yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] trinca:
Samsung i60x ROM: Extracting the OS payload from the Upgrader exe single file

The Upgrader program contains 3 payloads: Eboot, Phone and O/S. To extract the O/S payload follow this procedure:

1. Open the exe upgrader file using the Hex editor of your choice.

2. Locate the ASCII string B000F followed by 0x0A. The complete sequence you should look for is 0x4230303046460A. You should find 3 occurrences of the above string. Concentrate on the last one.

3. Copy from this start address all the way up to the string 0x060000EA3B, which is the start of the phone ROM.

4. Make sure your cut includes 12 trailing zeroes 0x000000000000 as they indicate the loader the end of the Runtime of the pda image.

5. Name your file ending with a bin extension. (i.e XXGD1_pda.bin)

6. Proceed with cvrtbin to extract the absolute (or plain) ROM image (ending in nb0.

7. You are ready to start cooking.

I was able to sucessfuly extract in this way the ROMS for i600 releases: XXGC6 and XXGD1 and for i607: UCGB4 and UCGD2.

How did I find out? I got the chance of getting the XXGC6 upgrade package, which included the eboot, phone and pda sections separated. Further reading in the forums indicated the B000FF is followed by 0x0A, the start address of the ROM (00000000) and the end address. From there it was easy to locate the payloads in the Upgrader single exe file.

Good luck extracting your ROMS.
[Windows Mobile Development and Hacking General] trinca:
Samsung i607 Service Manual

Below is the link for the SGH-i600 service manual URL. Does anybody have the service manual and/or schematics for the SGH-i607?
[Windows Mobile Development and Hacking General] trinca:
BIN B000FF runtime image file format

Does anybody have a detailed description of the arrangement of headers and records in this file format? The best reference I have found is this page:

http://www.devpia.com/MAEUL/Contents/Detail.aspx?BoardID=60&MAEULNO=23&no=242&page=1

Unfortunately I do not understand Korean...
[Windows Mobile Development and Hacking General] cmonex:
hey, i again sent you an email. i'll quote it in PM too just to be sure.

btw, the rom tutorial that i wrote and that you linked to, fully details B000FF format. what is not clear about it?
[Windows Mobile Development and Hacking General] trinca:
The tutorial is right

There is nothing wrong with your tutorial, I had to use the HEX editor several times until I got that right.
[Windows Mobile Development and Hacking General] trinca:
Do you know if isotherm may share the source code for xipbin? Do you have a way to contact him? I tried to contact him at hpcfactor with no results.
[Windows Mobile Development and Hacking General] JugglerLKR:
Trinca - ok, let's imagine you got all the needed files to B000F format. How do you plan flash it back to your i607?
[Windows Mobile Development and Hacking General] trinca:
Creating the B000FF Runtime image

After cooking the ROM...how to re-create the B000FF Runtime image back? That is the $1M.. question, I am still navigating uncharted waters...

Producing the Flashable runtime image back is what I am now concentrating on, as I see it there may be 4 possible ways:

1) Manually

-a) Splitting the nb0 file in [n] 128KB chunks (for a ~64MB image, there are over 500 x 128KB chunks)

-b) adding the chksum32 at the beginning of each chunk

-c) adding the address and offset to the beginning of the above.

-d) merging it all together

-e) adding B000FF, start address and offset at the beginning of the merged files

You can use an Hex editor with scripting properties such as 010Editor and write a script to accommodate a) thru e)

http://www.sweetscape.com/010editor/

Still a pain in the neck and the scripting language is similar to C, if you know this language it will be easy for you to automate the above. Still experimenting with it.

2) Using XIPBIN, made by somebody AKA isotherm, this utility will make a B000FF runtime file good for a HP/NEC mobilepro, the record length is made 0x40000 bytes long, different from 0x1FFE0 record length of the original ROM, according to cmonex, this should not be a problem provided the record is made of different length and has the right checksum per record, but I already have made several attempts and it does not work for me, when flashing the phone it gets stuck at the very beginning. You may research further here.

3) Modify xipbin and make it produce records 0x0001FFE0 bytes long, as the source code for this utility is not available, cmonex says isotherm had disappear. I am still hacking into this utility...

