ROMDump from XDA Comet - iPAQ rw6828, XDA Atom Software Upgrading

Hi
I have the new XDA Comet (same as XDA Atom Life) with WM6 in german.
I've dumped the ROM with pdocread. All you need is mamaich's imgfs tools to extract its contents.
Version is OS 5.2.1616 (build 18120.0.4.0) it's the same build like the english Atom Life WM 6 Rom, but maybe you'll build a german ROM.
Anyway, if someone is interested, here is the download link:
http://rapidshare.com/files/62060494/XDA_Comet_german.rar.html

---

hi scorpio16v,
thank you very much for the ROM dump. can you share how you managed itsutils to work with your xda comet?
i have tried various ways... only pdocread -l works on our Atom. other tools didn't work, and yes I have installed enbalerapi.cab before using the tools.
i'm hoping your solution would be similar to our Atom. if this will work, we can change bootscreen and pagepool without reflashing...
regards,
Jiggs
here's a dump of pdocread:
Code:
60.86M (0x3cdb000) MSFlash
| 1.24M (0x13e000) Part00
| 3.25M (0x340000) Part01
| 56.36M (0x385b000) Part02
43.99M (0x2bfd400) TrueFFS
| 43.99M (0x2bfc800) Part00
15.61M (0xf9c000) DSK2:
| 15.61M (0xf9bc00) Part00
127.50k (0x1fe00) DSK3:
| 127.00k (0x1fc00) Part00
STRG handles:
handle c3c31bba127.00k (0x1fc00)
handle 03f802ca 15.61M (0xf9bc00)
handle c3f80686 43.99M (0x2bfc800)
handle 63f957b2 56.36M (0x385b000)
handle a3f9578e 3.25M (0x340000)
handle 03f95666 1.24M (0x13e000)
disk c3c31bba
3 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 03f802ca
3 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c3f80686
3 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 f0 36 02 01 08 27 07 24 1a 0b 05 c4
disk 63f957b2
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3f9578e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 03f95666
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

---

As I said, I'm not very experienced in such thinks, it's not my own solution.
The way, I managed the dump, you can find posted by Oki in the Mio forum.
Here is the link:
http://www.miousers.co.uk/viewtopic.php?t=426&postdays=0&postorder=asc&highlight=pdocread&start=15
Hope you have success, because the output from pdocread -l is different to this from my Comet.
Code:
C:\itsutils\build>pdocread.exe -l
79.92M TRUEFFS
| 1.12M Part00
| 1.69M Part01
| 77.11M Part02
797.66M TRUEFFS
| 1.12M Part00
| 1.69M Part01
| 77.11M Part02
63.94M TRUEFFS
| 1.12M Part00
| 1.69M Part01
| 77.11M Part02
STRG handles: 23bd9a56
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
( 35.96M) 83f93f52
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
(796.88M) 03f931ca
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
( 77.11M) 63facfbe
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
( 1.69M) 83facf9a
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
( 1.12M)
C:\itsutils\build>
Just to make it comlete I attach the two other dumped parts. As I understand that must be the two XIP parts, right ?
But where are the ExtROM ? May be we must unhide it ?
Bootloader and Radiopart are also missing.
I think I could dump the rest with Haret, I hope so.
Parts_00_01

---

The Atom Life has a 36mb extended ROM image... this will give you a clue now.
Thanks for the mio lead. I'll try to check that out.

---

jiggs said:
The Atom Life has a 36mb extended ROM image... this will give you a clue now.
Thanks for the mio lead. I'll try to check that out.
Click to expand...
Click to collapse
yes, that might be this:
Code:
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
( [B]35.96M[/B]) 83f93f52
But I have no clue, how I can take access to this file.

