Related
Hi guys,
a new version of ER2003Edit is available from the wiki page:
http://wiki.xda-developers.com/wiki/ER2003Edit
New features and improvements:
- provides support for the new upgrade tool version (0.9.1.0) used by the latest T-Mobile and O2 updates
- supports editing of the header information (DeviceID, Operator and Language) in order to circumvent the country code error
- some other fixes and improvements
Best regards,
softworkz
Thnx dude! At last we got a program to modify the header. I guess this makes a lot of XDA owners very happy.
Great work!
Late...
Thanks Softworkz, great work again. It really looks like an even more powerful tool, but there seems to be a little bug (or I am doing something wrong):
After upgrading ER2003Edit to the new version, I cannot open the ms_.nbf anymore. When I try to open the file, ER2003Edit always crashes, although I left the file unbmodified.
Downgraded to the old version again and there it works, although I have to decode and encode the files by myself.
Any suggestions?
No problems opening the ms_.nbf here after doing the upgrade. Running Win XP sp1.
Try uninstalling the old one completely then install the new one...
Works great!
Late...
is it a misunderstanding between header-information and encryping ???
I think Er2003edit does not do the encryption/decryption so far.
Hey Softworkz...
this would be a great improvement as I guess all coming
extended roms will be encrypted.
Alex
Tried uninstalling and re-install but that didn't help. As far as I remember, Softworkz tool is not able to edit encrypted ms_.nbf.
But on my machine (Win XP pro 2002 SP1) the program always crashes when opening an non-encrypted ms_.nbf...
I will use the old one as a workaround, I don't need to change the header so this should be fine.
some programming tips:
It should not be very difficult to implement the xor decryption, just xor each DWORD in the file with 0x25863614 after loading it in memory, and before saving it back to the file.
also, if you verify the header checksum after loading the file, you should be able to detect that the file you are loading is actually a decrypted nbf file.
and another check to see if at offset 0x70040 there is a valid bootsector, with
the 'MSWIN4.1' and 'FAT16' strings should prevent it from crashing on invalid files.
Ouch, I just found out that the wrong version of xda2tools.dll was included with the setup. I have made available a new version (1.2.20) to fix this. (see wiki page)
Some details about ER2003Edit:
You do not need to uninstall old versions before installing newer ER2003Edit versions.
The new version (1.2.x) is able to perform XOR-De-/Encryption. When opening an extended ROM file ER2003Edit first checks if it is encrypted by looking for the presence of the dashes in the header.
If those are present in the right places ER2003Edit opens the file as usual. If the dashes are absent ER2003Edit tries to decrypt with all of the three XOR-Passwords (). If none of those passwords produces a file with a correct header a prompt is shown which lets you enter your own password.
The decrypted (or a copy of the unencrypted) ROM file is saved to the temp folder. When saving with ER2003Edit the file is encrypted again (in case the original file was encrypted) and is saved to the original location overwriting the initial file.
Itsme: The "dash-check" was used because the CRC-check in your code was always true (didn't look into it further).
The new version supports auto-detection of the ROM type in order to edit the header of the other 2 ROM files (NK and Radio_), too. The "error accessing image files" message is now suppressed for these files.
Nevertheless modifying the header of those files is useless and I didn't figure out how to access the file structure in those files (doesn't look like a FAT image).
Best regards,
softworks
Okay, that explains the problems I experienced. As soon as I am back home I will give it a try. If it works it will be a nice & powerful tool...
==> seems to work perfectly. So there are no more obstacles. Next stage will be an Upgrade to 1.66.xx... :shock:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
ER2003 crashes opening new O2 extended ROM Files
Hi softworkz,
first off all thanks for your great work!
Using the new version of er2003 i cant open the ms_.nbf file of the latest O2 upgrade (1.60.52). It crashes every time. Opening and editing my self created ext. ROM based on T-Mobile Update 1.60.07 works great.
Whats wrong with my installation? If you wish i can send u my Win XP error report.
Escargotet
Sorry for posting, was 2 stupid to read forum first!
Sorry for posting, was 2 stupid to read forum first!
Hi all
Please help to clarify as there are some inconsistances...
(or I am wrong, but will run into this problem)
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
So there is a missing link...
Alex
itsme said:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
Click to expand...
Click to collapse
The CRC check does not work in your code. XORing with a wrong password results in the following message:
WARNING: this does not look like a nbf header, possible you provided the wrong password
But this gets printed as a result of the "dash-check". If the crc-check would fail, a different message would be printed:
WARNING: checksum is not ok, possibly you provided the wrong password
But this message never gets printed because (filecrc != crcsum) never occurs (for whatever reason).
Xant said:
Hi all
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
Click to expand...
Click to collapse
No. Er2003Edit can open NK and radio ROM files and edit the header. Er2003Edit automatically re-encrypts the newer ROM files (XOR-Method).
Er2003Edit decrypts older ROM files (DES-Encrpytion), lets you edit the header and save the file but it does not re-encrypt these ones (use xda2nbftool). A message is displayed in this case to remind you to encrypt the file.
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
nargalzius said:
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
Click to expand...
Click to collapse
I knew about this. I was just stating that the header of NK and Radio is irrelevant for the upgrade tool and is not responsible for the country code error.
SPV M1000
Does it work with SPV M1000 version
loade ER2003 started it and stay on the ROM info screen :?
Since getting my XDAII a few days ago, I've been impressed with the number of customisations possible, and have managed to acheive a number of different tasks, however, I have as yet to cook my own ExtROM for it.
This is something I would very much like to do, and I have acquired an ms_.nbf from the end of the line update that O2 provides from their website.
I have all the necessary tools to do it, and I know exactly how to, but I do not know which packages I need to keep in order to have a PDA with fully functioning bluetooth, blackberry and ad nauseum. alternately, as I'm sure that there is probably an ExtROM with all the bare essentials in it (and probably newer version essentials too) so if someone could point me to one, or the other I'd be very grateful, and whatever it is, I am definitely interested in dumping O2Active.
you dont need to mess with nbf files to cook an extented rom
you can just use the tool to unhide and unlock the extented rom from the xda and remove the cab files you dont want and
add the ones you want and change the config.txt file to include the new stuff and exclude the stuff you removed
then you just lock and hide the rom and hardreset
and the rest if history
I know, but someone else wants a custom ROM, and they're too far away for me to get hold of their PDA to do it that way.
all I need to know now is what .CAB files I need to include to have everything functioning, then I'll bung on extras
I guess this is a trial and error jobby then.
now something I've wondered that should be simple to answer;
when flashing on an ExtROM, is it possible to flash ONLY the ExtROM, or is it mandatory to flash the OS and radio as well, on pain of trashing the PDA and reducing it to only the bootloader.
well, through trial and error I've got it all sorted, thanks to everyone for their help... oh, wait, I didn't get any help, but many thanks to Rudegar.
Sure, you don't owe me anything, but if a forum's been setup for the purpose of giving help, it sure would have been nice to have received some rather than just getting ignored because I haven't made enough posts yet to join whatever religious PDA sect you happen to run exclusively to help eachother.
rant over, I've made my point, perhaps something positive can come of it?
Just yesterday I created my first "EXTENDED ROM" and installed it by myself for my friends XDA II, all you need is EDIT2003 program thats on the wiki somewhere. Then you can open the ms_.nbf, and edit the splash images and the files it will install on the hard reset, then just install it to the phone using the rom upgrade procedure but put the extended rom in and delete the nk.nbf and the radio_.nbf tah dah!
Hello,
I have some questions, if someone could help me with any of these I would really appreciate it, I am quite newbie, but I learn fast... now the questions:
1. is it possible to full dump the Hermes ROM to microSD using 'd2s' in bootloader? if yes, would it be possible to use 's2d' to restore it?
2. anybody can provide more information on the Hermes ROM layout, virtual and physical memory maps, offsets, sizes, etc..? If yes, how do you find this?
3. anybody managed to run pmemdump or psdread on Hermes?
4. The existing ROM upgrades for Hermes do not have .nbf files, they use a "new(?)" format .nbh, the file RUU.dll has functions GetNBHInfo() and UpdateNBH(), anyone with windows debugging skills could help to decode this format? Inside this file you should find:
- Extended ROM
- OS
- IPL (part of bootloader)
- SPL (part of bootloader)
- Splash screen
- HTC Logo (normally uses the same image as the splash)
- GSM radio code
5. Can someone make something like xda2nbftool to work with this .nbh format?
6. I think the security password should be possible to extract from RUU.dll too, as it calls SecurityPass() function, but I don't know how.
7. Is there an up to date list of bootloader commands? I found those, but I think some info is wrong or missing:
http://wiki.xda-developers.com/index.php?pagename=HimalayaBootloaderCommands
http://www.xs4all.nl/~itsme/projects/xda/bl-ii-usage.html
8. anyone could provide photos of a disassembled device? chipset references, etc...?
9. anyone interested on linux port for Hermes??
BIG thanks
Now I can answer myself some questions... who can answer the rest??
pof said:
1. is it possible to full dump the Hermes ROM to microSD using 'd2s' in bootloader? if yes, would it be possible to use 's2d' to restore it?
Click to expand...
Click to collapse
Nope that I have found.
pof said:
6. I think the security password should be possible to extract from RUU.dll too, as it calls SecurityPass() function, but I don't know how.
Click to expand...
Click to collapse
The password is dinamically generated, changes everytime, here's how to access the bootloader with the right password:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoaderPassword
Also wrote a post in the forum about this, and made a cool pdf explaining the process:
http://forum.xda-developers.com/viewtopic.php?p=346002
BTW, the password seems to be not useful for anything
pof said:
7. Is there an up to date list of bootloader commands?
Click to expand...
Click to collapse
Yes, I've written it on the wiki, but some info is still missing:
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader
Hi guys,
When running through mrvanx's instructions on how to extract and compile the new .nbh file, i find that there is no explanation on the "Device" setting.
mrvanx leaves his "Device" setting at default "HERM200"....
My device is in actual fact a HERM100....
Is this an important setting to worry about? Or is default "HERM200" ok?
Thanks.
Notice how i say:
Verify the information in the window is the same as in the picture.
Click to expand...
Click to collapse
So you should leave the info as it is. It makes no difference which model of hermes you have.
Hi all,
there is probably working HardSPL for your device
we need someone with barely alive StarTrek to test this
REMEMBER! This may kill your device without any chance for recovering!
http://rapidshare.com/files/228281638/StarTrek_HardSPL.7z
Instructions:
- download above mentioned archive
- unpack this archive to any folder (e.g. C:\StarTrek_HardSPL )
- connect your startrek to PC using ActiveSync or WMDC
- run SemiAuto.bat and follow instructions
Please feedback
hi man
this test is when your htc is bricked? or it's necessary to enter to OS?...
necessary to enter to OS
Error 228: Invalid file size
XtreMe_G said:
Error 228: Invalid file size
Click to expand...
Click to collapse
Thanks for testing.
That's probably due to an NBH filesize less than 30MB.
I will upload a new version with my V9b rom inside, for size increasing purposes
But you've warned - This may kill your device without any chances on recovering...
hang on.....i think i can add the os.nb myself
dont worry, its a junk phone that i have.....doesnt read sim, some keys dont work, camera missing......etc, u get the picture
edit:
didnt work
error 270.....image file corrupted.....i suck
XtreMe_G said:
hang on.....i think i can add the os.nb myself
dont worry, its a junk phone that i have.....doesnt read sim, some keys dont work, camera missing......etc, u get the picture
Click to expand...
Click to collapse
already done
http://rapidshare.com/files/228565493/StarTrek_HardSPL2.7z
downloading now...
no go.....same error as before 228, invalid file size. and i definitely did not use the first one, i already deleted it.
so strange...
thanks
i noticed something.......your spl.nb is 512kb while the spl.nb from the cingular rom is 1mb