Beta: WM5 ROM editing tool

Search This thread

mamaich

Retired Recognized Developer
Apr 29, 2004
1,150
228
mamaich-eng.blogspot.ru
I've made a set of tools that can assist in cooking your own WM5 ROMs. These tools were tested only on BlueAngel devices. They should also work on Himalaya. Universal and Wizard support is also present, but it is untested, so the tools may crash or turn your device into brick. But it is possible to extract files from universal/wizard ROMs and use them on other devices.

I've attached 2 archives - make_hv.rar, a tool from Platform Builder that can be used to recreate .HV files (they contain default and boot registry), and imgfs_tools.rar - these tools should be used to edit WM5 IMGFS partition.
With these tools and http://xdaforums.com/viewtopic.php?t=33321 (it can edit WM5 boot XIP partition) it is possible to replace/add/delete any file in WM5 ROM.

Usage:
Code:
prepare_imgfs.exe
  Splits nk.nba into imgfs_raw_data.bin and imgfs_removed_data.bin.
imgfs_raw_data.bin - contains raw IMGFS data
imgfs_removed_data.bin - contains extra data (something like FAT table).
Usage:
  prepare_imgfs.exe nk.nba [-nosplit] [-mpx200] [-acer]
Use "-nosplit" for HTC Wizard and Universal ROMs that don't contain extra 
blocks of data. In this case imgfs_removed_data.bin would be empty.


make_imgfs.exe
  Reverse of prepare_imgfs. Combines imgfs_raw_data.bin and imgfs_removed_data.bin
into nk.nba file. Use -nosplit if it was specified for prepare_imgfs.exe.
Usage:
  make_imgfs.exe nk.nba [-nosplit]
The nk.nba file would be used as a template, its contents would be overwritten.


viewimgfs.exe
  Dumps the contents of imgfs_raw_data.bin to "dump" subdirectory. Files are 
dumped as is, modules as directories. File time and attributes are preserved.
If RecMod.exe is present in the current directory, all modules are 
reconstructed as working DLLs/EXEs and placed in the corresponding subdirectory.
Tool creates dump_MemoryMap.txt with address ranges occupied by modules.
Usage:
  viewimgfs.exe imgfs_raw_data.bin

RecMod.exe
  Reconstructs a module dumped as directory to a working state. Rebuilds 
relocations information, and tries to guess section names.
Usage:
  RecMod.exe [path to module directory]


BuildImgfs.exe
  Reverse of viewimgfs. Reconstructs imgfs_raw_data.bin and imgfs_removed_data.bin
from files in "dump" directory. Overwrites contents of imgfs_raw_data.bin/imgfs_removed_data.bin
files. Does not check for errors or end of free space. Approximate free space
left is displayed when program is finished. In case of error contents of bin
files is undefined.
Usage:
  BuildImgfs.exe
It would overwrite imgfs_raw_data.bin/imgfs_removed_data.bin in current directory.


DelFile.exe
  Deletes one file or module from imgfs_raw_data.bin. Wildcards are not supported.
Usage:
  DelFile.exe filename.ext
Uses imgfs_raw_data.bin from current directory. Does not check for errors.


AddFile.exe
  Adds one file to imgfs_raw_data.bin. Would reuse space freed by DelFile.
Usage:
  AddFile.exe filename.ext
Uses imgfs_raw_data.bin from current directory. Does not check for errors.


The typical process should be:
prepare_imgfs.exe nk.nba
viewimgfs.exe imgfs_raw_data.bin
...modify "dump" directory as you need...
BuildImgfs.exe
make_imgfs.exe nk.nba

or
prepare_imgfs.exe nk.nba
DelFile.exe filename.ext
AddFile.exe filename.ext
...you may add/delete as many files as you need...
make_imgfs.exe nk.nba


Of cause you'll need a tool to convert NBF<->NBA files. SD-card images can be also used instead of NK.NBA file, but this was not tested!
Troubleshooting.
In case of invalid ROM the tools would crash without saying anything. In this case they may destroy the contents of input files.

Use these tools at your own risk! They may make your device completely unusable! Always make an SD-card backup of your ROM and Extrom!
The worst case I had during tests was complete destroying of DOC partition on my device. I had to flash WM2003 OS, repartition DOC from there and this fixed the device. Of cause this method cannot be used on Wizard or Universal.

