[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] goye:
Bummer Thread. Can we make it better?

Hello forum.

A great “konnichi-wa” to you all from Japan.

I got an HTC S11HT from E-mobile, a start-up mobile company, in Japan. Since I’m not staying here for long, I didn’t want to spend my hard-earned cash in some phone that it wouldn’t work outside of this country once things were over.

So, I realized that this company offered the Kaiser. “Great!” – I said to myself. “As a good kinky engineer, all what I have to do is buy it, go home and flash the device so it can work anywhere.”

The good news is that this company doesn’t lock the phone. I brought a SIM card from Colombia and, with proportions in mind, I was able to see its content. I also spoke to tech representatives and they assured that this phone didn’t come locked in any way in order to allow their customers to travel overseas and adapt it to any type of 3G / GSM network.

Now, that’s the main reason I personally bought this phone.

I came here and started googling. I do appreciate and know that if you want to get something done, you really have to do your homework and research. I, too, have an independent technology community (that’s another story, though; and we can touch base later) dedicated to Microsoft Technologies. I know how picky some people are in answering the same question over and over again, since the answer might be somewhere.

So, after 3 hours surfing, I ended up with this thread. I saw POF’s post on how to “Dump HTC Kaiser ROM” .

“Cool. I found what I need. A way to back the ROM of my phone just in case I do something wrong” – me thought.

Well. Not quite.

First of all, POF forgot (or maybe omitted to say) that offset sizes of the RAW files varies according to the language that you are dumping. Let me put it simple.

A. DUMPING A ROM USING pdocread.exe

POF explained it well. All what you need to do is download the tools (http://www.xs4all.nl/~itsme/projects/xda/tools.html) , execute the command as POF indicates to do, and if everything goes well, you get your RAW images.

Right? Right?

Wrong!

Usually, the OS has a restriction in a security policy in the registry that impedes to execute remote applications. Kindly, a user called Ultimate pointed out that the problem in being unsuccessful in executing remote code on any PDA based on Windows Mobile 5/6 was a registry.

“Good!. Let’s run good old regedit and modify the key. You give me the path, I’ll do the rest.”

Man. Wrong again !

Mr. Ultimate said which was the registry key (by the way, it´s [HKLM\Security\Policies\Policies] and the value to modify is 00001001 from 2 to 1.

But, guess what? Mr. Ultimate forgot to say that a.) this freaking key was actually IN THE PDA, not the computer and that b.) a special tool called RegeditSTG had to be downloaded and copied to the PDA and be run in the PDA so you can look for the key and do the changes.

(Please, if you need that piece of software check this link in the forum: http://xdaforums.com/showthread.php?p=2034364)

Please, and before continuing with this speech: Don’t consider me a troll. I’m not here to upset people or harm susceptibilities. My intention, in good faith, is to point out that sometimes we try to give an answer, but we don’t take our time to answer them appropriately.

If we take our time to answer thoroughly, deeply and precisely, I can guarantee you that the people, and mostly, new users (calling them newbies or so is some sort of being snobby and disdainful with them) to these types of issues will decrease and instead, we, as a community, might construct good solutions and knowledge bases to problems posted by people.

Well. Keeping up with the story: I managed to finally do the dump of my ROM (as POF posted the instructions. Anyone needing a ROM dump from a brand new, sparkling Japanese Kaiser let me know.)

I also found out that the offset of the partitions are different.

Some people got spooked out because they saw that their dumps didn’t correspond in offset to the result that POF posted as an example in the thread.

Look. This is what POF posted:

210.38M (0xd260000) FLASHDR

| 3.12M (0x31f000) Part00

| 3.50M (0x380000) Part01

| 69.38M (0x4560000) Part02

| 134.38M (0x8660000) Part03

STRG handles:

handle e7489c1a134.38M (0x8660000)

handle 474960e6 69.38M (0x4560000)

handle c74b0fda 3.50M (0x380000)

handle 074b0eee 3.12M (0x31f000)

disk e7489c1a

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk 474960e6

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk c74b0fda

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk 074b0eee

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Now, I made a dump. Look what my dump gave as a result:

210.38M (0xd260000) FLASHDR

| 3.12M (0x31f000) Part00

| 3.63M (0x3a0000) Part01

| 68.50M (0x4480000) Part02

| 135.13M (0x8720000) Part03

STRG handles:

handle a7486c82135.13M (0x8720000)

handle a749618e 68.50M (0x4480000)

handle 074aff52 3.63M (0x3a0000)

handle 074aff76 3.12M (0x31f000)

disk a7486c82

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk a749618e

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk 074aff52

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk 074aff76

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

As you can see, my offsets are different from POF’s

Look. See POF’s outputs compared to mine

POF’s Part00 offset: 0x31f000

Mine: 0x31f000.

“So far, so good” – I said to myself.

POF’s Part01 offset: 0x380000

Mine: 0x3a0000.

“Oops. Did I do something wrong? Nah! I did exactly what POF posted. Since he’s the man, I must trust him. Besides, I think that since my phone is JPN and POF’s maybe English or some other thing, it makes pretty darn sense to have a size mismatch. Japanese is far more complex to compile vs. English. Plus we have to take in consideration the revision of the OS, and so forth”.

Let’s keep looking.

POF’s Part02 offset: 0x4560000

Mine: 0x4480000.

“Spooky. But, still, there is the language and OS difference.” – Me thought.

POF’s Part03 offset: 0x8660000

Mine: 0x8720000

“Now, this fourth part is bigger. The third one was smaller. What the ….” – I was starting to say out loud. Still, I’ve know that not all files and their outputs are identical since there are the language and device factors to be taken in consideration.

“Damn. I’ll try to assemble the RAW files.” – I said.

So, again, I read POF’s post carefully to see what was next.

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw

pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x380000 Part01.raw

pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4560000 Part02.raw

pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8660000 Part03.raw

“Ok. What the hell is different here? Oh! Oh! I see. He is using as base directions the handles of the offset. Bingo! No worries. I’ll use my own offsets instead of POF’s. In that way, I can compile my own RAW files and end of the story.”

So, according to this theory, this is how I must make my compilations:

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw

pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw

pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4480000 Part02.raw

pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8720000 Part03.raw

In execution:

pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw

CopyTFFSToFile(0x0, 0x31f000, Part00.raw)

Done. No errors. Smooth.

pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part01.raw

CopyTFFSToFile(0x0, 0x3a0000, Part01.raw)

Done. No errors. Smooth.

And so with the other 2.

“So, this is it. I have the ROM images. But, how can I use this thing? How can I put all these files together back to the phone just in case I might claim a warranty?”

I thought that the forum might have answered that question, as well.

So, I googled and searched again, and I found this thread.

How to Reconstruct a Dumped ROM & Reconstructed ROMs. http://xdaforums.com/showthread.php?t=337066

I almost got an orgasm of joy. I thought that this thing of hacking a phone, changing the language and making it work according to you was so straightforward, as long as you followed the instructions and used a little bit of your head.

Well, I’m at a dead end here. Many, many of you claim to have changed the language, the tweaks and so of your phones.

But, this thread is too cryptic.

Can anyone, kindly point me out to another step by step post or link where, after getting the RAW files, I can finish the job of flashing my Kaiser from Japanese to English or better, to Spanish, without bricking it?

Perhaps some of you might say: "Jeez! Use your head."

Instead of being sarcastic, can someone just point out STEP by STEP the remainder procedures to get this done?

See you, forum. Hope to hear you soon !