Weird OS.NB extracted? - Upgrading, Modifying and Unlocking

Hello, I've tried extracting imgfs.bin from LG WM 6.5 firmware, and it results in some weird way.
The points I'm curious at are:
1. Unpacking .KDZ results in *.wdb, not .DZ.
2. Unpacking *.wdb results in weird binary file, not in .tot
3. Resulted binary file seems to be in Qualcomm .MBN format, but there seems to be almost no details within it. Are there any docs about this format?
4. I've tried using osnbtool (with -sp option), then it failed with this message: Can not find OS image! So I've searched it for a bit, then found that I have to rip off all the LG-specific regions to work. So I ripped those off (with custom unyaffsmbn), tried osnbtool again then it worked.
LU210927_00.bin.new.PRE written.
LU210927_00.bin.new.OS.NB written.
Now I get these two, so I tried nbImageTool on OS.NB generated. It extracted imgfs.bin, but seems like it is corrupted... Did I miss something?
Here is the link to the extracted OS.NB: https://drive.google.com/file/d/1vPHWbiHproO_bs09WASc8YreWNaJVrZr/view?usp=sharing
And here is the link to the original firmware (kdz): https://drive.google.com/file/d/1YknA0mg27YfaGEHr10XJ1k8ztgw_V3fA/view?usp=sharing
Thanks a lot!

Related

Universal upgrading to Jasjar ROM (sorry for wrong crosspost

Hi!
Trying to figure out how to upgrade but I am missing something.
I downloaded the file JASJAR_WWE_11353_137_10301.EXE.
When I run it it gives me a country ID Error 120
Following other posts I downloaded the file MaUpgradeUt_noID.exe which gives me the error missing run.dll.
In another post it says to put the MaUpgradeUt_noID.exe in the same directory of the JASJAR_WWE_11353_137_10301.EXE.
BUT THE JASJAR_WWE_11353_137_10301.EXE DOES NOT CREATE ANY FILE NOR DIRECTORY.
WHERE THE HELL ARE THOSE EXTRACTED FILES???
P.S. What a nightmare.
Re: Universal upgrading to Jasjar ROM (sorry for wrong cross
claudioita said:
Hi!
Trying to figure out how to upgrade but I am missing something.
I downloaded the file JASJAR_WWE_11353_137_10301.EXE.
When I run it it gives me a country ID Error 120
Following other posts I downloaded the file MaUpgradeUt_noID.exe which gives me the error missing run.dll.
In another post it says to put the MaUpgradeUt_noID.exe in the same directory of the JASJAR_WWE_11353_137_10301.EXE.
BUT THE JASJAR_WWE_11353_137_10301.EXE DOES NOT CREATE ANY FILE NOR DIRECTORY.
WHERE THE HELL ARE THOSE EXTRACTED FILES???
P.S. What a nightmare.
Click to expand...
Click to collapse
You can use winzip to unpack the .exe..... and stop swearing.

tool to access the samsung onedisk flash

i wrote a new tool that you can use to read the rom image, it can be found at:
http://nah6.com/~itsme/bkondisk.zip
Code:
usage:
first copy bkondisk.exe to \windows on your device, then:
prun bkondisk [targetdir]
will save all partitions on all volumes in files on [targetdir]
prun bkondisk -v0 -p1 [targetdir]
will save a specific partition on [targetdir]
prun bkondisk -v0 -b0 -n1 \firstblock.img
will save the specified blocks to \firstblock.img
prun bkondisk -i
will only list disk info in the logfile "\bkondisk.log"
-v0 or -v1 to specify the volume
-p0, -p1, etc to specify a partition
-b0 etc to specify a starting block ( ignoring partioning )
-n32 specifies to read 32 blocks starting at the above block.
note: you DON'T need to put quotes around directories with spaces in it.
when no path is specified, files will be created in the root.
Thanks! I've got a couple of questions... it extracted the following files:
bk_00_0000.img
bk_02_0005.img
bk_03_0025.img
bk_06_0001.img
bk_08_0175.img
What do these files refer to (which one is the ROM, etc). Also, is there a way to write these backups back to the phone? It would be a great way to try out test roms and get back to my original T-Mobile ROM if necessary.
bk_00_0000.img - IPL : ONBL1 + ONBL2
bk_02_0005.img - GSM + splash + gsmdata + simlock + serialnrs
bk_03_0025.img - OS
bk_06_0001.img - SPL
bk_08_0175.img - userfilesystem
Is there a way to write them back to the phone? or is that not possible...
is it possible to get a .nbh files out of these files?
My idea would be to "glue" the 4 files together (bk_00 to bk_06) in one file, rename the file to RUU_signed.nbh and exchange the RUU_signed.nbh created by the RUU.exe in \Profiles\[user]\Local Settings\Temp\pftxx.tmp with this one and then run on the RUU.exe with the modified .nbh
for example in DOS:
copy /b bk_00_0000.img+bk_02_0005.img+bk_03_0025.img+bk_06_0001.img RUU_signed.nbh
Is it that simple?
EDIT:
Ok this easy way doesn't work.
RUU says "Error 238 - File read"
Maybe some kind of checksum is missing....
Three questions for itsme
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.
Maybe this helps a little bit to get ideas.
I have been searching here for nights - this is what I found so far:
1. I think it's similar to the Hermes - nobody found a way till now - the first step is to modify a signed .nbh, deleting works but not adding a file:
Hermes - how to dump ROM
Hermes - new custom ROMs
Hermes - ROM cooking and Bootloader MFG 1.01
aChef ROM Utils
2. This is the way Imei-Check is CID-unlocking - investigated by pof:
Reverse Engineering the Herems imei-check unlocker
Maybe there is another way like Zone-MR is doing it for the Star100/Qtek 8500
Star100 Unlock procedure but here you have still to decryt/encrypt the block in my understanding and therefore you have to find out the key
3. I didn't find anything about this so far, but I think the information is anywhere at XDA-Developers
EDIT: here (nl)itsme wrote:
.... but i am still busy, have not had the time to look at creating a tool to convert a memdump to a updater file.
Click to expand...
Click to collapse
so I hope he will find the time to create this tool
P.S: @itsme and @pof: I also want to thank you very much - you are heroes!!!
mar11974 said:
1. Could these files be used to create a nbf file to flash from the sd card as a backup?
2. Would it be possible to modify sim/cid lock?
3. Are these files in raw (dump) format that could be edited in hex editor?
P.S. Thanks to your other posts (works) that helped me figure out the whole sd card flashing thing for the Dash.
Click to expand...
Click to collapse
I got different files ...
After running the tool I got :
bk_0__0000.img (IPL? Is it same as bk_00_0000.img?)
bk_02_0005.img (GSM + splash + gsmdata + simlock + serialnrs)
bk_03_0025.img (OS)
bk_06_0001.img (SPL)
bk_08_0185.img (?????)
I did not get bk_08_0175.img, though.
Hints?
On the other hand, is it possible to extract files out of IMG files?
Thanks.

[release] nbimg: HTC splash screen tool

nbimg is a command line tool which allows to convert HTC Splash Screen images from NB to BMP and create NB splash screens from BMP format. Any splash screen size is supported (yes, it works for Diamond or Athena at 640x480 resolution too).
Code:
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
Usage: nbimg -F file.[nb|bmp]
Mandatory arguments:
-F <filename> Filename to convert.
If the extension is BMP it will be converted to NB.
If the extension is NB it will be converted to BMP.
Optional arguments:
-w <width> Image width in pixels. If not specified will be autodetected.
-h <height> Image height in pixels. If not specified will be autodetected.
-t <pattern> Manually specify the padding pattern (usually 0 or 255).
-p <size> Manually specify the padding size.
-n Do not add HTC splash signature to NB file.
-s Output smartphone format.
NBH arguments: (only when converting from BMP to NBH)
-D <model_id> Generate NBH with specified Model ID (mandatory)
-S <chunksize> NBH SignMaxChunkSize (64 or 1024)
-T <type> NBH header type, this is typically 0x600 or 0x601
Example to convert a NB to BMP:
Code:
$ ./nbimg.exe -F diamond137.nb
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
[] File: diamond137.nb
[] Image dimensions: 480x640
[] Encoding: diamond137.nb.bmp
[] Done!
Example to convert a BMP to NB:
Code:
$ ./nbimg.exe -F diamond137.bmp
=== nbimg v1.1
=== Convert NB <--> BMP splash screens
=== (c)2008 Pau Oliva - pof @ xda-developers
[] File: diamond137.bmp
[] Encoding: diamond137.bmp.nb
[] Image dimensions: 480x640
[] Done!
Download
Windows version attached to this post.
Linux version and source code available in my blog.
This is awesome!
Thanks.
nice one...
this is amzing tool
well done brother
OK so i took a .bmp file i created and converted it to .nb ... what exactly do i do next? can you only inject this file while a ROM is being cooked? or do i need to overwrite an existing file in the \windows directory?
I am using Kavana 6.1 ROM for the Excalibur BTW...
This has nothing to do with OS side. You need to create a NBH file for your device, with the NB splash screen inside, and flash it to replace the bootscreen.
so how to do "inject the .nb file int the .nbh file?
i have the original .nbh file and i've created the .nb file... what's the next step exactly?
and it's an .nbh unsigned file so its not locked down
Use any tool available to create NBHs, for example HTC Rom Tool. To flash your custom NBH file you'll need USPL or HardSPL installed on your device. Also for Excalibur specific instructions look [url="http://forum.xda-developers.com/showpost.php?p=2366103&postcount=13]here[/url], because you'll need to add the smartphone signature manually.
i tried using the htc rom tool but when it loads, it fails to update the devices list. says internet connection probs... im on the net to its not my internet connection. oh well. guess i will wait a little longer..... im really a noob when it comes to this part of modding. All i want to do is to replace the first splash screen that comes up ( the HTC one ) and the second splash screen ( the windows mobile one) with the two i created.
ok i finally created an .nbh file from the .nb file i used to get the mainsplash.nb file. But when i do the flash all i get is a green gradient filled mainsplash screen and not the image that i converted. Was there something i did wrong? bear in mind i have the HTC Excalibur Smartphone
Basically since all i wanted to do was to flash the main splash screen i created a .txt file with this info:
EXCA10000
1111111
1.11.0.0
USA
600,02_MainSplash.nb
i made sure i named the created .nb file to "02_MainSplash.nb" and dropped it into the directory where the .txt file was located. I got the output .nbh file and compared it with my original .nb file and it was 1kb larger than the .nb.....
When i created the .nb file i used the code you posted on another thread and it looked like this: nbimg.exe -F MainSplash.bmp -w 320 -h 240 -n .... the name of the file was MainSplash.bmp any suggestions? i had heard you talk about adding the "this is smartphone signature" manually. Could this be the problem? If that's the case, i suck as hexediting, so maybe you can hexedit it 4 me?
also note that i got a flash wtire error too when running the RUU
When I first saw this thread I was like "yay! a new EASY way to flash a just the boot image!" But I was wrong, just gets you one step closer Still thanks for the tool tho...what would be nice is a tool that you just insert the BMP or image, then it generates a flashable .nbh like the one I attatched (but that's asking too much) . The .nbh below is only 500kb and it flashes to my Vogue and ONLY replace the first boot screen (then hard-resets the phone). How did that person make that!?
So here's the deal on my ventures.
I've found out that although the excalibur is a 320 X 240 sozed screen the actual .bmp and .nbh files are 240 X 320 ... I verified this by extracting the .nb and .bmp files from the HTC ROGERS and TMO .nbh files the images looked fuzzy, but they work when they are injected into my phone. So here's what i did. I created a .bmp image from scratch using 320 X 240 attributes. the name of the file was 00_MainSplash.bmp. I then used pof's nbimg.exe file and typed in cmd window: nbimg.exe -F 00_MainSplash.bmp -w 320 -h 240 -n
. then it gave me 00_MainSplash.bmp.nb which i renamed and took off the extra .bmp in the middle. Then i did this .nb file in reverse by typing nbimg.exe -F 00_MainSplash.nb to see what the output .bmp file would look like. When i looked at the output .bmp file it was all distorted in the same way the official carrier .bmp files looked like. So i figure ok, i got it correct now. Here's where the issue occurs. I use the nbhgen.exe file and type nbhgen dash.txt (the .txt file is called dash.txt)
The text reads:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
so i execute it and it gives me the RUU_signed.nbh file . The file size is around 151kb I then use the RUU updater and execute that (after i run the USPL CID Bypass) Then after the updater states it's successful the phone reboots and gives me a green gradient screen as the first splash screen and not the file i created. I figured i must be going something wrong (obviously)
if i try and re-extract the .nb files out of my new .nbh file using NBHExtract.exe the only file that turns out is: 00_MainSplash.nb ... now when i ran that same utility on the Tmobile, Rogers and HTC official. nbh files the output files were 2: one was: 00_MainSplash.nb & 00_MainSplash.bmp,,, so it seems like the .nbh files should contain a .nb and a .bmp file somehow.
So i went back to my dash.txt file and changed it to read:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
600,00_MainSplash.bmp
i also tried:
EXCA10000
1111111
1.11.0.0
USA
600,00_MainSplash.nb
601,00_MainSplash.bmp
and tried using that output file with the RUU updater. Either way it gave me a flash error and kept that same green gradient screen upon first boot.
So if anyone can tell me where i fouled up i'd be indebted to you.
edit: ok a retract what i said about the nbhextract.exe not outputing 2 files when i extract the .nb file i created. So there must be something else im not doing right..... pof had mentioned something in another thread about using a hex editor to sighn the .nb file for smartphones. but i have no idea how to do that.
Edit2: I think one of two things are going on. 1. The .nb or .nbh file must be signed for smartphones like pof mentioned.... or 2. the nbhgen.exe is somehow malforming the format of the image ( such as converting it from 320x240 to 240x320 ) or the certificate doesnt work with the excalibur that nbhgen uses
Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.
pof said:
Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.
Click to expand...
Click to collapse
friggin sweet! thanks a lot! i'll make sure to "spread the wealth" if i can get it workin on my phone.
pof said:
Wait a while and I will make it smartphone friendly and with option to directly generate NBH for you. I'll update the first post when its done.
Click to expand...
Click to collapse
any timeline on when you expect this development to be completed?
Check the first post, I updated it.
pof, please, check this thread http://forum.xda-developers.com/showthread.php?t=404449&highlight=splash, for my problem
mucas gracias...or something like that
how do great roms always have bad(dumb) splashes...well not any more
thanks for the update
Hi All,
What is the HTC Thouch Diamond MODEL ID ? Where can I found it?
Regards,
Sebastien

Asus P320 .nbh

I am pretty new here.
I am pretty stuck here. I am looking for the .nbh for Asus P320.
All I have is a Flash.bin and for I ve tried splitting 850_GAX_SD_Enc.bin , I am able to get only .nb0 not .nbh.
Any idea here ? Thanks
I am using ROMDonalds. It says to extract a get a nbh file. I don't know how to extract this.

How to read and extract Tab S firmware .tar.md5 files

In the past, for e.g. my 3-4 year old Samsung galaxy tab, I was able to extract those firmware files (the ones you flash with Odin), by using the trick described in many places... Unzip, run sgs2toext4.jar on the .img file, then mount resulting .img.ext4 in Linux Reader.
On the files for Tab S, sgs2toext4.jar is failing. Like it has done for other devices, see e.g. post #48 at link below. (it endlessly loops the file name dropped into the program window).
http://forum.xda-developers.com/showthread.php?t=2138885&page=5
What's the way to read these files, on Windows?
Thanks!
You need simg2img to convert to a raw image.
Here is the windows version, rename your .img file to system.img then run convert.bat. You can view the files with ext2explorer.exe or Linux reader.
simg2img
Thanks very much.
That worked like a treat.

Categories

Resources