[PRJ][UPG]Universal ELF/IN 1.1.x & 2.2.X Roms PP Changer

Search This thread

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
For Cooks

The main reason for creating this thread is that many here in this forum have asked me for the method to change the pagepool of the later ELFin ROMs that are based on the 2.20.xxx.xx stock roms. Incidentally, these ROMs are also used for the ELFs.

Firstly, I must thank duttythroy's thread HERE in the Kaiser forum that inspired me to successfully search for the illusive pagepool offsets in the ELFin ROMs, which I was searching for months. Following the same modus operandi, the unique hex string pattern responsible for the pagepool was found to be:
|03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|



This walkthrough is targeted at the more advance users i.e. Chefs and I shall not be responsible for any damages to your devices if you do not follow the instructions given below.

For Regular Non Cooking Users please Look at The Second Post with the Multi PP Changer (Beta For Now)



Let me do a walkthrough on how to change the ELFin's 12MB Default Pagepool to 18MB Pagepool and other pagepools of your desire

[12MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| ELFin's Default Pagepool
[16MB Pagepool] |10 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[18MB Pagepool] |12 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[24MB Pagepool] |18 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|

To begin with, we will need a few stuff to perform the pagepool change:

- OS.nb or .NBH file (your targeted 2.20.xxx.xx ROM)
- A Hex Editor [Hex Edit Free 2.5] to edit the offsets
- Alot of guts.... keke :D

1. [HOW TO CHANGE ELFIN'S PAGEPOOL]

Step 1: Open the OS.nb or .NBH file with a Hex Editor
Step 2: Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| (Two addresses should be found)
Step 3: At the first address found, change the first two bytes "03 15" to "12 16" for 18MB pagepool
Step 4: Repeat Step No.3 at the 2nd address found
Step 5: Save & Exit the Hex Editor
Step 6: If you are using the OS.nb, start cooking your new ROM with it
Step 7: Flash the new .NBH file to your ELFin and enjoy the 18MB True Pagepool

For other pagepool sizes, change the first byte "03" to "XX" hex value corresponding to your desired pagepool in Step No.3 & 4. (Remember that this is hex value, i.e. "10" = 16MB, "12" = 18MB, "18" = 24MB, etc.)

2. [HOW TO CHANGE ELF'S PAGEPOOL]

Through comparison, I also discovered that the ELF's Default Pagepool is 8MB and is different from the ELFin's 12MB Pagepool within the same ROM. I reckoned then that it must be determined by a different set of bytes in the unique hex string pattern and discovered that they are "02 15", the fifth and sixth bytes of the string pattern:

[8 MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| ELF's Default Pagepool
[4 MB Pagepool] |03 15 A0 03 | 04 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[6 MB Pagepool] |03 15 A0 03 | 06 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[0 MB Pagepool] |03 15 A0 03 | 00 16 A0 13 | 00 10 83 E5 | DA C2 FF EB|

Step 1: Open the OS.nb or .NBH file with a Hex Editor
Step 2: Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| (Two addresses should be found)
Step 3: At the first address found, change the 5th & 6th bytes "02 15" to "04 16" for 4MB pagepool
Step 4: Repeat Step No.3 at the 2nd address found
Step 5: Save & Exit the Hex Editor
Step 6: If you are using the OS.nb, start cooking your new ROM with it
Step 7: Flash the new .NBH file to your ELF and enjoy the 4MB True Pagepool

For other pagepool sizes, change the fifth byte "02" to "XX" hex value corresponding to your desired pagepool in Step No.3 & 4. (Remember again that this is hex value, i.e. "04" = 4 MB, "06" = 6 MB, "00" = 0 MB, etc.)

3. [EFFECTS OF ZERO PAGEPOOL:]

No pagepool or zero pagepool will force the device to go into the dynamic mode where the entire RAM can be used for pagepooling without limits. Your device should be snappier but your used RAM memory might suffers at times. Appear to work well for devices like Elf, Prophet, etc with low RAM memory of 64MB and below. Some tests carried out by the Dynamic Duo ababrekar and htctouchp had confirmed this phenomenon. Tests on Kaiser with 128MB RAM had shown disastrous results: the kaisers were just crawling very slowly... hehe. Some people sweared by it and said it's SUPER-FAST! Well, this you got to find out by yourself...:p

NOTE: I have intentionally described the steps in details in the hope that someone who is good in programming will develop a simple "Change Pagepool" program that can do all these with the simple click of a few buttons. Better still if the progam can change the pagepool of the ROM that is in use through USB activesync...That will be the day! :D

HAVE FUN & ENJOY YOUR TRUE PAGEPOOL! ;)

