Develop Bugs

tool to access the samsung onedisk flash

i wrote a new tool that you can use to read the rom image, it can be found at:
http://nah6.com/~itsme/bkondisk.zip
Code:
usage:
first copy bkondisk.exe to \windows on your device, then:
prun bkondisk [targetdir]
will save all partitions on all volumes in files on [targetdir]
prun bkondisk -v0 -p1 [targetdir]
will save a specific partition on [targetdir]
prun bkondisk -v0 -b0 -n1 \firstblock.img
will save the specified blocks to \firstblock.img
prun bkondisk -i
will only list disk info in the logfile "\bkondisk.log"
-v0 or -v1 to specify the volume
-p0, -p1, etc to specify a partition
-b0 etc to specify a starting block ( ignoring partioning )
-n32 specifies to read 32 blocks starting at the above block.
note: you DON'T need to put quotes around directories with spaces in it.
when no path is specified, files will be created in the root.

Thanks! I've got a couple of questions... it extracted the following files:
bk_00_0000.img
bk_02_0005.img
bk_03_0025.img
bk_06_0001.img
bk_08_0175.img
What do these files refer to (which one is the ROM, etc). Also, is there a way to write these backups back to the phone? It would be a great way to try out test roms and get back to my original T-Mobile ROM if necessary.

bk_00_0000.img - IPL : ONBL1 + ONBL2
bk_02_0005.img - GSM + splash + gsmdata + simlock + serialnrs
bk_03_0025.img - OS
bk_06_0001.img - SPL
bk_08_0175.img - userfilesystem

Is there a way to write them back to the phone? or is that not possible...

is it possible to get a .nbh files out of these files?
My idea would be to "glue" the 4 files together (bk_00 to bk_06) in one file, rename the file to RUU_signed.nbh and exchange the RUU_signed.nbh created by the RUU.exe in \Profiles\[user]\Local Settings\Temp\pftxx.tmp with this one and then run on the RUU.exe with the modified .nbh
for example in DOS:
copy /b bk_00_0000.img+bk_02_0005.img+bk_03_0025.img+bk_06_0001.img RUU_signed.nbh
Is it that simple?
EDIT:
Ok this easy way doesn't work.
RUU says "Error 238 - File read"
Maybe some kind of checksum is missing....

Three questions for itsme
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.

Maybe this helps a little bit to get ideas.
I have been searching here for nights - this is what I found so far:
1. I think it's similar to the Hermes - nobody found a way till now - the first step is to modify a signed .nbh, deleting works but not adding a file:
Hermes - how to dump ROM
Hermes - new custom ROMs
Hermes - ROM cooking and Bootloader MFG 1.01
aChef ROM Utils
2. This is the way Imei-Check is CID-unlocking - investigated by pof:
Reverse Engineering the Herems imei-check unlocker
Maybe there is another way like Zone-MR is doing it for the Star100/Qtek 8500
Star100 Unlock procedure but here you have still to decryt/encrypt the block in my understanding and therefore you have to find out the key
3. I didn't find anything about this so far, but I think the information is anywhere at XDA-Developers
EDIT: here (nl)itsme wrote:
.... but i am still busy, have not had the time to look at creating a tool to convert a memdump to a updater file.
Click to expand...
Click to collapse
so I hope he will find the time to create this tool
P.S: @itsme and @pof: I also want to thank you very much - you are heroes!!!
mar11974 said:
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.
Click to expand...
Click to collapse

I got different files ...
After running the tool I got :
bk_0__0000.img (IPL? Is it same as bk_00_0000.img?)
bk_02_0005.img (GSM + splash + gsmdata + simlock + serialnrs)
bk_03_0025.img (OS)
bk_06_0001.img (SPL)
bk_08_0185.img (?????)
I did not get bk_08_0175.img, though.
Hints?
On the other hand, is it possible to extract files out of IMG files?
Thanks.

Tutorial for ipaq hx2000 series rom cooking

Rom cooking tutorial for hx2000 series
We will need:
mamaich's tools:http://mamaich.uni.cc/wm_re/imgfs_tools.rar
hx2000_tool: http://rapidshare.com/files/7435199/hx2000_Tool.rar.html
PEID: http://rapidshare.com/files/10292835/PEiD.rar.html
1. Open the program hx2000_tool.exe
2. There are two buttons: unpack & pack. Push unpack and select the nbf file of your rom. From extraction we take the nk.nba in the same folder as the nbf file is. put this file in mamaich tools folder
3. Now we will use mamaich tools.
Open a command prompt window and go to mamaich tools folder. Then run:
prepare_imgfs nk.nba
viewimgfs imgfs_raw_data.bin
And now we have the Dump folder with the extracted rom's files.
4. With this commands:
addfile(filename)
delfile(filename)
we can add or remove files.
When we finish all changes that we want to do we use the command:
buildimgfs
5. After run the command:
make_imgfs.exe nk.nba
6. We execute again hx2000_tool.exe to pack the new rom.This time we select pack(we must move the nk.nba back to the folder of the nbf), we check the option Pool size and we select from the list the pool size.
7 Correct the crc
For this we use the PEID program. Run PEID and select your rom's nbf file. Push the arrow on the lower right corner and select plugins -> crc32. Appears a small window.Enter the crc of our rom(for sp33752 the crc is E7A8B309) in collumn New crc. Check the "Overwrite mode" and press Fix.
8. The rom is ready for flash to the device.
Note:
These are translated from 4pda.ru( thanks to russian developers)
and I haven't more information for you. More you can find in 4pda.ru

great
Great!!
I think this is instruction of how to delete and add files from and to a ROM.
Dump a ROM out then delete/add files then pack it back...
Great work translator and the Russ.
Dancer69 and others... can you find me the info how to flash my hx2190b ?
I keep getting mismatch SKU when I tried to flash ROM WM6 from Rom version 1.00.00H
Thank you and waiting for your answers

I don't know if you already tried this but I read in 4pda.ru(from what I understand cause I don't know russian and I use wordlingo for translation and its not good) that someone with 2190b succeed to flash with this way:
He run the ruu utility from sp33003 and when pass the check he replace the EPAKROM.nbf with the nbf from wm6(first rename it).

XIP extraction
Additional information to your cooking tutorial : How-to extract XIP for HP2xxx
RomMaster 2.3 is needed (with -b option)
http://rapidshare.com/files/84961371/XIP_Tools.rar
You need nk.nba (from step 2 of dancer_69's tutorial):
> Rommaster.exe nk.nba -w 5 -b 0x00280000 -x -o xip.bin
Create an empty directory named XIP (aka : > mkdir XIP)
> Dumprom.exe xip.bin -5 -d XIP​
You wil found the XIP in XIP directory!

WM 6.5 rom cooking newbie
Ok...I am trying to remove as much unneccesary stuff off the wm6.5 rom for my iPAQ hx2410 as possible like bubble breaker,etc. I dont really know what else I can remove witout hurting the whole system so I am wondering what else I can remove that can make it lighter...also I want to replace windows media player with core player but I only have the cab file for core player and when I try to build it, there is an error...How can I add new programs without these errors??? Also, I followed all the necessary steps posted above except the last part with the peid file i was supposed to download...It says it was a virus so I found an updated Peid but i didnt see the option to finish that last step..I am very very new at cooking so anything u can advise me about doing so would be helpful..THANK YOU IN ADVANCE!!!

Is there a semi-specific list of files which are safe to remove? I followed the steps and I have a dumped ROM, but now that I can play with the files, I don't know what to remove without destroying dependencies or killing the functionality.

How to change my first boot screen ?

Any one knows ?

You try to search for "splash screen"
Which model of phone you have? I've made my own for 838 pro

yeah,i have 838 pro too...can u explain step by step how? thx before u explain...

Follow this link http://wiki.xda-developers.com/index.php?pagename=Hermes_Dialers
Here's the basic steps
1. The app you download only works on XP (some xp may missing some of the *.dll file, you may search on the internet for the missing dll file that required).
This Can ONLY Be Done On XP (nb_image_converter.exe dont like vista!!)
Firstly create your splashscreens using your favourite picture editor (PSP, Photoshop etc...), both these files MUST be 240x320 and saved as 24bit bitmaps:
Name of Image Size Type Description
* MainSplash.bmp 240x320 .bmp the first splashscreen you see
* SubSplash.bmp 240x320 .bmp the second splashscreen you see
* welcomehead.96.png 320x320 .png the WM splashscreen
Save mainsplash & sudsplash into Custom Splash
Save welcomehead.96.png and paste it into the /windows folder on your device (overwriting the current windows splashscreen).
Copy files "nb_image_converter.exe" & "padding.nb" into Custom Splash. Now run "nb_image_converter.exe" load both images, save them as Main.nb & Sub.nb.
Next open a command window, and place Custom Splash Folder in Root of C:
In the command window type the following:
cd c:\custom_splash (enter)
copy /b Main.nb+padding.nb MainSplash.nb (enter)
copy /b Sub.nb+padding.nb SubSplash.nb (enter)
dir (enter)
The final command (dir) will list the contents of the directory, the filesize of MainSplash.nb and SubSplash.nb MUST be exactly 262144 bytes
or you should NOT continue (would produce possibly FATAL results for the device)
We now need to repackage the two .nb files into a single nbh image so we can flash them, s
1) Start duttys good nbh tool:
2) click the "NB to NBH"
3) Click the First Splash and select the MainSplash.nb file, click the second splash and select the SubSplash.nb.
4) MAKE SURE that Device = HERM200, CID Type = SuperCID and Signature Size = 128 (my 838pro = herm100)
5) Now click the "Generate NBH File" button, save it on your desktop.
The next stage is to flash to the device using CustomRUU, simply place the custom ruu exe file in the same folder as the NBH file we just created and run it.
Select 'autodetect' and flash as normal.
Thanks to URPREY for the tutorial

Splash Screen

Hey guys, I have flashed a couple roms throughout the past 2 months, and i usually use Task 29 to wipe anything remaining but for some reason I get the Splash Screen from the Core Cell Evo roms, although im using the Energy GTX July 4 rom. Anyone know how to make this go away? or somehow I could change that? thanks

Not sure if this will help, but still trying to post something that may help you...
My phone was using the original HTC rom that came with T-mobile settings. Today I flashed its ROM with the following version :
ROM Name : WWE RHODIUM Cookie Energy style
ROM Version : 03.Jul.2010 WWE
ROM date: 03/15/10
RADIO Version : 3.45.25.14
and it removed the original T-mobile splash screen and also allows me to control the splash screen as follows :
Start -> Tools -> Advanced Config -> Splash
Hopefully it helps..

khoyifish said:
Hey guys, I have flashed a couple roms throughout the past 2 months, and i usually use Task 29 to wipe anything remaining but for some reason I get the Splash Screen from the Core Cell Evo roms, although im using the Energy GTX July 4 rom. Anyone know how to make this go away? or somehow I could change that? thanks
Click to expand...
Click to collapse
Yes, many of the custom ROMs will overwrite the initial splash screen. You generally have to manually install the screen you want - but depending on the ROM (some chefs don't change it), you may have to manually change the settings. There are several threads on the APPS forums dealing with changing the startup screens.
Note that there are two startup screens. The first one comes up right after power on / reset. This one has to be flashed. Then there is an (optionally) animated one that can be easily changed.

[How-To] Custom Boot Screen
stevedebi said:
Note that there are two startup screens. The first one comes up right after power on / reset. This one has to be flashed. Then there is an (optionally) animated one that can be easily changed.
Click to expand...
Click to collapse
There are actually three boot/splash/startup screens. The first one comes on after the little vibration when it turns on. The second one is the screen that contains the "R.G.D." info (in red) at the bottom left of the screen. The third is the one that can be changed easily. The first two are changed by flashing an .nbh file, and the third can be changed via reg tweak or cab.
.....
You can change the first two boot screens by flashing a stock ROM.
OR, to really customize the first two boot screens, you can do this:
**This will not affect your ROM, radio, and SPL (so don't worry). It will simply flash the first and second level boot screens. But you do need HardSPL.**
***This has only been tested (by me) on a T-Mobile USA Touch Pro2 (Rhodium 210 model; hence the RHOD210 in the code). I am not responsible for bricks!***
EDIT: I think it works for all GSM Rhodium variants; if it doesn't flash, it'll just say "Invalid Model ID" so it shouldn't brick (as long as you have Hard SPL). HOWEVER, I don't know about CDMA (Sprint/Verizon/Telus) models.
1. Download the nbimg tool.
2. Get a 24-bit, .bmp photo that is 480x800. You can resize and save the photo (as a .bmp) by using Microsoft Paint.
3. Unzip the nbimg tool. Put your photo in the same unzipped folder.
4. When you're in the unzipped folder, run a command (SHIFT + Right Click. Open Command)
5. In the command write this:
Code:
nbimg -p 18400 -w 480 -h 800 -F [U]insertnameofphotohere[/U].bmp -T 0x600 -S 64 -D RHOD210
6. Get the Rhodium RUU here (download the "Flashing Tools").
7. Put the .nbh you created in the same folder as the RUU.
8. FLASH -- it should have flashed the first boot screen.
9. To change the second boot screen, go back to step 5 and enter this (you can also change the picture, if you want! Just make sure it's in the same folder as the nbimg tool.):
Code:
nbimg -p 18400 -w 480 -h 800 -F [U]insertnameofphotohere[/U].bmp -T 0x60[B]1[/B] -S 64 -D RHOD210
10. Repeat steps 7-8. You should now have your custom first- and second-level boot screens.
I attached 2 of my boot screen pictures -- one from my TP2 and one from my HD2. I actually don't like the one from my TP2 because the scale of the phone in the picture is bad -- it was a resizing issue.

sumflipnol said:
There are actually three boot/splash/startup screens. The first one comes on after the little vibration when it turns on. The second one is the screen that contains the "R.G.D." info (in red) at the bottom left of the screen. The third is the one that can be changed easily. The first two are changed by flashing an .nbh file, and the third can be changed via reg tweak or cab.
.....
You can change the first two boot screens by flashing a stock ROM.
OR, to really customize the first two boot screens, you can do this:
**This will not affect your ROM, radio, and SPL (so don't worry). It will simply flash the first and second level boot screens.**
***This has only been tested (by me) on a T-Mobile USA Touch Pro2 (Rhodium 210 model; hence the RHOD210 in the code). I am not responsible for bricks!***
1. Download the nbimg tool.
2. Get a 24-bit, .bmp photo that is 480x800. You can resize and save the photo (as a .bmp) by using Microsoft Paint.
3. Unzip the nbimg tool. Put your photo in the same unzipped folder.
4. When you're in the unzipped folder, run a command (SHIFT + Right Click. Open Command)
5. In the command write this:
Code:
nbimg -p 18400 -w 480 -h 800 -F [U]insertnameofphotohere[/U].bmp -T 0x600 -S 64 -D RHOD210
6. Get the Rhodium RUU here (download the "Flashing Tools").
7. Put the .nbh you created in the same folder as the RUU.
8. FLASH -- it should have flashed the first boot screen.
9. To change the second boot screen, go back to step 5 and enter this (you can also change the picture, if you want! Just make sure it's in the same folder as the nbimg tool.):
Code:
nbimg -p 18400 -w 480 -h 800 -F [U]insertnameofphotohere[/U].bmp -T 0x60[B]1[/B] -S 64 -D RHOD210
10. Repeat steps 7-8. You should now have your custom first- and second-level boot screens.
I attached 2 of my boot screen pictures -- one from my TP2 and one from my HD2. I actually don't like the one from my TP2 because the scale of the phone in the picture is bad -- it was a resizing issue.
Click to expand...
Click to collapse
I used that on my old Magician, I didn't realize the same technique worked on the TP2.

OK, that was easy
I have attached the image I used, and the nbh files that I used.
hd_480_1.bmp - source picture
hd_480_1.bmp_1.nbh - Initial boot screen
hd_480_1.bmp_2.nbh - 2nd boot screen
I didn't put the "TP2" logo on the screen, because I figure I know what device I'm using!
EDIT: I don't mind anyone using them freely, but the picture may NOT be used for commercial purposes.

Question:
I made my bmp file, converted it to .nbh, but now I am not sure which "Rhodium RUU" to get and that link ( post 4 under 6. ) gives many files but nothing clear to what I am looking for.
Line 6 is this one:
6. Get the Rhodium RUU here (download the "Flashing Tools").
I thought I might be able to use "Rhodium_CustomRUU_v1.1" found at this thread:
http://forum.xda-developers.com/showthread.php?t=492930
but I need a confirmation from someone who knows this as I sure dont know will this do damage or help me make my new splash screen.
I will be using as my 1st splash this picture I found using google:

Weird OS.NB extracted?

Hello, I've tried extracting imgfs.bin from LG WM 6.5 firmware, and it results in some weird way.
The points I'm curious at are:
1. Unpacking .KDZ results in *.wdb, not .DZ.
2. Unpacking *.wdb results in weird binary file, not in .tot
3. Resulted binary file seems to be in Qualcomm .MBN format, but there seems to be almost no details within it. Are there any docs about this format?
4. I've tried using osnbtool (with -sp option), then it failed with this message: Can not find OS image! So I've searched it for a bit, then found that I have to rip off all the LG-specific regions to work. So I ripped those off (with custom unyaffsmbn), tried osnbtool again then it worked.
LU210927_00.bin.new.PRE written.
LU210927_00.bin.new.OS.NB written.
Now I get these two, so I tried nbImageTool on OS.NB generated. It extracted imgfs.bin, but seems like it is corrupted... Did I miss something?
Here is the link to the extracted OS.NB: https://drive.google.com/file/d/1vPHWbiHproO_bs09WASc8YreWNaJVrZr/view?usp=sharing
And here is the link to the original firmware (kdz): https://drive.google.com/file/d/1YknA0mg27YfaGEHr10XJ1k8ztgw_V3fA/view?usp=sharing
Thanks a lot!