Hello folks,
Does anyone know the correct way to disable a Windows Mobile process from starting when the Rhodium starts up? I notice a process called "JBlendDaemon.exe" starting up, but I do not use any Java applications (that I am aware of, at least).
How do I stop this process (or any other process) from starting at boot-up? This item is not in the Windows Startup directory (I am running stock Tmobile firmware).
Thanks!
overwrite the JBlendDaemon.exe
you will find it in the \windows\ folder
with a 0 Kbyte file(DummyFile,write protection)
JBlend works also when use this trick,
if you want it back, just delete the dummyfile and take a softreset
use TotalCommander or Resco....
you can also kill some StartUp BackgroundTasks via RegEditor
HKLM\init
Type REG_BINARY (Binary value)
Depend100 = 3C 00
Depend110 = 64 00
Depend120 = 64 00
Depend58 = 37 00
Type REG_SZ (String value)
Launch100 = uptimesqm.exe
Launch110 = tskschedule.exe
Launch120 = autoimeupdate.exe
Launch19 = initvmmap.exe
Launch4 = sdpready.exe
Launch58 = RunCC.exe
Launch98 = TimeWizard.exe
you can only delete this keys,
if you delete other keys you have a big problem ;-) Hardreset
greetz
HTC WP7 NBH Dump/Rebuild:
NBHImageTool
flash.store.bin Dump/Rebuild (dumped as os.nb in NBHImageTool):
(tool creation pending)
IMGFS Dump:
Combine xidump with the attached cecompr_nt.dll supporting XPH
IMGFS Build:
Combine imgfsfromdump with the attached cecompr_nt.dll supporting XPH
XIP/ULDR Dump:
dumprom works well for this.
XIP/ULDR Build:
(tool creation pending)
I'll be posting updates in my twitter, which you can reach by clicking the image in my signature below.
That's great
Thanks
awesome, best of luck;]
Thank for this
thanks. let us know if you need something...
i'm sure we can get more donations if needed...
Good luck in your attempt my friend.
A small appreciation from my side
Transaction ID: 3HV21374WY1903845
Relocation Module SYS/Dump:
Creating tools...
Command Dump IMGFS:
Code:
xidump imgfs.bin
Create Packages from Dump:
Combine Packagebuilder with the attached cecompr_nt.dll supporting XPH
Another method Dump XIP:
XIPPort - Bepe's
Region PagePool:
during the detection..
Generation File imageinfo.txt:
Command:
Code:
iitp [ -p physfirst ]
Download: IITP - imageinfo.txt producer.
XPR to XPH Compression:
Open the file os.nb.payload in HEX Editor. Find this Lines:
Code:
F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC ř¬,ťăÔ+M˝0‘nŘO1Ü
01 00 00 00 01 00 00 00 01 00 00 00 34 00 00 00 ............4...
08 00 00 00 00 02 00 00 00 10 00 00 58 50 52 00 ............XPR.
And change to:
Code:
F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC ř¬,ťăÔ+M˝0‘nŘO1Ü
01 00 00 00 01 00 00 00 01 00 00 00 34 00 00 00 ............4...
08 00 00 00 00 02 00 00 00 10 00 00 58 50 52 00 ............XPH.
Save this file. Get this library cecompr_nt.dll (attached in first post), then insert to TOOLS folder from your Kitchen ROM.
Download cecompr.dll (attached) and overwrite it in your XIP.
Useful module to compress XPH:
You're doing great work,
I hope you'll succeed.
Good luck
lets keep this on track, roms will be developed as they can be, asking for specific hardware won;t make any difference and only take the threads off track.
this is a nice clean thread for the real WP7 work going on, looks like we have sorted the compression issue,
looking forward to what Da_G finds with the JTAG on the HD2.
chrispilot2293 said:
why do you say that about Topaz how do you know that we wont get it.
Click to expand...
Click to collapse
Lots of posts in the other threads on this topic. There's lots of reasons but the main one is that non-Cortex A8 (ie Snapdragon) devices are not capable of executing code compiled for the ARMv7 instruction set. WP7 is compiled under ARMv7. To recompile for ARMv4/5/6 would require the original source code to WP7 which there's practically no chance of getting. Even IF that somehow leaked out, it would still run so poorly that it would be unuseable.
good luck da_g. endevours from indian in australia
What is difference between XPR and XPH? More importantly, I'd love to know how to rebuild cecompr_nt.
Does your cecompr_nt_xpr_xph.dll still support lzh?
If XIP/ULDR can be dumped w/ existing tools, what prevents existing tools being used for reconstruction?
gguruusa said:
What is difference between XPR and XPH? More importantly, I'd love to know how to rebuild cecompr_nt.
Does your cecompr_nt_xpr_xph.dll still support lzh?
If XIP/ULDR can be dumped w/ existing tools, what prevents existing tools being used for reconstruction?
Click to expand...
Click to collapse
No.... only XPR/XPH
Just made my donation. Just for the effort your giving. Thanks.
Just sent you a donation, looking forward to rocking my HD2 with Win7! Thanks man!
didn't the leaked spec sheet of wm7 state armv6 and above?
am i just behind the times
thanks for everyones work
Da_G said:
HTC WP7 NBH Dump/Rebuild:
NBHImageTool
flash.store.bin Dump/Rebuild (dumped as os.nb in NBHImageTool):
(tool creation pending)
IMGFS Dump:
Combine xidump with the attached cecompr_nt.dll supporting XPH
IMGFS Build:
Combine imgfsfromdump with the attached cecompr_nt.dll supporting XPH
XIP/ULDR Dump:
dumprom works well for this.
XIP/ULDR Build:
(tool creation pending)
Click to expand...
Click to collapse
Amazing work Da_G! Thanks for sharing your knowledge!
zole2112 said:
Just sent you a donation, looking forward to rocking my HD2 with Win7! Thanks man!
Click to expand...
Click to collapse
It is not certain that it will work, dont get your hopes up or your kickers in a twist if it comes do nothing.
Silently hoping it does however but we shall have to wait and see.
ID transazione: 6NA49355LX5868833
A small gift for your great work
Please let us Know if Donations can help, I would invest $100 or even more so that the HD2 sees the Light.
and Please guys, we invested and accepted donations to buy an HD2 Plus the Trace32 App, so let's focus on developing Win 7 for HD2 currently, later, I think that other devices can reap the benifits too.
Best of Luck to you Da_G
Will
Hello people,
Are there any tools for viewing and editing the amss.bin?
HEX Editor...
IDA...
Brain.
Best Regards
adfree said:
HEX Editor...
IDA...
Brain.
Best Regards
Click to expand...
Click to collapse
with revskill i got this with amss.bin
#define UNLOADED_FILE 1
#include <idc.idc>
static main() {
MakeName(0x00079B70, "Memcmp");
MakeName(0x00062160, "Memcpy");
MakeName(0x0022E924, "Memcpy");
MakeName(0x0006216B, "Memcpy_Generic");
MakeName(0x0022E92F, "Memcpy_Generic");
MakeName(0x000621D0, "__rt_udiv");
MakeName(0x00079F8C, "__rt_udiv");
MakeName(0x00062334, "strlen");
MakeName(0x0007A2C4, "strlen");
MakeName(0x00070DB2, "diag_sp");
MakeName(0x00062298, "strcmp");
MakeName(0x0007A1D8, "strcmp");
MakeName(0x0007A360, "strncpy");
MakeName(0x00072502, "diag_pkt");
MakeName(0x00062F00, "__rt_div0");
MakeName(0x0007D324, "__rt_div0");
MakeName(0x00062F10, "__32__rt_raise");
MakeName(0x0007F1F8, "__32__rt_raise");
MakeName(0x00ACC3A8, "rex_int_lock_32");
MakeName(0x00072330, "subsys_getid");
MakeName(0x0007A548, "vsprintf");
MakeName(0x00062004, "MemClr");
MakeName(0x0022E7C8, "MemClr");
MakeName(0x000725CC, "diag_subsystem");
MakeName(0x0006EC72, "diag_hdlr");
MakeName(0x000726D2, "diag_hdlr");
MakeName(0x00083D86, "diag_hdlr");
MakeName(0x00085432, "diag_hdlr");
}
What about it ?
@Tigrouzen, no segment found at 0x00079B70 etc
amss it's regular elf with a bunch of segments
Code:
Name : LOAD
Start : 0x001E7000
End : 0x001EE000
Length: 0x00007000
----------------------
Name : LOAD
Start : 0x001F0000
End : 0x001F1000
Length: 0x00001000
----------------------
Name : LOAD
Start : 0x001F2000
End : 0x005D8000
Length: 0x003E6000
----------------------
Name : LOAD
Start : 0x005D8000
End : 0x00CDB000
Length: 0x00703000
----------------------
Name : LOAD
Start : 0x00CDB000
End : 0x00D11000
Length: 0x00036000
----------------------
Name : LOAD
Start : 0x00D11000
End : 0x00DAF000
Length: 0x0009E000
----------------------
Name : LOAD
Start : 0x00DAF000
End : 0x00DB9000
Length: 0x0000A000
----------------------
Name : LOAD
Start : 0x00DB9000
End : 0x00E9B000
Length: 0x000E2000
----------------------
Name : LOAD
Start : 0x00E9C000
End : 0x01BF9000
Length: 0x00D5D000
----------------------
Name : LOAD
Start : 0x01BF9000
End : 0x01D05000
Length: 0x0010C000
----------------------
Name : LOAD
Start : 0x01FF0000
End : 0x01FF006C
Length: 0x0000006C
----------------------
Name : LOAD
Start : 0xB0000000
End : 0xB0010CE7
Length: 0x00010CE7
----------------------
Name : LOAD
Start : 0xB0040000
End : 0xB0057000
Length: 0x00017000
----------------------
Name : LOAD
Start : 0xB0100000
End : 0xB0107207
Length: 0x00007207
----------------------
Name : LOAD
Start : 0xB0140000
End : 0xB01401B8
Length: 0x000001B8
----------------------
Name : LOAD
Start : 0xB0200000
End : 0xB0208CF3
Length: 0x00008CF3
----------------------
Name : LOAD
Start : 0xB0240000
End : 0xB024028C
Length: 0x0000028C
----------------------
Name : LOAD
Start : 0xB0400000
End : 0xB040DBE8
Length: 0x0000DBE8
----------------------
Name : LOAD
Start : 0xB0600000
End : 0xB0602000
Length: 0x00002000
----------------------
Name : LOAD
Start : 0xB0602000
End : 0xB0604000
Length: 0x00002000
----------------------
Name : LOAD
Start : 0xF0000000
End : 0xF001F878
Length: 0x0001F878
----------------------
Name : LOAD
Start : 0xF0020000
End : 0xF0026000
Length: 0x00006000
load amss.bin with TriX, dump decoded stage (elf format) and analyze with disassembler (e.g. IDA)
Ok guys i extract certificate from Amss S8530 XEJL2, bootloader segments full info fsbl sbl...
Also i can dump complete NAND and find segment and algorith for RC1 too
This is appscompressed.bin algorythme
0x01ca7750 RIPEMD128+160+MD4
0x01ca7750 SEAL+MD4 key
appcomp hash :
SHA1 : EB55C6690ACAF40BB2F845313F58BFE9C3BC529D
SHA224 : AAC3E2B65CC9F33BB7EDDA3DEB541CA9E8919422CC179B4D2B49F39BAE008F00
SHA256 : 580D3DB21E41A9FE588AE544266040FABA8AF044E739971E77F2B1272323D0B6
SHA256-HTC : A44BC029D7F952750003D9695ED7B464E446D34EEF5BD9665487E4C2BF81F669
MD4 : B3BD8310FF2C4C05E2044FD491814792
MD5 : 7220779D1094C5F7789094DC75BA4E9E
CRC16 (0x1189) : F4EA
CRC30 (Block: 0x1000, Page: 0x200) : 0BD214AA
CRC30 (Block: 0x2000, Page: 0x400) : 0A28A17A
CRC32 (0xEDB88320) : 313F4EF2
CRC32 (0x04C11DB7) : 90B01704
CRC32 HTC (0xEDB88320) : B55B60A7
ECC Reed Solomon (parity 10) : 43702DA1FDAC4DB2023B
ECC BCH Micron 3 byte : 818144
ECC Hamming Toshiba (8 bit - 0x200 bytes) : C00FC3
ECC Hamming (8 bit - 0x200 bytes) : FF3CF3
ECC Hamming (16 bit - 0x200 bytes) : 3FCFFC
Amss algo :
0x0007fce0 CRC-16 norm
0x0007fee0 CRC-16 inv
0x0007f8e0 CRC-30
0x0007eb50 CRC30 Function
0x00b66194 CRC-32
0x00b66394 CRC32 Function
0x000800e0 CRC-32 Xilinx
0x0007eb58 CRC32 Xilinx Function
0x000800e4 CRC32 Xilinx Function
0x00c3c490 DES RAW Spbox
0x00c39381 RSA PKCS SHA1/RIPEND Digest
0x00c39390 MD2 S
0x00463548 SHA2 table
0x008fcc88 SHA2 table
0x00b6eb14 ZDeflate
0x0041a28c SHA1+MD4+MD5 init
0x008fcb08 SHA1+MD4+MD5 init
0x00c3d7f8 SHA1+MD4+MD5 init
0x0041a29c SHA1+MD4+MD5 key1
0x008fcb18 SHA1+MD4+MD5 key1
0x00c3d808 SHA1+MD4+MD5 key1
0x001a9844 SHA1+MD4+MD5 key2
0x0041ac1c SHA1+MD4+MD5 key2
0x008fcb1c SHA1+MD4+MD5 key2
0x001a9848 SHA1+MD4+MD5 key3
0x0041ac20 SHA1+MD4+MD5 key3
0x008fcb20 SHA1+MD4+MD5 key3
0x00463648 SHA2 init table
0x008fcd88 SHA2 init table
0x00c3d80c SHA2 init table
0x0046364c SHA2 init table
0x008fcd8c SHA2 init table
0x00c3d810 SHA2 init table
0x00419980 RIPEMD128+160+MD4
0x008fcaf8 RIPEMD128+160+MD4
0x00bdcca0 RIPEMD128+160+MD4
0x001a9844 MD5
0x0041ac1c MD5
0x008fcb1c MD5
0x00419980 SEAL+MD4 key
0x008fcaf8 SEAL+MD4 key
0x00bdcca0 SEAL+MD4 key
0x004fc7af HTC PUBLIC KEY
E9079DBB2452104990982132470BA20B7C795D1B4690B718B62FCD38D71D4E458FAF320374B89D5236C79BD57D2BA2D3508A4A605B0D48CB8CA5478BFE4D7D32AB0AE072BC367A9615F002D5023A617B422FEC1EF8DAD772D75E9C4F06EF624B864699A3F080D1B8E192B921D159852B2DC798F752B4F1FA529FF123D9963F73
0x00708134 Sober 128
0x00c3cd90 Sober 128 SBox
Possible algos little endian: 45
0x00315f6c AES te
Possible algos big endian: 1
Amss hash :
SHA1 : C59C5785E823E5E1CA9BE05DB6F55F8C8AC1BBA3
SHA224 : 5F50CED13C1204068E443919706B53D866271DAB1CFB5A9CB07A953CAE008F00
SHA256 : D86C7634FE07806D3B87701EC7F72F25DAAFAC7C40CA1D370C1ABA5840C091C0
SHA256-HTC : 120F70AECE78B8DCF69DCD79F020AB00AE17572123BA21274D6F6EE280774A09
MD4 : 7703DF5B1074392D4B91ECA23BAC9D92
MD5 : 22197F8AAD6A2CB4394E1B4E63EB843C
CRC16 (0x1189) : FAC5
CRC30 (Block: 0x1000, Page: 0x200) : 311AE4C7
CRC30 (Block: 0x2000, Page: 0x400) : 295DFC29
CRC32 (0xEDB88320) : 8DB21A34
CRC32 (0x04C11DB7) : 7B94B6A4
CRC32 HTC (0xEDB88320) : 08450BBC
ECC Reed Solomon (parity 10) : A04D69B134A126F3FD15
ECC BCH Micron 3 byte : 000000
ECC Hamming Toshiba (8 bit - 0x200 bytes) : FFFFFF
ECC Hamming (8 bit - 0x200 bytes) : FFFFFF
ECC Hamming (16 bit - 0x200 bytes) : FFFFFF
Amms certificat :
https://rapidshare.com/files/3061245812/1.cer
Well, the main idea was ..., to get some tools with which the amss.bin for bada v1.2 and v2 can be modified to work for the American/Australian version of the wave. Looks like there are some hardware differences and this file is containing information needed for the RF module.
Looks like there are some hardware differences and this file is containing information needed for the RF module
Click to expand...
Click to collapse
No idea if Hardware differences, but I'm pretty sure there are different Config/Calibration data...
Check out NV items... AMSS + NV items = Qualcomm related part...
http://www.samsunguniverse.com/forum/s8500-can-work-with-qualcomm-tools-t199.html
You could take an look on FCC documents for maybe Hardware check...
Best Regards
I think gambal refers to UMTS bands, Europe is different than in America.
UMTS bands in America are 850 - 1900
UMTS bands in Europe are 2100
bada 1.2 and above only works with Euro bands (these updates hasn't oficially released in America), so as we know the file "amss.bin" contains the parameters that define which bands to work, would be good to try to edit the information to compile a new "amss.bin" to work with American bands ..
Many Americans would be happy!
...would be good to try to edit the information to compile a new "amss.bin" to work with American bands ...
Click to expand...
Click to collapse
But you are really sure that not NV items differ?
Maybe easier to compare NV items...
Best Regards
You mean to compare amss NV items from a 1.0 American firmware and another 1.2 European firmware?
I was import to a .Qcn file a list of NV items of my mobile (bada 1.0 american), i will compare with another one of 1.2.
It's posible to create more NV items if is necesary?
sorry for double post.
i've compared NV items of my phone, first with a 1.0 american firmware then with a 1.2 European firmware..
EDIT: thought that there were no differences because the file size was identical, but looking more attentively i find some, i will continue researching,
You tried QPST or which Tool?
And are sure there are no differences?
I have 2x S8500... with QPST difference 10 NV items + one S8500 has 10 more
Content not checked... too lazy at this time.
Best Regards
Edit 1.
File Summary:
Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default, Total NV Item Count: 305
Click to expand...
Click to collapse
File Summary:
Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default, Total NV Item Count: 319
Click to expand...
Click to collapse
And these are only the "official" NV items... and not the hidden one...
Example...
Code:
NV item: [B]2608[/B] [NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I], index 0
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 0: 12 3d fc ff 9c 3c fc ff 26 3c fc ff b0 3b fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 1: 34 3b fc ff af 3a fc ff 2a 3a fc ff a6 39 fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 2: 22 39 fc ff 9f 38 fc ff 0c 38 fc ff 65 37 fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 3: be 36 fc ff 18 36 fc ff 73 35 fc ff ce 34 fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 4: 2a 34 fc ff 87 33 fc ff e5 32 fc ff 43 32 fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 5: a2 31 fc ff 01 31 fc ff 61 30 fc ff c2 2f fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 6: 23 2f fc ff 85 2e fc ff 85 2e fc ff 85 2e fc ff
NV_GSM_850_AMPM_MASTER_TBL_SEG8_F1_I 7: 85 2e fc ff 85 2e fc ff 85 2e fc ff 85 2e fc ff
sorry for my english, I mean to say that i find some differences..
between 2 firmwares, I find 40 differents NV items using "RF NV items Manager" program.
Example:
European 1.2 Firm:
Code:
NV item: 5059 [NV_WCDMA_2100_TX_LIN_MASTER_0_ENH_I], index 0
NV item: 5061 [NV_WCDMA_900_TX_PDM_LIN_0_ENH_I], index 0
American 1.0 Firm:
Code:
NV item: 5064 [NV_WCDMA_1900_TX_PDM_LIN_0_ENH_I], index 0
NV item: 5060 [NV_WCDMA_800_TX_PDM_LIN_0_ENH_I], index 0
(it's look like these items manage the umts network)
This are 2 items of 40 that I find.. So, I imported all 40 1.0 American Firmware Nv Items to the 1.2 Euro Firmwared Phone, (using previous modified .QCN file) then, i restart the device, but nothing happen, still no find UMTS network... But i want believe that we are close to find the solution
If I use PSAS to Display the new added NV items, these appear as "inactive item" and those already on the phone appears lile "bad parameter"
not know what else I can try...
Even if NV items count is different. Dump of NV area will be always the same in size. Area in oneNAND reserved for NV data is constant, and in most it's just empty space, filled with zeros.
Is it possible to dump whole NV items list using QPST? Can you guys do that and send dumps to me?
If not please search for following NV items and send me values you get (if you get any)
Int id 556
Int id 5
Int id 7
Int id 1403
String id 254
String id 387
String id 388
String id 256
String id 197
I want to prove some theory just taken from Bada kernel and need few different values to compare. These should contain Timezone, Locale and SimBlock settings. (If these NV items are even available)
Please send me PMs with dumps if you get any. Thanks in advance.
Tell me when you are ready "amms.bin" to "bada 2.0" so I can put it on my phone. I'm from Argentina. Thank you very much!
Rebellos said:
Int id 556
Int id 5
Int id 7
Int id 1403
Click to expand...
Click to collapse
With "PSAS" display "Inactive Item", and with "RV NV item manager" i don't these id's..
@adfree
Hey, if I wrote in phone (with "RV NV item manager") some NV items, is not take any effect... does exist another step to "activate" these items or some? maybe in Stune have to add any parameter? or maybe the "QPST Service program" tool..
I have fear of breaking the handset really... I just wan't to calibrate the UMTS bands, need these:
WCDMA_II_PCS_1900
WCDMA_V_850
http://forum.xda-developers.com/showpost.php?p=12436452&postcount=1
Other way to access NV items.
Now you can backup with sTune for instance... folders:
Code:
[B]NV
nvm[/B]
EXTREME Caution!
Some IDs are protected... so you can maybe write/activate, but not easily remove change = brick...
Best Regards
a little question..
there is a firmware of S8530 which has bada 1.2 and 850/900/2100Mhz 3g bands capable... there are firmwares prepared for Brazil and Australia.
it's posible to flash that amss.bin in a S8500 with bada 1.2?
I tried this, but the bootloader says "error erase amms"
amss.bin in a S8500 with bada 1.2?
Click to expand...
Click to collapse
If I remember correct, then yes...
Maybe not all combinations...
BUT check Multiloader ... adresses are different...
So you have to edit...
Later more.
Maybe give Link to this S8530 Firmware, so I can take an look or try for you...
Best Regards
hi guys a couple days ago, I wanted to edit my "init.rc" file, to add some improvements and some other useful services and I quickly
realized that the best method of doing it (for many reasons), was by editing my boot image, by extracting the ramdisk which contains this file and some other interesting files too.
In my quest for the best or most appropriate method to do it, I found many interesting posts and many tools and scripts,
recommendations, and so on... but more importantly were always the warnings about hazards of doing it, because are all due to
very specific to a device specific too.
(I am happy and thank you so mutch for that).
I finaly realized that for sure the best method to do it is using an hex editor.
Thankfully I'm familiar with hex editors, but until now not yet tried anything successful because I still have one question:
What I think I know so far:
- Please correct me if I'm wrong -
1-The file structure of the androids boot image file is not standardized but we have
some known addresses and headers (which is very helpfull).
2- From 0x00000000 to 0x00000800 Is the "boot.img" file header of android.
3- After that address, comes the kernel data.
4- The hex value "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 8B" Is the bigining of a gziped ramdisk data.
Here are my question:
1 - Can I just un-gzip + un-cpio, edit my file "init.rc" and re-cpio + re-gzip the ramdisk
(extracted from my hex editor in raw) and put it back in my "boot . img "?
Could someone help me understand better this?
Sorry about my english !