060808.CAB
EXEC:\Extended_ROM\ChgScutAttri.exe
LOCKisabled
RST: Reset
P.S. wich is the write command for OS.nba? this is all right command: pdowrite OS.nba 0 0x3900000? thanks

@thefamous
I am sorry but I don't know what could be wrong, for me has worked putting the freezing cabs just above the LOCK: DISABLED.

Zdravím,
funguje to i pro PDAmobiz ROMky jo?

thefamous said:
thanks, I've try to change the line of ttn setup in config.sys but now still in loop on PP_DefaultPage_WWE.CAB. I've try to modify this line (cut and paste it below LOK: line) but still loop on the other file.. do you have any solution? I'll try to re install the original ext rom and all work well.
this is my original config.sys
LOCK:Enabled
EXEC:\Windows\cusTSK.exe \Windows\HTC_Default.tsk
CAB: \Extended_ROM\MP_CVSDcpl_20060718.cab
XML: \Windows\MP_MMS3.5_HTC_Generic_Artemis_060818.xml
CAB: \Extended_ROM\PP_DefaultPage_WWE.CAB
XML: \Extended_ROM\PP_ExtVer.xml
CAB: \Extended_ROM\MP_ttn.cab
CAB: \Extended_ROM\MP_TT6_Voice13_ITA.cab
CAB: \Extended_ROM\PP_RemoveBTlnk.cab
CAB: \Extended_ROM\ST_PatchPeripheral.cab
CAB: \Windows\PP_CommManager_Patch_060808.CAB
EXEC:\Extended_ROM\ChgScutAttri.exe
LOCKisabled
RST: Reset
P.S. wich is the write command for OS.nba? this is all right command: pdowrite OS.nba 0 0x3900000? thanks
Click to expand...
Click to collapse
try putting a Cert_SPCS.cab in the first of the config list.

hi, can u tell me where i have to do the first step with the nbhextract.exe??
or can someone send me an image of a xda orbit?

Command "pdocread -l" returns following:
STRG handles:
handle 2e9d5306 2.00M (0x1ff800)
handle 4ea971d2 51.99M (0x33fcc00)
handle 8eae81ae 49.95M (0x31f2000)
handle 6fb26ef6 2.94M (0x2f0000)
handle 4fb26ea2 3.06M (0x30fc00)
so, I don't see 15M partition. Which handle should I use?

XDA Orbit extrom damaged
Hi to all..
Can someone tell me wich address I must use from info below to read/write
extrom to XDA Orbit?
Thanks
D:\ArtExtROMtools>pdocread -l
52.99M (0x34fe000) TrueFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 46.99M (0x2efe000) Part02
54.96M (0x36f6000) TrueFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 46.99M (0x2efe000) Part02
2.00M (0x1ff800) TRUEFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 46.99M (0x2efe000) Part02
2.00M (0x1ff800) TRUEFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 46.99M (0x2efe000) Part02
1.87G (0x77a80000) DSK1:
| 1.87G (0x77a60200) Part00
STRG handles:
handle ee3083e6 1.87G (0x77a60200)
handle 8e9ae6de 2.00M (0x1ff800)
handle 4e9e03be 2.00M (0x1ff800)
handle aea9e1c6 54.96M (0x36f6000)
handle 0eaeb1ae 46.99M (0x2efe000)
handle afb29ef2 2.94M (0x2f0000)
handle 4fb29e9e 3.06M (0x30fc00)
disk ee3083e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8e9ae6de
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4e9e03be
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk aea9e1c6
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0eaeb1ae
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 33 3d 02 04 0b 0b 16 d8 0c 09 06 62
disk afb29ef2
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 33 3d 02 04 0b 0b 16 d8 0c 09 06 62
disk 4fb29e9e
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 33 3d 02 04 0b 0b 16 d8 0c 09 06 62
D:\ArtExtROMtools>

Backup your Artemis (Mini Tutorial)