For Reference: SPB Benchmarking on the different pagepools done by pof and Larentius26

For those who want to change pagepool in ELF, the easy way using USB Activesync, download the small Change Pagepool App (ELF) created by tabi13 below:
ChangePPvAS
 
Last edited by a moderator:

dsixda

Inactive Recognized Developer
Nov 1, 2007
9,586
5,324
Ottawa
Universal Page Pool Changer - for Elf/Elfin only

This tool provides support for both Elf/Elfin and 1.1x/2.2x/3.xx ROMs, so it is a true universal Page Pool Changer. It will write to the appropriate area in memory, reboot your device and then read back the new value. This method is much faster than changing the page pool in the ROM file by hand, which requires re-flashing the entire ROM.

To use this: Unzip the attachment, connect your device to ActiveSync and then run pp.bat.
USE AT YOUR OWN RISK. BETA VERSION ONLY SO FAR. ENSURE YOU HAVE THE USPL INSTALLED!

This program would not have been possible without people like Swiftblade, tabi13, ayyu3m, htctouchp, Noonski and other cookers providing the offsets/strings to write to as well as testing it.


Posts for this Universal Testing PP Changer starts here:
http://xdaforums.com/showpost.php?p=2585064&postcount=123


UPDATE: Now working with all 3.xx ROMs, INCLUDING 3.xx ROMs with ULDR removed.
STILL TO DO: 2.xx ROMs with ULDR removed


SCREENSHOT #1 - Changing Page Pool:

screen1-1.gif



SCREENSHOT #2 - Reading back the new value after reboot (reboot time is partly dependent on the new page pool size):

screen2-2.gif



I will need feedback for the following:

1) Elf with 2.2x ROM
2) Elfin with 2.2x ROM
3) Elf with 1.1x ROM
4) Elfin with 1.1x ROM (NOTE: don't flash a 1.1x shipped ROM on your Elfin! Use just the OS ROM)
5) Elfin with 2.81 ROM*
6) Elf with 3.xx ROM
7) Elfin with 3.xx ROM

*It looks like Elfins that come installed with a 2.81 stock ROM do not contain the Page Pool values at the expected locations. If you however flash the dumped 2.81 ROM to a non-2.81 Elfin, the PP is read correctly on the non-2.81 Elfin.
 
Last edited:

Ameet

Retired Moderator
Dec 15, 2007
1,984
10
46
Mumbai
cool walkthrough brother.. cool.. keep it up.. hope to see a nice pagepool changing software someday by some programmer ;)
 

!Aman!

Retired Moderator
Feb 18, 2008
2,962
14
Brampton
Oops... some errors here.:( Thanks bro for pointing them out. I will edit them in a moment.:D
thanks for such an explanatory post bro :)
i've one question though. i modified the PP of my ROM to 16 MB and after flashing just when i got the prompt for screen alignment, i got some errors showing some exe's not able to run namely replog.exe, tskschedule.exe and 3-4 others. i didnt modify anything else in the ROM.
 

Ameet

Retired Moderator
Dec 15, 2007
1,984
10
46
Mumbai
how is the he value calculated? i want a 6mb pp for which i dont know what the hex value would be.. is there a calculator or something? so i wont have to ask each time ;)
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
thanks for such an explanatory post bro :)
i've one question though. i modified the PP of my ROM to 16 MB and after flashing just when i got the prompt for screen alignment, i got some errors showing some exe's not able to run namely replog.exe, tskschedule.exe and 3-4 others. i didnt modify anything else in the ROM.

Hi htctouchp.. did you change the "03 15" at both occurrences in the .nbh files. The patterns should only appear twice, if not somethings is very wrong.. just curious.. you use os.nb or .nbh file?
 

!Aman!

Retired Moderator
Feb 18, 2008
2,962
14
Brampton
Hi htctouchp.. did you change the "03 15" at both occurrences in the .nbh files. The patterns should only appear twice, if not somethings is very wrong.. just curious.. you use os.nb or .nbh file?
actually i tried this just 5 mins before ur post, in the manner explained by dutty(and ameet), first edited the S000 of nk.exe and then modified the os.nb and while editing the os.nb, i found this pattern just once, not twice.
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
how is the he value calculated? i want a 6mb pp for which i dont know what the hex value would be.. is there a calculator or something? so i wont have to ask each time ;)

Some numbers in hex:

"00" = 0
"01" = 1
"02" = 2
"03" = 3
"04" = 4
"05" = 5
"06" = 6
"07" = 7
"08" = 8
"09" = 9
"0A" = 10
"0B" = 11
"0C" = 12
"0D" = 13
"0E" = 14
"0F" = 15
"10" = 16
"11" = 16+1 = 17
"12" = 16+2 = 18
"13 = 16+3 + 19
.....
 

Ameet

Retired Moderator
Dec 15, 2007
1,984
10
46
Mumbai
Some numbers in hex:

"00" = 0
"01" = 1
"02" = 2
"03" = 3
"04" = 4
"05" = 5
"06" = 6
"07" = 7
"08" = 8
"09" = 9
"0A" = 10
"0B" = 11
"0C" = 12
"0D" = 13
"0E" = 14
"0F" = 15
"10" = 16
"11" = 16+1 = 17
"12" = 16+2 = 18
"13 = 16+3 + 19
.....

cool.. so for 4mb pp, i have "04 16"
for 6mb pp, i should have "06 16"
and for 8mb pp, i should have "08 16"

rite? :) thanks for the prompt reply brother
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
actually i tried this just 5 mins before ur post, in the manner explained by dutty(and ameet), first edited the S000 of nk.exe and then modified the os.nb and while editing the os.nb, i found this pattern just once, not twice.

hi htctouchp... the string pattern in Kaiser is different from ELFin and that explained why you found it once. So you probably edited some .exe program instead of pagepool.

Search the string pattern as given above and try it again. Should work and forget about nk.exe, just do it on the .NBH file straightaway and re-flash it back to your device. Cheers.
 

!Aman!

Retired Moderator
Feb 18, 2008
2,962
14
Brampton
hi htctouchp... the string pattern in Kaiser is different from ELFin and that explained why you found it once. So you probably edited some .exe program instead of pagepool.

Search the string pattern as given above and try it again. Should work and forget about nk.exe, just do it on the .NBH file straightaway and re-flash it back to your device. Cheers.
no bro...i meant i only used that method..but the string which i used was the same as the one mentioned by u.
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
no bro...i meant i only used that method..but the string which i used was the same as the one mentioned by u.

What ROM are you using? 1,17.xxx or 2.20.xxx ??

If you are using the 2.20.xxx rom and editing the .NBH file, the addresses found should be at 0X438DC and 0X353637... try searching again...
 

zeflash

Senior Member
Jan 23, 2007
51
0
THANK YOU!
thank you!
Finally I am able to get new ROMs with proper 4MB pagepool on my puny Elf!!!

Tried the trick on Ameet's 4.01 UC rom, and it worked.
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
THANK YOU!
thank you!
Finally I am able to get new ROMs with proper 4MB pagepool on my puny Elf!!!

Tried the trick on Ameet's 4.01 UC rom, and it worked.

pkoper said:
Excellent.... have been waiting for this. Good job!

We are here to share and it's good to know that it is of help to you bros.... Enjoy the true pagepool... keke c",)

htctouchp said:
yup, the strings are at these very addresses mentioned by u bro and i use 2.20.xxx ROM

How did it go? Manage to solve the problem? I re-look your problem and it might not be related to the pagepool changing.

I suspect one or two things: UC and/or SQM removed from your Rom... ?? And again I may be very wrong.... Cheers.
 

Swiftblade

Senior Member
Jun 22, 2007
1,926
1
even i can find only one instance of the hex string if i try to edit the nbh or nb file directly.. but i have the sqm removed from my rom, is that why?

They are 2 separate issues. I'm saying that if SQM module in WM6.1 is not removed properly, it can cause some of the .dlls not loading as mentioned by Aman.

Ameet bro... you mean you can only find one instance of the hex string in your roms? Only possibility of that happening is when the nk.exe in the XIP was removed during porting.... Now this get me thinking, maybe we need to hex edit only once, i.e. the higher offset at 0X353637....ummh...:confused:

The one instance of hex string is at the higher offset address in your case?
 
Last edited:

Ameet

Retired Moderator
Dec 15, 2007
1,984
10
46
Mumbai
They are 2 separate issues. I'm saying that if SQM module in WM6.1 is not removed probably, it can caused some of the .dll not loading as mentioned by Aman.

Ameet bro... you mean you can only find one instance of the hex string in your roms? Only possibility of that happening is when the nk.exe in the XIP was removed during porting.... Now this get me thinking, maybe we need to hex edit only once, i.e. the higher offset at 0X353637....ummh...:confused:

The one instance of hex string is at the higher offset address in your case?

yes it is the highest offset.. but i tried this trick on a rom in which i had already hex edited the sooo in nk.exe and then after cooking i could find only one instance.. but the trick of directly editing nb file didnt work for me (or maybe i did something wrong, which i'll try again) but the nk.exe trick and then nb files worked like a charm for me