[8525, TyTN, MDA Vario II, JasJam ROM Development] RanDomIze:
[size=+2]This HoTo is based in Bepe metode and explanations from cicciocant

Cicciocant don't have a Thread abaut this in the forum, but have a similar explanations in Italian, in a Italian Forum.

Bepe Thread.

http://xdaforums.com/showthread.php?p=1476021#post1476021

Post from Cicciocant in the Italian Forum.

http://www.a1kstyle.com/viewtopic.php?p=121913#121913

and 1 mor time sorry for my bad ENG.[/size]

First you need a Base Rom.

Tools at end of this Post

With the nbhtool from dutty's decompile the RUU_signed.nbh

Now you have some new *.nb files

rename Windows.nb to OS.nb

So we start from the ROM format os.nb

with the tadzio tools and Bepe package tool Extrat SYS e OEM.

Put SYS and OEM in your Kitchen, Create a ROM folder in the Kitchen leave blank for now. (There goes the xip that we must first patch)

Now take the file OS.nb

Export xip.bin with the commands:

nbsplit -hermes os.nb

rename OS.nb.payload nk.nb

RomMaster -w 5 nk.nb -x -o xip.bin >NUL​

Now you need xipport from Bepe include

Execute Xipport in the same folder where you have nk.nb and xip.bin

Press [dump xip.bin] and you create a folder OUT dont close the XIPPORT

Go inside OUT\MODULES\ FLASHDRV.DLL and open the file s000 with a HEX editor.

FLASHDRV.DLL S000 needs of these changes:

- "58 20 43" to "04 20 43" (1 time)

- "58 30 43" to "04 30 43" (3 times)​

These values them are exactly the times that says Bepe, then you can not go wrong.

A this point go to XIPPORT again

First Push [realloc P] and then [Build xip_out.bin]

You now have the xip patched and you must merged with nk.nb.

At the bottom of XIPPORT there are two lines

In the last one we write nk.nb (there should be already written)

In the first one will be written the address within nk.nb begins where the xip.bin

How do you know the address?

Open the xip.bin with Hex editor and you see that begins with

FE 03 00 EA 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

45 43 45 43 68 1B 19 80 68 1B 19

Now open nk.nb with a hex editor and you trying find the address that begins with the hex sequence.

What is the data that you must enter in the first row on xipport?

You go see that address that begins with the hex sequence at 00000400 is not that one, and another at 00320000 or someting like that, this is the correct one.

In my Hermes is 00320000

See the image in Post: http://xdaforums.com/showpost.php?p=1837256&postcount=22

A this point press the [xip_out.bin write to:]

And now you have the nk.nb with the xip patched.

Now you need re-create the os.nb file with the commands:

rename nk.nb os.nb.payload

NBMerge -hermes os.nb​

A this point you need edite the OS.nb in the Hex editor

- BN files: 0x000001F5: short value + 0x48 (eg: 0xA7 +0 x48 = 0xEF)

- BN files: 0x000001FB: short value + 0x48​

This Hex Egitor is in attach Files

Attention. Let me give you an example of how I have done:

0x000001F5: A7 00 + 0x48 = EF 00

0x000001FB: A5 01 + 0x48 = ED 01​

Now copy the OS.nb and puts it inside the folder ROM in your kitchen.

Since then, we extract the xip from the OS.nb with the commands:

nbsplit -hermes os.nb

del os.nb

del OS.nb.extra

rename OS.nb.payload nk.nba

RomMaster -w 5 nk.nba -x -o xip2.bin >NUL

mkdir XIP

dumprom xip2.bin -5 -d XIP >NUL​

Last Steep:

Remove IMGFS\OEM\OEMDrivers\OEM_FLASHDRV.DLL

Delete all references "ExtRom" in:

XIP: boot.rgu, boot.hv;

IMGFS: default.hv;​

Using the regcomp and the notepad to delete/edit the HV files, you need [size=+1]SAVE AS the RGU file, and select the type as "Unicode" The reason to Save as Unicode, is because rgucomp can only read Unicode

Dont forget to put in the first line REGDIT4 and a Blank line afther that, and also a Blank lile at end of the file.

Then you can convert again the RGU file to HV file with the regcomp[/size]

​

Regards to all cooker's

PS: maybe some one put this in Sticky if useful