Related
So I thought about opening this thread to discuss the technical progress of the "WM6 for Trinity" project...
Hopefully we can keep it technical only!
Goodluck
It's a dead end . Thank you
Just some of my experiences with that....
Porting the Kernel:
I think it makes more sense to use a device which already has a WM6 ROM for experiments on that tropic.
What I've tried...
Device: Universal
ROMs: Full working WM5 and WM6
1. I extracted the kernel from the WM5 ROM
2. I implanted it into the WM6 ROM
3. The offset of the boot partition header is written to one place of the Kernel, so I changed that to match the WM6 ROM
4. Flashed the ROM
Result: Black screen
this shows that the Kernel is not compatible...
theoretical issues:
- it did not work cos I only replaced the Kernel, but not the other OEM files
(don’t think so, cos the other OEM files should be stand alone drivers)
- there is another offset written to nk.exe
(no, cos I wrote a program to completely reorganize the boot section [except of the kernel] and it worked after changing the one known header offset)
- I missed something else or made a mistake...
(No one is perfect)
At first one terminology agreement: when I speak about (wince 5.x) kernel I speak 'bout nk.exe only (mun_rus counts as a kernel all stuff in boot partition. Formaly (excepting some modules/files) this is correct too but a bit uncommon). As near as I can tell bepe as well calls kernel nk.exe only. Please correct me if I'm wrong.
Now my expirement:
rexipped kernel from trinity rom placed in to the hermes one. result: two splash screens then halt. Splash screens means that kernel succesfully passed at least OEMInit. But nothing more. There are two possibilities:
1) kernel is not compatible
2) i've screwed up something during rexipping. complete toolchain is not ready yet and operation is semi-manual. However I have positive expirence in transplating kernel from one WM5 rom to another (with the same rexipping).
I'm giving up particular task of bringing WM6 for trinity for now. And continue to work on rexipping toolchain. Would it make any good for trinity or not it would be useful on many other tasks.
bepe said:
3. The offset of the boot partition header is written to one place of the Kernel, so I changed that to match the WM6 ROM
Click to expand...
Click to collapse
If you are placing sections on different addresses there are many more addresses that should be fixed except romhdr. In addition there is need to fix extensions ptr and copyinfo as well.
(no, cos I wrote a program to completely reorganize the boot section [except of the kernel] and it worked after changing the one known header offset)
Click to expand...
Click to collapse
I've tested your program: either I've missed something or it is unable to rexip (put sections on different places and perform fixups) modules. However boot partition produced after straightforward unpack->pack procedure on 100% working trinity wm5 rom refused to boot.
Oh, no, don't give up!
Seems like you know your stuff, can you just team up with the others, or point them into the right direction (if you think they are straying?)
As near as I can tell bepe as well calls kernel nk.exe only.
Click to expand...
Click to collapse
right, kernel is the same as nk.exe... ok, let’s use nk.exe
If you are placing sections on different addresses there are many more addresses that should be fixed except romhdr. In addition there is need to fix extensions ptr and copyinfo as well.
Click to expand...
Click to collapse
Yes, I placed every possible section to a new place except of nk.exe... that was part of the experiment to see if there are more addresses...
... and there are not, because the rom worked after that
3xcopyinfo and extensions... yes, that’s clear offsets are part of the header... as I said my tool reorganized that without any problems
I think you misunderstand what I meant:
the physical address of the boot section header is written to the NK.exe
this is the beginning of a boot section:
FE 03 00 EA 00 00 00 00 | 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
45 43 45 43 68 BB 19 80 | 68 BB 19 00 00 00 00 00
red it the offset of the boot section header...
next you’ll see a part of the nk.exe o32[0] data (MODULES\nk.exe\S000)
77 00 73 00 5C 00 00 00 | 68 BB 19 80 00 00 00 00
00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 | 6D 00 73 00 63 00 6F 00
could this be the problem why your nk.exe port did not work?
I've tested your program...
Click to expand...
Click to collapse
I did not finish the program... it worked for me with my universal rom... I think mun told me it would work on hermes too, at least dumping rebuilding...
sorry,
However I have positive expirence in transplating kernel from one WM5 rom to another (with the same rexipping).
Click to expand...
Click to collapse
that means you must have changed the header offset inside nk.exe
or it was the same offset... but dnot think so
Oh, no, don't give up!
Click to expand...
Click to collapse
Breaking through to bring WM6 on trinity without appropriate fully-working toolchain is just a useless waste of time: now it takes 'bout couple of hours to rexip module (or kernel wich is by some means a module too) check if everything is done correct (and still no warranty of that) and put it to rom. Moreover I'm hm... 80% sure that I've transfered kernel properly in my expirement wich means that probably there is no need to break through at all
From another side with toolchain finished it would be possible to bring WM6 to trinity (or any other modern WM5 device) in minutes or surely state impossibility of that.
if you think they are straying
Click to expand...
Click to collapse
I've clearly stated that at least lwsv is straying but nobody listened / However we have contacts via pm and I'm ready to provide some not too time consuming help.
ps:
@bepe
Result: Black screen
Click to expand...
Click to collapse
just noticed it. I can't be sure 'bout universal but on himalayas and trinity first splash is drawn on early stages of OEMInit (wich is called on very early stage of kernel startup). Black screeen using kernel surely compatible with hardware 99.9% means that kernel even have not started.
bepe said:
that means you must have changed the header offset inside nk.exe
Click to expand...
Click to collapse
as well as many others. pointers to data/code in any moved section should be fixed. And in romhdr pointer to extensions (wich are located in kernel, in trinity/hermes rom just after pointer to romhdr) should be fixed as well. And if you move any section wich copy list points to (nk.exe data section for example) it should be fixed too.
The XIPPort tool dumps a xip section and rebuild it identical, just the order of the TOC entries and the copy entries is not the same.
Also the "realloc P" part works perfectly, without changing something it should allocate the things the same way as MS did it using Platform Builder.
just how I've done it:
1. I dumped the xip.bin
-> rebuilding or reallocating using my tool would result in a identical xip section
2. I deleted the two modules: hd.dll, osaxst0.dll
-> both are not needed, just for debug info
3. Recalculated the whole xip section using my tool
-> reallocating in this state does not create a identical xip section because the deleted modules are using the place next to nk.exe... but reallocating means to fill that with the other modules, so everything after the first nk.exe section is on a new place
4. also the romhdr offset has been changed, so I changed it inside nk.exe
flashing, and the rom is working
Also the "realloc P" part works perfectly, without changing something
Click to expand...
Click to collapse
it is good. until you do not need to reallocate modules sections (because of overlapping regions for example) or you are not moving the kernel. But if you do you should refixup affected module images to get working rom.
flashing, and the rom is working
Click to expand...
Click to collapse
Very strange..I changed nothing then I cliked "realoc P" and flashed new boot section, but my wizard stucked on spl screen. Any thoughts? I compare maps, after realloc procedure it were some chages in Trueffs real addr area
I started to compare some data inside nk.exe of tytn and trinity
I was very impressive when i saw GPS in tytn's kernel)
tytn's wm6 nk.exe (Built on Dec 17 2006)
Code:
...
[color=red].text:8000528C 00000018 unicode [D :: GPS] [/color]
.text:800052A4 00000018 unicode [D :: RIL]
.text:800052BC 0000001A unicode [D :: SIR ]
.text:800052D8 00000018 unicode [D :: FIR]
.text:800052F0 00000016 unicode [D :: CF]
.text:80005308 00000024 unicode [D :: SERIAL_BT]
.text:8000532C 0000001E unicode [D :: SERIAL]
.text:8000534C 0000001C unicode [D :: AUDIO]
.text:80005368 00000022 unicode [D :: BACKPACK]
.text:8000538C 0000001A unicode [D :: WLAN]
.text:800053A8 00000016 unicode [D :: SD]
.text:800053C0 0000001E unicode [K :: KERNEL]
.text:800053E0 00000018 unicode [D :: SPI]
.text:800053F8 00000020 unicode [D :: BATTERY]
.text:80005418 0000001E unicode [D :: TOUCHP]
.text:80005438 00000018 unicode [D :: KEY]
...
trinity's wm5 nk.exe (Built on Dec 12 2006)
Code:
...
.text:80005AB4 00000018 unicode [D :: GPS]
.text:80005ACC 00000018 unicode [D :: RIL]
.text:80005AE4 0000001A unicode [D :: SIR ]
.text:80005B00 00000018 unicode [D :: FIR]
.text:80005B18 00000016 unicode [D :: CF]
.text:80005B30 00000024 unicode [D :: SERIAL_BT]
.text:80005B54 0000001E unicode [D :: SERIAL]
.text:80005B74 0000001C unicode [D :: AUDIO]
.text:80005B90 00000022 unicode [D :: BACKPACK]
.text:80005BB4 0000001A unicode [D :: WLAN]
.text:80005BD0 00000016 unicode [D :: SD]
...
There are much simmilar but in diffrent offsets. Hmm probably we can try use tytn's kernel in some way
mun_rus said:
I started to compare some data inside nk.exe of tytn and trinity
I was very impressive when i saw GPS in tytn's kernel)
Click to expand...
Click to collapse
Nothing impressive in that most htc devices (especially such kindred) share common codebase. If you look deeply you can find even wallaby echo in modern devs firmware.
Hmm probably we can try use tytn's kernel in some way
Click to expand...
Click to collapse
Yes we could. As devices are very similar kernels are the same for 99.9%. But very similar does not mean identical: at least gpio purposes are different and I've strong feeling that there are another minor hw diffs making impossible direct usage of hermes kernel. And as you have some reveng experience you could imagine how hardcore task would be finding out that differences and fixing them (and what probabilities of getting stable working kernel at the end are).
I don't want to tread out of my depth, but could you just explain what it is that HTC would need to do to customise the WM6 Rom for Trinity? Is it just one file (whatever XIP is or nt.exe??)? I mean how much of a big job would it be for them?
This leads on to my second paragraph; is there anyway of slyly contacting an engineer at HTC to syphon off this file (presuming it is a small file that would give you the answers you need)? Is this frowned apon in the xda-developer industry? Or is this common practice? Do any of you know someone at HTC? Could Orange leak this file? Or would they just get HTC to write their ROMS?
I don't want to stand here flaunting myself in my nappy but I just don't know about these things...
Thanks for answering
what it is that HTC would need to do to customise the WM6 Rom for Trinity?
Click to expand...
Click to collapse
I'm almost sure that nothing except they've already done. But I'm sure as well that they are not going to release WM6 for trinity: look they have a bunch of (not so different) new devices needed to be sold and releasing new os for (olready sold) old devices would not be a very wise idea from a sales department point of view.
No, I'm sure there won't be an official release, but I was talking more about an unofficial leak of a file.
Looks like the progress is slow
FuzzMunky said:
No, I'm sure there won't be an official release, but I was talking more about an unofficial leak of a file.
Click to expand...
Click to collapse
There is no wm6 for trinity yet...even test rom
mo7al said:
Looks like the progress is slow
Click to expand...
Click to collapse
Yes..it's so. Now have to make my tests with wm6/wm5 roms on my wizard...Try to realease my thoughts and ideas..Im going to recieve trinity till end of nex week or begin of week after. So, i hope progress will speed up
On the basis of which we shall do updating Rom for HTC_Trinity, I have already made and have successfully tested on Hermes - http://forum.xda-developers.com/showthread.php?p=1165177#post1165177
HTC WP7 NBH Dump/Rebuild:
NBHImageTool
flash.store.bin Dump/Rebuild (dumped as os.nb in NBHImageTool):
(tool creation pending)
IMGFS Dump:
Combine xidump with the attached cecompr_nt.dll supporting XPH
IMGFS Build:
Combine imgfsfromdump with the attached cecompr_nt.dll supporting XPH
XIP/ULDR Dump:
dumprom works well for this.
XIP/ULDR Build:
(tool creation pending)
I'll be posting updates in my twitter, which you can reach by clicking the image in my signature below.
That's great
Thanks
awesome, best of luck;]
Thank for this
thanks. let us know if you need something...
i'm sure we can get more donations if needed...
Good luck in your attempt my friend.
A small appreciation from my side
Transaction ID: 3HV21374WY1903845
Relocation Module SYS/Dump:
Creating tools...
Command Dump IMGFS:
Code:
xidump imgfs.bin
Create Packages from Dump:
Combine Packagebuilder with the attached cecompr_nt.dll supporting XPH
Another method Dump XIP:
XIPPort - Bepe's
Region PagePool:
during the detection..
Generation File imageinfo.txt:
Command:
Code:
iitp [ -p physfirst ]
Download: IITP - imageinfo.txt producer.
XPR to XPH Compression:
Open the file os.nb.payload in HEX Editor. Find this Lines:
Code:
F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC ř¬,ťăÔ+M˝0‘nŘO1Ü
01 00 00 00 01 00 00 00 01 00 00 00 34 00 00 00 ............4...
08 00 00 00 00 02 00 00 00 10 00 00 58 50 52 00 ............XPR.
And change to:
Code:
F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC ř¬,ťăÔ+M˝0‘nŘO1Ü
01 00 00 00 01 00 00 00 01 00 00 00 34 00 00 00 ............4...
08 00 00 00 00 02 00 00 00 10 00 00 58 50 52 00 ............XPH.
Save this file. Get this library cecompr_nt.dll (attached in first post), then insert to TOOLS folder from your Kitchen ROM.
Download cecompr.dll (attached) and overwrite it in your XIP.
Useful module to compress XPH:
You're doing great work,
I hope you'll succeed.
Good luck
lets keep this on track, roms will be developed as they can be, asking for specific hardware won;t make any difference and only take the threads off track.
this is a nice clean thread for the real WP7 work going on, looks like we have sorted the compression issue,
looking forward to what Da_G finds with the JTAG on the HD2.
chrispilot2293 said:
why do you say that about Topaz how do you know that we wont get it.
Click to expand...
Click to collapse
Lots of posts in the other threads on this topic. There's lots of reasons but the main one is that non-Cortex A8 (ie Snapdragon) devices are not capable of executing code compiled for the ARMv7 instruction set. WP7 is compiled under ARMv7. To recompile for ARMv4/5/6 would require the original source code to WP7 which there's practically no chance of getting. Even IF that somehow leaked out, it would still run so poorly that it would be unuseable.
good luck da_g. endevours from indian in australia
What is difference between XPR and XPH? More importantly, I'd love to know how to rebuild cecompr_nt.
Does your cecompr_nt_xpr_xph.dll still support lzh?
If XIP/ULDR can be dumped w/ existing tools, what prevents existing tools being used for reconstruction?
gguruusa said:
What is difference between XPR and XPH? More importantly, I'd love to know how to rebuild cecompr_nt.
Does your cecompr_nt_xpr_xph.dll still support lzh?
If XIP/ULDR can be dumped w/ existing tools, what prevents existing tools being used for reconstruction?
Click to expand...
Click to collapse
No.... only XPR/XPH
Just made my donation. Just for the effort your giving. Thanks.
Just sent you a donation, looking forward to rocking my HD2 with Win7! Thanks man!
didn't the leaked spec sheet of wm7 state armv6 and above?
am i just behind the times
thanks for everyones work
Da_G said:
HTC WP7 NBH Dump/Rebuild:
NBHImageTool
flash.store.bin Dump/Rebuild (dumped as os.nb in NBHImageTool):
(tool creation pending)
IMGFS Dump:
Combine xidump with the attached cecompr_nt.dll supporting XPH
IMGFS Build:
Combine imgfsfromdump with the attached cecompr_nt.dll supporting XPH
XIP/ULDR Dump:
dumprom works well for this.
XIP/ULDR Build:
(tool creation pending)
Click to expand...
Click to collapse
Amazing work Da_G! Thanks for sharing your knowledge!
zole2112 said:
Just sent you a donation, looking forward to rocking my HD2 with Win7! Thanks man!
Click to expand...
Click to collapse
It is not certain that it will work, dont get your hopes up or your kickers in a twist if it comes do nothing.
Silently hoping it does however but we shall have to wait and see.
ID transazione: 6NA49355LX5868833
A small gift for your great work
Please let us Know if Donations can help, I would invest $100 or even more so that the HD2 sees the Light.
and Please guys, we invested and accepted donations to buy an HD2 Plus the Trace32 App, so let's focus on developing Win 7 for HD2 currently, later, I think that other devices can reap the benifits too.
Best of Luck to you Da_G
Will
If you switch to QC and install correct drivers you have access.
Tested successfully few Tools:
PSAS
QPST
QXDM
NV items are possible to backup.
Read/write NV also possible...
SPC is 000 000
Security Password seems FFFFFFFFFFFFFFFF
I tested in PSAS... other SP leads to restart.
But Memory access is blocked.
Download Mode uses only Samsung Driver, not QC...
Goal would be to access/dump memory via Bootloader...
Best Regards
Samsung locked down the Wave more so than there android offering due to the proprietary nature of Bada, to be honest i really dont know how to solve that issue? is there any other folk with Jtag boxes that might give us there two cents?
Maybe we should play with Qualcomm stuff. To log something like GPIO.
HWTP for instance, but shows at this time only for older models...
see Screenshot from EF81... you can save to Text file...
Other usefull Tool could be QXDM.
I was able once to log something from S8500, but I have forgotten how...
Best Regards
HWTP can make Text output... here only from EF81, but:
GPIO 13 LCD_BCKLT_PWM
GPIO 84 FUEL_GAUGE_TXD
and more...
As HWTP is based on QXDM, I think QXDM is able to do this also... for S8500.
Question is only how.
Best Regards
Edit 1.
I've changed in Settings.Ini from HWTP MSM Identifier to:
0x4015E0E
Now I have access to the menu...