4) Create our own program using VC or VB, I may probably work on this one as well, as I get some time available.

I am attaching a copy of xipbin.exe, however if you have followed my instructions, you may probably have it already, please let me know of any success (or failure, we all learn from these ones too).

usage:

xipbin [myrom.nb0] [start address for myrom.nb0] [myrom.bin] [start address for myrom.bin]

For Samsung's B000FF ROMs the command will look like:

xipbin myrom.nb0 0 myrom.bin 0

myrom.bin is then recreated from scratch.

Also according to cmonex, you may do the following:

a) Get an original B000FF ROM

b) use cvrtbin.exe and obtain a nb0 ROM

c) use xipbin with this nb0 and re-create a runtime bin file.

d) apply again this cvrtbin utility to the re-created runtime bin file

e) compare the result with above b) step

f) If they match you may have a candidate procedure, if they don't do not attempt to flash the phone with the procedure above.

I will include the new viewbin and cvrtbin, which now works with start address 0 on this type of ROMs

Usage:

cvrtbin -r -a [start address] -l [length of ROM] -w [8, 16 or 32] [romfile.bin]

cvrtbin -r -a 0 -l [the length of your ROM] -W 32 [myrom.bin]

Good luck!
[Windows Mobile Development and Hacking General] trinca:
The format of MS BIN B000FF runtime image file

According to several sources I have consulted, including MS documentation and insights given by cmonex, plus heavy HEX editing sessions, this is my impression on how the B000FF Runtime image format looks like:

Byte------>--1--2--3--4--5--6--7--8--9--A--B--C--D--E--F

Record 0 -> 42-30-30-30-46-46-0A--<Strt add>--<ROM lgth> * * * * * * * * * * * (42-30-30-30-46-46 = B000FF in ASCII ; 0x0A = end of header B000FF)

Byte------>--1--2--3--4--5--6--7--8--9--A--B--C--<-----128KB of nb0 image------>

Record 1 ->--<Strt Add>--<Rec lgth>--<CHKSUM32>--<--Chunk Nbr 1 of nb0 image--->

Record 2 ->--<Strt Add>--<Rec lgth>--<CHKSUM32>--<--Chunk Nbr 2 of nb0 image--->

v - v

v - v

v - v

Record n-1>--<Strt Add>--<Rec lgth>--<CHKSUM32>--<---Last chunk of nb0 image--->

Last Rec-->-00-00-00-00-00-00-00-00-00-00-00-00 .* * * * * * * * * * * * * * * (The last record always ends with 12 bytes set to 0x0)

**************************************

Please note:

Record 0 and the last one are different

All data are encoded Little Endian!

**************************************

Using the command:

viewbin -r [myrom.bin]

Will give you the record content of your runtime image file.
[Windows Mobile Development and Hacking General] JugglerLKR:
Trinca - just ran viewbin on samsung i750 image. chunks sizes are not 128kb each. looks like chunks are actually files from ROM in XIP format (executable in place, it is usual PE files but missing reloc table and something else). I bet we should use file deleting/adding/injecting utility like romtools one for ROM image manipulation which reamins intact B000F header! I see no other way to recreate B000F.
[Windows Mobile Development and Hacking General] trinca:
Well, I guess your runtime differs from that on the i60x. In any case I know of a tool made by bepe the name of xipport, you can look at this thread and download it here:

http://xdaforums.com/showthread.php?t=315030

The best thing I can recommend you to do, is to try to get the appropriate format of your runtime image.

trinca
[Windows Mobile Development and Hacking General] JugglerLKR:
unfortunately all version of xipport just crash with errors on my ROM dump.
[Windows Mobile Development and Hacking General] trinca:
ROm Dump

JugglerLKR:

Let's get acquainted with your procedure, and do not pretend to modify something, just to find out if the tools work:

a) Have you dumped the ROM from the phone or you just extracted it from the updater executable?

b) If you have just cut the ROM out of the executable, use the new cvrtbin posted before (which runs fine at start address 0)

c) Run Mamaich's prepare_imgfs, there are 3 possible options:

prepare_imgfs [yourROM.bin] will produce imgfs_raw_data.bin and imgfs_removed_data.bin

prepare_imgfs [yourROM.bin] -nosplit will produce imgfs_raw_data.bin and an empty imgfs_removed_data.bin

prepare_imgfs [yourROM.bin] -acer will produce imgfs_raw_data.bin and an empty imgfs_removed_data.bin, but this one is the only which has worked for the i60x

d) Now if you use viewimgfs then the dump directory will be created and the files will be extracted. It is only after this confirmation you may be assured the ROM extracted has the correct structure for manipulation. I got so much trouble using the old version of cvrtbin, that I am telling you to run these extra steps.

Now try to run the xipport tool on the above *.nb0 file. and tell us if you were successful. At this point if you are not able to run the xipport tool, then you may not have something usable. RomMaster and dumprom/dumpromx are also alternatives for working with xip modules, please remember all these tools are highly experimental and not bug-free!

trinca
[Windows Mobile Development and Hacking General] JugglerLKR:
I have dump from device and cut from exe updater.

a) b) c) steps runs fine, except last output of cvrtbin "Progress...0%Done."

d) viewimgfs worked on imgfs_raw_data.bin and imgfs_removed_data.bin which was made from nb0 with -acer swtich!

At the same time viewimgfs ALSO worked on ROM dump!!!

And content of both dumped dirs (the one from viewimgfs romdump.raw and viewimgfs imgfs_raw_data.bin) are equal bit to bit!

But XIPPORT didn't work on ROM dump, also xipport didn't work on imgfs_raw_data.bin, and didn't work on *.nb0 :-( But there are lot versions of xipport floating around... Maybe you have some special one like new cvrtbin?
[Windows Mobile Development and Hacking General] trinca:
JugglerLKR

I am afraid I don't have a newer tool like such. Right now I am running in some trouble so far trying to restore the dumped files (without even making no modifications) back into a workable runtime ROM, I'll try to contact mamaich to find out if he can pour some insight.
[Windows Mobile Development and Hacking General] JugglerLKR:
I'm exactly in the same situation! Have you seen leaked WM6 for i607 blackjack?
[Windows Mobile Development and Hacking General] trinca:
Yes, I have flashed my phone with it, but it is still buggy, soft keys do not hang-up the phone nor allow to redial after a while, it is full of forced promo advertising using either $ingular and now AT$T stuff... (so is the current ROM)

I feel :mad: like having purchased a new TV set, let's say it is brand SOXY, and when I am watching such TV, I have to see continuous nags advertising SOXY Mail, SOXY MediaNET, SOXY Music or SOXY videos. Come on, the phone is mine!, I have paid top $$$ for it, and have to see at every moment all these advertising...neither $ingular nor AT$T have paid me back to afford such an inconsiderate advertising, it is disgusting.

So what I am trying to do is to merge the dll's for Bluetooth and Camera into the unbranded european i600 ROM, that comes with carousel and other nice little applets and has no advertising. I have to do the dll changes because flashing the i607 with the european i600 ROM makes BT, vibrator and camera not to work.
[Windows Mobile Development and Hacking General] trinca:
Finally I was able to dump the ROM and build that back

Good news!:cool:

After a series of attempts to dump the imgfs and build that back, I was successful, here is what I have done:

1) Got image file i607_UCGB4

2) extracted the i607_UCGB4 using the new cvrtbin (posted before)

3) Used new RC2 Tadzio kitchen tools, using the switch [-acer], find the tools attached and the full thread here: http://xdaforums.com/showthread.php?t=298327

4) Dumped everything in dump directory, very smooth, no warnings at all

5) Built the nb0 back following instructions.

7) Splitted nb0 file in 128KB chunks

8) Added header and checksum info (still cumbersome, I don't have a tool for this yet)

9) Flashed phone with the above

10) Success! it work :)

Special tanks to tadzio, mamaich, itsme and the many others who had made contributions to build these tools.

To Do:

- A tool to automate steps 7 and 8. I am doing these steps using batch files and HEX editor macros, still a pain in the neck
[Windows Mobile Development and Hacking General] jiggs:
Modified bepe XIPport.exe

hello,

I just came across you thread. Seems to me you're working on the XIP region.

I also came across this modified tool of bepe's XIPport.exe which I find more easy to manipulate compared to the original.

Hope this helps...
[Windows Mobile Development and Hacking General] trinca:
Pleased to meet you, Jiggs.

Thank-you for your comments.

Will take a look at the earliest convenience!

trinca
[Windows Mobile Development and Hacking General] trinca:
The ROM Pda may not have ben cut out properly of the single file updater

JugglerLKR:

I was thinking of your case, and was betting your ROM structure may be a match to the i60x, therefore I have made some research, here are the results, this procedure is exactly what I have followed for the i60x, this time I will illustrate the example with the i718 ROM:

Thank-you for providing the i718 WM6 English updater; I downloaded it from the site you gave me (find the URL attached to this post)

1)Extract the runtime ROM from the executable with HEX editor:

-Found your ROM starting at offset 0x0017E800 and ending at 0x03EBC1D2

-Cutted this block and named it i718_ZMGF4.bin

2) viwebin -r i718_ZMGF4.bin

-Gave me start address 0x00000000, length 0x03D7C280, a total of 490 records, being the last record address 0x00000000, offset 0x00000000 and contents 0x00000000, which gave certainty I have cut the right offset.

3) Now we prepare the nb0 ROM with cvrtbin

cvrtbin -r -a 0 -l 3d7c280 -w 32 i718_zmgf4.bin

4) Next we use Tadzio's kitchen tools:

nbsplit -acer i718_zmgf4.nb0

- Got the payload and extra files: i718_zmgf4.nb0.payload & i718_zmgf4.nb0.extra

5) Produce the raw imgfs file:

imgfsfromnb i718_zmgf4.nb0.payload imgfs.bin

6) Dump all the contents into the dump directory

imgfstodump imgfs.bin

Beautifull, all the files are there.

7) This is the time when you may "cook" your ROM...

8) Ready to make the nb0 file back"? Here we go...

imgfsfromdump imgfs.bin imgfs-out.bin

9) And to merge the changes into a new payload file

imgfstonb imgfs-out.bin i718_zmgf4.nb0.payload new_i718_zmgf4.nb0.payload

10) Or should I say 0xA;)? Next, we merge all the changes into a new nb0 file, however, remember here to rename the extra content to match the name of the new file you will create:

ren i718_zmgf4.nb0.extra new_i718_zmgf4.nb0.extra

and then

nbmerge -acer new_i718_zmgf4.nb0

Voila! :cool: your new nb0 image is ready, now it comes the part to put that back in records 128KB long. Still working on this tool... Time is so scarce... Besides, I don't have an i71x to try this out, but you do have one, so if you like to contribute to the progress of science, and you have the courage, by all means, try it...

Conclusion: I am 100% sure the the i60x and the i71x Runtime ROMs have the same structure.

Good luck, and cook something interesting...
[Windows Mobile Development and Hacking General] adiel:
WM6 for i600 is here

The WM6 version is out check http://www.samsungmobile.com/promotion/i600/index.jsp

i've downloaded the file but i when i install it i get a "wrong version" message.

is there something someone can do in order to bypass this version check or find another way to install it with no errors?
[Windows Mobile Development and Hacking General] Prerna:
Was gonna post the exact same question...:cool:
[Windows Mobile Development and Hacking General] trinca:
i600 Download URL here

I got it

Will take a look to the WM6 firmware and let you know. Find the URL to download attached below.
[Windows Mobile Development and Hacking General] trinca:
i600 WM6 Update did not work in my phone

First of all, what I have is an i607, maybe the firmware is not longer compatible, the fact is the pda part of the updater does not work on the i607, it hangs at bootitme. Maybe this updater (UXXGG2) is still Beta, I need to dig further in this issue, comparing imgfs dumps from this release with the interim UCGD2 release from AT$T/$ingular. Can anybody please tell me if this update had work in your i600 phone?

To get rid of the version checker in the updater, just remove the pda part using the Hex editor as described previously in this thread.
[Windows Mobile Development and Hacking General] BigBlue007:
What sence would it make to flash the WM6 update w/o the PDA part?

Can you think of any other method to trick that version check, especially if you actually do have an i600? Initially, the i600uxxupdater.exe was offered for dutch and russian versions of the device on the Samsung website. From the filename, one would believe the update is pretty much generic (language-wise it actually is, since WM-Smartphone ROMs contain a bunch of GUI languages), but there still seem to be some sort of check. My i600 (unbranded, german version) is being rejected with the "wrong software-version" error. Tweaking the version number in the registry didn't helped.

Any suggestions would be greatly appretiated. ;)
[Windows Mobile Development and Hacking General] trinca:
i600 WM6 firmware update - no version check - here:

===========================

Flash the phone at your own risk!

===========================

I cutted the pda, phone and boot sections out of the UXXGG2 updater, therefore there would be no more version check, I have included the single updater utility, same as used in the XXGC6 firmware; however I haven't tested this myself because I don't have an i600, and this update does not work on the i607 Blackjack; although care was taken at performing "surgery" in the updater, can't warranty the success. I have also included the URL for the modem driver just in case you need it.

===========================

Flash the phone at your own risk!

===========================

Being finished with the apocalyptic blah blah..., if you get the courage to flash your phone despite the warnings, please post your results in this thread for the sole benefit of the i60x community.:)
[Windows Mobile Development and Hacking General] bryanz:
Mmmmmm, quite risky, could I end with a bricked phone?

I am a bit scared of trying it!

Try to convince me and I will do it!

PS.

Horror I write so few times that iI have in my profile the Qtek 8310!!! Have to change that, since I have had many devices since that one!
[Windows Mobile Development and Hacking General] bryanz:
Sorry, it is not working :(

The program says all the update is ok, but when the phone soft resets it is stuck at the loader screen and it does not load Windows mobile :(
[Windows Mobile Development and Hacking General] bryanz:
Note that before upgrading I changed my regional settings to Nederlands just in case

Here is the log file in case it helps you:

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 32768

[LogFile 361] DBT_DEVICEARRIVAL Mask Value = 32768

[LogFile 370] DBT_DEVICEARRIVAL for Loop Start = 32768

[LogFile 461] return TRUE = 32768

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 32768

[LogFile 361] DBT_DEVICEARRIVAL Mask Value = 32768

[LogFile 370] DBT_DEVICEARRIVAL for Loop Start = 32768

[LogFile 461] return TRUE = 32768

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 32772

[LogFile 426] DBT_DEVICEREMOVECOMPLETE Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 461] return TRUE = 32772

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 32768

[LogFile 361] DBT_DEVICEARRIVAL Mask Value = 32768

[LogFile 370] DBT_DEVICEARRIVAL for Loop Start = 32768

[LogFile 389] DBT_DEVTYP_PORT Loop Start = 32768

[LogFile 398] !strTemp.Find Loop Start = 32768

[LogFile 461] return TRUE = 32768

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 7

[LogFile 461] return TRUE = 7

[LogFile 354] Device Change Mask Value = 32772

[LogFile 426] DBT_DEVICEREMOVECOMPLETE Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 441] DBT_DEVICEREMOVECOMPLETE for Loop Start = 32772

[LogFile 461] return TRUE = 32772
[Windows Mobile Development and Hacking General] nehvada:
am i missing something here? why is everybody ignoring that there might be a reason for different rom version like i600UXGxx, i600XXGxx etc.?

no wonder that it doesnt work.

besides keyboard mapping and the 0,1% chance of having different hardwares in those devices.....
[Windows Mobile Development and Hacking General] bryanz:
Because the download link was the same for Rusiia and Netherlands and once you execute the file it lets you choose the language you want from a large list.
[Windows Mobile Development and Hacking General] nehvada:
the language to choose from is only for the updater interface on your pc, just the guiding through the updating. it doesnt effect at all the software which is to be flashed on your device.

the only reason russia and netherlands have the same updater file is because they are selling the phones with the same rom versions in their countries. so for the other countries they gonna prepare some updaters also for i600XXGxx and all the others which do not match with the dutch/russion updater.
[Windows Mobile Development and Hacking General] bryanz:
I disagree (although I am not sure). The other ROMs had all of the languages once you installed them. Why should be different this one?

Why would want Russian or Netherlands read the installation in French for example?

Anyway, someone at Modaco (in the post me and you are also posting) has managed to install it on his device and is uploading the files. We will see.