IPL and SPL Technical Details - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

Hi,
As I'm a curious electronics engineer type, I have a few questions regarding the IPL, SPL and CE kernel.
1. Am I correct in thinking that the IPL simply loads the SPL into RAM and starts executing it?
2. Is the SPL providing the low level flashing interface and the setup code necessary to load the kernel into RAM? Does it provide any low level interfaces for the CE kernel?
3. I note that the OS portion of my flash has three partitions, what are the first two small ones for?
I've had a search on the net and I can't find many detailed answers to these questions so I thought I'd ask them here. Any help is greatly appreciated.

sjbale said:
Hi,
3. I note that the OS portion of my flash has three partitions, what are the first two small ones for?
Click to expand...
Click to collapse
The first two contain the OS core in XIP format (although they still need to be copied to RAM before execution). One is the kernel for normal operation, the other is used when Windows Update flashes the ROM (it'll not overwrite anything, just add to the existing data). They can be dumped from a ROM upgrade file and edited with RomMaster and dumprom.
The third partition is an IMGFS file system. It contains all the other files needed to make your device work. It can be dumped from a ROM upgrade file and edited with the Imgfs Tools.
There is actually a forth partition in the partition table - the Storage area. This is a FAT partition. It is only in the partition table, but there is no additional data in the ROM packages. During a hard boot, the OS will format that partition.
Cheers
Daniel

Thanks for the reply. I didn't think that the CE kernel was loaded during the flashing process, I thought the SPL provided the flash interface?
Out of curiosity if am I correct in thinking that the only way to brick the device is to damage the IPL/SPL or bugger up the radio ROM so that the SPL can't return a CID. If the actual OS portion of the flash contains bad blocks will this still prevent future flashing?

sjbale said:
1. Am I correct in thinking that the IPL simply loads the SPL into RAM and starts executing it?
Click to expand...
Click to collapse
Not "only", it initializes the hardware (processor, sdram, etc...), setups the physical to virtual mapping table, reads SPL from NAND puts it into RAM and jumps into its address.
If you want it more in depth, disassemble the IPL.nb file with IDA Pro. Code entry point at 0x0000000. And consult the SC32442A processor manual while following its flow.
sjbale said:
2. Is the SPL providing the low level flashing interface and the setup code necessary to load the kernel into RAM?
Click to expand...
Click to collapse
Yes.
Again, IDA Pro is your friend In hermes the SPL expects to be executed from virtual address 0x8c080000 which is physical 0x30080000.
sjbale said:
am I correct in thinking that the only way to brick the device is to damage the IPL/SPL or bugger up the radio ROM so that the SPL can't return a CID.
Click to expand...
Click to collapse
Yes, you are correct. It is also possible that NAND blocks are marked as bad when incorrectly flashing service byte 517th, read more on Des comment here.
sjbale said:
If the actual OS portion of the flash contains bad blocks will this still prevent future flashing?
Click to expand...
Click to collapse
Depending on how many bad blocks. I've seen a hermes die completely during the 2nd flash on a NAND with a lot of marked bad blocks.

Okay, I think I understand. So once the 517th byte of a flash block it set to non 0xFF it's permanent and can't be restored? The next flash won't be able to write to that block? Hmmh, dangerous!
Now all I need to do is find the £300+ quid for an IDA pro license. I'd better get back to what I'm supposed to be doing, time to put my RF hat back on

Yes, that's right. We haven't found a method to restore yet, but sure it is possible to do it because the marked bad blocks are not real bad blocks.... probably the way to go is patching a SPL which will never flash service data bytes from data taken of a file. Des and Olipro know more on this matter, you should ask them if you really want to get involved on some development
BTW, you can use the IDA Demo version available for free download if you don't want to spend the money just for disassembling IPL & SPL.
And there are other free alternatives, I sometimes use radare which is very helpful too, but you should have a *nix system.

Related

New version of ER2003Edit (1.2.20) available

Hi guys,
a new version of ER2003Edit is available from the wiki page:
http://wiki.xda-developers.com/wiki/ER2003Edit
New features and improvements:
- provides support for the new upgrade tool version (0.9.1.0) used by the latest T-Mobile and O2 updates
- supports editing of the header information (DeviceID, Operator and Language) in order to circumvent the country code error
- some other fixes and improvements
Best regards,
softworkz
Thnx dude! At last we got a program to modify the header. I guess this makes a lot of XDA owners very happy.
Great work!
Late...
Thanks Softworkz, great work again. It really looks like an even more powerful tool, but there seems to be a little bug (or I am doing something wrong):
After upgrading ER2003Edit to the new version, I cannot open the ms_.nbf anymore. When I try to open the file, ER2003Edit always crashes, although I left the file unbmodified.
Downgraded to the old version again and there it works, although I have to decode and encode the files by myself.
Any suggestions?
No problems opening the ms_.nbf here after doing the upgrade. Running Win XP sp1.
Try uninstalling the old one completely then install the new one...
Works great!
Late...
is it a misunderstanding between header-information and encryping ???
I think Er2003edit does not do the encryption/decryption so far.
Hey Softworkz...
this would be a great improvement as I guess all coming
extended roms will be encrypted.
Alex
Tried uninstalling and re-install but that didn't help. As far as I remember, Softworkz tool is not able to edit encrypted ms_.nbf.
But on my machine (Win XP pro 2002 SP1) the program always crashes when opening an non-encrypted ms_.nbf...
I will use the old one as a workaround, I don't need to change the header so this should be fine.
some programming tips:
It should not be very difficult to implement the xor decryption, just xor each DWORD in the file with 0x25863614 after loading it in memory, and before saving it back to the file.
also, if you verify the header checksum after loading the file, you should be able to detect that the file you are loading is actually a decrypted nbf file.
and another check to see if at offset 0x70040 there is a valid bootsector, with
the 'MSWIN4.1' and 'FAT16' strings should prevent it from crashing on invalid files.
Ouch, I just found out that the wrong version of xda2tools.dll was included with the setup. I have made available a new version (1.2.20) to fix this. (see wiki page)
Some details about ER2003Edit:
You do not need to uninstall old versions before installing newer ER2003Edit versions.
The new version (1.2.x) is able to perform XOR-De-/Encryption. When opening an extended ROM file ER2003Edit first checks if it is encrypted by looking for the presence of the dashes in the header.
If those are present in the right places ER2003Edit opens the file as usual. If the dashes are absent ER2003Edit tries to decrypt with all of the three XOR-Passwords (). If none of those passwords produces a file with a correct header a prompt is shown which lets you enter your own password.
The decrypted (or a copy of the unencrypted) ROM file is saved to the temp folder. When saving with ER2003Edit the file is encrypted again (in case the original file was encrypted) and is saved to the original location overwriting the initial file.
Itsme: The "dash-check" was used because the CRC-check in your code was always true (didn't look into it further).
The new version supports auto-detection of the ROM type in order to edit the header of the other 2 ROM files (NK and Radio_), too. The "error accessing image files" message is now suppressed for these files.
Nevertheless modifying the header of those files is useless and I didn't figure out how to access the file structure in those files (doesn't look like a FAT image).
Best regards,
softworks
Okay, that explains the problems I experienced. As soon as I am back home I will give it a try. If it works it will be a nice & powerful tool...
==> seems to work perfectly. So there are no more obstacles. Next stage will be an Upgrade to 1.66.xx... :shock:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
ER2003 crashes opening new O2 extended ROM Files
Hi softworkz,
first off all thanks for your great work!
Using the new version of er2003 i cant open the ms_.nbf file of the latest O2 upgrade (1.60.52). It crashes every time. Opening and editing my self created ext. ROM based on T-Mobile Update 1.60.07 works great.
Whats wrong with my installation? If you wish i can send u my Win XP error report.
Escargotet
Sorry for posting, was 2 stupid to read forum first!
Sorry for posting, was 2 stupid to read forum first!
Hi all
Please help to clarify as there are some inconsistances...
(or I am wrong, but will run into this problem)
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
So there is a missing link...
Alex
itsme said:
ok, now it works.
currently, a non-matching crc value only results in a printed warning, maybe I/you could add an extra parameter to the file processing functions, which get the result of the crc-check.
or maybe even better, raise an exception, for the warnings.
Click to expand...
Click to collapse
The CRC check does not work in your code. XORing with a wrong password results in the following message:
WARNING: this does not look like a nbf header, possible you provided the wrong password
But this gets printed as a result of the "dash-check". If the crc-check would fail, a different message would be printed:
WARNING: checksum is not ok, possibly you provided the wrong password
But this message never gets printed because (filecrc != crcsum) never occurs (for whatever reason).
Xant said:
Hi all
Er2003edit will try to modify the header information in the NK and Radio_mbf but this will not be successfull and I still will get the Country ID error, is that right ???
Click to expand...
Click to collapse
No. Er2003Edit can open NK and radio ROM files and edit the header. Er2003Edit automatically re-encrypts the newer ROM files (XOR-Method).
Er2003Edit decrypts older ROM files (DES-Encrpytion), lets you edit the header and save the file but it does not re-encrypt these ones (use xda2nbftool). A message is displayed in this case to remind you to encrypt the file.
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
nargalzius said:
softworkz said:
Xant said:
As far as bobopopo expierenced the new upgrade utility will not run parts of the upgrade but rather leave the machine useless.
Click to expand...
Click to collapse
AFAIK the upgrade tool will only look at the extended ROM's operator field. Anyone please correct me if I'm wrong about that.
Click to expand...
Click to collapse
I confirm what bobopopo claims, i tried only flashing the ms_.nbf, and it totally messed up my machine (stuck in bootloader), i had to reflash all three to get it to work again
Click to expand...
Click to collapse
I knew about this. I was just stating that the header of NK and Radio is irrelevant for the upgrade tool and is not responsible for the country code error.
SPV M1000
Does it work with SPV M1000 version
loade ER2003 started it and stay on the ROM info screen :?