But I think its not correct... as GPIO is handled in GPIONameList.ini
Attached is from S8500 too, but again, this could be crap.
WARNING: according to changes in this file phones' id can change.
Click to expand...
Click to collapse
Also Limit is 98... no idea how many GPIOs are in modern handset...
QXDM Logging work... with S8500.
Code:
MSG Factory Test Mode/High
15:31:24.222 QMochaBattery_fuel_gauge.c 01512
[B]Fuel Gauge[/B] SOC I2C Read Sucess, reg 0x4
Best Regards
Maybe soon we have more skilled QC users with S8600.
Welcome.
Best Regards
have you got FTM program for FTM mode ?
https://rapidshare.com/files/3344313793/qpst_ftm_eval_6.10_818.rar
QPST I found 2.7.368
QXDM 3.12.714
Both untested with S8600...
have you got FTM program for FTM mode ?
Click to expand...
Click to collapse
I think this is older stuff, removed from QPST... since 2006 or something like this.
Thanx.
Best Regards
QPST saved my little Bu..
I've lost all my NV items and was not able to restore Full dump via JTAG...
But step by step my S8500 is now alive again.
I can confirm, that all NV items are restoreable, which I have backuped via QPST.
Around 306...
Maybe it depend if full erased like my handset... if writeprotected or something like this...
Best Regards
What will happen with network lock if i change imei to all zeros with this tools? Is it calculated in real time and it depends from imei or it is just in some protected part of phone? Is any other way for unlocking with this tools?
Adfree I know that you don't support unlocking, but I have my phone more than 12 months, I don't have warranty any more and i want to start using custom firmwares and to learn something new. Unlocking is to expensive for me.
Please help me if you can, i would be very grateful, off course i'm respecting your work and your attitude very much and i will delete my post immediately if you want.
Many thanks.
hi adfree,
i have a problem with my phone, Kies doesnt recognize my phone's firmware and says my device is not supported for firmware upgrades even i have the official Bada 1.2 firmware for Philippines.
My previous firmware is S8500XXKL6 Bada 2.0 but since there's a lot of bugs on this firmware, ive switched back to the official Bada 1.2 firmware from Ph.
First, ive flashed to DXKE1 full firmware (CSC is Open Asia) then i flashed to DXKF1 with a CSC of XTC (one of the CSC for Philippines).
Ive checked my Product Code but my product code in Kies registry is S8500BAAKOR.
What's wrong with my phone that's why Kies doesnt recognized my firmware? Is that because of the wrong Product Code?
Can i modify the product code in Kies registry in change KOR to XTC?
Pls advise.
Thanks
Can i answer please ?
Thank you
Go to this topic : http://forum.xda-developers.com/showthread.php?t=1333956&highlight=hack
It is Adfree Tutorial so don't worry
Best Regards
Please, can someone confirm.
How to set S8600 to work in Qualcomm Mode?
Thanx in advance.
Sorry, I can't try self... no S8600.
Best Regards
According to this...
http://forum.xda-developers.com/showpost.php?p=24208953&postcount=56
I was able to set my S8500 to Test Mode...
No idea yet. For what it is...
Simple... WinComm shows:
Code:
__OemNvGetStringModem: ModemNv Item id is 10071, return GT-S8600HKAXEF
__OemNvGetIntModem: ModemNv Item id is 10072, return 65535
So I have used RevSkills to set NV item 2758 to 01...
Before it was 00
Maybe 02 is also Mode? No idea yet.
But first succes for me. Now my S8500 can work again with Kies.
If I used faked S8600 apps_compressed...
Before my F. Kies not connected on 2 PCs if I have changed my apps_compressed...
Best Regards
At the moment I am playing with Jet S8000...
Here it is possible to access EFS via QPST...
Best Regards
About S8600...
I have NOT found way or Code to set S8600 in Qualcomm Mode...
Maybe someone else have an idea...
Thanx in advance.
Best Regards
Edit 1.
http://forum.xda-developers.com/showpost.php?p=30900694&postcount=222
QPST Build 378 ...
Found for S8600... later more...
Best Regards
Edit 1.
Code:
*#8720#
AP USB / CP USB.
:good:
Taken from here:
http://www.mysamsungwave.com/index.php?topic=85.0
Now I was able to backup NV items...
In "alternate Mode" EFS Explorer shows all folders on S8600...
Also short tested QXDM... but with old Version...
Best Regards
Related with adfree post in other thread about bluetooth in S8530 investigation I come to this one I have installed QXDM and tested. I have just ubuntu; QXDM tested in WinXP over VirtualBox
Steps in S8500:
-*#8720# to activate "Qualcomm mode" (again to return to normal mode)
-Qualcomm drivers from this thread (Files.rar attachment)
-Looking for NV items related with bluetooth, found this
http://forum.xda-developers.com/showthread.php?p=33233244&highlight=bluetooth#post33233244
2839^"Bluetooth Active"^"Factory*"
2840^"Bluetooth Visible"^"Factory*"
2841^"Bluetooth SAP Enable"^"Factory*
4525^"Bluetooth Disabled"^"Debug*"
But they seem not active in S8500: QXDM Read button says "NV Status Error Received: Item Inactive". BlueTooth logs shows no info, not even mac address.
So Bluetooth in S8500 seem just managed by bcm4329 chip.
Maybe with QXDM we can get some "other processor logs" related with Bluetooth operations, but I am not very confident about that
NV Status Error Received: Item Inactive
Click to expand...
Click to collapse
Caution!
QXDM shows you little overview about "standard" NV items...
OEMs like Samsung can do their own stuff...
But since 2001 I think, really Standard NV items are:
NV item 447 for Bluetooth address
and IMEI
NV item 550
This is also working for S8500 + S8530 and many other handsets in year 2013... Qualcomm based.
If you activate an inactive NV item. Then you could do bad things to your handset...
Because few items then brick your handset... Bootcycle for instance...
It is really hard to erase or change few NV items, because WRITE Protection and few other ugly Security thingies... remember IMEI...
