Tutorial to port sys (update to NoDo)
Ok guys, I donít know why DFT havenít release an update for HD2 earlier since it take only few days to a noob to achieve a working NoDo rom. Their first version was built on a test rom with developerís certificates from Microsoft and HTC, debug tools, recompiled drivers for HD2 and a method to build SLDR and NK sections. They had before everybody a test version of Mango too. So I suppose they, or only one, is working for HTC or has good contacts and perhaps had a commercial interest or was more interested by the exploit than giving users a great experience of WP7 on HD2, updates as soon as itís possible and tools/knowledge to members like ervius, AnDim, Nokser etc. to achieve that by themselves. Someone in another post suggest an agreement not to release their mango before the 24th, itís quite possible. But I donít know and I donít blame, itís life lol
Perhaps weíll see a version of Mango for HD2 soon (and new exiting videos^^í) but since a lot of people are waiting for NoDo (some desperate posts made me cry XD) Iíll give you a first version, and better, the method to achieve that by yourself for the next coming.
!The trip isnít how to flash an HD7 rom on HD2 like certain people seems to believe and we donít need a new malgr for the moment!
What you need:
PS: open roms with an archive tool like 7-Zip and take the RUU_signed.nbh file, we only need this.
1. A new radio: (optional)
The radio is the part00.bin
in the Data.zip
With HTCrie open the nbh which contains the radio you want, select GSM and extract the GSM.nb
Open it with an hex editor and search for 7F 45 4C 46 01 01 01 61, itís the beginning of the part we need. The end is the series of 00 just after the last AMSS string you can find (refer to DFT part00.bin if you need help).
Keep only this section (delete the rest) and add some 00, for example if the files ends at the byte e004d0h go to e004ff.
Save the file, rename it part00.bin, youíll have your new radio (in this case 5.66.09.21a).
Replace it in the Data.zip, you can flash now with DWI to test it.
Youíll show the new version in the Settings/About of WP7.
2. Change The SYS by 7392 Step 1: Common packages
With HTCrie open the nbh which contains the 7392 SYS build (or another you want), extend OS/IMGFS and select SYS
. Extract it to a folder.
Do the same for other rom(s) containing extra languages in another folder.
Add the extra *_LANG_0XXX packages from the second directory to the first, after that you can delete it (the second folder lol, if only English was my native language^^).
You can use NabSync
packages or not, if not delete them, just remember youíll not need to add MOS entries in default.hv in this case.
Put the metadata package in another place, weíll use it in step 2.
Put the content of all other packages in a new folder (for ex called IMGFS), with HTCRIE open the same 7392 rom, extend OS and in IMGFS content select .ROM
modules, extract them in your IMGFS folder.
Itís your new SYS.
You could past/overwrite it in DFT IMGFS and build the rom now it will function (the DFT video of March) and YES itís as simple as that, youíll have new stuff from NoDo like copy/paste but not the possibility of Hidden Wi-Fi since it depend of OEM packages.
PS: Itís possible since there isnít many changes in NK and SLDR sections made by NoDo, so we can use like that. dsm files are not very important (just to have good references of packages) and rgu content is added in default.hv
Modules that need to be updated are:
- NK: cachefilt.dll, hd.dll and osaxst0.dll
- SLDR: exfat.dll, filesys.dll, k.coredll.dll, k.fatutil.dll, kernel.dll, mtpuldrsvc.dll, pm.dll, sdbus.dll, sdmemory.dll and unifiedblock.dll
3. Change The SYS by 7392 Step 2: metadata package
With HTCrie extract the metadata
package of the SHUBERT rom which contains OEM that you need, so we have to play with 3 metadata packages: DFT, SHUBERT OEM, MOZART SYS.
It could be a little simpler if we have a 7392 rom for SHUBERT but not for the moment.
Some files need to be updated, first is BasePolicy.xml
, compare the new content of MOZART with DFT one, same for SCHUBERT (replace C:\WM700\release\LEO and C:\WM700_7392\release\MOZART by C:\WM700_7392\release\SCHUBERT). If you find new entries and you judge them useful (refer to dsm and find the package) then add them in MOZART one (itís the most important for SYS).
Second is DefaultCerts.dat
, these files contain certificates. In hex each one begin with 30 82 ?? ?? 30 82 so you can cut this file in x parts, one for each certificate.
The common build is Microsoft root, oem roots, Microsoft Windows Mobile PCA0, oem, Microsoft Mobile Device Unprivileged PCA0.
Weíll keep DFT one as bas as itís include Qualcomm infrastructure development
, Microsoft Corporation CE Image Update Test
, useful for later (we never know^^). DFT has included HTC_Develop_Test twice (like in dsm beside Microsoft Corporation CE Image Update Test) so you can remove the second.
What you need is to take DefaultCerts.dat from other metadata packages, extract OEM 168
or/and OEM 169
(personally Iíve included both from other roms so Iíll never have to touch this file again) and insert oem/oem root certificates in DFT one.
are certainly updated but you can edit them with Imageinfo.bin, packages.cif/sof Tool.
Compare the imginf.txt
you obtain for each roms you use (you can sort this file to make it more simple).
Like with BasePolicy.xml, if there is an entry that you judge useful, just add it in packages.cif and .sof (refer to this toolís post in forum to know how use it well, but itís quite simple).
The last two files but more important are default.hv
To edit them just drag them onto HVEdit.exe by AnDim, youíll obtain default.hvm
which can be edited like rgu files.
To rebuild hv just drag hvm onto HVEdit.exe
I suggest keep the 7392 ones as base, compare them with DFT originals and modify entries you want.
For some you need a little knowledge (refer to forum) but for most itís language entries and some tweaks.
You can refer to rgu files which differ and take a look at NoDo and 7392 pku to know which files/rgu are concerned (see forum to know how obtain pku for each zune update
and extract them but donít use files as they are in your build since most of them are not suitable (except dsm), they only contain information to update files/modules)
You can add for exemple your LiveID
useful for HD2 users:
Copy the content of the new metadata package in your IMGFS folder. Now you have a fully functional SYS that you can use instead DFT one
Let see OEM packages.
4. Change OEM packages Step 1: common packages
With HTCrie extract in two folders (like for SYS before) the OEM
packages, one for DFT (for most youíll find them at the wrong place: in SYS - like for most of TEST roms you can find) the other for the rom with most updated HTC packages.
You donít need HTC_8x50_OS_UI_LEO
as we replace it by HTC_8x50_OS_UI_SCHUBERT
You donít need StartKitl and kitl.dll from DFT as itís debug tool (weíll see later) and HTC_CSPOSDrivers
is new stuff so donít search it in DFT rom.
Other packages which can be used without modification beside HTC_CSPOSDrivers are CSConn_DB
so just delete them like for HTC_8x50_OS_UI_LEO in DFT folder to see more clearly.
5. Change OEM packages Step 2: updated packages
Like Iíve said we could use DFT OEM packages as they are but we wonít have new stuff from HTC like Hidden Wi-Fi. So we have to update some modules.
We could update the most of them (certain drivers are HD2 specific) but since we canít update NK/SLDR sections for now youíll got some troubles (Iíll speak of that later).
So for each package we change all files,rgu and dsm but we have to keep some modules from DFT.
- For HTC_AppDrivers and HTC_OSDrivers donít keep anything (so delete them from DFT folder) but remove HTCConnectionSetUp.dll since it is in SLDR and have some dependencies so youíve got some troubles to connect secure wifi networks.
- For HTC_8x50_OS_UI_COMMON, OEM_8x50_OS, QC_8x50_OS_GPS, QC_8x50_OS_MMRIL overwrite all modules with DFT ones
- For HTC_8x50_OS_WIRELESS overwrite all modules. wl_server_serial.dll and wlan_oem.dll were files, we need updated ones in modules from new oem package for HTC Hidden Wi-Fi, the other thing to do is to verify in default.hv that BtOem, RSS and WLANOEM entries are in HKEY_LOCAL_MACHINE\Drivers\BuiltIn\ sections like in new roms and not in HKEY_LOCAL_MACHINE\Services\ like DFTís one (and never both) otherwise it wonít work.
- For OEM_8x50_OS_CAMERA replace modules and add camerasettingsmanifest.0XXX.xml from DFT in new one (since these files are normally in SLDR in new roms we have to add them). Use DSM editor to edit c6158f86-ef71-4a8b-8c04-0cf57c158b2f.dsm and add entries for these files (refer to this toolís post to know how use it but itís easy too).
- For OEM_8x50_OS_SURF replace all modules. But you donít have to add Backlightmdd_htc_6541.dll, just be sure you have backlightmdd.dll instead in default.hv like in new roms.
- For QC_8x50_OS replace modules. You have to delete windiag.dll or verify in default.hv that ďdllĒ=Ēwindiag.dllĒ is replaced by ďdllĒ=ĒĒ like in new roms.
6. Change OEM packages Step 3: extra packages (optional)
contain OEM software.
You can add from different roms and operators. Just add the *.xap
and * _License.xml
you want, edit mpap_HTC_MASD_01.provxml
to add/have only entries for these files and use DSM editor to edit 47c557c0-08b2-493c-a380-08c72d78e3ba.dsm
and update the list of files in this package.
contain the HTC or Operator personalization files. Like for OEMAPPS, keep/add what you want from different roms, Email accounts/providers, Browser favorites are useful, MNS_Cust_xxx too, Iíve personally built a new theme with transparency called Aero, added the entries in the default.hv and add the 02XX*.xaml in this package.
A picture with transparency in png format for the lockscreen too.
After use DSM editor to edit 438abf0c-b691-4259-a742-1f224fa3b5ba.dsm
You can add developer stuff/kitl and HTC tools packages too: AutoDeviceConfig, CommsDogfood, CoreOSDogfood, dogfoodDM, EtwChannelDefaultInternal, KitlShell, LoaderVerifierTestCerts, NetDrvVMINI, QC_8x50_OS_TEST, SensorView, SirepForPlatDev, StartKitl, TouchTools
Extract them from a test rom and add the content and entries in default.hv you find in rgu files.
HTC_TEST tools are xap files: DebugFlagEdit, GCFSettings, HTC BATTERY TOOL, HTCGPSTool, RegisterEdit, StopWatch, StressTool, USBModeSwitch
. Refer you at the HTC_OEMAPPS explanations.
You have finished the job with OEM part, just extract the content of each of these packages in your IMGFS folder.
7. Wi-Fi problems: (optional)
Some people had some troubles with the old roms and wifi. In forum most were speaking about the SD-card but it didnít solved the problem (and gone back to android^^).
Itís not the only problem. If you examine the file nvram.txt
which is used to enable the built-in wifi chip there are some differences between files from DFT, HD2 3.14, SCHUBERT operators.
EDIT: macaddr=00:11:22:33:44:55 in its file seems the place to put a mac adress for routers with some mac filters.
I list it below, so i use a mix from HD2. When I was using the original, I didn't reached secured networks, I had to remove battery for hours.
DFT: SCH:TMOUS/WWE/TIM/O2UK HD2 3.14: SCH:eek:range + MOZ:eek:2UK
boardrev=0x32 boardrev=0x36 boardrev=0x32 boardrev=0x36
pa0b0=5747 pa0b0=6003,6003,5576 pa0b0=6003 pa0b0=5552
pa0b1=64128 pa0b1=64086,64086,64172 pa0b1=64086 pa0b1=64245
pa0b2=65195 pa0b2=65195,65195,65155 pa0b2=65195 pa0b2=65200
pa0maxpwr=72 pa0maxpwr=82 pa0maxpwr=72 pa0maxpwr=78
mcs2gpo0=0x6666 mcs2gpo0=0xAAAA mcs2gpo0=0x6666 mcs2gpo0=0xCCCC
mcs2gpo1=0x6666 mcs2gpo1=0xAAAA mcs2gpo1=0x6666 mcs2gpo1=0xCCCC
rssismf2g=0xa rssismf2g=0xa,0xa,0xa rssismf2g=0xa rssismf2g=0xa,0xa,0xa
rssismc2g=0xb rssismc2g=0xb,0xb,0xa rssismc2g=0xb rssismc2g=0xb,0xb,0xa
rssisav2g=0x3 rssisav2g=0x3,0x3,0x3 rssisav2g=0x3 rssisav2g=0x3,0x3,0x3
rxpo2g=2 rxpo2g=1 rxpo2g=2 rxpo2g=0
I suggest to modify this entries in default.hv too
8. Build your rom:
"11nModeDisable"=dword:0 ; Wifi n
"PowerSaveMode"=dword:0 ; 0: Best Performance 1: Best Batterry 2: Between
"IBSSMode"="0" ; set the connection type in an ad hoc network (b/g)
"LegacyPowerCycle"=dword:0 ; new rom entry
"FrameBursting"="1" ; communication protocol (higher data transfer throughput)
All this process can be found in the forum for more explanations:
Rename the your IMGFS folder to dump (yes you could have done it at the beginning^^) with HTCrie open the part04.bin from DFT you find in Data.zip, select IMGFS and extract IMGFS.bin
With ImgfsFromDump recompile the new IMGFS, the command line is: ImgfsFromDump imgfs.bin imgfs-out.bin
With HTCrie replace the IMGFS in part4.bin: select IMGFS, click on add files, choose imgfs-out.bin, it take only few seconds.
Replace part04.bin in Data.zip by the new one and flash it with DWI, youíve got it!
If you like my work, donít pay me a beer, donít thank me but just send as much ďMISS UĒ as you want to +33 682732382 (France)