Fixup (.reloc) section format in WinCE XIP - Windows Mobile Software Development

I feel completely lost.
Structure of FIXUP table in executable module extracted from XIP (I took cecompr.dll, but that does not matter) is something impossible to reverse engineer.
What I manage to find is that first word is "page RVA" (16 bit, can't find out why 16 bit is enough), then size (in bytes) of the following records.
But then I can't understand what is there, behind page rva and size. PE file description by Microsoft is not correct, I tried to use it, but it is not for WinCE and thus does not help at all.
Does anybody know how to parse .reloc section of WinCE module?
Maybe, there's some sources of greloc/mreloc/platformrebuilder around? I'll be grateful for any clues.

Related

Asus P525 NB0 Kitchen by Anper

russian version can be found on:
http://asusmobile.ru/board/viewtopic.php?t=7816
version 080302_1843
This is english translated version of tool for editing of P525 ROM made by Anper.
Sorry for not so quite good english.
Additionally attached utilities for preparing of GIF "AsusP525GIFConverterByMrToto.zip"
About util KitchenNB0.exe:
Warranty: not any, only can say, that not especially include any harmful code to that utility. And before new version posting was firmware changes in mine PPC that made by that util.
don't known if that util works on other models (don't have it), it's tested only on my own ASUS P525. Flashing was made only thru USBloader.exe (don't knew how - read asusmobile.ru or anywhere in other places).
On mine device installed unchanged bootloader from WM6 official.
On WM5 was tested process completion on pc, but without real tests on pocket.
That Utility allow process images ROMGalaxy.NB0 and Galaxy.NB0
(Advised to use ROMGalaxy.NB0 (withiut bootloader), as more safe variant for Your device).
That images can be got by decoding of Galaxy.cap (decode can be done from that util).
First part of tool allow split to parts, and correcterrors in CHS, cut off bootloader, unpack galaxy.cap to ROMGalaxy.nb0 (used data from tool made by Ingvarr).
Second part allow you process IMGFS partition (partition that contain main
software). In that part partition IMGFS can be extracted to file. Get from that DUMP (in future You can do anything you want with that). After that combine DUMP to IMGFS and at the end combine and recalculate checksum of NB0.
splitting and combining functions of IMGFS to DUMP and back executed by Tadzio made utilities. But so they is made for HTC devices, so I'm correct that accordely to ASUS specific. That functions is called from mine tool (execute bat files is not necessary). Correction may be done by pressing button CORRECTION. ROM size is REALLY CHANGED WITH DECREASING OF nb0 image and accordely to size User storage INCREASED - checked (by recompressing of misar firmwares and by other firmwares corrections).
Checksum calculating made is done by tool, but algorhitm is taken from Ingvarr tools (slightly modified to this tool, that does not create all of file image in memory, but recalculate by chunks).
Process ROMs can in different directories, for no all in one place files garbage.
To flash ready file I'm advise thru bootloader and exactly ROMGalaxy.NB0 (without bootloader). Existence of bootloader you can check in first part of tool.
In that complect persist other tools, needed for coocing your rom.
But accordely to them - you must teach it yourself. I'm don't made that.
Also added in third part possibility to change any of parameters in XIP part of ROM (for correct processing parameters must be changed in order: firstly unpacking, changing, packing, and combining NB0).
Work examples:
1. Open NB0, if that not persist - make it from galaxy.nb0 (by cutting off of bootloader) or from galaxy.cap.
2. If that is homemade firmware, possible will be CHS error in MBR. Correct that by pressing button CORRECT MBR. (Why error persist? - Possible our firmware makers ignore that, or firmware was combined by utilities from Tadzio or other that was not adopted for ASUS (also possible CHS not so sensitive)).
Also may appear message about file size differences with sum of sizes of all partitions - it's not harmful - in most cases simple ignore that.
3. Next is Operations with IMGFS tab. In that part can simple do next processes in shown order. Get IMGFS, Create DUMP, edit DUMP as you wish, from DUMP create IMGFS, combine NB0 new and it's all, can flash. For checking you may open newly created NB0 in first part of tool.
4. Flashing may be done by USBLoader.exe.
Another example - correction and optimization of firmware size:
Shortly about compression:
I'm has provided an opportunity to combine IMGFS.new from DUMP with LZX compression (greatest, but slower starting) and XPR.
Choose by pressing needed button. At once want to warn you about not all firmwares have library with compression LZX, accordely to that after flashing, it will not run further to blue screen.
If you have not broke bootloader, this all is reperable (Many peoples through it passed).
Well, like everything, write at a forum.
And a long life for yoursdevices.
P.S. if you found translation errors - please PM to me.
20080303
Translation fixes, exe packed in own archieve as mainly only it changed
1. unpack kitchen ASUS_P525_NB0_Kitchen.zip
2. place ASUS_P525_NB0_Kitchen.exe from exe.zip to directory from 1.
Thanks DaLiV.
Thanks anper.
Great tools.
Wait for Eng version for a long time.
vivi
thanks anper & Daliv
great tools, Great work!
updated translation.
thanks!
Thanks DaLiV, anper!!
Have been looking for the English version!!
gabz
nice. looks interesting.
will give it a try.
but will it work using wm6/wm6.1 as base ROMs?
cheers!
ericjm said:
nice. looks interesting.
will give it a try.
but will it work using wm6/wm6.1 as base ROMs?
cheers!
Click to expand...
Click to collapse
tool work with WM5, WM6, WM6.1 only for ASUS P525.
anper said:
tool work with WM5, WM6, WM6.1 only for ASUS P525.
Click to expand...
Click to collapse
sweeeeet!
thanks for this one anper (and DaLiV for the english translation!)
can't wait!
How
How can we add additional OEM packages into our rom using this kitchen?
as in all other roms ... split by packages by other tools, if you want, but to that tool return ready dump directory
sorry
DaLiV said:
as in all other roms ... split by packages by other tools, if you want, but to that tool return ready dump directory
Click to expand...
Click to collapse
Sorry, But I cannot understand what you mean. Could you please elaborate?
search forum for tool like "buildos+packagetools" or "dmp2pkg" - then edit packages and after that make conversion back packages to dump
Sweet kitchen
Just letting everyone know that this kitchen can also be used for Dell Axim X51's - I have
For X51 users, make sure you don't click "Repair CHS" - it's for ASUS PDAs only and will result in a bricked ROM
btw You can also use recookstruct as well to sort the dump into packages, you may have to get rid of some entries in "HKEY_LOCAL_MACHINE\System\Inbox\Settings\WelcomeEmail\Templates\ServiceTemplates" because recookstruct can't parse the "®" symbol sometimes found in the key
(Only works with IMGFS, not XIP)

Emulated Windows Mobile 6 ROM Dumping

Hi,
My first post here, hope to don't broke any Forum Rule.
I'm running an emulation of Windows Mobile 6 (SDK) taken from Microsoft,
and I've the necessity to study and extract system dlls (such as for PDB)
and looking for certain Undocumented Functions.
My question is, Is possible/necessary to make a dump of this Emulated WM6?
If yes can you please point my to the right links and threads?
Regards,
Giuseppe
Hi,
How can I extract DLLs and other resources from PPC_ITA_GSM_VR.BIN ?
I've tried with splitrom.pl but does not recognizes that format ( hash MD5 does not match)
I've also seen that there is another Suite of Tools ImageFsToolKit I've to use it? if yes can you point me how?
Hope in a Reply
Have a Nice Day,
Giuseppe
Check out this Emulator Kitchen thread
Many thanks for your precious help!
I've runned 1_UnpackEmuROM.cmd and the process worked correctly
\OEM
\SYS
\ROM
Now my question is, every dll have a directory that contains imageinfo.bin and various S00x files, which tool I've to use to assemblate it in the final DLL?
I've also seen a little bug into BuildOS.exe, the crash is caused by a not Catched Exception, precisely is caused from an unhandles System.IO.DirectoryNotFoundException all you have to do to avoid that is to implement a try/catch block for this exception
Regards,
Giuseppe
Download the attachment
Unpack that
Place the folder of the dll (or exe) in the unpacked one. Note: The folder, not just the files.
Run ReversRecMode.bat
Look into the folder
It worked!
Many thanks!

Looking for infomation regarding cooking roms

Hi to all chefs,
I am looking for as much info on rom cooking as possible as to understand the process that is happening,
what i want to know is when the batch file is run this launches other commands could somebody please explain what is happening behind the scenes
when the buildos runs it processes all the files into a temp folder,
now my most important question is,
when building up the registry, what is the order that the files are processed, by dsm filename? package filename?
also when are the mxip_******.provxml files processed (reg esttings added to the registry and in what order
how is the best way to add a custom mxip_****.provxml to garantee my setting don't get changed,
also if there is enough useful answers posted, i will edit this post to make a time-line in post2 to help others new to cooking there own roms,
then infos wanted for timeline are the background into whats happening in each program launched (buildos,nbhtool etc) from pressing the cook batch file through to windows being flashed and autorun kicking in, sdautorun if exists, then the end would be the final reset and windows ready to use,
hope you will make useful answers
many thanks.
Reserved for timeline
timeline
1 cook button pressed
1.1 BuildOS launches
1.2 G'Reloc launches
1.3 NBSplit -kaiser OS.nb
1.4 ImgfsFromNb OS.nb.payload imgfs.bin
1.5 ImgfsFromDump imgfs.bin imgfs-new.bin
1.6ImgfsToNb imgfs-new.bin os.nb.payload os-new.nb.payload
1.7NBMerge -kaiser os-new.nb
1.8 HTCRomTool.bat
1.9 DiamonCustomRUU.exe
1.10 Cleanup.bat
garymeg said:
Hi to all chefs,
I am looking for as much info on rom cooking as possible as to understand the process that is happening,
what i want to know is when the batch file is run this launches other commands could somebody please explain what is happening behind the scenes
when the buildos runs it processes all the files into a temp folder,
now my most important question is,
when building up the registry, what is the order that the files are processed, by dsm filename? package filename?
1. the *buildos*.exe generates logfile with order
2. you can minimize the number of dsm-files/packages by your self.
i.e OEM, Packages and SYS to one dsm/rgu/provxml
also when are the mxip_******.provxml files processed (reg esttings added to the registry and in what order
mxipCOLD at coldboot (first time/only one time)
mxipUPDATE at resets (allways)
how is the best way to add a custom mxip_****.provxml to garantee my setting don't get changed,
"your device will ... in 3 seconds ... 2 seconds"
also if there is enough useful answers posted, i will edit this post to make a time-line in post2 to help others new to cooking there own roms,
these are not usefull answers, but iam to tired for details but i cant write nothing ...
then infos wanted for timeline are the background into whats happening in each program launched (buildos,nbhtool etc) from pressing the cook batch file through to windows being flashed and autorun kicking in, sdautorun if exists, then the end would be the final reset and windows ready to use,
hope you will make useful answers
many thanks.
Click to expand...
Click to collapse
generaly the kitchen/device that you use and/or how much detaild you have cooking-knowns will determines the order.
I Know very little, i can take a rom add packages and rebuild, thats my limit, i want to create this thread so i can better understand what is happening, edit files, make sure my edits dont get changed later during the setup process, I would think this applies to most devices (i have a diamond and also Artemis) the kitchen i use is the modifyed kiaser kitchen as when i was modding artemis i found a simular kitchen for that device and a lot of my packages were reused.
for extracting artemis i use the hypercore-kitchen. but for cooking i changed to ARTEMIS_DEV_v2.1_Build_19199-kitchen. the reason is, that the file-structure in hypercore dismis/damages my brain.
for diamond i use the "kitchen"-kitchen (orig. download filename was kitchen.rar).
ohh, its ringing, so i have end again ...
p.s.
study the system.txt inclusive the batch-files together with the batch-files from "kitchen"-kitchen.

[APP][v2009-09-23] ai Cab Explorer utility: new way to explore cab files on your disk

***CHANGE LOG START
2009-09-23
- New:file preview (please note that cou can even preview manila encoded images inside cab file, since they are converter internaly!)
- in preview you can choose to extract manila file or PNG image.
- bug fixes, cosmetic changes... new bugs ...
- you probably realized that I publish versions I got at the moment - raw, not too much tested, relative big changes from day to day, version is detected by the pub date... so expect new staf soon...
- !!! IMPORTANT !!! Please download cfc.exe and put it at c:\windows\ "c:\windows\cfc.exe" !!! Download last version from http://forum.xda-developers.com/showpost.php?p=2798441&postcount=1 !!!
(without cfc.exe app won't be able to decode mailla images)
2009-09-22
**IF YOU HEVE BEEN HERE PLEASE READ THE WHOLE POST SINCE IT IS ALL UPDATED!!!
- "Cab Album" support:
A Cab Album is collected information about many Cab files in one place.
Application will here "create" a new Cab Album by scaning folder. (It is possible to include subfolders in search path.)
Since creating a "Cab album" could be time consuming (depends on how many files it has to scan),
collected information - an "Album" can be saved (in xml structured file).
So next time, you can just use the same information by "loading" a saved album from disk (without scaning again).
Creating album is the process that will
a) detact all *.cab files in scaning folder (and subfolders)
b) for each found cab, program will try to locate "_setup.xml" within .cab file and extract information about real / target file names and paths
c) all information will be collected to memory
After that you will be able to
a) browse an album by cab files (from the tree)
b) browse an album by target file names (also from the tree where these files are grouped an counted)
c) search / filter the album by target file names
Also you can
a) click on "save" icon to save the album.
b) double click on cab file (lef side - tree) to open separate window tith that cab info
c) double click on file on the right side to extract it on disk
2009-09-21
- new version suports drag & drop files (from windows explorer)
- small cosmetic changes
2009-09-19
- first published version
***CHANGE LOG END
DID you ever try to find some fine resource (manila file, bmp for phone skin ... or whatever), which you know you have seen somewhere. And you are sure you got it somewhere on your hard or stick or ....
DID you ever wanted to create a new skin based on a few existing skins in some cab files.
DID you ever ask yourself - what will that XY.cab install on my device? Will it remove parst of my customization that I don't want to be changed?
In case you didn't this app is probably NOT for you.
But if you DID then you probably know that
a) most cab extractors will NOT extract files with the correct filenames on your hard disk.
Instead of some "5acc5861_manila" that will be installed on your device, what you get on your pc is some file named "0CABA635.001".
The real target file name "5acc5861_manila" is actually set in _setup,xml which is part of cab file for mobile device.
b) it is hard to find all "5acc5861_manila" resources on your hard disk without decompression of all cab files, and fixing a problem described before - see a
What do you think about a new point of view - an "Album" view.
Album view will help you to "scan" your hard disk folders, searching for cab files, extacting information from them (without extracting cab files on disk), and collecting all important information in one Album list.
That's not all.
Since "scanning" or building an album could be time consuming, you can "save" the album (xml file structure) so next time you just open existing album and you got all information very quick.
You can search albums - for example "Assets*.bmp" will find all files located in album containing dialer skins.
With another few clicks you can extract found files on disk and use you favourite tools to view or edit them.
Prease note tha this application is extended version of
"[APP][v2009-09-17] Cab utility - RENAME cab content/files to normal target names" located at http://forum.xda-developers.com/showthread.php?t=561533
Requirements: .NET framework 3.5 on your PC
BTW: If someone know some good .NET library for converting / previewing or updating _manila files please do let me know.
Also if someone would like to use some of functionality of this app in other projects ... I will be glad if I can help providing details about my libraries.
I hope you'll like it...
Weeeeeeeeeeell
Awesome thank you!
UPDATE
Missing drag & drop support was anoying, so I add it to v2009-09-21.
You can find / download new version in fist post
cablib error
I get an error when opening a cab-file:
FileLoadExeption
Could not load file or assembly 'Cablib, version 10.3.0.0 ... or one of its dependencies. This application has failed to star because the application configuration is incorrect. Reinstalling the application may fix this problem. (Exception from HRESULT:0x800736B1)
cc62 said:
I get an error when opening a cab-file:
FileLoadExeption
Could not load file or assembly 'Cablib, version 10.3.0.0 ... or one of its dependencies. This application has failed to star because the application configuration is incorrect. Reinstalling the application may fix this problem. (Exception from HRESULT:0x800736B1)
Click to expand...
Click to collapse
Yes in some systems you can get this error. On my laptop I have no problems but on my home PC I had exat the same error.
What I did to solve this problem is to replace version of CabLib, and also I put 2 dlls in the same folder where is application.
You can find CabLibFix in additional attachment in first post. Just put those files in the same directory (replace existing CabLib + additional 2 new files).
Please do let me know if that helps
Could not load file or assembly 'Cablib
Please note that v2009-09-22 should fix problems with error "Could not load file or assembly 'Cablib.." on some systems.
"FIx files" are included in that version, so I removed "fix..." archive.
However if you still have problems please do let me know,
thanks
v2009-09-22
v2009-09-22 works like a charm.
Thank you again
v2009-09-23 now has image / text preview + info about manila type of file (xml, SQLite, Lua_Script, Mode_9 ...)
Also you preview manila IMAGE files (decoded using cfc.exe to png)
The only inconvinience is that I manage to hardcode path to cfc.exe ( "c:\windows\cfc.exe").
Sory!
Error on win64 with an 'any CPU' build
Hi
We are using your CabLib.dll v2009-09-23 to load cab files inside our c# application. It works really well, except for one case.
When we build the application for target 'any cpu' and then install on a windows xp64 machine, we get an error message:
System.BadImageFormatException: Could not load file or assembly 'CabLib, Version=10.3.0.0, Culture=neutral, PublicKeyToken=5c838b77b53f84a0' or one of its dependencies. An attempt was made to load a program with an incorrect format.
File name: 'CabLib, Version=10.3.0.0, Culture=neutral, PublicKeyToken=5c838b77b53f84a0'
Everything works fine when we change the target to 'x86', but that then causes problems with our test suite. The 'Any CPU' build only fails in x64 machines.
I was wondering how you build your DLL and if you have any ideas to help us fix this problem.
Here's my config:
Microsoft Visual Studio 2008
Version 9.0.30729.1 SP
Microsoft .NET Framework
Version 3.5 SP1
The build and test is on an xp64 SP2 machine.
-- update --
I've also found that aiCabExplorer.exe has the same problem on my win64 machine. I see you are including the 32 bit C run time DLL's which you provide in the release - that appears to be the problem, as the OS is trying to dynamically link against the 64 bit version of MSCOREE.DLL, KERNEL32.DLL, OLE32.DLL and OLEAUT32.DLL and doesn't like mixing them up.
So the solution, I think, is for you to build without explicit dependencies on the 32 bit libraries. Is there any chance of getting a version like that?
Thanks,
Mark
Hi,
I use this app all the time.
Super duper.
Thank you very much.
Keith
Seems great Gonna try it

[SOLVED] Disassembling DLLs in WP7 firmware?

Hi there, first post but I could use some assistance.
I took the stock emulator image that's included with the dev tools and ran (I believe, this was a bit ago) viewbin.exe, cvrtbin.exe, and dumprom.exe on the image (basically the same technique that's used to dump the Zune firmware), resulting in all the files.
In particular, I'm looking to reverse engineer the MTPZ protocol, so I looked at MtpHandshakePlugin.dll which seems to be just what I need based on the strings contained within. When I load it into IDA Disassembler, IDA correctly finds strings and the exports and imports and what not. The problem is, it can't seem to find any function declarations or code. The only code it auto-analyzed was the start function, which was two instructions, the second instruction being a jump into a memory location it couldn't find. Prior to analysis IDA informed me that MIPS (the architecture of the image) supported memory mapping and that I could manually map addresses.
So, I assume that this jump address is memory mapped and I have to figure out where to map that to, after which IDA should be able to find all the code. The problem is, how do I know where to map the address to?
Long-ish post, I know, but any help would be much appreciated!
Hi,
Your problem is that IDA is using the wrong machine type. The DLL's are X86 from the emulator not ARM. You need to switch the machine type in the PE header to X86.
I typically just do this by hex editing the byte sequence C0 01 to 4C 01 but you can use any PE editor for this.
Ah, you are absolutely right. The thought crossed my mind earlier but I quickly dismissed it. Everything seems to be analyzed perfectly.
Thanks a ton!

Categories

Resources