[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
Using prepare_imgfs with OS.nb

Source code of mamaich's prepare_imgfs is available here, it searches for the last occurrence of this magic inside OS.nb file:

unsigned char IMGFS_GUID[]={0xF8, 0xAC, 0x2C, 0x9D, 0xE3, 0xD4, 0x2B, 0x4D,
0xBD, 0x30, 0x91, 0x6E, 0xD8, 0x4F, 0x31, 0xDC };

I've taken two OS.nb files, one from HTC 1.18 ROM (produces 53Mb raw_data.bin), and one from HTC 1.35 rom (produces 7Mb raw_data.bin), and searched the IMGFS_GUID inside them.

HTC 1.35 has it 10 times, while HTC 1.18 only 4 times. Here's the output of radare:

$ file OS118.nb
OS118.nb: x86 boot sector; partition 1: ID=0x20, starthead 2, startsector 2, 6398 sectors; partition 2: ID=0x23, starthead 0, startsector 6400, 5888 sectors; partition 3: ID=0x25, starthead 0, startsector 12288, 104448 sectors; partition 4: ID=0x4, starthead 0, startsector 116736, 122880 sectors, code offset 0xfd

$ radare OS118.nb
open 'OS118.nb'
File size: 60702720
[0x0000000000000000] > b 28
Block size = 28
[0x0000000000000000] > /\xf8\xac\x2c\x9d\xe3\xd4\x2b\x4d\xbd\x30\x91\x6e\xd8\x4f\x31\xdc
0x00000000000DCA78 '.search0'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000000DCA78 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 4300 4500 4300 4F00 4D00 5000 |..,...+M.0.n.O1.C.E.C.O.M.P.|

0x00000000000DCDA4 '.search1'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000000DCDA4 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 5800 5000 5200 0000 4300 6F00 |..,...+M.0.n.O1.X.P.R...C.o.|

0x0000000000540B28 '.search2'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000540B28 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 4300 4500 4300 4F00 4D00 5000 |..,...+M.0.n.O1.C.E.C.O.M.P.|

0x0000000000659000 '.search3'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000659000 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

End of file.
[0x00000000039E4000] >

$ file OS135.nb
OS135.nb: x86 boot sector; partition 1: ID=0x20, starthead 2, startsector 2, 6398 sectors; partition 2: ID=0x23, starthead 0, startsector 6400, 5888 sectors; partition 3: ID=0x25, starthead 0, startsector 12288, 105728 sectors; partition 4: ID=0x4, starthead 0, startsector 118016, 121600 sectors, code offset 0xfd

$ radare OS135.nb
open 'OS135.nb'
File size: 61368320
[0x0000000000000000] > b 28
Block size = 28
[0x0000000000000000] > /\xf8\xac\x2c\x9d\xe3\xd4\x2b\x4d\xbd\x30\x91\x6e\xd8\x4f\x31\xdc
0x00000000000D0778 '.search0'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000000D0778 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 4300 4500 4300 4F00 4D00 5000 |..,...+M.0.n.O1.C.E.C.O.M.P.|

0x00000000000D0AA4 '.search1'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000000D0AA4 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 5800 5000 5200 0000 4300 6F00 |..,...+M.0.n.O1.X.P.R...C.o.|

0x0000000000534828 '.search2'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000534828 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 4300 4500 4300 4F00 4D00 5000 |..,...+M.0.n.O1.C.E.C.O.M.P.|

0x0000000000618410 '.search3'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000618410 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x000000000063E368 '.search4'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
000000000063E368 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x0000000000642E90 '.search5'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000642E90 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x00000000006438B8 '.search6'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000006438B8 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x0000000000659000 '.search7'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
0000000000659000 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x00000000032E83F0 '.search8'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000032E83F0 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

0x00000000032EBAC8 '.search9'
offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B 0123456789ABCDEF0123456789AB
----------------+----------------------------------------------------------------------+----------------------------.
00000000032EBAC8 F8AC 2C9D E3D4 2B4D BD30 916E D84F 31DC 0100 0000 0100 0000 0100 0000 |..,...+M.0.n.O1.............|

End of file.

prepare_imgfs finds IMGFS start at offset 0x00659000 for 1.18 rom and at offset 0x032EBAC8 for 1.35 ROM:

C:\imgfs_tools>prepare_imgfs.exe OS118.nb -acer
Searching for IMGFS start... Found at 00659000
Dumping IMGFS ...
Done!

C:\imgfs_tools>prepare_imgfs.exe OS135.nb -acer
Searching for IMGFS start... Found at 032EBAC8
Dumping IMGFS ...
Done!

So it's only reading from the last occurrence of IMGFS_GUID until the end of the file.

So I took OS.nb from HTC1.35 rom and splited it in 11 parts, each part starts with an ocurrence of IMGFS_GUID except the first:

-rw-r--r-- 1 root root 853880 Jan 15 04:54 os135part1.nb
-rw-r--r-- 1 root root 812 Jan 15 04:54 os135part2.nb
-rw-r--r-- 1 root root 4603268 Jan 15 04:54 os135part3.nb
-rw-r--r-- 1 root root 932840 Jan 15 04:55 os135part4.nb
-rw-r--r-- 1 root root 155480 Jan 15 04:55 os135part5.nb
-rw-r--r-- 1 root root 19240 Jan 15 04:55 os135part6.nb
-rw-r--r-- 1 root root 2600 Jan 15 04:55 os135part7.nb
-rw-r--r-- 1 root root 87880 Jan 15 04:55 os135part8.nb
-rw-r--r-- 1 root root 46724080 Jan 15 04:56 os135part9.nb
-rw-r--r-- 1 root root 14040 Jan 15 04:56 os135part10.nb
-rw-r--r-- 1 root root 7974200 Jan 15 04:56 os135part11.nb

If you look at the size of part11, this was the 7Mb that prepare_imgfs.exe was dumping out of OS.nb, so I took only the part9 (the biggest) and produced a 46Mb imgfs_raw_data.bin file, that I could dump successfully with viewimgfs.exe :D

Still have to investigate WTF are the other parts :confused: