[Windows Mobile Development and Hacking General] Borg Number One:
The ultimate ( Asus MYPAL A620BT ) Pocket PC thread

World Wide English Windows Mobile 2003 / PocketPC 2003

German Windows Mobile 2003 / PocketPC 2003

(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

1. Introduction

2. Attemps getting a A620BT ROM image

3. Hacking/modifying the ROM image

4. A620BT Combo Buttons

5. Screenshots - how did I built them?

6. Problems/questions

1.) Introduction

Hi.

Short time ago I bought the Asus MYPAL A620BT Pocket PC / PDA.

It is a great PDA bundled with the superb "Destinator" navigation software.

Well, I like it to modify embedded software & firmware (especially BIOS files),

as you can see here:

The BNOBTC homepage

So I started to do some reverse-enginering with the A620BT.

2.) Attemps getting a A620BT ROM image

So, logically, I looked for a method how to dump / get the ROM file,

before I could start modifying the Asus MYPAL A620BT ROM itself.

I could not find anything, even the Asus support homepage did not help any further.

But with the help of google.com I could find other interesting stuff:

3.) Hacking/modifying the ROM image

Asus' FTP Server for "special" PDA related files:

"ftp4.asus.com.tw"

UN: PDAUser

PW: pda9983!

( Tip: When I was writing this article the UN:ftp01tk* and PW:vtf2g6z* seemed to be outdated and did/do not work anymore.)

*= can also be found by

google.com

Here:

ftp4.asus.com.tw/PDA/AD620BT/ROMImage/PPC2003

I was able to find English, German, etc..., ROM update files.

Inside the zip archives (e.g.: "SW-A4H01WA-007_09931WWE.ZIP") you can find following files:

+ AD620N.nb0

+ BOOT620N.nb0

+ IPL620N.nb0

+ .doc / .txt / readme file

3.1.) AD620N.nb0

It contains the Pocket PC operating system (Windows Mobile 2003 [a.k.a PocketPC 2003])

and the PocketPC Diagnostic Program

(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

The eight symbolic characters, which are shown on the upper-left and upper-right corner inside the

PocketPC Diagnostic Program can also be found in the "AD620N.nb0" file.

Here is the list with offsets, data and images of/from the symbolic chars:

symbolic character 1 @ 0x0000A400:

00001010FFFE101000007FFC01001110FFFE111001007FFC01003FF801000100

symbolic character 2 @ 0x0000A420:

00007DFE1010102021FE21024102FDFE4502450245FE4502450245FE7C480084

symbolic character 3 @ 0x0000A440:

00003FF80100FFFE8102BD7A8102BD7A00003FF821083FF821083FF8010201FE

symbolic character 4 @ 0x0000A460:

00007C924492452446487D244492449244407DFE4586454A4532454A45868DFE

symbolic character 5 @ 0x0000A480:

000020202020202023FCF82020202BFC310420886050A02020502088A1046202

symbolic character 6 @ 0x0000A4A0:

000003FE00480048FC48084811FE20484048BC482448244824483C8801080208

symbolic character 7 @ 0x0000A4C0:

000001000100010001007FFC41044104410441047FFC01000100010001000100

symbolic character 8 @ 0x0000A4E0:

00000000020001801100510851045006D00290021008100810080FF000000000

There is also another method to get the symbolic characters:

The ROM update file contains a kind of a file system which can be viewed with the really great utility:

=+ DUMPROM += by Willem Jan Hengeveld (

The XDA Developers homepage

).

With DUMPROM I could extract all files and "nk.exe" is the actual/proper/real file

which contains the PocketPC Diagnostic Program / AD620 Test Program.

Because of the "nk.exe" does not begin at offset 0x00 inside the "AD620N.nb0" file,

the real adresses are following:

symbolic character 1 @ 0x00009800.

symbolic character 2 @ 0x00009820.

symbolic character 3 @ 0x00009840.

symbolic character 4 @ 0x00009860.

symbolic character 5 @ 0x00009880.

symbolic character 6 @ 0x000098A0.

symbolic character 7 @ 0x000098C0.

symbolic character 8 @ 0x000098E0.

To view / see the symbolic characters, you just need to convert the hex data into binary (0,1) strings.

For example let us convert the data of the first symbolic character into a viewable symbolic character:

0000 1010 FFFE 1010 0000 7FFC 0100 1110 FFFE 1110 0100 7FFC 0100 3FF8 0100 0100

==>

HEX |Binary
------+--------
00 00 |00000000 00000000
10 10 |00010000 00010000
FF FE |11111111 11111110
10 10 |00010000 00010000
00 00 |00000000 00000000
7F FC |01111111 11111100
01 00 |00000001 00000000
11 00 |00010001 00010000
FF FE |11111111 11111110
11 10 |00010001 00010000
01 00 |00000001 00000000
7F FC |01111111 11111100
01 00 |00000001 00000000
3F F8 |00111111 11111000
01 00 |00000001 00000000
01 00 |00000001 00000000

Now, let us convert all "0" to "." and "1" to "X" to get a better view:

................
...X.......X....
XXXXXXXXXXXXXXX.
...X.......X....
................
.XXXXXXXXXXXXX..
.......X........
...X...X...X....
XXXXXXXXXXXXXXX.
...X...X...X....
.......X........
.XXXXXXXXXXXXX..
.......X........
..XXXXXXXXXXX...
.......X........
.......X........

Then, with a drawing program / utility,

each "X" will be drawn as a colored pixel and each "." will not be painted.

Finally, you reached to convert a binary character into a bitmap and you can see the first symbolic character:

(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

(Now you are able to modify the upper-left and upper-right corner of the diagnostic screen inside the "nk.exe" :D)

(The background color green was just used for easier image processing.)

The PocketPC Diagnostic Program ( AD620N Test Program ) also contains a nice

Key/Button Test

title scren --> testing the buttons

-->

(Screenshots / animations, PNG / gif conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

3.2.) BOOT620N.nb0

This file contains the bootloader and a built-in flash utiliy which can be accessed by/with special Combo Buttons in section "4"

Furthermore it contains the splash logo which is shown after a reset / after "booting" the Asus MYPAL A620BT PDA.

Here is a photo, which I made:

(Photo by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net)

However, I am not able to rip and display the logo in a decent way.

If you open the BOOT620N.nb0 file in a HEX editor and if you jump to offset:

0x00001E45 (or: 0x00001E47, if the 0D0A string does not belong to the image data),

then you can see the beginning of the image data.

It seems to be any kind of a palette area.

The real / plain image data seems to begin @ offset: 0x00001F98 and seems to end @ offset: 0x00027798.

That means 25800 Bytes [Hex] = 153600 Bytes.

After extracting the area ( after extracting the mentioned 153600 Bytes ) and pasting the data to a new (.RAW) file,

you can open the file in programs which are able to import/open raw files, such as:

"Irfanview".

( http://www.irfanview.com )

In Irfanview choose "RAW - RAW Image Data" as file type when you open the new built .RAW file.

After selecting and opening the file, a new window appears, where you can enter the dimensions and select the bits per pixel.

Take: 240 * 320 * 16bit.

This was my first attempt.

(The RAW image file began with one byte too much. :D)

(I did not copy and paste the area: 0x00001F98 - 0x00027798. I copied 0x00001F97 - 0x00027798. :D)

(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

This was my final attempt:

(This time, the area: 0x00001F98 - 0x00027798 inside the BOOT620N.nb0 was copied and pasted to a new raw file exactly.)

(Screenshoot, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

The logo seems to be have a color depth of 16 bit (2bytes per pixel) + a kind of a palette??????!????

Well, as you can see, I am currently not able to display the image correctly.

So, there are questions. :D

Please goto section 6.

3.3.) IPL620N.nb0

? ? ? :D :D :D

So, logically, there are questions. :D

Please goto section 6.

3.4.) .doc / .txt / readme file

The file contains helpfull information and detailed instruction for a ROM Image Update.

It also describes the special Combo Buttons.

4.) Special Combo Buttons

1. Power button + Reset Button --> Cold Boot

2. Record button + Reset Button --> ROM Image Update (Immediately Update AD620N.nb0)

3. AP1 button + Reset button --> Eboot Mode

4. AP2 button + Reset button --> ROM Image Update (Need User Input File Name)

5. AP3 button + Reset button --> Diagnostic Program

6. Power button + AP4 button --> Calibration for Touch Screen

There are further questions. :D

Please goto section 6.

5.) Screenshots - how did I built them?

Here are some programs which are able to control Pocket PC systems via PC (Netmeeting-like)

and which can be used to build screenshots as long as the Pocket PC is not in FlashROM mode or inside the Diagnostic Program. :D

+ ActiveSync Remote Display ( part of Windows Mobile Developer Power Toys)

( free download: http://www.microsoft.com/downloads/...d6-1dcc-47aa-ab28-6a2b006edfe9&displaylang=en )

( http://download.microsoft.com/downl...-83a0-81d7d9ac9ce1/WindowsMobilePowerToys.msi )

+ dotPocket (commercial software)

( http://www.dotpocket.com/pocket-pc-software.html )

+ Pocket Controller (commercial software)

( http://www.soti.net/ )

Because there are no(**) lossless methods to grab the screen while the PDA is in Diagnostic - or in FlashROM mode,

and because there are no screen dumping utilities which would work in the mentioned states/modes,

I looked for alternatives and I found some. :D

With the help of my Plustek USB scanner I could take some really huge and detailed scans from my Asus MYPAL A620BT.

The images were scanned with 1200 DPI, so I was able to:

+ see each dot/pixel/transistor on the touchscreen/TFT

+ re-draw each character and symbol and store each of them in a single graphics file. :D

With the help of HTML I could rebuild the different screens in a pixel accurate way.

So, I did a huge amount of reverse engineering to get decent screenshots instead stupid and bad photos.

( **= Theoretical, I could open the PDA and grab the digital video / display data from the

TFT / touchscreen pins. :D )

There are further questions. :D

Please goto section 6.

6.) Problems, troubles & questions.

Reffering to: 3.) Hacking/modifying the ROM image & 3.3.) IPL620N.nb0:

What are the files: "BOOT620N.nb0" "IPL620N.nb0" detailed for?

How to dump the bootloader area from a Pocket PC to a file?

Reffering to: 3.2) BOOT620N.nb0,

I would like to know:

"How to rip and modify the splash logo in a accurate way?"

"Did I forget something to do?"

Reffering to: 3.4.) .doc / .txt / readme file,

are there further Combo Buttons?

Reffering to: 5.) Screenshots - how did I built them?:

I already tried find the binary data for the displayed font /characters,

when the Asus MYPAL A620BT is in Diagnostic - or in FlashROM mode.

So, I tried to find the binary data for many re-painted chars in the three .nb0 files and extracted files.

For example, I also looked for the binary data of the character: A [ 3078CCCCFCCCCC ]

HEX|Binary
---+--------
30 |00110000 ..XX....
78 |01111000 .XXXX...
CC |11001100 XX..XX..
CC |11001100 ==> XX..XX..
FC |11111100 ==> XXXXXX..
CC |11001100 XX..XX..
CC |11001100 XX..XX..

However, no files seems to contain the "console font".

In the PC area, the VGABIOS contains the (8*8, 8*16,...) charsets/fonts,

which are "encoded" in the same binary way.

Is there any kind of "VGABIOS" inside the Pocket PC?

(WinRAR and TotalCommander are able to search HEX strings inside files.)

Where is the standard/console font stored (in)?

Is it also stored in one of the .nb0 files?

Reffering to 2.) Attemps getting a A620BT ROM image:

After a second search with http://www.google.com,

I could find two methods to dumping the rom, but both methods do not really work.

a)

The OSImage Tool ( http://www.xs4all.nl/~itsme/projects/xda/OsImageTool.html ) seems to work,

but after ~ 1.5 - 1.7MB nothing happens anymore.

No crash, ...etc., the dumping process just stops and nothing happens anymore.

I tried the OSImage Tool many time and I also removed/closed all applications from the memory.

(Pocket PC->settings->memory)

But everytime I try to dump,

the OSImage Tool stops after ~ 1.5 - 1.7MB.

The dumped part seems to be ok. (There are no weird chars inside the 1.5MB dumped part.)

However, it is just a part - not the whole dump. :D

In this forum I could find another person, who described the same problem in another thread:

http://xdaforums.com/viewtopic.php?p=34550#34550

I did not try the "bootblaster" yet.

But, I think it is important that the current OSImage Tool will also be improoved. :D

b)

grab_it ( http://xdaforums.com/viewtopic.php?t=22861 ) brings a stupid error message:

(Screenshoots, PNG conversion and highest possible lossless PNG optimization & file size reduction by:

Borg Number One - borg_no [dot] one -at- gmx [dot] net

Thanks go to GIMP, PNGCRUSH and PNGOUT)

The autostart feature worked and I also tried to start the grab_it manually, but everytime I get the error message:

Cannot create file