You can backup few NV items with QPST... as QCN file... with Tool Software Download BACKUP
Result looks like this:
Code:
File Version: Major 2, Minor 0, Revision 0
File Summary:
Phone Model: 19 [QSC6270/QSC6240], Configuration Name: default, Total NV Item Count: 305
Phone Model 19 [QSC6270/QSC6240] Configurations:
Configuration Name: default
Mobile Properties:
ESN: 0xDEADD00D
Phone Model: 19 [QSC6270/QSC6240]
NV Major: 0
NV Minor: 0
SW Version: Q6270B-KPUBL-1.5.45072S
Client Name: QPST Software Download 2.7.0.348
Feature Mask:
Bit 9: F_PREFERRED_ROAMING_BIT
Bit 11: F_DIAG_ORIG_CALL_BIT
Bit 46: F_UI_SHOW_DROP_CALL_BIT
Bit 48: F_UI_PWR_KEY_ALT_BIT
Bit 81: F_DS_BIT
Bit 91: F_UI_PRL_VER_BIT
Bit 94: F_MULTIPLE_RINGER_TYPES_BIT
Bit 109: F_MC_TIMER_FIX_BIT
Bit 150: F_LPM_BIT
Bit 171: F_IS683A_PRL_BIT
Bit 200: F_NV_TWO_NAMS_RL_SMALL_BIT
Bit 206: F_ODIE_FONT_BIT
Bit 216: F_EVRC_BIT
Bit 269: F_TCXO_CLOCK_BIT
Bit 281: F_UART_POWERDOWN_BIT
Bit 283: F_FAST_WARMUP_BIT
Bit 296: F_SBI_BIT
Bit 300: F_EVRC_ADSP_BIT
Bit 301: F_VOCODER_MANAGER_BIT
Bit 335: F_AUTOBAUD_BIT
Bit 336: F_512KBYTE_RAM_BIT
Bit 340: F_UI_ANIMATE_CHARGE_BIT
Bit 341: F_NSOTASP_BIT
Bit 350: F_UI_DL_ROAM_MSG_BIT
Bit 358: F_MINIBROWSER_BIT
Bit 363: Unknown
Bit 367: Unknown
Bit 371: Unknown
Bit 375: Unknown
Bit 376: Unknown
Bit 377: Unknown
Bit 379: Unknown
Bit 380: Unknown
Bit 381: Unknown
Bit 387: Unknown
Bit 390: Unknown
Bit 391: Unknown
Bit 423: Unknown
Bit 424: Unknown
Total Set Bits: 39 of 432
Roaming Lists:
NV Items:
NV item: 10 [NV_PREF_MODE_I], index 0
NV_PREF_MODE_I 0: 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PREF_MODE_I 7: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV item: 256 [NV_PRL_ENABLED_I], index 0
NV_PRL_ENABLED_I 0: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NV_PRL_ENABLED_I 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
I have no idea, how good XP work in Virtual machine...
Its dangerous to have accident during read/write access to NV...
For instance I can only repair few mistakes with JTAG...
Best Regards
Modding partition for MT6589 involves hex-editing two files EBR1 and EBR2 which you can find in ROMs that can be flashed using SP Flash Tool. Editing these files is easy, you only need to change a few things and flash them. Finding such ROM, in other way, is not so easy for this phone.
What I share here is a Aroma Installer file you must flash in TWRP (Did not work on Oppo recovery so please don't ask). Install / flash the zip file just like flashing ROMs and it will start-up a GUI and you just follow the instructions.
First, for the sake of common understanding let's agree with these terms below so you'll know what I mean when I said SD Card or Internal etc.
Phone Storage / SD Card : This is where you keep your music, photo, video, downloaded files etc.
System Storage / Internal : This is where your phone stores installed apps with their data, dalvik files etc.
Oppo ROM : Old default ROM in R819 before official ColorOS (green bootlogo).
ColorOS : The current official ROM for R819 (silver bootlogo)
Stock ROM / AOSP ROM for R819. Some refer this to Stock ROM, some say AOSP ROM.
Now here are the steps to do this. Looks complicated and advanced ? Well maybe, but not until you try them.
A. Root your device (skip if you're rooted already)
You can do this with simply running an application called Framaroot. Thread at xda-dev here. Choose the latest version, or you can just donwload Framaroot-1.8.1.apk
Install Framaroot then open Framaroot
Choose Install SuperSU and tap on Boromir. You can also try with Faramir (it depends on Framaroot version)
If you see a message saying "Success" then you're rooted. Just reboot your device.
If Framaroot suddenly closed with no message, just simply re-open Framaroot and re-do the Rooting Process
B. Flash TWRP Recovery & Nandroid Backup (skip if you have done this already)
We'll need TWRP Recovery to do this process.
Download TWRP recovery first. Thread at xda-dev here or you can just download openrecovery-twrp-2.6.3.0-R819.img.
Open Google Play and install Mobile Uncle Tools
Flash TWRP using Mobile Uncle Tools :
put the downloaded openrecovery-twrp-2.6.3.0-R819.img in root folder of your SD Card
Open Mobile Uncle Tools
Choose recovery update
Choose openrecovery-twrp-2.6.3.0-R819.img (it should be on top of the list)
Reboot into recovery and see if you can see TWRP
Make Nandroid Backup
Reboot back to system.
C. Backup, backup, backup
You need to make backup, many kind of backups. Nandroid backups, Application Backup and also your entire SD Card backup.
If you're using ColorOS you can use built-in app called "Backup & Restore". It make backup of your contacts, messages, MMS, call logs, Calendar, Clock (and alarm), Weather, Settings and Theme. It also make backups of your user installed apps and data. Or maybe you have the all powerful Titanium Backup or Helium or other kind of apps that can do backup, please do so. Make backups.
Connect your device to PC and make backup of your SD Card. Everything. This SD Card partition will get resized and needs to be formatted. So this means you'll have a copy of your Backup you made using Application, and Nandroid backup made by TWRP.
D. It's Flashing Time
You're rooted, twrp-ed and backed-up. Now it's time for flashing
Download OPPO-R819-ReParted-v1.5-by_Distan7.zip and copy to your SD Card.
Boot into recovery (TWRP). If you find this hard to do, just open Google Play and download Quick Boot and open it.
In TWRP, tap Install, choose my mod zip file and follow the instructions. You can choose between five partitions size for your Internal storage : 1 GB (Factory Default), 2 GB (recommended), 2.5 GB (my current settings), 3 GB and 3.5 GB. Don't ask about 4 GB please.
After installation, don't forget to Wipe SD Card. Remember SD Card gets partitioned and needs to be formatted. If during boot there's a message about encryption or storage needs repair, just go to settings and find Factory Reset.
Oh by the way, I did tell you to backup stuffs before you start the installer, right ?
E. Restore
Why do you make backups ? So you can restore stuffs. Here are some reading for restoring data :
Your SD Card is now around 1 GB to 2 GB smaller in size, so don't get confused when your data won't fit into your SD Card as it used to.
Restoring Nandroid Backup in TWRP works for me, but some users said they had problem with Google Apps sync after nandroid restore. I don't know if it's related to my mod or not.
You can restore from your backup made in "Backup & Restore" or using Titanium Backup or else.
Don't forget to check your APN, sound settings, bluetooth pairing, WiFi etc.
Small talks
I tried this many, many times, testing the partition result and also the installer. I was about to release EBR1 and EBR2 to be flashed with Flash Tool, but I remember that Meteos APK and ReParted could also flash EBR files. I don't understand anything in Meteos smalife file while ReParted makes more sense. It basically edify updater-script executed under Aroma installer.
I also found out that if you don't have any apps installed on SD Card before installing this mod, there's a good chance you don't have to do a factory reset. All my apps are installed at internal, and flashing this mod many times with different sizes and I didn't have to restore a single app or settings. But SD Card do need to be formatted.
Oh by the way, please leave feedback in the forum so we all can learn too.
Change logs :
2014-01-05 : v1.5 - Add 2.5 GB and 3.5 GB mod
2014-01-04 : v1 - 2 GB and 3 GB mod
Credits :
1. ReParted script is authored by Xakep from lenovo-forums.ru
2. Aroma Installer for ReParted is modified by rainextra
3. Aroma Installer itself is created by Amarullz
4. Mod 2GB, 2.5GB, 3GB and 3.5GB is made by myself
How I Test This Mod :
My phone is running ColorOS v1.0.0i-full. I didn't try this on Stock AOSP or Oppo ROM. In fact I don't have AOSP ROM. However I don't see any reason why this shouldn't work on AOSP ROM or Oppo ROM.
I'm using TWRP for recovery. Will this mod work using Oppo Recovery ? I don't know. Maybe someday I'll try. I tested with Oppo Recovery (stock Color OS recovery) and the installer can not run. So you'll need TWRP.
How to Make Your Own EBR Mod :
Inside the zip file you'll find EBR1 and EBR2. These are the original file (1 GB). The other files are self-explained by their file name. If you want to make a 4 GB go ahead yourself. Here's a how-to in xda-dev, the one I found easier to follow. What you need is a hex editor (HxD or WinHex).
EBR 1 (Hex Offset : 000001E0)
1.0 GB : 00 00 83 00 00 00 00 28 22 00 00 00 20 00 00 00
2.0 GB : 00 00 83 00 00 00 00 28 22 00 00 00 40 00 00 00
2.5 GB : 00 00 83 00 00 00 00 28 22 00 00 00 50 00 00 00
3.0 GB : 00 00 83 00 00 00 00 28 22 00 00 00 60 00 00 00
3.5 GB : 00 00 83 00 00 00 00 28 22 00 00 00 70 00 00 00
EBR 2 (Hex Offset : 000001C0)
1.0 GB : 00 00 83 00 00 00 00 54 40 00 FF D7 BD FF 00 00
2.0 GB : 00 00 83 00 00 00 00 54 60 00 FF D7 9D FF 00 00
2.5 GB : 00 00 83 00 00 00 00 54 70 00 FF D7 8D FF 00 00
3.0 GB : 00 00 83 00 00 00 00 54 80 00 FF D7 7D FF 00 00
3.5 GB : 00 00 83 00 00 00 00 54 90 00 FF D7 6D FF 00 00
Use my EBR1 and EBR2 as your base point, see the changes from 1GB to 2GB to 3GB and read the thread above, you can figured out the hex code for editing. Do the same with EBR2. Yes you need to edit both file. I bet making a 2.5 GB or a 4 GB mod isn't hard.
How To Flash Your Own EBR Mod :
Now supposed you've made your 4 GB Mod : EBR1-4GB and EBR2-4GB. Open my zip file (no need to extract) and add these two files along with their friends.
Next step is to modify two files : aroma_config and updater-script
aroma_config
Here's before editing :
Code:
"<~settings.resize>","",2,
"1GB", "Default Factory",0,
"2GB", "Recommended",0,
"3GB", "For more Space",0
# "2,5GB", "<~settings.resizeo3>",0,
Make the change into this :
Code:
"<~settings.resize>","",2,
"1GB", "Default Factory",0,
"2GB", "Recommended",0,
"3GB", "For more space",0,
"4GB", "Give me MORE !",0
updater-script
Here's before editing :
Code:
#if file_getprop("/tmp/aroma-data/customize.prop","selected.1") == "4"
# then
# package_extract_file("E25", "/dev/ebr2");
# endif;
Make the change to this :
Code:
if file_getprop("/tmp/aroma-data/customize.prop","selected.1") == "4"
then
package_extract_file("EBR1-4GB", "/dev/ebr1");
package_extract_file("EBR2-4GB", "/dev/ebr2");
endif;
Then all you have to do is replace aroma_config and updater-script in the zip file.
Any feedback would be welcome
Reserved
is this file: OPPO-R819-ReParted-v1.5-by_Distan7.zip can be used in other phone (mtk base 6589 with 4 GB Rom) such as lenovo a850,a830,a820,p780?
sicksoul said:
is this file: OPPO-R819-ReParted-v1.5-by_Distan7.zip can be used in other phone (mtk base 6589 with 4 GB Rom) such as lenovo a850,a830,a820,p780?
Click to expand...
Click to collapse
I don't think so. Partition layout could be very different across phones.
For Lenovo P780 - 4 GB version you can read from here
I just followed the instructions and it worked like a charm
I also installed the AOSP ROM with root and made huge modifications using xposed framework.
I really like the new experience so far.
8 gigs
Hello, I have the 8 gig device. I'm running a CN rom now though and the partition is not good. 3.xx gigs for internal memory 3.xx gigs for external memory. I want to make it one block of memory. How would I do that? Could I take your updater script and put in the erb files from my stock KK rom and rezip it and install from there? Or will I need to code some stuff?
As an Oppo ambassador, I'd like to thank the OP a lot for making the effort to put some life into this device again. The original 1 GB storage makes the phone almost unusable in the long run.
Mohon panduannya
I need root
Untuk oppo f3 bisa gak mas...???
hy
You can customize your Boot Splash Picture
(This is the first picture you see when you boot up your device, before the boot animation starts. The one you also see before booting into recovery.)
I have done this for every device I owned so far, plus a few I did't own. Until now they have all been HTC devices. Today I added the Xiaomi 9T Pro / K20 Pro.
If you have your bootloader unlocked and have a custom recovery (tested only on twrp-3.3.1-15-raphael), you can create you own custom boot splash using this Boot Splash Creator tool.
How to do it:
Upload a picture to the online boot splash zip generator (http://jobiwan.net:81/bootsplash-9tpro). (If your picture is not 1080x2340 it will be resized while retaining proportions.)
It generates and downloads a flashable .zip file,
Flash the resulting .zip file in recovery.
Alternatively, you can take the logo.img file from the cache directory inside the .zip file and flash it in fastboot:
fastboot flash logo logo.img
Disclaimer:
You have unlocked and rooted your device, and flashed custom recoveries, so by now you should know that you have nobody to blame but yourself.
Anyway: This tool is provided as is, with no warranty whatsoever. If you brick your device, I will feel sad for you but I will not be responsible.
How it works:
I took the logo.img file from a firmware zip. This is a 24M file that contains 4 bitmaps:
The MI logo
The fastboot logo
The MI logo with unlocked at the bottom
System has been destroyed logo
Each one is 1080x1920, 24bpp.
This tool converts your picture into a 1080x2340 bitmap and replaces the raw image data in the original logo.img file with the raw image data from your picture.
It replaces bitmaps 1 and 3, the MI and MI unlocked logo's. Fastboot and Destroyed logo's remain original.
Then it puts this patched logo.img file into a zip with an updater script that puts it into the logo partition. This .zip file gets sent back to your browser.
Back to stock:
The attached .zip files are recovery flashable. They contain the stock boot splashes for raphael and raphaelin respectively. (I put the original logo.img files in them.) So if you ever want the stock splash back, you can flash this.
('extracted-bitmaps.zip' is not flashable. It contains the original logo's as .bmp files.)
Share & Enjoy!
If you create any cool splashes, that others might like, please post them in this thread with a pictures and zips.
-Jobo
Update Oct. 16, 2019: Online tool now generates 1080x2340 plash images.
Nice
Can I use this on K20 Pro Raphaelin?
Anonda said:
Can I use this on K20 Pro Raphaelin?
Click to expand...
Click to collapse
[edit:]Yes you can. See post below this one.[/edit]
I can not say for 100% sure, because I do not own a raphaelin device to test with.
However, I strongly believe that you can do it. Here is why:
I looked at the logo.img files from a raphael and raphaelin firmware zip.
They are not the same: They have the bitmaps at different offsets. But the structure is the same. They both have the signature and index at the same offset (0x4000 or 16k) and the addresses of the bitmaps are int he same place in the index.
This is from V10.3.3.0.PFKEUXM:
Code:
00004000 4c 4f 47 4f 21 21 21 21 05 00 00 00 ef 05 00 00 |LOGO!!!!........|
00004010 f4 05 00 00 ef 05 00 00 e3 0b 00 00 ef 05 00 00 |................|
00004020 d2 11 00 00 ef 05 00 00 00 00 00 00 00 00 00 00 |................|
00004030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It has the bitmaps at 0x0005000, 0x05f4000, 0x0be3000, 0x11d2000
This is from V10.3.5.0.PFKINXM:
Code:
00004000 4c 4f 47 4f 21 21 21 21 05 00 00 00 3b 07 00 00 |LOGO!!!!....;...|
00004010 40 07 00 00 ef 05 00 00 2f 0d 00 00 3b 07 00 00 |@......./...;...|
00004020 6a 14 00 00 ef 05 00 00 00 00 00 00 00 00 00 00 |j...............|
00004030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It has the bitmaps at 0x0005000, 0x0740000, 0x0d2f000, 0x146a000
After confirming this, I felt confident / brave / stupid enough to flash the logo.img from the raphaelin firmware into my raphael. When I rebooted, it showed the Redmi logo and everything was fine.
So since flashing the raphaelin logo in a raphael device is safe and works fine, I would think that the reverse is also true.
If you or anyone with an Indian K20 have done this, please report back.
-Jobo
touch of jobo said:
I can not say for 100% sure, because I do not own a raphaelin device to test with.
However, I strongly believe that you can do it. Here is why:
I looked at the logo.img files from a raphael and raphaelin firmware zip.
They are not the same: They have the bitmaps at different offsets. But the structure is the same. They both have the signature and index at the same offset (0x4000 or 16k) and the addresses of the bitmaps are int he same place in the index.
