Hermes page pool tests - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

What is the Page Pool?
Quoting mamaich:
The large the paging pool is, the more code pages can present in RAM simultaneously -> the less loads from slow ROM -> the faster the device is.
Quoting Mike Calligaro from Windows Mobile Team Blog:
In general terms, there are a number RAM uses that aren't reported in the Memory CPL.
For instance, an OEM might set aside a fair amount of RAM to allow the camera to write directly into it without using the CPU (a DMA buffer). Typically the way they do that is to tell the system there is less than the available RAM and then use the RAM the system doesn't know about.
Another example is something called the "page pool." This is similar to the "page file" on a desktop system, and is heavilly used on NAND systems. The page pool isn't something a user can configure, so there's not much point in showing it in the Memory CPL.
Code that can't be shut down or paged out, especially drivers, isn't shown on that Memory CPL either. There's no reason to show you the RAM the display driver is using, because you can't do anything about it.
Applications use RAM in two ways. There is code that runs, and there is data that is created while it is running. On a NOR device, the code can run directly from the ROM and not be loaded into RAM first. This process is called XIP (eXecute In Place). NAND devices can't XIP, so their code is loaded into RAM and executed from there. If you don't have a Page Pool, this code is loaded into normal RAM. The Page Pool is a mechanism to limit how much code is loaded into normal RAM. With a Page Pool, we can unload code that hasn't been used in a while and reload it later if we need to. We can't do that without a Page Pool.
More information:
http://forum.xda-developers.com/showthread.php?t=276630
http://blogs.msdn.com/windowsmobile/archive/2005/11/17/494177.aspx
http://blogs.msdn.com/windowsmobile/archive/2005/08/19/453784.aspx
How to find the page pool offset on Hermes ROMs?
Take the Hex editor of your choice (I use radare) and open OS.nb.
Search the ASCI string "NKKD8", you'll find it two times, take the one more near to the end of the file.
Scroll down a bit until you find the HEXA string "64 00 00 00", page pool should be around there.
If anyone knows a better method please explain
Example using OS.nb from WM6 ROM for hermes
We find the second "NKKD8" at offset 0x3B6C90:
Code:
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
----------------+----------------------------------------+----------------.
00000000003B6C90 4E4B 4B44 3800 0000 0000 0005 0000 0000 |NKKD8...........|
00000000003B6CA0 00C8 FFFF 8039 2D80 4060 2880 B069 2880 |[email protected]`(..i(.|
00000000003B6CB0 B869 2880 AC69 2880 144A 0180 805D 2D80 |.i(..i(..J...]-.|
00000000003B6CC0 602A 2D80 1829 0080 0000 0000 0000 0000 |`*-..)..........|
Further down we can find this:
Code:
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
----------------+----------------------------------------+----------------.
00000000003B6F40 581D 0480 C41C 0480 BC1C 0480 00B0 0400 |X...............|
00000000003B6F50 FFFF FFFF FFFF FFFF 9B4F FFFF 64B0 0000 |.........O..d...|
[COLOR="Sienna"]00000000003B6F60 6400 0000 A85B 0480 0000 [b]6000[/b] 0000 0000 |d....[....`.....|[/COLOR]
00000000003B6F70 38E8 0180 C43C 0280 DC6B 0180 00B0 0380 |8....<...k......|
00000000003B6F80 882D 0280 FC2C 0280 D488 0480 5489 0480 |.-...,......T...|
So, we can see the page pool is at offset 0x3B6F6B and is set to 6 Mb.
The pagepool value is specified in HEXA, so for example:
Change "6000" to "4000" for a 4Mb paging pool
Change "6000" to "8000" for a 8Mb paging pool
Change "6000" to "C000" for a 12Mb paging pool
Change "6000" to "F000" for a 16Mb paging pool
Finding the best page pool size
The page pool size is a compromise between memory available to programs and speed. On WM6 ROM:
With 4Mb page pool we get a Total Program Memory available of 50.68 Mb, and SPB Benchmark index 347.88.
With 6Mb page pool we get a Total Program Memory available of 48.68 Mb, and SPB Benchmark index 346.03.
With 8Mb page pool we get a Total Program Memory available of 46.67 Mb, and SPB Benchmark index 345.95.
With 12Mb page pool we get a Total Program Memory available of 42.66 Mb, and SPB Benchmark index 348.53.
With 16Mb page pool we get a Total Program Memory available of 39.64 Mb, and SPB Benchmark index 351.26.
I attach the SPB benchmark results, so anyone can take its conclusions

Does it works for WM5 too ?

yes, it's exactly the same in wm5

Suprising results. Smallest and largest pool size were the fastest. It was obviously an increase as the size increased.
No point IMO changing it to anything other than 16mb or 4mb. Its stange how the least amount of memory allows for the second fastest speed.

When I run some programs then after I have killed the running program some other programs fail to start till I do a soft reset. One example is Opera 8.60. after running and killing Opera 8.60 I cannot start Netfront 3.3 and Softmaker's Planmaker.
I don't know if this is even relevant but Just wanted to know if I experiment with different page pool sizes do you think my problem can be solved.?
Thanks and Regards

this is great n all but just curious on how you would know that that is the exact thing that you need to change. theres books on this kinda stuff.. ?!?!
-ps thanx for da info

pof said:
yes, it's exactly the same in wm5
Click to expand...
Click to collapse
on AKU 3.3 I had lot's of out of driver memory errors with the widcomm BT drivers. So I guess it may have a smaller page pool then the WM6 os has.
Too bad I can't bench the BT performance. But maybe I will try a bigger pagepool when the new WM6 rom comes out, see if it feels more responsive and faster then.
Thanx for this great info!

but hermes have 64M rams, where are other rams

pof said:
yes, it's exactly the same in wm5
Click to expand...
Click to collapse
Tried it on the new 2.11 (AKU3.3) rom.
And it works mutch better now when using the widcomm stack and browsing the net.
Although I'm not sure what speeds it up, could be the pagepool or this rom, but it works great, mutch faster then the WM6 roms.

we can use pocket machanic to change the 3 cache settings
dont forget you have auto mode as well, i wonder how will that check out

qooqoo said:
but hermes have 64M rams, where are other rams
Click to expand...
Click to collapse
other rams maybe to Extended_ROM??
how to change Extended_ROM size????

philpwong said:
other rams maybe to Extended_ROM??
how to change Extended_ROM size????
Click to expand...
Click to collapse
no, Extended_ROM is part of NAND flash, it's different from RAM.

qooqoo said:
but hermes have 64M rams, where are other rams
Click to expand...
Click to collapse
Just think about the PC's windows OS, something like that

clfk said:
Just think about the PC's windows OS, something like that
Click to expand...
Click to collapse
but i don't think so.
hard disk and flash memory are use 1k=1000b instead of 1024b, but ram don't like that. 64M of RAM do = 64 * 1024 *1024 b.

My x01ht is
qooqoo said:
but i don't think so.
hard disk and flash memory are use 1k=1000b instead of 1024b, but ram don't like that. 64M of RAM do = 64 * 1024 *1024 b.
Click to expand...
Click to collapse
My x01ht is
ExtROM=10M+Pagepool=6M+Program Memory=48M

page pool
Hello i have try a benchmark with VsBenchmark 2006 on my Hermes tytn herm 200 and wm6 LVSW 3.24.0.4 radio 1.40 + 4mo page pool.
(original is 6mo)
the result score bench is 982
test 1:950
test 2:900
test 3:1263
test 4:654
test 5:1146

dluisao said:
Hello i have try a benchmark with VsBenchmark 2006 on my Hermes tytn herm 200 and wm6 LVSW 3.24.0.4 radio 1.40 + 4mo page pool.
(original is 6mo)
the result score bench is 982
test 1:950
test 2:900
test 3:1263
test 4:654
test 5:1146
Click to expand...
Click to collapse
I am writing because I have been trying to change the pagepool of LVSW 08-04 to 4mb but I can´t locate the offset location on this ROM when searching with my HEX editor. I followed the instructions posted in this forum but.... Any help would be fantastic. Thanks!
update.... sorted!!!

christonge said:
I am writing because I have been trying to change the pagepool of LVSW 08-04 to 4mb but I can´t locate the offset location on this ROM when searching with my HEX editor. I followed the instructions posted in this forum but.... Any help would be fantastic. Thanks!
update.... sorted!!!
Click to expand...
Click to collapse
you must find the string in ascy NKKD8 at the rom in NB format and don't in NBH format.
convert your rom NBH in NB format and use ultraedit for find this string NKKD8 or in ultraedit(editor hexa) go to
at 00000000003B6C90 line the NKKD8 is there and at the line 00000000003B6F60 you must change 6000 to 4000.
(00000000003B6F60 6400 0000 A85B 0480 0000 6000 0000 0000)
4000
and at finish reconvert the NB rom to NBH with the 4000 modified.

it seems that new wm6 rom for hermes,
Build: 17741.0.2.1
AKU: 0.2.1
CE: 5.2.1236
offset is different from other roms.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
how can i change new rom's pagepool,plz?
thanks in advance

@qooqoo: read the first post again, follow the three easy steps under "How to find the page pool offset on Hermes ROMs?".

