PSA: You Can Optimize Your Note 4’s Recents Menu & RAM

The Note 4 never had the fastest Recents Menu, and despite its 3GB of RAM, … more

XDA Picks: Best Apps of the Week (July 25 – Aug 1)

Apps are at the front and center of any smartphone experience, and with over a … more

Voices Of XDA: Orbiting The Earth With Android

Editor’s note: This week’s feature has been written by forum … more

CloudPlayer: DIY HiFi Music Streaming Solution

In our Helpful Guide to Music Streaming Services, we mentioned several different services … more

incl. ROM now: WM 6 updated Tornado kitchen with SDHC + 28/25MB total/avail storage

1,427 posts
Thanks Meter: 245
By tobbbie, Senior Member on 17th January 2010, 08:16 PM
Thread Deleted Subscribe to Thread Email Thread
This kitchen is a continuation of the Nitrogenious kitchen released at XDA-devlopers.
Nothing has changed from the tools side, only subtle adaptations and altered content.

Thanks go to :
  • This is for educational purposes only!
  • There will be no support for the published content!
Enjoy and contribute.

Mind that from the "cooking" or "kitchen" point of view this is for sure an old base and possibly more elaborate tools and definitely newer OS versions exist. The produced files should not be able to "brick" your device if you correctly set the Image Name to "OS" in the last step of the cooking process. IPL or SPL should never be written unless you know exaclty what you do - the kitchen only cooks the OS part! Writing incorrect content to the IPL or SPL area will brick your device for sure, so be careful!

This effort was only done to get a running stable ROM with SDHC support included that occupies as little storage space as possible
  • still having mandatory elements on board
  • filling the remaining space with useful tools
Space saving strategies (order of benefit):
  • outsource parts to SD card where possible (.NET CF 3.5)
  • compress files (.exe and .dll) that are not stored as modules with UPX where function permitts.
  • remove files that are not needed for any function
  • remove media data (ringtones, pictures) and leave only the bare minimum
  • resize media data where possible to further decrease size
  • not done, but possible:
    • - remove optional packages (additional color schemes) (25k)
    • - remove empty packages (15k)
    • - summarize registry tweak packages to just one additional package (edit the .rgu) (few kB)
About UPX and builtin BINFS compression:
My experience is that the BINFS compression shrinks a set of example files (.NET CF 3.5 files that reside in the \Windows path) to about 49% while UPX'ed they only take 32% of their initial size. So on average you may gain 17% of the initial filesize in your ROM. The larger the file, the better is usually the gain.
Mind that UPX will only compress exe/dll files (even if they may be named differently, see Total Commander's *.tfx) and does not compress exe/dll that depend on .NET. It works luckily on the .NET CF core parts itself.

You should not compress (even if compression works, these DLLs will not load later):
  • resource DLLs
  • menu extension DLLs (context menus)

Updated and altered content:
  • added SDHC support by replacing the OMAP850_SDHC.dll with an SDHC capable version initially created for the StrTrk. So far there are no negative impacts visible.
  • altered the titles of the options to indicate the space they take - also UPX'ed size
  • moved the oemstartup.dll and the relevant pictures to the folder where the optional sounds already resided
  • added German T9 to the English T9 - so both is installed in the system if you select this. Mind that an additional language is not eating much space (~70k)
  • added the SafeInboxExtension as an own option to add, removed the InboxExtension from the combined "Group SMS + ..." menu
  • put moBlue to the latest version (2.1) and adapted rgu content.
  • added an option for registry changes called "tobbie GUI tweaks" that sum up everything that I think is useful (smaller menus, fonts, scrollbars, value for gamma).
  • updated the TotalCmd to the latest released version
  • created several additional packages from the previous default content (CeleTask, ClearType Tuner, ClockOnTop, ComManager, Dopod SIM Manager, .NET CF 3.5, OMAPClock, OxiosAlarms, OxiosMemory)
  • added a new package for .NET CF 3.5 where the GAC_* files have to reside on SD card. The complemtary ZIP containing the files to copy on SD card are located in the "_Changes" directory.
  • added the GPSID Settings tool to the GPSID directory
  • included the SP1 fixes supplied by Nitrogenious (FakeCursor not included)
  • changed several tweaked menus in the settings -> system tweaks
  • added options for volume setting of the initial beep and voice tag to the Voice Tag menu in system tweaks, changed category of the [HKEY_CURRENT_USER\ControlPanel\Sounds\VRecBeg] from "Notifcation" to "System" so that only the sounds sent form the VoiceTag are audible when the System sound volume is set to 0.
  • completely UPX'ed the SYS\MMSCAMCLKSTK *.exe and *.dll (except 2)
    • replaced the htcmidi.avd with the WM5 version to get back good midi playback,
    • added the HTCSourceflt.dll (from Nitrogenious SP1) to get midi playback in wmplayer
    • removed two large files from this directory which are nowhere referenced (CameraRC_*.dll).
  • updated WM5torage to the latest version (1.90), already setting suitable defaults.
  • fixed default settings for A2DP