This is from V10.3.3.0.PFKEUXM:
Code:
00004000 4c 4f 47 4f 21 21 21 21 05 00 00 00 ef 05 00 00 |LOGO!!!!........|
00004010 f4 05 00 00 ef 05 00 00 e3 0b 00 00 ef 05 00 00 |................|
00004020 d2 11 00 00 ef 05 00 00 00 00 00 00 00 00 00 00 |................|
00004030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It has the bitmaps at 0x0005000, 0x05f4000, 0x0be3000, 0x11d2000
This is from V10.3.5.0.PFKINXM:
Code:
00004000 4c 4f 47 4f 21 21 21 21 05 00 00 00 3b 07 00 00 |LOGO!!!!....;...|
00004010 40 07 00 00 ef 05 00 00 2f 0d 00 00 3b 07 00 00 |@......./...;...|
00004020 6a 14 00 00 ef 05 00 00 00 00 00 00 00 00 00 00 |j...............|
00004030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It has the bitmaps at 0x0005000, 0x0740000, 0x0d2f000, 0x146a000
After confirming this, I felt confident / brave / stupid enough to flash the logo.img from the raphaelin firmware into my raphael. When I rebooted, it showed the Redmi logo and everything was fine.
So since flashing the raphaelin logo in a raphael device is safe and works fine, I would think that the reverse is also true.
If you or anyone with an Indian K20 have done this, please report back.
-Jobo
Click to expand...
Click to collapse
Raphael logos work on raphaelin without any issues!
Regards,
acervenky
acervenky said:
Raphael logos work on raphaelin without any issues!
Click to expand...
Click to collapse
Thanks for confirming. That's good to know.
I have added a zip with the stock logo for raphaelin to the original post.
-Jobo
Here is a boot splash plus boot animation that go well together.
They are the same style and the first (and last) frame of the animation is the same as the splash.
The boot animation is not recovery flashable. You have to manually copy it to /system/media/
-Jobo
Do you have the raw files of the 4 bitmaps inside the original logo.img of K20 Pro? Because I can't extract it and I want to get the original bitmaps/stock logos and start edit on it. Thanks
ispiyaakoe said:
Do you have the raw files of the 4 bitmaps inside the original logo.img
Click to expand...
Click to collapse
Yes. I have added them as an attachment to the first post, in 'extracted-bitmaps.zip'.
Inside the .zip are 8 .bmp files. euX.bmp are from European firmware, inX.bmp are from Indian firmware.
Interestingly, the bitmaps in the Indian firmware are not all the same size.
The 'normal' logo's are 1080x2340 while the 'fastboot' and 'destroyed' logo's are 1080x1920.
I think I will change my online tool to generate 1080x2340 splashes instead of 1080x1920.
Edit: Done. Online tool now generates 1080x2340 plash images.
Thank you very much! You are awesome.
There is a crop up and down at 1080p images. Other than that is working properly!!! Thx!
pikachukaki said:
There is a crop up and down at 1080p images. Other than that is working properly!!! Thx!
Click to expand...
Click to collapse
I have updated the online tool to generate 1080x2340 images instead of 1080x1920. This fills the entire screen.
(It also no longer distorts the image when stretching. It now scales the image proportionally for best fit and puts it on a 1080x2340 black background.)
Originally I made them 1080x1920 because that's how they are in the PFKEUXM firmware.
Only after looking into the Indian K20 Pro firmware did I find out that it also works with full 1080x2340 bitmaps.
Here is Google black boot logo + black android 10 bootanimation. Bootanimation is only for AOSP ROMs.
Thanks and credit to @touch of jobo for his tool.
Xiaomi Bunny pics
I took the images from this set: http://vkclub.su/en/stickers/xiaomi/
..and converted them to boot splash zips.
(On that site, it says the Author / Illustrator is 'Xiaomi'...)
It is the same creature that we have on our stock fastboot logo. I think they were originally meant as emoticons. Some of them have some text (in what seems to be Russian) in very dark grey. I first overlaid the images on this same dark grey color and then turned that dark grey into black. This gets rid of the text.
Attached to this post are:
The 16 images where I put the original pictures on a black background,
The original pictures in originals.zip
The flashable bootsplash zips are inside zips-000-007.zip and zips-008-015.zip
I put the 16 bootsplash zips inside 2 new zips to get around the 20 attachments per post limit.
This means they are fairly large. You can also just download individual pictures and run those through the tool.
(So just to clarify: Those 2 large zips are not flashable. They each contain 8 other zips that are flashable.)
gianton said:
Here is Google black boot logo + black android 10 bootanimation.
Thanks and credit to @touch of jobo for his tool.
Click to expand...
Click to collapse
Bootanimation does not work. Tested on my K20 pro
omkar1997 said:
Bootanimation does not work. Tested on my K20 pro
Click to expand...
Click to collapse
Forgot to mention bootanimation is only for AOSP ROMs.
IdrisMC said:
Can you flash both on LOS 17?
Does the splash also include the google bootloader image?
Click to expand...
Click to collapse
Yes that's what I'm using with LOS 17. Flash both in recovery (mount system first).
Silhouette of trees against winter evening sky
I took this picture about 10 years ago. Since then I have used it as a wallpaper on every computer and phone I used. I think it goes really well with a dark theme.
Now I made a boot splash and boot animation based on this picture. They are the original 9T-Pro splash and animation, but with this photo as the background.
By default, the lock screen takes the center of the wallpaper (when you select 'Apply Both'), which is the same cut-out I use as the background for the splash and boot animation.
Attachments:
bootsplash-9tpro-trees.zip
This is a recovery flashable zip that replaces your boot splash.
bootanimation.zip
This zip is not flashable You have to put it in /system/media/
(This is an external link, not an attachment. The file was too large to attach.)
trees-wall.jpg.zip
This is the full resolution wallpaper 3120x2340 (zipped)
trees-boot.jpg
This is a picture of the boot splash.
trees-small.jpg
This is a small, lower quality version of the picture inside trees-wall-jpg.zip. Just as a preview.
Enjoy,
-Jobo
Thanks for this tool, it's amazing
Sent from my raphael using XDA Labs
What are the odds of working on Mi 9T (Davinci)?
PS. Tested and it works like a charm S2