I have a Rom http://www.dopodasia.com/download/RUU_1.32.707.0_DOPODWWE_Ship.exe
I use WinRAR open the RUU_1.32.707.0_DOPODWWE_Ship.exe,I find the nksigned.nbh. Rename to nk.nbh.
1. cmd
D:\tt2>NBHextract.exe nk.nbh -v
=== NBHextract v1.0
=== Extract contents from HTC NBH files
=== (c)2007 xda-developers.com
=== by: pof & TheBlasphemer based on itsme perl scripts
Device: StarTrek
CID: DOPOD001
Version: 1.32.707.0
Language: WWE
Extracting: 00_G3IPL.nb
Extracting: 01_G4IPL.nb
Extracting: 02_SPL.nb
Extracting: 03_GSM.nb
Extracting: 04_ExtROM.nb
Extracting: 05_MainSplash.nb
Encoding: 05_MainSplash.bmp
Extracting: 06_OS.nb
rename 06_OS.nb to OS.nb
2.
D:\tt2>NBSplit -hermes OS.nb
NBSplit 2.0 RC 2
Done.
3.
D:\tt2>ImgfsFromNb OS.nb.payload imgfs.bin
ImgfsFromNb 2.0 RC 2
Searching for IMGFS start...
Found IMGFS at 0045e860.
Dumping IMGFS at offset 0045e860 (size 02217a08)
Done!
4.
D:\tt2>ImgfsToDump imgfs.bin
ImgfsToDump 2.0 RC 2
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: LZX
dwFreeSectorCount: 00002B22
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: FFFFFEFE
dwNextHeaderBlock: 00000000 (size: FFFFFE00)
Header type: 00000270, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 00760070, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 000002A4, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 000002D8, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 0000030C, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 000003A8, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 0072006F, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00300053, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
It's defeated .What can I do??
Please Help me! Thanks!!!
um, i'd try posting in the general tech area... more chance for a reply
Related
USB>task 32
Level = 0
USB>lnbs spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**ERROR: NO header matched
Cert Key Error
USB>
Thanks
jimmy69 said:
USB>task 32
Level = 0
USB>lnbs spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**ERROR: NO header matched
Cert Key Error
USB>
Thanks
Click to expand...
Click to collapse
Do not use lnbs-command, use lnb instead.
USB>lnb spl-1.04.nb 50020000
this will work!
An anohter error!
task 32
Level = 0
USB>lnb spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**Code entry point at 0x50040000
USB>
No, it's Ok, sorry
jimmy69 said:
task 32
Level = 0
USB>lnb spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**Code entry point at 0x50040000
USB>
Click to expand...
Click to collapse
Why? All works fine. Check your Bootloader Screen. Press Buttons: Ok + Power + WirelessManager hold it and soft reset with styles. You should see
IPL 1.01
SPL 1.01MFG
In this moment:
IPL-1.00
HERM200
SPL-1.04
but not its possible to change radio to 1.27.000
Error invalid 114
try it once again!
EDIT:
You should see
IPL 1.01
SPL 1.04
When flashing 1.01 MFG
You should see
IPL 1.01
SPL 1.01MFG
Hi,
I was curious if anyone has an extracted imgfs from a WM6 install that they can point me over to? I would like to play with some WM6 to WM5 programs. I cannot for the life of me get any of the WM6 Roms to extract properly I keep getting errors.
Thanks,
Rich
have you tried "Rom Koch?" It in one of the stickies at the top of the page.
RichTJ99 said:
Hi,
I was curious if anyone has an extracted imgfs from a WM6 install that they can point me over to? I would like to play with some WM6 to WM5 programs. I cannot for the life of me get any of the WM6 Roms to extract properly I keep getting errors.
Thanks,
Rich
Click to expand...
Click to collapse
the correct procedure is as follows (manually)
NBHExtract (or use my NBHDump, it's faster!) --> aChef/aWaiter to generate imgfs from OS.nb --> Imgfs tools (imgfsview, addfile) etcetera --> aChef/aWaiter to rebuild OS.nb --> NBHGen to generate flashable NBH
I had been using, NNHextract to the ruu_signed.nbh file to generate an 02_OS.nb file, then I use the prepare_imgfs.exe 02_OS.NB, this generates imgfs_raw_data.bin
Then I use viewimgfs.exe imgfs_raw_data.bin ---- Did I miss a step somewhere?
Code:
Here was the output:
C:\imgfs_tools_182>viewimgfs.exe imgfs_raw_data.bin
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 0001D317
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: 00003100
dwNextHeaderBlock: FFFBFFFF (size: FFFBFDFF)
Header type: 2F5314CE, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 00000400, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 000004C0, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
Address: FFFBFFFF, dwBlockSignature: 00000000
dwNextHeaderBlock: 00000000 (size: 00040001)
Header type: 00000000, Addr: FFFC0007
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC003B
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC006F
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC00A3
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC00D7
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC010B
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC013F
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC0173
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC01A7
Unknown header type, FS_DATA_TABLE??
do not use prepareimgfs.exe, use aChef.
So I was able to use the Achef to get the imgfs_raw_data.bin file out of the 02_OS.nb. How do I extract all the files / directories from the imgfs_raw_data.bin to a sub directory?
BTW, my goal is to fully extract the WM6 onto windows to play with the OS itself.
use viewimgfs now on the new bin file.
I used the command:
Code:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\aChef-v_0_2_1>viewimgfs.exe imgfs_raw_data.bin
C:\aChef-v_0_2_1>
Nothing happens?
No errors, just nothing at all...
Any ideas, I think I am pretty close to where I need to be.
Sorry to come accross as a newb but I am really confused on what I might be doing wrong to dump this rom. Any suggestions?
Thanks,
Rich
Hello,
I have a question for all coockers about file structure.
I've managed to edit my OS.nb for removing the first partition how is unusable on our Prophet.
My problem is now with RomMaster : I can't extract my XIP anymore, I test to Fix my XIP start and end address but don't work (Make_XIP from hypercore don't work too).
Some informations :
My error with RomMaster :
[Info] It is a common ROM.
[Error] File struct error, xip end offset is 0x77b82448, but file length is 0x035f0000.
Click to expand...
Click to collapse
What I test to resolve my problem, so it don't work too
D:\ROMEDIT> RomMaster.exe -s 0x00000400 -e 0x0030FFF0 -w 5 OS.nb
[Info] It is a common ROM.
[Error] File struct error, xip end offset is 0x77b82448, but file length is 0x035f0000.
Click to expand...
Click to collapse
My OS.nb info (make with NBInfo.exe)
NBInfo 2.1rc2
'OS.nb' has valid boot sector
Partition table:
Partition 0
-----------
File System: 0x23 (XIP RAM)
Start Sector: 0x00000002
Total Sectors: 0x00001800
Boot indicator: 0x00
First Head: 0x02
First Sector: 0x01
First Track: 0x00
Last Head: 0x7f
Last Sector: 0x01
Last Track: 0x30
Partition 1
-----------
File System: 0x25 (imgfs)
Start Sector: 0x00001880
Total Sectors: 0x00019700
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x31
Last Head: 0xff
Last Sector: 0x01
Last Track: 0x1c7
Partition 2
-----------
File System: 0x00 (unknown)
Start Sector: 0x00000000
Total Sectors: 0x00000000
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x00
First Track: 0x00
Last Head: 0x00
Last Sector: 0x00
Last Track: 0x00
Partition 3
-----------
File System: 0x00 (unknown)
Start Sector: 0x00000000
Total Sectors: 0x00000000
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x00
First Track: 0x00
Last Head: 0x00
Last Sector: 0x00
Last Track: 0x00
Geometry: flash has 128 virtual heads
MSFLSH50 header found at offset 0x200
(0 Reserved Entries, 2 Flash Region Entries)
Flash Region Entry 0:
---------------------
Region type: XIP
Start phys. block: 0x00000000
Size in phys. blocks: 0x00000000
Size in log. blocks: 0x00000061 -> Size in sectors: 0x00003080
Sectors per block: 0x00000080
Bytes per block: 0x00010000
Compact blocks: 0x00000000
-> Bytes per sector: 0x00000200
Flash Region Entry 1:
---------------------
Region type: READONLY_FILESYS
Start phys. block: 0x00000000
Size in phys. blocks: 0x00000000
Size in log. blocks: 0x0000032e -> Size in sectors: 0x00019700
Sectors per block: 0x00000080
Bytes per block: 0x00010000
Compact blocks: 0x00000000
-> Bytes per sector: 0x00000200
Searching for IMGFS signature...
Found IMGFS at byte 0x00310000 (sector 0x00001880).
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 00000000
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
---
Click to expand...
Click to collapse
So, if anyone can explain to me how to fix my XIP addresses to extract and modify it... Or without fixing an another method to extract XIP from my ROM (RomMaster and Make_XIP don't work with it)
Thanks in advance for your responses.
ps : sorry for my English for my problem explain but it's not my native language
Have you tried msflshtool to extract your xip partition ?!
hma4 said:
Have you tried msflshtool to extract your xip partition ?!
Click to expand...
Click to collapse
Thanks for your response, when I dump my ROM with this tool I've two files OS.nb.part0 and OS.nb.part1, so what is the real format of those files ? it's nb or bin extension (real) cause I want a bin file to edit with XipPort how request a xip.bin file.
I havn't tried to rename it cause don't say if it's the good format.
Just need that
Another question : for XIP can I add/remove some "FF FF" at the end to change the size? (for offset definition msflh50 header) ?
Thank for your hard work, perfect ROM and your help
xvx45 said:
Thanks for your response, when I dump my ROM with this tool I've two files OS.nb.part0 and OS.nb.part1, so what is the real format of those files ? it's nb or bin extension (real) cause I want a bin file to edit with XipPort how request a xip.bin file.
I havn't tried to rename it cause don't say if it's the good format.
Just need that
Another question : for XIP can I add/remove some "FF FF" at the end to change the size? (for offset definition msflh50 header) ?
Thank for your hard work, perfect ROM and your help
Click to expand...
Click to collapse
it's bin format. just rename it to xip.bin
you don't have to touch those FF in xip
Thank hma4 for your quick responses !
I'll test it !
So addinf FF at the end of XIP can make it unusable or anything else ?
hma4 said:
Have you tried msflshtool to extract your xip partition ?!
Click to expand...
Click to collapse
hma4
how to use this tool ( command, or Syntax )
Thank so much
While i'm extracting a new system.sin from Nordic ICS ftf i have this problem:
Code:
1 [main] unyaffs 1088 exception::handle: Exception: STATUS_ACCESS_VIOLATION
835 [main] unyaffs 1088 open_stackdumpfile: Dumping stack trace to unyaffs.exe.stackdump
in stackdump is:
Code:
Exception: STATUS_ACCESS_VIOLATION at eip=004010B0
eax=9207DAAB ebx=00000084 ecx=00004800 edx=00C5147A esi=0028CD34 edi=61179FC3
ebp=0028CCD8 esp=0028CCA0 program=C:\Users\Lukasz\Desktop\Xperia Neo\ftf_extractor\unyaffs.exe, pid 7988, thread main
cs=0023 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
0028CCD8 004010B0 (00C51420, 00000000, 612058E8, 00401333)
0028CD08 004013AF (00000002, 00C383C0, 00C38290, 00000001)
0028CD68 61006CD3 (00000000, 0028CDA4, 61006570, 7EFDE000)
End of stack trace
What's going on? system.sin from old Gingerbread is extracting fine
first:
Code:
D:\img>unyaffs.exe system.img
3 [main] unyaffs 672 handle_exceptions: Exception: STATUS_ACCESS_VIOLATION
1681 [main] unyaffs 672 open_stackdumpfile: Dumping stack trace to unyaffs.ex
e.stackdump
second,open the unyaffs.exe.stackdump file:
Code:
Exception: STATUS_ACCESS_VIOLATION at eip=610C5A41
eax=00000000 ebx=00000000 ecx=FFFFFFFF edx=0202A50F esi=0040130E edi=0202A50F
ebp=0022EE78 esp=0022EE74 program=D:\img\unyaffs.exe, pid 672, thread main
cs=001B ds=0023 es=0023 fs=003B gs=0000 ss=0023
Stack trace:
Frame Function Args
0022EE78 610C5A41 (0202A50F, 0040DC70, 00000200, 00000003)
0022EEB8 004010BF (0022EF1D, 00000000, 00000000, 00401333)
0022EEE8 004013AF (00000002, 006B01C0, 006B0090, 610A5E22)
0022EFD8 61004DD2 (0022EFF0, 0022F03C, 0022EFF0, 002310C4)
0022FF88 6100594F (00000000, 00000000, 00000000, 00000000)
End of stack trac
what's going on? Thanks~also give me a tip about analysis this code.