HTC Sedna WM6 downgrade
- Thread starter Amokh
- Start date
amokh if you have one device with a rom you want and want to put it on the other device ... yes it can definitely be done...
you need Qmat
and a kaiser kitchen
what works for kaiser works for sedna...
read other post as well as all you need has already been discusssed in other forums on this site... just takes time to find it... everybody had to do it , me included, so happy hunting
ask questions if you need help
ill do what i can...ok
also hard spl your device if you dont want to turn it into an expensive brick!
you need Qmat
and a kaiser kitchen
what works for kaiser works for sedna...
read other post as well as all you need has already been discusssed in other forums on this site... just takes time to find it... everybody had to do it , me included, so happy hunting
ask questions if you need help
ill do what i can...ok
also hard spl your device if you dont want to turn it into an expensive brick!
Thank you gardee005 for your answer...
My first idea was to take a WM6 WWE and trying to translate/ cook it with french files extracted from an WM6.1 french original shipped rom...
I have find the mui files, witch contains the lang, but i dont succeed to add to the OS.nb...
Other idea was to dump the ROM from the device with WM6 french, for that i tried to use itsutils pdocread.exe, according pof`s instructions for dumping Kaiser ROM
but, i have obtain this:
C:\itsutils\build>pdocread.exe -l
210.63M FLASHDR
| 3.12M Part00
| 3.63M Part01
| 78.50M Part02
| 125.38M Part03
980.00M DSK1:
| 980.00M PART00
STRG handles: 474f0f92(980.00M) 87484922(125.38M) 074b3d82( 78.50M) c74b3d5e(3.63M) 874b3aaa( 3.12M)
I don't know, how to dump them, because i don't have obtained the hex addresses, to proceed dumping...
How to do it??
As far as i know, i have to obtain something like:
3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
according to pof`s instructions, and i need to dump it like this:
"pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw"
i have also change :
"HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2 to dword:1"
and now, what`s next?
My first idea was to take a WM6 WWE and trying to translate/ cook it with french files extracted from an WM6.1 french original shipped rom...
I have find the mui files, witch contains the lang, but i dont succeed to add to the OS.nb...
Other idea was to dump the ROM from the device with WM6 french, for that i tried to use itsutils pdocread.exe, according pof`s instructions for dumping Kaiser ROM
but, i have obtain this:
C:\itsutils\build>pdocread.exe -l
210.63M FLASHDR
| 3.12M Part00
| 3.63M Part01
| 78.50M Part02
| 125.38M Part03
980.00M DSK1:
| 980.00M PART00
STRG handles: 474f0f92(980.00M) 87484922(125.38M) 074b3d82( 78.50M) c74b3d5e(3.63M) 874b3aaa( 3.12M)
I don't know, how to dump them, because i don't have obtained the hex addresses, to proceed dumping...
How to do it??
As far as i know, i have to obtain something like:
3.12M (0x31f000) Part00
| 3.50M (0x380000) Part01
| 69.38M (0x4560000) Part02
| 134.38M (0x8660000) Part03
according to pof`s instructions, and i need to dump it like this:
"pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw"
i have also change :
"HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2 to dword:1"
and now, what`s next?
http://rapidshare.com/files/85341969/kaiserkitchen_01-20-08.rar.html
get this kitchen... and qmat...
with this kitchen you should be able to extract the ROM and put it in the other device... you have part01 and part02 and get any ROM (.nbh file)
open KAISERKITCHEN.CMD in the kitchen then press m and u will see
let me know if this works..
then for step 9 use qmat to rebuild flashable ROM...
also this is not the kaiser so things wont be exactly the same but all should work...
also the radios on WM6.1 and WM6 dont mix..so u gotta have WM6 complete rom before u flash only WM6 OS rom..
get this kitchen... and qmat...
with this kitchen you should be able to extract the ROM and put it in the other device... you have part01 and part02 and get any ROM (.nbh file)
open KAISERKITCHEN.CMD in the kitchen then press m and u will see
let me know if this works..
then for step 9 use qmat to rebuild flashable ROM...
also this is not the kaiser so things wont be exactly the same but all should work...
also the radios on WM6.1 and WM6 dont mix..so u gotta have WM6 complete rom before u flash only WM6 OS rom..
Last edited:
thanks for the kitchen.
still unable to extract it...how can i obtain the dumped part01 and part02 files?
I suppose that it must be extracted from device...but how?
here is the menu:
Requires RUU_signed.nbh in BaseROM folder
(1a) Extract NBH Content from shipped ROM
(2a) Extract IMGFS from shipped ROM
(3a) Extract XIP from shipped ROM
Requires RUU_signed.nbh, dumped part01.raw and part02.raw in BaseROM folder
(1b) Extract NBH Content from cooked ROM
(2b) Extract IMGFS from cooked ROM
(3b) Extract XIP from cooked ROM
(4) Copy ROM XIP
(5) PKGTool
(6) Move OEM and SYS
(7) Delete Boot
(8a) BuildOS
(8b) BuildOS+Package_Tools-2.7
(9) Create Kaiser ROM
(10) HTC ROM Tool
(11) Clean Up Temp files
(12) PagePool Changer
none of them cannot extract from device...or i`m doing something wrong?
now i`m confused...
still unable to extract it...how can i obtain the dumped part01 and part02 files?
I suppose that it must be extracted from device...but how?
here is the menu:
Requires RUU_signed.nbh in BaseROM folder
(1a) Extract NBH Content from shipped ROM
(2a) Extract IMGFS from shipped ROM
(3a) Extract XIP from shipped ROM
Requires RUU_signed.nbh, dumped part01.raw and part02.raw in BaseROM folder
(1b) Extract NBH Content from cooked ROM
(2b) Extract IMGFS from cooked ROM
(3b) Extract XIP from cooked ROM
(4) Copy ROM XIP
(5) PKGTool
(6) Move OEM and SYS
(7) Delete Boot
(8a) BuildOS
(8b) BuildOS+Package_Tools-2.7
(9) Create Kaiser ROM
(10) HTC ROM Tool
(11) Clean Up Temp files
(12) PagePool Changer
none of them cannot extract from device...or i`m doing something wrong?
now i`m confused...
u said you you got Part01 and part02 in your previous post...
but, i have obtain this:
C:\itsutils\build>pdocread.exe -l
210.63M FLASHDR
| 3.12M Part00
| 3.63M Part01
| 78.50M Part02
| 125.38M Part03
is this true .. that you got this ?
search in the kaiser threads ... im like you ..i dont know much! just gotta try and fail many times and search and search ...
but did you get part01 and part01 while you device was connected by activsync ?? You said you did... and if you got them then ur just there..
the kitchen i gave you is for use when you have part01 , 02 and ***.nbh.
I have never extracted a ROM from a device.... i have cooked ROMs but always worked with english ROMs, so i know how to dump , edit and recompile a ROM for flashing...
Also make sure you give things enough time to run.... not just when they say Done... sometimes ther are still running and you will see a flashing _ when its finished...
but, i have obtain this:
C:\itsutils\build>pdocread.exe -l
210.63M FLASHDR
| 3.12M Part00
| 3.63M Part01
| 78.50M Part02
| 125.38M Part03
is this true .. that you got this ?
search in the kaiser threads ... im like you ..i dont know much! just gotta try and fail many times and search and search ...
but did you get part01 and part01 while you device was connected by activsync ?? You said you did... and if you got them then ur just there..
the kitchen i gave you is for use when you have part01 , 02 and ***.nbh.
I have never extracted a ROM from a device.... i have cooked ROMs but always worked with english ROMs, so i know how to dump , edit and recompile a ROM for flashing...
Also make sure you give things enough time to run.... not just when they say Done... sometimes ther are still running and you will see a flashing _ when its finished...
i have obtain the list of the partitions, and i was trying to dump them...
it must obtain something like this, for having the "0x31f000, 0x380000...etc " adrreses for start the dumping procedure...
and just after that you get the part01 and part 02...
It`s almost 3 weeks, since i have started to work on this issue, and still no solution...it`s depressive already
i think since i have the part01 and part02, i will able to reconstruct it to a flashable ROM...the only issue is to get them...
have you ever change the language by cooking a ROM?
if i will start extracting the french language from WM6.1 ROM (shipped), and put it to an WM6 WWE (shipped or not) can you help me with some instructions?
It seems like the -l option doesn't quite work, it didn't show the addresses required for dumping, so I followed an other way to get the address described (wiki /index.php?pagename=Hermes_HowtoDumpRom) but also adding the -b 0x800 option (/showthread.php?t=334680).
So basically you are doing -l get the partition names, after one by one get the addresses like this:
pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 -t
real nr of sectors: 1598 - 3.12Mbyte (0x31f000)
pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 -t
real nr of sectors: 1856 - 3.63Mbyte (0x3a0000)
..
now to dump
pdocread.exe -w -d FLASHDR -b 0x800 -p part00 0 0x31f000 part00.raw
pdocread.exe -w -d FLASHDR -b 0x800 -p part01 0 0x3a0000 part01.raw
..
So basically you are doing -l get the partition names, after one by one get the addresses like this:
pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 -t
real nr of sectors: 1598 - 3.12Mbyte (0x31f000)
pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 -t
real nr of sectors: 1856 - 3.63Mbyte (0x3a0000)
..
now to dump
pdocread.exe -w -d FLASHDR -b 0x800 -p part00 0 0x31f000 part00.raw
pdocread.exe -w -d FLASHDR -b 0x800 -p part01 0 0x3a0000 part01.raw
..
so ur on the way... let me know if its sucessful !!
sorry if i did not help much but i only know a little..
sorry if i did not help much but i only know a little..
Success!!!
It`s working!!
After i have obtain the part01 and part02.raw,it was not so difficult...using the kaiserkitchen...and finally rebuild .nbh with Psas to a flashable file!
Now i will test it for a few days, to see how stable is...
Thank you gardee005 for the kitchen and for your help, it is very good feeling to cook...
It`s working!!
After i have obtain the part01 and part02.raw,it was not so difficult...using the kaiserkitchen...and finally rebuild .nbh with Psas to a flashable file!
Now i will test it for a few days, to see how stable is...
Thank you gardee005 for the kitchen and for your help, it is very good feeling to cook...
good to hear.... whats Psas?
it not so difficult when you know how, did you use Qmat to rebuild the .nbh file or the kaiser tool? i never use the kaiser tool but qmat only so if u used it and it worked id like to know.
anyway nice to hear you succeded
it not so difficult when you know how, did you use Qmat to rebuild the .nbh file or the kaiser tool? i never use the kaiser tool but qmat only so if u used it and it worked id like to know.
anyway nice to hear you succeded
nice tool .. it has what u needed .. Hardware forensics>WinCE ROM util...
and you get part00 and offseto1x0031f00 etc.
then right click and you can dump..
and you get part00 and offseto1x0031f00 etc.
then right click and you can dump..
Last edited:
