Develop Bugs

tool to access the samsung onedisk flash

i wrote a new tool that you can use to read the rom image, it can be found at:
http://nah6.com/~itsme/bkondisk.zip
Code:
usage:
first copy bkondisk.exe to \windows on your device, then:
prun bkondisk [targetdir]
will save all partitions on all volumes in files on [targetdir]
prun bkondisk -v0 -p1 [targetdir]
will save a specific partition on [targetdir]
prun bkondisk -v0 -b0 -n1 \firstblock.img
will save the specified blocks to \firstblock.img
prun bkondisk -i
will only list disk info in the logfile "\bkondisk.log"
-v0 or -v1 to specify the volume
-p0, -p1, etc to specify a partition
-b0 etc to specify a starting block ( ignoring partioning )
-n32 specifies to read 32 blocks starting at the above block.
note: you DON'T need to put quotes around directories with spaces in it.
when no path is specified, files will be created in the root.

Thanks! I've got a couple of questions... it extracted the following files:
bk_00_0000.img
bk_02_0005.img
bk_03_0025.img
bk_06_0001.img
bk_08_0175.img
What do these files refer to (which one is the ROM, etc). Also, is there a way to write these backups back to the phone? It would be a great way to try out test roms and get back to my original T-Mobile ROM if necessary.

bk_00_0000.img - IPL : ONBL1 + ONBL2
bk_02_0005.img - GSM + splash + gsmdata + simlock + serialnrs
bk_03_0025.img - OS
bk_06_0001.img - SPL
bk_08_0175.img - userfilesystem

Is there a way to write them back to the phone? or is that not possible...

is it possible to get a .nbh files out of these files?
My idea would be to "glue" the 4 files together (bk_00 to bk_06) in one file, rename the file to RUU_signed.nbh and exchange the RUU_signed.nbh created by the RUU.exe in \Profiles\[user]\Local Settings\Temp\pftxx.tmp with this one and then run on the RUU.exe with the modified .nbh
for example in DOS:
copy /b bk_00_0000.img+bk_02_0005.img+bk_03_0025.img+bk_06_0001.img RUU_signed.nbh
Is it that simple?
EDIT:
Ok this easy way doesn't work.
RUU says "Error 238 - File read"
Maybe some kind of checksum is missing....

Three questions for itsme
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.

Maybe this helps a little bit to get ideas.
I have been searching here for nights - this is what I found so far:
1. I think it's similar to the Hermes - nobody found a way till now - the first step is to modify a signed .nbh, deleting works but not adding a file:
Hermes - how to dump ROM
Hermes - new custom ROMs
Hermes - ROM cooking and Bootloader MFG 1.01
aChef ROM Utils
2. This is the way Imei-Check is CID-unlocking - investigated by pof:
Reverse Engineering the Herems imei-check unlocker
Maybe there is another way like Zone-MR is doing it for the Star100/Qtek 8500
Star100 Unlock procedure but here you have still to decryt/encrypt the block in my understanding and therefore you have to find out the key
3. I didn't find anything about this so far, but I think the information is anywhere at XDA-Developers
EDIT: here (nl)itsme wrote:
.... but i am still busy, have not had the time to look at creating a tool to convert a memdump to a updater file.
Click to expand...
Click to collapse
so I hope he will find the time to create this tool
P.S: @itsme and @pof: I also want to thank you very much - you are heroes!!!
mar11974 said:
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.
Click to expand...
Click to collapse

I got different files ...
After running the tool I got :
bk_0__0000.img (IPL? Is it same as bk_00_0000.img?)
bk_02_0005.img (GSM + splash + gsmdata + simlock + serialnrs)
bk_03_0025.img (OS)
bk_06_0001.img (SPL)
bk_08_0185.img (?????)
I did not get bk_08_0175.img, though.
Hints?
On the other hand, is it possible to extract files out of IMG files?
Thanks.

The How to Flash BootScreen .NBH Image to Your Phone Guide

Hello,
The reason why anyone would do this is for example - I installed the Rogers WM6 but preferred the HTC BOOTSCREEN Image - hence why i personally did it. I did not like Rogers BootScreen Images as they take too long to boot as well as the bootscreen image in the Rogers WM6 used to load after the Green Windows Mobile Screen and on power-up, it used to have a black screen instead of the bootscreen image which to me did not seem practical as I rather see that the phones turned on right away than wait till the Windows Mobile screen loads. I've successfully flashed HTC Bootscreen image using the following steps. I had a member ask me how to flash .nbh files to phone. I'm talking specifically about the bootscreen .nbh images. In order to flash .nbh boot screen images - you have to flash through USPL. Here's how to do it -
1) Firstly, Download all required files that is
a) USPL CID -BYPASS
b) RUU
c) SDA APPLICATION UNLOCK
d) BOOTSCREEN IMAGES(IT CONTAINS HTC, ROGERS AND TMO BOOTSCREEN IMAGES)
2) Copy/Paste RUU File that is ExcaIMG_USPL_1110000unsigned.nbh to the desktop.
3) Copy/Paste ANY of the preferred BOOTSCREEN IMAGE (i.e. for example HTC.nbh) to RUU directory
4) Right Click ExcaIMG_USPL_1110000unsigned.nbh and Select Rename - Press Ctrl + C to copy file name
5) Head over to RUU and Right-Click HTC.nbh, Select Rename - Press Ctrl + V to copy over existing file name.
6) Once you're done this, REMOVE SD CARD AND REBOOT PHONE
7) Once done, APPLICATION UNLOCK YOUR PHONE IF IT HASN'T ALREADY BEEN APPLICATION UNLOCKED - YOU HAVE TO RUN SDA APPLICATION UNLOCK.
8) Now, Run USPL, Make sure you follow proper instructions as this is the main thing - if everything done right, you'll see screen goes into dim black with penguin and green messages, wait until you see the screen turns white then go to active sync and disable usb connections.
9) After this, run RUU and it'll use the re-named file which is the boot screen image to update the boot screen image. It will take max. a minute or two.
10) Once done, I think you see the tri-color screen but there won't be a cold boot - It'll reboot i think and go directly to the main screen.
11) Reboot and see if you see the preferred boot screen image.
For now, I'll post HTC, TMO and Rogers Boot Screen Images. We should still try as a group to create Custom Boot Screen .nbh files. If someone who know's how to make it, please share in this discussion.
Also, Does anyone know how to bring back the "Vibrate" mode during startup and shutdown?
Good Luck ! Post any concerns or any questions
NOTE: Please follow proper instructions, otherwise it won't work. If i'm missing anything, please let me know as I did this flash yesterday and I'm writing the guide today. Also, YOU HAVE TO FLASH THROUGH USPL - IT DOESN'T MATTER IF YOUR PHONES CID UNLOCKED OR NOT.
Credits go to da_mayhem for uploading the images.