Hi guys, I have been looking for a while now how to backup the Artemis ROM. I put up a little tutorial, hope you guys think it is usefull.
----------------------------------------------------------
1. Download ITSUTILS by Itsme: http://nah6.com/~itsme/itsutilsbin-20070323.zip
2. Extract the files to a directory.
3. You will find pdocread.exe inside the extracted directory.
4. Make a directory somewhere on a disk, where you want to save the parts to lets say for example C:\ROM
Backup the following parts like this:
SPL:
pdocread -n 0 -b 0x20000 0 0x100000 C:\ROM\bdk0-spl.nb
CID:
pdocread -n 1 -b 0x10000 0 0x40000 C:\ROM\bdk1-0-cidarea.nb
GSM Data:
pdocread -n 1 -b 0x4000 0x10000 0x4000 C:\ROM\bdk1-4-gsmdata.nb
GSM Radio ROM:
pdocread -n 1 -b 0x40000 0x140000 0x280000 C:\ROM\bdk1-5-gsmcode.nb
Splash Screen:
pdocread -n 1 -G 0x30000 -b 0x10000 0xF0000 0x30000 C:\ROM\bdk1-f-splash.nb
Extended ROM:
pdocread -h 0x[HANDLE] 0 0xf00000 C:\ROM\ExtROM.nb
Change [HANDLE]. You can get the handle by typing pdocread -l Watch out! the Handle is different every time
OS:
pdocread 0x3500000 C:\ROM\OS.nb
Good luck and if you have any questions feel free to ask them!
And ofcourse a HUGE thanks to pof for finding out these things!

i give it a try but where does he write the backup?

What is the program to use for make a backup? I don't understand...

fabbio87 said:
What is the program to use for make a backup? I don't understand...
Click to expand...
Click to collapse
The instructions are very clear, try to read again guys. You have to type these commands in the DOS command window (Click Start -> Run..., type CMD on the Open box then Click OK)

rvbcrs said:
OS:
pdocread 0x350000 C:\ROM\OS.nb
Click to expand...
Click to collapse
Thanks rvbcrs, I would like to make a correction here
0x3500000 instead of 0x350000
furthermore they are different from Artemis derivations
for ARTE100 (HTC P3300) it is 0x3900000
for ARTE200 (O2 Orbit) it is 0x3500000
for ARTE300 (LOVE, i.e Dopod M700) it is 0x3E00000
correct me if I am wrong!

rvbcrs said:
Hi guys, I have been looking for a while now how to backup the Artemis ROM. I put up a little tutorial, hope you guys think it is usefull.
----------------------------------------------------------
1. Download ITSUTILS by Itsme: http://nah6.com/~itsme/itsutilsbin-20070323.zip
2. Extract the files to a directory.
3. You will find pdocread.exe inside the extracted directory.
4. Make a directory somewhere on a disk, where you want to save the parts to lets say for example C:\ROM
Backup the following parts like this:
SPL:
pdocread -n 0 -b 0x20000 0 0x100000 C:\ROM\bdk0-spl.nb
CID:
pdocread -n 1 -b 0x10000 0 0x40000 C:\ROM\bdk1-0-cidarea.nb
GSM Data:
pdocread -n 1 -b 0x4000 0x10000 0x4000 C:\ROM\bdk1-4-gsmdata.nb
GSM Radio ROM:
pdocread -n 1 -b 0x40000 0x140000 0x280000 C:\ROM\bdk1-5-gsmcode.nb
Splash Screen:
pdocread -n 1 -G 0x30000 -b 0x10000 0xF0000 0x30000 C:\ROM\bdk1-f-splash.nb
Extended ROM:
pdocread -h 0x[HANDLE] 0 0xf00000 C:\ROM\ExtROM.nb
Change [HANDLE]. You can get the handle by typing pdocread -l Watch out! the Handle is different every time
OS:
pdocread 0x350000 C:\ROM\OS.nb
Good luck and if you have any questions feel free to ask them!
And ofcourse a HUGE thanks to pof for finding out these things!
Click to expand...
Click to collapse
@all sorry about my english
If my phone brick how can i write origin OS to my phone.
pls guide me in details because i'm newbie
thanks for your kind!

Tamagochi said:
The instructions are very clear, try to read again guys. You have to type these commands in the DOS command window (Click Start -> Run..., type CMD on the Open box then Click OK)
Click to expand...
Click to collapse
i know i have to type it in a dos box but where does the program write the backup of the os to. i get the following message: hexdumpTFSToStdout(0x3900000, 0x0)
i have a arte100 device (p3300)

rvbcrs wrote:
4. Make a directory somewhere on a disk, where you want to save the parts to lets say for example C:\ROM
Click to expand...
Click to collapse
Where is the problem? C:\ROM

Realflo said:
rvbcrs wrote:
Where is the problem? C:\ROM
Click to expand...
Click to collapse
yes i know but the OS.nb gives an error and the program is bussy for about 2 minutes and there is no file in the c:\rom directory the onley thin i get is this message:
hexdumpTFSToStdout(0x3900000, 0x0)

pvdhelm said:
i know i have to type it in a dos box but where does the program write the backup of the os to. i get the following message: hexdumpTFSToStdout(0x3900000, 0x0)
i have a arte100 device (p3300)
Click to expand...
Click to collapse
I have the same problem.
After the command :
I:\pda\rom>pdocread 0x3900000 I:\pda\rom\Bachup\OS.nb
HexdumpTFFSToStdout(0x3900000, 0x0)
and nothing ....
IN :
Extended ROM:
pdocread -h 0x[HANDLE] 0 0xf00000 C:\ROM\ExtROM.nb
Change [HANDLE]. You can get the handle by typing pdocread -l Watch out! the Handle is different every time
What is my [HANDLE] ? I can't see which one ?
my command pdocread -l :
56.95M (0x38f4000) TrueFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 50.95M (0x32f4000) Part02
38.24M (0x263e000) TrueFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 50.95M (0x32f4000) Part02
14.99M (0xefc400) TRUEFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 50.95M (0x32f4000) Part02
14.99M (0xefc400) TRUEFFS
| 3.06M (0x30fc00) Part00
| 2.94M (0x2f0000) Part01
| 50.95M (0x32f4000) Part02
1.89G (0x79280000) DSK1:
| 1.89G (0x79120e00) Part00
STRG handles:
handle 8fb7d542 1.89G (0x79120e00)
handle 4e99b5ee 14.99M (0xefc400)
handle 4e9e345a 14.99M (0xefc400)
handle 6ea971d2 38.24M (0x263e000)
handle 8eae71ae 50.95M (0x32f4000)
handle efb25ef2 2.94M (0x2f0000)
handle 0fb25e9e 3.06M (0x30fc00)
disk 8fb7d542
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4e99b5ee
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4e9e345a
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6ea971d2
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8eae71ae
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 6f 11 01 01 28 13 0a 78 07 08 06 f8
disk efb25ef2
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 6f 11 01 01 28 13 0a 78 07 08 06 f8
disk 0fb25e9e
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 6f 11 01 01 28 13 0a 78 07 08 06 f8

ALLYou it is necessary previously to do Aplication unlock:
Use
1) Cert_SPCS.cab
2) EnableRapi.cab

arc said:
ALLYou it is necessary previously to do Aplication unlock:
Use
1) Cert_SPCS.cab
2) EnableRapi.cab
Click to expand...
Click to collapse
get the same error message as before i installed the .cab files

pvdhelm said:
get the same error message as before i installed the .cab files
Click to expand...
Click to collapse
Same for me ....
And don't know which HANDLE I have to use from the list http://forum.xda-developers.com/showpost.php?p=1324492&postcount=10

pvdhelm Mistake in syntax.
Use :
pdocread 0x0 0x3900000 OS.nb0

I knew something was missing
Thanks

Now I have my ROms Backup ...
What can I do with it
It seems that if you want to restore you need to sign the ROMs
Questions :
Sign all of them ?
Only OS ?
how to sign them ?
Do I use pdocwrite ?
Do I use the beautyfull Artemis Update SPL (USPL) v.01 from pof (great job!!) ?
thanks

