FORUMS

The ultimate Pocket PC hacking + Asus MYPAL A620BT thread

9 posts
Thanks Meter: 0
 
By Borg Number One, Junior Member on 6th August 2005, 02:33 AM
Post Reply Email Thread
The ultimate ( Asus MYPAL A620BT ) Pocket PC thread

World Wide English Windows Mobile 2003 / PocketPC 2003



German Windows Mobile 2003 / PocketPC 2003



(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)



1. Introduction
2. Attemps getting a A620BT ROM image
3. Hacking/modifying the ROM image
4. A620BT Combo Buttons
5. Screenshots - how did I built them?
6. Problems/questions




1.) Introduction

Hi.

Short time ago I bought the Asus MYPAL A620BT Pocket PC / PDA.
It is a great PDA bundled with the superb "Destinator" navigation software.

Well, I like it to modify embedded software & firmware (especially BIOS files),
as you can see here:
The BNOBTC homepage


So I started to do some reverse-enginering with the A620BT.



2.) Attemps getting a A620BT ROM image
So, logically, I looked for a method how to dump / get the ROM file,
before I could start modifying the Asus MYPAL A620BT ROM itself.

I could not find anything, even the Asus support homepage did not help any further.
But with the help of google.com I could find other interesting stuff:



3.) Hacking/modifying the ROM image
Asus' FTP Server for "special" PDA related files:

"ftp4.asus.com.tw"
UN: PDAUser
PW: pda9983!

( Tip: When I was writing this article the UN:ftp01tk* and PW:vtf2g6z* seemed to be outdated and did/do not work anymore.)
*= can also be found by google.com

Here:
ftp4.asus.com.tw/PDA/AD620BT/ROMImage/PPC2003

I was able to find English, German, etc..., ROM update files.
Inside the zip archives (e.g.: "SW-A4H01WA-007_09931WWE.ZIP") you can find following files:

+ AD620N.nb0
+ BOOT620N.nb0
+ IPL620N.nb0
+ .doc / .txt / readme file



3.1.) AD620N.nb0

It contains the Pocket PC operating system (Windows Mobile 2003 [a.k.a PocketPC 2003])
and the PocketPC Diagnostic Program




(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)

The eight symbolic characters, which are shown on the upper-left and upper-right corner inside the
PocketPC Diagnostic Program can also be found in the "AD620N.nb0" file.


Here is the list with offsets, data and images of/from the symbolic chars:

symbolic character 1 @ 0x0000A400:
00001010FFFE101000007FFC01001110FFFE111001007FFC01 003FF801000100


symbolic character 2 @ 0x0000A420:
00007DFE1010102021FE21024102FDFE4502450245FE450245 0245FE7C480084


symbolic character 3 @ 0x0000A440:
00003FF80100FFFE8102BD7A8102BD7A00003FF821083FF821 083FF8010201FE


symbolic character 4 @ 0x0000A460:
00007C924492452446487D244492449244407DFE4586454A45 32454A45868DFE


symbolic character 5 @ 0x0000A480:
000020202020202023FCF82020202BFC310420886050A02020 502088A1046202


symbolic character 6 @ 0x0000A4A0:
000003FE00480048FC48084811FE20484048BC482448244824 483C8801080208


symbolic character 7 @ 0x0000A4C0:
000001000100010001007FFC41044104410441047FFC010001 00010001000100


symbolic character 8 @ 0x0000A4E0:
00000000020001801100510851045006D00290021008100810 080FF000000000



There is also another method to get the symbolic characters:
The ROM update file contains a kind of a file system which can be viewed with the really great utility:
=+ DUMPROM += by Willem Jan Hengeveld ( The XDA Developers homepage ).

With DUMPROM I could extract all files and "nk.exe" is the actual/proper/real file
which contains the PocketPC Diagnostic Program / AD620 Test Program.

Because of the "nk.exe" does not begin at offset 0x00 inside the "AD620N.nb0" file,
the real adresses are following:

symbolic character 1 @ 0x00009800.
symbolic character 2 @ 0x00009820.
symbolic character 3 @ 0x00009840.
symbolic character 4 @ 0x00009860.
symbolic character 5 @ 0x00009880.
symbolic character 6 @ 0x000098A0.
symbolic character 7 @ 0x000098C0.
symbolic character 8 @ 0x000098E0.


To view / see the symbolic characters, you just need to convert the hex data into binary (0,1) strings.
For example let us convert the data of the first symbolic character into a viewable symbolic character:

0000 1010 FFFE 1010 0000 7FFC 0100 1110 FFFE 1110 0100 7FFC 0100 3FF8 0100 0100
==>

Code:
HEX   |Binary
------+--------
00 00 |00000000 00000000
10 10 |00010000 00010000
FF FE |11111111 11111110
10 10 |00010000 00010000
00 00 |00000000 00000000
7F FC |01111111 11111100
01 00 |00000001 00000000
11 00 |00010001 00010000
FF FE |11111111 11111110
11 10 |00010001 00010000
01 00 |00000001 00000000
7F FC |01111111 11111100
01 00 |00000001 00000000
3F F8 |00111111 11111000
01 00 |00000001 00000000
01 00 |00000001 00000000
Now, let us convert all "0" to "." and "1" to "X" to get a better view:
Code:
................
...X.......X....
XXXXXXXXXXXXXXX.
...X.......X....
................
.XXXXXXXXXXXXX..
.......X........
...X...X...X....
XXXXXXXXXXXXXXX.
...X...X...X....
.......X........
.XXXXXXXXXXXXX..
.......X........
..XXXXXXXXXXX...
.......X........
.......X........
Then, with a drawing program / utility,
each "X" will be drawn as a colored pixel and each "." will not be painted.
Finally, you reached to convert a binary character into a bitmap and you can see the first symbolic character:

(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)


(Now you are able to modify the upper-left and upper-right corner of the diagnostic screen inside the "nk.exe" )
(The background color green was just used for easier image processing.)


The PocketPC Diagnostic Program ( AD620N Test Program ) also contains a nice
Key/Button Test

title scren --> testing the buttons
-->
(Screenshots / animations, PNG / gif conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)


3.2.) BOOT620N.nb0

This file contains the bootloader and a built-in flash utiliy which can be accessed by/with special Combo Buttons in section "4"
Furthermore it contains the splash logo which is shown after a reset / after "booting" the Asus MYPAL A620BT PDA.

Here is a photo, which I made:

(Photo by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net)


However, I am not able to rip and display the logo in a decent way.

If you open the BOOT620N.nb0 file in a HEX editor and if you jump to offset:
0x00001E45 (or: 0x00001E47, if the 0D0A string does not belong to the image data),
then you can see the beginning of the image data.

It seems to be any kind of a palette area.


The real / plain image data seems to begin @ offset: 0x00001F98 and seems to end @ offset: 0x00027798.
That means 25800 Bytes [Hex] = 153600 Bytes.

After extracting the area ( after extracting the mentioned 153600 Bytes ) and pasting the data to a new (.RAW) file,
you can open the file in programs which are able to import/open raw files, such as:
"Irfanview".
( http://www.irfanview.com )


In Irfanview choose "RAW - RAW Image Data" as file type when you open the new built .RAW file.
After selecting and opening the file, a new window appears, where you can enter the dimensions and select the bits per pixel.
Take: 240 * 320 * 16bit.

This was my first attempt.

(The RAW image file began with one byte too much. )
(I did not copy and paste the area: 0x00001F98 - 0x00027798. I copied 0x00001F97 - 0x00027798. )
(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)


This was my final attempt:

(This time, the area: 0x00001F98 - 0x00027798 inside the BOOT620N.nb0 was copied and pasted to a new raw file exactly.)
(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)

The logo seems to be have a color depth of 16 bit (2bytes per pixel) + a kind of a palette??????!????

Well, as you can see, I am currently not able to display the image correctly.

So, there are questions.
Please goto section 6.



3.3.) IPL620N.nb0
? ? ?
So, logically, there are questions.
Please goto section 6.



3.4.) .doc / .txt / readme file

The file contains helpfull information and detailed instruction for a ROM Image Update.
It also describes the special Combo Buttons.



4.) Special Combo Buttons

1. Power button + Reset Button --> Cold Boot
2. Record button + Reset Button --> ROM Image Update (Immediately Update AD620N.nb0)
3. AP1 button + Reset button --> Eboot Mode
4. AP2 button + Reset button --> ROM Image Update (Need User Input File Name)
5. AP3 button + Reset button --> Diagnostic Program
6. Power button + AP4 button --> Calibration for Touch Screen

There are further questions.
Please goto section 6.



5.) Screenshots - how did I built them?

Here are some programs which are able to control Pocket PC systems via PC (Netmeeting-like)
and which can be used to build screenshots as long as the Pocket PC is not in FlashROM mode or inside the Diagnostic Program.

+ ActiveSync Remote Display ( part of Windows Mobile Developer Power Toys)
( free download: http://www.microsoft.com/downloads/d...displaylang=en )
( http://download.microsoft.com/downlo...ePowerToys.msi )

+ dotPocket (commercial software)
( http://www.dotpocket.com/pocket-pc-software.html )

+ Pocket Controller (commercial software)
( http://www.soti.net/ )


Because there are no(**) lossless methods to grab the screen while the PDA is in Diagnostic - or in FlashROM mode,
and because there are no screen dumping utilities which would work in the mentioned states/modes,
I looked for alternatives and I found some.

With the help of my Plustek USB scanner I could take some really huge and detailed scans from my Asus MYPAL A620BT.
The images were scanned with 1200 DPI, so I was able to:
+ see each dot/pixel/transistor on the touchscreen/TFT
+ re-draw each character and symbol and store each of them in a single graphics file.

With the help of HTML I could rebuild the different screens in a pixel accurate way.


So, I did a huge amount of reverse engineering to get decent screenshots instead stupid and bad photos.



