Radio ROM Dump

[jockyw2001]

For getting GPS to work on Wings production models I believe it is necessary to also dump and reconstruct the radio ROM from a pre-prod model. We also need the radio dumped from a production model so that we can compare. The dump procedure is more complicated than dumping the OS (http://forum.xda-developers.com/showthread.php?t=356674) and this is nothing for n00bs.

Requirements

- Qualcomm QPST software (search)
- QC diagnostics drivers (attached)
- HardSPL, only needed if you want to dump from a production model

Procedure

1. Restart in tri-color bootloader mode and start MTTY
2. Type: rtask a
3. Type: radata Note: What you type is not echoed on screen!!!! (after pressing enter ignore the error message "Parameter error")
4. Type: retuoR Note: What you type is not echoed on screen!!!!
5. Type: rtask c

After step 5. the device will enter QC diagnostics mode and it will install 3 new devices on your PC. Make sure you install the attached drivers. After driver installation look in device manager to find which COM port the QC diag driver uses.

6. Exit MTTY
7. Start "QPST Configuration" and check if the device is recognized and if it is in "download" mode
8. Start "QPST Memory Debug", click "Get Regions" and then "Save To"
9. Upload the dumped files on XDA Devs FTP server

Dump NV Items

The configuration of radio are stored as NV items. It is possible to dump these as foolows:
1. Restart in tri-color bootloader mode and start MTTY
2. Type: rtask c
3. Exit MTTY and start "QPST RF NV Item Manager" and select Read from Phone from the File menu followed by Write Only listed Items to .QCN file
4. Upload the dumped files on XDA Devs FTP server

Version numbers listed in Splash screen

Please note them down and post them here.

Note that this procedure cannot harm your device in any way.

Final note: once an official HTC RUU file is available for Wings we can flash the reconstructed OS and Radio to your device. A RUU will be available sooner or later.

[el_lo]

Here is the link to Qualcomm QPST software 2.7.247 (http://gsm-multifund.de/files/siem/download/QPST_2.7.247.rar) ;)

I tried everything you said above, and all went well (retuoR gave mean an invalid command, but I went further and everything was ok :confused:).

I attached pictures of the task manager and QPST configuration.

The files you should have when you're done are : smi.bin ; ebi.bin ; load.cmm and whatever.qcn (this last file is the NV dump) . Is this correct Jockyw ? Will we have to reconstruct those to a .nbh file somehow?

[jockyw2001]

Well done el_lo :)

Yes, with ebi.bin and smi.bin *and* an official RUU we can reconstruct a complete pre-prod ROM.

[butzchan]

Well done el_lo :)

Yes, with ebi.bin and smi.bin *and* an official RUU we can reconstruct a complete pre-prod ROM.

An official RUU?

[jockyw2001]

An official RUU?
Yes

Can someone write down version numbers appearing in the splash screen please. Thx.

[Dumdidum]

Mine: (pre-production with working GPS):
R 1.58.06.16
G 25.42.11.00H
D 0.91.00.00


In Bootloader I have:
WING200 MFG
SPL-0.91.1000
CPLD-7

[Dumdidum]

After I have put it into bootloader and started MTTY, I type in:
rtask a
Then it seems to hang. It shows:

POWER OFF PMIC VREG_USB : SUCCESS!
C VREG_USB : SUCCESS!

But I cannot enter more strings now...

[Dumdidum]

I just ignored rtask a and did all other things
It installed the drivers but I get the following screen:

http://forum.xda-developers.com/attachment.php?attachmentid=66378&stc=1&d=1200611892

[jockyw2001]

After I have put it into bootloader and started MTTY, I type in:
rtask a
Then it seems to hang. It shows:

POWER OFF PMIC VREG_USB : SUCCESS!
C VREG_USB : SUCCESS!

But I cannot enter more strings now...
Yes you can. You can type it, but you won't see what you type on screen! :)
Your screenshot is showing the device in QC Diag mode, but not in Dload mode.
Try again and follow my instructions.

[Dumdidum]

Ok its now working... dumping in this moment...
you need the NV Items too?

Where can I upload it? which ftp-link?

[Dumdidum]

Ok I have the smi.bin , ebi.bin and load.cmm
But cannot get the NV-File...

did exactly what you said:

1. Restart in tri-color bootloader mode and start MTTY
2. Type: rtask c
3. Exit MTTY and start "QPST RF NV Item Manager" and select Read from Phone from the File menu followed by Write Only listed Items to .QCN file

but while starting "Read from File" I get:

http://forum.xda-developers.com/attachment.php?attachmentid=66379&stc=1&d=1200614645

[Dumdidum]

My fault... I had to choose the com-port in the settings first...

So I got all the files you want...

I have upload it here:

ftp://xda:xda@ftp.xda-developers.com/Uploads/Wings/HTC_Wings_Preproduction_radio_Dump_dumdidum.zip

I hope you can do something good with it. I love the GPS on my Wings :-) But the preproduction ROM is very unstable, so I'de love to get a stable ROM with GPS-Support. Although I fear that they have deactivated something on hardware, cause the producive wings are getting GPS data, just no fix... perhaps no antenna?

[jockyw2001]

My fault... I had to choose the com-port in the settings first...

So I got all the files you want...

I have upload it here:

ftp://xda:xda@ftp.xda-developers.com/Uploads/Wings/HTC_Wings_Preproduction_radio_Dump_dumdidum.zip

I hope you can do something good with it. I love the GPS on my Wings :-) But the preproduction ROM is very unstable, so I'de love to get a stable ROM with GPS-Support. Although I fear that they have deactivated something on hardware, cause the producive wings are getting GPS data, just no fix... perhaps no antenna?
Well done :)

Yes, I share your fears but let's see we can proof it using the "reconstruct pre-prod software" approach :D

[jockyw2001]

Anyone with a prod model care to take a note of the version strings in the splash screen please? Please note them down and post them here.

[moneytoo]

Production
R 1.58.17.02
G 25.62.30.03H
D 1.31.00.00

But here's someone with different version... http://www.htcwiki.com/thread/1104370/HTC+S730+rom?t=anon

[jockyw2001]

http://www.htcwiki.com/thread/1104370/HTC+S730+rom?t=anon
Thx for that link.
So we have:

GPS/3G Enabled S730:
R 1.58.06.16
G 25.42.11.00H
D 0.91.00.00

Production S730:
R 1.58.17.02
G 25.62.30.03H
D 1.31.408.0

and

R 1.58.17.02
G 25.62.30.03H
D 1.31.00.00

Someone should now dump radio rom of a prod model!

[jcespi2005]

For getting GPS to work on Wings production models I believe it is necessary to also dump and reconstruct the radio ROM from a pre-prod model. We also need the radio dumped from a production model so that we can compare. The dump procedure is more complicated than dumping the OS (http://forum.xda-developers.com/showthread.php?t=356674) and this is nothing for n00bs.

Procedure

1. Restart in tri-color bootloader mode and start MTTY
2. Type: rtask a
3. Type: radata Note: What you type is not echoed on screen!!!! (after pressing enter ignore the error message "Parameter error")
4. Type: retuoR Note: What you type is not echoed on screen!!!!
5. Type: rtask c
After step 5. the device will enter QC diagnostics mode and it will install 3 new devices on your PC. Make sure you install the attached drivers. After driver installation look in device manager to find which COM port the QC diag driver uses.
6. Exit MTTY
7. Start "QPST Configuration" and check if the device is recognized and if it is in "download" mode
8. Start "QPST Memory Debug", click "Get Regions" and then "Save To"
9. Upload the dumped files on XDA Devs FTP server

Dump NV Items

The configuration of radio are stored as NV items. It is possible to dump these as foolows:
1. Restart in tri-color bootloader mode and start MTTY
2. Type: rtask c
3. Exit MTTY and start "QPST RF NV Item Manager" and select Read from Phone from the File menu followed by Write Only listed Items to .QCN file
4. Upload the dumped files on XDA Devs FTP server


Hi, mate.

First of all, congratulations for the finding ;)

I'm taking a chance for the procedure in Kaiser device, and love to know what are the steps after the dump process to get the NB file...

For what i understand, i need to dump files from the first process (9 steps) and after this dump the config files too (4 steps), am i right?

many thanks...

[jockyw2001]

For what i understand, i need to dump files from the first process (9 steps) and after this dump the config files too (4 steps), am i right?

Compare smi.bin and ebi.bin with the radio.nb you flashed originally, that will give you the memory layout vs. the rom (.nb) layout. With that you can reconstruct a radio.nb from any radio dump.

Good luck!

[el_lo]

I've uploaded the radio from a production model here : Radio Production Model (ftp://xdaupload:xda@ftp.xda-developers.com/Smartphone/Wings/Radio (Production model)/Radio.zip) ;)

Here is the info from the production model in question :

R1.58.17.02
G25.62.30.03h
D1.31.00.00

[jockyw2001]

Excellent, so now we only need an official RUU to sort it all out.
Maybe we won't need it to reconstruct the radio, I'm not yet sure about that one.

[tom_codon]

Hum.... Jocky....

It's Cool...

Finding way for niki device too.
Thanks so much for your works :D

[jcespi2005]

Compare smi.bin and ebi.bin with the radio.nb you flashed originally, that will give you the memory layout vs. the rom (.nb) layout. With that you can reconstruct a radio.nb from any radio dump.

Good luck!

Sorry, but i'm a bit loose... what tool do i need to convert the BIN files to the NB files... cause the size are different... ebi.bin are 8Mb, smi.bin are 32Mb and radio.NB file are 17Mb... confused...

Many thanks....

[jockyw2001]

Sorry, but i'm a bit loose... what tool do i need to convert the BIN files to the NB files... cause the size are different... ebi.bin are 8Mb, smi.bin are 32Mb and radio.NB file are 17Mb... confused...

Many thanks....
All you need is a hex editor and patience :)
Parts of the radio rom are found in smi and a big part also in ebi.
Take a few bytes from radio.nb and try to find them in smi and ebi.
A couple of areas in radio.nb you will not find in smi and ebi, those areas must be identified but will not be updated.

[scorpio16v]

The files you should have when you're done are : smi.bin ; ebi.bin ; load.cmm and whatever.qcn (this last file is the NV dump) .

Do you know, if this tool works with all Qualcomm chips and if the posted drivers can handle all chips ?
I have an XDA Comet (Atom Life). It has an MSM 6280, but if i dump the content like you described. I only have some *.lst files. One file is the sdram_dump.lst (64MB) but it doesn't contain the radiorom.
OK Mtty doesn't work for this device, but I can enter GSM AT+Diag Mode with an BL menue and if I run the tool, it asks to set the device in DL Mode automaticly
It semms, that the tool doesn't work correct, but at the other side, It recognizes the right radioversion from my device.

[jcespi2005]

All you need is a hex editor and patience :)
Parts of the radio rom are found in smi and a big part also in ebi.
Take a few bytes from radio.nb and try to find them in smi and ebi.
A couple of areas in radio.nb you will not find in smi and ebi, those areas must be identified but will not be updated.

Thanks for the how-to :) i will give a try and see how hard is... i must recongnice i'm not an hex editor expert jajaja but i'll try anyway and see what find...

Cheers.

[jockyw2001]

Thanks for the how-to :) i will give a try and see how hard is... i must recongnice i'm not an hex editor expert jajaja but i'll try anyway and see what find...

Cheers.
No worries, I can always give you a hand with it :)

[jockyw2001]

Do you know, if this tool works with all Qualcomm chips and if the posted drivers can handle all chips ?
I have an XDA Comet (Atom Life). It has an MSM 6280, but if i dump the content like you described. I only have some *.lst files. One file is the sdram_dump.lst (64MB) but it doesn't contain the radiorom.
OK Mtty doesn't work for this device, but I can enter GSM AT+Diag Mode with an BL menue and if I run the tool, it asks to set the device in DL Mode automaticly
It semms, that the tool doesn't work correct, but at the other side, It recognizes the right radioversion from my device.
Yeah, should work just fine. Maybe you can pull other data areas in 'normal' QC Diag mode.

[Alcaline]

I am not able to connect the phone to my computer in the tri-color window.
I connect the USB, but the device is not shown in any port.

MTTY cannot find anything connected, and the same with QPST

Anyone?

[el_lo]

I am not able to connect the phone to my computer in the tri-color window.
I connect the USB, but the device is not shown in any port.

MTTY cannot find anything connected, and the same with QPST

Anyone?

Kill the activesync process "wcescomm.exe" ;)

[jockyw2001]

Kill the activesync process "wcescomm.exe" ;)
It's easier to right-click activeync icon and to uncheck "Allow USB connections" from Connection Settings

[ino_mart]

I'm a newbee with mtty. Can someone tell me what options I have to choose in the startscreen?

I have chosen USB and I do get a screen where I can type commands. But whatever I type (like rtask a) I get: command error!!

Same error appears when I enter the other commands.

[qumran]

Install HardSPL

[cmmore]

Hello is this just a patch or do i lose my Norweigan Lang. on my tlf...
And can anyone help me i tryed to install SPL but i the telefon restarts and noting happens and i get connect tlf to usb.. or something like that..

[ahmadashar]

hi,
I am trying to do the same for Kaiser. i was able to dump all the files, can anyone tell me how to convert them into a .nb file?

Thanks

[NetrunnerAT]

hi,
I am trying to do the same for Kaiser. i was able to dump all the files, can anyone tell me how to convert them into a .nb file?

Thanks

yes ... please!

I want dump 3 different Radios for Niki, but the HarSPL is badly modded -> cant change rtask modus -.-°

[Marcos Paolo]

hi I'm very interested to install gps in my niki.

but your manipulation upon same very complicate for me who i'm a novice.

someone could make,batch, macro, to install the driver automaticaly?

thank you

[ftjd]

Where can I download ebi.bin and smi.bin?

[NetrunnerAT]

use rapidshare. or xda-developers ftp

[oitne]

Can anyone tell me how to start in tri-color bootloader?

[NetrunnerAT]

Wiki tell you the answer:

Tri-Color Boot Mode (Dumdidum)
To get into tri-color boot mode, shut off the S730, then power on with the Camera button pressed. To exit, remove power from the S730 and power back on.

[Drobcek28]

What i doing wrong ???

[AllTheWay]

jocky,

I am trying use the mtty commands that you have in the 1st post. Having the same issue as the post above mine.

I have usb connections disabled but when I type rtask a I get an


Cmd>rtask a
Command error !!!

Cmd>



Using MTTY 1.42

SPL: 3.56.Hard


EDIT:Fixed by using SPL 1.1.JockyW

[conner1580]

Hi to all,

I have extracted ebi.bin, smi.bin, load.cmm and file.qcn from my polaris... How can I convert these file in nbh file to flash the radio? Please Help ME!!!