Related

New IMate Bootloader version

ok, Been struggeling for 2 days getting my new Imate back to life after it started showing the "Serial" death screen trying to upgrade it to O2 new rom.
I tried everything using the USB cradle and also using the SD way and my other good Imate...... As soon as I insert the SD in the dead Imate after packing it with the ROM from the good one it tells me "section=1 not allowed!" were as it is mentioned here in the forum it shold tell me "press power to upgrade".
I noticed that this new one has a bootloader ver 1.06 which is not refered to anywhere in this forum.
Any ideas?
sd cards usually only work for the same bootloader.
the trick is to put a 1.06 header on your sd card.
what you can do is this:
- first using your 1.06 bootloader create an sdcard with your bootloader,
by connecting your xda to a terminal program ( either via USB, or seiral )
then type 'd2s 80000000 40000'
this will write your bootloader to SD.
- then make a raw image copy of this sd card, using psdread
* insert the sdcard in a working xda2, put it in it's cradle, and type:
psdread -3 0 0x40400 bl106.img
- then create an sd image of the correct rom, in your working xda2.
from this image, replace the header part of the first sector of the
sdcard with the header from the bl106.img.
the header is the first 0x180 bytes.
psdread -3 0 0x200 os-header.img
* use hexeditor to replace the first 0x180 bytes of this file.
and write it back:
psdwrite -3 os-header.img.
then your sd card should work with the new bootloader.
btw, I am very interested in a copy of this bootloader. can you send me the bl106.img file?
Thank You
itsyou,
I Thank you tons for replying back... will give it a shot and will let you know the outcome.
As for the Bootloader Copy, I only have 2 SDs 512 & 256. I have no problems with bandwidth let me know where to dump it for you and I will do it promptly.
:wink:
now that I looked again at ur expalnation I find it very difficult for me to do.
Wouldnt it be easier to just flash my good XDA with the new bootloader then do a full sd image from that one and run it into the bad one? if this would work then fine if not pls find below some questions:
- first using your 1.06 bootloader create an sdcard with your bootloader,
by connecting your XDA to a terminal program ( either via USB, or seiral )
then type 'd2s 80000000 40000'
this will write your bootloader to SD.
DONE
- then make a raw image copy of this sd card
How
using psdread
* insert the sdcard in a working xda2, put it in it's cradle, and type:
psdread -3 0 0x40400 bl106.img
where to type that? in cmd prompt? if so; I did that, windows gave me an error related to a 16bit application encountered error (am using XP)? while Active sync is on? in mtty? Is this the SD card the one i did above or a formated one
- then create an sd image of the correct rom, in your working xda2.
from this image, replace the header part of the first sector of the
sdcard with the header from the bl106.img.
the header is the first 0x180 bytes.
psdread -3 0 0x200 os-header.img
Not clear
* use hexeditor to replace the first 0x180 bytes of this file.
and write it back:
psdwrite -3 os-header.img.
psdwrite ... is that a hex editor I can find somewhere
where to type that? in cmd prompt? if so; I did that, windows gave me an error related to a 16bit application encountered error (am using XP)? while Active sync is on? in mtty? Is this the SD card the one i did above or a formated one
psdread is a desk top windows command line tool, found in this archive.
you already know how to make an sdcard with os image. - type 'd2s' to your bootloader.
from this sd card you copy only the first sector with
Code:
psdread -3 0 0x200 sd-sector.img
then replace the header in this file.
this is an example of what the first 512 bytes look like:
first the part that needs to be replaced:
Code:
0000000: 4849 4d41 4c41 5941 5320 2020 2020 2020 HIMALAYAS
0000010: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
0000020: f622 919d e18b 1fda b0ca 9902 b972 9d49 ."...........r.I
0000030: 2c80 7ec5 99d5 e980 b2ea c9cc 53bf 67d6 ,.~.........S.g.
0000040: bf14 d67e 2ddc 8e66 83ef 5749 61ff 698f ...~-..f..WIa.i.
0000050: 61cd d11e 9d9c 1672 72e6 1df0 844f 4a77 a......rr....OJw
0000060: 02d7 e839 2c53 cbc9 121e 3374 9e0c f4d5 ...9,S....3t....
0000070: d49f d4a4 597e 35cf 3222 f4cc cfd3 902d ....Y~5.2".....-
0000080: 5341 3030 e1dc d6ae 8390 49f1 f1ff e9eb SA00......I.....
0000090: b3a6 db1e 870c 3edd 24eb 0d1c 06b7 47de ......>.$.....G.
00000a0: 8412 4dc8 43c3 cba6 1f03 5a7d 0938 251f ..M.C.....Z}.8%.
00000b0: 5d9f d4fc 96f5 453b 130d 890a 1cd3 902d ].....E;.......-
00000c0: 489a 50ee 4078 36fd 1249 32f6 9e81 49dc [email protected]
00000d0: ad4f 14f2 4440 66d0 6bc4 30b7 bec6 ff42 [email protected]
00000e0: 5455 9a6a 2215 d1e1 9038 3238 d93f 7c66 TU.j"....828.?|f
00000f0: 5e03 d8c0 9c91 d971 9f69 a5e2 0c99 9247 ^......q.i.....G
0000100: fa16 bb11 adae 2488 79fe 52db 2543 e53c ......$.y.R.%C.<
0000110: 1870 92da 6454 ceb1 853e 6915 f846 6a04 .p..dT...>i..Fj.
0000120: 9673 0ed9 162f 6768 d4f7 4a4a d057 6876 .s.../gh..JJ.Whv
0000130: fa16 bb11 adae 2488 79fe 52db 2543 e53c ......$.y.R.%C.<
0000140: f445 d3d8 28ce 0bf5 c560 593d 9727 8a59 .E..(....`Y=.'.Y
0000150: 762d d0c2 c9cd 68d4 496a 7925 0861 4014 v-....h.Ijy%[email protected]
0000160: b13b 6aa5 1128 c18c d6a9 0b87 978c 2ff1 .;j..(......../.
0000170: 151d 9a95 c19b e1c0 7ee9 a89a a786 c2b5 ........~.......
this part you need to keep.
Code:
0000180: 4854 4353 3830 3034 3030 3030 3031 4538 HTCS8004000001E8
0000190: 3030 3030 4238 3042 4546 4246 fe03 00ea 0000B80BEFBF....
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001d0: 0000 0000 0000 0000 0000 0000 4543 4543 ............ECEC
00001e0: 04c9 0d80 0000 0000 0000 0000 0000 0000 ................
00001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
use any hexeditor you like.
most will allow you to cut/past from one file to the other.
make very sure that at offset 0000180 it says something that starts with 'HTCS80040000'
otherwise you may accidentally overwrite your bootloader, and permanently damage your device.
after you have modified the sd-sector.img file, write it back to the sdcard
containing your os image with
Code:
psdwrite -3 sd-sector.img
.
both psdread and psdwrite can be found in the itsutils.zip archive, and are descibed here and here
itsme,
followed ur kind instructions to the letter and all went smooth with no errors what so ever till I started to write back the image to the bad XDA and it gave me the freaken same error (find below)
SD Download
===========
Section=1
Not allow
update!
I started loosing hope in this thing.
I am attaching here the bl106.img file as per ur request hope it helps you and anyone else in the future (is that what u want, if not let me know what exactly u need before i send this bad one to the shop for fixing)
Best regards.
Note: i noticed in the step where am supposed to replace the first 0x180 bytes that both headers form both images ar the same...I think...maybe am wrong thus i still replaced them as per ur instructions.
(my good xda has ver. 1.02 bootloader)
this is a bootloader v1.02 you uploaded here.
I assure you that this file was dumped from an xda2 which says ver. 1.06.
Although I already sent the Device for fixing I still have a whole flash dump to the deffective device on my HD. gemme an address where I can upload it to and I will do promptly.
Thanks again for all the help you gave me.
ftp.xda-developers.com
user xda
pass xda
file (raw image) of defective device being uploaded :wink:
Am supposed to get a replacement for this device in a week time. will post u a note case it has a 1.06 ver again.
just out of curiosity
who in Egypt jandles service of the XDA II ??
just in case!!
No one :?
I have been relaying on Dubai for that matter.
I did find the 1.06 bootloader in the 1.66.167 upgrade.
OH MAN! are you telling, had I waited one more day b4 sending it to Dubai I could have used this upgrade to do the trick?
How about in the one I uploaded, which version was embeded in the raw image?
still only the 1.02 version.
I don't think the 1.06 bootloader would have helped.
itsme,
Looking at the bright side of things, I now should not regret sending the busted xdaII back for exchange then.
Thank you very much for all the help you gave me. it only shows what a gr8 community this is.
PowerLOC Destinator problem with XDA II new ROM:
Hi,
Destinator problem with XDA II ROM:
ROM-1604eng
ROM-16036wwe
ROM-v16050
ROM -16021wwe
ROM-16052ger
All these ROM versions has the same problem, The PowerLOC Destinator can not find com 5, if I use the Pocket Blue Tools patch the freeze in com 7.
The only way I find to use the PowerLOC Destinator in the XDA II is with the Rom version 1.03.00 wwe_o2 asia together with the Pocket Blue Tools.
Somebody suceed using the PowerLOC Destinator with new Rom?
Best,
Dias
My Destinator works fine with bluetooth patch and 1.66.00WWE ROM. Don't know what your problem could be, other than not doing things in the finicky order the XDA II requires with BLuetooth.
I saw this note in Default_Driver.CAB of the 1.66.131 extrom.
; Change DUN port from COM5 to BSP4.
[HKEY_LOCAL_MACHINE\ExtModems\bluetooth_dun]
"port"="BSP4:"
maybe it is related?

