NBH file format used in Hermes ROM updates
The Hermes Original shipped ROMs contain a single .nbh file in the ROM Update Utility instead of the usual .nbf files found in other HTC ROM updates.
Information to understand NBH format:
- All files start with "R000FF\n", next 16 bytes of what appears to be random data.
- After that it consists of several blocks.
Each block starts with a header:
- After that follows the actual data (block-length bytes)* a signature.
- the last block has flag == 2, and only contains a signature of the overall signature count.
NBH files usually contain several ROM parts:
|0x100||IPL||Part of bootloader|
|0x200||SPL||Part of bootloader|
|0x400||CE OS Image||Windows Mobile|
|0x600||MainSplash|| First boot splash screen|
|0x601||SubSplash||Second boot splash screen (normally the same image as the MainSplash)|
List of known header types: NBH_headertypes
Extracting the .nbh files
The rom contents can be extracted using: NBHextract
C:\> NBHextract.exe hermimg_HTCWWE_22.214.171.124_Ship.nbh === NBHextract v1.0 === Extract contents from HTC NBH files === (c)2007 xda-developers.com === by: pof & TheBlasphemer based on itsme perl scripts Device: HERM200 CID: QTEK_001 Version: 126.96.36.199 Language: WWE Extracting: 00_IPL.nb Extracting: 01_SPL.nb Extracting: 02_GSM.nb Extracting: 03_MainSplash.nb Encoding: 03_MainSplash.bmp Extracting: 04_SubSplash.nb Encoding: 04_SubSplash.bmp Extracting: 05_ExtROM.nb Extracting: 06_OS.nb C:\>
It is also possible to extract them using itsme perl scripts:
- nbh2dbh.pl script to remove the signature wrapper
- dbhdecode.pl script to extract components from the dbh file
See demo termcast here.
The following commands will extract the rom into separate files:
perl nbh2dbh.pl nksigned.nbh nksigned.dbh > signatures.txt
perl dbhdecode.pl nksigned.dbh
perl splsplit.pl spl.nb spl.nbx
mv spl.nbx spl.nb
gsmsplit gsm.nb gsm.nbx
mv gsm.nbx gsm.nb
perl dumpxip.pl -d . os.nb > xip.txt
perl rdmsflsh.pl -d files OS.nb > rd.txt
gsmsplit is this windowsbatch file:
@echo off if "%2"=="" goto err split -b 327680 %1 _bcl for %%i in (_bcl*) do [http://bcl.sourceforge.net/ bcl] d %%i _x%%i.nb del _bcl* copy /b ''x''bcl*.nb %2 del ''x''bcl* goto end :err echo need 2 args :end
note that bcl.exe has been renamed to bfc.exe in the latest bcl release
For further discussion see related forum thread.