Hey guys, I've been playing around with 2003SE trying to figure out how to change the bootsplash, and this is what I've found so far.
I executed the following command:
Code:
pmemdump.exe 0x80000000 0x2000000 rom.raw
This should have dumped the entire ROM, as documented here:
http://www.xs4all.nl/~itsme/projects/xda/wince-rom-layout.html
I then opened the file rom.raw using IrfanView with the following options:
Image Width=240, Image height=70000, Header size=0, 16 BPP, NO Vertical flip.
And I was able to see an image that resembled the bootsplash near the top, but it was distorted. However, about a quarter of the way down I see the "Welcome to T-Mobile" logo in 320x240 perfectly.
It looks like the distorted bootsplash image is repeated twice when I open it in this format, so I tried opening the file with a width of 120 pixels, but it was still distorted. I've tried opening the raw file with all of the combinations I can think of, but none show the bootsplash clearly.
Any ideas of how we can determine it's starting byte position and format?
WM2003SE Bootsplash Address and Format Found
The bootsplash for the available WM2003SE rom is stored at 0x800417e0, and is only 76800 bytes long. Extract it from the rom using the following command:
Code:
pmemdump 0x800417e0 76800 bootsplash.raw
Open it as a 320x240 raw file with 8 bits per pixel (grayscale?) no header.
I have attached the bootsplash.raw file below, but had to change extension to .txt for uploading.
I'm unable to write a new bootsplash since pnewbmp doesn't support this offset, and pnewbootloader has other complaints using this offset.
There may be some color information in the 8 bits per pixel.
What we need now:
1.) Someone that knows more about graphic formats to investigate if the bootsplash has color information.
2.) A modified version of the pnewbmp.exe file from http://www.xs4all.nl/~itsme/projects/xda/tools.html that supports the new offset. (Ideally, modify it so it can be used for any offset).
Shawn
Are u sure?
old files had been twice big (153600 Byte)
Have you tried this size?
You shoud be able to run
Code:
pnewbmp -o 0x800417e0 filename
The file you've upladed doesn't look complete.....
Stefan
The T-Mobile ROm you´ve found is added by the kitchen.
Until now it´s not possible to cook a ROM without the splashscreen. So it´s added at the 0x80780000 position.
Has nothing to do with the real splash screen....
Stefan
Fairly Certain
old files had been twice big (153600 Byte)
Click to expand...
Click to collapse
Stefan,
You're absolutely right, it is definitely different than previous bootsplash formats. If I'm right, it's half the size because it uses 8 bits per pixel instead of 16 bits per pixel, as before. I believe that means it must use a standard 256 color table. We just need to know which standardized color table it uses (Windows System?), and find graphics software that will open bitmaps without headers.
Have you tried this size?
Click to expand...
Click to collapse
I've tried dumping the old file size, but it is just garbage after 76800 bytes. Perhaps they switched to this format to save memory.
The T-Mobile ROm you´ve found is added by the kitchen.
Click to expand...
Click to collapse
That's good to know. I thought that was the real bootsplash, and there was some switch in the code for this version of the ROM to point the bootsplash image to a temporary image that we are seeing. Let me illustrate with code:
Code:
Internal_Rom = True;
...
If (Internal_Rom==True)
Bootsplash_start_byte=0x800417e0;
else
Bootsplash_start_byte=0x80780000;
But since that's not the case, we don't need to worry about tracking down that switch.
I've tried using pnewbmp with the offset option, but I'm getting an error reading the bitmap. I've tried appending the original ROM data after my custom bootsplash (when necessary) to create files of sizes 76800, 151672, and 153600, but I still received the error so I don't think it is a problem with the file size, but it may not recognize the format. (pnewbmp appears to be trying to read the size 0x25800=153600, so that file size should have worked if it were a file size issue)
So, here's a theory of how to make a bootsplash for this new ROM format:
1. Create your image in RGB 320x240.
2. Change Image Mode to 8 bits/channel, and Indexed Color using the Palette "System (Windows)" (?).
3. Save your file in RAW format (Uncheck Alpha Channels), 0 Header
Resulting File Size=76800.
Now I just need to test this theory using a program that will allow me to write an arbitrary number of bytes to an arbitrary byte offset in the ROM.
Shawn
It works!
I'm getting ready to sell my Wallaby (replaced with PPC-6700), so I gave my (old) theory a try, and it worked!
I executed the following commands:
Code:
pmemdump.exe 0x80000000 0x417e0 one.raw
pmemdump.exe 0x800543E0 0x1FABC20 three.raw
I opened one.raw, three.raw, my new bootsplash raw image (described above), and an example NK.nbf file in a hex editor (PSPad). I appended the first two lines from NK.nbf to one.raw. They look like this:
PW10B1-ENG-3.16-000-aa9a--------
Click to expand...
Click to collapse
I then appended my new bootsplash image to the end of one.raw, then appended three.raw to the end of one.raw. I then saved this file as NK.nbf and replaced the default NK.nbf for the installer built at LumpiStefan's site.
When I ran the installer, it complained that aa9a wasn't the correct checksum, but it went through anyway, and works fine. The only problem is I can't control colors, since I don't know what color pallet it uses. The closest match is Mac OS. Until that gets figured out, it's best to just use a black & white image.
I was trying to cook a modded ROM for the i607, I was able to extract the nb0 from the bin file using cvrtbin & viewbin > then Mamaich's prepare_imgfs > viewimgfs > dump > modify/add/delete files > buildimgfs > makeimgfs and I know this is basically what you do with the Hermes ROM, however making it back to a BIN file has proven to be a "no go". I have tried splitrom.pl, rommaster, xipbin, etc, but I am afraid without the right utility this will not happen.
Does anybody know if there is a Tool to convert the cooked nb0 back into WMx B000F bin file? There is an old tool for Mobilpro xipbin.exe, however the block size and lenght of ROM does not match. Doing the splitting in sectors and retrieving the checksum manually is going to take a lifetime...
Just an idea: Could it be possible to use a blank CE.BIB with only the start and offset of the ROM and romimage from MS PB builder together with the nb0 file above?
Any good ideas are welcome.
I tried using romimage with no results
I tried to use Romimage from MS platform builder, and after many attempts I gave up. I basically used a minimal CE.BIB and the patched ROM (nb0) file as the source to be inserted. It creates the Run-time BIN file with 4K blocks where it should be making it 128Kb ones.
TO Do:
Try an HEX editor with macro or script capabilities, to perform the following process
1.- Strip the HEADER+RECORD section from the original FLASH file
2.- Strip all zeroes preceding the patched ROM (NB0) before the start point
3.- Cut the patched ROM in 128K chunks (about 500 pieces) called blocks or records
4.- Calculate the Checksum 32 of everyone of these chunks and annotate it
5.- Make the HEADER of the RECORD annotating (in little endian) : Start Address - Lenght(Block Size) - Checksum 32 for every record
6.- Join the HEADER to the respective record. Iterate this process until finished (some 500 times)
7.- Insert the above joined (HEADER+RECORD) section into the stripped flash file in step 1
8.- Here comes the scary part : flash the phone with this MOD (just the PDA section)
9.- If successful, make a program to automate steps 1 to 7
Wish me good luck...
On other comment: according to Texas Instruments, in the Code Composer Studio for OMAP processors, it can be connected to the phone via a COM port using HyperTerminal. Alternatively I think if we can flash the phone using this method and a ROM type NB0.... Perhaps no, as the flash program just connects to the phone using the Serial port qhen in Flash mode. This program also accepts img files, I tried to rename the nb0 file to img and didn't work. Does anybody know what these Samsung's img files are?
Is anybody interested on this matter? Please don't just read the post, start replying... If we really want to MOD this phone, being it the BlackJack i607 or the European i600, we need to start doing some Reverse Engineering..., the people at xda-developers had started this way to master the HTC and similars.
hey, i replied to your email. hope it will be helpful. especially if you give me a link to the image
cmonex said:
hey, i replied to your email. hope it will be helpful. especially if you give me a link to the image
Click to expand...
Click to collapse
Thank-you, however I haven't received your reply yet. I'll send you the link to the ROMS via private message .
Regards,
trinca
The modded ROM
Cmonex:
I have uploaded the modded ROM and is located at:
http://rapi*****/files/42779528/XXGD1_pda.nb0.html
******************W A R N I N G *********************
For everybody else following the thread, please be advised
this above file is a plain binary, it must be converted to a
MS WMx BIN format with a B000FF header before flashing any BJ.
Please do not attempt to flash your phone with it!
**************************************************
I haven't received your e-mail
cmonex said:
hey, i replied to your email. hope it will be helpful. especially if you give me a link to the image
Click to expand...
Click to collapse
Hi, Cmonex:
Can you please resubmit?
TKS
trinca
For those of you who would like to start cooking this ROM
I was able to extract the plain image using cvrtbin (MS tool that comes with visual studio) you may grab a copy from here:
http://www.toradex.com/colibri_downloads/Linux/linux_to_wince/?D=D
Then you will be able to use the common tools from xda-developers such as prepare_imgfs (with the switch -acer) from the WM5 kitchen made by itsme (first sticky in this forum) and so on.
Making the ROM back to the B000FF format is going to be the trouble... So far there is not an easy come back... yet!
There is also an excellent article on Mobilepro BIN roms made by cmonex, you can get a copy of that tutorial inside his Romtool package, get it from here:
http://hpcmonex.net/nec900/files/releases/romtoolpack.zip
Be informed the Mobilepro ROM is very different in the way the Runtime file is organized, however the tutorial is the best resource I have seen so far.
Besides, there are some really good tools inside that package
Best regards and start cooking!
trinca
Samsung i60x ROM: Extracting the OS payload from the Upgrader exe single file
The Upgrader program contains 3 payloads: Eboot, Phone and O/S. To extract the O/S payload follow this procedure:
1. Open the exe upgrader file using the Hex editor of your choice.
2. Locate the ASCII string B000F followed by 0x0A. The complete sequence you should look for is 0x4230303046460A. You should find 3 occurrences of the above string. Concentrate on the last one.
3. Copy from this start address all the way up to the string 0x060000EA3B, which is the start of the phone ROM.
4. Make sure your cut includes 12 trailing zeroes 0x000000000000 as they indicate the loader the end of the Runtime of the pda image.
5. Name your file ending with a bin extension. (i.e XXGD1_pda.bin)
6. Proceed with cvrtbin to extract the absolute (or plain) ROM image (ending in nb0.
7. You are ready to start cooking.
I was able to sucessfuly extract in this way the ROMS for i600 releases: XXGC6 and XXGD1 and for i607: UCGB4 and UCGD2.
How did I find out? I got the chance of getting the XXGC6 upgrade package, which included the eboot, phone and pda sections separated. Further reading in the forums indicated the B000FF is followed by 0x0A, the start address of the ROM (00000000) and the end address. From there it was easy to locate the payloads in the Upgrader single exe file.
Good luck extracting your ROMS.
Samsung i607 Service Manual
Below is the link for the SGH-i600 service manual URL. Does anybody have the service manual and/or schematics for the SGH-i607?
BIN B000FF runtime image file format
Does anybody have a detailed description of the arrangement of headers and records in this file format? The best reference I have found is this page:
http://www.devpia.com/MAEUL/Contents/Detail.aspx?BoardID=60&MAEULNO=23&no=242&page=1
Unfortunately I do not understand Korean...
hey, i again sent you an email. i'll quote it in PM too just to be sure.
btw, the rom tutorial that i wrote and that you linked to, fully details B000FF format. what is not clear about it?
The tutorial is right
There is nothing wrong with your tutorial, I had to use the HEX editor several times until I got that right.
cmonex said:
hey, i again sent you an email. i'll quote it in PM too just to be sure.
Click to expand...
Click to collapse
Do you know if isotherm may share the source code for xipbin? Do you have a way to contact him? I tried to contact him at hpcfactor with no results.
Trinca - ok, let's imagine you got all the needed files to B000F format. How do you plan flash it back to your i607?
Creating the B000FF Runtime image
After cooking the ROM...how to re-create the B000FF Runtime image back? That is the $1M.. question, I am still navigating uncharted waters...
Producing the Flashable runtime image back is what I am now concentrating on, as I see it there may be 4 possible ways:
1) Manually
-a) Splitting the nb0 file in [n] 128KB chunks (for a ~64MB image, there are over 500 x 128KB chunks)
-b) adding the chksum32 at the beginning of each chunk
-c) adding the address and offset to the beginning of the above.
-d) merging it all together
-e) adding B000FF, start address and offset at the beginning of the merged files
You can use an Hex editor with scripting properties such as 010Editor and write a script to accommodate a) thru e)
http://www.sweetscape.com/010editor/
Still a pain in the neck and the scripting language is similar to C, if you know this language it will be easy for you to automate the above. Still experimenting with it.
2) Using XIPBIN, made by somebody AKA isotherm, this utility will make a B000FF runtime file good for a HP/NEC mobilepro, the record length is made 0x40000 bytes long, different from 0x1FFE0 record length of the original ROM, according to cmonex, this should not be a problem provided the record is made of different length and has the right checksum per record, but I already have made several attempts and it does not work for me, when flashing the phone it gets stuck at the very beginning. You may research further here.
3) Modify xipbin and make it produce records 0x0001FFE0 bytes long, as the source code for this utility is not available, cmonex says isotherm had disappear. I am still hacking into this utility...
4) Create our own program using VC or VB, I may probably work on this one as well, as I get some time available.
I am attaching a copy of xipbin.exe, however if you have followed my instructions, you may probably have it already, please let me know of any success (or failure, we all learn from these ones too).
usage:
xipbin [myrom.nb0] [start address for myrom.nb0] [myrom.bin] [start address for myrom.bin]
For Samsung's B000FF ROMs the command will look like:
xipbin myrom.nb0 0 myrom.bin 0
myrom.bin is then recreated from scratch.
Also according to cmonex, you may do the following:
a) Get an original B000FF ROM
b) use cvrtbin.exe and obtain a nb0 ROM
c) use xipbin with this nb0 and re-create a runtime bin file.
d) apply again this cvrtbin utility to the re-created runtime bin file
e) compare the result with above b) step
f) If they match you may have a candidate procedure, if they don't do not attempt to flash the phone with the procedure above.
I will include the new viewbin and cvrtbin, which now works with start address 0 on this type of ROMs
Usage:
cvrtbin -r -a [start address] -l [length of ROM] -w [8, 16 or 32] [romfile.bin]
cvrtbin -r -a 0 -l [the length of your ROM] -W 32 [myrom.bin]
Good luck!
The format of MS BIN B000FF runtime image file
According to several sources I have consulted, including MS documentation and insights given by cmonex, plus heavy HEX editing sessions, this is my impression on how the B000FF Runtime image format looks like:
Byte------>--1--2--3--4--5--6--7--8--9--A--B--C--D--E--F
Record 0 -> 42-30-30-30-46-46-0A--<Strt add>--<ROM lgth> * * * * * * * * * * * (42-30-30-30-46-46 = B000FF in ASCII ; 0x0A = end of header B000FF)
Byte------>--1--2--3--4--5--6--7--8--9--A--B--C--<-----128KB of nb0 image------>
Record 1 ->--<Strt Add>--<Rec lgth>--<CHKSUM32>--<--Chunk Nbr 1 of nb0 image--->
Record 2 ->--<Strt Add>--<Rec lgth>--<CHKSUM32>--<--Chunk Nbr 2 of nb0 image--->
v - v
v - v
v - v
Record n-1>--<Strt Add>--<Rec lgth>--<CHKSUM32>--<---Last chunk of nb0 image--->
Last Rec-->-00-00-00-00-00-00-00-00-00-00-00-00 .* * * * * * * * * * * * * * * (The last record always ends with 12 bytes set to 0x0)
**************************************
Please note:
Record 0 and the last one are different
All data are encoded Little Endian!
**************************************
Using the command:
viewbin -r [myrom.bin]
Will give you the record content of your runtime image file.
Trinca - just ran viewbin on samsung i750 image. chunks sizes are not 128kb each. looks like chunks are actually files from ROM in XIP format (executable in place, it is usual PE files but missing reloc table and something else). I bet we should use file deleting/adding/injecting utility like romtools one for ROM image manipulation which reamins intact B000F header! I see no other way to recreate B000F.
Well, I guess your runtime differs from that on the i60x. In any case I know of a tool made by bepe the name of xipport, you can look at this thread and download it here:
http://forum.xda-developers.com/showthread.php?t=315030
The best thing I can recommend you to do, is to try to get the appropriate format of your runtime image.
trinca
unfortunately all version of xipport just crash with errors on my ROM dump.
ROm Dump
JugglerLKR:
Let's get acquainted with your procedure, and do not pretend to modify something, just to find out if the tools work:
a) Have you dumped the ROM from the phone or you just extracted it from the updater executable?
b) If you have just cut the ROM out of the executable, use the new cvrtbin posted before (which runs fine at start address 0)
c) Run Mamaich's prepare_imgfs, there are 3 possible options:
prepare_imgfs [yourROM.bin] will produce imgfs_raw_data.bin and imgfs_removed_data.bin
prepare_imgfs [yourROM.bin] -nosplit will produce imgfs_raw_data.bin and an empty imgfs_removed_data.bin
prepare_imgfs [yourROM.bin] -acer will produce imgfs_raw_data.bin and an empty imgfs_removed_data.bin, but this one is the only which has worked for the i60x
d) Now if you use viewimgfs then the dump directory will be created and the files will be extracted. It is only after this confirmation you may be assured the ROM extracted has the correct structure for manipulation. I got so much trouble using the old version of cvrtbin, that I am telling you to run these extra steps.
Now try to run the xipport tool on the above *.nb0 file. and tell us if you were successful. At this point if you are not able to run the xipport tool, then you may not have something usable. RomMaster and dumprom/dumpromx are also alternatives for working with xip modules, please remember all these tools are highly experimental and not bug-free!
trinca
I'm looking for information on the format of Hermes nb files. I am aware that there are perl scripts to unpack these files, but they are not working on a diagnostic image i have in nbh and (converted to) nb format. When I try to unpack the nb file with rdmsflsh.pl I get: could not find imgfs header
The file has plaintext readable strings and begins with 0xB000FF.
Does anyone have technical information on this file format? I know the file is valid since it can boot into the image just fine.
-fluxist
fluxist said:
I'm looking for information on the format of Hermes nb files. I am aware that there are perl scripts to unpack these files, but they are not working on a diagnostic image i have in nbh and (converted to) nb format. When I try to unpack the nb file with rdmsflsh.pl I get: could not find imgfs header
The file has plaintext readable strings and begins with 0xB000FF.
Does anyone have technical information on this file format? I know the file is valid since it can boot into the image just fine.
-fluxist
Click to expand...
Click to collapse
There is a lot of good information about the NBH format (here) that may be useful. Also, the wiki in general may be helpful.
Hi mates, does anyone know, where is the operator screen located in the phone ?
By Operator Screen, i mean the wallpaper of the vendor like O2, Vodafone, i-Mate, T-mobile etc. whose ROM, you have installed in your device.
It comes before the Windows Mobile splash screen, after reboot.
I have searched my entire /Windows/ folder, couldn't get hold of it.
if it is before welcome96 than i doubt you can change it without cooking your own rom...
http://wiki.xda-developers.com/uploads/Custom Splash Screens.zip
Complete Guide & Tools To Create Custom Splash Screens - Compiled by Bennec83 from wiki
is this available for any wm5/6 device?
fuzzvirus said:
http://wiki.xda-developers.com/uploads/Custom Splash Screens.zip
Complete Guide & Tools To Create Custom Splash Screens - Compiled by Bennec83 from wiki
Click to expand...
Click to collapse
can you post the link for this thread ?
I hope we are not talkin' about the windows splash screen aka "welcomehead.192"
this what I am talking about
From the read me file inside the zip.
This Can ONLY Be Done On XP (nb_image_converter.exe dont like vista!!)
Firstly create your splashscreens using your favourite picture editor (PSP, Photoshop etc...), both these files MUST be 240x320 and saved as 24bit bitmaps:
Name of Image Size Type Description
* MainSplash.bmp 240x320 .bmp the first splashscreen you see
* SubSplash.bmp 240x320 .bmp the second splashscreen you see
* welcomehead.96.png 320x320 .png the WM splashscreen
Save mainsplash & sudsplash into Custom Splash
Save welcomehead.96.png and paste it into the /windows folder on your device (overwriting the current windows splashscreen).
Copy files "nb_image_converter.exe" & "padding.nb" into Custom Splash. Now run "nb_image_converter.exe" load both images, save them as Main.nb & Sub.nb.
Next open a command window, and place Custom Splash Folder in Root of C:
In the command window type the following:
cd c:\custom_splash (enter)
copy /b Main.nb+padding.nb MainSplash.nb (enter)
copy /b Sub.nb+padding.nb SubSplash.nb (enter)
dir (enter)
The final command (dir) will list the contents of the directory, the filesize of MainSplash.nb and SubSplash.nb MUST be exactly 262144 bytes
or you should NOT continue (would produce possibly FATAL results for the device)
We now need to repackage the two .nb files into a single nbh image so we can flash them, s
1) Start duttys good nbh tool:
2) click the "NB to NBH"
3) Click the First Splash and select the MainSplash.nb file, click the second splash and select the SubSplash.nb.
4) MAKE SURE that Device = HERM200, CID Type = SuperCID and Signature Size = 128
5) Now click the "Generate NBH File" button, save it on your desktop.
The next stage is to flash to the device using CustomRUU, simply place the custom ruu exe file in the same folder as the NBH file we just created and run it.
Select 'autodetect' and flash as normal.
Thanx a lot mate, can i use this on my Universal ? It's resolution is 640 by 480.
Is there any way, i can extract the operator splash screen i.e Main splash, from my current ROM ?
well I won't be able to help here as I have a hermes and I can tell about that. Hoping someone else might help you.