I've published these tools so that someone could integrate BA patches into a ROM or play with cooking own ROMs.


edited 12.12.2005. AddFile/BuildImgfs should work on Universal/Wizard ROMS (i.e. roms with empty imgfs_removed_data.bin file).

edited 15.01.2005. Fixed a major bug found by TofClock. Short name of files with filename length 24 chars or longer (like "instmsgrresources.96.dll") was incorrectly generated and in some cases they were inaccessible by OS.

edited 05.02.2005. Added several checks so that viewimgfs.exe does not crash on incorrectly patched ROMs (MPX200). Don't use buildimgfs.exe on such ROMs.

edited 30.03.2006. Added RecMod tool that reconstructs modules dumped as directories to a working DLL. So reusing modules from other ROMs is now much easier. Added updated prepare_imgfs.exe with support of ACER N300 ROM (thanks to Tuatara).

edited 12.07.2006. Added source code of prepare_imgfs/make_imgfs tools, so anyone can add the support of new devices.

edited 25.10.2006. Published the source code on my site. The code is ugly and is not commented at all. Don't ask me how to compile or use it!


I've stopped working on this project. There would be no updates.
Complete source code is available on my site.
 

Attachments

  • make_hv_111.rar
    54.2 KB · Views: 18,965
  • imgfs_tools_182.rar
    123.1 KB · Views: 109,242
  • prepare_imgfs_src.rar
    1.4 KB · Views: 11,478
Last edited:
  • Like
Reactions: Vervol

baniaczek

Senior Member
Jul 1, 2005
351
2
Warsaw
Looks nice :)

Some questions:

1. AddFile:
Can I add single file like
Code:
AddFile something.exe
or have I use 'modules as directories' [like directories dumped with ViewImgfs]

2. AddFile:
Is it possible to add files into directories not in \Windows? For example: "\Program Files\Something\something.exe"

3. Is it possible to modify the kernel? Can I extract and replace \Windows\fatfsd.dll?

Thanks in advance.
 

efjay

Senior Member
Nov 18, 2004
1,549
64
mamaich, would for example replacing the internet explorer exe be enough to get it to render gifs correctly? Or are extra dll needed? Also is it necessary to use the other tool you linked to as it appears your tool can add and delete files itself? thanks

Edit: Forgot to add, thanks for your hard work.
 

mamaich

Retired Recognized Developer
Apr 29, 2004
1,150
228
mamaich-eng.blogspot.ru
baniaczek said:
1. AddFile:
Can I add single file like
Code:
AddFile something.exe
You can use both methods, but subdirs can be used only if you are really know what you are doing (i.e. you know all addresses of each section and 100% sure that they don't overlap some other modules and you've edited .VM and .ROM files). In most cases you should add EXE/DLL files as normal files.
Is it possible to add files into directories not in \Windows? For example: "\Program Files\Something\something.exe"
All files are placed into \windows dir and then moved by coldinit to subdirs according to instructions in initflashfiles.dat. Of cause you can modify that file as you like.
3. Is it possible to modify the kernel? Can I extract and replace \Windows\fatfsd.dll?
Boot part can be edited with http://xdaforums.com/viewtopic.php?t=33321

ramram
There is no ROM I can release for public testing. I would not integrate my patches into the ROM, I'm working on adopting Wizard's ROM for our devices. But everything is on too early stage, I have to combine registry settings, ROM files, find and patch drivers for ROMs to work, etc. And Wizard's ROM is larger than ours, some files should be removed.
 

ramram

Senior Member
Mar 29, 2004
481
4
www.xda-developers.com
Ic

mamaich,
I'll wait you then until you finish the wizard rom adoptation, I'll be glad trying it on the BA if you don't mind, consider my device for development purpose and beta testing if needed.

Concernig the IE, I have the same problems as Efjay mentioned earlier.
Thank you
 

efjay

Senior Member
Nov 18, 2004
1,549
64
mamaich said:
efjay said:
mamaich, would for example replacing the internet explorer exe be enough to get it to render gifs correctly? ...
I don't have any problems with IE.

mamaich, the problem is with viewing gif files. On this site using PIE i cannot see the quote button and other buttons below a post. Even manually opening a gif file on the BA opens PIE with a blank page.
 

zohaer21

Senior Member
Nov 23, 2004
613
23
how about buzz if you can with your know how get a bare minimum rom version of universal not having alot of crap like the various silly tsk files and other pictures and videos that serve as demos on the rom and not do anyting else..im sure alot of us use our own file explorers (resco,tc) so that can be removed aswell.. what do you think...??/
 

thanh_lam

Member
Sep 7, 2005
26
0
zohaer21 said:
can you use nk.nbf? how can i convert nk.nbf into nk.nba????
you can use this tool xda3nbftool.exe download from ftp for BA or Xda2nbftool.exe for Himalaya.

@Maimach
All the module files are Directory ??? How can I use these for my purpose ? But it Great work Maimach , go on!!!!!!
 

efjay

Senior Member
Nov 18, 2004
1,549
64
I tried to use this tool to add two modules and then flash the finished nbf file but i get an error file is corrupt if i use BaUpgradeUt.exe. If i use MaUpgradeUt_noID.exe it seems to initialise but no rom info is shown on the upgrade screen. Continuing the rom upgrade nothing then happens then a message comes up that the upgrade is finished. Soft reset and back to normal. I followed mamaichs instructions and everything seemed to go ok. Any idea why it didnt work for me?
 

KTamas

Senior Member
Sep 2, 2004
813
3
Yeah, go Mamaich, you rock. After the Wizard ROM on the BA, the next step could be a complete ROMkitchen (á lá Wallaby...).
 

KTamas

Senior Member
Sep 2, 2004
813
3
Stupid question, where can I find the NBF<->NBA converter? (Yes, i did search the forums)
 

gimpdog

Member
Jul 10, 2005
32
1
@efjay
did you use the -sd -sl -so and the -c -u options in xda3nbftool? Thats where i went wrong first time.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I've made a set of tools that can assist in cooking your own WM5 ROMs. These tools were tested only on BlueAngel devices. They should also work on Himalaya. Universal and Wizard support is also present, but it is untested, so the tools may crash or turn your device into brick. But it is possible to extract files from universal/wizard ROMs and use them on other devices.

    I've attached 2 archives - make_hv.rar, a tool from Platform Builder that can be used to recreate .HV files (they contain default and boot registry), and imgfs_tools.rar - these tools should be used to edit WM5 IMGFS partition.
    With these tools and http://xdaforums.com/viewtopic.php?t=33321 (it can edit WM5 boot XIP partition) it is possible to replace/add/delete any file in WM5 ROM.

    Usage:
    Code:
    prepare_imgfs.exe
      Splits nk.nba into imgfs_raw_data.bin and imgfs_removed_data.bin.
    imgfs_raw_data.bin - contains raw IMGFS data
    imgfs_removed_data.bin - contains extra data (something like FAT table).
    Usage:
      prepare_imgfs.exe nk.nba [-nosplit] [-mpx200] [-acer]
    Use "-nosplit" for HTC Wizard and Universal ROMs that don't contain extra 
    blocks of data. In this case imgfs_removed_data.bin would be empty.
    
    
    make_imgfs.exe
      Reverse of prepare_imgfs. Combines imgfs_raw_data.bin and imgfs_removed_data.bin
    into nk.nba file. Use -nosplit if it was specified for prepare_imgfs.exe.
    Usage:
      make_imgfs.exe nk.nba [-nosplit]
    The nk.nba file would be used as a template, its contents would be overwritten.
    
    
    viewimgfs.exe
      Dumps the contents of imgfs_raw_data.bin to "dump" subdirectory. Files are 
    dumped as is, modules as directories. File time and attributes are preserved.
    If RecMod.exe is present in the current directory, all modules are 
    reconstructed as working DLLs/EXEs and placed in the corresponding subdirectory.
    Tool creates dump_MemoryMap.txt with address ranges occupied by modules.
    Usage:
      viewimgfs.exe imgfs_raw_data.bin
    
    RecMod.exe
      Reconstructs a module dumped as directory to a working state. Rebuilds 
    relocations information, and tries to guess section names.
    Usage:
      RecMod.exe [path to module directory]
    
    
    BuildImgfs.exe
      Reverse of viewimgfs. Reconstructs imgfs_raw_data.bin and imgfs_removed_data.bin
    from files in "dump" directory. Overwrites contents of imgfs_raw_data.bin/imgfs_removed_data.bin
    files. Does not check for errors or end of free space. Approximate free space
    left is displayed when program is finished. In case of error contents of bin
    files is undefined.
    Usage:
      BuildImgfs.exe
    It would overwrite imgfs_raw_data.bin/imgfs_removed_data.bin in current directory.
    
