One more step towards WM6 ROM ?

[Avis]

One man has successfully integrated WM6 modules into XIP of hx4700. The result: working WM5 with WM6 modules from "msxipkernel" package (taken from Universal)
Maybe his method can help us to port WM6 on Himalaya?

(Original thread: http://4pda.ru/forum/index.php?showtopic=44886)
Here is what he did (translate from russian):

1. Take "xipport". Modified one is attached.
2. dump xip & build maps for hx4700. Save "map.txt"
3. dump xip & build maps from wm6 xip (HTC Universal or any other device)
4. Just copy all modules and those ".txt" files from msxipkernel (wm6) except "cachefilt", "encfilt", "filesys".
5. "realloc P" & write maps (it works for hx4700). If not enough mem for realloc - then increase "physlast" in "romhdr.txt"
6. In new "map.txt" addresses of regions in section "first Dll... last Dll" for 4 files in "oemxipkernel" must stay unchanged, for example:
---
01fe1000 - 01fe2000 L00001000 actual of region_1 Fsdspy.dll
01fe2000 - 01fef000 L0000d000 actual of region_1 msflash.dll
01fef000 - 01ff0000 L00001000 actual of region_2 cecompr.dll
01ff0000 - 01ff1000 L00001000 actual of region_1 ceddk.dll
---
If they are not then fix in corresponding "imageinfo.txt" value of o32[1(2)].o32_realaddr

7. Repeat the same for all files in "msxipkernel". We need that "actual of region_1" correspond with "map.txt" (wm6). For files "pm.dll" and "regenum.dll" will be "!!!!!!!!!!!!!" symbols.

8. Edit "o32[1].o32_realaddr" for "pm.dll" and "regenum.dll" to make there regions exactly concur with regions of excepted "cachefilt", "encfilt". Such a replacement. After all this section must be:
---
01fa01fe - 01fa01fe L00000000 Start: first DLL address
01fa01fe - 01fe1000 L00040e02 NUL
01fe1000 - 01fe2000 L00001000 actual of region_1 Fsdspy.dll
01fe2000 - 01fef000 L0000d000 actual of region_1 msflash.dll
01fef000 - 01ff0000 L00001000 actual of region_2 cecompr.dll
01ff0000 - 01ff1000 L00001000 actual of region_1 ceddk.dll
01ff1000 - 01ff2000 L00001000 actual of region_1 mspart.dll
01ff2000 - 01ff3000 L00001000 actual of region_1 imgfs.dll
01ff3000 - 01ff4000 L00001000 actual of region_1 fsreplxfilt.dll
01ff4000 - 01ff5000 L00001000 actual of region_1 fsdmgr.dll
01ff5000 - 01ff6000 L00001000 actual of region_1 fatutil.dll
01ff6000 - 01ff7000 L00001000 actual of region_1 fatfsd.dll
01ff7000 - 01ff8000 L00001000 actual of region_1 regenum.dll
01ff8000 - 01ff9000 L00001000 actual of region_1 diskcache.dll
01ff9000 - 01ffa000 L00001000 actual of region_1 devmgr.dll
01ffa000 - 01ffc000 L00002000 actual of region_1 crypt32.dll
01ffc000 - 01ffd000 L00001000 actual of region_1 coredll.dll
01ffd000 - 01ffe000 L00001000 actual of region_1 certmod.dll
01ffe000 - 01fff000 L00001000 actual of region_1 pm.dll
01fff000 - 02000000 L00001000 actual of region_1 busenum.dll
02000000 - 02000000 L00000000 End: last DLL address
---

9. Look into "map.txt" (Universal) to find where was the first region of "regenum"
---
01fef000 - 01ff0000 L00001000 actual of region_1 regenum.dll
---
If it was "0x1FEF000", and we changed it to "01ff7000". So we have to patch file. Edit "S000" of "regenum.dll" and fix all dword-aligned values that looks like: XX XF FE 01 to XX X7 FF 01 (so we see them in "winhex"). It can be automated with a simple script :)

10. Do the same for "S000" in "pm.dll"

11. Set in all "imageinfo.txt" cvalue of "e32_subsysminor" to 1.

12. Write new placement of "ROMHDR" into "S000" of "nk.exe"

13. Make ROM, flash and Try!

[lyger]

hx4700 wm6, frankinstein style. interesting development anyone upto trying it?

[jiggs]

hey Avis. He did not mention in his steps when to introduce cachefilt, etc.

could you possibly ask him to post the original XIP.bin and the WM6 XIP.bin; so, we could study further. (sorry, I don't speak Russian)

This is promising... :)

Jiggs

[jiggs]

Oh, I get it. He didn't include cachefilt and stuff because he's still using WM5 system files...

[jiggs]

step 12 is vague. write new placement of "ROMHDR" into S000 of "NK.EXE" BUT I couldn't locate any instance of the address of ROMHDR in S000! :confused:

[lyger]

jiggs, sounds like you got skillz. can anyone help develop this solution? need to get more people aware of this..

[jiggs]

step 12 is vague. write new placement of "ROMHDR" into S000 of "NK.EXE" BUT I couldn't locate any instance of the address of ROMHDR in S000! :confused:

okay I got it. there is rom_00 hdr in map.txt those addresses are the ones I can locate in S000 nk.exe. However, I have flashed my deviced three (3) times already, but it won't boot nor even show the boot screen.

What is not clear to me is step 6. what is my reference map.txt: hima? or uni?

[jiggs]

jiggs, sounds like you got skillz. can anyone help develop this solution? need to get more people aware of this..

tell bepe and tofclock, they're more experienced in porting...

[lyger]

did you use a hx4700 or a different device? Shame it didn't start-up.. anyone provide any insight on how this works?

[jiggs]

Avis,

Could you please request for sample xip.bin's so we can study further?

Thanks in advance.

Jiggs

[jiggs]

This method will not work in our Himalaya because we need nk.exe that is compatible with the new CORE. Unfortunately, our very old nk.exe is not compatible with WM6 CORE.

:mad:

[chrismrulz]

I realize this is about the Himalaya,
But does this mean we might have a working WM6 for the hx4700?
There are like thousands of people waiting on that. we've even signed petitions to try and get hp to do it :/

[cmonex]

well if anyone needs help in porting wm6 to a wm5 device that has no wm6 kernel, i can try and help.

i've already contributed to some such projects which have been successful. :)

[Rudegar]

i suspect that you and Avis are the only ones working on it
http://forum.xda-developers.com/showthread.php?t=293352&page=3

[cmonex]

i suspect that you and Avis are the only ones working on it
http://forum.xda-developers.com/showthread.php?t=293352&page=3


i was on holiday....how is the hx4700 port right now?

edit: ok i checked it out :)