HTC Hermes WWE AKU3.3 Test ROM 2.05.255.1 radio 1.34.00.10_108

What is this file ???
Is it aku 3.3 in english or russian????
-----------------------
MODERATOR EDIT:
Changed the subject, use this as the main thread to discuss HTC 2.05 WWE AKU 3.3 ROM issues.
Download and ROM details in the wiki:
http://wiki.xda-developers.com/index.php?pagename=Hermes_Upgrades
BE SURE TO READ THE WIKI BEFORE ASKING QUESTIONS PLEASE
English.
If you need Russian one look for it in Upload/Temp directory
It is in English, I just flashed it using 1.10mfg method
An still no MUI I presume ?
What Where Who Its New The Wwe Version?
Plz Give The Link And Why Dont You Say Anything?
bubu23 said:
What Where Who Its New The Wwe Version?
Plz Give The Link And Why Dont You Say Anything?
Click to expand...
Click to collapse
ftp://ftp.xda-developers.com/Uploads/Hermes/
Here you have.
BuT WhY TyPinG LikE ThAt ! Are YoU PaRkInsOn ?
Is it from HTC or cingular? I've heard both are about to release an AKU 3.3 rom
loll no im not parkinston maybe my keboard is
but why the file finish with test?
its not good its just test???
plz tell me im horny on that fileee(rom)
English confirmed.
Just flushed OS and Ext rom.
ROM Version:2.05.255.1
ROM Date: 01/17/07
ExtROM Version: 2.05.255.101
OS 5.1.461 (build 15671.3.3.0)
I can't get to FTP :/ what user and password ?
reg
Sar
Username = xda
Password = xda
You get to the ftp by this link no pass needed...
ftp://xda:[email protected]/Hermes/
Cheers
Seems very fast...
cant see where it says TEST though. My of been a test for the carriers, so likely the RTM for the carriers to then implement.
So far, so good... at least this one is english, unlike the Swedish update i did yesterday
in the ftp thers only the swedish rom i cant find the wwe rom??
RUU_Hermes_2.05.263.1_6275_1.34.00.10_108_SVE_HTCEUR.exe is now up... Guessing it is an official release from htc?
Cheers
Well i flashed it also.
the Test is included in the splash.bmp. =)
really... But imho the swedish one is a bit faster, but that is just subjectiv i didnt tried to test it with a benchmark program.
btw. any update from cingular?
Somethings fishy about this.
This is supposed to be AKU 3.3, but theres no WPA2 support???
not sure this is a complete ROM?
Does this mean MS Voice Command over bluetooth is fixed without the hacks?
I have detect problems with this rom! Is better wait for another!
Problems detect:
- No wpa2
- Phone connection always breaking down
- Can't go to my contacts!
- ActiveSync always says pocket is out of memory (yes I reset several times)
Flash Using Lnb
This is my first time flashing using lnb and i followed the wiki about using mtty..i just wanted an experimented persons to examine the output of mtty and tell me if the update was perfectly done and if there was no problems in nand please...
Thanks
Iverson....
USB>
USB>task 32
Level = 0
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 461
Storage Total block: 475
Total Bad Block in CE: 0
NeedToEraseBlockStart: 474
Storage format success
USB>lnb 06_OS.nb
:F=06_OS.nb
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 501A0000 Length: 3C0C800
*********************************************
*********************************************
*********************************************
*********************************************
*********************************************
*********LAST BLOCK, dwBytesCollected=0x13800
Code entry point at 0x53DA0000
Write Nand Success
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 473
Storage Total block: 463
Total Bad Block in CE: 0
NeedToEraseBlockStart: 486
Storage format success
USB>

Dead wlan due to erased eeprom? *SOLVED*

Needed tools:
PuTTY ver.6 or above
Plink
Active Sync 4.5
any Hex editor
MTTY1.exe ver 1.11a
Windows PC
SPL 2.30 Olipro
SPL 1.01 MFG pack
SPL 1.10 Oli w/custom RUU
SPL 1.04 w/custom RUU
DUTTY'S Good .NB Tool
Win Rar
Hermes with working wlan
There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.
Steps for Working Wlan Device:
You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)
then use DUTTY'S Good .NB Tool...
http://forum.xda-developers.com/showthread.php?t=296311
...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)
Download PuTTY and Plink and copy them into your C:\Windows\Temp folder
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
Put your device in bootloader mode and disable USB connections in Active Sync
Connect to the PC and open PuTTY
Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...
http://forum.xda-developers.com/download.php?id=9864
... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.
Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.
Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.
Go to START/RUN/CMD
This opens a DOS window. Change directories to C:\Temp and type the following:
plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)
Now type the following and hit ENTER (once) after each command:
task 32
password 0000000000000000 (that's 16 zeros)
set 1e 1
rbmc me.txt 500a0000 40000
that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.
When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.
Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:
In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".
You now have the eeprom flash file to be transfered to the non working device...
Steps for Non-working Wlan Device:
Using the methods on MrVanx's downgrading SPL page...
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG
Read the full instructions before flashing.
Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.
Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt
Now type the following:
task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000
Hitting ENTER after each command.
When it's done, close MTTY and reboot your device and verify that your Wlan is now working...
Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)
BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:
plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800
watch your file grow to 128 MB.
If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...
Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.
Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.
*NOTE* Olipro just posted later in this thread
"just to point out guys;
to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"
another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...
Member alakentu has translated this method into Spanish. The thread is here:
http://forum.xda-developers.com/showthread.php?t=364751
***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***
For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.
cool !! I try this if i found a phone with no dead wlan
nice.........
It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.
Would it be possible for someone to extract the eeprom file from a working wlan device, "zero-out" the MAC address portion, or replace with 'FF' or some other 'dummy' value, and post this here, so those of us without access to a working device can use to flash our damaged devices?
By "blanking-out" the MAC address in the attached file, you dont risk having your MAC address used by everybody, so there is no "legal" risk, and help us without a working device to fix ours...
Thanks for the solution guys and hopefully you can post the file here for us to use.
Good work !!
Thank you very much for this solution !!!! Great job!
But as said chrisvor, could you post an extract of a working Eeprom for thoose who don't have one please...
Thank you !
drummer,
first of all is to say thanks to you all who put in their time and effort in resolving this problem
so my question is... can you post the file of working wlan bit for us, without that i can't solve this problem... =(
Thanks!!!
Thank you so much for this!!!!
I will try to reviving my X01HT WiFi later!
Great Job!!!!
Someone has repaired his hermes ??
nicoebra said:
Someone has repaired his hermes ??
Click to expand...
Click to collapse
I did. And so did Laikos. Actually, he fixed his about 20 minutes before I did, he is a better editor than I am. Why do you think we did the research? We both had devices with non-working wlans, and now they're working again.
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.
laikos said:
It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.
Click to expand...
Click to collapse
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...
pop20032004 said:
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...
Click to expand...
Click to collapse
How did you come to that conclusion?
All Laikos was suggesting, is you could type in the data, rather than replace the data by "cloning" it from another's device. Once you know the offsets, which you do if you read this technique, it's quite easy, although time consuming. So far, each file we have examined have had the identical wlan signatures, and identical first three numbers of the MAC address. That suggests that HTC was assigned a set of MAC addresses by OUI for their use.
BTW, using SPL 2.30 oli, you can change your backup CID, and model number (Hermes 100, 200, 300, or whatever you want to change it to like "Hermes 911").
Help
I believe that would be better than someone give the instructions detailed for those that they do not have other device to the hand to extract the EEPROM, extract your corrupt EEPROM and edit it.
In my case, live in Mexico city and these devices are extremely rare of seeing by here.
As soon as if someone can help me to obtain the file of a EEPROM will be I thanked what is.
Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
i can't edit file " herm1.nb"
you can guide again or help me to edit my file.
Hello,
Is it normal that my file herm1.nb is rained large that 30Mo at the time of that creation, thank you.
-------------
Edit:I excuse myself I have to make an error the first handling, I succeeded in having the file herm1.nb has 256 Ko (262 ' 439 bytes).
If I do not modify the mac address that you it will occur on the other apparatus, thank you
drummer10630 said:
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.
Click to expand...
Click to collapse
@drummer10630: I do appreciate all your and Laikos efforts to solve this problem and to let the whole community know the method so everybody can fix their devices... however, the reason I asked if anybody could post the file was not a sign of "laziness", rather it is due to the lack of friends who have a TyTN or who want to void their warranty by flashing a non-official bootloader in order to "do me the favor" of extracting their eeprom data.
If any of you guys have extracted the eeprom and you have edited it to include your MAC address, could you please edit a COPY of this file, put "FF" in all the bytes of the MAC address (which is the only thing that "ties" this file to your purchased device and hence yourself), and post it here for us "tytn-friend-less" people to use?
Many thanks for EVERYBODY's efforts in solving this
Thanks and kudos go to Pof and Oli ofcourse, due to whom none of this would be ever possible !!
Chris
I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?
jrp said:
I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?
Click to expand...
Click to collapse
According to the #1 post, you HAVE TO follow the instructions, i.e. downgrading to SPL 1.04, 1.01 MFG, Olipro 2.30, in order to save the eprom from the working device.... no shortcut I'm afraid
I removed the lines 00000000-00000140
But I do not have information with the line 0001F850 and 0001F860 is this normal? , thank you.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Quick question.... Could I dump the WLAN eeprom from a Wizard? Dont think so, but I thought I'd ask since I have a wizard lying around too....

UPX exe and dll files to speed up your TG01

Its been very quiet in these forums recently, probably because everyone has bought a Galaxy S2 or a HTC Sensation!
I recently came across UPX, this is a compression utility that can shrink exe and dll files quite dramatically, saving space and increasing application launch speed quite dramatically.
I am currently using Mirom8 and even though this Sense 2021 rom is protected have decided to list exe and dll files that can (I think) be UPXed for speed
Here is a list of exe and dlls from the \windows folder and their UPXed size:
AdjustMotionSensor.exe 109k
AdobeReaderLE.exe 1050k
AlarmPopUp.exe 105k
AlbumSearcher.exe 135k
AudioBooster.exe 87k
AudioManager_Eng.exe 76k
BackupRestoreUI.exe 220k
Camera.exe 161k (nice increase in launch speed here)
CommManager.exe 152k
ConnectionSetup.exe 112k
ConnectionSetupAuto.exe 115k
ContactEditor.exe 66k
EmailSetupWizard.exe 97k
Facebook.exe 206k
HTCAlbum.exe 400k
HTCAppointment.exe 105k
HTCBookmark.exe 123k
HTCDRMEngine.exe 949k
HTCMsgEnhance.exe 110k
HTCPhotoPicker.exe 358k
OneNoteMobile.exe 268k
PPCPimBackup.exe 147k
PPT.EXE 687k
PushClient.exe 137k
PWORD.EXE 128k
PXL.EXE 291k
RSSHub.exe 266k
ServiceMode.exe 160k
SettingImprovement.exe 90k
SIM_MGR.EXE 82k
SimLockP.exe 49k
SimMgr.exe 117k
SPMC.EXE 117k
StreamingPlayer.exe 165k
Uploader.exe 97k
WiFiNetwork.exe 67k
wma9prodecoder.dll 236k
wmv9decoder.dll 258k
WMVDMOE.DLL 238k
YouTube.exe 145k
And other useful savings
Opera 10, 2 largest files can be UPXed, flashlite, the large dll can be UPXed
S2U2, all exe's can be UPXed, makes the unlock screen quite smooth to use
Its not worth UPXing files less that 200k although it might help a slow launching app around the 150k size, and normally its not worth UPXing files that stay resident in ram all the time, as it can use quite a lot more ram than normal, but if you launch apps a lot, then it can really make a difference to the speed of opening your favourite applications. Apps that use .net cannot be UPXed either, so that is a limiation otherwise more files could be UPXed.
Very good work!!! Have you send me all the files? I will over weekend swap the files and re cook mirom8.
mirolg said:
Very good work!!! Have you send me all the files? I will over weekend swap the files and re cook mirom8.
Click to expand...
Click to collapse
Hi Miro
I will send you a rar file again via email today at some point.
This can be done to other rom releases too you know, i am unsure of total rom savings space wise, possibly 20MB-30MB, not huge but we are talking a whole 20MB plus of internal storage free for something else.
Also it would be useful to know whereelse in the rom there are exe files i can try to upx, must be other places.
(InsertNameHere) said:
Its been very quiet in these forums recently, probably because everyone has bought a Galaxy S2 or a HTC Sensation!
Click to expand...
Click to collapse
Yes, it seems that only few person are on the forum. Maybe drupad will show up after return from vacation. It is over
Regards
fxdjacentyfxd
(InsertNameHere) said:
Hi Miro
I will send you a rar file again via email today at some point.
This can be done to other rom releases too you know, i am unsure of total rom savings space wise, possibly 20MB-30MB, not huge but we are talking a whole 20MB plus of internal storage free for something else.
Also it would be useful to know whereelse in the rom there are exe files i can try to upx, must be other places.
Click to expand...
Click to collapse
miROM1 and miROM8 are good ROMs and if we can save 20 - 30 MB Storage, then will be much better! i try it and give you a feedback!
good work, tnx
mirolg said:
miROM1 and miROM8 are good ROMs and if we can save 20 - 30 MB Storage, then will be much better! i try it and give you a feedback!
good work, tnx
Click to expand...
Click to collapse
How about coking this with latest manila u had in mind??
thanks for this!!!
nikola92 said:
How about coking this with latest manila u had in mind??
Click to expand...
Click to collapse
Miro is working on it for us
hi, a short statement:
my sense 2021 package i have compressed with cfc.method the result is sense and sense tabs starts quicker and works really faster. ok. miROM1 and mirom8 are in the lastest relases also fast, but all starts 0,5 sec. quicker. UPX method compress the exe + dll files and the result is from app to app different- but i mean the most works better and we save few MB storage. miROM8 has now 270 MB and miROM1 has 256 MB free Storage.
Both ROMs are with all fixes and updates incl. cam-button and toshiba power + wifi settings.
I would test it and will upload it next days
cheers, miRO
mirolg said:
hi, a short statement:
my sense 2021 package i have compressed with cfc.method the result is sense and sense tabs starts quicker and works really faster. ok. miROM1 and mirom8 are in the lastest relases also fast, but all starts 0,5 sec. quicker. UPX method compress the exe + dll files and the result is from app to app different- but i mean the most works better and we save few MB storage. miROM8 has now 270 MB and miROM1 has 256 MB free Storage.
Both ROMs are with all fixes and updates incl. cam-button and toshiba power + wifi settings.
I would test it and will upload it next days
cheers, miRO
Click to expand...
Click to collapse
Good news and sounds quite exciting, i am glad you found a way to get CFC working with 2021, i had read it was somewhat more difficult than previous versions like 2012, and UPX saves some space, thats good too.
270MB user storage is incredible i would say!
Great job!
Which version of UPX did you use ?
can i have a link ?
lesscro said:
Which version of UPX did you use ?
can i have a link ?
Click to expand...
Click to collapse
Any version above 3.03 supplied with this batch utility works fine, but i used the latest version 3.07
Best to do all compression on your pc rather than use a PPC version, it can take quite a long time to compress a large exe file.
thx for all... i will test myself on my TG !
Actually i tried this files to perform a speed test :
Code:
Explorer.exe 268 288 2010-09-07 20:46 -a---
GoogleMaps.exe 2 354 176 2010-06-25 19:47 -a---
iGo.exe 8 613 376 2011-05-08 09:07 -a---
iManager.exe 356 352 2011-02-21 17:00 -a---
InfoTrafic Trains.exe 319 488 2010-03-17 23:28 -a---
Opera10-armv4i.exe 623 400 2010-03-15 20:48 -a---
