[Upgrading, Modifying and Unlocking] aszeman:
Hi! (For borisbme Szia!)

Here I summarize my experiences with T620.

NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the below things you will risk that you make your device a brick. Try this at your own risk!

First take a look at the MioP550 - Osc260A R05_P09.nb0 file. The header structure seems to be rather straightforward.

0x00: "Pocket_PC_2005" \x00 \x00 \x00

0x10: 4 bytes : offset of the 1st section

4 bytes : length of the 1st section

4 bytes : checksum

4*'\x00'

0x20: "MS_IPL" som '\x00's

0x30: 4 bytes : offset of the 2nd section

4 bytes : length of the 2nd section

4 bytes : checksum

4*'\x00'

0x40: "OS_IMAGE" some '\x00's

0x50: 4 bytes : offset of the 3nd section

4 bytes : length of the 3nd section

4 bytes : checksum

4*'\x00'

0x60: "UBOOT" some '\x00's

I believe the 1st secion is the update loader , the 2nd is the actual update in MSFLSH50 format (-acer type) and the 3rd is UBOOT update.

Let's not touch the IPL and UBOOT section for a while ;-)

Based on the above information you can split the image into 3 parts and change the OS_IMAGE part.

I noticed that the checksum is for verification purpose but it does not prevent the flashing of an image with wrong checksum. I learned that because I changed the checksum to FFFFFFF to see how flashing reacts, but after a few "Bad checksum, press any key" messages I accidentally flashed my T620 with the above P550 ROM :-(

Let's look at the OS_IMAGE part.

If you want quick dump, you can try prepare_imgfs "saved OS_IMAGE file" -n -acer and view_imgfs , but you can further decompose the file.

I wrote it's "-acer" type, because it has 512 bytes sectors padded with 8 extra bytes. If you remove the padding then you have a clean MSFLSH50 file you can manipute with msflshtool.

Here I can see some difference between the P550 and T620. The 1st sector is the MBR and the partition sizes are different for the 2 device. The 2nd sector is still MSFLSH50 header, I don't know the structure, so would not change that. My assumption was, that it the file sizes are the same, it would not hurt to replace parts ;-)

One can go further with the P550 partition sizes and change T620 dumps to fit into it.

With the following little python script you can split the OS_IMAGE into parts. Do not comment the code , I not a skillful coder;-)

from binascii import hexlify
from struct import unpack

parts = (("part00",0x8FE),("part01",0xF00),("filler",0x200),("part02",0xD500))
infile = open("OS_IMAGE.dat","rb")

## MBR
mbr=open("mbr.dat","wb")
data = infile.read(520)
mbr.write(data)
mbr.close()

## HDR
hdr=open("hdr.dat","wb")
data = infile.read(520)
hdr.write(data)
hdr.close()

for (part,size) in parts:
print "Extract part ",part
ofile = open(part+".dat","wb")
for i in range(0,size):
data = infile.read(512)
marker = infile.read(8)
ofile.write(data)
ofile.close()

print "Extract rest"
ofile = open("rest.dat","wb")
while True:
data = infile.read(512)
if len(data) == 0:
break
marker = infile.read(8)
ofile.write(data)
ofile.close()

part00 corresponds to the "pdocread" dumped part00 ( I guess it's the bootloder)

part01 corresponds to the "pdocread" dumped part01 ( I guess it's the kernel partition)

part02 corresponds to the "pdocread" dumped part02 ( It is the IMGFS OS image )

With the following little python script you can combine back the parts into a "new" OS_IMAGE you can use to replace the corresponding part in the ".nb0"

from binascii import hexlify
from binascii import unhexlify
from struct import unpack
from struct import pack

parts = (("part00",0x2,0x8FE,"fdfffbff"),("part01",0x900,0xF00,"fdfffbff"),("filler",0x0,0x200,"fffffbff"),("part02",0x1800,0xD500,"fffffbff"))
outfile = open("NEW.dat","wb")

## MBR
mbr=open("mbr.dat","rb")
data = mbr.read(520)
outfile.write(data)
mbr.close()

## HDR
hdr=open("hdr.dat","rb")
data = hdr.read(520)
outfile.write(data)
hdr.close()

for (part,start,size,mark) in parts:
print "Combine part ",part,start,size
ifile = open(part+".dat","rb")
for i in range(0,size):
data = ifile.read(512)
if data == '':
print "Less data"
data = '\xff'*512
if(data == '\xff'*512):
marker = unhexlify('ffffffffffffffff')
else:
marker = pack("<L",start+i)+unhexlify(mark)
outfile.write(data)
outfile.write(marker)
ifile.close()

print "Combine rest"
ifile = open("rest.dat","rb")
while True:
data = ifile.read(512)
if len(data) == 0:
break
marker = unhexlify("ffffffffffffffff")
outfile.write(data)
outfile.write(marker)
ifile.close()
outfile.close()

The part00 and part01 is smaller in case of T620 with 0x100*512 bytes compared to P550. Add some '\FF\s to have the same size.

The part02 is bigger in case of T620, but the end of it is full of zeroes. Remove some zeroes to have the same size.

If you bring T620 dumped files to same size, you can replace those parts, combine back to OS_IMAGE and replace that part in the .nb0

The part02 can be fully edited with imgfs tools.

The part00 and part01 has SRPX signature, so you can use SRPX2XIP and then xipport or dumprom to check the content.

The .nb0 got this way can be flashed using DNW.

The next step would be the cooking ;-)

With imgfs tools you can easily remove/add packages. The unfortunate thing is that if you change AKU level then you might have to modify the 2 XIP parts as well. I have no experience with that (so far).

Also for porting WM6 it would be really good the have the pdocread dump of the P560 partitions ;-)

Hope this helps a little bit for proceeding with T620/P550 cooking/porting.

NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the above things you risk that you make your device a brick. Try this at your own risk!