---

Ok,
some times I need some more time to understand.
I've the damned ExtROM
At first I get the latest itsutils, not longer the old one, that I've used.
Code:
C:\itsutilsbin-20070705>pdocread -l
79.92M (0x4fec000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 77.11M (0x4d1c000) Part02
797.66M (0x31da8000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 77.11M (0x4d1c000) Part02
63.94M (0x3ff0000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 77.11M (0x4d1c000) Part02
1.89G (0x79280000) DSK1:
| 1.89G (0x79120e00) Part00
STRG handles:
handle c3face7a 1.89G (0x79120e00)
handle [B]03fc3fae[/B] 35.96M ([B]0x23f6400[/B])
handle a3f93f52796.88M (0x31ce0000)
handle 63f931ca 77.11M (0x4d1c000)
handle c3facfbe 1.69M (0x1b0000)
handle c3facf9a 1.12M (0x11fc00)
disk c3face7a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 03fc3fae
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
disk a3f93f52
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
disk 63f931ca
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
disk c3facfbe
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
disk c3facf9a
4 partitions, 3 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 67 28 02 01 03 13 14 5f 19 0b 06 98
This is the damned ExtROM. And that's the way I get it:
Code:
C:\itsutilsbin-20070705>pdocread -h 0x[B]03fc3fae[/B] 0 [B]0x23f6400[/B] Ext_ROM.raw
CopyTFFSToFile(0x0, 0x23f6400, Ext_ROM.raw)
I think you can get the other parts in the same way.
Now, I need some help to make this flashable for german Atom Life user.
Comet_ExtROM
You can open it with WinImage.

---

great! unfortunately, it did not work on my Atom. How do I know I have the latest version of itsutils?

---

jiggs said:
great! unfortunately, it did not work on my Atom. How do I know I have the latest version of itsutils?
Click to expand...
Click to collapse
You can download the latest version from "itsme's" page.
The latest is "itsutilsbin-20070705".
Link:
http://www.xs4all.nl/~itsme/projects/xda/tools.html

---

Hi scorpio16v,
Can you post the steps that you did to dump the ROM from XDA Comet (Atom Life) please?
This is what I've done so far:
Code:
E:\Atom_Rom_Stuff\Utils>pdocread.exe -l
79.92M (0x4fec000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
797.66M (0x31da8000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
63.94M (0x3ff0000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
STRG handles:
handle 23fc3fae 35.96M (0x23f6400)
handle e3f93f52796.85M (0x31cd9c00)
handle 03f931ca 65.19M (0x4130000)
handle c3facfbe 1.69M (0x1b0000)
handle c3facf9a 1.12M (0x11fc00)
disk 23fc3fae
4 partitions, 3 binary partitions
customerid=060a0000 uniqueid= 00 00 0a 06 0f 36 0b f8 00 00 00 c3 00 00 00 ce
disk e3f93f52
4 partitions, 3 binary partitions
customerid=060a0000 uniqueid= 00 00 0a 06 0f 36 0b f8 00 00 00 c3 00 00 00 ce
disk 03f931ca
4 partitions, 3 binary partitions
customerid=060a0000 uniqueid= 00 00 0a 06 0f 36 0b f8 00 00 00 c3 00 00 00 ce
disk c3facfbe
4 partitions, 3 binary partitions
customerid=060a0000 uniqueid= 00 00 0a 06 0f 36 0b f8 00 00 00 c3 00 00 00 ce
disk c3facf9a
4 partitions, 3 binary partitions
customerid=060a0000 uniqueid= 00 00 0a 06 0f 36 0b f8 00 00 00 c3 00 00 00 ce
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part00 -t
real nr of sectors: 2302 - 1.12Mbyte (0x11fc00)
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part01 -t
real nr of sectors: 3456 - 1.69Mbyte (0x1b0000)
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part02 -t
real nr of sectors: 133504 - 65.19Mbyte (0x4130000)
Am I on the right track?

---

oswin said:
Hi scorpio16v,
Can you post the steps that you did to dump the ROM from XDA Comet (Atom Life) please?
This is what I've done so far:
Code:
E:\Atom_Rom_Stuff\Utils>pdocread.exe -l
79.92M (0x4fec000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
797.66M (0x31da8000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
63.94M (0x3ff0000) TRUEFFS
| 1.12M (0x11fc00) Part00
| 1.69M (0x1b0000) Part01
| 65.19M (0x4130000) Part02
STRG handles:
handle 23fc3fae 35.96M (0x23f6400)
handle e3f93f52796.85M (0x31cd9c00)
handle [B]03f931ca[/B] 65.19M ([B]0x4130000[/B])
handle c3facfbe 1.69M (0x1b0000)
handle c3facf9a 1.12M (0x11fc00)
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part00 -t
real nr of sectors: 2302 - 1.12Mbyte (0x11fc00)
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part01 -t
real nr of sectors: 3456 - 1.69Mbyte (0x1b0000)
E:\Atom_Rom_Stuff\Utils>pdocread -w -d TRUEFFS -p Part02 -t
real nr of sectors: 133504 - 65.19Mbyte (0x4130000)
Am I on the right track?
Click to expand...
Click to collapse
yes, that looks fine, but you can skip this step and try the following way for example:
Code:
pdocread -h 0x[B]03f931ca[/B] 0 0x[B]4130000[/B] Part02.raw
That will dump the imgfs part. For the other parts do the same way.
Please do the pdocread.exe -l again and compare the right datas.
And don't forget the 35.96 MB Part. It's the extended ROM.
Hope that'll help you.

---

scorpio16v said:
Now, I need some help to make this flashable for german Atom Life user.
Comet_ExtROM
You can open it with WinImage.
Click to expand...
Click to collapse
Hi,
Sorry, I only looked at this now. You just need to add a 12-byte header for this to work on normal flashing. You need to rename this to flash in bootloader mode. Unfortunately, I don't know what the name is. You can try to enter into bootloader mode and insert a blank miniSD. In the Atom, it lists all filenames it can't find though. Hope it works the same way as the comet.
cheers,
Jiggs
edit: a 1gb miniSD doesn't work. 512mb and 256mb miniSD works fine with SD card flashing.

---

jiggs said:
Hi,
Sorry, I only looked at this now. You just need to add a 12-byte header for this to work on normal flashing. You need to rename this to flash in bootloader mode. Unfortunately, I don't know what the name is. You can try to enter into bootloader mode and insert a blank miniSD. In the Atom, it lists all filenames it can't find though. Hope it works the same way as the comet.
cheers,
Jiggs
edit: a 1gb miniSD doesn't work. 512mb and 256mb miniSD works fine with SD card flashing.
Click to expand...
Click to collapse
Thanks for your reply.
I've ordered an 256 MB MiniSD. Hope it works.
On Developers FTP there is an folder called "ATOMLife_MiniSD".
The text file inside says AL1.DIO is the OS image and ExRom.img is the name for the Extended ROM file. Hope it works.
Ok the way to flash the Extended ROM is now clear,
how can I restore the OS ?
The other 3 parts that I've dumped are the Imgfs and the XIP parts ?
Is it right, that I must merge the 3 parts with SPRX tolls from Scooter-Kitchen and restore the 12 byte header ?
An other question is, if it is possible to flash this via RUU ? And for what are the *.mbn files in the official Atom Life update ?
At first, I must find the way to restore my Comet with my Romdump.
Than I think an AKU 0.7.0 like your Atom ROM would be fine for the Atom Life /Comet too.

---

scorpio16v said:
Thanks for your reply.
I've ordered an 256 MB MiniSD. Hope it works.
On Developers FTP there is an folder called "ATOMLife_MiniSD".
The text file inside says AL1.DIO is the OS image and ExRom.img is the name for the Extended ROM file. Hope it works.
Ok the way to flash the Extended ROM is now clear,
how can I restore the OS ?
The other 3 parts that I've dumped are the Imgfs and the XIP parts ?
Is it right, that I must merge the 3 parts with SPRX tolls from Scooter-Kitchen and restore the 12 byte header ?
An other question is, if it is possible to flash this via RUU ? And for what are the *.mbn files in the official Atom Life update ?
At first, I must find the way to restore my Comet with my Romdump.
Than I think an AKU 0.7.0 like your Atom ROM would be fine for the Atom Life /Comet too.
Click to expand...
Click to collapse
Just to give you an idea on how the Atom works with SD CARD flashing:
1. we don't need the 12-byte header
2. our 64mb ROM dump includes eboot.nb0 and couple of other things.
So, my guide is the size of the original nb0 file that came with the update. in your case, it's the size of the atom life original flash.dio without the 12-byte header.
3. i merely copied this dump.bin and renamed it do diskimg.nb0 on to a 512-mb miniSD.
4. enter into bootloader mode and inserted the miniSD where it downloads the diskimg.nb0 file.
5. the Atom automatically tries to find the other files needed
6. it then hard resets itself and boots normally.
I normally do the editing on the OS part diskimg.nb0 which includes the XIP part already. I think the other parts you downloaded is not the XIP part but the IPL and stuffs (breakdown found in the original ROM upgrade of Atom Life). The Atom however only have distributor information data.
You can actually do some binary comparison of the dump you made vs. the atom life upgrade components in order to determine it. I use ExamDiff Pro, but there are lots of other programs which do binary comparison.

---

OK
Maybe I'm to stupid to understand.
1. I have the imgfs part (ok,its bigger than the original rom, but I think I can simply cut the size down.)
2. If I dump the original Atom Life ROM with msflshtool.exe from scooter kitchen, I get "flash.dio.part0, flash.dio.part1 and flash.dio.part2"
Part 2 is the same like my OS dump, and part 0 and 1 are the same like my dumped parts 00 and 01.
But how can I merge the 3 Parts together ?
Hope you help me again
The ExtRom dump from Comet is ok. I've succsessfully injected a test file and flashed it via MiniSD.

---

scorpio16v said:
OK
Maybe I'm to stupid to understand.
1. I have the imgfs part (ok,its bigger than the original rom, but I think I can simply cut the size down.)
2. If I dump the original Atom Life ROM with msflshtool.exe from scooter kitchen, I get "flash.dio.part0, flash.dio.part1 and flash.dio.part2"
Part 2 is the same like my OS dump, and part 0 and 1 are the same like my dumped parts 00 and 01.
But how can I merge the 3 Parts together ?
Hope you help me again
The ExtRom dump from Comet is ok. I've succsessfully injected a test file and flashed it via MiniSD.
Click to expand...
Click to collapse
Now, this is the tricky part. You have to use msflshtool.exe to stitch the parts together. However, I could not verify this procedure because I don't have the device to test on. The way I understand it, the Atom Life ROM becomes a pattern file and update it's parts using your dump.
BoomerCE has successfully done this. You can also ask vivi, to ask for procedure in putting back the XIP section.
Code:
msflshtool CEimage.bin –r –p n
where: n is parts 0 to 2. Also note, that msflshtool won't work with the 12-byte header present in the pattern file. FYI, the 12-byte header contains the CID of your device.
hope this helps.

---

Thank you jiggs
That's the missing step i was searching for.
I make now some tests with an Atom Life ROM to compare the scource file with the merged and if it's all OK, I think I can make my ROM.
And then, I must only be brave (or stupid) enough to flash this thing.
edit:
OK
I've split the Atom Life ROM and merged it together. The new file and the original file are identical.
Now, I put my dumped parts in the flash.dio from the Atom Life ROM.
I think my ROM is ready. Hope, I don't miss something.
Someone of the experienced Atom Life users are willing to test it for me.

---

jiggs said:
FYI, the 12-byte header contains the CID of your device.
hope this helps.
Click to expand...
Click to collapse
That means even if I could restore my ROM, I can't flash it via MiniSD without the correct header with my devices CID ?
I thought, if I update in bootloader-mode and MiniSD there is no CID check.

---

scorpio16v said:
That means even if I could restore my ROM, I can't flash it via MiniSD without the correct header with my devices CID ?
I thought, if I update in bootloader-mode and MiniSD there is no CID check.
Click to expand...
Click to collapse
actually, the CID can be derived from mxip_oem1.dll and mxip_oem.ver So nothing to worry about.

---

Thank you jiggs for all your help !!!
Now, i've flashed my dumped ROM and ExtROM via MiniSD.
After a few tries (and fear that i've ****ed up my Comet) all went good.
The divice starts.
I think that is the first "custom" ROM for the XDA Comet.
Now I must do some tests, before I offer this for the public,
and then I must figure out, how to port the damned AKU 0.7.0 Build for the XDA Comet.

---

scorpio16v said:
Thank you jiggs for all your help !!!
Now, i've flashed my dumped ROM and ExtROM via MiniSD.
After a few tries (and fear that i've ****ed up my Comet) all went good.
The divice starts.
I think that is the first "custom" ROM for the XDA Comet.
Now I must do some tests, before I offer this for the public,
and then I must figure out, how to port the damned AKU 0.7.0 Build for the XDA Comet.
Click to expand...
Click to collapse
congratulations to your new cooked ROM. could you try installing the following certificate? Cooked Wm6 ROMs without the official upgrade seem to suffer this problem. BUT since your cooked ROM is based from official ROM upgrade, it should install. If it doesn't, then I have something new to study.
Thanks in advance.