sweet, thanks... I'll try this later tonight after i get home from work... or tomorrow

woohoo, sweet... thanks for the guide lukybandit.
On step #2, you'll want to "Cut/Paste" if you copy, it leaves the original file in the folder, so renaming the HTC.nbh isn't possible unless you delete the original file.
also, step #8... DEFINATELY make sure you disable USB connections, i tried without and it didn't work...
However you're supposed to do that for WM6 rom updates also, but i never have, and haven't had a problem... until now that is.

Change HTC Splash Screen
Hello,
How to change the HTC splach screen which appears just after powering on the device?
I tried a lot of tools but I did'nt found one which works. Is it because the Excalibur screen is 320x240 instead of 240x320?
Does someone knows how to do?
StefanSki

StefanSki said:
Hello,
How to change the HTC splach screen which appears just after powering on the device?
I tried a lot of tools but I did'nt found one which works. Is it because the Excalibur screen is 320x240 instead of 240x320?
Does someone knows how to do?
StefanSki
Click to expand...
Click to collapse
replace Shutdown.png in windows folder,with 320x240

i tried this i created a .png file but when i try to place it there access denied lol it wont let me touch anything in the windows folder

This is not this splash screen I mean.
I am talking about the first one, which is in the NBH file as a NB file. I don't manage to make a good NB file in the right format to flash it using RUU.

nbh file wat folder wuld that b in because i jus changed my shutdown screen and i want my turn on screen to b da same as that one

blahzay_blah said:
i tried this i created a .png file but when i try to place it there access denied lol it wont let me touch anything in the windows folder
Click to expand...
Click to collapse
you need total commander to overwrite

No one knows how to make a NB file that contains the splash screen? The default HTC NB file begins with "this is smartphone signature".

i changed my shutdown screed with resci explorer but to change the start up screen the htc screen and the freen windows mobile screen i want to get rid of those ugly screens

any1? a little help lol just want to change the start up splash screen any1 know how

You can use nbimg, to convert from NB to BMP.
For excalibur you'll need to use the following syntax:
Code:
nbimg.exe -F MainSplash.[nb|.bmp] -w 320 -h 240 -n
Also you'll need to add the "this is smartphone signature" manually to the generated NB file (using an hex editor). Maybe I'll add support for doing this automatically if there's a need. PM me as I'm not following the thread.

just saw on another thread how to create a .nb file from a .bmp .... i placed this here because apparently luky got the tmo and rogers .nbh files which have the mainsplash.nb files in them. need to know how to take the .nbh files he included and replace the mainslpash.nb and mainsplash.bmp files with the ones i created
heck i'll even upload the images here if someone wants to show me what to do

i was able to get the .nbh file created but when i flashed the phone with that file the first screen now looks like a green gradient image and not the image i put in the .nbh file

thanks for this man much appreciated.

[release] nbimg: HTC splash screen tool

nbimg is a command line tool which allows to convert HTC Splash Screen images from NB to BMP and create NB splash screens from BMP format. Any splash screen size is supported (yes, it works for Diamond or Athena at 640x480 resolution too).
Code:
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
Usage: nbimg -F file.[nb|bmp]
Mandatory arguments:
-F <filename> Filename to convert.
If the extension is BMP it will be converted to NB.
If the extension is NB it will be converted to BMP.
Optional arguments:
-w <width> Image width in pixels. If not specified will be autodetected.
-h <height> Image height in pixels. If not specified will be autodetected.
-t <pattern> Manually specify the padding pattern (usually 0 or 255).
-p <size> Manually specify the padding size.
-n Do not add HTC splash signature to NB file.
-s Output smartphone format.
NBH arguments: (only when converting from BMP to NBH)
-D <model_id> Generate NBH with specified Model ID (mandatory)
-S <chunksize> NBH SignMaxChunkSize (64 or 1024)
-T <type> NBH header type, this is typically 0x600 or 0x601
Example to convert a NB to BMP:
Code:
$ ./nbimg.exe -F diamond137.nb
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
[] File: diamond137.nb
[] Image dimensions: 480x640
[] Encoding: diamond137.nb.bmp
[] Done!
Example to convert a BMP to NB:
Code:
$ ./nbimg.exe -F diamond137.bmp
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
[] File: diamond137.bmp
[] Encoding: diamond137.bmp.nb
[] Image dimensions: 480x640
[] Done!
Download
Windows version attached to this post.
Linux version and source code available in my blog.

This is awesome!
Thanks.

nice one...

this is amzing tool

well done brother

OK so i took a .bmp file i created and converted it to .nb ... what exactly do i do next? can you only inject this file while a ROM is being cooked? or do i need to overwrite an existing file in the \windows directory?
I am using Kavana 6.1 ROM for the Excalibur BTW...

This has nothing to do with OS side. You need to create a NBH file for your device, with the NB splash screen inside, and flash it to replace the bootscreen.

so how to do "inject the .nb file int the .nbh file?
i have the original .nbh file and i've created the .nb file... what's the next step exactly?
and it's an .nbh unsigned file so its not locked down

Use any tool available to create NBHs, for example HTC Rom Tool. To flash your custom NBH file you'll need USPL or HardSPL installed on your device. Also for Excalibur specific instructions look [url="http://forum.xda-developers.com/showpost.php?p=2366103&postcount=13]here[/url], because you'll need to add the smartphone signature manually.

i tried using the htc rom tool but when it loads, it fails to update the devices list. says internet connection probs... im on the net to its not my internet connection. oh well. guess i will wait a little longer..... im really a noob when it comes to this part of modding. All i want to do is to replace the first splash screen that comes up ( the HTC one ) and the second splash screen ( the windows mobile one) with the two i created.

ok i finally created an .nbh file from the .nb file i used to get the mainsplash.nb file. But when i do the flash all i get is a green gradient filled mainsplash screen and not the image that i converted. Was there something i did wrong? bear in mind i have the HTC Excalibur Smartphone
Basically since all i wanted to do was to flash the main splash screen i created a .txt file with this info:
EXCA10000
1111111
1.11.0.0
USA
600,02_MainSplash.nb
i made sure i named the created .nb file to "02_MainSplash.nb" and dropped it into the directory where the .txt file was located. I got the output .nbh file and compared it with my original .nb file and it was 1kb larger than the .nb.....
When i created the .nb file i used the code you posted on another thread and it looked like this: nbimg.exe -F MainSplash.bmp -w 320 -h 240 -n .... the name of the file was MainSplash.bmp any suggestions? i had heard you talk about adding the "this is smartphone signature" manually. Could this be the problem? If that's the case, i suck as hexediting, so maybe you can hexedit it 4 me?
also note that i got a flash wtire error too when running the RUU

When I first saw this thread I was like "yay! a new EASY way to flash a just the boot image!" But I was wrong, just gets you one step closer Still thanks for the tool tho...what would be nice is a tool that you just insert the BMP or image, then it generates a flashable .nbh like the one I attatched (but that's asking too much) . The .nbh below is only 500kb and it flashes to my Vogue and ONLY replace the first boot screen (then hard-resets the phone). How did that person make that!?

So here's the deal on my ventures.
I've found out that although the excalibur is a 320 X 240 sozed screen the actual .bmp and .nbh files are 240 X 320 ... I verified this by extracting the .nb and .bmp files from the HTC ROGERS and TMO .nbh files the images looked fuzzy, but they work when they are injected into my phone. So here's what i did. I created a .bmp image from scratch using 320 X 240 attributes. the name of the file was 00_MainSplash.bmp. I then used pof's nbimg.exe file and typed in cmd window: nbimg.exe -F 00_MainSplash.bmp -w 320 -h 240 -n
. then it gave me 00_MainSplash.bmp.nb which i renamed and took off the extra .bmp in the middle. Then i did this .nb file in reverse by typing nbimg.exe -F 00_MainSplash.nb to see what the output .bmp file would look like. When i looked at the output .bmp file it was all distorted in the same way the official carrier .bmp files looked like. So i figure ok, i got it correct now. Here's where the issue occurs. I use the nbhgen.exe file and type nbhgen dash.txt (the .txt file is called dash.txt)
The text reads:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
so i execute it and it gives me the RUU_signed.nbh file . The file size is around 151kb I then use the RUU updater and execute that (after i run the USPL CID Bypass) Then after the updater states it's successful the phone reboots and gives me a green gradient screen as the first splash screen and not the file i created. I figured i must be going something wrong (obviously)
if i try and re-extract the .nb files out of my new .nbh file using NBHExtract.exe the only file that turns out is: 00_MainSplash.nb ... now when i ran that same utility on the Tmobile, Rogers and HTC official. nbh files the output files were 2: one was: 00_MainSplash.nb & 00_MainSplash.bmp,,, so it seems like the .nbh files should contain a .nb and a .bmp file somehow.
So i went back to my dash.txt file and changed it to read:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
600,00_MainSplash.bmp
i also tried:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
601,00_MainSplash.bmp
and tried using that output file with the RUU updater. Either way it gave me a flash error and kept that same green gradient screen upon first boot.
So if anyone can tell me where i fouled up i'd be indebted to you.
edit: ok a retract what i said about the nbhextract.exe not outputing 2 files when i extract the .nb file i created. So there must be something else im not doing right..... pof had mentioned something in another thread about using a hex editor to sighn the .nb file for smartphones. but i have no idea how to do that.
Edit2: I think one of two things are going on. 1. The .nb or .nbh file must be signed for smartphones like pof mentioned.... or 2. the nbhgen.exe is somehow malforming the format of the image ( such as converting it from 320x240 to 240x320 ) or the certificate doesnt work with the excalibur that nbhgen uses

Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.

pof said:
Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.
Click to expand...
Click to collapse
friggin sweet! thanks a lot! i'll make sure to "spread the wealth" if i can get it workin on my phone.

pof said:
Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.
Click to expand...
Click to collapse
any timeline on when you expect this development to be completed?

Check the first post, I updated it.

pof, please, check this thread http://forum.xda-developers.com/showthread.php?t=404449&highlight=splash, for my problem

mucas gracias...or something like that
how do great roms always have bad(dumb) splashes...well not any more
thanks for the update

Hi All,
What is the HTC Thouch Diamond MODEL ID ? Where can I found it?
Regards,
Sebastien

Change your boot splash screen to any custom one.

First of all, thanks to lukybandit and pof for their help and threads which made this possible.
This tutorial will allow you to change your initial splash screen to any 320 X 240 customized splash screen of your choice.
You will need to download 3 items below:
The nbimg 1.1.zip file made by pof
the 2 .zip files (1.) Excalibur-USPL-RUU.zip (2.) Excalibur USPL - CID BYPASS.zip
Unzip all 3 files and place the contents into "local disc C:" root directory.
first thing to do is to create a bitmap file ".bmp" with a 320 x 240 screen resolution. I recommend taking any image you make and using photoshop or gimp or even MS Paint to make the resolution 320 X 240 and then save it into "local disc C:" root directory. To make it easy to follow with this tutorial, save it with the file name of "MainSplash.bmp".
UPDATE 6/4/09: Additional instruction if you are not creating using MS Paint. Thanks to TheExpertNoob
If your "Designing" your 320x240 boot screen in Photoshop, save it, then flatten the image (discard hidden layers as well).
Once that is done, CTRL+A, CTRL+C (to copy whole flatten image from photoshop) open MS Paint and set the dimensions of a new file as 320x240 in MS Paint, CTRL+V, then save it as a 24-bit bitmap in MSPaint. (this seems to remove any "Information" Photoshop puts into the BMP file if you were save as in photoshop, which seems to cause the messed up boot screens. reopening a photoshop saved BMP in MSPaint won't work either.)
Then back in photoshop undo your "flatten image" to modify to your liking later.
If your still not having any luck, download one of the premade bootscreens found in these forums ex. HTC, flash it and start over with the above steps (so your overwriting your custome over a clean boot screen)
After you've created your .bmp file, the next thing you're going to do is to open up a command prompt and type: "cd c:\" . press enter. this should take you to a c:\ prompt.
Next you're going to type this:
Code:
nbimg -p 108514 -n -s -w 320 -h 240 -F MainSplash.bmp -T 0x600 -S 1024 -D EXCA10000
press enter.
{{{Keeping mind of the upper or lower case of the letters (this is important!)
if it is a upper case "S" then it has to be a upper case "S" (not "s") and lower case "n" then use a lower case "n" (not "N").}}}
If you do it right, it should look like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
you will end up getting two output files:
MainSplash.bmp.nb &
MainSplash.bmp.nbh
(you can delete the MainSplash.bmp.nb)
Next step is to rename the output file. (MainSplash.bmp.nbh)
Open the folder "Excalibur-USPL-RUU" and locate the file "ExcaIMG_USPL_1110000unsigned.nbh" use this exact file name to rename the file you just created. Once renamed you're going to cut and paste that file into the "Excalibur-USPL-RUU" folder and overwrite the original.
UPDATE 6/4/09: Alternate Instructions if doing this with Energy Based ROM: thanks killa-mckilla!
(Rename the file to EXCAIMG.bmb.nbh , not ExcaIMG_USPL_1110000unsigned.nbh)
Next, you need to prepare your phone for this flash of the splash screen.
( if your phone is not app unlocked this procedure WILL NOT WORK! If your phone is not app unlocked, please download and run the SDA_Application Unlock.zip file from your PC below)
You will need to power your phone off and remove your micro-SD card ( if you have it installed, if not just reboot it) now power your phone back on.
(this seems to work better when a non-sliding panel (chome) homescreen is active, so you may want to change this at this time if you are using a sliding panel homescreen.) ))
Connect your phone to your PC via activesync.
Open the folder named "Excalibur USPL- CID BYPASS" and run the file "Uspl.bat" follow the instructions on the screen and after abour the 3rd or fourth enter press your phones screen should turn white. You should hear the audible sound from your PC indicating that something was just disconnected. ( don't worry it should reconnect immediately ) Activesync will not detect your phone. this is normal.
Now you will open the folder "Excalibur-USPL-RUU" and you're going to run "ROMUpdateUtility.exe". follow the on-screen instructions. If done successfully, the RUU will give you a success screen and your phone will reboot. You should now see your newly created boot splash screen that you just created!.....I am currently pursuing how to also change the second splash screen (the windows mobile screen) and will update this tutorial when that happens. Let me know if any part of this is confusing or if you have any difficulty with the results.

Good post man, hopefully this will help a lot of people out with similar questions regarding this.

Hey Pudgedaddy, good post. I know this want work for me, but is there any way to change it without flashing? I would like to change but didn't know where to start.

showaco said:
Hey Pudgedaddy, good post. I know this want work for me, but is there any way to change it without flashing? I would like to change but didn't know where to start.
Click to expand...
Click to collapse
I don't think so. The initial splash screen is part of the the ROM so you have to flash a .nbh file in order to change it.... as far as i know.

pudgedaddy said:
I don't think so. The initial splash screen is part of the the ROM so you have to flash a .nbh file in order to change it.... as far as i know.
Click to expand...
Click to collapse
So this is the first splash? Not the second one, right?

showaco said:
So this is the first splash? Not the second one, right?
Click to expand...
Click to collapse
Yes. In the case of excalibur users, it's either the HTC first boot screen, the t-mobile first boot screen, or the rogers first boot screen that they see as soon as they turn on the phone.

pudgedaddy said:
Yes. In the case of excalibur users, it's either the HTC first boot screen, the t-mobile first boot screen, or the rogers first boot screen that they see as soon as they turn on the phone.
Click to expand...
Click to collapse
ok, 'cause on mine , I have a blue windows screen for a couple of seconds and then it changes to a green windows screen with the custom rom's name that stays on thru rest of boot process. I found a reg hack to change the second boot screen, thats why I was asking.

showaco said:
ok, 'cause on mine , I have a blue windows screen for a couple of seconds and then it changes to a green windows screen with the custom rom's name that stays on thru rest of boot process. I found a reg hack to change the second boot screen, thats why I was asking.
Click to expand...
Click to collapse
what's the reghack that you use....? maybe i can change my second boot screen too.

The reg entries are at HKLM\System\Startup\1. In there you will only want two keys, one called Duration and the other Splash. If there is ay others, remove them. I have Duration set as dword and is 9000. Splash is image location. It should be in windows folder and word is jpg doesn't work but that gif does. I think png does also. You can do the same for HKLM\System\Shutdown\1. Image size is 320X240.

showaco said:
The reg entries are at HKLM\System\Startup\1. In there you will only want two keys, one called Duration and the other Splash. If there is ay others, remove them. I have Duration set as dword and is 9000. Splash is image location. It should be in windows folder and word is jpg doesn't work but that gif does. I think png does also. You can do the same for HKLM\System\Shutdown\1. Image size is 320X240.
Click to expand...
Click to collapse
oh ok.... i have a variation of this same hack adapted from thw WM6 t-mo ROM for my phone. ( I actually have a thread that talks about how to do this with screens and sounds) anyway, with this hack i end up having 3 screens...... 1 my custom first boot screen, 2. the standard windows mobile screen, 3, my other custom boot screen using the reg hacks.
So i guess there's still something in the ROM that needs to be flashed to change the 2nd boot screen for the DASH

Im New Here And I Tried Doing This Step By Step But
I Just Cant Seem To Get It Right. My Command Promp Tells
Me That What I Wrote Down Cant Be Recognized As A Command. What Am I Doing Wrong???

CHEKO15 said:
Im New Here And I Tried Doing This Step By Step But
I Just Cant Seem To Get It Right. My Command Promp Tells
Me That What I Wrote Down Cant Be Recognized As A Command. What Am I Doing Wrong???
Click to expand...
Click to collapse
you have to tell me SPECIFICALLY what step in this process you are in and what SPECIFIC error message came up. Then i can help

WELL IM DONE WITH THE FIRST 2 STEPS BUT
WHEN I TYPE DOWN THIS "nbimg -p 108514 -n -s -w 320 -h 240 -F MainSplash.bmp -T 0x600 -S 1024 -D EXCA10000" THE COMMAND PROMPT
TELLS ME "nbimg is not recognized as internal or external command" what do i do wrong???

CHEKO15 said:
WELL IM DONE WITH THE FIRST 2 STEPS BUT
WHEN I TYPE DOWN THIS "nbimg -p 108514 -n -s -w 320 -h 240 -F MainSplash.bmp -T 0x600 -S 1024 -D EXCA10000" THE COMMAND PROMPT
TELLS ME "nbimg is not recognized as internal or external command" what do i do wrong???
Click to expand...
Click to collapse
the nbimg.exe file and whatever .bmp file both have to be in the root C:\ directory.
basically, if you're starting out as "c:\ nbimg -p **********" the c:\ part if this assumes that anything you are running is in the c:\ root diretory. so when you type after that "nbimg" it is searcing got the program in c:\ only. it will not search your entire hard drive(s) for this app. secondly the .bmp has to be also in c:\ because nbimg.exe also only looks in whatever directory it is currenty in. Now technically this doesnt have to be in c:\ it can be anywhere you want.... say your desktop. but if you have it somewhere else, you'd have to change the active directory you're in before you start. Some people don't know how to get to the active desktop directory in a command prompt. I only listed the instructions to be placed in the C:\ root directory because it makes it a whole lot easier not having to type out the entire direcotry name. (so you type in " cd c:\ " instead of "cd c:\documents and settings\*username*\desktop\" to get to the active directory) which makes this less error prone with noobs running command prompt.

well i done these steps but now
it tells me " file:MainSplash.bmp..
could not open MainSplash.bmp"

CHEKO15 said:
well i done these steps but now
it tells me " file:MainSplash.bmp..
could not open MainSplash.bmp"
Click to expand...
Click to collapse
is the .bmp you are trying to convert named "Mainsplash.bmp" ???
basically the mainsplash.bmp refernces the .bmp file you are converting. if your .bmp file is named something different, you need to either insert that filename.bmp in place of mainsplash.bmp or rename your file to mainsplash.bmp
edit: secondly if the file is named "MainSplash.bmp", do you have it in the same directory as nbimg.exe? if not it needs to be in the SAME DIRECTORY!
(ex: if nbimg.exe is in C: <root directory> then MainSplash.bmp need to also be in C: <root directory> )

Thanks Man I Finally Got It..
Thanks For The Steps And Keep On
Helping People.

help
Okey I have changed my second load screen and eveything works but when I look in eg edit for hklm/system/startup I cannot find it. I'm using a tilt. anythoughts

Hi, I tried this method step by step and got my splash to change, but the actual picture is really distorted compared to the original bmp pic. Not sure what happened there. I tried it using different bmp files and every time the splash screen is distorted. I am using Rickywatt v24 vanilla rom.

pcdo said:
Hi, I tried this method step by step and got my splash to change, but the actual picture is really distorted compared to the original bmp pic. Not sure what happened there. I tried it using different bmp files and every time the splash screen is distorted. I am using Rickywatt v24 vanilla rom.
Click to expand...
Click to collapse
was the original image a 320X240 resolution? it HAS to be an original 320X240 ( and not a 240X320 ) resolution in order for the output to match the input.

Extract file form LG Backup "lbf"

Hi,
I want to extract a single file from a "lbf" file created by LG Backup on a G4. The file has to be in there as the app using it works on my G5. ADB backups (or Helium) do not work as the app can not be backed up this way. Rooting is no option for me. I've found nothing any where. Can some one help?
TIA

I have the same issue
My LG G4 Crashed.... and had to sent it to the Service Center for Repair.
Now i dont a month old backup take by LG Bridge software and the file is with extension ".lbf".
How can i extract data from the .lbf file and load it to Samsung Mobile.
Please help.... i hv lost all my contacts and others details..
Many Thanks.
Zaks

Reading and .LBF
A friend of mine's phone died (an LG G4) and all he had to go off of was an .LBF file.
I was able to pull the photos, contact, text messages, and voicemail out of the file using a Hex Editor (HxD). I can go over the process if you are still interested,

Hoggmeiser said:
A friend of mine's phone died (an LG G4) and all he had to go off of was an .LBF file.
I was able to pull the photos, contact, text messages, and voicemail out of the file using a Hex Editor (HxD). I can go over the process if you are still interested,
Click to expand...
Click to collapse
please...pm me if could ...i really need to know this...Thanks in advance

Hoggmeiser said:
A friend of mine's phone died (an LG G4) and all he had to go off of was an .LBF file.
I was able to pull the photos, contact, text messages, and voicemail out of the file using a Hex Editor (HxD). I can go over the process if you are still interested,
Click to expand...
Click to collapse
I am intersted. Thanks

Pulling Data from an .LBF file (LG Phone Backup)
Things you'll need (all freeware):
HxD - Hex Editor
7Zip
Mozilla Firefox
SQLite Manager Add-On
VideoLAN Media Player
This procedure gets very technical, but bear with me and you'll find what you're looking for.
I've posted a video on YouTube going over the process if you prefer watching rather than reading: watch?v=HGwX7lFtd4s
Contacts
Right click the .LBF file and open it with 7Zip, you can navigate through the folders to find the database file. Extract the .DB file somewhere (it's usually called "contact2.db"). Now open Mozilla Firefox, and open your SQLite Manager. In the options at the top, click "Connect Database" and navigate to your newly extracted .DB file. It won't see it natively, make sure you set the filter to "All files" in the open file dialogue menu to see it, then click OK. Here you can go through all of the different tables containing account information, contacts, call history, phone numbers, etc.
Text Messages
Much trickier than pulling contacts. There are two kinds of text messages we are looking for: SMS & MMS. These files will be compressed in a ZIP file, so we need to isolate the ZIP file in HxD before we can continue. Open the .LBF in HxD, hit CTRL+F to search, and type ".vmsg" into the box as a text-string searching forward, then hit enter. It should jump you to a file usually called "sms.vmsg". This is where the SMS text messages begin in the ZIP file. Now to identify the beginning of the ZIP file, look a few characters back for a string called "PK. ."; this is the universal identifier for ZIP files, it stands for Phil Katz, the creater of the ZIP file header. There will be other PKs on the screen, so just focus on the first one you come to going backwards from the "sms.vmsg". Highlight the PK, and note the offset in the lower left corner of the HxD window, record that number for later. Now, searching forward once again, look for the next instance of "sms.vmsg", this is the end of the SMS area of the ZIP file, and it leads to the beginning of where the MMS messages are stored. MMS files are stored in the "PDU" file container when they are sent, so you will be searching the document for .PDU files until you come to the last one (when you hit search again, and a window pops up saying HxD has finished searching the document with negative results). That tells you you have reached the end of the MMS message area, and now you need to find where the ZIP file ends. Search forward for PK [HEX: 50 4B], until you see the PK that's right before the next database declaration, usually called "tasks.db". The PK before "tasks.db" is the beginning of the ZIP containing that database (and we're not interested in that right now), so look for the very next occurrence of PK going backward from that one to find the ending declaration of the ZIP file containing the text messages. The pattern for ending a ZIP file is difficult. You will be looking for:
PK {followed by 17 bytes} {followed by 00 00 00}
Keep in mind: 1 byte = 2 hex characters (00 = 1 byte worth of data)
SO! At the ending PK we are at, count forward 17 groups of hex characters, then three groups of 00s. Highlight the six zeros and that is your end of ZIP file. Now Hit CTRL+E to select a block of data. Remember that offset I told you to record? Enter that as the beginning address, the end address should already be at the 00 00 00 you highlighted, then hit Enter. Now CTRL+C, CTRL+N, CTRL+V, CTRL+S to make a new file containing those highlighted bytes, and to save it. Make sure you save it with the ".ZIP" file extension. Now extract that zip file using whatever program you like, and you will find a "sms.vmsg" file and a bunch of .PDUs. I'm not going to get into .PDUs in this post. You can open "sms.vmsg" in a text editor to view the contents. If you want a prettier version of it, you can try converting it online, or what I did, was download an android emulator, imported the .VMSG file into that, and used a random app to export the text messages to .PDF format.
Photos
JPEGs are way easier to carve out than text messages. The problem is that there are usually TONS OF THEM. I will show you how to do this manually, but if you would like to automate the process, you may have to consider writing a bit of code. JPEGs always start and end the exact same way. They start: FF D8 FF E0 xx xx 4A 46 49 46 00 in Hexadecimal, or in ANSI text: ÿØÿà..JFIF
If you find that string, you've found the beginning of a JPEG file. Highlight it and write down the offset. JPEGs for the most part all end consistently, too. They end: FF D9 in Hexadecimal, or in ANSI text: ÿÙ
Select the FF D9, hit CTRL+E to select a block, enter the beginning offset (where FF D8 FF E0 was) and hit OK. Then the CTRL+C, CTRL+N, CTRL+V, CTRL+S combo, and save it with the .JPEG file extension.
Hopefully this helps. If you need assistance with voicemail, let me know. It completely relies on the carrier of your phone to find how those files are stored.

Audio files?

Use PhotoRec
After having some trouble with Hoggmeiser's Hex Editor solution, I found that the free software PhotoRec pretty much does it all for you (I can't insert links yet as I just created an account to post this, but just google "photorec"). Just change the .lbf at the end of your file to .raw so that you can select it in PhotoRec. It parses out a ton of different file types. Not sure if one could find the text messages and contacts database, but I did see some "sqllite" files in my data. Definitely usable to get photos/pictures.

Hoggmeiser said:
Pulling Data from an .LBF file (LG Phone Backup)
Things you'll need (all freeware):
HxD - Hex Editor
7Zip
Mozilla Firefox
SQLite Manager Add-On
VideoLAN Media Player
This procedure gets very technical, but bear with me and you'll find what you're looking for.
I've posted a video on YouTube going over the process if you prefer watching rather than reading: watch?v=HGwX7lFtd4s
Contacts
Right click the .LBF file and open it with 7Zip, you can navigate through the folders to find the database file. Extract the .DB file somewhere (it's usually called "contact2.db"). Now open Mozilla Firefox, and open your SQLite Manager. In the options at the top, click "Connect Database" and navigate to your newly extracted .DB file. It won't see it natively, make sure you set the filter to "All files" in the open file dialogue menu to see it, then click OK. Here you can go through all of the different tables containing account information, contacts, call history, phone numbers, etc.
Text Messages
Much trickier than pulling contacts. There are two kinds of text messages we are looking for: SMS & MMS. These files will be compressed in a ZIP file, so we need to isolate the ZIP file in HxD before we can continue. Open the .LBF in HxD, hit CTRL+F to search, and type ".vmsg" into the box as a text-string searching forward, then hit enter. It should jump you to a file usually called "sms.vmsg". This is where the SMS text messages begin in the ZIP file. Now to identify the beginning of the ZIP file, look a few characters back for a string called "PK. ."; this is the universal identifier for ZIP files, it stands for Phil Katz, the creater of the ZIP file header. There will be other PKs on the screen, so just focus on the first one you come to going backwards from the "sms.vmsg". Highlight the PK, and note the offset in the lower left corner of the HxD window, record that number for later. Now, searching forward once again, look for the next instance of "sms.vmsg", this is the end of the SMS area of the ZIP file, and it leads to the beginning of where the MMS messages are stored. MMS files are stored in the "PDU" file container when they are sent, so you will be searching the document for .PDU files until you come to the last one (when you hit search again, and a window pops up saying HxD has finished searching the document with negative results). That tells you you have reached the end of the MMS message area, and now you need to find where the ZIP file ends. Search forward for PK [HEX: 50 4B], until you see the PK that's right before the next database declaration, usually called "tasks.db". The PK before "tasks.db" is the beginning of the ZIP containing that database (and we're not interested in that right now), so look for the very next occurrence of PK going backward from that one to find the ending declaration of the ZIP file containing the text messages. The pattern for ending a ZIP file is difficult. You will be looking for:
PK {followed by 17 bytes} {followed by 00 00 00}
Keep in mind: 1 byte = 2 hex characters (00 = 1 byte worth of data)
SO! At the ending PK we are at, count forward 17 groups of hex characters, then three groups of 00s. Highlight the six zeros and that is your end of ZIP file. Now Hit CTRL+E to select a block of data. Remember that offset I told you to record? Enter that as the beginning address, the end address should already be at the 00 00 00 you highlighted, then hit Enter. Now CTRL+C, CTRL+N, CTRL+V, CTRL+S to make a new file containing those highlighted bytes, and to save it. Make sure you save it with the ".ZIP" file extension. Now extract that zip file using whatever program you like, and you will find a "sms.vmsg" file and a bunch of .PDUs. I'm not going to get into .PDUs in this post. You can open "sms.vmsg" in a text editor to view the contents. If you want a prettier version of it, you can try converting it online, or what I did, was download an android emulator, imported the .VMSG file into that, and used a random app to export the text messages to .PDF format.
Photos
JPEGs are way easier to carve out than text messages. The problem is that there are usually TONS OF THEM. I will show you how to do this manually, but if you would like to automate the process, you may have to consider writing a bit of code. JPEGs always start and end the exact same way. They start: FF D8 FF E0 xx xx 4A 46 49 46 00 in Hexadecimal, or in ANSI text: ÿØÿà..JFIF
If you find that string, you've found the beginning of a JPEG file. Highlight it and write down the offset. JPEGs for the most part all end consistently, too. They end: FF D9 in Hexadecimal, or in ANSI text: ÿÙ
Select the FF D9, hit CTRL+E to select a block, enter the beginning offset (where FF D8 FF E0 was) and hit OK. Then the CTRL+C, CTRL+N, CTRL+V, CTRL+S combo, and save it with the .JPEG file extension.
Hopefully this helps. If you need assistance with voicemail, let me know. It completely relies on the carrier of your phone to find how those files are stored.
Click to expand...
Click to collapse
Found these steps while looking to extract some data from a backup of my K20 Plus. Super helpful and easy to follow!!

Simple python script for file extraction
Script is here:
Code:
import mmap
index=0
filename=f"LGBackup_xxxxxx.lbf"
def read_in_chunks(file_object, chunk_size=1024):
"""Lazy function (generator) to read a file piece by piece.
Default chunk size: 1k."""
while True:
data = file_object.read(chunk_size)
if not data:
break
yield data
def find_in_file(f,signature, startpos):
prev=b''
chunk_size=2**20
for i,cur in enumerate(read_in_chunks(f,chunk_size)):
searchee=prev+cur
pos=searchee.find(signature)
if pos>=0:
return i*chunk_size+pos-len(prev)+startpos
prev=cur
else:
return -1
with open(filename,"rb") as backup:
starpos=0
while True:
pos=find_in_file(backup, b'PK\x03\x04',starpos)
if pos<0:
break
print(backup.tell())
backup.seek(pos)
print(backup.tell())
index+=1
filename=f"{index}.brokenzip"
with open(filename,"wb") as nextfile:
for chunk in read_in_chunks(backup,2**20):
nextfile.write(chunk)
starpos=pos+1
backup.seek(starpos)
print(backup.tell())
print()
Instruction there, here is copy:
You will need 7-zip context menu "Extract here".
Edit filename to your backup file
Run this script from same folder
Select all *.brokenscript and choose 7-zip > Extract here
On overwrite request, choose either "Yes to all" or "No to all", id doesn't matter
Ta-da! You just got your files.
Looks like this backup is a bunch of concatenated broken zip files with zeros for file sizes. 7-zip can open this easily.
Script does this: finds ZIP header, copies everything from header to new file, opens it and repeats it until no more ZIP headers. Quick, hackish, works.

File "skrypt.py", line 31
nextfile.write(chunk)
^
IndentationError: expected an indented block

barszet said:
File "skrypt.py", line 31
nextfile.write(chunk)
^
IndentationError: expected an indented block
Click to expand...
Click to collapse
Oops. Fixed in post. It was needed to prepend 13+ spaces before nextfile.

topin89 said:
Script is here:
Code:
import mmap
index=0
filename=f"LGBackup_xxxxxx.lbf"
def read_in_chunks(file_object, chunk_size=1024):
"""Lazy function (generator) to read a file piece by piece.
Default chunk size: 1k."""
while True:
data = file_object.read(chunk_size)
if not data:
break
yield data
while True:
with open(filename,"rb+") as backup:
mm = mmap.mmap(backup.fileno(), 0)
pos=mm.find(b'PK\x03\x04',1)
if pos<0:
break
backup.seek(pos)
index+=1
filename=f"{index}.brokenzip"
print(filename)
with open(filename,"wb") as nextfile:
for chunk in read_in_chunks(backup,2**20):
nextfile.write(chunk)
Instruction there, here is copy:
You will need 7-zip context menu "Extract here".
Edit filename to your backup file
Run this script from same folder
Select all *.brokenscript and choose 7-zip > Extract here
On overwrite request, choose either "Yes to all" or "No to all", id doesn't matter
Ta-da! You just got your files.
Looks like this backup is a bunch of concatenated broken zip files with zeros for file sizes. 7-zip can open this easily.
Script does this: finds ZIP header, copies everything from header to new file, opens it and repeats it until no more ZIP headers. Quick, hackish, works.
Click to expand...
Click to collapse
File "script.py", line 21, in <module>
mm = mmap.mmap(backup.fileno(), 0)
ValueError: mmap length is too large
---------- Post added at 02:29 AM ---------- Previous post was at 02:28 AM ----------
File is 2.75 GB. Is that a problem?

Clarify
Hi Topin89,
Thank you for the post. I downloaded python for android and typed out the script and saved it to a .py file. Can you please clarify what the next steps were? I sort of got lost on how to proceed. Thanks
topin89 said:
Script is here:
Code:
import mmap
index=0
filename=f"LGBackup_xxxxxx.lbf"
def read_in_chunks(file_object, chunk_size=1024):
"""Lazy function (generator) to read a file piece by piece.
Default chunk size: 1k."""
while True:
data = file_object.read(chunk_size)
if not data:
break
yield data
while True:
with open(filename,"rb+") as backup:
mm = mmap.mmap(backup.fileno(), 0)
pos=mm.find(b'PK\x03\x04',1)
if pos<0:
break
backup.seek(pos)
index+=1
filename=f"{index}.brokenzip"
print(filename)
with open(filename,"wb") as nextfile:
for chunk in read_in_chunks(backup,2**20):
nextfile.write(chunk)
Instruction there, here is copy:
You will need 7-zip context menu "Extract here".
Edit filename to your backup file
Run this script from same folder
Select all *.brokenscript and choose 7-zip > Extract here
On overwrite request, choose either "Yes to all" or "No to all", id doesn't matter
Ta-da! You just got your files.
Looks like this backup is a bunch of concatenated broken zip files with zeros for file sizes. 7-zip can open this easily.
Script does this: finds ZIP header, copies everything from header to new file, opens it and repeats it until no more ZIP headers. Quick, hackish, works.
Click to expand...
Click to collapse

topin89 said:
Script is here:
Code:
import mmap
index=0
filename=f"LGBackup_xxxxxx.lbf"
def read_in_chunks(file_object, chunk_size=1024):
"""Lazy function (generator) to read a file piece by piece.
Default chunk size: 1k."""
while True:
data = file_object.read(chunk_size)
if not data:
break
yield data
while True:
with open(filename,"rb+") as backup:
mm = mmap.mmap(backup.fileno(), 0)
pos=mm.find(b'PK\x03\x04',1)
if pos<0:
break
backup.seek(pos)
index+=1
filename=f"{index}.brokenzip"
print(filename)
with open(filename,"wb") as nextfile:
for chunk in read_in_chunks(backup,2**20):
nextfile.write(chunk)
Instruction there, here is copy:
You will need 7-zip context menu "Extract here".
Edit filename to your backup file
Run this script from same folder
Select all *.brokenscript and choose 7-zip > Extract here
On overwrite request, choose either "Yes to all" or "No to all", id doesn't matter
Ta-da! You just got your files.
Looks like this backup is a bunch of concatenated broken zip files with zeros for file sizes. 7-zip can open this easily.
Script does this: finds ZIP header, copies everything from header to new file, opens it and repeats it until no more ZIP headers. Quick, hackish, works.
Click to expand...
Click to collapse
How do i run this python script ( i dont know anything about python)? i have extracted my .lbf file into a folder already. What do i do from there?

gagica86 said:
Hi Topin89,
Thank you for the post. I downloaded python for android and typed out the script and saved it to a .py file. Can you please clarify what the next steps were? I sort of got lost on how to proceed. Thanks
Click to expand...
Click to collapse
Sorry, gagica86, I forgot to answer. I hope somebody helped you anyway, if not, see below.
eltonm1219 said:
How do i run this python script ( i dont know anything about python)? i have extracted my .lbf file into a folder already. What do i do from there?
Click to expand...
Click to collapse
So, say there are these files in a folder:
LGBackup_010218.lbf
thescript.py
first, you need to change line:
Code:
filename=f"LGBackup_xxxxxx.lbf"
to
Code:
filename=f"LGBackup_010218.lbf"
in "thescript.py".
Then, if should install Python (if you don't already). I can't post links, so google "Python", first link is what you need. Then "Download", then "Python 3.7.0" (version may be different). Install it, make sure "Add to path" is set.
First try double-click on thescript.py. If nothing happens or "How to open" dialog box appears, in Explorer, Shift+Right Click on empty space in the folder, then "Command line" or "Powershell". Type
Code:
python thescript.py
and press Enter.
Lots of *.brokenzip files should appear. Select them all and extract with 7-zip.

Yato gami said:
File "script.py", line 21, in <module>
mm = mmap.mmap(backup.fileno(), 0)
ValueError: mmap length is too large
---------- Post added at 02:29 AM ---------- Previous post was at 02:28 AM ----------
File is 2.75 GB. Is that a problem?
Click to expand...
Click to collapse
Oh! Yes, it may be. Write if solution is still needed.

topin89 said:
Oh! Yes, it may be. Write if solution is still needed.
Click to expand...
Click to collapse
Yep, I still do.

Yato gami said:
Yep, I still do.
Click to expand...
Click to collapse
Here, this should help:
Code:
import mmap
index=0
filename=f"LGBackup_xxxxxx.lbf"
def read_in_chunks(file_object, chunk_size=1024):
"""Lazy function (generator) to read a file piece by piece.
Default chunk size: 1k."""
while True:
data = file_object.read(chunk_size)
if not data:
break
yield data
def find_in_file(f,signature, startpos):
prev=b''
chunk_size=2**20
for i,cur in enumerate(read_in_chunks(f,chunk_size)):
searchee=prev+cur
pos=searchee.find(signature)
if pos>=0:
return i*chunk_size+pos-len(prev)+startpos
prev=cur
else:
return -1
with open(filename,"rb") as backup:
starpos=0
while True:
pos=find_in_file(backup, b'PK\x03\x04',starpos)
if pos<0:
break
print(backup.tell())
backup.seek(pos)
print(backup.tell())
index+=1
filename=f"{index}.brokenzip"
with open(filename,"wb") as nextfile:
for chunk in read_in_chunks(backup,2**20):
nextfile.write(chunk)
starpos=pos+1
backup.seek(starpos)
print(backup.tell())
print()

Maybe, I've a simple solve this problem. My LG G3 crashed and I've an LG backup file *.lbf but my phone could'nt open it, and my pc same... I found 2 websites, where I could extract it and save contacts.db to vcard file.