( **= Theoretical, I could open the PDA and grab the digital video / display data from the
TFT / touchscreen pins. )

There are further questions.
Please goto section 6.




6.) Problems, troubles & questions.


Reffering to: 3.) Hacking/modifying the ROM image & 3.3.) IPL620N.nb0:
What are the files: "BOOT620N.nb0" "IPL620N.nb0" detailed for?
How to dump the bootloader area from a Pocket PC to a file?


Reffering to: 3.2) BOOT620N.nb0,
I would like to know:
"How to rip and modify the splash logo in a accurate way?"
"Did I forget something to do?"


Reffering to: 3.4.) .doc / .txt / readme file,
are there further Combo Buttons?


Reffering to: 5.) Screenshots - how did I built them?:

I already tried find the binary data for the displayed font /characters,
when the Asus MYPAL A620BT is in Diagnostic - or in FlashROM mode.

So, I tried to find the binary data for many re-painted chars in the three .nb0 files and extracted files.
For example, I also looked for the binary data of the character: A [ 3078CCCCFCCCCC ]
Code:
HEX|Binary
---+--------
30 |00110000           ..XX....
78 |01111000           .XXXX...
CC |11001100           XX..XX..
CC |11001100     ==>   XX..XX..
FC |11111100     ==>   XXXXXX..
CC |11001100           XX..XX..
CC |11001100           XX..XX..

However, no files seems to contain the "console font".


In the PC area, the VGABIOS contains the (8*8, 8*16,...) charsets/fonts,
which are "encoded" in the same binary way.

Is there any kind of "VGABIOS" inside the Pocket PC?

(WinRAR and TotalCommander are able to search HEX strings inside files.)

Where is the standard/console font stored (in)?
Is it also stored in one of the .nb0 files?



Reffering to 2.) Attemps getting a A620BT ROM image:
After a second search with http://www.google.com,
I could find two methods to dumping the rom, but both methods do not really work.


a)
The OSImage Tool ( http://www.xs4all.nl/~itsme/projects...ImageTool.html ) seems to work,
but after ~ 1.5 - 1.7MB nothing happens anymore.
No crash, ...etc., the dumping process just stops and nothing happens anymore.
I tried the OSImage Tool many time and I also removed/closed all applications from the memory.
(Pocket PC->settings->memory)

But everytime I try to dump,
the OSImage Tool stops after ~ 1.5 - 1.7MB.

The dumped part seems to be ok. (There are no weird chars inside the 1.5MB dumped part.)
However, it is just a part - not the whole dump.


In this forum I could find another person, who described the same problem in another thread:
http://forum.xda-developers.com/view...?p=34550#34550

I did not try the "bootblaster" yet.
But, I think it is important that the current OSImage Tool will also be improoved.


b)
grab_it ( http://forum.xda-developers.com/viewtopic.php?t=22861 ) brings a stupid error message:



(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:
Borg Number One - borg_no [dot] one -at- gmx [dot] net
Thanks go to GIMP, PNGCRUSH and PNGOUT)

The autostart feature worked and I also tried to start the grab_it manually, but everytime I get the error message:
Cannot create file
6th August 2005, 03:01 PM |#2  
Senior Member
Thanks Meter: 32
 
More
I think this will work

grab_it by default trys to write dump.bin file to "/Storage Card" folder since you have "/Speicherkarte" instead it ends with error message try attached file with modiffyed grab_it to work with your asus.
Attached Files
File Type: exe grab_it_64_143_187.exe - [Click for QR Code] (5.0 KB, 444 views)
4th June 2006, 04:13 PM |#3  
Junior Member
Thanks Meter: 0
 
More
How to restore ROM
Is it possible to restore the original ROM as my PDA doesn't boot (I believe it lost the ROM image).
cyberdel
16th September 2008, 12:43 PM |#4  
Guest
Thanks Meter: 0
 
More
latest rom for A620BT GER
hi everybody,

i know it's an old post and i'm very unhappy to get it outside the recycle bin but i really need ur help.

IS THERE SOMEBODY WHO HAD THE LATEST ROM v0.99.31 or so in german language for Asus MyPal A620BT? I really need it.

Thanks to the one who can share it with me.

gReeTs
cYBERdEL
9th November 2009, 07:41 PM |#5  
mariox26's Avatar
Senior Member
Thanks Meter: 11
 
More
rom asus a620bt
hello guys.I desperately need a ROM in English for a620bt.ma someone can help please. [email protected]
Finally i found ROM for A620bt v0.99.31 WWE,and German language,and for A620 the last ROM.I am verry hapy.yeah
7th April 2011, 08:49 AM |#6  
Junior Member
Thanks Meter: 0
 
More
A620BT ROM image?
Finally i found ROM for A620bt v0.99.31 WWE,and German language,and for A620 the last ROM.I am verry hapy.yeah

I'd also be a happy guy like you - could you please send the ROM for A620bt v0.99.31 WWE?

thanks in advance

Luke
[email protected]
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes