Develop Bugs

Help me dump the OS of my PPC

Hi!
I need your help!
I have an Airis T620 PPC, the official patch from the manufacturer's site for WM5 bricked my PPC.
The AirisT620 is a MIO P550 clone, and I've downloaded the WM5 ROM for Mio P550 (MioP550 - Osc260A R05_P09.nb0) and I've intalled it succesfully on my AIRIS.
BUT, I'd like to dump the WM5 of my friend's AIRIS to a *.nb0 file to upload to my PPC. I've downloaded itsutilsbin-20070705.zip and created a RAW image.
Here's the list of the Parts:
C:\itsutils>pdocread -l
127.00M (0x7f00000) SMFLASH
| 1.12M (0x11fc00) Part00
| 1.88M (0x1e0000) Part01
| 26.63M (0x1aa0000) Part02
| 97.38M (0x6160000) Part03
976.50M (0x3d080000) DSK1:
| 976.38M (0x3d061600) Part00
STRG handles:
handle 63d1c926976.38M (0x3d061600)
handle a3f5081e 97.38M (0x6160000)
handle a3f5012a 26.63M (0x1aa0000)
handle 23f50106 1.88M (0x1e0000)
handle c3f74f2a 1.12M (0x11fc00)
disk 63d1c926
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3f5081e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3f5012a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 23f50106
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c3f74f2a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
I used this to create the RAW image:
Pdocread -w -d SMFLASH -p Part02 0x0 0x1aa0000 Part02.raw
If I try to make an *.nb0 directly I get the following error message:
C:\itsutils>pdocread 0 0x1aa0000 asd.nb0
CopyTFFSToFile(0x0, 0x1aa0000, asd.nb0)
ERROR: ITReadDisk : read 00000000 bytes - A device attached to the system is not
functioning.
How can I convert the raw to nb0, or how can I dump the ROM directly to nb0?
Thank you for your help!

Hi again!
I tried several methods during the weekend. All failed somewhere.
First I tried to dump the OS to hex.
C:\itsutils>pdocread -h 0xc3f0518e 0x0 0x1aa0000 OS.nb
The error message was:
CopyTFFSToFile(0x0, 0x1aa0000, OS.nb)
ERROR: ITReadDisk : read 00000000 bytes - A device attached to the system is not functioning.
the itsutils.log said:
ERROR: DeviceIoControl(FL_IOCTL_READ_SECTORS) - A device attached to the system is not functioning.
than I tried:
C:\itsutils>pdocread.exe -n 2 0x0 0x1aa0000 OS.nba
error:
ERROR: ITTFFSGetInfo - A device attached to the system is not functioning.
WARNING: using default 512 bytes for sectorsize
CopyTFFSToFile(0x0, 0x1aa0000, OS.nba)
ERROR: ITReadDisk: outbuf==NULL
- A device attached to the system is not functioning.
after that I tried using bkondisk, and bksamsungflash:
C:\itsutils>prun bkondisk -i
in the bkondisk.log:
ERROR: kioctl(FLASH, init1) - The network request is not supported.
error initializing flash
bksamsungflash gives the same error in its log
And my last try was:
C:\itsutils>Pdocwrite -w -d SMFLASH -p Part02 Part02.raw 0x0 0x1aa0000
CopyFileToTFFS(Part02.raw:0, 0, 01aa0000)
and the last error message was:
ERROR: ITWriteDisk - The media is write protected.
How can I acquire the D-O-C password for my PDA?
Anyone has any ideas how to step further?
P.S.
The policies in HKLM\Security\Policies\Policies\00001001 is set to dword '1'
And I think my PPC is missing the IOCTL Api, how can I install it on my PPC?

Is it more simple using SPB backup.. say backup a good version of the system (without PIM) and flash over?

Hi myc!
Yes, I am using SPB backup to backup my personal files, but in this case I need to acquire the operating system of my PDA, witch can't be done with SPB backup.

Hi! (For borisbme Szia!)
Here I summarize my experiences with T620.
NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the below things you will risk that you make your device a brick. Try this at your own risk!
First take a look at the MioP550 - Osc260A R05_P09.nb0 file. The header structure seems to be rather straightforward.
0x00: "Pocket_PC_2005" \x00 \x00 \x00
0x10: 4 bytes : offset of the 1st section
4 bytes : length of the 1st section
4 bytes : checksum
4*'\x00'
0x20: "MS_IPL" som '\x00's
0x30: 4 bytes : offset of the 2nd section
4 bytes : length of the 2nd section
4 bytes : checksum
4*'\x00'
0x40: "OS_IMAGE" some '\x00's
0x50: 4 bytes : offset of the 3nd section
4 bytes : length of the 3nd section
4 bytes : checksum
4*'\x00'
0x60: "UBOOT" some '\x00's
I believe the 1st secion is the update loader , the 2nd is the actual update in MSFLSH50 format (-acer type) and the 3rd is UBOOT update.
Let's not touch the IPL and UBOOT section for a while ;-)
Based on the above information you can split the image into 3 parts and change the OS_IMAGE part.
I noticed that the checksum is for verification purpose but it does not prevent the flashing of an image with wrong checksum. I learned that because I changed the checksum to FFFFFFF to see how flashing reacts, but after a few "Bad checksum, press any key" messages I accidentally flashed my T620 with the above P550 ROM :-(
Let's look at the OS_IMAGE part.
If you want quick dump, you can try prepare_imgfs "saved OS_IMAGE file" -n -acer and view_imgfs , but you can further decompose the file.
I wrote it's "-acer" type, because it has 512 bytes sectors padded with 8 extra bytes. If you remove the padding then you have a clean MSFLSH50 file you can manipute with msflshtool.
Here I can see some difference between the P550 and T620. The 1st sector is the MBR and the partition sizes are different for the 2 device. The 2nd sector is still MSFLSH50 header, I don't know the structure, so would not change that. My assumption was, that it the file sizes are the same, it would not hurt to replace parts ;-)
One can go further with the P550 partition sizes and change T620 dumps to fit into it.
With the following little python script you can split the OS_IMAGE into parts. Do not comment the code , I not a skillful coder;-)
Code:
from binascii import hexlify
from struct import unpack
parts = (("part00",0x8FE),("part01",0xF00),("filler",0x200),("part02",0xD500))
infile = open("OS_IMAGE.dat","rb")
## MBR
mbr=open("mbr.dat","wb")
data = infile.read(520)
mbr.write(data)
mbr.close()
## HDR
hdr=open("hdr.dat","wb")
data = infile.read(520)
hdr.write(data)
hdr.close()
for (part,size) in parts:
print "Extract part ",part
ofile = open(part+".dat","wb")
for i in range(0,size):
data = infile.read(512)
marker = infile.read(8)
ofile.write(data)
ofile.close()
print "Extract rest"
ofile = open("rest.dat","wb")
while True:
data = infile.read(512)
if len(data) == 0:
break
marker = infile.read(8)
ofile.write(data)
ofile.close()
part00 corresponds to the "pdocread" dumped part00 ( I guess it's the bootloder)
part01 corresponds to the "pdocread" dumped part01 ( I guess it's the kernel partition)
part02 corresponds to the "pdocread" dumped part02 ( It is the IMGFS OS image )
With the following little python script you can combine back the parts into a "new" OS_IMAGE you can use to replace the corresponding part in the ".nb0"
Code:
from binascii import hexlify
from binascii import unhexlify
from struct import unpack
from struct import pack
parts = (("part00",0x2,0x8FE,"fdfffbff"),("part01",0x900,0xF00,"fdfffbff"),("filler",0x0,0x200,"fffffbff"),("part02",0x1800,0xD500,"fffffbff"))
outfile = open("NEW.dat","wb")
## MBR
mbr=open("mbr.dat","rb")
data = mbr.read(520)
outfile.write(data)
mbr.close()
## HDR
hdr=open("hdr.dat","rb")
data = hdr.read(520)
outfile.write(data)
hdr.close()
for (part,start,size,mark) in parts:
print "Combine part ",part,start,size
ifile = open(part+".dat","rb")
for i in range(0,size):
data = ifile.read(512)
if data == '':
print "Less data"
data = '\xff'*512
if(data == '\xff'*512):
marker = unhexlify('ffffffffffffffff')
else:
marker = pack("<L",start+i)+unhexlify(mark)
outfile.write(data)
outfile.write(marker)
ifile.close()
print "Combine rest"
ifile = open("rest.dat","rb")
while True:
data = ifile.read(512)
if len(data) == 0:
break
marker = unhexlify("ffffffffffffffff")
outfile.write(data)
outfile.write(marker)
ifile.close()
outfile.close()
The part00 and part01 is smaller in case of T620 with 0x100*512 bytes compared to P550. Add some '\FF\s to have the same size.
The part02 is bigger in case of T620, but the end of it is full of zeroes. Remove some zeroes to have the same size.
If you bring T620 dumped files to same size, you can replace those parts, combine back to OS_IMAGE and replace that part in the .nb0
The part02 can be fully edited with imgfs tools.
The part00 and part01 has SRPX signature, so you can use SRPX2XIP and then xipport or dumprom to check the content.
The .nb0 got this way can be flashed using DNW.
The next step would be the cooking ;-)
With imgfs tools you can easily remove/add packages. The unfortunate thing is that if you change AKU level then you might have to modify the 2 XIP parts as well. I have no experience with that (so far).
Also for porting WM6 it would be really good the have the pdocread dump of the P560 partitions ;-)
Hope this helps a little bit for proceeding with T620/P550 cooking/porting.
NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the above things you risk that you make your device a brick. Try this at your own risk!

Wowww!!
This post is really Interresant !
I have a mio p550, and i have an mio p560 dump !
Anyone can help me how to port the mio p560 rom to my p550 rom ??
great thanks !!!

Airis T620 Raw files
Hi,
I've dumped my ROM, and now I have the raw files. Can anyone tell me how to convert them back into a usable ROM? Thanks in advance.

new rom for Samsung SGH-I780 - i780DXHC1

Can someone please asist this guy to dump it?
or explain there (PPCSG) How to?
http://www.ppcsg.com/index.php?showtopic=98612&st=240#
Thanks,
Nadav.

Nadavi said:
Can someone please asist this guy to dump it?
or explain there (PPCSG) How to?
http://www.ppcsg.com/index.php?showtopic=98612&st=240#
Thanks,
Nadav.
Click to expand...
Click to collapse
Hi Nadav, can you also share with us the steps on how you create an upgradeable ROM from the dump ROM? Thanks.

Go here:
http://forum.xda-developers.com/showthread.php?t=370529&highlight=topogigi&page=28

hello oddball1
but what is the operation to have the 3 files r*.aw ?
when i use this link i have o lot of error : http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
do you have th good parameter for the samsung ? or the parameter do you have uded to dump your rom

sacha06 said:
hello oddball1
but what is the operation to have the 3 files r*.aw ?
when i use this link i have o lot of error : http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
do you have th good parameter for the samsung ? or the parameter do you have uded to dump your rom
Click to expand...
Click to collapse
Use this tutorial, it's really complete. You only need to change the length of the raw parts according to pdocread -l results.
http://wiki.xda-developers.com/index.php?pagename=Elf_HowtoDumpRom

Topogigi said:
Use this tutorial, it's really complete. You only need to change the length of the raw parts according to pdocread -l results.
http://wiki.xda-developers.com/index.php?pagename=Elf_HowtoDumpRom
Click to expand...
Click to collapse
Hi Guys,
I've the i780DXHC1 ROM device with me. However, I'm stuck in Step 8, here's the output
D:\itsutils>pdocread -l
254.25M (0xfe40000) DSK1:
| 1.25M (0x13f000) Part00
| 2.88M (0x2e0000) Part01
| 76.25M (0x4c40000) Part02
| 172.50M (0xac80000) Part03
971.50M (0x3cb80000) DSK2:
| 971.38M (0x3cb60e00) Part00
STRG handles:
handle e765de1a971.38M (0x3cb60e00)
handle c77f842e172.50M (0xac80000)
handle 678567be 76.25M (0x4c40000)
handle c785679a 2.88M (0x2e0000)
handle a7856752 1.25M (0x13f000)
disk e765de1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c77f842e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 678567be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c785679a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7856752
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
D:\itsutils>pdocread -w -d DSK1: -p Part00 -t
real nr of sectors: 1 - 512.00byte, 0x200
Did I do anything wrong? Please advise... so that I can upload this ROM to you all
Thanks!

hello paullim29
i have the same error when i try to dump the 3 files *.raw
but no answer in this forum....

sacha06 said:
hello paullim29
i have the same error when i try to dump the 3 files *.raw
but no answer in this forum....
Click to expand...
Click to collapse
i'm trying to locate someone who can help you
Nadavi

See post #3 here:-
http://www.ppcsg.com/index.php?showtopic=98149&pid=701195 :-

hello Ineedtoys
what we found in this link ? thanks
See post #3 here:-
http://www.ppcsg.com/index.php?showt...149&pid=701195 :-

hello,
here the good syntaxe to have the 3 files
pdocread -w -d DSK1: -b 0x800 -p Part00 0 0x11f000 Part00.raw
pdocread -w -d DSK1: -b 0x800 -p Part01 0 0x240000 Part01.raw
pdocread -w -d DSK1: -b 0x800 -p Part02 0 0x5380000 Part02.raw
ps: i have now the rom orange Fr ,

ONLY if those memory addresses match those from the pdocread -l command. Please follow all the instructions and not just quote part!

so is there a new ROM for us to try?

sacha06 said:
hello,
here the good syntaxe to have the 3 files
pdocread -w -d DSK1: -b 0x800 -p Part00 0 0x11f000 Part00.raw
pdocread -w -d DSK1: -b 0x800 -p Part01 0 0x240000 Part01.raw
pdocread -w -d DSK1: -b 0x800 -p Part02 0 0x5380000 Part02.raw
ps: i have now the rom orange Fr ,
Click to expand...
Click to collapse
What version of the rom you've got?
Well,
Upload the rom to rapidshare.com
so we can create a usable rom from it.

like you see in my msg, rom orange FR

sacha06 said:
like you see in my msg, rom orange FR
Click to expand...
Click to collapse
I think he meant the version. Go to Start > Settings > System > Version. You can then obtain the PDA & PHONE version.
If everything goes well, I'll be uploading the DXHC1 ROM today! This comes with the hard-reset + new mouse driver and it's in English (Singapore)

paullim29:Thank you! I really need the "Hard reset".

paullim29 said:
I think he meant the version. Go to Start > Settings > System > Version. You can then obtain the PDA & PHONE version.
If everything goes well, I'll be uploading the DXHC1 ROM today! This comes with the hard-reset + new mouse driver and it's in English (Singapore)
Click to expand...
Click to collapse
Thank you paullim. I am waiting this ROM too.

paullim29 said:
I think he meant the version. Go to Start > Settings > System > Version. You can then obtain the PDA & PHONE version.
If everything goes well, I'll be uploading the DXHC1 ROM today! This comes with the hard-reset + new mouse driver and it's in English (Singapore)
Click to expand...
Click to collapse
great !!! excellent work and hope to see the rom today!!!
gotta love xda-dev!!!

Hi Guys,
Here's the DXHC1 ROM!!! Please get it to flashable format so that we all can upgrade to this latest firmware Thanks to all the great guys' help. Without them, this wouldn't be possible at all...
http://rapidshare.com/files/111926777/DXHC1.zip

Backup questions - Updating wm5

Hi everyone,
i looked around a bit in this forum and i´m really interested in updating my (currently 2.2.0) wm5 to a newer release.
But there are still some questions I could not find an answer for...
When updating with "your" Firmware that i found for n5x0 series i have to manually change the language in the firmware file to match my device.
What language will wm be?
Another problem is my personal data. Since i dont use m$ outlook on my desktop device i can´t sync my contacts etc. with my desktop.
Will my contacts, calendar, ... be like before flashing or will it restore the whole device to delevery status? (if not will my apps remain?)
Or is there a way to create an backup image of the whole active system including windows, and all internal memory? With my previous device (or active sync version?) i was able to create backups (even if not the whole windows were backed up at least all contact´s ... were)
Is it possible that the device will be "dead" after flashing? (no way to flash a backup or new rom)
What to do to be sure that wont happen to me?
And maybe one of the most important questions:
I´m using Navigon 6 that was included to my device, will i be able to use the software with my key as before? Is there maybe a workaround to make it work again after flashing?
i read bad things about this :/
i´m sorry if there´s a collected answer to those questions but i´ve searched a lot about this topic before writing here and didn´t get clear answers to my questions
I´m thinking about flashing:
OS_213U.nbf
(for Loox N5x0 series, link found here in this board, thread: http://forum.xda-developers.com/showthread.php?t=294165 )
with it´s included flash util
(PocketLOOX5xxFlashTool.exe)
Currently i´m running the German version of WM5 (2.2.0)
i would be glad about an advice
best regards
Forsaken aka Jens

Backup of previous system
i found a tutorial made for some HTC devices to make a dump of the current rom and before I continue updating to a newer wm5 or even wm6 i would like to know if those dumps will help me to restore my system if something´s not working for me.
-- Edit --
link to HTC tutorial: http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
link to used tools: http://www.xs4all.nl/~itsme/projects/xda/tools.html
just if someone wants to do the same
what i did:
pdocread -l
Code:
34.97M (0x22f7400) TrueFFS
| 3.06M (0x30fc00) Part00
| 3.56M (0x390000) Part01
| 28.34M (0x1c57400) Part02
79.45M (0x4f74000) TrueFFS
| 3.06M (0x30fc00) Part00
| 3.56M (0x390000) Part01
| 28.34M (0x1c57400) Part02
STRG handles:
handle 6ff40d1a 79.45M (0x4f74000)
handle eff7ffba 28.34M (0x1c57400)
handle 8ff7fdbe 3.56M (0x390000)
handle 0ff7fd9a 3.06M (0x30fc00)
disk 6ff40d1a
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk eff7ffba
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 df 09 01 04 06 11 10 36 02 07 06 ab
disk 8ff7fdbe
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 df 09 01 04 06 11 10 36 02 07 06 ab
disk 0ff7fd9a
2 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 df 09 01 04 06 11 10 36 02 07 06 ab
Partition sizes:
Code:
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part00 -t
real nr of sectors: 6270 - 3.06Mbyte, 0x30fc00
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part01 -t
real nr of sectors: 7296 - 3.56Mbyte, 0x390000
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part02 -t
real nr of sectors: 58042 - 28.34Mbyte, 0x1c57400
So i backed up the 3 Partitions (rom, boot, and kernel) and my appliaction memory
Code:
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part00 0 0x30fc00 Part00.raw
CopyTFFSToFile(0x0, 0x30fc00, Part00.raw)
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part01 0 0x390000 Part01.raw
CopyTFFSToFile(0x0, 0x390000, Part01.raw)
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -p Part02 0 0x1c57400 Part02.raw
CopyTFFSToFile(0x0, 0x1c57400, Part02.raw)
D:\PocketPC\Loox N560\ROMs\utils>pdocread -w -d TrueFFS -h 0x6ff40d1a 0 0x4f80000 Part_6ff40d1a.raw
CopyTFFSToFile(0x0, 0x4f80000, Part_6ff40d1a.raw)
Now i´ve got a "full backup" of my PocketPC's internal memory:
Code:
20.05.2008 01:38 3.210.240 Part00.raw <--- Boot
20.05.2008 01:37 3.735.552 Part01.raw <--- Kernel
20.05.2008 01:43 29.717.504 Part02.raw <--- OS-ROM
20.05.2008 01:13 83.361.792 Part_6ff40d1a.raw <--- Applications
Will these dumps help me to restore my system? (i guess so)
Is there a way to build them into a .ns file that i can reflash my old system?
Will it be possible to write back all dumps using pdocwrite to restore the systems previous state? (including installed apps etc.)
Can i start flashing WM6 without possible lose of data?
PS: i read about you can use any versions of WM Roms, if allowed i could link via rapidshare or whatever a archive of my boot+rom+kernel or maybe .ns file (if i find some tut or someone links it to me )

[How] to dump KS20 RAW Rom (step by step)

The method is based on the Rom Dump for Hermes with a little bit of modifications to suit KS20
http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom
Firstly, download the "itsutils tools" at:
http://wiki.xda-developers.com/index.php?pagename=XdaUtils
Now let's start the process:
1. Unzip the contents of itsutils.zip on c:\itsutils
2. Connect your KS20 to PC using USB cable, and make sure ActiveSync is running
3. Start -> run -> cmd.exe
4. cd c:\itsutils
5. First we are going to find the device handles for all the flash partitions, using pdocread -l
c:\itsutils>pdocread.exe -l
221.88M (0xdde0000) DSK1:
| 1.25M (0x13f000) Part00
| 5.00M (0x500000) Part01
| 69.25M (0x4540000) Part02
| 146.38M (0x9260000) Part03
1.90G (0x79b00000) DSK2:
| 1.90G (0x79ae1200) Part00
STRG handles:
handle 05bba79a 1.90G (0x79ae1200)
handle 65dadd7e146.38M (0x9260000)
handle e5dc0512 69.25M (0x4540000)
handle c5d67fb6 5.00M (0x500000)
handle a5dc04ca 1.25M (0x13f000)
disk 05bba79a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 65dadd7e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e5dc0512
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c5d67fb6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a5dc04ca
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6. If you get the following errror, probably your device is application locked:
C:\itsutils>pdocread.exe -l
Copying C:\itsutils\itsutils.dll to WCE:\windows\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart ActiveSync.
Basically you have to modify this registry key, and then softreset using power button:
HKLM\Security\Policies\Policies
valuename '00001001' was set to dword:2, change it to dword:1
dword: any thing other than 1 disallows unsigned
dword: 1 allows unsigned
7. Note: There are two ways to read each partition: pdocread -h 0xHANDLVALUE 0 0xSIZEVALUE diskimage.nb or pdocread -d storename -p partitionname StartValue LengthValue file.raw
We will use the second method for the next step.
Overview of flash partitions (just for your information, not a step)
FLASHDR STOREINFO 114.88M (0x72e0000) dev='FLASHDR' store='Microsoft Flash Disk'
nsect=39700 bpsect=200 free=0 maxpartsize=0
3.12M ( 0x31fc00) Part00 'BOOT' end= 18fe type=20 image update kernel partition (XIP), used while image updates
2.88M ( 0x2e0000) Part01 'RAWFS' end= 1700 type=23 regular kernel partition (XIP), used for normal OS boot
50.88M (0x32e0000) Part02 'imgfs.dll' end=19700 type=25 imgfs
58.00M (0x3a00000) Part03 'fatfsd.dll' end=1d000 type=04 user filesystem
EXT_FLA STOREINFO 10.00M (0xa00000) dev='EXT_FLA' store=''
nsect=5000 bpsect=200 free=0 maxpartsize=0
10.00M ( 0xa00000) PART00 'fatfsd.dll' end= 5000 type=04 extended rom
This does not include the IPL, splash and SPL.
8. Check that all the partition sizes reported by pdocread are correct:
c:\itsutils>pdocread -w -d DSK1: -p Part00 -b 0x800 -t
real nr of sectors: 638 - 1.25Mbyte, (0x13f000)
c:\itsutils>pdocread -w -d DSK1: -p Part01 -b 0x800 -t
real nr of sectors: 2560 - 5.00Mbyte, (0x500000)
c:\itsutils>pdocread -w -d DSK1: -p Part02 -b 0x800 -t
real nr of sectors: 35456 - 69.25Mbyte, (0x4540000)
Note the partition sizes (in brackets) for the next step. They may differ from device to device.
9. Now let's dump the first 3 partitions (coldboot kernel, base kernel and imgfs), use the sizes you found in the previous step.
c:\itsutils>pdocread -w -d DSK1: -p Part00 -b 0x800 0 0x13f000 Part00.raw
CopyTFFSToFile(0x0, 0x13f000, Part00.raw)
c:\itsutils>pdocread -w -d DSK1: -p Part01 -b 0x800 0 0x500000 Part01.raw
CopyTFFSToFile(0x0, 0x500000, Part01.raw)
c:\itsutils>pdocread -w -d DSK1: -p Part02 -b 0x800 0 0x4540000 Part02.raw
CopyTFFSToFile(0x0, 0x4540000, Part02.raw)
As the Part02.raw file is large, it will take a few mins, dw just wait and it will be done!!!
Note: Step 7 is not important, can be igorned!

Thanks....I got it

it seems that we have method for install english raw file
and we have this unbranded english version
http://rs75.rapidshare.com/files/126667462/DZ-KS20E-00-V10a-454-XX-APR-29-2008_0.zip
did any body try it???

Can i flash my cel with these extracted files?
I'm from brazil, and here we have the MS25 (KS20, almost the same hardware..)
and i have extracted this 3 files, and then extracted imgfs from part02.raw.. I compared the imgfs from my MS25 with a imgfs extracted from a germany's rom flash.bin.. and it maches in almost everything.. except about the sizes (germany dump folder is almost 2x of my rom's dump folder).
my question is.. for exemple: Can i edit the extracted files and re-flash on my phone with no problems? I really need to know this, because i don't wanna brick my phone.. We don't have oficial roms for emergency, LG Brasil is a kind of lazy and still not provide us the oficial ones..
thank's in advance..

brunoargenton said:
my question is.. for exemple: Can i edit the extracted files and re-flash on my phone with no problems? I really need to know this, because i don't wanna brick my phone.. We don't have oficial roms for emergency, LG Brasil is a kind of lazy and still not provide us the oficial ones..
thank's in advance..
Click to expand...
Click to collapse
Nobody can't answer?

I want to know this as well, I'll probably provide a dutch unbranded rom if this method works.

[solved] - file not found (even though its there, or not signed with cert)

I'm looking into cooking my own Diamond roms.
Can anybody point me in the right direction?
I have no experience in HTC rom dev and need information from the ground up.
^.^
Help needed with regard to the proper Diamond kitchen / dev tools, how tos, inserting / removing components from roms etc.
I would be greatly appreciative.
Thanks in advance.
##### 05/07/2008 #####
Some good screencasts throughout the cooking processes
http://forum.xda-developers.com/showthread.php?t=372469
The excellent Kaiser kitchen tuto to get you started:
http://wiki.xda-developers.com/index.php?pagename=Kaiser ROM Kitchen Tutorial

I found a kitchen here:
http://forum.xda-developers.com/showthread.php?p=2341701
But no reviews as to its efficiency yet.
JugglerLKR Kitchen:
http://forum.xda-developers.com/showthread.php?t=405371
neokit:
http://forum.xda-developers.com/showpost.php?p=1800999&postcount=1
bepe's kitchen:
### coming soon ###
Surface Kitchen:
http://forum.xda-developers.com/showpost.php?p=2355807&postcount=3

If you're really serious you might want to start from this thread... Gives you the basics, then search search search through the threads throughout the board... Nobody'll give you a tutorial on this, you'll just have to learn it...

adwinp - there are lot of tutorials on kaiser and diamond predecessor kitchens - browse and read post and wiki about them. Alex's wiki on kaiser kitchen is brilliant. There is nothing complicated in kitchen itself, but making good rom requires lots of trial and error and testing...

Thanks for the info.
Excellent Kaiser tuto, Juggler.
^.^
I've read about ppl using the Kaiser kitchen successfully to build Diamond roms but would like some more info about the actual compatibility.

i've published diamond tested kitchen - you can use it to start
http://forum.xda-developers.com/showthread.php?t=405371

I have added it to post #2 already earlier today.
Thanks.
^.^

# Dumping ROM:
This is from the Kaiser instructions
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw
Are the addresses the same for the diamond?

adwinp said:
This is from the Kaiser instructions
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw
Are the addresses the same for the diamond?
Click to expand...
Click to collapse
No, when i dumped my rom i had to change the FLASHDR

use pdocread -l and u can see partitions

Tools links
http://forum.xda-developers.com/showthread.php?t=331094 --> these are the 'reloc tools
More links to come once I figure out more about the extracting / cooking processes.
An help from a dev would be appreciated.
I'm trying to build a "from-the-ground-up" diamond cooking FAQ.
bepe? elite? bram? Juggler? Anyone?

adwinp said:
http://forum.xda-developers.com/showthread.php?t=331094 --> these are the 'reloc tools
More links to come once I figure out more about the extracting / cooking processes.
An help from a dev would be appreciated.
I'm trying to build a "from-the-ground-up" diamond cooking FAQ.
bepe? elite? bram? Anyone?
Click to expand...
Click to collapse
bepe is making his new kitchen with smooth xip porting etc...
as for tools - they're for relocating modules - usually when you just cooking rom (not porting from other device) you should use g'reloc - that is enough.

Here are my partitions, dumped with pdocread:
C:\htc\flashing\apps\itsutilsbin-20080602>pdocread.exe -l
209.50M (0xd180000) DSK1:
| 124.00k (0x1f000) Part00
| 4.50M (0x480000) Part01
| 88.13M (0x5820000) Part02
| 116.75M (0x74c0000) Part03
3.75G (0xf0000000) DSK7:
| 3.75G (0xefbcd400) Part00
STRG handles:
handle 6434d366 3.75G (0xefbcd400)
handle 47d677b6116.75M (0x74c0000)
handle a7db84d2 88.13M (0x5820000)
handle 87db84ae 4.50M (0x480000)
handle 67db8466124.00k (0x1f000)
disk 6434d366
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 47d677b6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7db84d2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87db84ae
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 67db8466
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C:\htc\flashing\apps\itsutilsbin-20080602>pdocread.exe -w -d DSK1: -b 0x800 -p Part00 0 0x1f000 Part00.raw
CopyTFFSToFile(0x0, 0x1f000, Part00.raw)
C:\htc\flashing\apps\itsutilsbin-20080602>pdocread.exe -w -d DSK1: -b 0x800 -p Part01 0 0x480000 Part01.raw
CopyTFFSToFile(0x0, 0x480000, Part01.raw)
C:\htc\flashing\apps\itsutilsbin-20080602>pdocread.exe -w -d DSK1: -b 0x800 -p Part02 0 0x5820000 Part02.raw
CopyTFFSToFile(0x0, 0x5820000, Part02.raw)
C:\htc\flashing\apps\itsutilsbin-20080602>pdocread.exe -w -d DSK1: -b 0x800 -p Part03 0 0x74c0000 Part03.raw
CopyTFFSToFile(0x0, 0x74c0000, Part03.raw)
C:\htc\flashing\apps\itsutilsbin-20080602>
In order to recreate the OS imgfs etc, we need
C:OS_Cruise>COPY /B inicio.bin+Part00.raw+Part01.raw os.nb.base
inicio.bin
Part00.raw
Part01.raw
1 file(s) copied.
C:OS_Cruise>COPY /B relleno.bin+Part02.raw imgfs.bin
relleno.bin
Part02.raw
1 file(s) copied.
C:OS_Cruise>ImgfsToNb.exe imgfs.bin OS.NB.base os.nb.payload
ImgfsToNb 2.1rc2
Using bigstorage mode
??
what is inicio and relleno?
I've downloaded some other tools from a French forum and these include the 2 files.
My question is:
How do I successfully recreate my os.nb.base, imgfs.bin and os.nb.payload?
Do I really need these files?
My other question will be about the part0, 01, 02 and 03.
What should I do to use my own OS (and extract XIP) instead of using a RUU_signed.nbh from a downloaded ROM?
Okay.
I've found out that the part01 is XIP, part02 is imgfs.
Do I just need to rename them?

if you want to reconstruct using your dump
http://forum.xda-developers.com/showthread.php?t=337066
you can use the kaiser rom kitchen to rebuild the rom from your raw dumps

I've read that thread, as well as this one.
http://wiki.modaco.com/index.php/How_to_dump_and_reconstruct_a_Hermes_ROM
When I try imgfstodump part02.raw, I get an "Part02.raw is not a valid IMGFS file. Exiting" error.
would also minimize the use of other downloaded roms.
So now, what want to do, is extract the contents of my Part02.raw (imgfs) partition, make some changes, rebuild all my .raw to a .nbh file.

ya you cant extract part02.raw directly
what you do is follow the thread i linked exactly
it will reconstruct the .nbh file for you
and then using the same kitchen u can extract the rom from the .nbh and edit and rebuild

hi guys,
i have a simple question. I only need to replace a particular file in Bepe's latest rom, namely the wince.nls file. How do i go about doing it?
is there some form of nbh editor where i can use to directly replace the file?
thanks.
Ruffie

ruffruff said:
hi guys,
i have a simple question. I only need to replace a particular file in Bepe's latest rom, namely the wince.nls file. How do i go about doing it?
is there some form of nbh editor where i can use to directly replace the file?
thanks.
Ruffie
Click to expand...
Click to collapse
Yes. Search for "HTC Rom Image Editor". You'll find a special thread for tool created by AnDim but I don't know whether it will completely work with our Device Diamond.

cyphol said:
Yes. Search for "HTC Rom Image Editor". You'll find a special thread for tool created by AnDim but I don't know whether it will completely work with our Device Diamond.
Click to expand...
Click to collapse
hi bro,
thanks for the advice. i did tried this but opening up the nbh with the editor, i couldnt find the file "wince.nls" at all. I tried adding my wince.nls into the rom but i could not save. there is an error while saving.

adwinp said:
I've read that thread, as well as this one.
http://wiki.modaco.com/index.php/How_to_dump_and_reconstruct_a_Hermes_ROM
When I try imgfstodump part02.raw, I get an "Part02.raw is not a valid IMGFS file. Exiting" error.
would also minimize the use of other downloaded roms.
So now, what want to do, is extract the contents of my Part02.raw (imgfs) partition, make some changes, rebuild all my .raw to a .nbh file.
Click to expand...
Click to collapse
Remember what I told you? It's simple and fast. The thread at Modaco is a good reference to "why is the donor ROM needed".