If you have USPL - use htcrt for making ROM in nbh .
http://forum.xda-developers.com/showthread.php?t=311909
htcrt- do signature for USPL - this signature not HTC -only if you use USPL.
You may create only System -OS.nb0

Tamagochi said:
Thanks rvbcrs, I would like to make a correction here
0x3500000 instead of 0x350000
furthermore they are different from Artemis derivations
for ARTE100 (HTC P3300) it is 0x3900000
for ARTE200 (O2 Orbit) it is 0x3500000
for ARTE300 (LOVE, i.e Dopod M700) it is 0x3E00000
correct me if I am wrong!
Click to expand...
Click to collapse
Great thanks! I can't test these values.. so I will write them down, but I don't know if it will work..

arc said:
If you have USPL - use htcrt for making ROM in nbh .
http://forum.xda-developers.com/showthread.php?t=311909
htcrt- do signature for USPL - this signature not HTC -only if you use USPL.
You may create only System -OS.nb0
Click to expand...
Click to collapse
Amen too that! hehe..

Extended ROM:
pdocread -h 0x[HANDLE] 0 0xf00000 C:\ROM\ExtROM.nb
Change [HANDLE]. You can get the handle by typing pdocread -l Watch out! the Handle is different every time
how do i know wich handle i use ?
after the backup i got this files:
is this good?
bdk0-spl.nb 1.00 mb
bdk1-0-cidarea.nb 256 kb
bdk1-4-gsmdata.nb 16 kb
bdk1-5-gsmcode.nb 2.50mb
bdk1-f-splash.nb 192 kb
OS.nb0 56.0mb

Have an unbranded Touch Dual...

Hi geeks,
I have an unbranded Touch Dual, not SIM locked (16 key version). I am no good with low level programming and mobile stuff - but as a developer in other areas, I realize that someone may benefit from getting dumps from my device - or maybe even "live" access to it.
I got the device today, and it has the following information:
Model: NIKI100
---
ROM version: 1.31.403.09
ROM date: 11/01/07
Radioversion: 1.58.16.27
Protocol version: 25.61.30.03H
---
Windows Mobile 6 Professional
CE OS 5.2.1622(Build 18128.0.4.4)
Let me know if there is anything I can help with. For the right developer, I might even be able to provide access to a PC with the device connected and a remote desktop connection (RDP). You can even get a webcam session showing the display of the device.
I can live without the device for shorter periods of time (24 hours or so) up to 2-3 times a week, and also every night when I am sleeping. As long as you don't screw it up beyond repair ... ;-)
(While you work I can also interact physically with the device if needed - for example doing resets, field tests, etc).
Throw me a message if this is any good for you.
- Jesper

uhm ... you have a new country code!
ok wait a sec i search for the right tools!

here is the answer ... -> http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
happy dumping ^_^

I was going to make a post in the exact same vein.
Would anyone actually be interested in a dump of the 1.31.405.09 ROM (Radio 1.58.16.27) from a 16-key HTC branded Touch Dual?

why not ... put it online!
i have see, that different Keyboard Driver needed for 20key and 16key version.

Very interrested, as long it's a WWE.... I'd like to see the difference between the 16 and the 20 keys keyboard....
Thanks...

Some Keyboardsettings are different!
Check this Thread and Download both ROMs. Make a File and Reg Compare!
http://forum.xda-developers.com/showthread.php?t=350860
The different are very small ... like only max 5 Files and a collection off Regkeys.

Having a tad trouble dumping.
Am following the guide for the Hermes posted by NetrunnerAT.
Not sure if I have missed something, never having done this before...
My output from pdocread -l (had to unlock first) :
Code:
210.88M (0xd2e0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 80.50M (0x5080000) Part02
| 123.75M (0x7bc0000) Part03
5.69G (0x16c680000) DSK1:
| 5.69G (0x16c280000) Part00
STRG handles:
handle 874f0f92 5.69G (0x16c280000)
handle 4748d452123.75M (0x7bc0000)
handle e74b3d22 80.50M (0x5080000)
handle 474b3cfe 3.50M (0x380000)
handle 474b3a4a 3.12M (0x31f000)
disk 874f0f92
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4748d452
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74b3d22
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b3cfe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b3a4a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
But when I check to see if the partition sizes reported by pdocread are correct it returns:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part00 -t
real nr of sectors: 1 - 512.00byte (0x200)
C:\itsutils>pdocread -w -d FLASHDR -p Part01 -t
real nr of sectors: 1 - 512.00byte (0x200)
C:\itsutils>pdocread -w -d FLASHDR -p Part02 -t
real nr of sectors: 1 - 512.00byte (0x200)
Whereas the wiki says I should expect:
Code:
C:\itsutils>pdocread -w -d FLASHDR -p Part00 -t
real nr of sectors: 6398 - 3.12Mbyte (0x31fc00)
C:\itsutils>pdocread -w -d FLASHDR -p Part01 -t
real nr of sectors: 5888 - 2.88Mbyte (0x2e0000)
C:\itsutils>pdocread -w -d FLASHDR -p Part02 -t
real nr of sectors: 104192 - 50.88Mbyte (0x32e0000)
C:\itsutils>pdocread -w -d FLASHDR -p Part03 -t
real nr of sectors: 118784 - 58.00Mbyte (0x3a00000)
Which dosnt look right to me.
Whats my next move?

@dabs This post may help:
http://forum.xda-developers.com/showpost.php?p=1718401&postcount=51

Sorted - thanks to chainfire (had to use -b switch to set sectorsize to 0x800)
http://rapidshare.com/files/77103304/Niki-1.31.405.09-WWE-dabs.zip.html
16-key
ROM is WWE 1.31.405.09 dated 10/31/07
Radio is 1.58.16.27
just the .raw files

Wonderful, I'm going to the same with my unbranded Nike 20 keys, and we'll be able to compare and find out the differences....
Any way to re-install these Raw files in case of problem ??

As I understand it - not yet.
As far we cannot flash to the dual, but im sure the magic cooks will figure something out in due course.

Calvin4000
Make a file Compare and a Reg Hive Compare. You can found 5 files and some keys ... very easy to find!
If you copy or set the wrong files and your os is currupt. you only need to hard reset! this reinstall the firmware!
In the moment you cant kick your firmware!

Can somebody with a German ROM dump it?

Well, the title says pretty much everything...
I need a dump of a German Rose ROM for developing a German ROM for the VOX. I already have a dump, but it is English and Russian. So far it works great, but I would like to add other languages (especially German )!
So if anybody could dump his/her ROM and upload it somewhere that would be great!
Thanks!

yes i search it also..
please post a dump

hi there!
i would do it, but i have no experience with dumping roms.
could somebody post me a step-by-step guide?

Yes, of course, there is a guide here in the wiki for the Vox, i hope it works for the Rose too.

Can anybody provide us a step-by-step guide for dumping a Rose's ROM?!
Thanks in advance

frauhottelmann said:
Can anybody provide us a step-by-step guide for dumping a Rose's ROM?!
Thanks in advance
Click to expand...
Click to collapse
I use Kaiser kitchen to dump the Rose's ship Rom for porting tomy BlackJack II. Search Kaiser Kitchen in this forum.

Still nothing? I am really desperate for the German muis! The problem is that I don't have the files for HTC's stuff, the SYS isn't a big deal, there are lot's of devices with a German SYS, but none with HTC's stuff!

Hi Frau Hotte,
I have not really experience with dumping rom of the new WM Devices greater then WM3.xx
So if you want, we can make a teamviewer connection and you can feel free to make a Dump of my german S740?

I am not quite sure how we can dump it, we have to try a couple of different ways.
1. http://forum.xda-developers.com/showthread.php?t=334680
2. http://forum.xda-developers.com/showthread.php?t=477539 (the 2nd part after or)

so we try it, maybe, nothing is so far as the popo of the world

lol
Nobody needs to where I actually live^^
You should try the second method first, I hope this one works!

hehe was only a joke
I tried from Link#2 TFFSDump.exe on S740 but that will not dump the ROM to SD Card. Following Error MEssage displayed: "Couldn´t get TrueFFS Info!"
the Application pdocread.exe from itsutils dont work too...
When I Start pdocread there was transfered a File/command whatever to Rose (S740) and I must accept this file on Rose. After I accepted i become this error message:
D:\itsutilsbin-20080923\pdocread.exe -i
Copying D:\itsutilsbin-20080923\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.
any IDea?
I Try to find some issues with total commander on Smartphone...

Try to app unlock your device! I am really out of answers here...

I tried some RAPI Unlockers, some other tweaks that I known since WM2003... but :-(
Now I unlock successfully with http://rapidshare.com/files/193990423/SDA_ApplicationUnlock.exe
the rose, and now tells me itsutils:
D:\itsutilsbin-20080923\pdocread.exe -l
209.25M (0xd140000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.38M (0x360000) Part01
| 82.50M (0x5280000) Part02
| 120.25M (0x7840000) Part03
STRG handles:
handle#0 8d6e3f8a 120.25M (0x7840000)
handle#1 ad77c1f6 82.50M (0x5280000)
handle#2 0d77c1d2 3.38M (0x360000)
handle#3 2d77c002 3.12M (0x31f000)
disk 8d6e3f8a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk ad77c1f6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0d77c1d2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2d77c002
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
so I try to dump the german HTC S740 again with:
D:\itsutilsbin-20080923\pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
D:\itsutilsbin-20080923\pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 0x360000 Part01.raw
D:\itsutilsbin-20080923\pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 0x5280000 Part02.raw
D:\itsutilsbin-20080923\pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 0x7840000 Part03.raw
And this Files you are needed?
So you must write it back with itsutils (see http://www.xs4all.nl/~itsme/projects/xda/tools.html )
actually the full package of tools that I used for ROM dumping of S740 : http://nah6.com/~itsme/itsutilsbin-20080923.zip
But don´t forget before uploading to your HTC to unlock the Applicationstore with SDA Tool above ;-)

That looks good! After you did this command continue with:
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
then
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x360000 Part01.raw
then
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x5280000 Part02.raw
then
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x7840000[COLOR=Teal][/COLOR] Part03.raw
And you should get 4 *.raw files!

ups, you post too
please feel free: http://rapidshare.com/files/203561330/HTC_S740_german_Rom_DUMP.7z.html
I doesn´t have winrar, so please use the freeware multipacking tool 7zip ;-)
greetinsg and good night
Joy (from the really outside popo of anywhere)

Oh man I love you!!!
Well, I need these files for the Vox not the Rose. There are no German files yet, so thank you very much!

hehe, the VOX is the better one device. Better Keyboard, nicer look - only not much memory and a little slow. But the nicest Smartphone from HTC...
the modell after VOX (the Wings) was for the trash basket and the S740 I don´t love it too..
Now I Use a Nokia E71/E66, a Apple IPhone and a HTC Shift.
If you need my (fast) brandnew S740 ;-) Let me know... if not, maybe you have a good navigation solution for Rose for me ? ;-)

Hehe, no thanks. The next device I get will have a touch screen.
And the only thing that I find too slow is the rotating!

oki, it was a versuch wert
maybe if you need no Keyboard the HTC Touch HD is a good Deal, and with Keyboard...
hmm.. with your form factor only the new one HTC Touch Pro2 ?

