first i just want to say that i am not trying to out do pk's rom cause its great in a lot of ways that this rom isn't. with that being said i just wanted to offer up an alternative to those who r having problems with pk's v2 rom.
**** please use the unlocker first if you have not already done so, if your not sure if you have CID unlocked your phone then do it anyways *****
if your unsure how to CID unlock your device with this vid http://video.google.de/videoplay?docid=2234348915783114030
it is 18min.
ok now for the rom and unlocker **edit: i have updated this link to go directly to the pk3 rom
http://forum.xda-developers.com/showthread.php?t=338409
version 2.20
radio 1.45
for the extra programs **edit: link to PK3 rom
http://forum.xda-developers.com/showthread.php?t=338409
load this file onto the mini sd or microdrive, this is just a backup of everything
i left out the background cause i thought everyone would want there own
i am also attaching screen shot of the today.
***EDIT: i took down the links cause pk3 is a better rom and very stable, if you dont want all the stuff that comes with pk3 then u should download the offical htc wm6 rom ***
well i guess thats it. so have fun
features
so is this a standard rom with addons or is t cooked ie registry edits extra progs can we have the full details please
its really more of a standard rom with addons there are some registry hacks done but i want it to be as stable as possible. the only bug is in wm5storage when you deactive it the sd card is gone until you softreset then it back but 1.75 did not work at all for me which is why i loaded 1.73. Also you have the ability to uninstall any of the app that you don't want.
Yeah, details would be welcome.
It does not seem to be the latest available as you mention version 2.20 and
radio 1.45.
What is included, tweaked etc. and aren't the extras available as cab files?
ok, reg tweaks: time zone, date and time, hold comm manager for bright.exe, created .lnk for bluetooth, alarm, wifi, sounds that you have e-mail, text message, missed call and so on. as for as programs go i just loaded it and then backed them up so it would be easy to install. if i post cab then i can't give out serial keys for the programs that need it. it's not the latest but like i said i wanted to make sure that its stable for example pk's rom is ver 2.19 im sure part of the reason he choose that version is for stability.
irus said:
ok, reg tweaks: time zone, date and time, hold comm manager for bright.exe, created .lnk for bluetooth, alarm, wifi, sounds that you have e-mail, text message, missed call and so on. as for as programs go i just loaded it and then backed them up so it would be easy to install. if i post cab then i can't give out serial keys for the programs that need it. it's not the latest but like i said i wanted to make sure that its stable for example pk's rom is ver 2.19 im sure part of the reason he choose that version is for stability.
Click to expand...
Click to collapse
rom aint bad. i choose 2.19 because its the latest build at time for athena. build 17944. this build was awesome on my hermes and should also be for athena. only real problem in my rom is battery. the rest are realvga issues. good luck in ur rom cooking ventures.
Pawel062 said:
rom aint bad. i choose 2.19 because its the latest build at time for athena. build 17944. this build was awesome on my hermes and should also be for athena. only real problem in my rom is battery. the rest are realvga issues. good luck in ur rom cooking ventures.
Click to expand...
Click to collapse
thanks for the kind words
The more choices the better for EVERYONE! Sweet bro!
irus,
Which kitchen tool are you using to cook your rom? I would also like to cook my own, but not sure which tool is for Athena.
you'll find every thing you need.
http://forum.xda-developers.com/showthread.php?t=320338
And the roms just keep on coming.....
Nice option.....Good luck
Later.......
irus said:
you'll find every thing you need.
http://forum.xda-developers.com/showthread.php?t=320338
Click to expand...
Click to collapse
I'm aware of this thread, but I thought the tools there were for Trinity only. Am I wrong to have assumed that?
nice rom with nice aplications, thanks
eaglesteve said:
I'm aware of this thread, but I thought the tools there were for Trinity only. Am I wrong to have assumed that?
Click to expand...
Click to collapse
u can use it to extract rom from x7500
dump the os
I followed the manual and tried to dump the os.nb from the official "Advantage_HTC_NLD_2.21.404.1_1.50.00.00_Ship" rom. But I get the following errors. What am I doing wrong?
C:\ROMDonalds\02-Dump>dump os.nb
NBSplit 2.0 RC 2
Done.
ImgfsFromNb 2.0 RC 2
Searching for IMGFS start...
Found IMGFS at 00666668.
Dumping IMGFS at offset 00666668 (size 04666658)
Done!
ImgfsToDump 2.0 RC 2
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 00006A3C
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: FFFFFEFE
dwNextHeaderBlock: 00000000 (size: FFFFFE00)
Header type: 00000270, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 004C006C, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 000002A4, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 000002D8, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 0000030C, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000340, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 00003608, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00630061, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
Kan C:\ROMDonalds\02-Dump\imgfs.bin niet vinden
Done. The files are in "dump" folder
C:\ROMDonalds\02-Dump>
just redownload the rom and go from there
Thanks for this rom.
I know PK's rom is at the cutting edge of whats available, and whilst i like what it is capable of and am currently using it, its too unstable/buggy for me and i now realise that i prefer stability over the the extra's pk offers, so its time to reflash to your rom for now
Thanks
Mosser, if you have and questions or bugs please report both to this thread. thanks
I certainly will if i find any problems, have only been running it for about 6 hours so far, but it is ver fast, and is stable so far, the good thing is that everything seems to just work as it should, I miss the 96dpi though, but wouldnt give up battery life and stability for it
you can use real vga on this rom. there are a few bugs but it seems to work for the most part.
Related
ok, Been struggeling for 2 days getting my new Imate back to life after it started showing the "Serial" death screen trying to upgrade it to O2 new rom.
I tried everything using the USB cradle and also using the SD way and my other good Imate...... As soon as I insert the SD in the dead Imate after packing it with the ROM from the good one it tells me "section=1 not allowed!" were as it is mentioned here in the forum it shold tell me "press power to upgrade".
I noticed that this new one has a bootloader ver 1.06 which is not refered to anywhere in this forum.
Any ideas?
sd cards usually only work for the same bootloader.
the trick is to put a 1.06 header on your sd card.
what you can do is this:
- first using your 1.06 bootloader create an sdcard with your bootloader,
by connecting your xda to a terminal program ( either via USB, or seiral )
then type 'd2s 80000000 40000'
this will write your bootloader to SD.
- then make a raw image copy of this sd card, using psdread
* insert the sdcard in a working xda2, put it in it's cradle, and type:
psdread -3 0 0x40400 bl106.img
- then create an sd image of the correct rom, in your working xda2.
from this image, replace the header part of the first sector of the
sdcard with the header from the bl106.img.
the header is the first 0x180 bytes.
psdread -3 0 0x200 os-header.img
* use hexeditor to replace the first 0x180 bytes of this file.
and write it back:
psdwrite -3 os-header.img.
then your sd card should work with the new bootloader.
btw, I am very interested in a copy of this bootloader. can you send me the bl106.img file?
Thank You
itsyou,
I Thank you tons for replying back... will give it a shot and will let you know the outcome.
As for the Bootloader Copy, I only have 2 SDs 512 & 256. I have no problems with bandwidth let me know where to dump it for you and I will do it promptly.
:wink:
now that I looked again at ur expalnation I find it very difficult for me to do.
Wouldnt it be easier to just flash my good XDA with the new bootloader then do a full sd image from that one and run it into the bad one? if this would work then fine if not pls find below some questions:
- first using your 1.06 bootloader create an sdcard with your bootloader,
by connecting your XDA to a terminal program ( either via USB, or seiral )
then type 'd2s 80000000 40000'
this will write your bootloader to SD.
DONE
- then make a raw image copy of this sd card
How
using psdread
* insert the sdcard in a working xda2, put it in it's cradle, and type:
psdread -3 0 0x40400 bl106.img
where to type that? in cmd prompt? if so; I did that, windows gave me an error related to a 16bit application encountered error (am using XP)? while Active sync is on? in mtty? Is this the SD card the one i did above or a formated one
- then create an sd image of the correct rom, in your working xda2.
from this image, replace the header part of the first sector of the
sdcard with the header from the bl106.img.
the header is the first 0x180 bytes.
psdread -3 0 0x200 os-header.img
Not clear
* use hexeditor to replace the first 0x180 bytes of this file.
and write it back:
psdwrite -3 os-header.img.
psdwrite ... is that a hex editor I can find somewhere
where to type that? in cmd prompt? if so; I did that, windows gave me an error related to a 16bit application encountered error (am using XP)? while Active sync is on? in mtty? Is this the SD card the one i did above or a formated one
psdread is a desk top windows command line tool, found in this archive.
you already know how to make an sdcard with os image. - type 'd2s' to your bootloader.
from this sd card you copy only the first sector with
Code:
psdread -3 0 0x200 sd-sector.img
then replace the header in this file.
this is an example of what the first 512 bytes look like:
first the part that needs to be replaced:
Code:
0000000: 4849 4d41 4c41 5941 5320 2020 2020 2020 HIMALAYAS
0000010: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
0000020: f622 919d e18b 1fda b0ca 9902 b972 9d49 ."...........r.I
0000030: 2c80 7ec5 99d5 e980 b2ea c9cc 53bf 67d6 ,.~.........S.g.
0000040: bf14 d67e 2ddc 8e66 83ef 5749 61ff 698f ...~-..f..WIa.i.
0000050: 61cd d11e 9d9c 1672 72e6 1df0 844f 4a77 a......rr....OJw
0000060: 02d7 e839 2c53 cbc9 121e 3374 9e0c f4d5 ...9,S....3t....
0000070: d49f d4a4 597e 35cf 3222 f4cc cfd3 902d ....Y~5.2".....-
0000080: 5341 3030 e1dc d6ae 8390 49f1 f1ff e9eb SA00......I.....
0000090: b3a6 db1e 870c 3edd 24eb 0d1c 06b7 47de ......>.$.....G.
00000a0: 8412 4dc8 43c3 cba6 1f03 5a7d 0938 251f ..M.C.....Z}.8%.
00000b0: 5d9f d4fc 96f5 453b 130d 890a 1cd3 902d ].....E;.......-
00000c0: 489a 50ee 4078 36fd 1249 32f6 9e81 49dc [email protected]
00000d0: ad4f 14f2 4440 66d0 6bc4 30b7 bec6 ff42 [email protected]
00000e0: 5455 9a6a 2215 d1e1 9038 3238 d93f 7c66 TU.j"....828.?|f
00000f0: 5e03 d8c0 9c91 d971 9f69 a5e2 0c99 9247 ^......q.i.....G
0000100: fa16 bb11 adae 2488 79fe 52db 2543 e53c ......$.y.R.%C.<
0000110: 1870 92da 6454 ceb1 853e 6915 f846 6a04 .p..dT...>i..Fj.
0000120: 9673 0ed9 162f 6768 d4f7 4a4a d057 6876 .s.../gh..JJ.Whv
0000130: fa16 bb11 adae 2488 79fe 52db 2543 e53c ......$.y.R.%C.<
0000140: f445 d3d8 28ce 0bf5 c560 593d 9727 8a59 .E..(....`Y=.'.Y
0000150: 762d d0c2 c9cd 68d4 496a 7925 0861 4014 v-....h.Ijy%[email protected]
0000160: b13b 6aa5 1128 c18c d6a9 0b87 978c 2ff1 .;j..(......../.
0000170: 151d 9a95 c19b e1c0 7ee9 a89a a786 c2b5 ........~.......
this part you need to keep.
Code:
0000180: 4854 4353 3830 3034 3030 3030 3031 4538 HTCS8004000001E8
0000190: 3030 3030 4238 3042 4546 4246 fe03 00ea 0000B80BEFBF....
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001d0: 0000 0000 0000 0000 0000 0000 4543 4543 ............ECEC
00001e0: 04c9 0d80 0000 0000 0000 0000 0000 0000 ................
00001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
use any hexeditor you like.
most will allow you to cut/past from one file to the other.
make very sure that at offset 0000180 it says something that starts with 'HTCS80040000'
otherwise you may accidentally overwrite your bootloader, and permanently damage your device.
after you have modified the sd-sector.img file, write it back to the sdcard
containing your os image with
Code:
psdwrite -3 sd-sector.img
.
both psdread and psdwrite can be found in the itsutils.zip archive, and are descibed here and here
itsme,
followed ur kind instructions to the letter and all went smooth with no errors what so ever till I started to write back the image to the bad XDA and it gave me the freaken same error (find below)
SD Download
===========
Section=1
Not allow
update!
I started loosing hope in this thing.
I am attaching here the bl106.img file as per ur request hope it helps you and anyone else in the future (is that what u want, if not let me know what exactly u need before i send this bad one to the shop for fixing)
Best regards.
Note: i noticed in the step where am supposed to replace the first 0x180 bytes that both headers form both images ar the same...I think...maybe am wrong thus i still replaced them as per ur instructions.
(my good xda has ver. 1.02 bootloader)
this is a bootloader v1.02 you uploaded here.
I assure you that this file was dumped from an xda2 which says ver. 1.06.
Although I already sent the Device for fixing I still have a whole flash dump to the deffective device on my HD. gemme an address where I can upload it to and I will do promptly.
Thanks again for all the help you gave me.
ftp.xda-developers.com
user xda
pass xda
file (raw image) of defective device being uploaded :wink:
Am supposed to get a replacement for this device in a week time. will post u a note case it has a 1.06 ver again.
just out of curiosity
who in Egypt jandles service of the XDA II ??
just in case!!
No one :?
I have been relaying on Dubai for that matter.
I did find the 1.06 bootloader in the 1.66.167 upgrade.
OH MAN! are you telling, had I waited one more day b4 sending it to Dubai I could have used this upgrade to do the trick?
How about in the one I uploaded, which version was embeded in the raw image?
still only the 1.02 version.
I don't think the 1.06 bootloader would have helped.
itsme,
Looking at the bright side of things, I now should not regret sending the busted xdaII back for exchange then.
Thank you very much for all the help you gave me. it only shows what a gr8 community this is.
PowerLOC Destinator problem with XDA II new ROM:
Hi,
Destinator problem with XDA II ROM:
ROM-1604eng
ROM-16036wwe
ROM-v16050
ROM -16021wwe
ROM-16052ger
All these ROM versions has the same problem, The PowerLOC Destinator can not find com 5, if I use the Pocket Blue Tools patch the freeze in com 7.
The only way I find to use the PowerLOC Destinator in the XDA II is with the Rom version 1.03.00 wwe_o2 asia together with the Pocket Blue Tools.
Somebody suceed using the PowerLOC Destinator with new Rom?
Best,
Dias
My Destinator works fine with bluetooth patch and 1.66.00WWE ROM. Don't know what your problem could be, other than not doing things in the finicky order the XDA II requires with BLuetooth.
I saw this note in Default_Driver.CAB of the 1.66.131 extrom.
; Change DUN port from COM5 to BSP4.
[HKEY_LOCAL_MACHINE\ExtModems\bluetooth_dun]
"port"="BSP4:"
maybe it is related?
What is this file ???
Is it aku 3.3 in english or russian????
-----------------------
MODERATOR EDIT:
Changed the subject, use this as the main thread to discuss HTC 2.05 WWE AKU 3.3 ROM issues.
Download and ROM details in the wiki:
http://wiki.xda-developers.com/index.php?pagename=Hermes_Upgrades
BE SURE TO READ THE WIKI BEFORE ASKING QUESTIONS PLEASE
English.
If you need Russian one look for it in Upload/Temp directory
It is in English, I just flashed it using 1.10mfg method
An still no MUI I presume ?
What Where Who Its New The Wwe Version?
Plz Give The Link And Why Dont You Say Anything?
bubu23 said:
What Where Who Its New The Wwe Version?
Plz Give The Link And Why Dont You Say Anything?
Click to expand...
Click to collapse
ftp://ftp.xda-developers.com/Uploads/Hermes/
Here you have.
BuT WhY TyPinG LikE ThAt ! Are YoU PaRkInsOn ?
Is it from HTC or cingular? I've heard both are about to release an AKU 3.3 rom
loll no im not parkinston maybe my keboard is
but why the file finish with test?
its not good its just test???
plz tell me im horny on that fileee(rom)
English confirmed.
Just flushed OS and Ext rom.
ROM Version:2.05.255.1
ROM Date: 01/17/07
ExtROM Version: 2.05.255.101
OS 5.1.461 (build 15671.3.3.0)
I can't get to FTP :/ what user and password ?
reg
Sar
Username = xda
Password = xda
You get to the ftp by this link no pass needed...
ftp://xda:[email protected]/Hermes/
Cheers
Seems very fast...
cant see where it says TEST though. My of been a test for the carriers, so likely the RTM for the carriers to then implement.
So far, so good... at least this one is english, unlike the Swedish update i did yesterday
in the ftp thers only the swedish rom i cant find the wwe rom??
RUU_Hermes_2.05.263.1_6275_1.34.00.10_108_SVE_HTCEUR.exe is now up... Guessing it is an official release from htc?
Cheers
Well i flashed it also.
the Test is included in the splash.bmp. =)
really... But imho the swedish one is a bit faster, but that is just subjectiv i didnt tried to test it with a benchmark program.
btw. any update from cingular?
Somethings fishy about this.
This is supposed to be AKU 3.3, but theres no WPA2 support???
not sure this is a complete ROM?
Does this mean MS Voice Command over bluetooth is fixed without the hacks?
I have detect problems with this rom! Is better wait for another!
Problems detect:
- No wpa2
- Phone connection always breaking down
- Can't go to my contacts!
- ActiveSync always says pocket is out of memory (yes I reset several times)
Flash Using Lnb
This is my first time flashing using lnb and i followed the wiki about using mtty..i just wanted an experimented persons to examine the output of mtty and tell me if the update was perfectly done and if there was no problems in nand please...
Thanks
Iverson....
USB>
USB>task 32
Level = 0
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 461
Storage Total block: 475
Total Bad Block in CE: 0
NeedToEraseBlockStart: 474
Storage format success
USB>lnb 06_OS.nb
:F=06_OS.nb
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 501A0000 Length: 3C0C800
*********************************************
*********************************************
*********************************************
*********************************************
*********************************************
*********LAST BLOCK, dwBytesCollected=0x13800
Code entry point at 0x53DA0000
Write Nand Success
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 473
Storage Total block: 463
Total Bad Block in CE: 0
NeedToEraseBlockStart: 486
Storage format success
USB>
Needed tools:
PuTTY ver.6 or above
Plink
Active Sync 4.5
any Hex editor
MTTY1.exe ver 1.11a
Windows PC
SPL 2.30 Olipro
SPL 1.01 MFG pack
SPL 1.10 Oli w/custom RUU
SPL 1.04 w/custom RUU
DUTTY'S Good .NB Tool
Win Rar
Hermes with working wlan
There are steps for the user with the device with the working wlan eeprom, and steps for the user with the device with the corrupted or missing wlan eeprom. Basically what you will be doing is cloning the MAC of a device with a working wlan, editing it, and flashing it to your device with the non-working wlan.
Steps for Working Wlan Device:
You need to get SPL Oli 2.30 (found on the XDA DEV FTP Site in the HERMES/HardSPL folder) on the working device. You can do this by following the downgrading bootloader page at:
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
Assuming you have HardSPL v7 on your device (as most of you have been doing upgrades and downgrades), follow the steps to downgrade to Oli 1.10 then to SPL 1.04, (read and execute carefully)
then use DUTTY'S Good .NB Tool...
http://forum.xda-developers.com/showthread.php?t=296311
...to convert the SPL Oli 2.30 .nb file contained in the .rar you downloaded (use WinRar to extact) to an .nbh file (RUU_signed) THEN flash SPL 2.30 (you can use the same custom RRUwrapper you used to flash to 1.04 by putting it in the same folder, but move the RUU_signed.nbh of 1.04 to another folder first, then put it back when your finished)
Download PuTTY and Plink and copy them into your C:\Windows\Temp folder
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
Put your device in bootloader mode and disable USB connections in Active Sync
Connect to the PC and open PuTTY
Click SERIAL, and make the speed 115200, and type \\.\WCEUSBSH001 (all CAPS) in the space for SERIAL LINE (overwrite what is there) or connect with MTTY first...
http://forum.xda-developers.com/download.php?id=9864
... and copy and paste the address into PuTTY then close MTTY. Type HERMES into the space named SAVED SESSIONS and hit SAVE. Hit OPEN. Press ENTER to get a CMD prompt...you will see a green cursor. Type Task 32 and it will return Level=0. Ok, close PuTTY as you have verified that it's working.
Sometimes your device will be seen as \\.\WCEUSBSH002 or \\.\WCEUSBSH003, just use which ever it connects to.
Now the next bit is tricky because you you will do it "blind" as in this mode, Plink does not have local echo so you won't see what you're typing.
Go to START/RUN/CMD
This opens a DOS window. Change directories to C:\Temp and type the following:
plink HERMES > herm1.nb (hit ENTER TWICE) (you will see the new file herm1.nb written in your Temp folder) (notice the spaces before and after the > sign)
Now type the following and hit ENTER (once) after each command:
task 32
password 0000000000000000 (that's 16 zeros)
set 1e 1
rbmc me.txt 500a0000 40000
that will copy the wlan section of the eeprom nand to the file called herm1.nb. You can right click on the file, select properties, and see that it grows to 256k-257k.
When it's done creating the file (to 256k or 257k, you'll see it doesn't get any bigger), press CTRL C in DOS to close plink and it saves the file at 257k size.
Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
Now, since you've basically cloned another's MAC address (already allocated to another device), it's necessary that you change your MAC address ASAP. Instructions on how to do that below:
In the edited herm1.nb file, go to the MAC Address at offset 0001F850 and change the 2nd, 3rd and 4th bytes from the right... (it's your MAC address in reverse), to ANY numbers you like, keeping the same format. This 6 byte sequence is your NEW MAC ADDRESS. The last 3 numbers of the MAC (which appear in opposite order) can be "invented".
You now have the eeprom flash file to be transfered to the non working device...
Steps for Non-working Wlan Device:
Using the methods on MrVanx's downgrading SPL page...
http://www.mrvanx.org/cms/index.php?option=com_content&task=view&id=59&Itemid=27
...downgrade again to SPL 1.04, then flash SPL 1.01 MFG. When flashing and using SPL 1.01 MFG, some users suggest you only use the version of MTTY that comes with the MFG Pack.
http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG
Read the full instructions before flashing.
Ok, now that you have verified that you have SPL 1.01 MFG on the device, put in bootloader mode, disable USB connections in Active Sync. Connect the device and open MTTY. Make sure you have copied your herm1.nb file into the same folder as MTTY.
Connect to the device (\\.\WCEUSBSH001)
and hit ENTER to get a CMD prompt
Now type the following:
task 32
password 0000000000000000
set 1e 1
lnb herm1.nb 500a0000 40000
Hitting ENTER after each command.
When it's done, close MTTY and reboot your device and verify that your Wlan is now working...
Then I recommend flashing HardSPL v7 or SPL 2.30 to your device right away (because you know you won't leave your device alone and we don't want you bricking your Hermes, do we?)
BTW, if you want to do a full backup of you FULL eeprom nand at any time, connect as before and type these commands:
plink HERMES > full.nb (hit ENTER twice)
task 32 (hit ENTER once and only once from now on after every command)
password 0000000000000000
set 1e 1
rbmc me.txt 50000000 7fff800
watch your file grow to 128 MB.
If you ever need to flash the entire eeprom nand, just edit it as above so you take out the commands you typed (HTCS-HTCE) and you're good to go...
Thanks go out to Pof and Olipro for doing the initial research on this issue. And also to members Laikos and Panzer who helped tremendously.
Tested on Cingular 8525 Wm6 VP3G modified AT&T rom, and Orange m3100 WM6 cooked rom based on Dopod 3.54.707.3 rom.
*NOTE* Olipro just posted later in this thread
"just to point out guys;
to flash 2.30.Olipro, just convert it into an NBH then run SSPL on your phone and go ahead with the flash, same goes for loading any other SPL, just load SSPL first (or use Custom RUU with the NBH and select force SSPL) the downgrading is unnecessary"
another member (dan1967) suggested that one only have to use SPL 2.60 Oli Hard SPL v9 Developer Edition to do this procedure and one can avoid the upgrading and downgrading of bootloaders...
Member alakentu has translated this method into Spanish. The thread is here:
http://forum.xda-developers.com/showthread.php?t=364751
***DISCLAIMER.....TRY AT YOUR OWN RISK, WE ARE NOT RESPONSIBLE FOR ANY MALFUNCTIONS OR OTHER ISSUES THAT MAY OCCUR.***
For those of you who used my guide to fixing your dead Wlan on Hermes, please feel free to make a donation via paypal if you feel I've helped you in some way. Any amount will be very much appreciated, and I could really use the cash, hee hee, thanks in advance. Just click the PayPal Logo below to donate.
cool !! I try this if i found a phone with no dead wlan
nice.........
It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.
Would it be possible for someone to extract the eeprom file from a working wlan device, "zero-out" the MAC address portion, or replace with 'FF' or some other 'dummy' value, and post this here, so those of us without access to a working device can use to flash our damaged devices?
By "blanking-out" the MAC address in the attached file, you dont risk having your MAC address used by everybody, so there is no "legal" risk, and help us without a working device to fix ours...
Thanks for the solution guys and hopefully you can post the file here for us to use.
Good work !!
Thank you very much for this solution !!!! Great job!
But as said chrisvor, could you post an extract of a working Eeprom for thoose who don't have one please...
Thank you !
drummer,
first of all is to say thanks to you all who put in their time and effort in resolving this problem
so my question is... can you post the file of working wlan bit for us, without that i can't solve this problem... =(
Thanks!!!
Thank you so much for this!!!!
I will try to reviving my X01HT WiFi later!
Great Job!!!!
Someone has repaired his hermes ??
nicoebra said:
Someone has repaired his hermes ??
Click to expand...
Click to collapse
I did. And so did Laikos. Actually, he fixed his about 20 minutes before I did, he is a better editor than I am. Why do you think we did the research? We both had devices with non-working wlans, and now they're working again.
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.
laikos said:
It's possible to just hand code the WLAN EEPROM Value to your dead WLAN EEPROM too. Download your dead EEPROM and Edit the location mentioned by drummer.
Warning: It took about 30 mins to hand code the WLAN EEPROM DATA.
Click to expand...
Click to collapse
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...
pop20032004 said:
I don't believe that this is a good idea, as you don't know what else (from EEPROMcode) is corrupted!!
The MAC address is the only visible part to us...
Click to expand...
Click to collapse
How did you come to that conclusion?
All Laikos was suggesting, is you could type in the data, rather than replace the data by "cloning" it from another's device. Once you know the offsets, which you do if you read this technique, it's quite easy, although time consuming. So far, each file we have examined have had the identical wlan signatures, and identical first three numbers of the MAC address. That suggests that HTC was assigned a set of MAC addresses by OUI for their use.
BTW, using SPL 2.30 oli, you can change your backup CID, and model number (Hermes 100, 200, 300, or whatever you want to change it to like "Hermes 911").
Help
I believe that would be better than someone give the instructions detailed for those that they do not have other device to the hand to extract the EEPROM, extract your corrupt EEPROM and edit it.
In my case, live in Mexico city and these devices are extremely rare of seeing by here.
As soon as if someone can help me to obtain the file of a EEPROM will be I thanked what is.
Open the file in a Hex Editor, and remove all the non usable Hex Data (basically the commands you typed) between offsets 00000000-00000140 up thru the Hex equivalent of the word HTCS. Delete the data so that you actually delete the word HTCS. Then at the end of the file, offset (00040000), delete from the very end of the file (right to left) thru the word HTCE. You delete the Hex equivalent of the word HTCE. You can leave the D+ ] there as we're only going to write 40000 bytes. Now the now MAC address is at ROW 0001F850 with two bytes at row 0001F860. The MAC reads backwards. Save it as herm1.nb (but not in the same folder as the original).
i can't edit file " herm1.nb"
you can guide again or help me to edit my file.
Hello,
Is it normal that my file herm1.nb is rained large that 30Mo at the time of that creation, thank you.
-------------
Edit:I excuse myself I have to make an error the first handling, I succeeded in having the file herm1.nb has 256 Ko (262 ' 439 bytes).
If I do not modify the mac address that you it will occur on the other apparatus, thank you
drummer10630 said:
...and no, we're not posting, or sending anyone the file. You have to find a friend that will help you, as your trust in each other will safeguard against any possible mis-use of this technique.
Click to expand...
Click to collapse
@drummer10630: I do appreciate all your and Laikos efforts to solve this problem and to let the whole community know the method so everybody can fix their devices... however, the reason I asked if anybody could post the file was not a sign of "laziness", rather it is due to the lack of friends who have a TyTN or who want to void their warranty by flashing a non-official bootloader in order to "do me the favor" of extracting their eeprom data.
If any of you guys have extracted the eeprom and you have edited it to include your MAC address, could you please edit a COPY of this file, put "FF" in all the bytes of the MAC address (which is the only thing that "ties" this file to your purchased device and hence yourself), and post it here for us "tytn-friend-less" people to use?
Many thanks for EVERYBODY's efforts in solving this
Thanks and kudos go to Pof and Oli ofcourse, due to whom none of this would be ever possible !!
Chris
I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?
jrp said:
I have tried to get the code from a working Vario II using Des' SSPL, to avoid all the flashing of a working device, but got
Code:
USB>task 32
Level = 0
USB>password 0000000000000000
HTCSPass1.
CMËHTCEUSB>set 1e 1
USB>rbmc me.txt 500a0000 40000
GetExtRomData+(): *pszPathName=me.txt, dwStartAddress=500A0000, dwLength=40000
USB>c=40000
... and no dump.
Is there a workaround?
Click to expand...
Click to collapse
According to the #1 post, you HAVE TO follow the instructions, i.e. downgrading to SPL 1.04, 1.01 MFG, Olipro 2.30, in order to save the eprom from the working device.... no shortcut I'm afraid
I removed the lines 00000000-00000140
But I do not have information with the line 0001F850 and 0001F860 is this normal? , thank you.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Quick question.... Could I dump the WLAN eeprom from a Wizard? Dont think so, but I thought I'd ask since I have a wizard lying around too....
Are there any step for step instructions, either on a web site or in a downloadable PDF that detail how one can cook their own athena ROMs?
Such a thing would be a big help to all those that would like to try cooking their own ROMS..
I have found some instructions but they are old and are for other devices mostly running WM2003se or WM5. It would be goo to have an updated one for WM6 and the Athena.
Madhadder said:
Are there any step for step instructions, either on a web site or in a downloadable PDF that detail how one can cook their own athena ROMs?
Such a thing would be a big help to all those that would like to try cooking their own ROMS..
I have found some instructions but they are old and are for other devices mostly running WM2003se or WM5. It would be goo to have an updated one for WM6 and the Athena.
Click to expand...
Click to collapse
How about over in the Hermes forum? (Not trying to me a [email protected]$$..)
toyfreak said:
How about over in the Hermes forum? (Not trying to me a [email protected]$$..)
Click to expand...
Click to collapse
search for "rom donalds", its a guide for hermes written by myself and Bennec83 that aims to teach you the basics of cooking and give you and understanding of why and how you do things, not just do it
Nice explanation and good instructions. Is there a version that works for the Athena? I only got as far as dumping the os.nb. It must be a diifferent offset or addresses, or something with the imgfs.. it states
NBSplit 2.0 RC 2
Done.
ImgfsFromNb 2.0 RC 2
Searching for IMGFS start...
Found IMGFS at 00666668.
Dumping IMGFS at offset 00666668 (size 04666658)
Done!
ImgfsToDump 2.0 RC 2
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 00006494
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: FFFFFEFE
dwNextHeaderBlock: 00000000 (size: FFFFFE00)
Header type: 00000270, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 004C006C, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 000002A4, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 000002D8, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 0000030C, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000340, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 00003608, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00630061, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
it creates and Deletes the following files
OS.nb.payload
OS.nb.extra
imgfs.bin
it creates an empty dump_MemoryMap.txt and no dump folder.
Am i doing something wrong
ATHENA.. Not HERMES, guys.. while there maybe many simularities between the devices when cooking ROMS, some important steps are not correct for the Athena, thus the guides need to be updated.
basically the differences are:
dont use nbsplit at all and use the '-nosplit' option on all imgfs programs
Midget_1990 said:
basically the differences are:
dont use nbsplit at all and use the '-nosplit' option on all imgfs programs
Click to expand...
Click to collapse
thanks Midget_1990..That works great..
I knew you would know the answer!
guys the trinity tools dont work on athena. the tools we use for wizard and uni do. now to those that do wanna cook get ready for late nights and lots of anger. the athena's rom is partioned so the os.nb is a fixed size. if u dont overload it the rom will boot and everything will be ok. if u do then the rom wont work and ur device will not turn on. with the athena adding stuff is hit or miss. some stuff wont go in bc theres a real big file. it aint easy i can tell u that but if u want to try it go ahead.
Pawel062 said:
guys the trinity tools dont work on athena. the tools we use for wizard and uni do. now to those that do wanna cook get ready for late nights and lots of anger. the athena's rom is partioned so the os.nb is a fixed size. if u dont overload it the rom will boot and everything will be ok. if u do then the rom wont work and ur device will not turn on. with the athena adding stuff is hit or miss. some stuff wont go in bc theres a real big file. it aint easy i can tell u that but if u want to try it go ahead.
Click to expand...
Click to collapse
Yes be careful people and good luck. This one was a surprise to us...but then again, no one knows it all and it's fun to learn new things.
How abou just edit ext ROM.. can I do the same way as universal?? Or still unsolved?
Thanks
I would ask all active members to upload or share their collection of roms for Hurricane. I bricked my hurr 2 years from now and yesterday i got one so i would like to try as many roms as possible, and it will be great for all to share roms!!! I found several on this forum (lazaj's, saleng's, shadow's) but i think that there is more!!! So share your collection!!!
Here i found some on forum:
hurricane unlock, patch and upgrade wm 6.1(selang09) ***
Link: http://www.megaupload.com/?d=JLO5H1L7
Thread: http://forum.xda-developers.com/showthread.php?t=475286
Opinion: Good one, but chinese language everywhere! After u change main lang. still some apps name stay in chinese and options too!
wm6.1 for hurricane (with Bluetooth and INFRARED RAY problems solved)0415update!!!
Link: http://rapidshare.com/files/100934508/5x6_wm6.1_0319.rar
Thread: http://forum.xda-developers.com/showthread.php?t=378607
Opinion: Didn't tried!
WM 6 Graphite rom, how to get WMPlayer in English (now in Polish)
Link: http://rapidshare.com/files/108676266/wm6_2_2.zip
Thread: http://forum.xda-developers.com/archive/index.php/t-384972.html
Opinion: Using this one right now! Seems ok, works nice, nice look, except incoming calls didn't show up!!! Very bad bug!
Wm 6.1 Pl/eng
Link: http://rapidshare.com/files/131860280/wm_6_1_by_Lazaj007.zip
Thread: http://forum.xda-developers.com/showthread.php?t=410739
Opinion: Tried before Graphite eng edition, works great, looks great... Main lang polski, after lang change WMP stay in polski! But still ok!
WM6 for SPV C550
Link: http://rapidshare.com/files/56833250/566.zip
Thread: http://forum.xda-developers.com/showthread.php?t=330709
Opinion: Never tried!
And one pack with SPL 1.00.84 & soft spl (nb, nbf), IPL 1.00.15, GSM DATA (hex and dec), bootloader commands, splsplit... etc!
Link: http://rapidshare.com/files/427352270/data_hurricane.rar
Info: This last files can help u to unbrick your hurricane (BUT AVOID TO BRICK IT), i found it on pda2u.ru , and thanks them for that! Special thanks to member SAXON!
I found many links for ROMs but those which is here have alive links! Someone with good upload speed can reup them again in one pack and post a link here!
ENJOY!
I would like to have a non T-Mobile German version (can be a shipped ROM). Have not found any yet, only those that are available at www.shipped-roms.com Have to live with de-branding this as it seems.
Possibly someone with any of the following devices can do a "r2sd all" backup of the ROM?
imate SP4M
Orange C550
Qtek 8200 (the Russian/English is available as RUU)
Thanks for this link tobbbie !
Btw, in selang's rom SMS Send don't work! So, it is useless!!! :S
I have tested all ROM´s below for SDA II, but for me lazaj007 is the best of all
Thanks to lazaj007
Did anyone care to pick up some ROM cooking for that device? I did not succeed in getting the .BIN files manipulated correctly - and I think I have a collection of nearly all ROM tools now :-(
howto convert .bin to .nb0 and back
Foreword:
.BIN files are not all the same by their nature (of course not by content). There are
.bin that are used to identify the bare binary content of the various partitions (you mostly see those)
.bin that are used to flash a ROM to the device. This looks somehow historic though, the format is already described by itsme at: http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html. It seems to me that some non HTC devices are still using this format.
The osnbtool.exe (from Weisun at PDACLAN.COM) does not work for any purpose regarding .bin files
at least not for Hurricane.
- The -sp option cuts only the B000F\0a header but does not reconstruct the blocks of the .bin file.
Mind that small .bin files (smaller than 0x1c00000) are treated correctly as there is only one block.
- The -2bin option creates an incorrect .bin header (sets a weird total length) and sets totally confused
block-load addresses for the created blocks of 64k (0x10000) size. Check it with viewbin.exe if you like.
Reference for the filestructure by itsme:
http://www.xs4all.nl/~itsme/projects/xda/wince-flashfile-formats.html
The splitrom.pl (itsme romtools) seems not be able to read the content of any .bin file I have fed to it.
Neither for .BIN files created for Hurricane nor those for Typhoon, I always get:
cmd> splitrom.pl <binfile>
B000FF image: 82040000-84c40000, entrypoint: 00000000
!!! your rom is not known to me: md5: a520f0d1093b36f0a3cfd9323ea99155
this bootloader seems to be No bootloader present
no xipchain found
no bootloader found
no operator rom found
no bitmap found
I am rather sure it should handle everything correctly but I am too stupid to debug .pl :-(
So the only thing that works and will re-create a flash-able .BIN file from a .nb0 is listed below:
convert .bin to .nb0:
enter: viewbin -r <binfile>, you get something like:
Image Start = 0x82040000, length = 0x02C00000
Record [ 0] : Start = 0x82040000, Length = 0x01C00000, Chksum = 0x00000000
Record [ 1] : Start = 0x83C40000, Length = 0x01000000, Chksum = 0x00000000
Record [ 2] : Start = 0x00000000, Length = 0x00000000, Chksum = 0x00000000
Start address = 0x00000000
The above has two blocks of data and a termination block.
The checksum = 0 effectively disables upload checking (so potentially dangerous).
The size just fits the Hurricane's SPL "l" (load) command buffer, as you get when loading a ROM:
"clean up the image temp buffer at 0x8C080000 Length 0x01C40000 "
The blocks can be smaller than 0x1c40000 but not bigger obviously.
then convert to nb0, enter: cvrtbin.exe -r -a <imgstart> -l <length> -w 32 <binfile>
for above viewbin output: cvrtbin.exe -r -a 82040000 -l 2c00000 -w 32 <binfile>
mind to omit the 0x for the start and address, replace <binfile> with your filename, then you get a resulting file from <original-name.bin> to <original-name.nb0> which can further be decomposed and edited with standard ROM tools
convert .nb0 to .bin:
enter: xipbin.exe <input.nb0> <start-in-nb0> <output.bin> <loadaddress>
to get back something flashable like above: xipbin.exe <input.nb0> 0 <output.bin> 82040000
mind to omit the 0x for the loadaddress, replace <"file"> with your filenames
to recheck if the created BIN file is usable, startup the viewbin again
enter: viewbin -r <binfile> you now get something like:
Image Start = 0x82040000, length = 0x02C00000
Record [ 0] : Start = 0x82040000, Length = 0x00040000, Chksum = 0x0208CC79
...many entries deleted...
Record [175] : Start = 0x84C00000, Length = 0x00040000, Chksum = 0x0177FB3C
Record [176] : Start = 0x00000000, Length = 0x00000000, Chksum = 0x00000000
Start address = 0x00000000
Done.
Looks quite different - but this is ok! The loading process in MTTY indocates the loading of each above block with a sequence of |*, so with these many blocks the upload to the device is giving feedback and thus is not tempting people to interrupt it.
I have done my tests with the 566.zip linked in the first post of this thread, but this should work with any .BIN file from the other ROMs as well. So I will continue to see if I can recycle any of the WM6 Roms for inserting my imgfs created for Tornado. As before the imgfs still the XIP is loaded and I know too little about this yet (especially in connection to the imgfs and how close these two are linked) - I am prepared to see non booting device states quite a lot. Luckily there is nothing done to the early boot chain (IPL and SPL) so I can always get back to the bootloader and start over again.
I hope to get a first indication that imgfs is mounted correctly in the "old" XIP before I have to replace the OEMdriver parts in my Tornado ROM.
I just checked if I can still use this flash-method for the Tornado - and it works as well. So the created "os-new.nb" in the OUT directory can be converted to .BIN and then flashed inside MTTY with the "l" command. Not that I like this method - but it works as well.
Tobbbie, you have here a very good research! To bad this device is out of use!