PhotoManPro.exe 1 108 480 2010-04-26 16:29 -a---
player.exe 1 894 672 2009-09-17 11:14 -a---
RCapture.exe 90 112 2010-04-26 16:28 -a---
s2p.exe 364 032 2010-07-17 05:35 -a---
SKTools.exe 2 657 208 2010-03-02 15:09 -a---
ThemeChanger.exe 113 912 2007-04-18 07:43 -a---
Weather-iGo-PPC-v2.exe 264 192 2010-11-11 17:49 -a---
And only a few Exe seems to be work like my old test with my P535 long time ago...
it appear too somes EXE manage in .NEt/win32 are not supported actually !
But when it work... it s soooooooooooooooooo fastest !
Working file compression :
Code:
Explorer.exe 252 928 2010-09-07 20:46 -a---
GoogleMaps.exe 855 040 2010-06-25 19:47 -a---
iManager.exe 203 264 2011-02-21 17:00 -a---
Opera10-armv4i.exe 246 568 2010-03-15 20:48 -a---
PhotoManPro.exe 499 712 2010-04-26 16:29 -a---
RCapture.exe 53 248 2010-04-26 16:28 -a---
then i have seen on Mirolg ROM thread you manage a complete suite with standard TG exe... can you share this package, i think system files (*.exe) is universal...
And maybe you win when i will finish my new SKIN in test !
other nice idea to still use this tool always updated... i forgot it ! but it s very usefull !
lesscro said:
Actually i tried this files to perform a speed test :
Code:
Explorer.exe 268 288 2010-09-07 20:46 -a---
GoogleMaps.exe 2 354 176 2010-06-25 19:47 -a---
iGo.exe 8 613 376 2011-05-08 09:07 -a---
iManager.exe 356 352 2011-02-21 17:00 -a---
InfoTrafic Trains.exe 319 488 2010-03-17 23:28 -a---
Opera10-armv4i.exe 623 400 2010-03-15 20:48 -a---
PhotoManPro.exe 1 108 480 2010-04-26 16:29 -a---
player.exe 1 894 672 2009-09-17 11:14 -a---
RCapture.exe 90 112 2010-04-26 16:28 -a---
s2p.exe 364 032 2010-07-17 05:35 -a---
SKTools.exe 2 657 208 2010-03-02 15:09 -a---
ThemeChanger.exe 113 912 2007-04-18 07:43 -a---
Weather-iGo-PPC-v2.exe 264 192 2010-11-11 17:49 -a---
And only a few Exe seems to be work like my old test with my P535 long time ago...
it appear too somes EXE manage in .NEt/win32 are not supported actually !
But when it work... it s soooooooooooooooooo fastest !
Working file compression :
Code:
Explorer.exe 252 928 2010-09-07 20:46 -a---
GoogleMaps.exe 855 040 2010-06-25 19:47 -a---
iManager.exe 203 264 2011-02-21 17:00 -a---
Opera10-armv4i.exe 246 568 2010-03-15 20:48 -a---
PhotoManPro.exe 499 712 2010-04-26 16:29 -a---
RCapture.exe 53 248 2010-04-26 16:28 -a---
then i have seen on Mirolg ROM thread you manage a complete suite with standard TG exe... can you share this package, i think system files (*.exe) is universal...
And maybe you win when i will finish my new SKIN in test !
other nice idea to still use this tool always updated... i forgot it ! but it s very usefull !
Click to expand...
Click to collapse
I know .NET files cannot be UPXed, i did say this in my other post about UPX, but this thread was to state what i found could be done on mirom8.
Also bear in mind small files less than maybe 100k are not worth doing, because there is a latency involved with getting file off of storage, and then decompressing it in ram.
Also there is a downside, files UPXed have a higher memory footprint than files not compressed, so for instance, Imanager.exe that would always be resident in ram, is a bad idea, it will use more ram than it would if it wasn't compressed, its more useful for the config program, as that would make it open faster, any program that starts with the phone, don't bother UPXing it, any program thats always running, don't UPX it.
Glad you found the post useful.
then i will try to tes Mirom8 Rom and extract desired system files compresses based on your discussion with Mirolg...
thx for all !
lesscro said:
then i will try to tes Mirom8 Rom and extract desired system files compresses based on your discussion with Mirolg...
thx for all !
Click to expand...
Click to collapse
Mirom8 cfc is a beta and is not protected, so you can either ask Miro for what can and can't be done, or dump it in a kitchen and use it as a guide as to what to UPX and with what settings, not everything can be -Brute compessed, especially dll files, i believe there is a -Best switch, you will have to do a lot of trial and error, Miro has made leaps and bounds in finding what can be done, if you find things he has missed, let him know, anything to get a smaller, faster rom. My favourite example is the camera application, it fles, it opens in about 3 seconds.
Adding to your list of what you found could be done, i can tell you both of the largest files in the Opera application can be UPXed, so thats the exe and the largest dll file, in flashlite the largest dll can also be UPXed.
i will tru one by one Windows Exe files...
but i repeat i m pretty sure system base system is same on all rom especially system configuration files...
and All TG tool file, like camera and more other indispensable application...
You know what i m looking for... that's why i ask you to send me a package with already identified files system 'UPX transformed'...
I will won lot of time...
indeed, i will report your technic 'UPX' to a French Rom Cooker...
Actually my ROM, maybe it will try it himself too... and more tester more report !
have fun !
lesscro said:
i will tru one by one Windows Exe files...
but i repeat i m pretty sure system base system is same on all rom especially system configuration files...
and All TG tool file, like camera and more other indispensable application...
You know what i m looking for... that's why i ask you to send me a package with already identified files system 'UPX transformed'...
I will won lot of time...
indeed, i will report your technic 'UPX' to a French Rom Cooker...
Actually my ROM, maybe it will try it himself too... and more tester more report !
have fun !
Click to expand...
Click to collapse
Some components cannot be UPXed, cprog.exe, unless you first compress the png files, and gwes.exe, will eat more memory than ever if upxed, however if you found a technique to make it work postively on memory usage, please share how you did it.
I read some of this thread, maybe useful to you.
Only files i have are the ones listed in the first post, better off looking at miros roms as he has a lot of files upxed there.
Damn ! Beautifull... all your idea is awesome !
All your link is so cool...
i will try to test some new files... another tester is in place now... we will report all files we can test here !
Thx...

[MOD]UART Debugging Connection

Introduction
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.
On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
Code:
Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
Starting OS Bootloader from EMMC ...
U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)
Load address: 0x80e80000
DRAM: 1024 MB
Using default environment
In: serial
Out: serial
Err: serial
hw_status 0x23 vbus_status 0x80
mmc read: Invalid size
mmc read: Invalid size
2 bytes read
MAX17042+UBOOT: battery type=LG
MAX17042+UBOOT: gas gauge detected (0x0000)
MAX17042_STATUS (00h) is 0x0000
MAX17042+UBOOT: BATTERY Detected!
MAX17042+UBOOT:WARM BOOT
mmc read: Invalid size
mmc read: Invalid size
40 bytes read
Valid max17042 init data is loaded into memory
0x1234
0x215b
0x00d6
0x2037
0x0000
0x0100
0x007e
0x3670
0x078f
0x0000
0x0000
0x6435
0x2f2c
0x0140
0x7d5a
0x87a4
0x1400
0x205c
0x205c
0x6046
verify if mem loaded: FullcapNom was saved as 2037
uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
uboot verify: 2a RELAXCFG is 083b ; should be 083b
uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
uboot verify: 18 DesignCap is 205c ; should be 205c
uboot verify: 12 Vempty is 7d5a ; should be 7d5a
uboot verify: 25 TEMPLIM is 2305 ; should be 2305
uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
uboot verify: 2c TGAIN is e3e1 ; should be e3e1
uboot verify: 2d TOFF is 290e ; should be 290e
uboot verify: 2e CGAIN is 4000 ; should be 4000
uboot verify: 2f COFF is 0000 ; should be 0000
uboot verify: 37 FCTC is 05e0 ; should be 05e0
MAX17042+UBOOT: warm config is okay
SOC 90%, booting.
Board revision PVT
mmc read: Invalid size
mmc read: Invalid size
16 bytes read
ptn 0 name='xloader' start=256 len=131072
ptn 1 name='bootloader' start=512 len=262144
ptn 2 name='recovery' start=1024 len=15728640
ptn 3 name='boot' start=32768 len=16777216
ptn 4 name='rom' start=65536 len=50331648
ptn 5 name='bootdata' start=163840 len=50331648
ptn 6 name='factory' start=262144 len=387973120
ptn 7 name='system' start=1019904 len=641728512
ptn 8 name='cache' start=2273280 len=446693376
ptn 9 name='media' start=3145728 len=1073741824
ptn 10 name='userdata' start=5242880 len=64991232
mmc read: Invalid size
1088 bytes read
BCB found, checking...
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
Booting into Android
mmc read: Invalid size
mmc read: Invalid size
4 bytes read
BootCnt 2
1 bytes written
Autobooting in 0 seconds, press <SPACE> to stop...
kernel @ 80088120 (2682952)
ramdisk @ 81080000 (157153)
Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.
Starting kernel ...
Linux version 2.6.35.7 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: OMAP4430 ACCLAIM
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 245760
free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
Normal zone: 1536 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 178688 pages, LIFO batch:31
HighMem zone: 512 pages used for memmap
HighMem zone: 65024 pages, LIFO batch:15
***********************
OMAP4430 ES2.3 type(HS)
id-code (6b95c02f)
Die-id (5C360006-00000001-09111715-1601D00D)
Prod-id (000DB95C-000600CC)
***********************
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
FIXME: omap44xx_sram_init not implemented
Reserving 33554432 bytes SDRAM for VRAM
SMC: Allocated workspace of 3M at (0x9c900000)
PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 243712
Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 [email protected] [email protected] init=/init rootwait vram=32M,82000000 omapfb.vram=0:[email protected]
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 448MB 256MB 256MB = 960MB total
Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xf0800000 - 0xf8000000 ( 120 MB)
lowmem : 0xc0000000 - 0xf0000000 ( 768 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.init : 0xc0008000 - 0xc003d000 ( 212 kB)
.text : 0xc003d000 - 0xc053f000 (5128 kB)
.data : 0xc0540000 - 0xc05888c0 ( 291 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
You will need
In order to get started you will need some things. Here's what you will need.
Torx T5 screw driver (the star kind)
Soldering iron ( any soldering iron)
Case opener tool ( or guitar pick or something small and plastic)
30-40 AWG wire (small wires)
1.8V UART to USB converter (Like The Bus Priate)
Tweezers (Makes it easier to handle small things)
Most of the tools and parts used can be obtained at Lowes or Radio Shack
For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.
Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Disassembly
If you have an SDCard inserted, remove it.
Remove two(2) T5 Torx screws securing the back cover to the unit
Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
Remove ten(10) T5 torx screws from the metal case which secure the front cover
Image 2:
disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
Remove the board and LCD from the metal case
Modification
Image 3:
Locate the UART RX and TX lines on the board shown in Image2.
You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..
Stop here and use UART or continue on for a cleaner method
run 40 awg wire to a piece of perf-board, about 8 holes wide.
Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
attach the UART RX
Image 4:
Route the wires along the board and tape them down
Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
Reassemble the unit, Assembly is reverse of Disassembly.
Image 5:
Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
Image 6:
You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)
For the Bus Pirate, get it working in a termianal and use the following settings:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)
(1)>3
Set serial port speed: (bps)
1. 300
2. 1200
3. 2400
4. 4800
5. 9600
6. 19200
7. 38400
8. 57600
9. 115200
10. BRG raw value
(1)>9
Data bits and parity:
1. 8, NONE *default
2. 8, EVEN
3. 8, ODD
4. 9, NONE
(1)>1
Stop bits:
1. 1 *default
2. 2
(1)>1
Receive polarity:
1. Idle 1 *default
2. Idle 0
(1)>1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1)>1
Ready
UART>(3)
Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.
I hope this was informative and/or interesting for you to read.
Thanks to pokey9000 for pointing me to the right area.
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Also, what would happen if it didn't autoboot in 0 seconds and you could hit the spacebar?
Sent from my BNTV250 using Tapatalk
HMG10 said:
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Sent from my BNTV250 using Tapatalk
Click to expand...
Click to collapse
That's the number of boots since the counter was reset. After 8 failed boots, the device will go into recovery and restore all firmware.
this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..
servergod said:
this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..
Click to expand...
Click to collapse
that's exactly what I did...
Adafruit's FTDI Friend should also do the trick, $10 less.
I changed up my UART connection. I feel this is much cleaner and runs less wire through the nook. This makes it into a really good development device.
This new setup is made with a piece of perf-board from Radio Shack and it's held onto the nook using double-sided tape. Here are some pictures:
The wires are routed through the crack in the back cover and run to the same points mentioned in the Original Post. The 3rd connection (middle) here is Ground. Ground is the point on the board closest to the edge and furthest from UART TX in the staggered group of pins..
I thought I'd update this... I though I'd update this after a few weeks of working with it. The external connection works very well. It is easy to remove and replace if required with just 3 solder joints if required. The external perf-board is very unobtrusive, and does not interfere with operation.
I also found a case that works well with this modification. it's called "Mini Suit" for Nook Tablet.
If you go with this method and need a case, Mini Suit will suit you.
Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!
acruxksa said:
Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!
Click to expand...
Click to collapse
disregard picture 4. I took alot of pictures while setting things up and I chose the ones that gave the best idea of what was going on. Thanks.
Replacement for Bus Pirate
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks
chongns said:
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks
Click to expand...
Click to collapse
This should really go into the Samsung forum for the phone you're trying to get to, however here is where you can buy a bus pirate.

Categories

Resources