Call For People with bad NAND Blocks

could anyone who has a Hermes with NAND blocks they've corrupted please contact me; I've modified the SPL to ignore bad NAND blocks, although I have no idea if it actually works or not, so anyone who has bad blocks and has a way of getting my SPL onto their phone please contact me.
I've an hermes from a friend with bad blocks on NAND here... device is still usable, so I can install the SPL and try.
Also I have a unusable device with Bad Block, I have bootloader 1.06 (without KITL mode).
tedes
bad blocks, extROM can't installed automatically
Count me in....
I have bad blocks and I'm suspecting these are causing the extended rom can't installed automatically everytime I upgraded ROMs. When I unlocked and mounted, it shows nothing in this \extended_rom folder and it has only 0.6Mb capacity. Any clues?
abe505 said:
Count me in....
I have bad blocks and I'm suspecting these are causing the extended rom can't installed automatically everytime I upgraded ROMs. When I unlocked and mounted, it shows nothing in this \extended_rom folder and it has only 0.6Mb capacity. Any clues?
Click to expand...
Click to collapse
ExtROM is separate from OS ROM... God knows how you'd manage that.
Just curiosity...
Does any of you managed to clear these Bad Blocks marks using Olipro's miracleous SPL?
I hv dared to do..now I hv 13.4 MB of staorage out of which 6 MB is free..
Can any one help freeing some files from Windows...

What is a Hard or Soft SPL

I allreyd flashed a lot and did use a soft spl, but I do not find a proper
explanation what it is.
So, i Think it is the Bootloader ?
Can anyone tell me what a soft and a hard SPL is and does ?
For what do I need it ?
I just got my new Touch Pro bought in UK and now it is here in Germany and I want a german ROM on it as soon as it is available.
Please don´t write your standard answers like WIKI and Search - a forum is here for communication and I did not find the proper answers - only too long threats
Greetings
Marcus
69reichertm said:
....So, i Think it is the Bootloader ?...
....Can anyone tell me what a soft and a hard SPL is and does ?....
Click to expand...
Click to collapse
Yep your right on that assumption sir The bootloader does alot of the low level handling of the startup process when you power on the device aswell as handling the process when you flash anything to the device...im sure its far more technical than that but thats a starter explanation Essentially you NEED a bootloader for the device to work at all, the case with many of the HTC devices...other devices are different most likely.
Soft SPL: (normally referred to as SSPL) IS loaded into RAM and allows you to perform some of the operations the standard bootloader would do, naturally with some extra functionality (explained later)
HardSPL: Same sort of thing except it is flashed to the device permenantly, so it replaces the HTC bootloader in your devices flash memory.
Both of these tend to safeguard against corrupting the device by having some fancy workarounds and updates to the processes built into the HTC SPL, and the best part is that they allow you to flash ANY ROM you wish therefor allowing us to use Cooked ROMs and various updates like radio updates and etc...frees the device up quite superbly.
69reichertm said:
Please don´t write your standard answers like WIKI and Search - a forum is here for communication and I did not find the proper answers - only too long threads
Click to expand...
Click to collapse
Perhaps some mebers feel like adding a general HardSPL page to the wiki for FAQs like this to be answered better than "Search the forum.." since we know its not that good for finding anything.
The Wiki is there for everyone to use and edit so, learn and pass it on
Just a quick question, does any of this interfere with HTC released updated ROMs? Like, when they release a new version on their site, does having HardSPL prevent you from updating?
Hello !
Thank you for your advise.
One more question:
Should I install Hard or Soft SPL ?
I want to try out many ROMS - I think Hard is better, what do you mean ?
Thank you for your help
By the way:
I am a kind of technican - working in IT for nearly 18 years starting fron Novell, Banyan Vines and DOS up to Windows Vista. Also I am a kind of apple Guru, thats why I have certainly an iPhone 2G and 3G.
For business I use HTC devices sind the first MDA. But I lost track a little sind iPhone.
As I am a technic nerc I sstarted with th the Diamond touch again and I liked the device but i swapped this week to the touch pro because of the keyboard, SD Slot an flash light. I love this device.
By the way I also have the new Samsung Omnia 900 here and an unfun Nokia E71 ( I hate this old symbian - looks like last centuty )
So good night and thank you
Marcus
Jiggs1337 said:
Just a quick question, does any of this interfere with HTC released updated ROMs? Like, when they release a new version on their site, does having HardSPL prevent you from updating?
Click to expand...
Click to collapse
no, raphael hardspl is unsigned, means any rom is allowed, including HTC official roms.
69reichertm said:
One more question:
Should I install Hard or Soft SPL ?
Click to expand...
Click to collapse
you can only install hardspl. the job of soft spl is to install hardspl.
do not ever try any of the following:
- with SSPL, do not flash anything other than the included SPL NBH files. as extra protection the diamond and raphael SSPL's require htchacker sign (except the version jocky edited) and will reject anything that's not an SPL.
- and do not ever try to flash SSPL as an NBH, especially if it is a diamond or raphael.
Im sorry to disagree with your "don't tell me to use the Wiki".
But this is a fairly comprehensive answer to your question: http://wiki.xda-developers.com/index.php?pagename=SPL Questions? straight out the wiki.
Ta
Dave
When flashing a new ROM, do u lose all ur settings? Like installed programs, and other customizations?
Do you lose these by installing Hard-SPL?
Jiggs1337 said:
When flashing a new ROM, do u lose all ur settings? Like installed programs, and other customizations?
Do you lose these by installing Hard-SPL?
Click to expand...
Click to collapse
Yes - Everything Goes.
No.
Ta
Dave
Thanks Dave.
So what do you guys do? Just reinstall everything one by one after you've flashed the new ROM?
Jiggs1337 said:
Thanks Dave.
So what do you guys do? Just reinstall everything one by one after you've flashed the new ROM?
Click to expand...
Click to collapse
There are several things.
UC is short for User Customisation; it is in all the Kaiser ROM's nowadays. l3v5y's Raph ROMs also have it.
Links: l3v5y's ROMs & Main UC Thread.
I use UC to install programs, Provisioning XML (as part of UC) to change registry settings, my xcopyce application to copy folders and active sync to copy contacts, calender etc.
Ta
Dave
Ok, thanks. Seems very complicated. Having to write XML files and such.
when running RaphaelHardSPL-Unsigned_190_1_3.exe, it says all information will be lost on my device. Are you sure i dont lose everything when installing Hard-SPL?
Jiggs1337 said:
Ok, thanks. Seems very complicated. Having to write XML files and such.
when running RaphaelHardSPL-Unsigned_190_1_3.exe, it says all information will be lost on my device. Are you sure i dont lose everything when installing Hard-SPL?
Click to expand...
Click to collapse
I can't say. I haven't done it, what says you will lose all the info, the RUU or the thread? If it's the RUU, then you should be OK, it's probably the standard message that the proper RUU (used for carrier ROM upgrades) has.
UC is good, takes maybe an hour or two to get setup, but once done, you don't have to do it again and it makes flashing so much fun. I started with just installing CAB's and Copying files, then went onto ProvXML for my registry settings next. The latest version of Schap's Advanced Config (3.0) can export tweaks into a Prov XML file for you. It is worth it if you flash your ROM as often as I do.
Dave
I do love this kind of stuff. Any new gadget i get, i like to do this kinda stuff with it. But its a little overwhelming in this case .
So, using UC, i can set it up so that my settings, such as email accounts, wifi networks + passes, notify settings, etc, as well as all the programs are restored after a ROM flash?
To do this i have to manually go through my registry to find the entries for each of these settings though? No way to just extract my current unflashed devices settings to a file that the new ROMs then use? That would be nice
Jiggs1337 said:
I do love this kind of stuff. Any new gadget i get, i like to do this kinda stuff with it. But its a little overwhelming in this case .
So, using UC, i can set it up so that my settings, such as email accounts, wifi networks + passes, notify settings, etc, as well as all the programs are restored after a ROM flash?
To do this i have to manually go through my registry to find the entries for each of these settings though? No way to just extract my current unflashed devices settings to a file that the new ROMs then use? That would be nice
Click to expand...
Click to collapse
We are getting a little off topic of the OP now but...
Any tweaks done with schaps Advanced Config can be easiler exported using a "export" menu option.
If you export your registry after flashing, and again after you have all your settings setup right, you can Diff then using a Diff Program and copy the changes into your ProvXML file. Most PPC Regedit programs can export.
Any more on UC, I'd have a read of the UC thread and ask any questions in there. Myself and l3v5y keep and eye on it most of the time and should be able to help fairly quickly.
Ta
Dave
Hello
So my Threat became quite interesting.
One last question foe me.
What File should I download to HARD SPL my Touch Pro.
Is there a file which includes all ? I mean I do not have to modify files inside the cabinet or so ?
Is there a fast link ?
Thank you for all the help - now lets start using the Touch - weekend is near
69reichertm said:
Hello
So my Threat became quite interesting.
One last question foe me.
What File should I download to HARD SPL my Touch Pro.
Is there a file which includes all ? I mean I do not have to modify files inside the cabinet or so ?
Is there a fast link ?
Click to expand...
Click to collapse
lol, sure, there is only one package, and you simply click the EXE and it goes
http://forum.xda-developers.com/showthread.php?t=410150
Is it possible to use those backup softwares? Like Spb Backup for example that say "ROM Upgrade Mode — now it's possible to restore data after the ROM upgrade"? Instead of UC and such?
there is a IPL initial program loader (sort of bios)
a SPL secondary program loader (kinda like the ntloader)
and there is a service mode (3 color screen) (the flashprog)
then we have a RUU remote unit upgrader
mft masterfile table
mbr master boot record
and some other shizzle
the device switches the output of the internal usb when device is in 3 colorscreen to a service mode which allows it to overwrite the internal flashdrive .. pretty neat as what it actually does is switching to an internal flashprogrammer which programs the internal flashdrive. this is the same process as is used for your pc at home to update the bios.
the CID celloperator identification code (used for blocking certain rom upgrades)
enjoy..
Soft SPL quesiton
I have a SPV M700 and it's unlocked. I want to install Schaps rom. I have the folowing SPL version 1.07.000. I have't managed to install hard spl. Can I use soft spl to flash it? Can I permanently brake it?

he Windows Mobile Image Update System - Updating your ROM without losing data!

please rom cookers have a look .can u guys cook rom for our device by this method .
if we got success in this matter no device will be bricked.
i m not so aware of technical terms .so i cant advice u guys!!
http://forum.xda-developers.com/showthread.php?t=520009
sorry for my bad english
i hope u will understand what i want to say
thanks!!!!!!!!
We are aware of this system, but right now, the system is under testing and not fully working. Rest assured when it becomes fully ready and if its possible to use it on gene, we will definately use it.
I said if it is possible, because, on gene, the concept of ULDR partition doesn't exists as far as i know. And ULDR partition is an integral component of that system. ULDR was most probably introduced in WM 6.1 but since Gene is a WM 6 device, it doesn't have the parition layout entry for ULDR. I could be wrong, this is just what my logic says based on my current information.
Also, it wont prevent bricking, as for the system to work, you will need to flash a ROM that supports the ULDR partition and the update system itself, before anything else. For that, you will need to patch your SPL as cooked ROMS will never have the HTC's digital signature. And as we know, patching the SPL is the reason behind all the bricking mess.
But anyways, thanks a lot for sharing
Double Post!
Will it ever work?
I have read the thread sometime back, but I have a few queries...
1. When you upgrade your OS from, say 98 to XP or XP to Vista, there always is a performance issue (compared to formatting your hard drive and doing a fresh install). And since our WinMo are nothing but hand held PCs (well you can say that, it got a processor, a hard disk (ROM), RAM), I guess that issue will crop up here as well.
2. What will happen if you have a 3rd party s/w which is incompatible with the new version of WM? Those of you who are in the PC tech field for a long time, you know after you have upgraded your OS, you can't use that software, neither can you uninstall it ...
So there will be issues, if I am not wrong.
But thats only my opinion. Most pple here are head and shoulders above me technically .
@Addicted: Well, Here are my opinions on your queries :
1. Yes, if the registry of the PPC is having some problems, then it will be an issue. Its a bigger issue in PCs as compared to PPCs coz in PCs the software are huge in size and they write thousands of entries to registry, modify system files etc. SO when an upgrade occurs, these changes either cause a corrupted registry, or in the second case when system files had been modified or replaced by a program, these files will be again updated by the OS and the program may not work, and if its a system level program with deep roots in system functionality, it will cause the system to slowdown at least or crash at worse.
These issues dont affect PPC much coz, for one, PPC software are usually small, they dont write much in registry (ms office on pc for example on PC writes a few thousand keys to registry while registering COM servers etc while MS Office on PPC just adds 10 or 20), and since the OS files are in ROM, they cant be touched by a software. They will remain overridden, if they have beem overridden as the updating process doesn't touch the phone memory.
2. Think again buddy, this is not applicable for WinMO. When you flash a ROM, you already change your OS version, so that will happen anyway, if you flash a ROM or you use the update system on an existing ROM.
I hope this would have cleared your doubts.
krazy_about_technology said:
2. Think again buddy, this is not applicable for WinMO. When you flash a ROM, you already change your OS version, so that will happen anyway, if you flash a ROM or you use the update system on an existing ROM.
I hope this would have cleared your doubts.
Click to expand...
Click to collapse
Actually you did not get me about the second issue, what I was trying to say is, if you flash your ROM, you incompatible program will be deleted (obviously) and thus free up space, but if you upgrade, your program will still take up space but will be of no use to you. Since most of the programs in Winmo are stored in Windows folder itself, it will be next to impossible for 99% users to identify the files to delete .
i already talk about image update in visual kitchen for gene thread, all this take lots time. da_g bepe and lots senior ppl are working on this its required new kitchen new rom format
as per i know it's required more rom space which not possible on gene rom
thanks !!!!!! guys for taking interest.
i like it because i have bricked my gene 4 times and got new motherboard.
but now my phone is not in under warranty so i cant take more risk.
i have done all methods correctly but unfortunately i was failed every time .
so after a year of trying i m still using wm5. so i want a new method without
zero risk for updating my rom.
Sorry buddy, but I dont think you can damage ur MB by wrong flash .

[How To]Gold card method to unbrick HTC Monet/Lobster device?

Hi All
Do you have any ideas?
How to unlock this device?
As in the topic...
Nokser said:
Hi All
Do you have any ideas?
How to unlock this device?
As in the topic...
Click to expand...
Click to collapse
it is better you find out - http://psas.revskills.de
and learn PSAs 1.08 was released, I am confident that you can develop it to your device
and as a friend, I can only help with this
I search people.... You have a HTC Monet, please write in this topic
How "bricked" is your device - i.e. which state can you get it when switching on?
tobbbie said:
How "bricked" is your device - i.e. which state can you get it when switching on?
Click to expand...
Click to collapse
This Device run only in Bootloader mode(tri color screen etc)
Problem is.... this phone not have a Official/Ship firmware
Well then the sequence is:
Hard-Reset (L+R Softkey method)
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?)
Official firmware (see above)
Gold Card will not help for loading a cooked ROM as it still needs a signed ROM (despite ignoring the Carrier).
tobbbie said:
Well then the sequence is:
Hard-Reset (L+R Softkey method)
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?)
Official firmware (see above)
Gold Card will not help for loading a cooked ROM as it still needs a signed ROM (despite ignoring the Carrier).
Click to expand...
Click to collapse
Hard-Reset (L+R Softkey method) -> Not Working
R2SD backup (where can you get THAT? - Even how can you make that, on a GoldCard possibly?) -> Not Working
Official firmware (see above) -> Not Find, and not get from Virgin Mobile/HTC
Sad situation - you will have to google around, possibly find owners where you could get at R2SD backup from (if that works for this device). I found this query not so long ago: http://forums.phone-tools.cn/showthread.php/31636-Htc-lobster-700tv-how-can-i-unlock-with-xtc-clip-%28virgin-mobile%29
Do you know if this device has the M-Systems DiscOnChip (like older Wizard and Typhoon(Hurricane/Tornado) or already newer/other encrypted storage?
You could as well try the guys at IMEI-check.UK - they are very knowledgeable and may have a system backup of the supported devices in their drawer (just in case..). Maybe they can fully CID Unlock the SPL on that device and allow the flashing of a cooked ROM (is there any)?
tobbbie said:
Sad situation - you will have to google around, possibly find owners where you could get at R2SD backup from (if that works for this device). I found this query not so long ago: http://forums.phone-tools.cn/showthread.php/31636-Htc-lobster-700tv-how-can-i-unlock-with-xtc-clip-%28virgin-mobile%29
Do you know if this device has the M-Systems DiscOnChip (like older Wizard and Typhoon(Hurricane/Tornado) or already newer/other encrypted storage?
You could as well try the guys at IMEI-check.UK - they are very knowledgeable and may have a system backup of the supported devices in their drawer (just in case..). Maybe they can fully CID Unlock the SPL on that device and allow the flashing of a cooked ROM (is there any)?
Click to expand...
Click to collapse
I understand, but not have a good solutions. i see all this pages... and nothing
My dad still has his Monet on the stock ROM.
IF you can give me simple instructions to follow to dump the ROM, I can do it when I next see him (within the next few months).
Safest method should be to have a GoldCard created and then do a R2SD backup on that card. The R2SD command should be available from the "GoldCard - SuperCID" SPL.
If that works, nothing on the device itself has to be changed and the complete ROM is dumped on the card. In turn that memory card can then be dumped to a file, zipped and shared.
I said simple I've not ever researched gold card and to be honest don't have the inclination to do so. if you could give me clear step by step instructions with links to needed files, I can help.
Well - I don't need it, its Nokser
So he surely will tell you a step-by-step action what to do, maybe even prepare a package for you. It will require downloading a program that can create the Gold Card (psas.revskills.de), have a suiting SD card, as small as 64MB, but any less than 2 GB will do it, a normal USB cable, a PC, a Terminal Program (mtty) and finally one out of a set of tools that can handle the created image.
If all is prepared well, the total time to execute all actions would be ~half an hour (the dump on the device is just a minute!), but you should calculate a little more for this one time action.
Thanks for offering your help to save one of a species from the dumpster!
grayme said:
I said simple I've not ever researched gold card and to be honest don't have the inclination to do so. if you could give me clear step by step instructions with links to needed files, I can help.
Click to expand...
Click to collapse
Hi
Please, you first dump and write in attach. bootloader section
...just to complement the GoldCard idea:
When writing back the dump to a card for loading the broken device, the bootsector of that card may require to be a "gold card" too. Since the Gold Card key is related to the device and the Serial number of the card, the key contained in the bootsector of the dump will not fit to the serial of the new card Nokser has to use.
So after the dump was written back to the card, the PSAS has to write the goldcard-key to the new card again (which is different as the serial of the card is different).
I wish you luck getting that operation done!
I want Bootloader, because in this file is writing all info from load all parts and method backup. All abouts from boot file is importand.
If we IDA execute this file, then we see -> how to get any section and name sectiors
Bootloader (IPL and SPL) are part of the "R2SD All" backup. You can patch them later. Makes no sense to only do partial R2SD backups.
tobbbie said:
Bootloader (IPL and SPL) are part of the "R2SD All" backup. You can patch them later. Makes no sense to only do partial R2SD backups.
Click to expand...
Click to collapse
I understand, but this function is not working in my phone
Also not with "goldcard" inserted? Can PSAS make a GoldCard for Lobster/Monet?
tobbbie said:
Also not with "goldcard" inserted? Can PSAS make a GoldCard for Lobster/Monet?
Click to expand...
Click to collapse
In "goldcard", i don't have any results

Categories

Resources