[HOW-TO] Change your Boot Splash + ZIPs + Online Generator + Warning Gone + Ville/C2

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
Maybe a stupid question, but does this slowdown the boot process?
No it does not.
The contents of that partition gets transferred to the screen buffer regardless of what is in it.
(If you put totally random bit-diarrhea into it, you get colorful snow as your boot splash.)


@touch of jobo, have you been able to code a generator for the Desire X yet?
If you're still searching for information on the Desire X, have a look HERE. :)
At the moment I am traveling (again.. Moldova this time.. don't ask.. ;) ) but I will have a look into that when I get back home. 'Should' be about a week or so.
Thanks.
 
Last edited:
  • Like
Reactions: SecUpwN

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
.... have a look HERE. :)
Sorry, but where exactly am I looking? I see a lot of links. Some are dead. Am I overlooking something here?


Using search, I found this post: http://forum.xda-developers.com/showpost.php?p=33176155 that lists the partition table and the emmc information, but I could not find any post where someone has mapped out the partitions that are not in /proc/emmc. If you know where to find this, direct me to it. Alternatively, if you know that someone has already done it 'manually', please link me to that post.

If you don't think this information is out there, it is not difficult to find out.
First eliminate the partitions that are listed in emmc and the ones that are too small to hold a 480x800 splash.
Then for the others, dump them to a file, download these files to your computer.
Use a hex editor or possibly an image editor that can import raw rgb565 data to identify the splash.

If you don't know how to do this, I can walk you through it. For this, you must be able to get an adb shell in recovery, and feel OK with typing commands in a root shell that an internet stranger feeds you, without making typos.

-Jobo
 

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
I feel comfortable with typing commands, please guide me via PM. Thanks!
I do it here in public, in case anyone else finds it interesting and/or useful. Since much of this is not specific to the Desire X but applies to most devices, and can also be used to identify other partitions, by comparing the contents to image files extracted from RUUs.


So here we go then.. Read the entire thing before you start doing it.

The .zip I attached is not flashable. You should unzip it on your Computer. Inside it is a file named xsplash.565 which you should put on your sdcard. You can do this while booted in android, or using 'adb push' after you boot into recovery. It doesn't matter as long as it ends up on the sdcard of your device.

Boot into recovery, get an adb shell.

From the info in the post I linked to before, the partitions that are not labeled as something else, and are not too small to hold the splash are:
3, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 19, 20, 24

If you have the original HTC boot splash that is completely white wth green HTC letters halfway down, then we only need very little data to identify it, but let's take 1k. (Let me know if you don't have the white stock splash.) The command for this is 'dd', with the parameters if=input file, of=output file, bs=block size, count=how many blocks.

For each partition XX, do the following:

dd if=/dev/block/mmcblk0pXX bs=1024 count=1 | hexdump -v

Note: we don't use the 'of' (output file) parameter, but instead we pipe the output through hexdump, to display it in a readable form. The thing between 'count=1' and 'hexdump' is the pipe symbol, probably above your backslash on your keyboard. (It is on mine.)

It should look something like this:

~ # dd if=/dev/block/mmcblk0p24 bs=1024 count=1 | hexdump -v
1+0 records in
1+0 records out
1024 bytes (1.0KB) copied, 0.005676 seconds, 176.2KB/s
0000000 479a 9ff4 2d5d a303 7558 e5a8 e79f 0a79
0000010 1c33 c68c a8d4 8886 850c c85e 0a88 825a
0000020 2ec4 1f5f 3e56 ba8a ead4 b776 d06d 67eb
0000030 995b e227 bb03 430b 0fb5 c760 367a ffe1
..etc..
00003c0 f8e8 dd4b 6c36 2dca 7bc2 423c 13a6 9b10
00003d0 2ad8 8edc c1a0 4760 85ac 55a0 7a4b f40d
00003e0 66df 6c08 cf62 51bd d0a7 2808 fc35 f563
00003f0 24c8 0867 a004 e4b2 aed2 4664 7a9f 94a9
0000400
/sdcard #


For a lot of them you may find they consist of mostly zeros.
For one of the partitions, the output will look like this:

0000000 f79d f79d f79d f79d f79d f79d f79d f79d
0000010 f79d f79d f79d f79d f79d f79d f79d f79d
0000020 f79d f79d f79d f79d f79d f79d f79d f79d
0000030 f79d f79d f79d f79d f79d f79d f79d f79d
..etc..

It is full of f79d. That pattern is the solid almost-white color of the stock splash.
This is the partition we're looking for.
When you have this, continue for the others, to make sure that there is only one.
(I assume you find one, and not more than one. If not, don't continue.)

From here on, XX is the number we found here.


Now that we have our suspect, here comes the scary part: we're going to flash something new into it, to confirm.

Confirm that sdcard is mounted.

Type the command 'df'. The output should look like this and show you where sdcard is mounted.

~ # df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 389848 48 389800 0% /dev
/dev/block/mmcblk0p34 258012 4248 253764 2% /cache
/dev/block/mmcblk0p36 10413072 4892480 5520592 47% /sdcard


Go to your sdcard partition. (The output from the previous command tells you the mount point.)

~ # cd /sdcard
/sdcard #


If you want to be able to flash the original back, you have to dump it now.
(Replace XX with the partition number we found before.)

/sdcard # dd if=/dev/block/mmcblk0pXX of=stock.565 bs=1024 count=750
750+0 records in
750+0 records out
768000 bytes (750.0KB) copied, 0.020876 seconds, 35.1MB/s
/sdcard #


Make sure the xsplash.565 file is there, and if you made a backup, then the stock one as well.

/sdcard # ls -l *565
-rwxrwxrwx 1 root root 768000 May 24 19:54 stock.565
-rwxrwxrwx 1 root root 768000 May 24 19:16 xsplash.565


Confirm that the file size is exactly 768000 bytes. (This is 480 x 800 x 2. It is also 750 x 1024)
If all is good, we're now going to flash it:
(Replace XX with the partition number we found before.)

/sdcard # dd if=xsplash.565 of=/dev/block/mmcblk0pXX
1500+0 records in
1500+0 records out
768000 bytes (750.0KB) copied, 0.353151 seconds, 2.1MB/s


So this time round, the input is the file and the output is the block device. If you enter the wrong partition number here, you may have a brick.

At this point, you cross your fingers, or do any other ritual to please the Gods of Gadgets,
then reboot your device.

...

If it all successful, let me know the partition number. If it is not successful, let me know where you get stuck, or have doubts, or the output doesn't match what I wrote.

The next thing will be to construct a recovery-flashable .zip for you to test, so you will get yet another opportunity to destroy your device.

Happy hunting,

-Jobo
 

Attachments

Last edited:

SecUpwN

Senior Member
Jun 12, 2012
2,086
645
0
DEUTSCHLAND!
secupwn.github.io
The .zip I attached is not flashable. You should unzip it on your Computer. Inside it is a file named xsplash.565 which you should put on your sdcard. You can do this while booted in android, or using 'adb push' after you boot into recovery. It doesn't matter as long as it ends up on the sdcard of your device.
Which ZIP-File? There is none! I am more than eager to help our XDA community. Give it to me! :)
 
Last edited:

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
I have not modified the white splash screen, hence my girlfriend still has the orginal splash screen.. shall I do the stuff you mentioned above now?
Yes. Go ahead to the point where you should find the right partition number. Don't go further unless everything goes like I said it would.
As long as everything checks out, just follow along. Go up to the point where you're going to flash the new splash, then PM me, or if you feel confident after doing the first part, just take the plunge.

Edit: I have re-read your post after you replied. If the device has the original splash (which you say it has), then yes, go ahead. If it would have had a modified splash (which you say it has not) I would need more than 1k of data, and hexdumping would not be enough to identify it.



Which ZIP-File? There is none! I am more than eager to help our XDA community. Give it to me! :)
Edit2: So that had not propagated.. (Re?-)attached the .zip file. (must have fallen off ;))
 
Last edited:

SecUpwN

Senior Member
Jun 12, 2012
2,086
645
0
DEUTSCHLAND!
secupwn.github.io
Yes. Go ahead to the point where you should find the right partition number. Don't go further unless everything goes like I said it would. As long as everything checks out, just follow along. Go up to the point where you're going to flash the new splash, then PM me, or if you feel confident after doing the first part, just take the plunge.
Please be aware that I'm an addicted post-modifier. It completely changed - would you please re-read it?
 

SecUpwN

Senior Member
Jun 12, 2012
2,086
645
0
DEUTSCHLAND!
secupwn.github.io
HUNTING FOR DESIRE X (ProtoU) COMPLETED!

From here on, XX is the number we found here.
Scary partition number: 19

Now that we have our suspect, here comes the scary part: we're going to flash something new into it, to confirm.
Ready to rumble!

Code:
/sdcard # dd if=xsplash.565 of=/dev/block/mmcblk0p19
1500+0 records in
1500+0 records out
768000 bytes (750.0KB) copied, 0.288399 seconds, 2.5MB/s
At this point, you cross your fingers, or do any other ritual to please to Gods of Gadgets, then reboot your device.
"You have just flashed a new boot splash!"

Am I the first one on this world having done this for the Desire X now? :cowboy:


If it all successful, let me know the partition number.
Verified and working partition number for the Desire X (ProtoU) is: 19.

The next thing will be to construct a recovery-flashable .zip for you to test, so you will get yet another opportunity to destroy your device.
Of course, give it to me! Helping you update your boot splash generator is fun for me. I love hacking stuff!
 
Last edited:
  • Like
Reactions: touch of jobo

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
Verified and working partition number for the Desire X (ProtoU) is: 19.
You got the flashable .zip in PM.

  • I took a flashable .zip from the Desire X forums, took the update binary from there.
  • Used the same update script as for the One S, but changed the partition number to 19.
  • Added an image file that fits the dimensions of the Desire X screen, 480x800.
If that worked out for you, the next thing will be for me to setup some php and shell things, and then for you to test the web generator. That will be the 3rd and final chance to break the device. If the generated .zip works then everybody can use it.


What are the prerequisites for this to work on the Desire X? Do you have to run specific hboot versions, do you have to be S-Off, ...?
 
  • Like
Reactions: SecUpwN

Flippy498

Retired Forum Moderator
May 21, 2014
3,077
2,331
253
I have HTC One S S-off with that "red overlay"

hboot 2.15

can i flash modded_hboot_2.16.0000.zip

?
Since your hboot is not 2.16.0000 I wouldn't recommend to flash the zip. It could brick your phone. But you can use this. Just read the instructions carefully before first use so that you don't brick your phone.

Edit: Well, I think it's easier to use one of the zips in post #148 of this thread.

Edit2: It may be safer to use the zips mentioned in post #274.
 
Last edited:
  • Like
Reactions: SnZ

touch of jobo

Senior Member
Oct 21, 2008
755
644
0
Groningen
I have HTC One S S-off with that "red overlay", hboot 2.15
can i flash modded_hboot_2.16.0000.zip ?
If you just want to get rid of the red overlay text, then flash the modded 2.15. The same version you have now, except without the red warning text.
If you want to upgrade your hboot from 2.15 to 2.16 then you need more than to just flash the hboot image. See the link from @Flashalot in post #477.

-Jobo
 
  • Like
Reactions: SnZ