How to dump HTC Shift ROM

Search This thread

pof

Retired Moderator
Mar 18, 2005
3,571
74
43
Barcelona
pof.eslack.org
To dump Shift's CE ROM use itsutils from itsme:

LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
 85.88M (0x55e0000) FLASHDR
|           3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
|           3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
|          41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
|          37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee  3.50M (0x380000)
handle 2348c71e  3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw

DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb

To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend) :)
 

lucid

Senior Member
Dec 8, 2005
783
49
Amsterdam
www.reperion.com
Excellent

This is just too much good news in one day.

Will order the HTC Shift today as this is what we needed to know.

We see the HTC shift as the killer device for our software PocketReperion and
now we see a light at the end of the tunnel.

Will post a special WM6 Shift version of PocketReperion soon.

http://www.reperion.com/newclient
 

BallGor

Member
Apr 22, 2008
33
0
To dump Shift's CE ROM use itsutils from itsme:

LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
 85.88M (0x55e0000) FLASHDR
|           3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
|           3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
|          41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
|          37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee  3.50M (0x380000)
handle 2348c71e  3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw

DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb

To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend) :)

Sorry that I am not a technical guy, but I am really interested to revive my Shift. What is this for??
 

Blueangel69

Senior Member
Nov 24, 2006
96
5
46
Viseu
Help please

Hi ppl.Can anyone help me:confused:
Im looking to cook a ROM at my own taste/add some usefull Apps and flash it to my device,but is becoming a headake job to do"Wich gives me a empty OEM folder. And only .VM and .ROM in SYS folder wen i try to cook."Its consuming me a lot of time:(
Were can i get Pdocread.exe :confused:. It might be the solution.
Can someone help im a noobie,that feels very very nooooooobie,lol :eek:



Devices:HTC TyTN II SuperUnlocked_Trying to cook a live ROM 4 it.
:Qtek 9100 SuperUnloked { All thanks to Pof }
 

saiweb

Senior Member
Oct 25, 2006
310
0
Chesterfield, MO
Hi Blueangel69
In the very first post, pof mentioned that you have to download rapi tools (itsutils) from itsme.
>>To dump Shift's CE ROM use itsutils from itsme:

You will see pdocread.exe in that zip file.
 

gmarg

Member
Apr 19, 2008
14
0
Trying to dump my rom with itsutils but keep getting the message:
"could not update itsutils.dll to the current version, maybe it is in use? try restarting your device, or restarting active sync, or maybe your device is application locked".
I tried different versions of itsutils, delete itsutils.dll from windows directory in WM and try again but still getting the same message. Any ideas?????
My Shift is not hardSPL (maybe thats the problem?)


Edit: I hardSPL my sift and still getting the same message. I even tried 'pput itsutils.dll \Windows'. Any ideas?????
 
Last edited:

saiweb

Senior Member
Oct 25, 2006
310
0
Chesterfield, MO
Last edited:

arlub

New member
Jan 9, 2009
1
0
North Hills
Need Help.

I was able to dump all raw files except Part00.raw. I used the command prompt. Am I supposed to use another program or am I using the right one?
 

koala996

Senior Member
Sep 18, 2007
477
0
Bruxelles-Brussels
hey I got an error when doing the 4th raw :

"ERROR: ITReadDisk : read 00000000 bytes - Adresse de bloc de contrôle de stockage non valide."
(storage control's bloc address is not valid)

I have the 4 raws created and the 4th has the size : 37.7MB (39.583.744 bytes)

edit : sorry was stupid yesterday.... in fact the size of Part02 and Part03 were not the same as you Pof.... so I just needed to change that :)
well... doing it again ! in Windows 7 :p
 
Last edited:

leonlsl

New member
Mar 5, 2009
4
0
To dump Shift's CE ROM use itsutils from itsme:

LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
 85.88M (0x55e0000) FLASHDR
|           3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
|           3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
|          41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
|          37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee  3.50M (0x380000)
handle 2348c71e  3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw

DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb

To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend) :)

I have dumped all the raw files, howere I can't reconstrct a rome in NBH by the above instructions same for Kaiser.
 

Tplane37

Senior Member
Dec 6, 2008
233
1
Code:
 pmemdump -p -f 0x00000000 > SPL.bin.txt

This show the bytes for my device in the text file below, I am having issues locating a decent guide to dump the bootloader. I am trying to dump the bootloader off my stock Sprint Touch Pro 2. The rest of the process in the first post was perfect for getting the RAW files, I have them split to SYS, OEM, EXT, and XIP. Now, I just need a little guidance dumping the bootloader and dumping <Part00.raw> and <Part03.raw> into useable files.

Can anyone help out on this, I have found the start length on the pmemdump.exe (simple enough, start at the beginning...I think). But in the first post, there was a number after the start length...is this the same across the board? If not, how do we determine what this number should be? How should we determine the start length? Or will starting at 0x00000000 be okay?

Feel free to PM me about this since this is not a thread for the Touch Pro2...but it has been the most helpful thread so far for dumping the stock ROM off this thing to have around for backup purposes.:cool:
 

Attachments

  • SPL.bin.txt
    1.2 KB · Views: 50