Directory and contents
  • added a batchfile (you may want to edit) where the %SystemDrive% can be set to any value. This allows to install the kitchen on any drive you like and not on C:\ (the normal systemdrive) as it was mandatory. Mind that the scope of this %systemdrive setting is limited to the batch execution only. You can put the whole environment on a large RAMdisk (~380MB required) - this speeds up the cooking dramatically! A large RAM disk is available from "[ QSoft ] Qualitative Software" (1 year trial for the lite version) - see here: .
  • added a subdirectory "_Squeezer" where you find the UPX compression set "Squeezer" also published at XDA-developers (readme contained there). I have used this set to batch compress many files before putting them to ROM.
  • added a directory "_Changes" where you find the compressed and original versions of the files in equally named subdirectories OEM and SYS like in the WORK path. So in case you want to go back to the non-UPX-ed version they are there. Continuing the UPX-batch directory logic (2_Backup, 3_Compressed) there are further ones (4_removed and 5_changed) to document the changes done to the original content.
The rest of the kitchen is identical to the one Nitrogenious had released.

Download here:

Quick Start:

- Unpack to C:\
- read cooking guide at Nitrogen's thread (see above)
- using defaults you get a ROM with:
- available storage 27,97MB, free after boot 24,8MB

Correction: If you want to use the moBlue package, please edit the RGU file and add a blank line at the end. Using notepad will ensure that the file stays in unicode format.

Correction-2 (14.10.2010): You will experience that while WMP is playing the backlight will not go off as normal. This can be fixed by replacing the HTCWMPPlug.dll in the \windows directory on the device or in C:\Torn\_Changes\SYS\MMSCAMCLOCKSTK in the kitchen with the attached file.

Please make sure that your device is "SuperCID" before entering the "Format BINFS command. See post 3.

added 20100314: (edited 20100504)
Despite it is really extremely easy to cook your own ROM with the kitchen, let me give you a head start with your old Tornado. I have cooked the default settings to a ROM and added all tools that you need to step from a stock Tornado to the cooked one in a single archive.

Download it from here:

Unpacking it you will find a directory structure:

├───1 prepare security
│   ├───1 HTCUnlock
│   └───2 SDA_ApplicationUnlock
├───2 prepare for custom flash
│   └───Utils
├───3 flash latest Radio and SPL
├───4 format BINFS 1b00000
├───5 flash ROM
└───6 copy NetCF to SD
Follow the actions in the directories one-by-one:
You only need to do steps 1 and 3 if you come from an official ROM but Step 2 (lokiwiz) needs only be done once per device.
If you flash another cooked ROM you can start from step 4.

Attention: In case you did not notice yet - the following procedures will completely erase all content that you stored on the device (email, SMS, MMS, ToDo, Contacts - simply everything) - the device will be as if it comes out of the box. So back up your data before you do this!

Here is what to do in detail, how and why:
  1. Prepare security: This means that the restrictive program execution privileges have to be set less firm to allow step 2 to run later.
    1. Connect your Tornado to the PC and let Active Sync connect. First run HTCUnlock-CVS.exe in the directory 1 HTCUnlock. This will install a program on your device. Run the installed program there and restart the device.
    2. After the device has reconnected to Active Sync, on the PC run the program SDA_ApplicationUnlock.exe in the folder 2 SDA_ApplicationUnlock. It should confirm "succesfully unlocked".
  2. Now the device is ready to receive the "SuperCID" that allows to flash any ROM to it, regardless of Operator or Vendor limitations. To be on the safe side later, please enter on the device *#06# and note down the IMEI that the device reports - you will need it later.

    This needs only be done once per device - it is a permanent setting that survives all ROM updates.

    Go to the folder 2 prepare for custom flash and

    make sure there are no files *.bin left from previous device's activities

    then execute Lokiwiz.bat. It will prompt you with 4 options:
    U. Unlock
    L. Lock
    C. CID Unlock (SuperCID)
    Q. Quit
    Type the letter and press Enter:
    Input "C" <enter>.
    It will copy a program (itsutils) to the device and it should ask you for permission to execute - grant execution and let the batch file continue. You should find 2 new files beside the Lokiwiz.bat (lock-backup.bin and cid-unlocked.bin). Move them to a safe place immediately and do not repeat the procedure or call another option!

    Be careful to label these files unambigously (best is to append the device's IMEI to the name - get it with *#06# before and do not use the IMEI printed on the label of the device - as restoring a wrong *.bin file to a device will kill the GSM radio access (Message: Data Crashes, please contact your... when trying to connect to the network with a SIM card inserted).

    Now the device is prepared to receive custom ROMs.
  3. Let's first put the last available Radio ROM and SPL (Secondary Program Loader) to the device. Go to the directory 3 flash latest Radio and SPL and execute ROMUpdateUtility.exe. After successfull update the device will restart in the old OS, nothing has visibly changed - you could still use the device as it is, all your data are still there.
  4. Now the preparations start to erase the old OS and flash the new one.
    1. Deactivate USB connections for the Active Sync
    2. Switch off the device and disconnect from USB
    3. Press Camera Key and keep it pushed down while connecting the USB cable to the PC - wait until the 3-color screen appears and release the camera key.
    4. Start ttermpro.exe in directory 4 format BINFS 1b00000
    5. Select Serial and Port USB
    6. Press <enter> in the terminal window, you should get prompt CMD>
    7. enter info 2 <enter> you should see something like:
      Cmd>info 2
      + SD Controller init
      - SD Controller init
      CMD55 failed
      + SD Controller init
      - SD Controller init
      CMD55 failed
      HTCSSuperCID        ' HTCE
      The last line must show HTCSSuperCID ' HTCE.
      • If you see anything else there (e.g. HTCSVODA0504 „±çdHTCE - which is for an Austrian V1240) the lokiwiz in step 2 above did not work correctly. Still you have not destroyed anything (hopefully) - so to get the old OS start up again, enter ResetDevice <enter> - the device will restart and boot again. Think about what went wrong in the previous steps.
        The lokiwiz batch file and the tools behind it are very powerful and can kill the GSM radio access of the device. Be careful with the *.bin files and keep those of different devices clearly apart.
      • In case you see HTCSSuperCID ' HTCE then you can pass the point of no return (after this the OS and all your data are deleted from the device) and enter at the prompt format BINFS 1b00000 <enter>. (The value 1b00000 depends on the ROM size, so if you use a different ROM, the value may also be different.) After a few seconds the prompt returns and the partition where the OS was stored is cleaned up now. The device will not boot beyond the 3-color screen in this state. You need to flash the new OS in the next step - but before this enter ResetDevice <enter> - the device will restart and return to the 3-color screen.
      • Terminate the tterm.exe, you will not need it any further.
      • Re-activate USB connections in Active Sync - you may forget it later.
  5. Enter the directory 5 flash ROM and execute ROMUpdateUtility.exe. The procedure looks the same as in step 3 but takes a little longer. Do not get nervous as the time at 100% extends a few minutes. The device will reboot and bring you to the new OS.
  6. The SD card that shall be used in the device needs to have the NetCF 3.5 files copied to the directory \Windows finally. This is NOT on the device but on the card - you can copy it on the PC while the sd card is in a card-reader or when the device has is mounted, there the path is \Storage Card\Windows
  7. If the device had a SIM-Lock and it rejects your SIM, go to the lokiwiz.bat (again move out all *.bin files) and select "U" for SIM Unlock - again move the bin files in the directory to a safe place (but you should never need them). Mind that the "lock_backup.bin" is just a copy of the current encrypted area in the device. So this file is different after each step you completed before. Worse: if you do not save the FIRST lock-backup.bin you can never go back to this state.
Mind that lokiwiz.bat has worked for me on a Telenor Sim-Locked nordic ROM CID-locked QTEK 8310, so it should work for any other device as well. If you get the dreaded "Data Crashes..." message and your restore of the correct lock-backup.bin did not help either - your last resort is the SIM Unlock service here: It costs you some bucks, but they seem to re-create the encrypted area with the matching IMEI of your device putting it in a SIM-unlocked and CID Unlocked state. Cheaper than buying a new device.

After you have sucessfully flashed your ROM - maybe you try cooking one yourself?
Attached Files
File Type: zip - [Click for QR Code] (20.4 KB, 46 views)
Last edited by tobbbie; 14th October 2010 at 06:40 PM. Reason: solution to WMP playback with backlight on
17th January 2010, 08:17 PM |#2  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
The selected default settings fill the ROM up to the last few hundred bytes. Adding options will surely jump over the next MB border and your ROM uploading preparations will have to format BINFS with a larger size.

If you have not read it elsewhere yet, the standard sequence to uplad a ROM is:
1.) cook ROM (OS part)
2.) determine size and format BINFS accordingly
more see this thread:
3.) upload ROM
Last edited by tobbbie; 17th January 2010 at 08:42 PM.
17th January 2010, 08:17 PM |#3  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
If you start from scratch - so your device is still "untouched" by any custom ROM, you must prepare your device to allow the loading of a custom ROM. This happens in several steps to overcome the various security levels that try to prevent this:
  1. Application unlock the current operating system. Look for "SDA Application unlock" this runs on the PC and remotely unlocks (via the Active Sync Connection) the security of the Windows Mobile operating system. This allows tools to run that you need for the next step.
  2. Super-CID your device (and check if it worked!). Look for "lokiwiz" ZIP file in the forum here. Despite orginally created for the "Wizard" model, it also works for the Tornado in all respect, so it does the Super-CID and it does the SIM Unlock. I did it myself on a QTEK 8310 with a Nordic ROM and SIM-locked to Telnor.
  3. To check if it worked, connect the device in Bootloader mode to the terminal program and enter "info 2" (without the quotes). It has to show HTCSSuperCID ' HTCE
  4. Do not care about SIM lock yet, you can do that anytime later if necessary.
Good luck!
Last edited by tobbbie; 6th March 2010 at 06:41 PM.
18th January 2010, 12:51 PM |#4  
Senior Member
Flag Lost
Thanks Meter: 30
Thanks a lot. Nice work. Very useful. Could you please post one with a PRO rom, preferably the 6.5 version? Or at least the guidelines to make one?
18th January 2010, 01:05 PM |#5  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
I will not cook any further - this is why I released the kitchen. The strategies to save space are outlined in detail, so other cooks can take them and incorporate to their ROMs.
For me WM6 is sufficient - I don't need the "goodies" that came after that.
18th January 2010, 02:08 PM |#6  
Senior Member
Flag Lost
Thanks Meter: 30
Oh fine. Thanks anyway. What is the perceived space saved from this method? And is there any performance hit?

I've seen that UPX'ing has a lot of performance boost so I'm wondering whether it can be made only to the packages or is it applicable to the exe's and large dll's from the CABs too. Since there are a few applications, which even when added later, install to the device memory directly. In these cases, UPX'ing might be highly beneficial in reducing the size as well as giving a speed boost. Any info on this?
18th January 2010, 02:30 PM |#7  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
Well, indeed you may think that UPX-ing will decrease performance as the file must be decompressed before running - but the opposite is the case!
  1. you save space (most if installed, a little if in ROM - due to BINFS compression that is there anyway)
  2. you get faster file-read time: This pays for especially well for large files (opera, office, acrobat, TomTom and alike). This will by far gain more than you loose for decompression (which goes directly to memory).

Looking at usual read-speeds of about 1MB/sec and an assumed 10 times faster decompression speed to memory, my feeling is that for speed reasons it will pay best for LARGE files (card and memory installed). Mind that after the file is read and loaded to memory, still the application needs to initialize itself. The last step is the same, no matter if UPX-ed or not.

If you tweak the bits for memory saving on the device it is no harm for anything smaller as well. Usually I stop UPX-ing below 50kB in size, but to have the ROM fit in the MB-frame I wanted to achieve I also had to UPX some smaller files as well. Just compare the directories of Nitrogenious' kitchen release and mine.
19th January 2010, 12:56 AM |#8  
Senior Member
Thanks Meter: 9

Thanks for kitchen !

Sorry, I'm a novice in ROM cooking (I just modified a bit a ROM for my HTC Touch, long time ago, but I got no problem with flashing ROMS on HTC devices )
So I got a few questions/remarks.

1. I tried to build a custom ROM, but I got an error after selecting options.
I checked log file (a:\Torn\WORK\temp\log.txt) and I found following message :
Failed to parse value name HKEY_LOCAL_MACHINE\Software\\moBlue!!!
InitRegistry FAILED in file ".\Registry\37771312-772c-4ff9-a0a1-b555ad54a025.rgu" within a few lines of line 10.
ImportFromPackageListStrict: (RGUComp) !ERROR failed importing ".\Registry\37771312-772c-4ff9-a0a1-b555ad54a025.rgu"
wmain: (RGUComp) !ERROR failed building DEFAULT hives
If I uncheck "MoBlue", all is OK, so I think MoBlue package is corrupt.

2. When building with default option, what values to put in nb2nbf (CID and start address) ?
I used same as (82040000 for start adress and ORG_0401 for CID)
Is this OK?
(my phone is an Orange SPV600, CID unlocked, so I think I can put any value for CID)

3. I didn't really understand how to change ROM size. I checked your thread, but I'm still in the dark.
In nb2nbf, in size column, I got "33357824" = "0x13E20248".
So I used "format BINFS 014000000". Is the the way to go ?

Thanks for answers.
19th January 2010, 05:56 AM |#9  
Senior Member
Flag Lost
Thanks Meter: 30
Smile Answers!
1. Even I'm unsure about that.

2. Yes. Just select the OS option and it will fill the address by itself.

3. Yes. That is the method I follow. AFAIK, convert the bytes into it's hex equivalent and choose the nearest <higher> hex number with 5 0's at last.

And from what I understand from his post, if you have a ROM with 29.1 mb size, either reduce it to (29 mb - 64k) or add some apps and increase it to (30mb - 64k), to make the optimum use of the available space.
19th January 2010, 09:55 AM |#10  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
Hi AlainL,

...will have to look after the moblue part - strange, possibly the wrong format of the file (not unicode stored). The content should be ok. I fixed it after updating from the old moBlue inside the old kitchen to the 2.1 version copying the Registry content of the moBlue branch.

Regarding the address it is easy: when you select "OS" and click in the address field, the address is selected automatically - this is the right one.

Your assumption on the format BINFS <size> is correct. This is the way to format it. But your calculation is wrong. The Hex size of your value is 1FD0000 and thus you have to format with 2000000 or your device will not boot after flashing.
Last edited by tobbbie; 19th January 2010 at 12:25 PM. Reason: unicode instead utf-8
19th January 2010, 11:26 AM |#11  
tobbbie's Avatar
OP Senior Member
Flag Stuttgart
Thanks Meter: 245
The solution to the moBlue problem in the .rgu is very easy.
Edit the .rgu file and add a blank line at the end - that's all.

Read More
Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes