[8125, K-JAM, P4300, MDA Vario Software Upgrading] flexchen:
I just managed to change the second splash screen and customize my extrom with the help of SD Card and NBF manipulation, this task is usually done by aWizard for me, but now it can't do that again due to the DOC write protection after the recent ROM upgrade.

Here is what I did with my wizard, it may not be applicable to yours, so take your own risk if you want to do it by yourself.

1) Change splash screen

[1] Found a 128MB or other size > 64MB SD card, and fill all sectors with zero using WinHEX

[2] Enter USB bootloader mode, open MTTY with USB, type "r2sd splash", this will backup your current splash screen into that SD card.

[3] Clone the SD card content to splash.sdimg using WinHEX

[4] Run "perl typhoonnbfdecode.pl splash.sdimg" to dump the parameters like blversion and docuniqueid, and save those infos.

[5] Run "perl typhoonnbfdecode.pl -x splash.sdimg" to dump your current splash screen file. Usually, you will get a file named as 800c0800-splash.nb.

[6] Open the dumped 800c0800-splash.nb using WinHEX, fill offset 0-0x2fbff with 0, open your cooked binary format splash file ( make sure it is started with "This is smartphone signature.", and exactly 0x2581e bytes in length) in WinHEX also, copy and paste the cooked splash content to the dumped one from offset 0, and make sure other part of the dumped one remains untouched, then save it as 800c0800-cooked.nb

[7] Run "perl typhoonnbfdecode.pl -r splash=800c0800-cooked.nb -p docuniqueid=00000000241001041c0811de0c0905b6 -p blversion=2.16.0000 -d cooked-splash.sdimg", remember changing the docuniqueid and blversion in the cmdline to the values you save in [4]

[8] Clone the cooked-splash.sdimg to your SD card using WinHEX

[9] Put that SD in, and boot into bootloader, and press voice dial when it asks for restoring splash screen from SD card.

[10] Reboot to normal when it is finished, and see your own splash screen again.

**** Please make a full "r2sd all" SD backup in case you messed up.

2) Customize EXT Rom

[1] Same as 1.1

[2] "r2sd extend" to save your current extend rom

[3] save to extend.sdimg

[4] "perl typhoonnbfdecode.pl extend.sdimg" to save all parameters it shows

[5] "perl typhoonnbfdecode.pl -x extend.sdimg" to save the dumped extended rom file, it is 0743d4c0-unknown_0743d4c0.nb for me.

[6] Downloading WinImage 8.0 from its web site, and open 0743d4c0-unknown_0743d4c0.nb for any customization you want below \__TFAT_HIDDEN_ROOT_DIR__, then save it to 0743d4c0-cooked.nb

[7] "perl typhoonnbfdecode.pl -r extend=0743d4c0-cooked.nb -p docuniqueid=00000000241001041c0811de0c0905b6 -p blversion=2.16.0000 -d cooked-extend.sdimg", remember changing the docuniqueid and blversion in the cmdline to the values you save in [4]

[8] Clone the cooked-extended.sdimg to your SD card using WinHEX

[9] Put that SD in, and boot into bootloader, and press voice dial when it asks for restoring extended rom from SD card.

[10] Reboot to normal when it is finished, and run Unlock extrom Wizard.cab to unhide your extrom.

**** You need my own updated typhoonnbfdecode.pl to have the ability to add extend module into SD image or NBF file, and it is attached, thanks for itsme for his excellent contributation to the XDA community.

Although I could cook the extended rom freely, but I found there are stiil limitations:

1) If I dare to delete one file in \Extended_Rom2, the FATFS of it will be destoryed totally

2) The read access to ext rom will stall definitely if I read a lot from it. For example, I put acrobat into ext rom, the first running will be ok, but it will stall the system in the second acrobat launching.

Hopes this information helpful for someone.