Beta: WM5 ROM editing tool

[mamaich]

"""""""""""I'm trying to dump an Universal ROM (JASJAR_WWE_11353_137_10301)"""""""

i tried the same thing, on the same rom , and created dump folder but failed to rebuild it . :?: :?: :?:
any help
Rebuilding universal's ROMs is not tested. I'll fix that when I'll get Universal.

[nedge2k]

i also need to convert a dll folder to a dll.

i tried to copy the dll out of the raw rom .bin using winhex and the start/end offsets (from dumpmemorymap.txt) for the dll and then paste it into a new file and save it as the dll but it didnt work.

so far the imgfs tools are the only ones that have allowed me to "access" this dll as its from a g-smart.

i'd appriciate any help with this as if i can do what im hoping to do it'll benefit us all ;)

Do you say that you have a .bin of g-smart rom ???

Yep, i used buzz's covert wm5 rom dumper to get the .bin but Gigabyte have also supplied me with an .nb0 image.

[TofClock]

wow , can you send me this .bin please ?

tofclock@gmail.com

[sacaman]

Dear All

how i can change from dump.bin to nk.nba



Thanks


Sacaman :wink:

[mashi]

what the limitation on tornado ? i extracted Tmo USA sda flash.
dump is over 800M. i try to put chinese font file to it.. it can't be buildimgfs. the file is 5M.
thanks

[nedge2k]

wow , can you send me this .bin please ?

tofclock@gmail.com

Not really as it would probably get me in a lot of sh*t with Gigabyte. Why would you want it anyway?

[le_toubib]

""""""""""""""""Rebuilding universal's ROMs is not tested. I'll fix that when I'll get Universal."""""""""""""""""
i tried even to delfile.exe without making a dump folder .... but still , an error arised ....
i m just trying to CLEAN this rom , full of dog barking junk useless file :cry: :cry:

[TofClock]

wow , can you send me this .bin please ?

tofclock@gmail.com

Not really as it would probably get me in a lot of sh*t with Gigabyte. Why would you want it anyway?

because i have a dump , but a dump made with WM5Dumper , and some files are corrupted :/

all files are working , like answer machine and others , but i've problems with modules like cprog.exe and tapres.dll

[TofClock]

Hey mamaich , i've seen the tools are updated ....

your RecMod.exe tool is very very usefull :)

Is it possible to do the revert tool ?

RecMod.exe : Module -> File

i' would use a tool that makes File -> Module

is it possible ?

[mamaich]

is it possible ?Such set of tools is present in PlatformBuilder 5.1x, but I don't have it.
And reimplementing them would be extremely difficult. You have to find RAM holes, rebase each code/data section of a DLL, etc.

[TofClock]

ok , thanks for your fast reply ..

i've asked that because because i've found a lot of things in moduiles ....

the welcomehead.96.png display on each boot is generated by gwes.exe , i'm actually testing to disable it ....

i'm working on the battery icon display .... i think i can find the soluce :)

[bepe]

please help,
how to dump the WM5 boot XIP partition.
Using gmap's tool I can relpace them but how to extract this files?

dumprom only dumps nk.exe...

[alligator]

@TofClock: sorry it was a mistake, PM in state of Post a reply

This are the German, English and French Transcriber files V 2.0 !!!!!
Because Microsoft has only published V1.5 I builded them with Platform Builder 5 for my translated ROM.

Perhaps somebody has time to make cab files with the nessasary registry entries...

Tested on a HTC Himalaya (English ROM WM5 + German Transcriber).

Hello,

I tried to create manually some entries on the registry to enable the french dictionary for the transcriber, but without any success...

Could someone help me ? many thanks

[bepe]

This is the German registry, try to finde this entries for French...

[zohaer21]

doenst work with latest imate jamin rom...

[baniaczek]

And reimplementing them would be extremely difficult. You have to find RAM holes, rebase each code/data section of a DLL, etc.
Maybe this way - convert all modules into files and convert them back one by one?
Yes. It's still extrmely difficult :(

[summiter]

Howdy all -

I've run into a problem working with a WM5 (Wizard) rgu file. Per instructions here, I do:

rgucomp.exe -o dump\default.hv -nologo > default.rgu

Which for the sake of testing, I edit by ONLY adding REGEDIT4 to the first line, and then save in unicode to boot.rgu. When I run rgucomp.exe -b this is what I get:

---------------------------------------------------------------------------------
Microsoft (R) RGUComp Version 1.0.000
Registry file processor and hive builder.
Copyright (C) 2004 Microsoft Corporation All Rights Reserved.
built: Nov 19 2004 15:17:13
importing registry file ".\boot.rgu"...
Failed to parse value name HKEY_CLASSES_ROOT\awbfile\Shellex\ContextMenuHandl ers
\{E88B4A18-6F77-4bb6-8E0D-DCD4B1F8F1DA}!!!
InitRegistry FAILED in file ".\boot.rgu" within a few lines of line 10.
BuildBootHive: (RGUComp) !ERROR failed importing ".\boot.rgu"
wmain: (RGUComp) !ERROR failed building BOOT hive
----------------------------------------------------------------------------------


Here's the first 11 lines of the rgu file that rgucomp.exe created from my default.hv:

----------------------------------------------------------------------------------
REGEDIT4
[HKEY_CLASSES_ROOT\.giff]
@="gifimage"
[HKEY_CLASSES_ROOT\.wbm]
@="wbmpimage"
[HKEY_CLASSES_ROOT\awbfile]
"EditFlags"=dword:10000
[HKEY_CLASSES_ROOT\awbfile\Shellex\EventSoundHandle rs\{DDDC2AE0-9CA8-4fbb-A7B0-088B6D202749}]
@="Ring Tone Plugin Player"
[HKEY_CLASSES_ROOT\awbfile\Shellex\ContextMenuHandl ers\{E88B4A18-6F77-4bb6-8E0D-DCD4B1F8F1DA}]
"DelayLoad"=dword:1 @="Set as Ringtone"
-----------------------------------------------------------------------------------

Everything there looks properly formatted to me. Any ideas on the cause of the error?

[bepe]

Change
"DelayLoad"=dword:1 @="Set as Ringtone"
to
"DelayLoad"=dword:1
@="Set as Ringtone"

[summiter]

Change
"DelayLoad"=dword:1 @="Set as Ringtone"
to
"DelayLoad"=dword:1
@="Set as Ringtone"

Hi Bepe - thanks for the reply! I found that fix works after playing around. Unfortunately I'm having to make that kind of correction to a lot of the file. =(

[bepe]

There is a problem with non-standard characters and "rgucomp -o"

There is another way:
Copy all rgu file to .\RGU\ and all dsm files to .\DSM\
Copy packages.sof and boot.rgu to .\
Run DsmToHive.bat

Copy all files out of your device because some files are located at the XIP patition of the rom, this dsm files and the boot.rgu will not be dumped by viewimgfs.exe !!!
(Or use dumprom.exe to dump the XIP patition)

without changes this will generat a 100% identical user.hv and default.hv (compared to that of the rom)

->make changes directly to the rgu files

This will not work with edited roms!!!!

[summiter]

There is a problem with non-standard characters and "rgucomp -o"

There is another way:
Copy all rgu file to .\RGU\ and all dsm files to .\DSM\
Copy packages.sof and boot.rgu to .\
Run DsmToHive.bat

Copy all files out of your device because some files are located at the XIP patition of the rom, this dsm files and the boot.rgu will not be dumped by viewimgfs.exe !!!
(Or use dumprom.exe to dump the XIP patition)

without changes this will generat a 100% identical user.hv and default.hv (compared to that of the rom)

->make changes directly to the rgu files

This will not work with edited roms!!!!

Hi bepe,

Ok a couple questions:

So, the default.hv that is dumped by viewimgfs.exe into .\dump is not a full and proper dump of that file?

Also, when you say it won't work on edited ROMs, what do you mean? I've got a Wizard ROM dumped and have made many changes to it (added files some ringers and Compact Framework 2, etc). The default.hv that I am trying to work with was dumped from the original ROM using viewimgfs.exe.

Thanks for being so valuable to the community here.

[Bral]

I use this tool to extract X50V's SD update Rom "WM50_K_A01_X50v_WM5_ENG.nb0", It can extract many files, But 2 important file: "user.hv" and "default.hv" can't extract as file, it is 2 folder. How do i convert the folder to file?

[bepe]

@Bral
rename the S000 file to default.hv

@summiter
The original default.hv, boot.hv and user.hv of your rom where build that way so this three files have to be (Binary)identical to that one generated by DsmToHive.bat (without editing trh rgu files).

by edited ROMs I ment if somebody made changes directly to a hv file already, in this case this changes will be lost.

DsmToHive.bat will generate default.hv, boot.hv and user.hv at the same time, do not rename something!
If DsmToHive.bat generates only boot.hv some rgu or dsm is missing...

the last lines of the output should be:
...
(RGUComp) done!
Microsoft (R) RGUComp Version 1.0.000
Registry file processor and hive builder.
Copyright (C) 2004 Microsoft Corporation All Rights Reserved.
built: Nov 19 2004 15:17:13
importing registry file ".\boot.rgu"...
(RGUComp) done!

[Bral]

To: Bepe

I can't find the S000 file, in user.hv folder,there only 3 files: user.hv(2KB), imageinfo.txt(24KB),imageinfo.bin(56KB). in default.hv the file is: default.hv(2KB), imageinfo.txt(24KB), imageinfo.bin(524KB).
What wrong with is?

[bepe]

sorry, delete the existing default.hv and rename imageinfo.bin

if this is working:
replace the folder '.\dump\default.hv\' by the file default.hv

[panda88]

is there any emulator that can run nk.nbf? I am asking this question because i would like to try out the new rom before flashing to the device. any idea?

[bepe]

Moves all files and modules related to one package ('dump\xxxx-xx-xx-xx-xxxxxx.dsm') to 'dump\xxxx-xx-xx-xx-xxxxxx\'.

Usage:
dsmtool <file>
<file>: 'dsm file' or 'modul' or 'file' from 'dump\' directory.

just drop a file from 'dump\' at dsmtool.exe :wink:

Edit: this is my first real c++ tool, so all critic referring to source is welcome... (PM)

[hdubli]

I hv dump(from mamaich tool) for Atom...and want to extract or locate Media Plus App...Can anyone tell me how to find..I hv checked the modules..but it is unclrear...files do not contain anything related to media plus.

[mamaich]

I hv dump(from mamaich tool) for Atom...and want to extract or locate Media Plus App...Can anyone tell me how to find..I hv checked the modules..but it is unclrear...files do not contain anything related to media plus.
This application may be in extended ROM. So look there for a CAB file.

[hdubli]

Thanks.Extended ROM is .img file and I opened it with Win Image.There are files related to that and are called as Media Center Skins...Hv checked but could not locate the exe for the same...it only contains the bmps and pngs and other files..

cabs are available but for operator settings.

Just to inform, atom's Ext ROm is of 15 MB.It takes less than a min to update the Ext ROM during the ROM update and interesting thing is that there is no Auto Run method, the phone boots up with all the contents of ext rom loaded except it asks for localisation for operator settings...

Can anyone inform about this..

[Excubator]

I've been trying to use the tools on a Tornado Rom however so far very unsuccessfull.

I extracted the decrypted nba-file from the nbf-file using "Typhoon NBF tools". I then used Prepare_IMGFS -nosplit to create the .Bin-files. (No errors reported whatsoever).
Using deletefile I removed a couple of files. After that I built the new nk.nba with make_imgfs and updated the checksum using "xda3nbftool -c -u"
I used "nb2nbf_tornado.exe" to create the nbf-file - still no errors reported from any program.
After I installed the new ROM on my Tornado the unit simple hangs on the boot menu.

Any ideas on this? Is it at all possible to extract the nba-file from the nbf-file using xda3nbftool? In that case, what are the password for the Tornado nbf-file?

[mamaich]

xda3nbftool is for BlueAngel. You'll get garbage if you use it on tornado.

[double_ofour]

I having trouble here about converting boot.rgu to boot.hv

Microsoft (R) RGUComp Version 1.0.000
Registry file processor and hive builder.
Copyright (C) 2004 Microsoft Corporation All Rights Reserved.
built: Nov 19 2004 15:17:13
importing registry file ".\boot.rgu"...
Failed to parse value name HKEY_CURRENT_USER\\Software\\Microsoft\\Windows!!!
InitRegistry FAILED in file ".\boot.rgu" within a few lines of line 4.
BuildBootHive: (RGUComp) !ERROR failed importing ".\boot.rgu"
wmain: (RGUComp) !ERROR failed building BOOT hive

Error on line 4, here my registry

REGEDIT4
[HKEY_CURRENT_USER\MUI]
"CurLang"=dword:409
[HKEY_CURRENT_USER\Software\Microsoft\Windows]
"DbPath"="\\mxip_initdb.vol" "LangDbPath"="\\mxip_lang.vol"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Internet Settings]
"EnableNegotiate"=dword:1 "EnableHttp1_1"=dword:1 "ProxyHttp1.1"=dword:1 "SecureProtocols"=hex:A8,00,00,00 "AggressiveCacheFlush"=dword:0 "ShowDialogFullScreen"=dword:1 "DialogTimeOut"=dword:493e0 "EnableAutodial"=dword:0 "MaxConnectionsPerServer"=dword:4 "DisableCachingOfSSLPages"=dword:1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\Cache]
"Signature"="Client UrlCache MMF Ver 4.7" "QuotaAdjustCheck"=dword:1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\Cache\C.... BLAH BLAH]

this thing??
[HKEY_CURRENT_USER\Software\Microsoft\Windows]
what wrong with that line?

ER!! im getting crazy here now.. been tried everything "UNICODE" "REGEDIT4" "NO SPACE BETWEEN SOMETHING"

[bepe]

One entry per line:


REGEDIT4
...
[HKEY_CURRENT_USER\Software\Microsoft\Windows]
"DbPath"="\\mxip_initdb.vol"
"LangDbPath"="\\mxip_lang.vol"
...

and use unicode :wink:
bepe

[bepe]

@mamaich:
Is there a change to get tools like this for XIP Section? (moduls!)
I tried to understand the structure of XIP, but my abilities referring to c++ and my knowledge about the rom structure are far away from the state of making tools like this :cry:

Perhaps this would also help to port AKU2 to BA...

[double_ofour]

Thanks bepe GOT IT working now!
Thanks!

[double_ofour]

How do i know if the rom already reached the maximum space? and whats the maximum space for o2 XDA II ROM? Thanks!

[HyperMalac]

Hy there all!

Sorry for bothering you with this, but I want too to edit my ROM.

So all I need is to delete some files, to free up space (like anyone want too).
My problem is that I'm a complete idiot with the ROM editing. I've read the first pages of this topic, and saw there is quite hard to do. Can someone post a guide/how to? Because at the first pages all of you are worked with, such hard programs, and i think you've made developments, and now you are using easier programs, or not?

Thanks for the help and sorry for my English (I hope I wrote understandable)

[TauTau]

Hi,

I'm trying to extract a few things from this ROM http://www.vodafone.de/business/support_download/59345.html for the Wizard. HTC64 Extended Rom Tool doesn't recognize the rom. Typhoonnbftool doesn't see any sections (i.e. OS, Extended) in the nbf.
I have been able to extract files with typhoonnbfdecode.pl from the nbf, I then have some .nb files that look like the different parts of the ROM (IPL, SPL), and I can rename the ExtendedRom file to .rar and then open them with winrar, though I only get short filenames which don't give me a clue what's in there (looks like a old image format). renaming the OS file doesn't work though, winrar can't open that.

Am I using the wrong tools? Do I take wrong steps?

Lars

[farseer]

The followingc command:

viewimgfs.exe dump.bin

is resulting in this error:

Unable to load compression DLL!

i do see named "cecompr_nt.dll" in the same directory as viewimgfs.exe.
What could be the issue here?

[faria]

allo people,need help; since a got the other parts of the wizard rom figured out i decided it was time to start learning how to cook the OS part of the rom.everything was going fine till;

when a try to Dump the contents of imgfs_raw_data.bin,using imgfs_tools,
from a wizard .nba,rom version 2.4,i get this errors ,does anyone knows why or how to fix?
i have also tried 3 diferent nba files [same rom version] yet this morning it worked fine with a 2.21 rom when i tested.
i m also unable to delete/add files after this.
thanks.
a big thanks to maimaich to make all this possible. you are the man.





.................................................. .................................................. ......

Ram Address: 00604000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00605000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00606000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00607000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00608000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00609000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0060F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00610000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00611000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00612000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00613000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00614000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00615000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00616000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00617000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00618000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00619000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0061F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00620000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00621000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00622000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00623000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00624000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00625000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00626000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00627000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00628000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00629000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0062F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00630000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00631000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00632000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00633000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00634000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00635000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00636000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00637000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00638000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00639000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0063F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00640000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00641000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00642000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00643000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00644000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00645000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00646000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00647000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00648000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00649000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0064F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00650000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00651000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00652000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00653000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00654000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00655000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00656000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00657000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00658000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00659000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0065F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00660000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00661000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00662000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00663000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00664000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00665000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00666000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00667000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00668000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00669000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066A000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066B000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066C000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066D000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066E000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 0066F000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00670000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00671000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00672000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00333000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00334000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00335000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00336000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00337000 (dhcp.dll) overlapps 'jscript.dll'
Ram Address: 00338000 (dhcp.dll) overlapps 'jscript.dll'
Unhandled exception in DumpImageData!!!
Cannot create dhcp.dll\♂7♀
Unhandled exception in DumpImageData!!!
Unhandled exception in DumpXipData!!!

Header type: FFFFFEFB, Addr: 00031940
szName: dhcp.dll

Header type: FFFFF6FD, Addr: 00031974
dwNextDataTableOffset: 00000000
dwNextStreamHeaderOffset: 000319A8
dwSecNameLen: 00000004
szSecName: S000
dwStreamSize: 000060D0
dwDiskOffset: 00071E80
cbOnDiskSize: 00000040
dwUnknown[0]: 00000000
dwUnknown[1]: 00000000
dwUnknown[2]: 00000000
dwUnknown[3]: 00000000
wCompressedBlockSize: 50E5
wDecompressedBlockSize: 8421
Error! ProcessFixups: cannot map dump\dhcp.dll\s15627
dwDiskOffset: 84E078E5
wCompressedBlockSize: B8E5
wDecompressedBlockSize: C471
dwDiskOffset: 84815CE1
wCompressedBlockSize: FAE5
wDecompressedBlockSize: 01D8
dwDiskOffset: 241C1848
wCompressedBlockSize: 8430
wDecompressedBlockSize: 36E2
dwDiskOffset: 0C066962
wCompressedBlockSize: 8460
wDecompressedBlockSize: 28E5
dwDiskOffset: 00580418
wCompressedBlockSize: ACE5
wDecompressedBlockSize: 00B8
dwDiskOffset: 192C2E99
wCompressedBlockSize: 2030
wDecompressedBlockSize: 3884
dwDiskOffset: 00189226
wCompressedBlockSize: 003B
wDecompressedBlockSize: 4000
dwDiskOffset: 820E5883

Header type: FFFFF6FD, Addr: 000319A8
dwNextDataTableOffset: 00000000
dwNextStreamHeaderOffset: 00076408
dwSecNameLen: 00000004
szSecName: S001
dwStreamSize: 00000200
dwDiskOffset: 00031700
cbOnDiskSize: 00000040
dwUnknown[0]: 00000000
dwUnknown[1]: 00000000
dwUnknown[2]: 00000000
dwUnknown[3]: 00000000
wCompressedBlockSize: 00F8
wDecompressedBlockSize: 0200
dwDiskOffset: 000762C0

Address: 00076400, dwBlockSignature: 30299D08
dwNextHeaderBlock: 00000009 (size: FFF89C09)

Header type: CCF93000, Addr: 00076408
Unknown header type, FS_DATA_TABLE??

Header type: 26B41410, Addr: 0007643C
Unknown header type, FS_DATA_TABLE??

Header type: 00000017, Addr: 00076470
Unknown header type, FS_DATA_TABLE??

Header type: 3D5A491E, Addr: 000764A4
Unknown header type, FS_DATA_TABLE??

Header type: 97152D25, Addr: 000764D8
Unknown header type, FS_DATA_TABLE??

Header type: 54007E2C, Addr: 0007650C
Unknown header type, FS_DATA_TABLE??

Header type: ADBB6234, Addr: 00076540
Unknown header type, FS_DATA_TABLE??

Header type: 6AA6B33A, Addr: 00076574
Unknown header type, FS_DATA_TABLE??

Header type: C4619742, Addr: 000765A8
Unknown header type, FS_DATA_TABLE??

Address: 00000009, dwBlockSignature: D86E9130
dwNextHeaderBlock: 01DC314F (size: 01DC3146)

Header type: 01000000, Addr: 00000011
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 00000045
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 00000079
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 000000AD
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 000000E1
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 00000115
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 00000149
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 0000017D
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 000001B1
Unknown header type, FS_DATA_TABLE??

Address: 01DC314F, dwBlockSignature: 3597006C
dwNextHeaderBlock: 01F108BE (size: 0014D76F)

Header type: A0006C70, Addr: 01DC3157
Unknown header type, FS_DATA_TABLE??

Header type: 0640006E, Addr: 01DC318B
Unknown header type, FS_DATA_TABLE??

Header type: 02010501, Addr: 01DC31BF
Unknown header type, FS_DATA_TABLE??

Header type: 6A91006C, Addr: 01DC31F3
Unknown header type, FS_DATA_TABLE??

Header type: 0929373E, Addr: 01DC3227
Unknown header type, FS_DATA_TABLE??

Header type: 6882006C, Addr: 01DC325B
Unknown header type, FS_DATA_TABLE??

Header type: 93006A9C, Addr: 01DC328F
Unknown header type, FS_DATA_TABLE??

Header type: 0814FB00, Addr: 01DC32C3
Unknown header type, FS_DATA_TABLE??

Header type: B8022C0D, Addr: 01DC32F7
Unknown header type, FS_DATA_TABLE??

Address: 01F108BE, dwBlockSignature: 1000FFFF
dwNextHeaderBlock: 0C330110 (size: 0A41F852)

Header type: 574A0001, Addr: 01F108C6
Unknown header type, FS_DATA_TABLE??

Header type: 16001100, Addr: 01F108FA
Unknown header type, FS_DATA_TABLE??

Header type: 85002A7E, Addr: 01F1092E
Unknown header type, FS_DATA_TABLE??

Header type: D880560E, Addr: 01F10962
Unknown header type, FS_DATA_TABLE??

Header type: 5A630001, Addr: 01F10996
Unknown header type, FS_DATA_TABLE??

Header type: A8AE5B1C, Addr: 01F109CA
Unknown header type, FS_DATA_TABLE??

Header type: 002A8600, Addr: 01F109FE
Unknown header type, FS_DATA_TABLE??

Header type: 2AE3002A, Addr: 01F10A32
Unknown header type, FS_DATA_TABLE??

Header type: 0E002A0D, Addr: 01F10A66
Unknown header type, FS_DATA_TABLE??

[farseer]

i don't know what the secret password is...maybe i can get i can use my "Get One Free Help" card this once?

The followingc command:

viewimgfs.exe dump.bin

is resulting in this error:

Unable to load compression DLL!

i do see named "cecompr_nt.dll" in the same directory as viewimgfs.exe.
What could be the issue here?

[solnyshok]

Hi Guys, deep respect for the tools you developed for editing wm5 roms.

I tried to use those tools on my ipaq hx4700. Surprisingly, I found that wm5 update nbf is easy to steal from wm5 update utility and it looks like nbf is not encrypted. At least, all tools work on it (prepare, add/delfile, view, build, make). And, it is easy to flash it back to device by fooling the same update software, just replacing the original nbf at the last moment before flashing.

Ok, now it is not all that easy of course, and I need your advise. Yes, I have read the thread, and done about a dozen rom builds, even bricked device and restored with image from SD card.

First, I am not sure tools are 100% correct.
1) if I delete some 5mb with help, pictures and somesoftware (100% sure that it is not related to builtin wince - like dockware and pocketinformant) from rom, I add only some 500kb worth of utilities and then build it back, then I see some strange behaviour in wince functions - like messaging starts but you cannot write new mail; msnmessenge does not start at all, wifi does not start.
2) dll from dump, received with "view" tool has different size from dll in rom - e.g. I tried to take battery.dll from dump (39.5kb) and overwrite with battery.dll in ROM and I see it was only 37kb.
3) if do a test by prepare->view->did not change anything->build->make and flash resulting nbf to device - it bricks.

Any ideas what could be wrong with my approach or with tools? I know that tools have not been tested on hx4700, but I would love to see them working correctly. :roll:

[mamaich]

2) dll from dump, received with "view" tool has different size from dll in rom - e.g. I tried to take battery.dll from dump (39.5kb) and overwrite with battery.dll in ROM and I see it was only 37kb.
This is correct. The size of modules in ROM are calculated incorrectly by OS. Internally they are split in sections, etc, so the correct size cannot be known. My tool reconstructs files from modules, realigns and relocates them, so it may save some space or make the files larger.

3) if do a test by prepare->view->did not change anything->build->make and flash resulting nbf to device - it bricks.
prepare_imgfs/make_imgfs should be modified to support HP devices. prepare_imgfs moves unknown data to imgfs_removed_data.bin, make_imgfs does the reverse. Structure of this file is known (better to say "guessed") for BA and Himalaya devices, for HP it would contain trash, so your device would hang on boot. I.e. for devices different from Hima/BA this is only one side process - you can dump, but not recreate.
Somewhere I've published source code of these 2 tools, you should study contents of imgfs_removed_data.bin, and modify make_imgfs so that it recreates it correclty.

[solnyshok]

I thought that make_imgfs is just stitching together 2 files, hmmm... and that removed*.bin was not altered in the process at all. Now you say it contains FAT for image and affects the make_imgfs process?

Ok, I have sources for prepare/make_imgfs. where can I read about what is contained in removed*.bin on BA/Hima.

[solnyshok]

some 20 hours later, only information I could dig out is more than a year old, so I am not sure even that it refers to WM5. It could be based on wm2003se (more likely).

_http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html



NBF
this file is usually found in 'official' upgrades, together with a program that is usually named 'programme a.exe', or 'upgrade.exe'
start with a 32 byte header containing
device identification
'-' as separator
language
'-' as separator
version
'-' as separator
?? 007 - another number, probably operator id.
'-' as separator
a 16 bit checksum, in perl: unpack("%16C*", $data, $otherheaderfields)
this checksum is stored without leading zeroes.
the first three '-' separators are included in the sum, the fourth is not.
'-' as padding to 32 bytes
followed by the 256K bootloader
followed by the 30.75M os image
the problem with this format is that it is usually used for flashing over a serial or usb line, from a host computer. and it overwrites the most essential part of your device's rom, its bootloader. if something goes wrong here, you will need to resort to more complicated techinques to get your device working again.

Is this true for WM5 roms too? How can I find something wm5 nbf layout?

Please help me guys.
:shock:

[mamaich]

Is this true for WM5 roms too? How can I find something wm5 nbf layout?

No.
Source code of these 2 tools is in the first post. Structure of removed data is somehow obvious, you can examine it in any hex editor.

[zohaer21]

can anyone link the direct link to TyphoonNbfTool.exe
i cant seem to access the site in general as it keeps giving a network error???
thanks

[solnyshok]

Mamaich,

I have couple of questions again :)

1. Is there possibility to add imgfs.h to sources published on the first page?

2. I'm a bit puzzled that while prepimgfs tool supports different approaches to mpx,emu,acer,etc images, it seems from the sources that makeimg doesn't take them into account. For example, in
prepimgfs:

WriteFile(H, ImgfsPtr+i, step, &Tmp, 0);
WriteFile(HT, ImgfsPtr+i+step, skip, &Tmp, 0);

here step & skip are variables defined for each device separately, but in makeimgfs, it seems, those are hardcoded values:

ReadFile(H,ImgfsPtr+i,0x3F000,&Tmp,0);
ReadFile(HT,ImgfsPtr+i+0x3F000,0x1000,&Tmp,0);

is it an old source of makeimgfs?, or it never supported mpx, acer, etc?

[solnyshok]

Mamaich,

Looking at imgfs_removed_data.bin in hex we have 0x82 blocks of 0x1000 bytes looking approximately like one below,

80 04 00 00 FF FF FB FF 81 04 00 00 FF FF FB FF 82 04 00 00 FF FF FB FF 83 04 00 00 FF FF FB FF 84 04 00 00 FF FF FB FF 85 04 00 00 FF FF FB FF 86 04 00 00 FF FF FB FF 87 04 00 00 FF FF FB FF 88 04 00 00 FF FF FB FF 89 04 00 00 FF FF FB FF 8A 04 00 00 FF FF FB FF 8B 04 00 00 FF FF FB FF 8C 04 00 00 FF FF FB FF 8D 04 00 00 FF FF FB FF 8E 04 00 00 FF FF FB FF 8F 04 00 00 FF FF FB FF 90 04 00 00 FF FF FB FF 91 04 00 00 FF FF FB FF 92 04 00 00 FF FF FB FF 93 04 00 00 FF FF FB FF 94 04 00 00 FF FF FB FF 95 04 00 00 FF FF FB FF 96 04 00 00 FF FF FB FF 97 04 00 00 FF FF FB FF 98 04 00 00 FF FF FB FF 99 04 00 00 FF FF FB FF 9A 04 00 00 FF FF FB FF 9B 04 00 00 FF FF FB FF 9C 04 00 00 FF FF FB FF 9D 04 00 00 FF FF FB FF 9E 04 00 00 FF FF FB FF 9F 04 00 00 FF FF FB FF A0 04 00 00 FF FF FB FF A1 04 00 00 FF FF FB FF A2 04 00 00 FF FF FB FF A3 04 00 00 FF FF FB FF A4 04 00 00 FF FF FB FF A5 04 00 00 FF FF FB FF A6 04 00 00 FF FF FB FF A7 04 00 00 FF FF FB FF A8 04 00 00 FF FF FB FF A9 04 00 00 FF FF FB FF AA 04 00 00 FF FF FB FF AB 04 00 00 FF FF FB FF AC 04 00 00 FF FF FB FF AD 04 00 00 FF FF FB FF AE 04 00 00 FF FF FB FF AF 04 00 00 FF FF FB FF B0 04 00 00 FF FF FB FF B1 04 00 00 FF FF FB FF B2 04 00 00 FF FF FB FF B3 04 00 00 FF FF FB FF B4 04 00 00 FF FF FB FF B5 04 00 00 FF FF FB FF B6 04 00 00 FF FF FB FF B7 04 00 00 FF FF FB FF B8 04 00 00 FF FF FB FF B9 04 00 00 FF FF FB FF BA 04 00 00 FF FF FB FF BB 04 00 00 FF FF FB FF BC 04 00 00 FF FF FB FF BD 04 00 00 FF FF FB FF BE 04 00 00 FF FF FB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .......
always ending with
FF FF FF FF FF FF FF FF 06 21 55 C1 D5 29 9C DF B8 EA B8 BA F3 F9 D3 82 47 8A 43 3B E6 2A D9 A9 31 67 39 09 53 67 BF 12

followed by 0x164 empty blocks (FFs),(TFAT16?)

then followed by 2 blocks of interchanging multiple FFs and multiple B2 BA sequences looking like this

FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

and ending with the last 1 block of 0x00-s.

At this point my conclusions are:
1. there are 0x82 sequential x40000 blocks of data - so, there no hole in this ROM.
2. last block of 00 is probably signalling the end of ROM or end of TFAT.

What the 2 blocks with 2AB2 stand for, maybe remainder of FAT TABLE?

What those 504 bytes long sequences of
80 04 00 00 FF FF FB FF 81 04 00 00 FF FF FB FF 82 04 00 00 FF FF FB FF
stand for, maybe they need to be in imgfs_raw_data.bin?

I look also at imgfs_raw_data.bin - it has slightly different structure
-there is also 0x82 sequential 0x3F000 long blocks of data,
-followed by only 20 blocks of FFs (instead of 0x164 blocks of FF in removed_data.bin)
-here the TFAT16 image begins - one block is filled mainly with 0x00-s and then it is follwed by the rest of blocks filled with FFs.
-last 2 blocks contain those BA B2 sequences again. FAT table? Is it incomplete because part of it is removed? Does it affect work of viewimgfs?

Sorry for so many questions. :roll:

[solnyshok]

I thought I'd bump this thread again after two weeks. Can anyone help me to figure out structure of this ROM based on data above?

Solnyshok http://www.websmileys.com/sm/smoking/rauch23.gif

[kremo]

can someone help how to change a dll in wizzard rom?

I tried to change keyboard driver to work wizzard rom on prophet.
I tried delfile/addfile and change dump directory too, but after create nba file and flesh it, keyboard doesnt work.

can someone help how can I fix this?

[sorg]

i would like to ask couple of questions to mamaich if he is still around here.
i'm studying ASUS P525 ROM image. IMGFS tools work fine with key -nosplit. I guess, since no need split data building ROM should work fine as well.

according to what mamaich said, module is barely memory dump of exe/dll without any relocation and section info, PE header almost empty as well. But looking at any module inside P525 ROM i clearly see all info in PE header. Relocation/Section info is also present and it seems valid. Is it new generation of ROM? I read that TrueFFS DOC system doesn't allow XIPing, thus all files should be copied to RAM before execute. So, looks like original XIP idea is dead in present generation of ROMs and even modules look like normal portable executable files.
So, can mamaich give any comment about this?
Also, since module has no difference in comparing with normal PE files and TrueFFS DOC ROM has no real XIP support, may it be transferred from module-type to file-type? working with files is much easier, IMHO.

[ali4533]

can i edit imate PDA-N (HTC Galaxy) ROM?

[Oki]

Yes. Theoretically they load a bit slower then XIP dlls, but this is completely unnoticeable. By the way all DLLs in IMGFS (stored as modules or as files) are loaded to RAM. The real XIP DLLs that are executed directly from ROM are only nk.exe, coredll and several other that are in first XIP section of ROM.
In the New Magneto format there are not XIP chains. Instead of them there are other compressed sections with the "SRPX" signature, so NK.exe and the rest of the critical IO DLLs are not executed directly from the storage device anymore. Things are getting more and more like in the PC platform.

By the way, it is possible to get the source code of viewimgfs and buildimgfs?

Regards,
Oki

[hannip]

Hi, I'm using these tools not so much for creating a new rom, but for extracting files and cabing them up for install on other devices.

I've extracted a cheetah imgfs using
prepare_imgfs Part02.raw -nosplit
viewimgfs imgfs_raw_data.bin

Worked great. I am able to take any of the files and use them as is on another device. However when I try to use module files it appears unusable.

I see there is a RecMod tool for restoring a module but when I use it there is no output and it just exits. I read in the tool notes that if RecMod is in the current dir when extracting the modules it will restore them to files. Is the result the file inside each module dir? If so are these usable as is or do they still need header tweaking?

Thanks for your help.

[hannip]

It looks like I jumped the gun. I tried the dll's on another device and they work fine. Sorry and thanks for these great tools!

[Oki]

I see there is a RecMod tool for restoring a module but when I use it there is no output and it just exits. I read in the tool notes that if RecMod is in the current dir when extracting the modules it will restore them to files. Is the result the file inside each module dir? If so are these usable as is or do they still need header tweaking?

Thanks for your help.RecMod creates the executable file inside the module folder. you have to call it with the name of the folder:

recmod ".\MyModule.dll"

If recmod.exe is present in the same folder of viewimgfs.exe then the modules are reconstructed when being extracted from the IMGFS segment.

Regards,
Oki

[Johnnnnnnnnnny]

I can edit ROM, but I cant edit default.hv yet.
I have:
1. split all the tools + default.hv into same folder
2. use: <code>set _FLATRELEASEDIR=.
rgucomp -o default.hv -nologo > default.rgu</code>
and I have default.rgu
3. Edited it, and renamed onto boot.rgu and save as unicode
4. use <code>rgucomp -o</code> and it was extract me boot.hv, who has 28 KB!! What I doing wrong?

[jvelasco]

Please Help...
How to add files to other folder (not Windows)?
Ex. \Windows\Startup\ ?

Not found "initifiles.dat"

I have hx4700 WM5, use:
prepare_imgfs.exe CEOS.nbf
viewimgfs.exe imgfs_raw_data.bin
... working... .\dump\
BuildImgfs.exe
make_imgfs.exe ceos.nbf
xda3nbftool -c -u ceos.nbf
ceos.nbf work fine.

thanks advanced..

[Oki]

Please Help...
How to add files to other folder (not Windows)?
Ex. \Windows\Startup\ ?

Not found "initifiles.dat"
The right name is initflashfiles.dat

Regards,
Oki

[jvelasco]

The right name is initflashfiles.dat

Regards,
Oki

Thanks for reply...
.\dump\initflashfiles.dat not found
This is found in \device\windows\initflashfiles.dat
...
Try copy \device\windows\initflashfiles.dat to .\dump\
...

[jiggs]

Hi Mamaich,

I know you are no longer working on this tools as you said in your first post. However, I thought it wouldn't hurt if I ask a reverse tool for recmod. Meaning files turned back to modules... if this is possible.

Thanks.

[mamaich]

Hi Mamaich,

I know you are no longer working on this tools as you said in your first post. However, I thought it wouldn't hurt if I ask a reverse tool for recmod. Meaning files turned back to modules... if this is possible.

Thanks.

I've already answered that earlier. Of cause it is possible, for example Microsoft has such toolchain. And I don't have time nor mood to recreate that stuff myself.

[jiggs]

I've already answered that earlier. Of cause it is possible, for example Microsoft has such toolchain. And I don't have time nor mood to recreate that stuff myself.

I'm really sorry if I missed out that part. If it isn't too much to ask, could you possibly show us how to store files on a different subfolder other than the default \windows when we add files to the WM5 ROM? IF it would be difficult and tedious for ordinary ROM cookers like us, please accept our apology for asking.

[mamaich]

... could you possibly show us how to store files on a different subfolder other than the default \windows when we add files to the WM5 ROM? ...
This was also already answered. Use initflashfiles.dat to place files where you need.

[jiggs]

Actually, we have read about the use of initflashfiles.dat. However, initflashfiles.dat makes duplicate (copies) and not move the files from \windows to the location where its supposed to be. This wouldn't have been a problem if our himalaya were not limited with persistent storage space. We noticed that if we run the applications we added to the ROM from \windows where it is automatically placed, we save a lot of space, BUT it becomes very tedious in converting references to \windows for all applications we intend to incorporate.

Now, our question, really is, can you show us a way to cooked the files into ROM other than the default \windows OR is it too cumbersome as well that we are better off converting references of the applications to \windows. Hope you understand us and thank you for being patient with me.

This was also already answered. Use initflashfiles.dat to place files where you need.

[phoniex_8848]

I have got modules,such as abc.exe,abc.dll.
But they can't be Edited with Mul.:confused:
Which tool should I use to edit them??
thk u

[jiggs]

I have got modules,such as abc.exe,abc.dll.
But they can't be Edited with Mul.:confused:
Which tool should I use to edit them??
thk u

What do you want to do with abc.exe and abc.dll? When you say modules, do you only have folders named abc.exe in dump folder? If you look at the contents of these folders you will see the file itself abc.exe otherwise you need recmod.exe to convert the module to files.

i.e. recmod abc.exe abc.exe

[phoniex_8848]

What do you want to do with abc.exe and abc.dll? When you say modules, do you only have folders named abc.exe in dump folder? If you look at the contents of these folders you will see the file itself abc.exe otherwise you need recmod.exe to convert the module to files.

i.e. recmod abc.exe abc.exe

thk u!
But there comes 'Error!Cannot map zlib.dll\imageinfo.bin'!~:(
WHY?
How to do?

[b_sphinx]

How do i change .nbf to .nba using xda3nbftool.exe for universal rom?

Tried,
xda3nbftool -x ms_.nba ms_.nbf 0x20040522
xda3nbftool -x nk.nba nk.nbf 0x20040521
xda3nbftool -x radio_.nba radio_.nbf 0x20040523

doesn't work, i guess something 2 do with the password??

anyone..??

thx

[jiggs]

thk u!
But there comes 'Error!Cannot map zlib.dll\imageinfo.bin'!~:(
WHY?
How to do?

Please read the first page of this thread. Complete instruction is stated there in extracting modules...

[b_sphinx]

How do i change .nbf to .nba using xda3nbftool.exe for universal rom?

Tried,
xda3nbftool -x ms_.nba ms_.nbf 0x20040522
xda3nbftool -x nk.nba nk.nbf 0x20040521
xda3nbftool -x radio_.nba radio_.nbf 0x20040523

doesn't work, i guess something 2 do with the password??

anyone..??

thx

Never mind...

managed to use the perl & alpinebfdecode.pl method to convert.. :)

[Lvballer06]

Please read the first page of this thread. Complete instruction is stated there in extracting modules...


I get the same error and I have read the first page.....when it says path to module how should that be formatted? to the folder? the file? or what? An example would be nice :D
Thanks for any help in advanced,
Mike

Edit: I got it to not give me the error, but it didnt go anything just went to a new line in command prompt...

And how do I make a .hv file for the ROM? Anyone know?

[Johnnnnnnnnnny]

HI,
I want to use RecMod, but It doesnt work me. I have dumped ROM and I use:
recmod.exe C:\ROM\dump and it doesnt work - It fail just on start

but the error shows: "Error! Cannot map C:\rom\dump\imageinfo.bin"


SO, the original question: What I doing wrong?

And 2. I can change Aku version, but I dont know, how to change os value. Do you can help me?


some help to me?

[jiggs]

HI,
I want to use RecMod, but It doesnt work me. I have dumped ROM and I use:
recmod.exe C:\ROM\dump and it doesnt work - It fail just on start

but the error shows:

SO, the original question: What I doing wrong?

And 2. I can change Aku version, but I dont know, how to change os value. Do you can help me?


some help to me?

hex edit nk.nba to change os value...

[xplode]

How the change the WM5 coredll.dll?

I understand that it is in XIP section of the rom, it has done before old os core was 5.1.1700 and the current one it 5.1.195, there are newer core for WM5 now, again I am talking for blueangel rom

I just need someone to point me to the right direction and i will do this

[rockmouse]

Thanks.

^^

[llbasha]

*********
*********

What is the best way and tools to use to edit initflashfiles.dat
This file is very important and we need step by step clear guide with example

*********
*********

[Oki]

*********
*********

What is the best way and tools to use to edit initflashfiles.dat
This file is very important and we need step by step clear guide with example

*********
*********
Without any doubt, the best tool is NOTEPAD.EXE. The way you use it depends on what you want to do with that file. Be more specific with your question since it is more or less like asking for the best way of editing the registry.

Regards,
Oki

[konker]

Hi...I'm trying to unpack the Dopod C720W ROM I downloaded from the Dopod Asia website.
However, I have not managed to get it to completely dump the contents.
Here's what I did:
1. Using NBHextract.exe, I ran the command on RUU_signed.nbh & the contents of this ROM file produced a collection of files.
2. Using prepare_imgfs.exe, I managed to extract the .bin files from the 04_OS.nb file & got two output files imgfs_raw_data.bin & imgfs_removed_data.bin.
3. I proceeded to ran viewimgfs.exe on imgfs_raw_data.bin & was hoping to see the ROM dumped into the dump folder but within a second, the process completed without any specific message nor dump folder.
So, what am I doing wrong? How come I cannot dump the .bin file as claimed to extract specific files.
Please advice me on what else I might have missed out.
Thanks!

[xplode]

try this

http://wiki.xda-developers.com/index.php?pagename=Hermes_NBH

[llbasha]

Without any doubt, the best tool is NOTEPAD.EXE. The way you use it depends on what you want to do with that file. Be more specific with your question since it is more or less like asking for the best way of editing the registry.

Regards,
Oki

Thank you for the response. All I wanted to know is the file type. I now understand it is a unicode file. I find that the best way to edit this is by using an old program called editpad (copy attached - free version) that allows to do, among many other things, to convert unicode to ansi and back to unicode without destroying the file structure. I feel sure many will find this very useful. Also it can be used as direct replacement for notepad by just rename it notepad.exe and over write your window one (or rename it before copying).

Regards
llbasha

[shantzg001]

I've been trying to use the tools for building an HTC wizard ROM. Now, before starting out on any modifications, I simply tried to break apart and rebuild it. So, I extracted a ROM using typhoondecode_v5, then followed this:
1. prepare_imgfs.exe OS.nb -nosplit
2. viewimgfs.exe imgfs_raw_data.bin
3. BuildImgfs.exe
But then my imgfs_raw_data.bin is not rebuilt and stays at its original self. The buildimgfs tool does not give me an error, however the last 3 lines of its output reas something like :
total sectors: 0000
used: <some number>
free: <some number>
I searched the forums but couldn't find an answer. Saw a couple of posts having the same prob but no answer. Since I havent done any modifications to the ROM and have tried with both AKU2.3 and AKU 3.3 (and custom ROMs as well as official Qtek ROMs), the ROM that i am using is also not an issue.
Now, since there are so many custom wizard ROMs out there and ppl swear by mamaich's tools so there must be a solution. Please help me out.
Thanks in advance.

[pencilcase]

Hey, this is probably the most stupid question ever but I have been searching for hours on this and seem to be unable to find a hint...

how can i pre-modify the registry of my dumped rom?

[Mr. Vi]

Hi guys!

I just started to cook my own roms for my wizard and added some executables and some shortcuts to the underground rom.

I made those changes like that:
## Extracting OS from nk.nbf
typho5.exe -x nk.nbf

prepare_imgfs.exe 80040000-OS.nb -nosplit
viewimgfs.exe imgfs_raw_data.bin

Now, I just put "AltTab.exe" and "AltTab.lnk" into the "dump" directory. After that, I edited the "initflashfiles.dat" (just added one line, to put the shortcut into the Start menu folder)

BuildImgfs.exe
make_imgfs.exe 80040000-OS.nb -nosplit

Using the tool "nb2nbf.exe" I created the new kn.nbf file and flashed my wizard. (is it correct, that I change the start address from "82040000" to "80040000"?)

Now, have a look at the output (woot.jpg)

Please tell me what's going wrong...

Hope you can help me! Vi

ps: when i hardreset the device, it doesn't show the align screen to me.

[nandlal_mk]

Hi guys!

I just started to cook my own roms for my wizard and added some executables and some shortcuts to the underground rom.

I made those changes like that:
## Extracting OS from nk.nbf
typho5.exe -x nk.nbf

prepare_imgfs.exe 80040000-OS.nb -nosplit
viewimgfs.exe imgfs_raw_data.bin

Now, I just put "AltTab.exe" and "AltTab.lnk" into the "dump" directory. After that, I edited the "initflashfiles.dat" (just added one line, to put the shortcut into the Start menu folder)

BuildImgfs.exe
make_imgfs.exe 80040000-OS.nb -nosplit

Using the tool "nb2nbf.exe" I created the new kn.nbf file and flashed my wizard. (is it correct, that I change the start address from "82040000" to "80040000"?)

Now, have a look at the output (woot.jpg)

Please tell me what's going wrong...

Hope you can help me! Vi

ps: when i hardreset the device, it doesn't show the align screen to me.

Hi ,
im using molski pack for cooking my own rom for prophet. see

http://forum.xda-developers.com/showthread.php?t=297027

im getting similar image n situation on 3rd splash screen.
read it

http://forum.xda-developers.com/showpost.php?p=1168384&postcount=59

Nobody is guessing whts going wrong, even not molski--the thread starter

is the situation same like me ?

thanx
nandlal

[mun_rus]

Probably you have wrong iniflasfiles.dat
Check it once more

[d4blue]

hi..does anyone coul help me cook 02 Atom Exec ROM without any software like sms plus, sprite backup, jeyo extender, etc?


best regards,

eddie

[Max.V]

I have problem with using BuildImgfs.exe.
When I execute this utility, errors hapens :(
I want to edit Tornado ROM.What do I do wrong?:confused:

P.S> I shall be grateful to any advice :)

[roozbeh]

is this normal that i dont have initflashfiles.dat?
it seems some kitchen tools require this?
is it safe that i create a null one?

[naoki66]

D:\tt2\os\TOOLS>viewimgfs.exe imgfs.bin
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: LZX
dwFreeSectorCount: 00002B22
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000

Address: 00000200, dwBlockSignature: FFFFFEFE
dwNextHeaderBlock: 00000000 (size: FFFFFE00)

Header type: 00000270, Addr: 00000208
Unknown header type, FS_DATA_TABLE??

Header type: 00760070, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??

Header type: 000002A4, Addr: 00000270
Unknown header type, FS_DATA_TABLE??

Header type: 000002D8, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??

Header type: 0000030C, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??

Header type: 00000000, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??

Header type: 000003A8, Addr: 00000340
Unknown header type, FS_DATA_TABLE??

Header type: 0072006F, Addr: 00000374
Unknown header type, FS_DATA_TABLE??

Header type: 00300053, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??

What's wrong??

[cicciocant]

How Can I use this tool to translate The roms?

[hollandg]

I'm stumped!

I've got the DLL file in the same dir as buildimgfs but I'm still getting the error
Unable to load compression dll!

Any ideas?

I'm following the trinity dumping instructions so I'm not exactly sure what to do when things go wrong :confused:

[sservati]

how can we change splash screen with this tool?

I already cooked a rom for Hyundai A200 but I want to change the Splash screen of Hyundai to a picture!!!

please help me guys

[jiggs]

Hello mamaich,

We are trying to build a new ROM for the XDA Atom, and we encountered some problems with the .ROM module. Described as follows is the original imageinfo.bin content for each device. Our objective was to port the AKU3.5 system files into our old AKU2.2.

ATOM AKU2.2: 00 00 1E 01 00 00 10 02 02 00 00 00 00 00 E5 01
ATOM LIFE AKU3.3: 00 00 28 01 00 00 02 02 02 00 00 00 00 00 E4 01
BENQ P51 AKU3.5: 00 00 25 01 00 00 02 02 02 00 00 00 00 00 E4 01

Now, if we used the .ROM module of BENQ, our XDA Atom would not boot. If we use the .ROM module of Atom along with the BENQ system files, the device will boot, but the today screen won't show, the control panel applets are missing, etc.

I changed the ATOM .ROM imageinfo.bin into:
00 00 1E 01 00 00 02 02 02 00 00 00 00 00 E5 01

and the today screen showed, as well as the control panel applets. However, there are still some things left out like the SD Card and Active Sync not functioning properly. We suspect this is so because if we use the .ROM module of Atom Life together with BENQ system files, active sync works but SD Card is not functioning.

If you can enlighten us with this, we will not be guessing as to what are the appropriate values to be placed. Thanks and hope to hear from you. :)

[jiggs]

sorry wrong post. I transferred to proper thread.

[sg10]

edit: forget it, my mistake, awaiter didn't produce the required .bin unless I do -force.
thank's for great util.

[famsanr]

Hi everybody. I upgraded the rom in my htc pu 10 but after of finishing instalation with the reset for initializing the device only appears the logo and no more. I've instalated the rom again and again but in the fist screen doesn't apears any rom, radio and extended rom. I'll be grateful with any answer for fixing my trouble. Thank for reading this.

[DSF]

You are a bit wrong. You can replace any module (i.e directory) with a file. Just delete the directory and add the file with the same name.

Yes.. but it does not work in case of OS modules... I've tried to copy directly modules from OS, SHELL, MEdiaOS from another ROM and phone booted OK, but programs aren't working normally.
Then i've copied all the files from those modules, deleted the modules from my rom, copied the files back and flashed. Surprise: stuck in the first splash screen...

Is there a solution for this, please?

Using on TORNADO smartphone, many tools for wizard are working also on tornado.

Thanks

[b0ris747]

IPAQ HW69xx (aka HTC SABLE) modification of prepare_imgfs (-ipaq argument):



if (argv[argc][1] == 'i')
{ rate=0x10089; step=0x10000; skip=0x89; }

[sledwrecker]

Is there a way to convert nk.nbf to nk.nbh? THANKS!:confused:

[4blue]

Hi ! I tried to extract the imgfs_raw_data.bin file. RecMod.exe and viewimgfs.exe are in te same directory. If I run in CMD viewimgfs.exe imgfs_raw_data.bin I get the error message: Cannot map file imgfs_raw_data.bin

Any solution(s) to this?

THX!

[spgi]

IPAQ HW69xx (aka HTC SABLE) modification of prepare_imgfs (-ipaq argument):

Hi all,
First my english very very bad. Sorry
Any help to kitchen rom wm6 for htc sable (hw6915)

Im kitchen rom from Microsoft SDK and dumped CEOS.nbf. My not posible end proekt.
This link: http://rapidshare.com/files/94461173/BuildWM6_hw6915.rar is Rar arhive :
1. Dumped rom from hw6915 - imgfs_removed_data.bin, imgfs_raw_data.bin;
2. Dumped Microsoft WM6 SDK - a.BIN.extra, a.BIN.payload
3. Scoter kitchen rom - CEImage.bin.
My not posible create from CEImage.bin this CEOS.nbf.

Use Scoter kitchen.
Collect boot.rgu from windows of your device.
Dump ROM and create packages by bepe Package Tool.
Keep OEM.
Use SYS as you want.
But the hardest part is XIP section.

Not work tools (buildimgfs, viewimgfs and any tools from xda-developers) for this device. :confused:

[wickednomad]

Hi! I´m trying to dump my original HTC Touch XL´s (ELFIN) ROM in order to try some of the other systems available in this forum.

:D I´m using this guide:

http://wiki.xda-developers.com/index.php?pagename=Elf_HowtoDumpRom

:mad: Unfortunately i´m getting an error here:

D:\_ROM>buildimgfs.exe

it stops when processing the file wmvdmoe.dll:

"Processing "wmvdmoe.dll" as module" :confused:

I get an error message and windows asks to send a crash report to microsoft.

If i try to run the buildimgfs command again, i get the error:

"Unable to load compression DLL!"

Any ideas what might be happening?



brs,

Gus



Ps. Dump_memorymap.txt shows:

01E8F000 - 01ECCFFF ( 253951 bytes): wmvdmoe.dll


.

[apex123]

Hi ,
I'm a beginner for creating and editing a ROM and loading it on my windows mobile 5.0,
please help about how to create a ROM , take a backup of my existing original ROM , and how to dump the WM5.0 changed ROM on my PDA , I'm having
HP IPAQ rw6928 running WM5.0,
Also is it possible to change the OS on my device,i.e., the ROM. ?
Also is it possible to load WM6.0 on my PDA?

[Claudiomaracaja]

Please i need your help, i have a MIO P550B flashed with rom "Osc260A R05_P09" but this rom is not totaly compatible with
P550B (screen not centralized and deslocated to righ side and audio is too low), i need to put your original versio back "OSCAR 270a UT R02"
i have a original backup rom "part00.raw,
part01.raw,
part02.raw
and part03.raw"

rom of P550B

Oscar 270a_ut_r02
127.00M (0x7f00000) SMFLASH
| 1023.00k (0xffc00) Part00
| 1.63M (0x1a0000) Part01
| 34.88M (0x22e0000) Part02
| 89.50M (0x5980000) Part03
1.88G (0x78000000) DSK1:
| 1.87G (0x77fe0200) Part00
STRG handles:
handle 83f74666 1.87G (0x77fe0200)
handle 63ec3892 89.50M (0x5980000)
handle a3ec319e 34.88M (0x22e0000)
handle c3f74faa 1.63M (0x1a0000)
handle c3f74fce1023.00k (0xffc00)
disk 83f74666
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 63ec3892
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3ec319e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c3f74faa
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c3f74fce
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



i tryed the methods to make nb0:

1) prepare_imgfs.exe Part02.raw -nosplit - Sucess
2) viewimgfs.exe imgfs_raw_data.bin - Sucess
3) buildimgfs.exe - Sucess

now i need a "ruu_signed.nbh" of P550 or P550B to proceed with next step.
where i found ruu_signed ???
somebody help-me. thanks.

[systemz]

Put a link of the original files to mio p550b.
I will recompile!
:)

[Claudiomaracaja]

http://www.megaupload.com/?d=ZLPCD3AO

thanks a lot.

[efjay]

Can anyone help with converting .raw files extracted from a Samsung Omnia to a flashable file? Thanks.

[Odeon]

Hello All:

double searched the forum, can't find the answer (even though mamaich said it's answered somewhere here):

is there the reverse for recmod.exe? i.e., modules from files? or can we just delete old module (folder) and insert file instead, and it will be rendered correctly by rom building tools and later by OS itself?

Please help!

[Scorpion23]

I sewed the beast sewing collected through ROM kitchen, unique that I did not so, so inundated it in him the Italian version 2002. Now there is sleduschee, device in bootloader calls not, but at the load of the operating system, at the start of any program gives out errors. If to call at tuning, there simply empty screen nothing is present. If to leave him included and not to touch, through about 5 overloaded and waits actions.
What can be done, that started to fly what is necessary to be changed??? or to abort him?? Thank you for an answer...:(:(:(

[danjunior777]

Hi, Claudiomaracaja! Did you get your problem solved? I have the same problem and would be glad if you can help me.

[Perinn]

danjunior777, Claudiomaracaja! someone got the problem solved? i have the same problem!!