69xx bootloader command for extracting ROM

[nixo79]

Hello,

please, if somebody has more information about bootloader commands supported by HP iPAQ hw6900 series (HTC Sable) to share on this thread with us

Will be very helpful if we can extract ROM image through the bootloader of this iPAQ

[Nazeroth]

I dont know much, i know nothing indeeed, however i found somewhere a pack of files for the Wizard that were supposed to work for the sable, however they didnt, but there is this particular file, that when ran in the sable made appear a folder called "2" with an icon of a storage card and which rpely the contents of the root of the device (but for itself i mean no 2 folder inside the 2 folder lol)

I dont know if it is of some use but i definitevely want to perform a corporate install of windows in my sable and kill all that HP crap that comes in bundled

[b0ris747]

Just press ACTION+POWER+reset with stylus and hold this combinaison for a few seconds, you'll see a screen without backlight (so you must be under bright light to see it) going into bootloader mode.

Put your device on the cradle (which I suspect you had connected it to your PC)

using mtty, connect to your USB Port (or Serial port if serial cradle)

type "password BOOTLOADER" and use "h" as an help command.

Now you can dump a ROM from Bootloader

The command should be sth like "r2sd"

Read the manual of this command "h r2sd full" and use it to dump your ROM on the SDCard

Now you can dump the raw ROM image from SD Card Reader using ntrw.exe

EDIT: going to bootloader mode seem to hard reset your device, backup FIRST!

[Nazeroth]

HI Boris,

where to find the manual ETC.

A RAW ROM maens a bin file? how to convert then to something readable modifiable.... i understand that this is the main issue now.

[b0ris747]

I want to see a computer file which isn't binary based....
or a full text ROM :)

In fact, for me a raw ROM is a ROM-file which has been extracted from the device... The difference with a ROM-to-install is the encryption which is not present with raw dumps (to be checked).

Raw dumps can be modified and then re-updated but it needs some operations that are command-line based...

Once you got your raw ROM on SD, copy it to PC using ntrw, you have to find the correct tool to dump the content (dumprom should do the work)

Remember to keep the raw ROM as a backup, and work with a copy of the raw ROM.

You can also cut/paste the file into parts (OS, EXTROM...).

Logically, if you got the original ROM file (the german one) and the same taken from the device (raw ROM), we should be able to modify some existing tools to work with 69xx ROM files and cook some ROMs.

in bootloader mode: type
"h COMMANDNAME full" should show full manual of COMMANDNAME.
To have more informations, once you know if your bootloader has d2s or r2sd ... command name, search for it on wiki and you should have more informations and examples on the specific command.

[Matt4444]

I need to extract the ROM from one of these as well. I am getting into bootloader and trying to dump the rom to 256MB SD as follows...

USB>
USB>
USB>password BOOTLOADER
HTCSPass.<YHTCEUSB>d2s
SD:Waiting for card insert.........

CMD3 for SD, it's OK, ready to get RCA from response.

SD:Detected one card

SD:ready for transfer OK

d.total_lba=7A000
d.block_size=200
d.RCA=B368
d.drv_type=40000000
d.busWidth=1
Total card size=F400000

SDCARDD2S+,cStoragePlatformType=FF



Then the device just sits there with Cal Checksum on the screen. I get no response from NTTY or device until I restart.

I read on another thread that it might be locked. I also read that there may be a password to get into another level of access. See http://mobilitytoday.com/forum/showthread.php?t=15217 for details.

I have to get this cracked as I want to restore my good any network ROM onto a network specific device.

Anyone got any other ideas?

[b0ris747]

Then the device just sits there with Cal Checksum on the screen. I get no response from NTTY or device until I restart.


The checksum calculation is a long process, try to wait longer...

Anyway your SD should have been written... have you tried to read it?

EDIT: Does it show ******** or direct checksum calculation? (how long is the process)

[Matt4444]

I let it run for over an hour the first time but that was with a 1GB SD card and I understand that it would take longer with 1GB.

I haven't actually looked to see if there is anything on the card(s) as I just assumed it hadn't worked. Other threads say that the device gives you progress or at least some response from the MTTY to say it was done.

I have to shoot to a meeting but will try again when I get back...

[nixo79]

Just press ACTION+POWER+reset with stylus and hold this combinaison for a few seconds, you'll see a screen without backlight (so you must be under bright light to see it) going into bootloader mode.

Put your device on the cradle (which I suspect you had connected it to your PC)

using mtty, connect to your USB Port (or Serial port if serial cradle)

type "password BOOTLOADER" and use "h" as an help command.

Now you can dump a ROM from Bootloader

The command should be sth like "r2sd"

Read the manual of this command "h r2sd full" and use it to dump your ROM on the SDCard

Now you can dump the raw ROM image from SD Card Reader using ntrw.exe

EDIT: going to bootloader mode seem to hard reset your device, backup FIRST!

yes, nice but does not work in 69xx's bootloader. while executing d2s command the device loops on "Calculating checksum" point and nothing happens even after an hour of waiting .. :-(

[Matt4444]

That is the same problem I am having. I read on another thread that dmc874 (who seems to know what he is talking about) thought it was related to the device being locked. See http://mobilitytoday.com/forum/showthread.php?p=68783

I am now trying to research the locking to see if there is anything I can do to unlock it... anyone else got any ideas?

[nixo79]

Does anybody tried to upload a .NBA image through bootloader?

Someone to know the command for sending through bootloader to certain address locations?

[b0ris747]

What about pdocread or such tools?

Method to dump ROM from wizard using pdocread: http://www.spv-developers.com/forum/showthread.php?t=2888

[That Dude]

Does Anyone Know Where I Can Get A English Rom For My IPAQ hw6955 Whitch Is Currently In French Please Help..

[mafioso617]

Just press ACTION+POWER+reset with stylus and hold this combinaison for a few seconds, you'll see a screen without backlight (so you must be under bright light to see it) going into bootloader mode.

Put your device on the cradle (which I suspect you had connected it to your PC)

using mtty, connect to your USB Port (or Serial port if serial cradle)

type "password BOOTLOADER" and use "h" as an help command.

Now you can dump a ROM from Bootloader

The command should be sth like "r2sd"

Read the manual of this command "h r2sd full" and use it to dump your ROM on the SDCard

Now you can dump the raw ROM image from SD Card Reader using ntrw.exe

EDIT: going to bootloader mode seem to hard reset your device, backup FIRST!



..hey great info on how to get to bootloader,, i have a tmobile wing and need to get to the boot loader screen please tell me specifically wat i have to do.. also wat do u mean by action button???????

[b0ris747]

..hey great info on how to get to bootloader,, i have a tmobile wing and need to get to the boot loader screen please tell me specifically wat i have to do.. also wat do u mean by action button???????


Action button = push directional pad in no direction

Anyway it won't work...

Maybe a method based on this:
http://forum.xda-developers.com/showthread.php?p=1480853

I'm looking for a french dump!
I'm also looking for a crazy volunteer to test an english ROM (It probably won't update, but I'd like to see the resut and I've got no such device :( Magician, Beetles and Prophet only...)

[cadillak]

b0ris747....

My pda Hp 6915..normal english 1.21UK rom. hp sites german rom download. Hp6915 update error. error code display vG.30.

Hard reset end soft reset not fonksionert.

Help me.

Not: not english speak sory.

[CBR1000RR]

http://forum.xda-developers.com/showthread.php?t=309357

[funny.zhang]

good! Can it works for eten x500?

[cdguider]

Does anybody tried to upload a .NBA image through bootloader?

Someone to know the command for sending through bootloader to certain address locations?

This is information for the BEETLES, Should not be too different than the 6900, If anyone could backup a 6900 series radio, and upload it, alot of us would be grateful.

Source: http://blogs.unbolt.net/index.php/brinley/2007/07/31/ipaq_6515_dead_gsm_after_failed_firmware

Extract of my RadioROM
I extracted from start address of 60000000 with a length of 800000 what I think is my radio rom and this can be downloaded at
http://www.bold.net.au/~behave/radioROM.zip
I came up with this address from experimentation and addresses from other XDAs and extracted with the following command


USB>d2s 60000000 800000
SD:Waiting for card insert.........

CMD3 for SD, it's OK, ready to get RCA from response.

SD:Detected one card

SD:ready for transfer OK

pc->drive.total_lba=1EB400
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=CFAD
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=3D680000

SDCARDD2S+,cStoragePlatformType=FF

********************************
Store image to SD/MMC card successful.



Anything higher and the dump fails.


USB>d2s 60000000 800001
SD:Waiting for card insert.........

CMD3 for SD, it's OK, ready to get RCA from response.

SD:Detected one card

SD:ready for transfer OK

pc->drive.total_lba=1EB400
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=CFAD
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=3D680000

********************************Read radio flash is fail!



The size of the uncompressed ROM is around 1gig because I only have 1gig sd cards to dump the ROM on.

You will probably need a 1gig or larger SD card, dim92 tried writing to a smaller card and the IPAQ doesn’t recognize it but you are welcome to give it a try on smaller cards as most of the image are 0s anyway.

Once you have written the image on to an sd card (use any of the bigrom guides using ntrw), pop it into the IPAQ and enter boot loader mode (power + joystick + reset). It should show up with “Download Sections: 1 press power to start".

Press power button and it should show “Updating radio". Let it finish and if it completed with no errors, power up to see if the mobile phone works. If it still does not work, try running the beetles radio patch now. If this too does not work, try running the LATEST rom from HP.

Useful utilities
iPAQDisk
http://www.xs4all.nl/~itsme
HOWTO: Change serial number and model number for HP IPAQ 6515
HP IPAQ 6515 Bootloader password

Exploring HP IPAQ 6515e bootloader

[bramblyrose]

I dont know much, i know nothing indeeed, however i found somewhere a pack of files for the Wizard that were supposed to work for the sable, however they didnt, but there is this particular file, that when ran in the sable made appear a folder called "2" with an icon of a storage card and which rpely the contents of the root of the device (but for itself i mean no 2 folder inside the 2 folder lol)

I dont know if it is of some use but i definitevely want to perform a corporate install of windows in my sable and kill all that HP crap that comes in bundled

Hi buddy,thanks for your attachment.
But I gotta tell ya this doesn't work in hp6915,coz all the ROM in the internet do not have ExtRom.nbf,so nobody's device had flashed the Extended Rom in device...then the Unlock tool will not work in this.

Anyway,thank you :)

Brose

[mdelleman]

bumping this one.

[cdguider]

NO GSM FIX FOR SOME hw6500 / hw6900 Series

http://forum.xda-developers.com/show...=377495&page=6

POST #56