How to dump HTC Kaiser ROM

[pof]

To dump Kaiser's ROM use itsutils pdocread.exe (http://www.xs4all.nl/~itsme/projects/xda/tools.html) from itsme:

LIST NAND PARTITIONS

$ ./pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



DUMP THEM!

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw

[austinsnyc]

and then rebuilding? :)

[Frontline]

Hi, what's the best method (Vista) to upload the orginal HTC rom to a phone? What tool do i search for?

[jcespi2005]

To dump Kaiser's ROM use itsutils pdocread.exe (http://www.xs4all.nl/%7Eitsme/projects/xda/tools.html) from itsme:




Thanks for the guide to dump... manage to dump the spanish HTC WM6 ROM, and now i have two questions...

First is easy (i think), what is every partition of the dump? i suppose part03 is the imgfs, but can you give us more information about this?

Second one is do you think can be interesting uploading the dumped ROMs to the wiki (like in the hermes wiki)? If "yes" i can upload the spanish one.

Thanks again for your efforts.

[sparky77]

i have followed the links but only downloaded pdocread.cpp
Anyone got pdocread.exe direct link

[jcespi2005]

i have followed the links but only downloaded pdocread.cpp
Anyone got pdocread.exe direct link

You can download latest version here...


http://www.xs4all.nl/~itsme/projects/xda/tools.html

[sparky77]

Think i will leave it untill someone does a site like mrvanx
thanks the only thing i could download "pdocread.cpp". no idea were to go fron here, and don't understand the Wiki (i may leave it to the pro's)
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdocread.cpp

[ultimate]

Thanks a lot!!!


But when i run pdocread.exe an error mag:

"Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked."

I restarted my Kaiser, still the same error...

Anyone could help?

[ultimate]

Thanks a lot!!!


But when i run pdocread.exe an error mag:

"Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked."

I restarted my Kaiser, still the same error...

Anyone could help?

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

[ultimate]

ok now, I have the

3.12M (0x31f000) Part00
4.38M (0x380000) Part01
73.38M (0x4560000) Part02
129.88M (0x8660000) Part03

From my CHT Hong Kong version Kaiser, how can i flash it to my friend's WWE Kaiser?

[ultimate]

ok now, I have the

3.12M (0x31f000) Part00
4.38M (0x380000) Part01
73.38M (0x4560000) Part02
129.88M (0x8660000) Part03

From my CHT Hong Kong version Kaiser, how can i flash it to my friend's WWE Kaiser?

I've uploaded my CHT Chinese version ROM here:
http://www.sendspace.com/file/dc9abe

[Harsesis]

How do you put the .raw parts together to make a flashable image?

I want to upload t-mobile uk kaiser image.

[jcespi2005]

How do you put the .raw parts together to make a flashable image?

I want to upload t-mobile uk kaiser image.

For now there is no way to repack the dumpeds ROM, we need to wait and make more research, seems we are near to get the way to do.

You need NBH file and HardSPL (http://forum.xda-developers.com/showthread.php?t=334679)/KaiserCustomRUU (http://forum.xda-developers.com/showthread.php?t=334890) (thanks to Pof) to flash a Kaiser.

Regards.

[Deathace]

T-Mobile UK
210.13M (0xd220000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.50M (0x8780000) Part03

Raw files available online here (www.deathace.net/files/T-MobileUK_Kaiser130_1.56.110.4_Dump_ROM.rar) should anyone want them (62MB).

Russ

[Krypt]

Is it possible to use pdocwrite to write back the raw files to your own device?

[vfrvulcan]

T-Mobile UK
210.13M (0xd220000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.50M (0x8780000) Part03

Raw files available online here (www.deathace.net/files/T-MobileUK_Kaiser130_1.56.110.4_Dump_ROM.rar) should anyone want them (62MB).

Russ

Strange. On my T-Mob UK...
210.00M (0xd200000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.38M (0x8760000) Part03

Notice the slightly smaller Part03.
Same ROM, same dates. Wierd!

ROM: 1.56.110.4
Date: 01/09/07
Radio: 1.27.12.11
Protocol: 22.45.88.07H

[Harsesis]

Has anyone figured out how to put the rom back together?

I want to flash my device once I get my rom backed up. I've got the customised cab files for t-mobile uk.

can anyone help?

[RacerII]

Dumping my t-mobile NL rom right now.
210.38M (0xd260000) FLASHDR
3.13M (0x31f000) Part00
3.50M (0x380000) Part01
67.25M (0x4340000) Part02
136.50M (0x8880000) Part03
If anyone wants the raw files , please let me know.

[dan13l]

On my UK T-Mobile Vario III:

210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.63M (0x87a0000) Part03

Which is really odd...

Recap:

Deathace
210.13M (0xd220000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.50M (0x8780000) Part03

vfrvulcan
210.00M (0xd200000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.38M (0x8760000) Part03

All using T-Mobile Vario IIIs.

[dan13l]

First is easy (i think), what is every partition of the dump? i suppose part03 is the imgfs, but can you give us more information about this?

I'd quite like to know this as well - I'm assuming one of the sections is the SPL. It'd be nice to know which, so I can revert back to the factory SPL if needs be.

[jcespi2005]

I'd quite like to know this as well - I'm assuming one of the sections is the SPL. It'd be nice to know which, so I can revert back to the factory SPL if needs be.

I know Part02 is imgfs (where you can extract the files from the ROM and make packages. But don't know what are the others. Perhaps Part00 and/or Part01 are XIP, but i'm not sure.

Anyone know what are the Part00, Part01 and Part03?

[hellejoep]

Dumping my t-mobile NL rom right now.
210.38M (0xd260000) FLASHDR
3.13M (0x31f000) Part00
3.50M (0x380000) Part01
67.25M (0x4340000) Part02
136.50M (0x8880000) Part03
If anyone wants the raw files , please let me know.

I would like this one! Could you put it on Rapidshare?

[jcespi2005]

If someone is interested, here are the Spanish TyTN II ROM from HTC:

http://rapidshare.com/files/62058154/KaiserDumpedRomESN.rar

[bigdriver4u]

I know Part02 is imgfs (where you can extract the files from the ROM and make packages. But don't know what are the others. Perhaps Part00 and/or Part01 are XIP, but i'm not sure.

Anyone know what are the Part00, Part01 and Part03?

I'm a previous Heremes Black Rom user and could not wait to get this At&T crap off my newly puchased Tilt. I've spent a number of hours reading this and most post but can't get a feel if this is the best backout solution to flahsing back to your original carrier ROM? Can the newly created raw files be used to create a nbh file and flash back? Also, is the block size of 0x800 specific to the kaiser,"Tilt" or a value found to be most effective when reading data from the disk-on-chip? Does one of the images represent the extended ROM.? I can see that DSK1 is my SD card so hoping that one of the other images is the extd-ROM. Thanks in advanced for the information.

Oh and for documenation sake, here's my raw file info?
210.75M (0xd2c0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 125.00M (0x7d00000) Part03
1.89G (0x79280000) DSK1:
| 1.89G (0x79120e00) Part00
STRG handles:
handle e74bb3ee 1.89G (0x79120e00)
handle 0747dc1a125.00M (0x7d00000)
handle 2748b0e6 79.13M (0x4f20000)
handle 474b0fda 3.50M (0x380000)
handle c74b0eee 3.12M (0x31f000)
disk e74bb3ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0747dc1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2748b0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[RacerII]

as far as i know there is no ext rom on the kaiser

[youzii]

Thx POF,I had success dump the raw,
and rebuild it to OEM and SYS^_^

[Harsesis]

how did u rebuild?

[jcespi2005]

how did u rebuild?

He means that packages the dump folder into SYS and OEM folder to be used with bepe`s (or anyother) coock.

Don't know how to reconstruct a dumped rom for now.

[RacerII]

I would like this one! Could you put it on Rapidshare?

http://rapidshare.com/files/62329519/tmobnl_raw_dump.rar.html

[aaronwms]

I just successful dumped my ROM. But, the next question is how can I "restore" the dumped ROM to the Phone. Any one knows?

[scorpio16v]

Just some suggestions from a "Non-Kaiser"-user :D
There is a logfile from itsutils in the root-directory of your device called "itsutils.log".
Open it with a texteditor and you get further informations about the different parts.
Some hints for the ROM-reconstruction you can find here (http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoReconstruct).
Maybe the way to reconstruct a Kaiser ROM is similar.

[tadzio]

Maybe the way to reconstruct a Kaiser ROM is similar.

Yes. That shouldn't be a problem really. I will release a new version of the ImgfsTools later today (check the "Want more storage" sticky in the Hermes forum) which can work with Kaiser ROMs.

Then all you have to do is rename part02.raw (which is the imgfs partition; part03 seems to be Storage) to imgfs.bin.

Run NBSplit, ImgfsFromNb on a Kaiser ROM as described in the ReadMe that comes with the ImgfsTools (or have a look at the included NBDumpKaiser.bat file).

Now, simply replace the imgfs.bin that came from the Kaiser ROM with the one you got as Part02.raw.

You now should be able to run ImgfsToDump and proceed normally with building a ROM.

This procedure will replace only the imgfs partition. However, the XIP part is language independent, so this should be sufficient to change the language of your Kaiser.

As I heard, the Kaiser does not have an Extended ROM, so that should be all you need to do.

Disclaimer: I don't own a Kaiser, so I have not tested this myself.

Hope that helps!

tadzio

[RacerII]

Hang on , so if i get this right i can use my t-mobile dutch raw dump to reconstruct so it can be flashed right?

If so could you or anyone please explain what steps i exactly should take just to be sure.
I allready dumped the rom on my device.

I only want to do this so i can create a backup rom for me and other t-mobile nl users so if they need to send their phone back for warranty reasons they can flash the original rom back.

[jcespi2005]

Yes. That shouldn't be a problem really. I will release a new version of the ImgfsTools later today (check the "Want more storage" sticky in the Hermes forum) which can work with Kaiser ROMs.

Then all you have to do is rename part02.raw (which is the imgfs partition; part03 seems to be Storage) to imgfs.bin.

Run NBSplit, ImgfsFromNb on a Kaiser ROM as described in the ReadMe that comes with the ImgfsTools (or have a look at the included NBDumpKaiser.bat file).

Now, simply replace the imgfs.bin that came from the Kaiser ROM with the one you got as Part02.raw.

You now should be able to run ImgfsToDump and proceed normally with building a ROM.

This procedure will replace only the imgfs partition. However, the XIP part is language independent, so this should be sufficient to change the language of your Kaiser.

As I heard, the Kaiser does not have an Extended ROM, so that should be all you need to do.

Disclaimer: I don't own a Kaiser, so I have not tested this myself.

Hope that helps!

tadzio

Thanks for the guidelines, and for the new version. I'll try to reconstruct my spanish original ROM whan i come back home later today :)

Cheers.

[tadzio]

Hang on , so if i get this right i can use my t-mobile dutch raw dump to reconstruct so it can be flashed right?

If so could you or anyone please explain what steps i exactly should take just to be sure.
I allready dumped the rom on my device.

I only want to do this so i can create a backup rom for me and other t-mobile nl users so if they need to send their phone back for warranty reasons they can flash the original rom back.

It will not be exactly the same ROM. You will have the XIP part of the "donor" ROM (language independent), plus the dutch Imgfs partition (basically, the Windows folder).

The procedure has not yet been tried in reality. But the steps are described in the ImgfsTools documentation (also look at the NBDumpKaiser and NBBuildKaiser batch files) and in my post above.

Cheers
tadzio

[RacerII]

Sorry to ask this question , what exactly is the XIP?

If i get this right , if i use this method i will have an english rom (kaiser xip) and a dutch imgfs?

So it wont really be of any use then?

[tadzio]

Sorry to ask this question , what exactly is the XIP?

If i get this right , if i use this method i will have an english rom (kaiser xip) and a dutch imgfs?

So it wont really be of any use then?

XIP refers (technically not 100% correctly) to the core part of Windows Mobile.

It is not english. It is language independent, i.e. it does not contain any text or other language- or country-specific parts.

If you put in your dutch imgfs.bin, you will have a completely dutch Windows.

Make sure you have HardSPL installed before you flash anything.

Cheers
tadzio

[RacerII]

XIP refers (technically not 100% correctly) to the core part of Windows Mobile.

It is not english. It is language independent, i.e. it does not contain any text or other language- or country-specific parts.

If you put in your dutch imgfs.bin, you will have a completely dutch Windows.

Make sure you have HardSPL installed before you flash anything.

Cheers
tadzio

Thanks for your explanation , so in my case this still cant be used as backup.
Because the t-mobile rom uses an older ce build right?

Thanks for answering my quiestions btw , im new to using these tools and trying to understand what it exactly does.

Edit: thanks about the hard-spl warning , i wont even dare to try it without it.
Rom flashing is no problem , i think i tried all the wm6 roms there where released for the trinity.

[mordof]

can i add to dump folder cab file + to the config_PT.txt
will that work (the new cab) on HR after redump?
thanks

sorry my device is kaizer

[tadzio]

Because the t-mobile rom uses an older ce build right?


I have no idea. But if it does, then yes, that procedure won't fulfill your needs.

Cheers
tadzio

[jcespi2005]

Thanks to tadzio and his great tools, i manage to make BigStorage unmodiffied ROM from dumped spanish 1.56 ROM, taking dumped folder from Part02.raw of my spanish Kaiser (http://forum.xda-developers.com/showpost.php?p=1579890&postcount=23) as the source for making the ROM.

I can't test it for now, so i need someone that can flash this ROM and advice if works. Of course you need HardSPL (http://forum.xda-developers.com/showthread.php?t=334679) before doing this.

If this ROM works after flash, then the reconstruct process from dumped ROM is an easy way, an i make a little guide on how to do it.

Someone?

An advice: if you'r going to try this (what i thank you), make sure you have one valid ROM to flash and HardSPL in case that don't boot.

Here is the link DELETED

Regards.

EDIT: The ROM don't boot. I'll try to repack without BS to see if works.

[christonge]

Thanks to tadzio and his great tools, i manage to make BigStorage unmodiffied ROM from dumped spanish 1.56 ROM, taking dumped folder from Part02.raw of my spanish Kaiser (http://forum.xda-developers.com/showpost.php?p=1579890&postcount=23) as the source for making the ROM.

I can't test it for now, so i need someone that can flash this ROM and advice if works. Of course you need HardSPL (http://forum.xda-developers.com/showthread.php?t=334679) before doing this.

If this ROM works after flash, then the reconstruct process from dumped ROM is an easy way, an i make a little guide on how to do it.

Someone?

An advice: if you'r going to try this (what i thank you), make sure you have one valid ROM to flash and HardSPL in case that don't boot.

Here is the link http://rapidshare.com/files/62680710/ReconstructedKaiser1.56.412.4.ESN.BigStorage.rar

Regards.


Downloading as I write...;)

[tadzio]

EDIT: The ROM don't boot. I'll try to repack without BS to see if works.

:-(

Seems I will need to look again at my code. Very strange.

Cheers
tadzio

[jcespi2005]

:-(

Seems I will need to look again at my code. Very strange.

Cheers
tadzio

Well, the nonBigStorage one works fine (thanks to christonge (http://forum.xda-developers.com/member.php?u=381531) to test it for me), so thanks to see the issue. I follow the recomendations about .extra and let the tool to create instead of use the one for the original windows.nb (can be this the origin of the issue?).

I'll try to do the process again, but starting with the part02.raw renamed to imgfs.bin without dumping the content, to see if the dump process are related.

I'll post the spanish reconstructed rom in new thread later with a little guide on how to reconstruct a dumped ROM.

Thanks for your support.

Cheers.

EDIT: How to reconstruct dumped ROM thread here (http://forum.xda-developers.com/showthread.php?t=337066)

[rvdgeer]

I guess jcespi2005 forgot to mention you should take a look in this thread:
http://forum.xda-developers.com/showthread.php?p=1587004

He made a tutorial for (re)constructing ROMs with links to all need programs...

Edit: I just saw he did edit his post...

[tadzio]

:-(

Seems I will need to look again at my code. Very strange.

Cheers
tadzio

Okay, I think I know now what went wrong. I will release a corrected version of the ImgfsTools shortly.

As a quick work-around, make sure you do the following:

- if you allow NBMerge to find the .nb.extra file, you must use -conservative or -bigstorage

- if you allow NBMerge to internally generate the extra data, you must use -move or -bigstoragemove (yes, these were undocumented, but they do exist :-))

There were two other minor problems, so this might still not work - although I think it will.

Cheers
tadzio

[jcespi2005]

Okay, I think I know now what went wrong. I will release a corrected version of the ImgfsTools shortly.

As a quick work-around, make sure you do the following:

- if you allow NBMerge to find the .nb.extra file, you must use -conservative or -bigstorage

- if you allow NBMerge to internally generate the extra data, you must use -move or -bigstoragemove (yes, these were undocumented, but they do exist :-))

There were two other minor problems, so this might still not work - although I think it will.

Cheers
tadzio

Great ;)

Thanks...

[qooqoo]

THX everyone here.

now i can dump kaiser's imgfs with tadzio's new imgfs tools, but how could i dump kaiser rom's xip?
i try to dump helmi_c's rom's xip with RomMaster.exe and dumprom.exe, like this:

nbsplit -kaiser os.nb
rename OS.nb.payload nk.nba
RomMaster -w 5 nk.nba -x -o xip.bin >NUL
dumprom xip.bin -5 -d XIP >NUL

but i got nothing in xip folder. but i did get correct xip with this tool in hermes's rom. can anyone help me please,
thanks again~

[jcespi2005]

THX everyone here.

now i can dump kaiser's imgfs with tadzio's new imgfs tools, but how could i dump kaiser rom's xip?
i try to dump helmi_c's rom's xip with RomMaster.exe and dumprom.exe, like this:

nbsplit -kaiser os.nb
rename OS.nb.payload nk.nba
RomMaster -w 5 nk.nba -x -o xip.bin >NUL
dumprom xip.bin -5 -d XIP >NUL

but i got nothing in xip folder. but i did get correct xip with this tool in hermes's rom. can anyone help me please,
thanks again~

Perhaps this thread helps you

http://forum.xda-developers.com/showthread.php?t=313737

Cheers.

[qooqoo]

Perhaps this thread helps you

http://forum.xda-developers.com/showthread.php?t=313737

Cheers.

THX man, i've tried that tools, it has the same effort with tadzio's new imgfs tools, and can dump out imgfs, but still nothing in XIP folder, who know this problem~:confused:

[qooqoo]

THX everyone here.

now i can dump kaiser's imgfs with tadzio's new imgfs tools, but how could i dump kaiser rom's xip?
i try to dump helmi_c's rom's xip with RomMaster.exe and dumprom.exe, like this:

nbsplit -kaiser os.nb
rename OS.nb.payload nk.nba
RomMaster -w 5 nk.nba -x -o xip.bin >NUL
dumprom xip.bin -5 -d XIP >NUL

but i got nothing in xip folder. but i did get correct xip with this tool in hermes's rom. can anyone help me please,
thanks again~

can anyone help me please~??~:confused:

[Rcon942]

To dump Kaiser's ROM use itsutils pdocread.exe (http://www.xs4all.nl/~itsme/projects/xda/tools.html) from itsme:

LIST NAND PARTITIONS

$ ./pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



DUMP THEM!

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw


Was hoping to get a bit of help on dumping my HTC Kaiser ROM. I've followed thes instructions to a T. Part 00 & 01 work perfectly & produce the .raw files. The problem occurs when I try to dump the remainder of the files [part02 & part03]. In the Dos command line I get the following error message:

ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid

Despite the error message, a .raw file is generated for both the part02 & part03. Windows Explorer shows the 2 files as being 70,144kb & 47,872kb respectively.

Any help would be greatly appreciated.

Thanks in advance,
Paul

[tadzio]

Was hoping to get a bit of help on dumping my HTC Kaiser ROM. I've followed thes instructions to a T. Part 00 & 01 work perfectly & produce the .raw files. The problem occurs when I try to dump the remainder of the files [part02 & part03]. In the Dos command line I get the following error message:

ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid

Despite the error message, a .raw file is generated for both the part02 & part03. Windows Explorer shows the 2 files as being 70,144kb & 47,872kb respectively.

Any help would be greatly appreciated.

Thanks in advance,
Paul

I do not have a Kaiser, so I can't say anything definite. Just a few ideas:

- did pdocread -l give you the same numbers as in pof's post? If not, which numbers did you use to dump, pof's or the ones from your call to pdocread -l?

- did you actually have a look into part02 and part03 - maybe they are usable and contain the data you expected? If ImgfsToDump works on part02.raw, then obviously it was a valid imgfs file.

Cheers
tadzio

[Rcon942]

I do not have a Kaiser, so I can't say anything definite. Just a few ideas:

- did pdocread -l give you the same numbers as in pof's post? If not, which numbers did you use to dump, pof's or the ones from your call to pdocread -l?

- did you actually have a look into part02 and part03 - maybe they are usable and contain the data you expected? If ImgfsToDump works on part02.raw, then obviously it was a valid imgfs file.

Cheers
tadzio

Wow, that was exactly it! Thanks Tadzio!

[r0guenj]

i just want to get some feedback before i go and screw something up......lol.

C:\temp>pdocread -l
210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 124.50M (0x7c80000) Part03
STRG handles:
handle c7481c1a124.50M (0x7c80000)
handle 2748f0e6 79.13M (0x4f20000)
handle 274b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk c7481c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2748f0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 274b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

C:\temp>pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)

C:\temp>pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
CopyTFFSToFile(0x0, 0x380000, Part01.raw)

C:\temp>pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4f20000 Part02.raw
CopyTFFSToFile(0x0, 0x4f20000, Part02.raw)

C:\temp>pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x7c80000 Part03.raw
CopyTFFSToFile(0x0, 0x7c80000, Part03.raw)

dumped raw files:

C:\temp>dir *.raw
Volume in drive C has no label.
Volume Serial Number is D471-4416

Directory of C:\temp

10/21/2007 03:37 AM 3,272,704 Part00.raw
10/21/2007 03:38 AM 3,670,016 Part01.raw
10/21/2007 03:45 AM 82,968,576 Part02.raw
10/21/2007 03:57 AM 130,547,712 Part03.raw
4 File(s) 220,459,008 bytes
0 Dir(s) 63,388,418,048 bytes free

C:\temp>

[Harsesis]

You did it right :)

Now onto reconstructing the rom so its fashable!

[CyberSpeedy]

As Pdocread READS the Memory-on-chip, isn't it possible to Write the raw-files just by using pdocwrite?
Or doens't this work,because if this works, I know for sure there is a way to return to my dutch Tytn2 OEM rom if something fails will flashing an wwe cooked version

[buaty]

Thanx For All.

I Will Test It Tomorrow Morning When The Phone Full Charged.

[CyberSpeedy]

As Pdocread READS the Memory-on-chip, isn't it possible to Write the raw-files just by using pdocwrite?
Or doens't this work,because if this works, I know for sure there is a way to return to my dutch Tytn2 OEM rom if something fails will flashing an wwe cooked version

Bounce, because no one is answering ;)

[eddythepeddy]

Sorry, am a newby at this... Will thisROM dump only contain the original base ROM, or also the appz and settings I made since a first started to use the device?

Cheers,
Edward

[sparky77]

Were is my (0x00000) i have followed your cmd and mine is not the same

C:\itsutils>pdocread -l
210.38M FLASHDR
| 3.12M Part00
| 3.50M Part01
| 68.00M Part02
| 135.75M Part03
1.87G DSK1:
| 1.87G Part00
STRG handles: c6efbb32
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.87G) a746fc3e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(135.75M) 0747d10a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 68.00M) 4747d0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
any help please ps "Os Vista"

[thickycat]

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

But where can I find a registry editor that will let me do this? The one I've tried ("Mobile Registry Editor") says "Access Denied"...

[kroton]

As Pdocread READS the Memory-on-chip, isn't it possible to Write the raw-files just by using pdocwrite?
Or doens't this work,because if this works, I know for sure there is a way to return to my dutch Tytn2 OEM rom if something fails will flashing an wwe cooked version

Bounce, because no one is answering ;)

What's the correct answer?
Regards

[udK]

But where can I find a registry editor that will let me do this? The one I've tried ("Mobile Registry Editor") says "Access Denied"...

Try Resco Explorer (Registry Add-in) ;)

[ra303]

hey guys , been lurking here and doing the RTFMs and wikis and finally decided to dump the rom on my Aussie 3 based kaiser and when I ran pdocread.exe -l , I got different values for part 02 , is this normal ?



C:\Tytn\itsutil>pdocread.exe -l
210.50M (0xd280000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.38M (0x4460000) Part02
| 135.50M (0x8780000) Part03
968.75M (0x3c8c0000) DSK1:
| 968.72M (0x3c8b8e00) Part00
STRG handles:
handle 874bb3a6968.72M (0x3c8b8e00)
handle 27463c4e135.50M (0x8780000)
handle 2747111a 68.38M (0x4460000)
handle c74710f6 3.50M (0x380000)
handle 874b0f1e 3.12M (0x31f000)
disk 874bb3a6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 27463c4e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2747111a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74710f6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874b0f1e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[sparky77]

how do i get the display (0x31f000)

pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03


i put in the same code and get

pdocread.exe -l
210.38M FLASHDR
| 3.12M Part00
| 3.50M Part01
| 69.38M Part02
| 134.38M Part03

does anyone know, as i would like a backup of my rom

Plus the direct link to pdocread.exe as you can see it's pdocread.cpp

http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdocread.cpp

im sure there's somone out there know the answers to my question

[jcespi2005]

how do i get the display (0x31f000)

pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03


i put in the same code and get

pdocread.exe -l
210.38M FLASHDR
| 3.12M Part00
| 3.50M Part01
| 69.38M Part02
| 134.38M Part03

does anyone know, as i would like a backup of my rom

Plus the direct link to pdocread.exe as you can see it's pdocread.cpp

http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdocread.cpp (http://nah6.com/%7Eitsme/cvs-xdadevtools/itsutils/src/pdocread.cpp)

im sure there's somone out there know the answers to my question

Download the last version here http://nah6.com/~itsme/itsutilsbin-20070705.zip and try again (don't forget to update the DLL into \windows PDA folder).

Anyway, if you have the last version, the address you post are the same, so you can use to extract the ROM.

[thickycat]

Anyway, if you have the last version, the address you post are the same, so you can use to extract the ROM.

It's probably the case but isn't the granularity of the '69.38M' too great to be sure that the numbers actually mean the same? I don't know the block size but 0x4560000 gives 69.38M but so would anything up to 45628F7.

You're probably right, but I hate assuming...!

[jcespi2005]

It's probably the case but isn't the granularity of the '69.38M' too great to be sure that the numbers actually mean the same? I don't know the block size but 0x4560000 gives 69.38M but so would anything up to 45628F7.

You're probably right, but I hate assuming...!

No problem, the correct size is given by a size 0x4560000 and the block size (800 for Kaiser). So in a Kaiser every time you see 69,38M, this is caused by the 0x4560000. My Kaiser is
210.50M (0xd280000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.00M (0x4500000) Part02
| 134.88M (0x86e0000) Part03
5.69G (0x16c680000) DSK1:
| 5.69G (0x16c280000) Part00
STRG handles:
handle c74bb3ca 5.69G (0x16c280000)
handle a746ac4e134.88M (0x86e0000)
handle c747810a 69.00M (0x4500000)
handle 874780e6 3.50M (0x380000)
handle 474b0f0e 3.12M (0x31f000)

Did you try the last version?

[bokingwen]

nevermind i was stupid.....

[sonny-67]

Stuck at the first hurdle, I'm afraid :confused:

From where do I run the commands - the Kaiser or PC?

e.g $ ./pdocread.exe -l

Thanks

[sonny-67]

Ok - I guessed that it's run from a command prompt on the PC.

However I also get the message:-

"Could not update itsutils.dll to the current version, maybe it's inuse? try restarting your device, or restart activesync or maybe your device is application-locked".

I've seen the registry edit fix for this, but is there anyway around it without having to edit the registry. Does everyone have to edit the registry before running pdocread? If so, then shouldn't this sticky mention that upfront?

Cheers.

[louiscar]

I'm not having any joy with this at all for some reason.

When I run pdocreate.exe -l it copied itsutils.dll to the wce \windows folder.

That's it. When I try to run it again it just says:

"Could not update itsutils.dll to the current version, maybe it's in use? Try restarting your device, or restart activesync or maybe your device is spplication - locked"

If I delete the file it gives me the same message but the file does re-appear ok, but I'm not getting the list as I should.

Obviously the message I'm getting is eronious as the file does get copied.

Can anyone enlighten me as to what might be the problem here?

[jcespi2005]

I'm not having any joy with this at all for some reason.

When I run pdocreate.exe -l it copied itsutils.dll to the wce \windows folder.

That's it. When I try to run it again it just says:

"Could not update itsutils.dll to the current version, maybe it's in use? Try restarting your device, or restart activesync or maybe your device is spplication - locked"

If I delete the file it gives me the same message but the file does re-appear ok, but I'm not getting the list as I should.

Obviously the message I'm getting is eronious as the file does get copied.

Can anyone enlighten me as to what might be the problem here?

If you read the whole thread you'll find the next post...

http://forum.xda-developers.com/showpost.php?p=1565513&postcount=9

with the solution for your problem...

[louiscar]

Thanks, I just found the fix by going through the thread again. I've got the list now. I should have read the whole thread :o

Now I can see if my T-Mobile matches others and will upload if not.

[louiscar]

On my UK T-Mobile Vario III:

210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.63M (0x87a0000) Part03

Which is really odd...

Recap:

Deathace
210.13M (0xd220000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.50M (0x8780000) Part03

vfrvulcan
210.00M (0xd200000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.38M (0x8760000) Part03

All using T-Mobile Vario IIIs.

... and my T-Mobile Vario III (UK)

210.50M (0xd280000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.88M (0x87e0000) Part03
483.88M (0x1e3e0000) DSK1:
| 483.70M (0x1e3b4600) Part00
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle e6acb092 19.00k (0x4c00)
handle a74bb3a6483.70M (0x1e3b4600)
handle 67480c1a135.88M (0x87e0000)
handle 6748e0e6 68.00M (0x4400000)
handle 474b0fda 3.50M (0x380000)
handle c74b0eee 3.12M (0x31f000)
disk e6acb092
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a74bb3a6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 67480c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6748e0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[Choc0Lat]

To dump Kaiser's ROM use itsutils pdocread.exe (http://www.xs4all.nl/~itsme/projects/xda/tools.html) from itsme:

LIST NAND PARTITIONS

$ ./pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



DUMP THEM!

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw


Hi,
First time I am dumping roms and I got the following which differs from yours

209.75M (0xd1c0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 67.75M (0x43c0000) Part02
| 135.38M (0x8760000) Part03
968.75M (0x3c8c0000) DSK1:
| 968.50M (0x3c880e00) Part00
20.00k (0x5000) BTD1:
| 19.00K (0X4c00) PART00
STRG handles:
handle 85dd8d7e 19.00k (0x4c00)
handle 274bb3ee 968.50M (0x3c880e00)
handle c7472c3e 135.38M (0x8760000)
handle 8748010a 67.75M (0x43c0000)
handle 074800e6 3.50M (0x380000)
handle e74b0f0e 3.12M (0x31f000)
disk 85dd8d7e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 274bb3ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c7472c3e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8748010a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074800e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74b0f0e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

I am using ROM 1.81.707.0 WWE

How to I actually dump the rom.

When I use the dump command provided:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
I got this reply:
HexdumpTFFSToStdout(0x31f000, 0x0)

Anything I have did wrongly? Appreciated if you can guide me. Thanks.

[louiscar]

I'm also having some problems dumping part3. Part2 took a couple of tries but finally got it. Part3 dips out or hangs up. At first try it just hung till I aborted to see what bytes were saved (seems to randomly stop).

After a failure then subsequent tries will kill activesync at some point fairly early in the process. A reboot will start the process off again, first try usually being a hang or halt (not message, just inactivity till I abort) saving anything between 700k to 2M.

According to the list:

210.50M (0xd280000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.00M (0x4400000) Part02
| 135.88M (0x87e0000) Part03

I should run:

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4400000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x87e0000 Part03.raw

As part 3 is the area where each version seems to differ I'm wondering if I've got something wrong. Any ideas?

[jcespi2005]

I'm also having some problems dumping part3. Part2 took a couple of tries but finally got it. Part3 dips out or hangs up. At first try it just hung till I aborted to see what bytes were saved (seems to randomly stop).




Don't worry about part03.raw. This is the storage area, so you don't need it. Part01 is the XIP and part02 is the IMGFS. This are the most important.

Cheers.

[jcespi2005]

Hi,

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
I got this reply:
HexdumpTFFSToStdout(0x31f000, 0x0)

Anything I have did wrongly? Appreciated if you can guide me. Thanks.


Seems all goes ok. Every ROM can have different sizes and different values for dumping, so don't care about this.

Take a look and see if part00.raw is on the folder where you try the command.

Cheers.

[louiscar]

Don't worry about part03.raw. This is the storage area, so you don't need it. Part01 is the XIP and part02 is the IMGFS. This are the most important.

Cheers.

Ok that's good to know jcespi. Is there a way to know that (once re-constructed) the file is valid or is the only way to find out is flash it?

I only worry about Part2 as it took a couple of tries to dump but I did get the correct size and activesync dropped the connection only after part3 started. It's exactly 68M so I should think it's good.

[umirza85]

when i dump the rom off of my kaiser do i need to hard reset the device before i dump it to get a clean image file?

[jcespi2005]

when i dump the rom off of my kaiser do i need to hard reset the device before i dump it to get a clean image file?

The ROM you dump is ReadOnly on the device, so every time you dump, is the same content ;) You don't need to HardReset before to do the dump.

Cheers.

[umirza85]

The ROM you dump is ReadOnly on the device, so every time you dump, is the same content ;) You don't need to HardReset before to do the dump.

Cheers.

perfect reply, thanks jcespi.

[Larajaja]

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

first ==> sorry for my english :(

i dont have on HLKM\Security this repertory \Policies\Policies

i have XP Pro

thank's

[Neonightmare]

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

I have the same problem, but I can't change the value from 2 to 1.

How did you do it?


thx Neo


Win XP, tried with MobileRegistryEditor...

[jcespi2005]

I have the same problem, but I can't change the value from 2 to 1.

How did you do it?


thx Neo


Win XP, tried with MobileRegistryEditor...

Try the one attaced, works for me.... freeware...

[Neonightmare]

Try the one attaced, works for me.... freeware...

Big THX, now it works, i' ll try to dump my german/swisscom ROM....

thx Neo

[hollywood]

Where do the dump files end up on your computer? This is the first time I have dumped a rom. Everything went through right but I cannot find the dumped files. Where are they saved? Thanks

[hollywood]

Nevermind I figured it out.

[autosoori]

I get and extra line while trying to use the -l option and I dont know what that is (in bold below). I have the AT&T Tilt, bought just a week ago.
Does anyne know if that is an extra thing that I have to dump?


C:\DR>pdocread.exe -l
210.88M (0xd2e0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 125.13M (0x7d20000) Part03
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle 45de53fe 19.00k (0x4c00)
handle 4746dc3e125.13M (0x7d20000)
handle 2747a10a 79.13M (0x4f20000)
handle 0747a0e6 3.50M (0x380000)
handle 474b0f0e 3.12M (0x31f000)

[autosoori]

I get and extra line while trying to use the -l option and I dont know what that is (in bold below). I have the AT&T Tilt, bought just a week ago.
Does anyne know if that is an extra thing that I have to dump?


C:\DR>pdocread.exe -l
210.88M (0xd2e0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 125.13M (0x7d20000) Part03
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle 45de53fe 19.00k (0x4c00)
handle 4746dc3e125.13M (0x7d20000)
handle 2747a10a 79.13M (0x4f20000)
handle 0747a0e6 3.50M (0x380000)
handle 474b0f0e 3.12M (0x31f000)

[radicool]

20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00


I thought that the BTD referred to the Bluetooth "storage" option, but it was still there even when I disabled Bluetooth.

I noticed there were even more storage options listed until I removed my SD card. I don't think you need to worry about them.

[Martie]

Hello, my new device is a.... Kaiser 120 :)

To completeness this thread...

...a german t-mobile ROM (MDA Vario III)



210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 68.63M (0x44a0000) Part02
| 135.13M (0x8720000) Part03



and now the recunstruktion.... puuhhhh...

[Martinhdk]

Hellou

Have dumped the DANISH rom for TYTNII.

PM if needed..

:)

210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 67.63M (0x43a0000) Part02
| 136.00M (0x8800000) Part03
STRG handles:
handle 87488c1a136.00M (0x8800000)
handle 074960e6 67.63M (0x43a0000)
handle c74b0fda 3.50M (0x380000)
handle 474b0eee 3.12M (0x31f000)
disk 87488c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[nEuDy]

Hi @ll..

i think, i need your help :o

I have bought a new HTC TyTN II German Version last Friday.

Now, before i will try things like upgrading cooked roms and install many programs to try, i wanted to dump the "first" rom..

But when i use the itutils i get these message:

Copying C:\itsutilsbin-20070705\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.

Have i to HardSPL first?

need Help please

thanxx


[EDIT]

OK.. Sorry.. i found it out.. was my mistake.
in the Regestry there was on HKLM/../Policies/Polisies the value of "0001001" was "2".. i changed it to "1".. now it works ;-)

here is my output:

210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 71.50M (0x4780000) Part02
| 132.13M (0x8420000) Part03
1.89G (0x79280000) DSK1:
| 1.89G (0x79260e00) Part00
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle 45c35a82 19.00k (0x4c00)
handle c74bb3a6 1.89G (0x79260e00)
handle 0747dc1a132.13M (0x8420000)
handle 2748a0e6 71.50M (0x4780000)
handle 474b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk 45c35a82
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74bb3a6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0747dc1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2748a0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[nogs]

I have a fairly up to date Kaiser Orange UK ROM Dump

Operator Version : 24.181.1.612
Rom Version : 1.81.61.2 WWE
Rom Date : 09/20/07


PM me if needed.

Nogs

[jychan28]

:confused: There are a few things going on about working with the ROM that I got confused.

1. Dump ROM, then reconstruct ROM and flash back to the machine. I think this is a different way of doing a backup.:confused:

Question: Are all the user data included in the dump during the dump? Would the data be reflashed back to the machine in proper location? (I don't think so). I think just keep the RUU.. ROM file and SpriteBackup would be a perfect backup solution, why need to dump ROM in this case?

2. Now, after going this dump procedure, I got all these folders and files in the dump directory (hundreds of them). What do I do with them? In other words, how do I edit them? Can add couple .exe files into directory that is about it. How do you, for example, change the display from English to Chinese, or added an IME program or add the .cab file equivalent to it?

3. In using ROM kitchen to cook, is there any tool which can convert a .cab to an OEM package folder? I saw a thread how to make an OEM package, is there other simplier way?

My confusion is between 2 & 3. If functions or programs can be added with 2 (dump & re-construct ROM), why we need the kitchen. On the other hand, if the kitchen is use to add or subtract functions or programs, why we need to go through all the trouble of dumping and reconstructing ROM?

It seems to me that a good cook does not need to be also a farmer and a ranger to get all his ingredients.

Many thanks!

[dwaviation]

I don't have access to change my dword value... Permission denied:mad:

[gibs]

French Vodafone V1615:

210.25M (0xd240000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 66.00M (0x4200000) Part02
| 137.63M (0x89a0000) Part03
1.89G (0x79280000) DSK1:
| 1.89G (0x79260e00) Part00
STRG handles:
handle 45c58f8e 1.89G (0x79260e00)
handle 27480c1a137.63M (0x89a0000)
handle a748e0e6 66.00M (0x4200000)
handle 274b0fda 3.50M (0x380000)
handle 874b0eee 3.12M (0x31f000)
disk 45c58f8e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 27480c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a748e0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 274b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[nEuDy]

I don't have access to change my dword value... Permission denied:mad:

Use TotalCommander to do this.. ;)

[Laurentius26]

Hi,

I have the following problem, when dumping part 3:

ERROR: ITReadDisk: Outbuf==NULL

'Host Device disconnected'

What can cause this?

Thanks,

Leo ;)

[Laurentius26]

Nobody can help me?

When I try to dump part 03.raw the device disconnects all the time :(
It's saying the software on my device has disconnected !!!
Sometimes at 17mb other times at 110mb but never dumps the complete partition!!!

Adresses and size are different too as first post in this thread!
I'm trying to dump a Dutch Orange ROM and will upload if I manage!

$ ./pdocread.exe -l
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.63M (0x45a0000) Part02

| 134.25M (0x8640000) Part03 (this one I can't dump)


Am I the only one in this?

[jacky312]

hi, i posted a thread asking on how to make a backup of the current rom i have which is the arabic version, and i was linked to this forum.

unfortunately, it is to complecated for me (Newbie), and i guess for several other newbies. is there a much more simpler way? or in other words, a more simpler way that takes every issue, step by step to backup everything, so that when i take it to the dealer, they would not know that i reflashed the device. thnx for the cooperation.

I would also like to share this rom for all of those people who would need it to use it for the warrenty.

Again, Thnx

[Leon.nr]

Hello,

my dumped ROM

Orange Slovakia WWE 1.81.68.3

210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 73.13M (0x4920000) Part02
| 130.63M (0x82a0000) Part03
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle c74bb3ca 19.00k (0x4c00)
handle 07488c1a130.63M (0x82a0000)
handle c74960e6 73.13M (0x4920000)
handle 274b0fda 3.50M (0x380000)
handle e74b0eee 3.12M (0x31f000)
disk c74bb3ca
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 07488c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 274b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

http://rapidshare.com/files/83339104/Tytn_II_ORANGE_SK_WWE_reconstructed.rar

[jcespi2005]

Hello,

my dumped ROM

Orange Slovakia WWE 1.81.68.3

http://rapidshare.com/files/83339104/Tytn_II_ORANGE_SK_WWE_reconstructed.rar


Nice :)

If you doesn't matter, i'll add a link in my thread about reconstructed ROMs for this one you make.

Cheers

[Powershot]

Hi,

I have the following problem, when dumping part 3:

ERROR: ITReadDisk: Outbuf==NULL

'Host Device disconnected'

What can cause this?

Thanks,

Leo ;)

Hi Guys,

i have the same problem when trying to dump my German Vodafone VPAcompact V. Is there any solution available?

Thanks and best regards!!

[stainlesspc]

Ok long time flasher first time dumper.
I read the whole thread, and must be missing something
First I do not speak programeze, so if I read the instructions I did not realize it.
1. Can I do this as my tilt is now, or does it have to be a fresh hard reset ?
2. do I just connect my phone and run pdocread.exe (finally found it :) )
3. or do I need to enter some special commands.

A nice step by step and requirments ie. fresh hard reset, hard-spl, ect.

Thanks :)

[Leon.nr]

Orange Slovakia WWE 1.81.68.3

http://rapidshare.com/files/83339104/Tytn_II_ORANGE_SK_WWE_reconstructed.rar

Might somebody try this ROM, please? I need know if is OK, so i can flash my Kaiser

[mindbeat]

Hi Guys,

i have the same problem when trying to dump my German Vodafone VPAcompact V. Is there any solution available?

Thanks and best regards!!

Same problem here. got any clue what the problem is? Try to dump from my At&t Tilt,

210.88M (0xd2e0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 125.13M (0x7d20000) Part03


CopyTFFSToFile(0x0, 0x7d20000, Part03.raw)
ERROR: ITReadDisk: outbuf==NULL
- An established connection was aborted by the software in your host machine.

Using Vista x64...

[jcespi2005]

Same problem here. got any clue what the problem is? Try to dump from my At&t Tilt,

210.88M (0xd2e0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 79.13M (0x4f20000) Part02
| 125.13M (0x7d20000) Part03


CopyTFFSToFile(0x0, 0x7d20000, Part03.raw)
ERROR: ITReadDisk: outbuf==NULL
- An established connection was aborted by the software in your host machine.

Using Vista x64...

Don't worry about part03.raw part, there is no needed to reconstruc the ROM.

If you have Part01 and PArt02, is enoght.

Cheers.

[stmasi]

At the end of the part02.raw dump, I get the following error message:

ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid.

However, I have ended with the following:

01/26/2008 10:23 3,272,704 Part00.raw
01/26/2008 10:26 3,670,016 Part01.raw
01/26/2008 10:32 72,351,744 Part02.raw
01/26/2008 10:49 140,902,400 Part03.raw
4 File(s) 220,196,864 bytes

Do these sizes seem correct?

Please advise.

EDIT...

Nevermind...got it working now just fine and dandy. Now all I have to do is figure out how to compile these files, make the changes I want, and flash it back to my phone.

Thanx.

[Johnston411]

I'm trying to dump a wm6.1 rom which i have cooked myself and added apps to to see if once reconstructed it is as was when dumped.

I'm having this problem:-


http://i153.photobucket.com/albums/s221/Johnston411/Itsutils1.jpg


I'm sure it's something simple but i'm a bit of a novice.

I'm using vista home premium.

[eroG]

Nobody can help me?

When I try to dump part 03.raw the device disconnects all the time :(
It's saying the software on my device has disconnected !!!
Sometimes at 17mb other times at 110mb but never dumps the complete partition!!!


| 134.25M (0x8640000) Part03 (this one I can't dump)


Am I the only one in this?



same issue here.

hope someone finds out why it stops everytime I try to dump it.


edit: after trying to dump Part3 several times in the end it has completed the procedure and now I have all the 4 files. my advice to anyone else who is encountering this problem is to keep trying until it works..

[ahmadashar]

I know this might be a stupid question, but do i need to HardSPL my phone b4 i dump the rom, i actually want to dump the original UK rom for Kaiser and just wana be safe then sorry.

[paty]

Done !
210.75M (0xd2c0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 73.88M (0x49e0000) Part02
| 129.38M (0x8160000) Part03
from Chinese Hong Kong TyTN II.
BTW, are those dumped ROM contain my personal data, e.g. contacts, notes, etc? Which part I need to pass to other to rebuild ROM?
thanks

[Jibreil]

This is the first time I'm gonna do this, so need some novice help here:
- Do I need to flash the original RUU ROM on my phone in order to extract the RAW dump?
- Once I flash the original ROM, I need to connect the phone and then run the command so that the RAW files can be extracted?

Thanks in advance

[Don_Zakaria]

Done! Dutch HTC Tytn II Hi (kpn) Rom version: 1.56.404.6

[hamada_2010]

can anyone tell me how to dump htc duall ???

because i have french rom and i want to update it to the enlish one

[ygeordy]

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

I have the same problem. How do I find this registry entry ? Please, could anyone help me. Thanks

And another thing, where can I find a HTC Touch cruise branded english ROM version. I searched (and I am stilll searching) the forum, but can not find it.

Thanks again.

[rumbotter]

hi guys... i m in dumping the rom.... actually i would like to know what for we dump part00.raw n part03.raw if we only need part01.raw and part02.raw for the rom reconstruction... sorry for my bad english... tq....

[lampacz]

Hello,

i've 2 days new MDA T-Mobile Vario III with R 1.27.12.32, G 22.45.88.07H, D 1.56.00.00 (prints when booting), D 1.56.113.4 (in control panel) rom date(09/01/2007 or 01/09/2007).

i tried make backup first, before flashing (none know...), but pdocread -w -n 0 -t ends with error (ERROR: ITTFFSGetInfo - ...)

pdocread -l

210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 72.25M (0x4840000) Part02
| 131.50M (0x8380000) Part03
3.75G (0xf0000000) DSK1:
| 3.75G (0xefc00000) Part00
20.00k (0x5000) BTD1:
| 19.00k (0x4c00) PART00
STRG handles:
handle 45a7f272 19.00k (0x4c00)
handle e74bb3a6 3.75G (0xefc00000)
handle c7477c3e131.50M (0x8380000)
handle 8748510a 72.25M (0x4840000)
handle e74850e6 3.50M (0x380000)
handle 674b0f0e 3.12M (0x31f000)
disk 45a7f272
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74bb3a6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c7477c3e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8748510a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74850e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 674b0f0e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

so i tried:
pdocread -w -d FLASHDR -b0x800 -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)

pdocread -w -d FLASHDR -b0x800 -p Part01 0 0x380000 Part01.raw
CopyTFFSToFile(0x0, 0x380000, Part01.raw)

pdocread -w -d FLASHDR -b0x800 -p Part02 0 0x4840000 Part02.raw
CopyTFFSToFile(0x0, 0x4840000, Part02.raw)

pdocread -w -d FLASHDR -b0x800 -p Part03 0 0x8380000 Part03.raw
CopyTFFSToFile(0x0, 0x8380000, Part03.raw)

in previous step i'm not sure with -b0x800 option

rom should be same as http://forum.xda-developers.com/showthread.php?t=347041 (but not sure)

result:

27.02.2008 21:28 3272704 Part00.raw
27.02.2008 21:29 3670016 Part01.raw
27.02.2008 21:35 75759616 Part02.raw
27.02.2008 21:47 137887744 Part03.raw


is there some way how to test if dump is OK, eg in warranty problem i can restore in easy way oreginal ROM ?

and is possible to lock CID again (to get completly initial state before flashing and unlocking) ?

thank you

[TheDovelKing]

OK, different issue.

I know Part03 isn't of great importance when reconstructing ... but.

When I dump Part03 twice and check it with WinDiff it is always different in many places. Are we sure that Part03 is actually pointing to a static ROM partition?

The other parts always verify correctly after multiple reads.
Could this explain why so many others are having such trouble getting part03? Since it changes all the time pdocread is detecting this and aborting?

Cheers,
Anthony

[stainlesspc]

Made it :)
Well I got it dumped last night
Dr.Jays video was great and filled in the small blanks I had as to how to proceed.
Now to figure our what is next :)

[GSLEON3]

OK, different issue.

I know Part03 isn't of great importance when reconstructing ... but.

When I dump Part03 twice and check it with WinDiff it is always different in many places. Are we sure that Part03 is actually pointing to a static ROM partition?

The other parts always verify correctly after multiple reads.
Could this explain why so many others are having such trouble getting part03? Since it changes all the time pdocread is detecting this and aborting?

Cheers,
Anthony

You should NOT be using the values in the first post as static values. Always execute the "pdocread -l" command as these locations can vary depending on what ROM is on your device.

For example. For Dutty's Hybrid WM6.1, the partitions ar:
0x31f000 Part00
0x380000 Part01
0x3fe0000 Part02
0x8be0000 Part03

And for Sleuth v3.0, the location is here:
0x31f000 Part00
0x3a0000 Part01
0x4380000 Part02
0x8840000 Part03

Always "pdocread -l" for location.

[myv6mustang]

Hey i need a bit of help. Just started learning to cook my own rom and i cooked it successfully. Now i want to dump the ROM on my device however when i run pdocread i get this error

C:\Kaiser~1\pdocred.exe
The NTVDM CPU has encountered an illegal instruction
CS:11b9 IP:02e7blah blah blaah..

I have windows vista home premium. I searched already and found issues like thisn when people tried to install without hardspl. I have hardspl on my kaiser and have flashed it several times before. Whats wiered is i get the same error even when i run the program without the Kaiser attached.

I have also tried turning off wireless and restarting device but still no joy. Thanks. Oh yeah i check the regs for my device and i already have the dword value set to 1. Thanks in advance.

[Tayton]

You are starting your CMD with the Run As Administrator option in Vista correct?
-------------
Hey i need a bit of help. Just started learning to cook my own rom and i cooked it successfully. Now i want to dump the ROM on my device however when i run pdocread i get this error

C:\Kaiser~1\pdocred.exe
The NTVDM CPU has encountered an illegal instruction
CS:11b9 IP:02e7blah blah blaah..

I have windows vista home premium. I searched already and found issues like thisn when people tried to install without hardspl. I have hardspl on my kaiser and have flashed it several times before. Whats wiered is i get the same error even when i run the program without the Kaiser attached.

I have also tried turning off wireless and restarting device but still no joy. Thanks. Oh yeah i check the regs for my device and i already have the dword value set to 1. Thanks in advance.

[myv6mustang]

yes. Ran as admin and normal user. Even tried running the program from command prompt when started as admin and still get the same error

[cassiano]

Hello there!

Can someone tell for sure if the procedures described in this thread work on smartphones (specially the HTC Excalibur/S621, aka T-Mo Dash) and/or in other PPCs (non-HTC also, i've got a Cyberbank POZ EVDO...)?

Thanks in advance!

Cheers.

[Vivendi]

Guys, need your help.

I'm trying do dump an original rom from my orange tytn, but receiving the known message in cmd

[I]"Copying C:\itsutils\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse? try restarting your device, or restart ActiveSync"

i found some very good tips on wiki- "Hermes_HowtoDumpRom", but i'm stucked on changing the HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1.

I cannot change this dword to 1, by default it 0. I was using regeditSTG.exe and MobileRegistryEditor and none of them cannot change the value. I have no idea how to use this prapi.exe tool. Please advice...

[Vivendi]

disregard my previous comment. I've resolved that problem.

Now i have another issue. After running pdocread -w -d FLASHDR -b0x800 -p Part00 0 0x31f000 Part00.raw i got the following message:

CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
ERROR: ITReadDisk : Read 00000000 bytes - The Parameter is incorrect.

The same story with other parts.

Any idea what is wrong???


Right before the described issue i had another issue. I didnt receive such error message, but after CopyTFFSToFile(0x0, 0x31f000, Part00.raw) i wasnt able to find any file in the defined directory on PC. It looks like files were not copied to my machine. Any thoughts?

[swatguard]

I just dumped my vodafone RO ROM from my Htc Touch Cruise, i got that nasty error on Part03.raw

(ERROR: ITReadDisk: outbuf==NULL
- An established connection was aborted by the software in your host machine.)

I understand from previous posts that it is not important for reconstructing the ROM.
Could anyone please, post a "step by step" tutorial for reconstructing the original ROM in case of "warranty needs" , for us...n00bs...

Thanks in advance

[mrpeartree]

does anyone try this PTG rom? is this the official HTC rom ou the TMN rom? thanks

[marksweb]

Copying C:\itsutilsbin\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.

i keep getting this message. how can i unlock my kaiser? i've tried restarts of the device and active-sync, but i've no idea how this applicatino locking works.

[Praetorian1]

Hello all...

I've done my best to trawl through the rest of this thread and the forum/wiki in general, but no one else seems to have had this problem...

I'm expecting to see my "Part*.raw" files in the working directory of pdocread.exe, but they are no-where to be seen... I've searched the host PC and my Kaiser, but to no avail!...

Everything seems to be working fine, as per the tutorial, but I just can't find the dump files!

Any help would be greatly appreciated.

TIA.

[sdlopez83]

Nevermind found solution

[sdlopez83]

Please Delete

[swazpurohit]

once you have dumped the 4 parts, can you also upload these parts back to the phone, so that it is like it used to be? thanks

[goye]

Opened the registry, both on XP and Vista and as a matter of fact, I couldn't find this key that you are stating.

Can you give an EXACT PATH to this key in the registry? Is there another way to do a dump of the ROM?

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1

[goye]

ok now

HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1


I also got this error. I ran regedit and tried to look for the key that you are stating here. Couldn't find it neither on XP nor on Vista. I'm sorry but, can you give a better definition of the path of this key. Thank you.

[XtreMe_G]

I also got this error. I ran regedit and tried to look for the key that you are stating here. Couldn't find it neither on XP nor on Vista. I'm sorry but, can you give a better definition of the path of this key. Thank you.

on the phone, not the pc

[goye]

on the phone, not the pc

I found it. I also found out that I needed a software called regeditstg to do this.

thanks

[denis costa]

Hi everyone!

I´d like to know what exact command to run pdocread.exe file on cmd?

There are many commands that i really don´t know if is necessary or not.:confused:

[gregslater84]

well I get an error saying:

"C:\Windows\system32\cmd.exe - pdocread -l
The NTVDM CPU has encountered an illegal instruction.
CS:0fc3 IP:02e7 OP:63 61 6e 20 62 Choose 'Close' to terminate the application."

:(

[gregslater84]

Hey i need a bit of help. Just started learning to cook my own rom and i cooked it successfully. Now i want to dump the ROM on my device however when i run pdocread i get this error

C:\Kaiser~1\pdocred.exe
The NTVDM CPU has encountered an illegal instruction
CS:11b9 IP:02e7blah blah blaah..

You're having the same problem as me, after some fishing around I found that it's a problem with the NTVDM and WOW (Windows On Windows) systems. It looks like it's one of two things:

1. A virus - run a deep virus scan.
2. One of the problems listed in this: http://support.microsoft.com/kb/q196453/

I started reading that support page and lost interest, so I'm doing a virus scan, I'll let you know of any meaningful results.

[gregslater84]

...sorted it (that was quick!)...

The file "pdocread.exe" I downloaded from the original link was only 14Kb. I've downloaded the zip in post 67 (thanks jcespi2005!), extracted pdocread.exe (now 140kb!) and itsutils.dll into the same folder and it worked boootiful!

Thanks again!

[raiisak]

Since several is looking for ansver on the: ERROR: ITReadDisk I made a semispam tread to lead to the ansver
You should NOT be using the values in the first post as static values. Always execute the "pdocread -l" command as these locations can vary depending on what ROM is on your device.

For example. For Dutty's Hybrid WM6.1, the partitions ar:
0x31f000 Part00
0x380000 Part01
0x3fe0000 Part02
0x8be0000 Part03

And for Sleuth v3.0, the location is here:
0x31f000 Part00
0x3a0000 Part01
0x4380000 Part02
0x8840000 Part03

Always "pdocread -l" for location.

This means you NEED TO USE YOURE OWN VALUES, ie. on my kaiser i had to use 0x43e000 instead of 0x4560000 as shown as an example in the wery first post. Hope this could help.

+ If you cant get contact to the device use PHM Regedit: http://www.phm.lu/Products/Smartphone/RegEdit/
(use the pocketpc 2002,2003 (ARM/PXA) if the active sync file doesnt work for you, this is the cab and defently work on kaiser)

Then goto HKLM (HKEY_LOCAL_MACHINE) -> Security -> Policies (NOT Policy) -> then edit: 00001001 (should be the secound or something) and change the value data from 2 to 1. Make a soft reset and you are good to goo :cool:

[andyzhp]

Does any body tell me how to use this software?
I just download the software " pdocread.exe ", keep my kaiser connecting to PC, then double click the software, but nothing happened, I didn't see the any file.
So can anybody teach me how to run the software? I need more details about that. I am a fresh.
thanks for all.

[gregslater84]

You need to run the software from the command line with the "-l" switch initially. Click start > run and type "cmd".

[Imperium]

What if someone dumped the original rom WITH HardSPL installed? will you be able to flash the original ROM without HardSPL anyways like a stock ROM? or not?

[tubaking182]

***deleted solved

[gregslater84]

@Imperium: I would have thought the CID would be retained when it's dumped. So as long as it's the same unit that would make sense. I'm no expert though but that's what I reckon! :)

[redbandana]

i cannot get this tool to do anything. When I click on pdocread a black screen appears for 2 seconds and then disappears.

[acabtp]

i cannot get this tool to do anything. When I click on pdocread a black screen appears for 2 seconds and then disappears.

read his post... it's a command line tool

[redbandana]

read his post... it's a command line tool

i know but when i click the tool i can't type anything because it disappears.

[acabtp]

i know but when i click the tool i can't type anything because it disappears.

open a command prompt, then run the tool. command line tools are run FROM the command line, they aren't (usually) the command line themselves.

[acabtp]

I'm trying to dump a wm6.1 rom which i have cooked myself and added apps to to see if once reconstructed it is as was when dumped.

I'm having this problem:-


http://i153.photobucket.com/albums/s221/Johnston411/Itsutils1.jpg


I'm sure it's something simple but i'm a bit of a novice.

I'm using vista home premium.

as you can see from the error message, the problem is writing to the output file. vista doesn't let non-elevated accounts write to the root of the c drive, so you can either change to a different directory and save the dump there, or run the command prompt with administrative privileges and try it again.

[redbandana]

as you can see from the error message, the problem is writing to the output file. vista doesn't let non-elevated accounts write to the root of the c drive, so you can either change to a different directory and save the dump there, or run the command prompt with administrative privileges and try it again.

sorry I know little but you basically explained everything I needed to know up to this point. Thank you.

[Brombeer78]

Hi Guys,

I'm new to this ROM stuff but followed the instructions.
I was able to dump my T-mobile NL Rom from my niki200 (mda touch plus)
I now have 4 .raw files if anybody want these files let me know
Here is the output

C:\Shit>pdocread.exe -l
210.75M (0xd2c0000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 84.25M (0x5440000) Part02
| 119.88M (0x77e0000) Part03
968.75M (0x3c8c0000) DSK1:
| 968.50M (0x3c880e00) Part00
STRG handles:
handle c74f0f92968.50M (0x3c880e00)
handle 2748c452119.88M (0x77e0000)
handle 074b3d22 84.25M (0x5440000)
handle c74b3cfe 3.50M (0x380000)
handle 874b3a4a 3.12M (0x31f000)
disk c74f0f92
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2748c452
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b3d22
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b3cfe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874b3a4a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00



C:\Shit>pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)

C:\Shit>pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
CopyTFFSToFile(0x0, 0x380000, Part01.raw)

C:\Shit>pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x5440000 Part02.raw
CopyTFFSToFile(0x0, 0x5440000, Part02.raw)

C:\Shit>pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x77e0000 Part03.raw
CopyTFFSToFile(0x0, 0x77e0000, Part03.raw)

C:\Shit>dir *.raw
De volumenaam van station C is OS
Het volumenummer is 74A5-A10D

Map van C:\Shit

15-06-2008 10:15 3.272.704 Part00.raw
15-06-2008 10:16 3.670.016 Part01.raw
15-06-2008 10:24 88.342.528 Part02.raw
15-06-2008 10:36 125.698.048 Part03.raw
4 bestand(en) 220.983.296 bytes
0 map(pen) 26.427.199.488 bytes beschikbaar

Now that i have the files wat can i do with it?

[forsberg]

Hi everyone

Im a newbie who thought this would be easy but...
Heres my problems and questions.

When i do a pdocread.exe -l i get this:
210.38M (0xd260000) FLASHDR
| 3.12M (0x31f000) Part00
| 3.63M (0x3a0000) Part01
| 83.88M (0x53e0000) Part02
| 119.75M (0x77c0000) Part03
1.89G (0x79280000) DSK1:
| 1.89G (0x79120e00) Part00
STRG handles:
handle 06179b96 1.89G (0x79120e00)
handle c7422cda119.75M (0x77c0000)
handle 6748b10a 83.88M (0x53e0000)
handle e748b0e6 3.63M (0x3a0000)
handle 074a9eee 3.12M (0x31f000)
disk 06179b96
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c7422cda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6748b10a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e748b0e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074a9eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

So when i use the commands exactly as written in the 1st post:

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw

thats listed in the first post i get this:

Part00.raw 3,1 MB
Part01.raw 3,0 MB
Part02.raw 69,3 MB
Part03.raw 119,7 MB
Total: 195,3 M

If i use my own values i get errors.

The Questions:
Shouldnt i get files that are the same size as pdocread.exe -l shows?
Or is it the sum of all files that matters (im missing about 15 MB i think)?
Shouldnt i use the values that pdocread.exe -l shows and run the command like this: pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw



Please help a newbie :D

Information Only:
The phone is new with Windows Mobile 6.1 Pro Swedish.
I have done a hardreset.
I have the latest Itsutils from 20080313.
I HAVENT done any changes (ie. CID/SIM) other then the registry change from 2 to 1.
Im using Windows XP SP3.

[icek]

Having read through this thread, either I have missed something or there is still NO WAY of flashing the read files or compiling a backup file which can be used to flash back to the kaisers.

[jcespi2005]

Having read through this thread, either I have missed something or there is still NO WAY of flashing the read files or compiling a backup file which can be used to flash back to the kaisers.

Seems you didn't search before postiong, there are a sticky thread by Alex with a link to Reconstructed ROMs....

and of course in my signature ;)

Cheers

[forsberg]

Thought this forum had all the answers :)

The Questions:

Shouldnt i get files that are the same size as pdocread.exe -l shows?

Or is it the sum of all files that matters (im missing about 15 MB i think)?

Shouldnt i use the values that pdocread.exe -l shows and run the command like this: pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw

[icek]

Did alot of reading on this and the link got missed. Thanks to Jcespi for providing link..:)

[loco41]

what do I need to extract the rom I am really confused I dont know what to get please if any1 can help me.

[Simonetti2010]

How do I get the radio ROMs from the dumped files?

[icek]

Follow the instructions at the start of this thread to dump the raw files and then the link below to reconstruct the files
http://forum.xda-developers.com/showthread.php?t=337066

[jacky_zhuxg]

:confused: There are a few things going on about working with the ROM that I got confused.

2. Now, after going this dump procedure, I got all these folders and files in the dump directory (hundreds of them). What do I do with them? In other words, how do I edit them? Can add couple .exe files into directory that is about it. How do you, for example, change the display from English to Chinese, or added an IME program or add the .cab file equivalent to it?

3. In using ROM kitchen to cook, is there any tool which can convert a .cab to an OEM package folder? I saw a thread how to make an OEM package, is there other simplier way?

My confusion is between 2 & 3. If functions or programs can be added with 2 (dump & re-construct ROM), why we need the kitchen. On the other hand, if the kitchen is use to add or subtract functions or programs, why we need to go through all the trouble of dumping and reconstructing ROM?


That is all the things I'm getting confused too.
anyone can explain? read a lot from this forum and I know I should put part01.raw, part02.raw and ruu_signed.nbh together to reconstruct ROM.
os if the part01.raw and part02.raw has all the ROM needed, what exactly ruu_signed.nhb do? and we can only use ruu_signed.nbh to flash, then what exactly part01/02.raw do?

[forsberg]

Thought this forum had all the answers :)

The Questions:

Shouldnt i get files that are the same size as pdocread.exe -l shows?

Or is it the sum of all files that matters (im missing about 15 MB i think)?

Shouldnt i use the values that pdocread.exe -l shows and run the command like this: pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw

Please, could anyone help me :(

[jcespi2005]

That is all the things I'm getting confused too.
anyone can explain? read a lot from this forum and I know I should put part01.raw, part02.raw and ruu_signed.nbh together to reconstruct ROM.
os if the part01.raw and part02.raw has all the ROM needed, what exactly ruu_signed.nhb do? and we can only use ruu_signed.nbh to flash, then what exactly part01/02.raw do?

Well, part01 and part02 are the content of device extracte, but are in RAW format. part01 is the XIP and part02 is the IMGFS (the OS itself). But for creating a NB file from the IMGFS you need an old NB, this is why you need a base NBH file to reconstruct. Tha tadzio tools works in this way... and KaiserKitchen is based on two basic tools, Tadzio and Bepe tools.

To understand how works the reconstruction process, take a deep look at KAISERKITCHEN.CMD and you will understand a lot better how do the works...


Thought this forum had all the answers :)

The Questions:

Shouldnt i get files that are the same size as pdocread.exe -l shows?

Or is it the sum of all files that matters (im missing about 15 MB i think)?

Shouldnt i use the values that pdocread.exe -l shows and run the command like this: pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw

the answer to you questions are yes. For reconstruction process, you only need part01 and part02. So what is your exact problem? Did you extract part01 and part02? what error did you get?

We need more info to help you, mate...

Cheers

[jacky312]

hi, i downloaded
- itsutilsbin-20080602
- itsutl050628

and i can't seem to run pdocread.exe, i get the following error message

"Unable to locate component
This application has failed to start because RAPI.dll was not found. Re-installing the application may fix this problem."


what steps should i do, does this require some type of installation?

i have very little knowledge in programing, and i would like to dump my rom since it is not available here and i would also like to share it.

if you managed to dump your rom successfully can you tell me in simple steps how you have managed to do it?

Thnx for the support.

[jacky_zhuxg]

Well, part01 and part02 are the content of device extracte, but are in RAW format. part01 is the XIP and part02 is the IMGFS (the OS itself). But for creating a NB file from the IMGFS you need an old NB, this is why you need a base NBH file to reconstruct. Tha tadzio tools works in this way... and KaiserKitchen is based on two basic tools, Tadzio and Bepe tools.

To understand how works the reconstruction process, take a deep look at KAISERKITCHEN.CMD and you will understand a lot better how do the works...




the answer to you questions are yes. For reconstruction process, you only need part01 and part02. So what is your exact problem? Did you extract part01 and part02? what error did you get?

We need more info to help you, mate...

Cheers

Thanks a lot. You ARE a really warmhearted　man, professional as well.

so if I didn't misunderstand, that is nothing worry about ruu_signed.nbh I use when I got part01/02.raw file for cooking ,right?

[jacky312]

while i am dumping Part02.raw , at the end i get the following error message


ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid.



what does this mean?
what should i do?

Thnx