Related
Hello ;
I tried to flash my preproduction Herme with SD card, copied the french image in the root folder of the microSD after renaming it to 'HERMIMG.nbh' , restarted the phone with boot loader here is what I get :
Checking image file...
after about 20sec..
No image file!
PLEASE HELP
thanks
There are some preproduction models where you cannot upgrade using the HERMIMG.nbh on fat32 microSD card, I have one of them too. My original rom is in chinese and I have bootloader version 0.94.
I haven't tryied it yet, but the process should be something like this:
1) Extract contents from NBH upgrade file using itsme tools nbh2dbh.pl and nbh2decode.pl. Make sure the NBH you use has bootloader version 1.04.
2) Create a custom NBF upgrade out of the IPL.nb and SPL.nb you have extracted, use typhoonbfdecode.pl with -s, -r ipl and -r spl. This should make a "bootloader-only" upgrade.
3) Use MaUpgrade_NoID.exe to upgrade the bootloader on your device, this will only work on preproduction devices as they have 'wdata' command in bootloader 0.94, and the upgrading process should be the same.
Once you have upgraded it to bootloader 1.04 then you will be able to update to any rom using the usual Hermes upgrades found on the wiki.
Blocked at 2nd step
Error message :
C:\Documents and Settings\Administrateur\Bureau\Nouveau dossier (3)>perl typhoon
nbfdecode.pl -s -r ipl.nb -r spl.nb
Option r, key "ipl.nb", requires a value
Option r, key "spl.nb", requires a value
Usage: typhoonnbfdecode.pl filename
lists contents of filename
or typhoonnbfdecode.pl [-i] [-v] -x infile
extract modules
-i decode as sd header image
-t file is tornado nbf, with large header
-v also list headers
-s convert SPL to memory image
or typhoonnbfdecode.pl [-r module=file] [-p param=value] -c outfile
create new nbf
-s convert SPL memory image to nbf image
-t file is tornado nbf, with large header
-r specify the modules to read, module can be one of:
os, ipl, spl, splash or gsm
-p specify the header values, param can be one of:
device, language, magic, operator, flags, version or blversion
or typhoonnbfdecode.pl [-r module=file] [-p param=value] -d outfile
create sdcard image
-r specify the modules to read, module can be one of:
os, ipl, spl, splash or gsm
-p specify the header values, param can be one of:
docuniqueid, blversion, cid, seclevel, timestart, timeend
keys, cardid
Ohh help!
ohh no:
Actually I cannot do anything with that error :
Usage: typhoonnbfdecode.pl filename lists contents of filename
here is my command :
C:\Documents and Settings\Administrateur\Bureau\Nouveau dossier (3)>perl typhoonnbfdecode.pl -s -r ipl= ipl.nb -r spl=spl.nb -c nk.nbf
where is the error?
Again..
Well the error was a space ... lol --> ipl= ipl.nb
Corrected it and :
read 00020000 for ipl from ipl.nb
no IPL at 4 in IPL image
Means what ???
mcilias said:
Well the error was a space ... lol --> ipl= ipl.nb
Corrected it and :
read 00020000 for ipl from ipl.nb
no IPL at 4 in IPL image
Means what ???
Click to expand...
Click to collapse
You need to add option "-f" to your parameters to bypass the safety checks (the checks are written for WM2003 roms), be sure to have the latest version of typhoonnbfdecode when you do that.
Still confused
After adding the -f here is the result :
C:\Documents and Settings\Administrateur\Bureau\Nouveau dossier (3)>perl typhoon
nbfdecode.pl -s -f -r ipl=ipl.nb -r spl=spl.nb -c 123.nbf
read 00020000 for ipl from ipl.nb
no IPL at 4 in IPL image
read 00040000 for spl from spl.nb
spl image: 00080000 bytes
no BOOTLOAD at 0x2004 in SPL image
blversion 1.0.0.0
device SP3i
entrycount 2
flags 17
language ENGLISH
magic HTC
operator CDL___02
version 1.0.0.0
91000000 00080000 fd748c72 spl
90000000 00020000 68f14038 ipl
enc: 91000000 00080000 fd748c72 spl
enc: 90000000 00020000 68f14038 ipl
is that ok? is the file ready to upgrade with?
2- I don't know how to use it with MaUpgradeUt_noID.exe
it is asking for RUU.dll , I put the one in the original ROM and I have this error : UpdateRadio not found in the library of dynamic RUU.dll links (translated from french)
Please help me to upgrade this bootloader
thanks
mcilias said:
perl typhoonnbfdecode.pl -s -f -r ipl=ipl.nb -r spl=spl.nb -c 123.nbf
[...]
is that ok? is the file ready to upgrade with?
Click to expand...
Click to collapse
Should be ok, but only for preproducion Hermes units.
mcilias said:
2- I don't know how to use it with MaUpgradeUt_noID.exe
it is asking for RUU.dll , I put the one in the original ROM and I have this error : UpdateRadio not found in the library of dynamic RUU.dll links (translated from french)
Click to expand...
Click to collapse
You need MaUpgradeUt_noID.exe, RUU.dll and UI.dll and RUU.conf with the right settings (download older non-hermes upgrades to compare).
The file you created should be named nk.nbf or ms_.nbf (i'm not sure) and be in the same folder of the upgrade utility.
Good luck!
..
in original ROM I have RUU.dll and RUUUI.dll not UI.dll , I don't have RUU.conf I copied one from QTEK S100 ROM and I don't know info to change the config and it gives me the same error.
the error always comes but when I change the RUU.dll to the S100 one it opens the wizard.. I think that MaUpgradeUt_noID.exe is not compatible with the ROM of the herme ...
PLEASE LOOK AT PAGE 2
Production Hermes == bootloader >= 1.04 == command to flash ROM 'wdatah' == command to flash rado rom 'rwdata' == Utility Files: (ROMUpgradeUt.exe RUU.dll RUUUI.dll HERMIMG.nbh)
Preproduction Hermes == bootloader <= 0.94 == command to flash ROM 'wdata' == command to flash radio rom 'rwdata' == Utility Files: (MaUpgradeUt_noID.exe RUU.conf RUU.dll UI.dll radio_.nbf ms_.nbf nk.nbf)
So, for bootloader 0.94 you need to use an OLD RUU which flashes NBF files using 'wdata' command and not 'wdatah' command, not compatible with Shipped hermes upgrades in NBH format, that's why you need to convert NBH to NBF.
I might do it and publish the upgrade, but I'd like to extract the bootloader from my preproduction Hermes first and there's no known method yet. So, if you don't do it yourself you'll need to wait, sorry.
..
so as I understand, I have to use an old RUU for herme which is not available actually?
would the S100 one work? without causing any problem?
What should I do exactly now?
Can I please have instant contact with you? msn or so?
Thanks
mcilias said:
so as I understand, I have to use an old RUU for herme which is not available actually?
would the S100 one work? without causing any problem?
Click to expand...
Click to collapse
Yes, it is available from older HTC devices (not TyTN/Hermes).
Use the MaUpgradeUT_NoID utility, was originally writen for magician but should be fine with your preproduction bootloader.
I used all files of S100 RUU.dll + UI.dll + RUU.conf + ms_.nbf + radio_.nbf + nk.nbf ... says successfuly but it did nothing to the pda no action !
Pda Lost ?
Still no solution for this case ? Did I lose my pda phone forever?
I am quite busy ATM and cannot give this a try, if no one comes with a solution I might do it myself during the weekend and post the update or progress done, so please be patient
thanks but please don't forget me
NO SOLUTION !!???!!..
So there is no solution for this ****ing preproduction herme?
should I send it to recycle ?
HI,
could you please let me know version of your Preprod Hermes bootloader? Thanks.
Preprod HTC devices has fuctionaly limited bootloader. Therefore you must flash bootloader to 1.03 version at least.
hello
it's 0.92 how can i flash boot loader? i tried lot of solution .. it doesn't work !
mcilias said:
it's 0.92 how can i flash boot loader? i tried lot of solution .. it doesn't work !
Click to expand...
Click to collapse
Solution found, I upgraded one preproduction hermes with bootloader 0.94 (IPL-0.16, SPL-0.94) to a 1.04 bootloader and now I can flash any shipped rom on it:
http://wiki.xda-developers.com/index.php?pagename=Hermes_Howto_Bootloader104
I'm truly sorry about the delay.
I've finally got round to posting a a STAR100 SuperCID guide.
1. Get itsutils: http://www.xs4all.nl/~itsme/projects/xda/tools.html
2. Run pdocread.exe with no args. Take a note of the "uniqueid" value.
3. Run "pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb" - you'll get a file.
4. Head over to http://www.spv-developers.com/strtrkCID/. Feed it the DOCID and the file you got from steps 2 and 3. It'll give you back anoter file.
5. Run "pdocwrite -n 1 patchedfile.bin 0x000000 0x10000 -b 0x4000" where patchedfile.bin is obviously to be replaced with the patched file you got from step 4.
6. There is no 6. Report feedback.
Click to expand...
Click to collapse
All credit goes to itsme - he wrote all the tools and scripts which made all this possible.
Spawning script: perl startrek_cidedit.pl cid1e62995dd1db197b00b697388760b5e3.bin -i DOPOD601 -c 11111111 -o supercid1e62995.bin 2>&1
decrypting
bufend=44bdd4609845fd0931a871b4a31ddba42d4b96386f9 e9c5dff947c035432fc15
result=b2c7c4eede400853eb232eba436f394b3d75a9adf4c e9a1e452b26ea9059dc59
sha64k=8a7e3a8462b8c851ac125710d44abc05da4916f215e 331f98420db7ae5d87a5d
buffer checksum failed
why ?
Looks like the DOCID value you entered is incorrect. It should be a long stream of hex numbers.
Fantastic !!! Working Ok on SPV F600. Now, we need how to simunlock this smartphone.
Thank you very much Zone Mr.
i run pdocread in step 1 and got a dos screen that desaper in a second,and were i find the file in step 2.
Zone-MR said:
Looks like the DOCID value you entered is incorrect. It should be a long stream of hex numbers.
Click to expand...
Click to collapse
thank you Zone-MR,can u tell me how to get a long stream of hex numbers.
wlinsong said:
thank you Zone-MR,can u tell me how to get a long stream of hex numbers.
Click to expand...
Click to collapse
i know how to do,thank Zone-MR very very much
is there someone know how to flash rom use T-flash Card?
someone can't get the docid ,because you must use the old one!
I tried to do first step but when I ran pdocread.exe I get the following message :
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.
I've app-unlocked my device, activesync works ok, and restarting does not help. Phone is Qtek8500.
Any ideas?
Thanks
Is the script to calculate CID area for startrek available?
I think this should use the same method on Artemis or Herald, the problem is that they have G4 DOC and we'll not be able to use pdocwrite, but on those phones we're already able to place a hacked SPL in mem with psetmem.exe and jump into it's address with modified haret version. If we have the right CID area we can use the hacked SPL to flash it.
sorry for the ignorance...
I have downloaded itsutils but where is the dpocread.exe??
do I have to connect to the device with the mtty??
Maybe a bit more explanation
I've CID unlocked my Qtek 8500 and installed new ROM 3.6.251.0. Thanks Zone, great work!
Maybe it would be useful to write more detailed instructions, so here it is :
1. Application unlock your phone using regeditstg and do the following :
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1001 = 2 -->Change the value data from 2 to 1
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1005 = 16 --> Change the value data from 16 to 40
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1017 = 128 --> Change the value data from 128 to 144
Reboot the phone
2. Run SDA_ApplicationUnlock tool. Reboot the phone after it finishes.
3. Download itsutil.zip from http://www.xs4all.nl/~itsme/projects/xda/tools.html , version from 2005-6-28. There is even newer version, but with that version you can not use pdocread without arguments.
4. Connect the phone with activesync
5. Run Command Prompt, go to subfolder named "build" in itsutils folder, and run pdocread without arguments
6. Note the value of "uniqueid". It will be something like : "00 00 00 00 12 03 02 14 3b 07 1b b2 04 05 07 54"
7. run pdocread again with these arguments : "pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb". This will make original-bdk1.nb file in build folder (where the pdocread is located).
8. Upload this file and value of uniqueid to http://www.spv-developers.com/strtrkCID/. It will open a new page after few seconds. Go to bottom of the page and click the link "Download patched BDK1"
9. Download the file (it will be named like "supercidxxxxxxx.bin) to "build" folder
10. Run the pdocwrite from command prompt with these arguments : "pdocwrite -n 1 supercidxxxxxxx.bin 0x000000 0x10000 -b 0x4000". Replace supercidxxxxxxx.bin with the original name of downloaded file from step 9.
11. Wait 15-20 seconds and that is it. Reboot the phone and install the ROM you like
It works! I've got now 3.6.251.0_02.67.30 on my Qtek!
Thank's, damird, your guide is unreplaceble for such lamers like me
But maybe anyone can suggest me were can i find and how to install (if it possible) Russian t9 or only russian lang to input? Or maybe how to rollback to original ROM with this that lang... (1.02.261.1)
Thank's
added:
Problem's gone, Russian T9 added.
Damird!
Cheers mate
Hello, can you share with us this script to calculate CID area in StarTrek?
With this script we can SimUnlock the StarTrek very easy (at least I think...)
Thank you very much.
I'm confused here... is CID unlock not the same with SIM unlock?
my carrier is tmob but I'm getting cing 3125 at ebay so I need to SIM unlock the phone for it to work on tmob right?
wow, pof, I can't wait for it! i had bought one herald in China but wireless was disable by default. I hope I could unlock the CID and get a WWE rom to enable the wireless.
sokelut said:
I'm confused here... is CID unlock not the same with SIM unlock?
my carrier is tmob but I'm getting cing 3125 at ebay so I need to SIM unlock the phone for it to work on tmob right?
Click to expand...
Click to collapse
Correct, you still need to pay to carrier unlock the phone. Check the wiki for links to a few services that are known to work.
CID unlock? Error installing ROM
I'm getting an ERROR [294] INVALID VENDER ID
I did the CID unlock
It starts to install the rom but when it gets to 4% I get this error. How do i fix this?
Can anyone help?!
Need a little clarification
Im stuck in steps 3-11. I've downloaded itsutils and I don't know how to proceed.
I'm trying to use the RBMC command in the BL to extract the splash screens (as I couldnt find Orange-Israel splash screens anywhere).
I authenticated myself in the BL (btw, I have an exectuable that will do all that is written in POF's wiki). when I use the RBMC command:
rbmc d:\splash.nb 500e0000 40000
alot of garbge starts to flow to the screen in MTTY.
I guess MTTY doesnt saves the file automaticly.
Please help me dumping the Splash using this method (or any other method)
Capture the output with usb-monitor and convert it to binary file.
Pog, can you elaborate in this?
I used USB Monitor to log everything. Now I have a HEX and ASCII dump of every packet that cam from the TYTN. How do I save it into something usfull and how do I convert it to binary and then to BMP?
You can do it with unix command 'xxd' (included in vim) or with a simple C program (do a bucle in a shell script for every hex-char):
Code:
int main () {
unsigned int c;
unsigned char aux[10];
int s=read(0,aux,4);
sscanf(aux,"%x",&c);
printf ("%c",c);
return 0;
}
If you don't have access to a linux box, attach the dump here and I do it for you.
damnit, I wont have access to linux until next week...
I would appritiate your help in converting but I dont know if I did the dump correctly with USB Monitor.
First, it has several packakets with the commands I issued, than it has several LARGE packets with "junk" (I think thats the Splash screen dump).
However, I can export it to TXT and in TXT I see both the HEX and the ASCII part. Is that ok? If not, how do I dump the correct part?
knfevg said:
However, I can export it to TXT and in TXT I see both the HEX and the ASCII part. Is that ok? If not, how do I dump the correct part?
Click to expand...
Click to collapse
Yes this is correct. Attach the dump and if it is useful i make the splashscreens for u.
POF, attached is the zipped file with the TXT dump (in unicode).
It would be GREAT if you could help me.
If there is a need in some other kind of a dump, please let me know.
The dump is incomplete, you only dumped 24Kb, a whole splash screen should be at least 128Kb + 128Kb more of padding. Attached is the partial bin file.
mtty is not good for rbmc'ing... the best is to use linux 'cu' comand (included in uucp) like this:
Code:
((sleep 2 && echo rbmc file 500E0000 40000 ) | cu -l /dev/ttyUSB0 ) > dump.txt
POF,
I think I've attached the wrong file
I hope thats the correct one
there you go, splash in .nb and .bmp
pof said:
The dump is incomplete, you only dumped 24Kb, a whole splash screen should be at least 128Kb + 128Kb more of padding. Attached is the partial bin file.
mtty is not good for rbmc'ing... the best is to use linux 'cu' comand (included in uucp) like this:
Code:
((sleep 2 && echo rbmc file 500E0000 40000 ) | cu -l /dev/ttyUSB0 ) > dump.txt
Click to expand...
Click to collapse
Hi pof.
Have tried this too, but the dump.txt contains only 46 bytes. What's wrong.
mm... post the contents and we'll know
Probably it's failing because you have to authenticate to the bootloader prior to doing the rbmc command (or use a patched SPL which does not require it, for example latest HardSPL).
Pof, THANKS!!!!!
One more question.
The secondary splash is usualy the same as the prime?
What IS SubMain splash? When does it come up?
knfevg said:
The secondary splash is usualy the same as the prime?
Click to expand...
Click to collapse
Generally yes.
knfevg said:
What IS SubMain splash? When does it come up?
Click to expand...
Click to collapse
MainSplash - the one you see with the red letters at bottom when booting
SubSplash - the next one without red letters
If MainSplash and SubSplash are the same, you get the feeling that there's only 1 splash screen, but there are actually two
pof can you make me .bmp from dump?
I can xxd to hex but don't know what's next to got .bmp
Thanks
gromel said:
I can xxd to hex but don't know what's next to got .bmp
Click to expand...
Click to collapse
After you xxd the hex, the binary file you get is the actual splash.nb, so you can use nb_image_converter.exe to make a BMP, you can find it here:
ftp://xda:[email protected]/Hermes/Cooked_ROMs/Hermes_SplashScreen_Pack.zip
BTW, before using xxd you'll need to convert the dump from utf-8 to ascii.
If you can't manage to do it yourself, tell me and I'll do it for you.
Ah, now better understand.
But When I try iconv -f utf8 -t ascii dump -o output
then I got always error iconv: illegal input sequence at position 0
PS. In usb-monitor I can export as UNICODE or ANSI (ASCII).
I'm trying and trying and trying....
If I dump the ROM of HTC Touch Pro T7276 here in India, how do I upload the dumped files for the use and development of all members.
If you don't have your own RapidShare / 4Shared etc style hosting then...
I upload stock ROM's to AllTheWay's for shared account (he doesn't seem to mind) : http://www.4shared.com/dir/5551593/20b4549a/sharing.html
Also, there is the xda-developers FTP. (The article is on the wiki: http://wiki.xda-developers.com/index.php?pagename=BA_FTP_Site).
Thanks,
Dave
Would that be a localized Hindi ROM?!
ray_f said:
Would that be a localized Hindi ROM?!
Click to expand...
Click to collapse
I guess we will have to wait and see eh!
Problem with Part 03
I have problem with dump of part 03, I get the following error :
E:\TOUCH PRO\ROM\itsutilsbin-20080923>pdocread -w -d DSK1: -b 0x800 -p Part03 0
0x143a0000 Part03.raw
CopyTFFSToFile(0x0, 0x143a0000, Part03.raw)
ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is i
nvalid.
A small toys for generate P3400 boot image !
Based on the pof's nbimg.exe and the XnView's nconvert.exe !
Enjoy this toy! Everyone !
Download mirrors
Download
What boot image (Boot Splash)
The BootSplash image, is the image that is displayed when your PocketPC device is starting up.
How to change the Gene's Boot Splash Screens
Some of the information you can reference these wiki, The tutorial describes how to custom Boot Splash Screens,
http://wiki.xda-developers.com/index.php?pagename=Wizard_ChangeSplashScreens
http://wiki.xda-developers.com/index.php?pagename=TitanBootsplashTutorial
[Translate CHS to EN by Google]
很抱歉我可怜的英语！（ Sorry my bad English ! ^_^ ）
一些关于如何转换 Gene's Boot Splash Screens的信息：
1、你需要一个BMP的图片，图片要求的格式
大小 ：240w x 320h
分辨率：96dpi
位深度：24
我利用了 nconvert.exe 去得到这样的一个图片, Res.jpg 可以是 Nonvert 支持的任意格式，
例如( BMP,GIF,PNP,JPG,WMF,EMF and Other nconvert Support)
Code:
nconvert.exe -resize 240 320 -out bmp -dpi 96 -truecolors -o temp.bmp Res.jpg
2、如何的到开机第一屏的刷机包(Howto make Splash.nb & Splash.nbh)
Code:
nbimg.exe -p 42978 -n -s -F temp.bmp -D GENE10000 -S 1024 -T 0x600
rename temp.bmp.nb splash.nb
rename temp.bmp.nbh splash.nbh
3 、 关于 NBimg 的用法（Usage）
Code:
Mandatory arguments:
-F <filename> Filename to convert.
If the extension is BMP it will be converted to NB.
If the extension is NB it will be converted to BMP.
Optional arguments:
-w <width> Image width in pixels. If not specified will be autodetected
.
（Gene : -w 240)
-h <height> Image height in pixels. If not specified will be autodetecte
d.
（Gene : -h 320)
-t <pattern> Manually specify the padding pattern (usually 0 or 255).
（Gene : -t 0)
-p <size> Manually specify the padding size.
（Gene : -p 42978)
-n Do not add HTC splash signature to NB file.
（Gene : -n)
-s Output smartphone format.
（Gene : -s)
NBH arguments: (only when converting from BMP to NBH)
-D <model_id> Generate NBH with specified Model ID (mandatory)
（Gene : -D GENE10000)
-S <chunksize> NBH SignMaxChunkSize (64 or 1024)
（Gene : -S 1024)
-T <type> NBH header type, this is typically 0x600 or 0x601
（Gene : -T 0x600)
Great thanks. It's more easy change the boot image with this tool.
What exactly is a boot image Ramerson? Can you explain in a little detail what are the usage scenerios and benefits of this tool?
Thanks in advance!
kindly explain
hi
can any one explain wat this is for i dont seem to understand
sm7s said:
A small toys for generate P3400 boot image !
Based on the pof's nbimg.exe and the XnView's nconvert.exe !
Enjoy this toy! Everyone !
I am sorry my bad English ! ^_^
Download
Click to expand...
Click to collapse
Oh, now i got it. Thanks for the explanation sm7s Actually when you said boot image i thought its something to do with the boot loader. words like bootsplash or boot time logo would have expained it better Anyways, thanks a lot for sharing.
Good, more simple to change boot screen with your tools, thanks.
I can't download
link plz
hey friends can someone give another link or upload the same?
Alternate download link:
http://www.4shared.com/file/123679548/c55e56e9/genesplash.html
Addicted2xda said:
Alternate download link:
http://www.4shared.com/file/123679548/c55e56e9/genesplash.html
Click to expand...
Click to collapse
thanx buddy
can u also tell me how 2 use it?
i cant understand nething in the first post
got the details in the zip
thank u 1ce again
Link doesnt work
Please upload it once again...