[Upgrading, Modifying and Unlocking] raykisi:
The method is based on the Rom Dump for Hermes with a little bit of modifications to suit KS20

http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom

Firstly, download the "itsutils tools" at:

http://wiki.xda-developers.com/index.php?pagename=XdaUtils

Now let's start the process:

1. Unzip the contents of itsutils.zip on c:\itsutils

2. Connect your KS20 to PC using USB cable, and make sure ActiveSync is running

3. Start -> run -> cmd.exe

4. cd c:\itsutils

5. First we are going to find the device handles for all the flash partitions, using pdocread -l

c:\itsutils>pdocread.exe -l

221.88M (0xdde0000) DSK1:

| 1.25M (0x13f000) Part00

| 5.00M (0x500000) Part01

| 69.25M (0x4540000) Part02

| 146.38M (0x9260000) Part03

1.90G (0x79b00000) DSK2:

| 1.90G (0x79ae1200) Part00

STRG handles:

handle 05bba79a 1.90G (0x79ae1200)

handle 65dadd7e146.38M (0x9260000)

handle e5dc0512 69.25M (0x4540000)

handle c5d67fb6 5.00M (0x500000)

handle a5dc04ca 1.25M (0x13f000)

disk 05bba79a

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk 65dadd7e

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk e5dc0512

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk c5d67fb6

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

disk a5dc04ca

0 partitions, 0 binary partitions

customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

6. If you get the following errror, probably your device is application locked:

C:\itsutils>pdocread.exe -l

Copying C:\itsutils\itsutils.dll to WCE:\windows\itsutils.dll

Could not update itsutils.dll to the current version, maybe it is inuse?

try restarting your device, or restart ActiveSync.

Basically you have to modify this registry key, and then softreset using power button:

HKLM\Security\Policies\Policies

valuename '00001001' was set to dword:2, change it to dword:1

dword: any thing other than 1 disallows unsigned

dword: 1 allows unsigned

7. Note: There are two ways to read each partition: pdocread -h 0xHANDLVALUE 0 0xSIZEVALUE diskimage.nb or pdocread -d storename -p partitionname StartValue LengthValue file.raw

We will use the second method for the next step.

Overview of flash partitions (just for your information, not a step)

FLASHDR STOREINFO 114.88M (0x72e0000) dev='FLASHDR' store='Microsoft Flash Disk'

nsect=39700 bpsect=200 free=0 maxpartsize=0

3.12M ( 0x31fc00) Part00 'BOOT' end= 18fe type=20 image update kernel partition (XIP), used while image updates

2.88M ( 0x2e0000) Part01 'RAWFS' end= 1700 type=23 regular kernel partition (XIP), used for normal OS boot

50.88M (0x32e0000) Part02 'imgfs.dll' end=19700 type=25 imgfs

58.00M (0x3a00000) Part03 'fatfsd.dll' end=1d000 type=04 user filesystem

EXT_FLA STOREINFO 10.00M (0xa00000) dev='EXT_FLA' store=''

nsect=5000 bpsect=200 free=0 maxpartsize=0

10.00M ( 0xa00000) PART00 'fatfsd.dll' end= 5000 type=04 extended rom

This does not include the IPL, splash and SPL.

8. Check that all the partition sizes reported by pdocread are correct:

c:\itsutils>pdocread -w -d DSK1: -p Part00 -b 0x800 -t

real nr of sectors: 638 - 1.25Mbyte, (0x13f000)

c:\itsutils>pdocread -w -d DSK1: -p Part01 -b 0x800 -t

real nr of sectors: 2560 - 5.00Mbyte, (0x500000)

c:\itsutils>pdocread -w -d DSK1: -p Part02 -b 0x800 -t

real nr of sectors: 35456 - 69.25Mbyte, (0x4540000)

Note the partition sizes (in brackets) for the next step. They may differ from device to device.

9. Now let's dump the first 3 partitions (coldboot kernel, base kernel and imgfs), use the sizes you found in the previous step.

c:\itsutils>pdocread -w -d DSK1: -p Part00 -b 0x800 0 0x13f000 Part00.raw

CopyTFFSToFile(0x0, 0x13f000, Part00.raw)

c:\itsutils>pdocread -w -d DSK1: -p Part01 -b 0x800 0 0x500000 Part01.raw

CopyTFFSToFile(0x0, 0x500000, Part01.raw)

c:\itsutils>pdocread -w -d DSK1: -p Part02 -b 0x800 0 0x4540000 Part02.raw

CopyTFFSToFile(0x0, 0x4540000, Part02.raw)

As the Part02.raw file is large, it will take a few mins, dw just wait and it will be done!!!

Note: Step 7 is not important, can be igorned!