    
    DelFile.exe
      Deletes one file or module from imgfs_raw_data.bin. Wildcards are not supported.
    Usage:
      DelFile.exe filename.ext
    Uses imgfs_raw_data.bin from current directory. Does not check for errors.
    
    
    AddFile.exe
      Adds one file to imgfs_raw_data.bin. Would reuse space freed by DelFile.
    Usage:
      AddFile.exe filename.ext
    Uses imgfs_raw_data.bin from current directory. Does not check for errors.
    
    
    The typical process should be:
    prepare_imgfs.exe nk.nba
    viewimgfs.exe imgfs_raw_data.bin
    ...modify "dump" directory as you need...
    BuildImgfs.exe
    make_imgfs.exe nk.nba
    
    or
    prepare_imgfs.exe nk.nba
    DelFile.exe filename.ext
    AddFile.exe filename.ext
    ...you may add/delete as many files as you need...
    make_imgfs.exe nk.nba
    
    
    Of cause you'll need a tool to convert NBF<->NBA files. SD-card images can be also used instead of NK.NBA file, but this was not tested!
    Troubleshooting.
    In case of invalid ROM the tools would crash without saying anything. In this case they may destroy the contents of input files.

    Use these tools at your own risk! They may make your device completely unusable! Always make an SD-card backup of your ROM and Extrom!
    The worst case I had during tests was complete destroying of DOC partition on my device. I had to flash WM2003 OS, repartition DOC from there and this fixed the device. Of cause this method cannot be used on Wizard or Universal.

    I've published these tools so that someone could integrate BA patches into a ROM or play with cooking own ROMs.


    edited 12.12.2005. AddFile/BuildImgfs should work on Universal/Wizard ROMS (i.e. roms with empty imgfs_removed_data.bin file).

    edited 15.01.2005. Fixed a major bug found by TofClock. Short name of files with filename length 24 chars or longer (like "instmsgrresources.96.dll") was incorrectly generated and in some cases they were inaccessible by OS.

    edited 05.02.2005. Added several checks so that viewimgfs.exe does not crash on incorrectly patched ROMs (MPX200). Don't use buildimgfs.exe on such ROMs.

    edited 30.03.2006. Added RecMod tool that reconstructs modules dumped as directories to a working DLL. So reusing modules from other ROMs is now much easier. Added updated prepare_imgfs.exe with support of ACER N300 ROM (thanks to Tuatara).

    edited 12.07.2006. Added source code of prepare_imgfs/make_imgfs tools, so anyone can add the support of new devices.

    edited 25.10.2006. Published the source code on my site. The code is ugly and is not commented at all. Don't ask me how to compile or use it!


    I've stopped working on this project. There would be no updates.
    Complete source code is available on my site.
    1
    Topogigi said:
    Hi Mamaich,

    Firstly I want to thank you very much for your great work.

    I tried to use your rom tools, and I can successfully extract all the files from the Universal WWE rom set. But whenever I try to add a file with addfile.exe or build the imgfs back, Windows XP reports an error and then your software hangs. I think that this could have something to do with the dll that makes file compression (cecompr_nt.dll). Am I missing something? Perhaps I have to install something more before launching buildimgfs?
    Universal is not tested. I'll look at its ROM when I'll have time. Its format may differ from BA/Hima.
    Maybe you've added too many files? My program don't check for a free space and would crash.
    1
    @KTamas

    your .rgu format is wrong

    MS-Editor "Save As..." and select Unicode
    1
    hdubli said:
    I hv dump(from mamaich tool) for Atom...and want to extract or locate Media Plus App...Can anyone tell me how to find..I hv checked the modules..but it is unclrear...files do not contain anything related to media plus.
    This application may be in extended ROM. So look there for a CAB file.
    1
    Mamaich,

    Looking at imgfs_removed_data.bin in hex we have 0x82 blocks of 0x1000 bytes looking approximately like one below,

    80 04 00 00 FF FF FB FF 81 04 00 00 FF FF FB FF 82 04 00 00 FF FF FB FF 83 04 00 00 FF FF FB FF 84 04 00 00 FF FF FB FF 85 04 00 00 FF FF FB FF 86 04 00 00 FF FF FB FF 87 04 00 00 FF FF FB FF 88 04 00 00 FF FF FB FF 89 04 00 00 FF FF FB FF 8A 04 00 00 FF FF FB FF 8B 04 00 00 FF FF FB FF 8C 04 00 00 FF FF FB FF 8D 04 00 00 FF FF FB FF 8E 04 00 00 FF FF FB FF 8F 04 00 00 FF FF FB FF 90 04 00 00 FF FF FB FF 91 04 00 00 FF FF FB FF 92 04 00 00 FF FF FB FF 93 04 00 00 FF FF FB FF 94 04 00 00 FF FF FB FF 95 04 00 00 FF FF FB FF 96 04 00 00 FF FF FB FF 97 04 00 00 FF FF FB FF 98 04 00 00 FF FF FB FF 99 04 00 00 FF FF FB FF 9A 04 00 00 FF FF FB FF 9B 04 00 00 FF FF FB FF 9C 04 00 00 FF FF FB FF 9D 04 00 00 FF FF FB FF 9E 04 00 00 FF FF FB FF 9F 04 00 00 FF FF FB FF A0 04 00 00 FF FF FB FF A1 04 00 00 FF FF FB FF A2 04 00 00 FF FF FB FF A3 04 00 00 FF FF FB FF A4 04 00 00 FF FF FB FF A5 04 00 00 FF FF FB FF A6 04 00 00 FF FF FB FF A7 04 00 00 FF FF FB FF A8 04 00 00 FF FF FB FF A9 04 00 00 FF FF FB FF AA 04 00 00 FF FF FB FF AB 04 00 00 FF FF FB FF AC 04 00 00 FF FF FB FF AD 04 00 00 FF FF FB FF AE 04 00 00 FF FF FB FF AF 04 00 00 FF FF FB FF B0 04 00 00 FF FF FB FF B1 04 00 00 FF FF FB FF B2 04 00 00 FF FF FB FF B3 04 00 00 FF FF FB FF B4 04 00 00 FF FF FB FF B5 04 00 00 FF FF FB FF B6 04 00 00 FF FF FB FF B7 04 00 00 FF FF FB FF B8 04 00 00 FF FF FB FF B9 04 00 00 FF FF FB FF BA 04 00 00 FF FF FB FF BB 04 00 00 FF FF FB FF BC 04 00 00 FF FF FB FF BD 04 00 00 FF FF FB FF BE 04 00 00 FF FF FB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .......
    always ending with
    FF FF FF FF FF FF FF FF 06 21 55 C1 D5 29 9C DF B8 EA B8 BA F3 F9 D3 82 47 8A 43 3B E6 2A D9 A9 31 67 39 09 53 67 BF 12

    followed by 0x164 empty blocks (FFs),(TFAT16?)

    then followed by 2 blocks of interchanging multiple FFs and multiple B2 BA sequences looking like this

    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A B2 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

    and ending with the last 1 block of 0x00-s.

    At this point my conclusions are:
    1. there are 0x82 sequential x40000 blocks of data - so, there no hole in this ROM.
    2. last block of 00 is probably signalling the end of ROM or end of TFAT.

    What the 2 blocks with 2AB2 stand for, maybe remainder of FAT TABLE?

    What those 504 bytes long sequences of

    80 04 00 00 FF FF FB FF 81 04 00 00 FF FF FB FF 82 04 00 00 FF FF FB FF
    stand for, maybe they need to be in imgfs_raw_data.bin?

    I look also at imgfs_raw_data.bin - it has slightly different structure
    -there is also 0x82 sequential 0x3F000 long blocks of data,
    -followed by only 20 blocks of FFs (instead of 0x164 blocks of FF in removed_data.bin)
    -here the TFAT16 image begins - one block is filled mainly with 0x00-s and then it is follwed by the rest of blocks filled with FFs.
    -last 2 blocks contain those BA B2 sequences again. FAT table? Is it incomplete because part of it is removed? Does it affect work of viewimgfs?

    Sorry for so many questions. :roll: