Just curious as to how long it should take to flash the OS.nb file through mtty???
its been sitting on the 'start NB image download' for about 30 minutes now...
Code:
USB>
USB>task 32
Level = 0
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 463
Storage Total block: 473
Total Bad Block in CE: 0
NeedToEraseBlockStart: 476
Storage format success
USB>lnb OS.nb
:F=OS.nb
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image download
well it should take no where near 30 minutes (a full RUU upgrades takes only 25minutes)
when i upgraded to 2.05 via mtty it was done in under ten minutes (fast).
are you sure the filename is OS.nb because be default when you extract the .nb from the .nbh is will be 06_OS.nb
yes im sure it was named correctly else it wouldnt have picked up the
Code:
USB>lnb OS.nb
:F=OS.nb
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image download
should i cancel it and start again??
when you extracted the .nb files from the .nbh did you rename any files?
If you didnt, then again I think OS.nb doesnt exist and that is why it is hanging there after more than 30 minutes.
also, make sure that mtty.exe is in the same directory as the .nb you are trying to flash.
yes i renamed the files from 06_OS.nb to OS.nb and the files are in the same directory... what version and connection speed are you using in mtty??? the version im using is 1.11a...
v1.11a and default settings for the USB connection.
I guess you can restart the process, because immediately after the messages you see on the terminal output should have sees the progress meter kick into full swing.
hahahahaha you were right... was using the mtty from a different folder ... time for some sleep....
there you go,
time for sleep? its only 3:22pm in Melbourne...... should you be at work?
EDIT: I cant talk, reading forums on company time, academia is so good.
yeah at work.. but been up all night playing with all these new tools!!!!
Related
First of all .. my thanks goes to all the people to this forum!
You're really GREAT !!
In any case sorry for my poor english :wink:
I've few questions ...
I've read many many pages but I can't understand the right procedure to follow for dumping my Himalaya original ROMs because in some pages the "d2s" command is followed by some numbers and in other, by other numbers ... confusion bring me !
After that, otherwise, I've tried to follow the XDA II procedure and the storing procedure to SD seems to be ok .. but when I try to save the rom dump from my SD to PC using ntwr (otherwise was unreadable in Win), I've got a read error but, in any case, I obtain only one file on my PC of about 400 MB and I suppose that something is wrong because all of you speaks of about 50 MB ... so ... What's the right procedure with the right command? How can I be sure that my dump is correct? The dump it's only one file or one for separate ROM Radio and Extended?
When I solve this issue I can try to upgrade my Himalaya to WM2005.
Thank you for your help.
Please help me, I'd like don't lose my guarantee.
This post was submitted also to buzz forum
Now this is the situation ...
Qtek 2020 - 1.66.04ITA
-= Preparing the device =-
01 ) I,m gone to Bootloader (Power + Directions + Reset)
02 ) I see on the device "Serial v1.06"
03 ) I stop MSSync service Ctrl+Alt+Canc and stop wcescomm.exe
04 ) Put device on cradle
05 ) Now I see on the device "USB v1.06" instead of "Serial v1.06"
06 ) Put the 512 MB SD into the device
07 ) Start Mtty 1.42
08 ) Leave as is all the parameters
09 ) I've "USB" port (and not ".WCEUSBSH001") and I press USB
10 ) Ok seems to be connected to the device
-= Dumping the ROM on SD =-
11 ) Into mtty command line I write (and not copy and paste and without "sd a" at the end)
d2s 80000000 02000000
12 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
SDCARDD2S+,cStoragePlatformTyp e=FF
****************************** ****************************** ****************************** ****************************** ********
Store image to SD/MMC card successful.
USB>
13 ) Then I write
d2s 60000000 00300000 sd a
14 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
************
Store image to SD/MMC card successful.
USB>
15 ) Then I write
d2s 70000000 01080000 sd a
16 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
DOCInfoTableinitHW+
Binary0:dwSize=80000
BINFS0:dwSize=0
FAT0:dwSize=1000000
FAT1:dwSize=EA0000
All:dwSize=1F20000
****************************** ****************************** ******
Store image to SD/MMC card successful.
USB>
-= Saving ROM from SD Card to PC =-
17 ) Put the SD Card into a Card Reader
18 ) Go to Dos command line into ntrw path
19 ) Type "ntrw read ROM.nb1 H:" where H: is the Card reader drive
Now start the problem ... :shock:
I want to know if it's all ok with this process ...
The output of ntrw is:
NTRW 2.0
Removable media
Cylinders: 0:60
TracksperCylinder: 255
SectorsPerTrack: 63
BytePerSectors: 512
bufsize is 65536
500629504 bytes written bytes: 0
ReadFile(): ROM.nb1 -- Parametro non corretto
First signal of some error but someone tell that's ok!
And then I see prompt.
Now I find the file ROM.nb1 that is 477 MB (like the SD size after a FAT format).
It's ok? ... I don't think so .. but let's going on!
I open the file with an HEX Editor and the file seems ok but after a string like HTCE the file contains all 00h.
Can I cut off that part?
How can I ensure myself that's all ok?
Come on guru don't leave me with the bootloader splash screen instead of the MAGNETO one :lol: :lol: :lol:
Thanks to rhmartin's help (on buzzdev.net) I've reach this situation ..
I've got my dumped rom in SD and in a file.
But ...
I acquire more information about my Qtek 2020 (XDA2):
ROM: 1.66.04ITA
Radio: 1.10
ExtROM: 1.66.148
I think that's a WM2003 (not SE), isn't it?
In any case ... I put back my dumped roms in SD and followed the procedure for rom restore:
1 - Bootloader
2 - Put SD into device
3 - Wait for "Press Power Button"
4 - ecc. ecc.
But I never reached number 3, what's wrong?
I've put back the dump as a single file (as ntrw output give to me), it's correct or I must put it back (and so backup first in that way) as 3 separate files?
I've seen that in download area there's no WM2003 dumped rom, so I search by myself and I found RUU172128ITA (1.72 ITA) but I prefer if my backup can be useful for disaster recovery and can be used for my original version backup.
I think that you understand my situation .. I prefer ask before a not funny situation instead fill the forum with hundreds emergency posts.
I hope you think I've reason.
Thank you for the patience and sorry for possible misunderstandings or english syntax errors!
NO ONE CAN HELP ME ... INCREDIBLE!
I'm ready to ask sorry but ...
There's no one in this great forum that can help me ...
IT'S INCREDIBLE !!! :shock: :shock: :shock:
I don't think that no one haven't my problem ...
PLEASE SOMEONE HELP ME
:evil:
I have big problem!
I kill my TyTN,
I go to multi port...........
---------------------------------------------
USB>task 32
Level = 0
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 473
Storage Total block: 463
Total Bad Block in CE: 0
NeedToEraseBlockStart: 486
Storage format success
USB>lnb RUU_SIGNED.nbh
:F=RUU_SIGNED.nbh
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 501A0000 Length: 5544382
***************************************
****************************************
*******************************
****************************************
****************************************
****************************************
****LAST BLOCK, dwBytesCollected=0x10000
Code entry point at 0x556E0000
Write Nand Success
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 17
Can't find OS in flash!!!
Storage format success
USB>task 8
-----------------------------------------------------------
can you halp me? please!
ouch.... you tried to flash the entire nbh. This file contains os, extrom, radio and splash screens. You need to take that apart first with nbhextract to get os.nb then flash that instead. Hopefully you'll be able to....
I'd like to grab the Orange / T-Mobile splash screens to add to the ROM cooking customisation packs. I can see ow to flash a splash screen here but not how to dump one from a working 'Phone.
Any pointers?
Same is true of a Phone 'skin'. How do I dump that from a working phone?
If the splash screens you want are included on any shipped ROM, you just have to extract the Splash Screens from the NBH file, you can do that with NBHextract.
If you really want to dump them from the device, you can do it with 'rbmc' command:
- device has to be SuperCID (or use a SSPL/HardSPL)
- you have to authenticate to bootloader with the proper password
- After that, type
Code:
USB> task 32
USB> set 1e 1
USB> rbmc 500e0000 40000
USB> set 1e 1
USB> rbmc 50140000 40000
darrellr said:
Same is true of a Phone 'skin'. How do I dump that from a working phone?
Click to expand...
Click to collapse
This is the list of files for the phone skin, copy them from \windows and put them on a cab.
Code:
Bkgnd_Land.bmp Bkgnd_Port.bmp
brightbar_dn_l.bmp brightbar_dn_p.bmp
brightbar_l.bmp brightbar_p.bmp
brightbar_up_l.bmp brightbar_up_p.bmp
BtBtnDn_Land.BMP BtBtnDn_Port.BMP
BtBtnDs_Land.BMP BtBtnDs_Port.BMP
BtBtnUp_Land.BMP BtBtnUp_Port.BMP
EcBtnDn_Land.BMP EcBtnDn_Port.BMP
EcBtnDs_Land.bmp EcBtnUp_Land.BMP
EcBtnUp_Port.BMP EdBtnDn_Land.bmp
EdBtnDn_Port.bmp EdBtnDs_Land.bmp
EdBtnDs_Port.bmp EdBtnUp_Land.bmp
EdBtnUp_Port.bmp EsBtnDn_Land.bmp
EsBtnDn_Port.bmp EsBtnDs_Land.bmp
EsBtnDs_Port.bmp EsBtnUp_Land.bmp
EsBtnUp_Port.bmp IcBtnDn_Land.BMP
IcBtnDn_Port.BMP IcBtnDs_Land.BMP
IcBtnDs_Port.BMP IcBtnUp_Land.BMP
IcBtnUp_Port.BMP indialer_downdis_l.bmp
indialer_downdis_p.bmp indialer_downsel_l.bmp
indialer_downsel_p.bmp indialer_down_l.bmp
indialer_down_p.bmp indialer_lb.bmp
indialer_ls.bmp indialer_pb.bmp
indialer_ps.bmp indialer_updis_l.bmp
indialer_updis_p.bmp indialer_upsel_l.bmp
indialer_upsel_p.bmp indialer_up_l.bmp
indialer_up_p.bmp indialer_zoomsel_l.bmp
indialer_zoomsel_p.bmp indialer_zoom_l.bmp
indialer_zoom_p.bmp MaBtnDn_Land.BMP
MaBtnDn_Port.BMP MaBtnDs_Land.BMP
MaBtnDs_Port.BMP MaBtnUp_Land.BMP
MaBtnUp_Port.BMP MvBtnDn_Land.BMP
MvBtnDn_Port.BMP MvBtnDs_Land.BMP
MvBtnDs_Port.bmp MvBtnUp_Land.BMP
MvBtnUp_Port.BMP NmBtnDn_Land.bmp
NmBtnDn_Port.bmp NmBtnDs_Land.bmp
NmBtnDs_Port.bmp NmBtnUp_Land.bmp
NmBtnUp_Port.bmp predefined_image_female.bmp
predefined_image_male.bmp SbBtnDn_Land.BMP
SbBtnDn_Port.BMP SbBtnDs_Land.BMP
SbBtnDs_Port.BMP SbBtnUp_Land.BMP
SbBtnUp_Port.BMP SdBtnDn_Land.bmp
SdBtnDn_Port.BMP SdBtnDs_Land.BMP
SdBtnDs_Port.BMP SdBtnUp_Land.BMP
SdBtnUp_Port.BMP SfBtnDn_Land.BMP
SfBtnDn_Port.BMP SfBtnDs_Land.BMP
SfBtnDs_Port.BMP SfBtnUp_Land.BMP
SfBtnUp_Port.BMP ShBtnDn_Land.BMP
ShBtnDn_Port.BMP ShBtnDs_Land.BMP
ShBtnDs_Port.BMP ShBtnUp_Land.BMP
ShBtnUp_Port.BMP TkBtnDn_Land.bmp
TkBtnDn_Port.bmp TkBtnDs_Land.bmp
TkBtnDs_Port.bmp TkBtnUp_Land.bmp
TkBtnUp_Port.bmp UaBtnDn_Land.BMP
UaBtnDn_Port.BMP UaBtnDs_Land.bmp
UaBtnDs_Port.BMP UaBtnUp_Land.BMP
UaBtnUp_Port.BMP UvBtnDn_Land.bmp
UvBtnDn_Port.BMP UvBtnDs_Land.BMP
UvBtnDs_Port.bmp UvBtnUp_Land.BMP
UvBtnUp_Port.BMP VbBtnDn_Land.bmp
VbBtnDn_Port.bmp VbBtnDs_Land.bmp
VbBtnDs_Port.bmp VbBtnUp_Land.bmp
VbBtnUp_Port.bmp VCBtnDn_Land.BMP
VCBtnDn_Port.BMP VCBtnDs_Land.BMP
VCBtnDs_Port.BMP VCBtnUp_Land.bmp
VCBtnUp_Port.BMP VTBtnDn_Land.BMP
VTBtnDn_Port.BMP VTBtnDs_Land.BMP
VTBtnDs_Port.BMP VTBtnUp_Land.bmp
VTBtnUp_Port.BMP
Any one know command to mtty for atom exec\orsio n725 or RoverPC G5.
Phone connect to pc by rs-232, standart command not work
PS sorry for my english
Sorry, just want to understand further, why you using a serial cable (RS-232) to connect to your PC. is your phone hanged at bootloader mode?
Winterice said:
Any one know command to mtty for atom exec\orsio n725 or RoverPC G5.
Phone connect to pc by rs-232, standart command not work
PS sorry for my english
Click to expand...
Click to collapse
mtty is made for HTC devices. Atom is made by Quanta. I've been looking for the same tool myself. have you tried putty? If I'm not mistaken, you are trying to reformat the DOC? or upgrade the device thru mtty?
I have looked into the things we can upgrade from SDCARD flashing, and DOC.IMG is one of the option. I think this will change the format of DOC. One way to get a copy of this DOC.IMG is to dump the ROM thru SDCard using buzz romdumper64.
Please let me know of your developments.
Phone in bootloader, i am try dump rom. if plug phone with USB mtty doesn't see phone. if use command 'r' phone write message Format DOC.OK
Sorry for my English.
This experiments with the MTTY.
This experiments to copy ROM to the SD card or file.
I'm Running MTTY.
connecting PC and the Rover G5 (Atom Exec/Orsio N725), using a serial cable (RS-232).
Run bootloader mode.
On the PC screen :
-----------------
*******Beginning System Initialization*******
Run Mode = 104 MHz
Turbo Mode = Run Mode
MemClk = 104 MHz
Bus Mode = NORMAL
SDCLK[1] = MemClk (SDRAM Clk)
SDCLK[0] = MemClk/2 (Sync. FLASH Clk)
Mode = RUN
Boot FLASH in Asynchronous mode
******************************************************
OEMInitDebugSerial using STUART888
Microsoft Windows CE Ethernet Bootloader built Jun 13 2006 20:41:44
Copyright © 2006 Microsoft Corporation
Portions copyright © 2006 Intel Corporation
Original MSC0 12801282
New MSC0 12807FF2
New MDREFR = 0x11E018
New SXCNFG 40044004
Flash type L18
main:InitDisplay()
InitLCDCtrl..
ClearFrameBuffer..0xA6000480
+Check LCM ID:
==PreBL_Ver = 0.0.0
==2nd_BL_Ver = 0.0.0
Ethernet Boot Loader Configuration:
0) IP address: 0.0.0.0
1) Subnet mask: 0.0.0.0
2) # bootme's: 0
3) Boot delay: 0 seconds
4) DHCP: Disabled
5) Reset to factory default configuration
6) Launch existing flash resident image at startup
7) Program RAM image into FLASH (Disabled)
8 ) Program SMSC MAC address
9) Boot device order: SMSC -> PCMCIA S0 -> PCMCIA S1
D) Download image now
E) Erase flash image
L) Launch existing flash resident image now
U) Download os image now (USB1.1)
O) Overwrite eboot image now (USB1.1)
H) Jump to DM
I) Sim Lock
------------------
But ...
There are undocumented commands.
If press "R" - a message on the screen
Formating DOC.
OK
So there are undocumented commands
we are interesting other command
It would help us if we get hold of Service Manual.
Winterice said:
Phone in bootloader, i am try dump rom. if plug phone with USB mtty doesn't see phone. if use command 'r' phone write message Format DOC.OK
Click to expand...
Click to collapse
Have you tried buzz grab_it ROM dumper? it worked perfectly well with the Atom. It dumped everything to SD Card. You just have to break it apart and identify the sections.
For the Atom:
diskimg.nb0
eboot.nb0
dm.nb0
flash.img
agent.mot
mot.mot
cpld.img
assetinf.img
extended.img
MDOC.img
what particularly interest me is MDOC.img because I believe we can change DOC format with this.
our device have 192 mb rom, i or Alex_beda try this dumper today
This dumper not working.
Message in the screen "cannot create file!"
Using the miniSD 2 GB Kingmax
May be need to use mini SD less 1 GB?
Or using any other dumper?
alex_beda said:
This dumper not working.
Message in the screen "cannot create file!"
Using the miniSD 2 GB Kingmax
May be need to use mini SD less 1 GB?
Or using any other dumper?
Click to expand...
Click to collapse
you have to modify the name of SDCard. It is named "memory card" in your device. the program looks for "Storage Card". Search this value using registry editor.
"Folder"="\Storage\Card"
jiggs said:
you have to modify the name of SDCard. It is named "memory card" in your device. the program looks for "Storage Card". Search this value using registry editor.
"Folder"="\Storage\Card"
Click to expand...
Click to collapse
Thank you!
I'm downloading dump in the miniSD card.
But...
Problem.
Dump size 128 MB maximum
ROM size in my divice 192 MB.
How downloading full size (192 mb)?
alex_beda said:
Thank you!
I'm downloading dump in the miniSD card.
But...
Problem.
Dump size 128 MB maximum
ROM size in my divice 192 MB.
How downloading full size (192 mb)?
Click to expand...
Click to collapse
Your ROM chip size is 192MB. BUT I think, your ROM system size is only 64mb. Same as ATOM. The rest is only persistent storage, extended partition, and checksum partition.
to verify, you can pdocread the memory layout of your device. don't forget to install the RAPI before pdocread; otherwise, it will not work.
my ELF's mac address may be lost
every times, when my elf restart,
a document named HTCExcpthLog_mmdd_hhmmss.txt will be build in SDcard at \storage card\HtcLog\
mmdd_hhmmss is the restart time.
I would ask all active members to upload or share their collection of roms for Hurricane. I bricked my hurr 2 years from now and yesterday i got one so i would like to try as many roms as possible, and it will be great for all to share roms!!! I found several on this forum (lazaj's, saleng's, shadow's) but i think that there is more!!! So share your collection!!!
Here i found some on forum:
hurricane unlock, patch and upgrade wm 6.1(selang09) ***
Link: http://www.megaupload.com/?d=JLO5H1L7
Thread: http://forum.xda-developers.com/showthread.php?t=475286
Opinion: Good one, but chinese language everywhere! After u change main lang. still some apps name stay in chinese and options too!
wm6.1 for hurricane (with Bluetooth and INFRARED RAY problems solved)0415update!!!
Link: http://rapidshare.com/files/100934508/5x6_wm6.1_0319.rar
Thread: http://forum.xda-developers.com/showthread.php?t=378607
Opinion: Didn't tried!
WM 6 Graphite rom, how to get WMPlayer in English (now in Polish)
Link: http://rapidshare.com/files/108676266/wm6_2_2.zip
Thread: http://forum.xda-developers.com/archive/index.php/t-384972.html
Opinion: Using this one right now! Seems ok, works nice, nice look, except incoming calls didn't show up!!! Very bad bug!
Wm 6.1 Pl/eng
Link: http://rapidshare.com/files/131860280/wm_6_1_by_Lazaj007.zip
Thread: http://forum.xda-developers.com/showthread.php?t=410739
Opinion: Tried before Graphite eng edition, works great, looks great... Main lang polski, after lang change WMP stay in polski! But still ok!
WM6 for SPV C550
Link: http://rapidshare.com/files/56833250/566.zip
Thread: http://forum.xda-developers.com/showthread.php?t=330709
Opinion: Never tried!
And one pack with SPL 1.00.84 & soft spl (nb, nbf), IPL 1.00.15, GSM DATA (hex and dec), bootloader commands, splsplit... etc!
Link: http://rapidshare.com/files/427352270/data_hurricane.rar
Info: This last files can help u to unbrick your hurricane (BUT AVOID TO BRICK IT), i found it on pda2u.ru , and thanks them for that! Special thanks to member SAXON!
I found many links for ROMs but those which is here have alive links! Someone with good upload speed can reup them again in one pack and post a link here!
ENJOY!
I would like to have a non T-Mobile German version (can be a shipped ROM). Have not found any yet, only those that are available at www.shipped-roms.com Have to live with de-branding this as it seems.
Possibly someone with any of the following devices can do a "r2sd all" backup of the ROM?
imate SP4M
Orange C550
Qtek 8200 (the Russian/English is available as RUU)
Thanks for this link tobbbie !
Btw, in selang's rom SMS Send don't work! So, it is useless!!! :S
I have tested all ROM´s below for SDA II, but for me lazaj007 is the best of all
Thanks to lazaj007
Did anyone care to pick up some ROM cooking for that device? I did not succeed in getting the .BIN files manipulated correctly - and I think I have a collection of nearly all ROM tools now :-(
howto convert .bin to .nb0 and back
Foreword:
.BIN files are not all the same by their nature (of course not by content). There are
.bin that are used to identify the bare binary content of the various partitions (you mostly see those)
.bin that are used to flash a ROM to the device. This looks somehow historic though, the format is already described by itsme at: http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html. It seems to me that some non HTC devices are still using this format.
The osnbtool.exe (from Weisun at PDACLAN.COM) does not work for any purpose regarding .bin files
at least not for Hurricane.
- The -sp option cuts only the B000F\0a header but does not reconstruct the blocks of the .bin file.
Mind that small .bin files (smaller than 0x1c00000) are treated correctly as there is only one block.
- The -2bin option creates an incorrect .bin header (sets a weird total length) and sets totally confused
block-load addresses for the created blocks of 64k (0x10000) size. Check it with viewbin.exe if you like.
Reference for the filestructure by itsme:
http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html
The splitrom.pl (itsme romtools) seems not be able to read the content of any .bin file I have fed to it.
Neither for .BIN files created for Hurricane nor those for Typhoon, I always get:
cmd> splitrom.pl <binfile>
B000FF image: 82040000-84c40000, entrypoint: 00000000
!!! your rom is not known to me: md5: a520f0d1093b36f0a3cfd9323ea99155
this bootloader seems to be No bootloader present
no xipchain found
no bootloader found
no operator rom found
no bitmap found
I am rather sure it should handle everything correctly but I am too stupid to debug .pl :-(
So the only thing that works and will re-create a flash-able .BIN file from a .nb0 is listed below:
convert .bin to .nb0:
enter: viewbin -r <binfile>, you get something like:
Image Start = 0x82040000, length = 0x02C00000
Record [ 0] : Start = 0x82040000, Length = 0x01C00000, Chksum = 0x00000000
Record [ 1] : Start = 0x83C40000, Length = 0x01000000, Chksum = 0x00000000
Record [ 2] : Start = 0x00000000, Length = 0x00000000, Chksum = 0x00000000
Start address = 0x00000000
The above has two blocks of data and a termination block.
The checksum = 0 effectively disables upload checking (so potentially dangerous).
The size just fits the Hurricane's SPL "l" (load) command buffer, as you get when loading a ROM:
"clean up the image temp buffer at 0x8C080000 Length 0x01C40000 "
The blocks can be smaller than 0x1c40000 but not bigger obviously.
then convert to nb0, enter: cvrtbin.exe -r -a <imgstart> -l <length> -w 32 <binfile>
for above viewbin output: cvrtbin.exe -r -a 82040000 -l 2c00000 -w 32 <binfile>
mind to omit the 0x for the start and address, replace <binfile> with your filename, then you get a resulting file from <original-name.bin> to <original-name.nb0> which can further be decomposed and edited with standard ROM tools
convert .nb0 to .bin:
enter: xipbin.exe <input.nb0> <start-in-nb0> <output.bin> <loadaddress>
to get back something flashable like above: xipbin.exe <input.nb0> 0 <output.bin> 82040000
mind to omit the 0x for the loadaddress, replace <"file"> with your filenames
to recheck if the created BIN file is usable, startup the viewbin again
enter: viewbin -r <binfile> you now get something like:
Image Start = 0x82040000, length = 0x02C00000
Record [ 0] : Start = 0x82040000, Length = 0x00040000, Chksum = 0x0208CC79
...many entries deleted...
Record [175] : Start = 0x84C00000, Length = 0x00040000, Chksum = 0x0177FB3C
Record [176] : Start = 0x00000000, Length = 0x00000000, Chksum = 0x00000000
Start address = 0x00000000
Done.
Looks quite different - but this is ok! The loading process in MTTY indocates the loading of each above block with a sequence of |*, so with these many blocks the upload to the device is giving feedback and thus is not tempting people to interrupt it.
I have done my tests with the 566.zip linked in the first post of this thread, but this should work with any .BIN file from the other ROMs as well. So I will continue to see if I can recycle any of the WM6 Roms for inserting my imgfs created for Tornado. As before the imgfs still the XIP is loaded and I know too little about this yet (especially in connection to the imgfs and how close these two are linked) - I am prepared to see non booting device states quite a lot. Luckily there is nothing done to the early boot chain (IPL and SPL) so I can always get back to the bootloader and start over again.
I hope to get a first indication that imgfs is mounted correctly in the "old" XIP before I have to replace the OEMdriver parts in my Tornado ROM.
I just checked if I can still use this flash-method for the Tornado - and it works as well. So the created "os-new.nb" in the OUT directory can be converted to .BIN and then flashed inside MTTY with the "l" command. Not that I like this method - but it works as well.
Tobbbie, you have here a very good research! To bad this device is out of use!