[FAQ]How to backup rom?

Any boday tell me how to backup HD rom from device?Use backuptools can not backup.
Thanks yr help!

I use the spb backup software. works great.

With the backup tools mentioned above you can't extract the rom at all. There you need some specialized tools. Click here in order to get more details.

Here's how to do it - most tutorials miss important bits of information, so I'll post a detailed instruction here.
1. Download itsutils and copy them to a folder (in my case it's C:\itsutils)
2. Fire up the Windows command line window - Start, Run, cmd
3. Go to the itsutils folder by typing
Code:
cd c:\itsutils
4. View available partitions (not necessary, you can skip this step) with this command:
Code:
itsutils -l
You should get something like
Code:
457.50M (0x1c980000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.25M (0x440000) Part01
| 126.38M (0x7e60000) Part02
| 323.75M (0x143c0000) Part03
7.42G (0x1db000000) DSK7:
| 7.42G (0x1dac00000) Part00
STRG handles:
handle efea74fe 7.42G (0x1dac00000)
handle 4fd70f46323.75M (0x143c0000)
handle 2fe261f6126.38M (0x7e60000)
handle 6fe261d2 4.25M (0x440000)
handle 4fe26002 3.12M (0x31f000)
disk efea74fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4fd70f46
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2fe261f6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6fe261d2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4fe26002
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
5. Check partition sizes (you can do this instead of the previous step):
Code:
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part00 -t
You'll get
Code:
real nr of sectors: 1598 - 3.12Mbyte, 0x31f000
Repeat for other partitions:
Code:
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part01 -t
real nr of sectors: 2176 - 4.25Mbyte, 0x440000
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part02 -t
real nr of sectors: 64704 - 126.38Mbyte, 0x7e60000
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part03 -t
real nr of sectors: 165760 - 323.75Mbyte, 0x143c0000
6. Dump the ROM now - you'll get it in parts. Make sure the sizes (bold) match the ones you got in the previous step!
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 [B]0x31f000[/B] Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 [B]0x440000[/B] Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 [B]0x7e60000[/B] Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 [B]0x143c0000[/B] Part03.raw
7. Put the parts in an archive and post here - that's it.

Thakns a lot,I will backup now

vangrieg said:
Here's how to do it - most tutorials miss important bits of information, so I'll post a detailed instruction here.
Click to expand...
Click to collapse
Many thanks for this usefull infos!
How can I make a flashable file from this 4 raw files?
(Sorry for this question, I'm not so expert in this theme.)

is this procedure all done on the handset or does it have to be connected via activesync?

InsecureSpike said:
is this procedure all done on the handset or does it have to be connected via activesync?
Click to expand...
Click to collapse
via activesync

thanks for tha quick reply mate,
much appreciated,

To make a flashable ROM out of these files you'll need a kitchen.
BTW, I think that extracting the fourth part is not necessary, but this needs to be confirmed by someone more knowledgeable.
In general, I think instructions about such stuff should be in a sticky post in this forum, I find it strange that people ask users to upload their ROMs without explaining how to do it.

vangrieg said:
Here's how to do it - most tutorials miss important bits of information, so I'll post a detailed instruction here.
1. Download itsutils and copy them to a folder (in my case it's C:\itsutils)
2. Fire up the Windows command line window - Start, Run, cmd
3. Go to the itsutils folder by typing
Code:
cd c:\itsutils
4. View available partitions (not necessary, you can skip this step) with this command:
Code:
itsutils -l
You should get something like
Code:
457.50M (0x1c980000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.25M (0x440000) Part01
| 126.38M (0x7e60000) Part02
| 323.75M (0x143c0000) Part03
7.42G (0x1db000000) DSK7:
| 7.42G (0x1dac00000) Part00
STRG handles:
handle efea74fe 7.42G (0x1dac00000)
handle 4fd70f46323.75M (0x143c0000)
handle 2fe261f6126.38M (0x7e60000)
handle 6fe261d2 4.25M (0x440000)
handle 4fe26002 3.12M (0x31f000)
disk efea74fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4fd70f46
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2fe261f6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6fe261d2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 4fe26002
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
5. Check partition sizes (you can do this instead of the previous step):
Code:
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part00 -t
You'll get
Code:
real nr of sectors: 1598 - 3.12Mbyte, 0x31f000
Repeat for other partitions:
Code:
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part01 -t
real nr of sectors: 2176 - 4.25Mbyte, 0x440000
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part02 -t
real nr of sectors: 64704 - 126.38Mbyte, 0x7e60000
c:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part03 -t
real nr of sectors: 165760 - 323.75Mbyte, 0x143c0000
6. Dump the ROM now - you'll get it in parts. Make sure the sizes (bold) match the ones you got in the previous step!
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 [B]0x31f000[/B] Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 [B]0x440000[/B] Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 [B]0x7e60000[/B] Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 [B]0x143c0000[/B] Part03.raw
7. Put the parts in an archive and post here - that's it.
Click to expand...
Click to collapse
when we back up the rom, does it save the configuration too?
thank you

No, this just copies the factory software installer image from which everything is deployed when you do a hard reset. ROM means read-only memory after all!

which is the best way to back up the Radio?
thanks?

vangrieg said:
Here's how to do it - most tutorials miss important bits of information, so I'll post a detailed instruction here.
(...)
7. Put the parts in an archive and post here - that's it.
Click to expand...
Click to collapse
vangrieg,
I 've done all the steps and now I have 4 raw files.
What is the best way to transform them in a flashable rom?
I have read lot of tutorials but I think I am a bit lost here...
thanks

jacare said:
What is the best way to transform them in a flashable rom?
Click to expand...
Click to collapse
I have the same question. How to make a backup of my installed ROM that I could restore later on (if I need to send the device to the HTC repair center)

kaefert said:
I have the same question. How to make a backup of my installed ROM that I could restore later on (if I need to send the device to the HTC repair center)
Click to expand...
Click to collapse
Download and unzip the latest itsutilsbin from here: http://wiki.xda-developers.com/index.php?pagename=XdaUtils
Change in a regeditor on your HD: HKLM\Security\Policies\Policies
valuename '00001001' from dword:2 to dword:1 then softreset
Connect the HD to the PC and follow the intsructions which is in this topic post #4
( I can't list my partitions with itsutils -l command so I use pdocread -l)
Finally you will get 4 raw files, then read this topic: http://forum.xda-developers.com/showthread.php?t=469399

I found your recipe in this post too : http://forum.xda-developers.com/showthread.php?t=427507, plus the way to make a flashable ROM.
Just a question, you wrote "itsutils -l", but seems to be "pdocread -l" ??
Well, I launched "pdocread -l" command, and he prompted me to copy the isutils.dll to WCE:\windows, I answered YES on my Blackstone, and then the file was copied, and I had the following step you described.
Maybe the last version of isutils package included that copy, that's handy
Thanks anyway for your post, well done.

typo?
Sorry, please discard. Already posted...
vangrieg said:
Code:
itsutils -l
Should this not be?:
Code:
pdocread.exe -l
Click to expand...
Click to collapse

Hi. I'm just new here and also I dont have any experience or knowledge about the topic in this thrend.
I followed the detailed instruction of vangrieg but unfortunately I encountered an error when I fired up the pdocread -w -d FLASHDR -b 0x800 -p Part00 -t
This was the error:
c:\itsutils>pdocread -l
Copying c:\itsutils\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.
Any one want to enlighten me about this? I'm stuck and dont know what to do next.

Change in a regeditor on your HD: HKLM\Security\Policies\Policies
valuename '00001001' from dword:2 to dword:1 then softreset