[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] KMFM$:
[MANUAL] XIP Porting for Kaiser

Terms:

====

BASE = Kaiser ROM 3.29.707.0

DONOR = Opal ROM (Build 19971)

' = indicates folder/file

" = actual item wording

Preparing the BASE for the Port

=======================

Dump your BASE ROM so that you get the xip.bin.

Dump your BASE xip.bin with XIPPort.exe, and click "write maps" to get MAP.txt in the 'OUT' folder.

(*The xip.bin file needs to be in the same folder as xipport.exe.)

Open the 'OUT\MAP.txt' and go through what you will need to achieve for a full port. ( I advice to keep this MAP.txt as a backup, just in case.)

Click “make pkgs” in XIPPort to get 'OEMXipKernel' and 'MSXipKernel' folders inside the 'OUT\Files' and 'OUT\Modules' folders.

Delete the 'MSXipKernel' folders from 'OUT\Files' and 'OUT\Modules'.

*Leave the other folder there (i.e.-LangDB, MSXipKernelLTK, WinCENLS_WWE, etc.)

Now our BASE OUT folder is ready for the port.

Gathering the DONOR Files

=====================

Dump your DONOR ROM to get the xip.bin.

Dump your DONOR xip.bin with XIPPort.exe, and click “make pkgs”.

In the 'OUT' folder locate the 'Files\MSXipKernel' and 'Modules\MSXipKernel' folders.

Delete 'osaxst0.dll' + 'osaxst0.dll.imageinfo.txt', 'hd.dll' + 'hd.dll.imageinfo.txt', and 'bmui.nb0'* + 'bmui.nb0.imageinfo.txt'* to get the new XIP within the original RAM size.

*If present. If you don’t wish to delete these files, then you will need to play around with the “physlast” to expand the range for those files.

Copy the DONOR 'MSXipKernel' folders from 'OUT\Files' and 'OUT\Modules' to their respective 'Files' and 'Modules' folder in the BASE ROM's 'OUT' folder.

Now our BASE 'OUT' folder is ready to be ported with the OEMXipKernel and MSXipKernel.

Fixing the Modules

================

Now using the BASE 'OUT' folder, open XIPPort.exe and click "undo".

Click “realloc P” to re-calculate the reallocation addresses. Then click “write maps” to get the new 'MAP.txt' file.

* Ignore any region errors that XIPPort brings up

Open this MAP.txt and look in the o32_realaddr and e32_vbase addresses. Here you may find overlaps of the modules in a few or most places (seen as !!!!!!!!!!!!!!!!!!)

* Busenum.dll must be the last entry in both tables.

table:

[[

00000000 - 01f901fd L01f901fd NUL

[o32_realaddr] addresses

01f901fd - 01f901fd L00000000 Start: first DLL address

01f901fd - 01fdf000 L0004ee03 NUL

01fdf000 - 01fe1000 L00002000 initialized data of region_1 wce_rex.DLL

01fe1000 - 01fe2000 L00001000 initialized data of region_1 MMMAP.dll

01fe2000 - 01fe3000 L00001000 initialized data of region_1 htcfsfilter.DLL

01fe3000 - 01fec000 L00009000 initialized data of region_1 FLASHDRV.DLL

01fec000 - 01fed000 L00001000 initialized data of region_3 FLASHDRV.DLL

01fed000 - 01fee000 L00001000 initialized data of region_1 ceddk.dll

01fee000 - 01fef000 L00001000 initialized data of region_1 cecompr.dll

01fef000 - 01ff0000 L00001000 initialized data of region_1 regenum.dll

01ff0000 - 01ff1000 L00001000 initialized data of region_1 pm.dll

01ff1000 - 01ff2000 L00001000 initialized data of region_1 mspart.dll

01ff2000 - 01ff3000 L00001000 initialized data of region_1 mencfilt.dll

01ff3000 - 01ff4000 L00001000 initialized data of region_1 imgfs.dll

01ff4000 - 01ff5000 L00001000 initialized data of region_1 fsreplxfilt.dll

01ff5000 - 01ff6000 L00001000 initialized data of region_1 fsdmgr.dll

01ff6000 - 01ff7000 L00001000 initialized data of region_1 fatutil.dll

01ff7000 - 01ff8000 L00001000 initialized data of region_1 fatfsd.dll

01ff8000 - 01ff9000 L00001000 initialized data of region_1 diskcache.dll

01ff9000 - 01ffa000 L00001000 initialized data of region_1 devmgr.dll

01ffa000 - 01ffc000 L00002000 initialized data of region_1 crypt32.dll

01ffc000 - 01ffd000 L00001000 initialized data of region_1 coredll.dll

01ffd000 - 01ffe000 L00001000 initialized data of region_1 certmod.dll

01ffe000 - 01fff000 L00001000 initialized data of region_1 cachefilt.dll

01fff000 - 02000000 L00001000 initialized data of region_1 busenum.dll

02000000 - 02000000 L00000000 End: last DLL address

[e32_vbase] addresses

02000000 - 03e16000 L01e16000 NUL

03e16000 - 03e1f000 L00009000 Virtual base address of wce_rex.DLL

03e1f000 - 03e24000 L00005000 Virtual base address of MMMAP.dll

03e24000 - 03e2b000 L00007000 Virtual base address of htcfsfilter.DLL

03e2b000 - 03e4c000 L00021000 Virtual base address of FLASHDRV.DLL

03e4c000 - 03e52000 L00006000 Virtual base address of ceddk.dll

03e52000 - 03e56000 L00004000 Virtual base address of cecompr.dll

03e55000 - 03e56000 L00001000 !!!!!!!!!!!!!!!!!!

03e55000 - 03e59000 L00004000 Virtual base address of regenum.dll

03e59000 - 03e68000 L0000f000 Virtual base address of pm.dll

03e68000 - 03e70000 L00008000 Virtual base address of mspart.dll

03e70000 - 03e80000 L00010000 Virtual base address of mencfilt.dll

03e80000 - 03e8c000 L0000c000 Virtual base address of imgfs.dll

03e8c000 - 03e96000 L0000a000 Virtual base address of fsreplxfilt.dll

03e96000 - 03eac000 L00016000 Virtual base address of fsdmgr.dll

03eac000 - 03eb5000 L00009000 Virtual base address of fatutil.dll

03eb5000 - 03ec8000 L00013000 Virtual base address of fatfsd.dll

03ec8000 - 03ece000 L00006000 Virtual base address of diskcache.dll

03ece000 - 03eda000 L0000c000 Virtual base address of devmgr.dll

03eda000 - 03f4c000 L00072000 Virtual base address of crypt32.dll

03f4c000 - 03fe2000 L00096000 Virtual base address of coredll.dll

03fe2000 - 03ff0000 L0000e000 Virtual base address of certmod.dll

03ff0000 - 03ffa000 L0000a000 Virtual base address of cachefilt.dll

03ffa000 - 04000000 L00006000 Virtual base address of busenum.dll

04000000 - 80000000 L7c000000 NUL

]]

<< The trick to reading the o32 and e32 table is this:

the first column is the modules starting address (o32_realaddr or e32_vbase).

the second column is it's ending address (which should be the same as the realaddr/vbase for the next module). ;)

the third column (The one that starts with 'L') is the file's "vsize". ;)

>>

These are the overlaps which need to be taken care of by reallocating the modules in Initialized Data and Virtual Base addresses

You need to work our way up from the bottom of the list since the busenum.dll is reallocated at the last address of the memory.

For example:

03e4c000 - 03e52000 L00006000 Virtual base address of ceddk.dll

03e52000 - 03e56000 L00004000 Virtual base address of cecompr.dll

03e55000 - 03e56000 L00001000 !!!!!!!!!!!!!!!!!!

03e55000 - 03e59000 L00004000 Virtual base address of regenum.dll

Meaning, e32_vbase address of cecompr.dll is overlapping the reserved space of regenum.dll by 1000 (L00001000).

I recommend you use M’Reloc.exe for reallocating the addresses in imageinfo.bin and Notepad to reallocate the addresses in the corresponding imageinfo.txt files.

Since the binaries (S000, S001...) must actually be relocated using M'Reloc, it is not enough to just adjust the values in the imageinfo.txt files.

To calculate the new addresses of the overlapping modules, open a hex calculator.

* You can use windows calculator for this. Open the calculator, click "view" and select "scientific". Now, press "F6" or click "HEX" to put the calculator into hexidecimal mode.

Now to correct the e32_vbase of cecompr.dll, follow this calculation as a base (e32_vbase regenum.dll - e32_vsize cecompr.dll =

correct

e32_vbase cecompr.dll)

Meaning, (03e55000 – 4000 = 03e51000) hence the correct e32_vbase address for cecompr.dll is 03e51000

Now since the cecompr.dll is reallocated using the above calculation, the modules next in line above that will also have to be reallocated. Namely, ceddk.dll (although not overlapping cecompr.dll yet since we have not "realloc P").

To calculate the e32_vbase of ceddk.dll you will need the new e32_vbase address of cecompr.dll which you got just now (03e51000).

I recommend writing down the e32_vbase, e32_vsize, o32_realaddr and o32_vsize of each module so it will be easier to calculate the correct addresses for reallocation).

Remember, you need to work our way up from the bottom of the list since the busenum.dll is reallocated at the last address of the memory.

To reallocate the addresses for o32_realaddr, follow the above calculation. Only this time, replace the e32_vbase with o32_realaddr and e32_vsize with o32_vsize.

Now open the corresponding imageinfo.txt file for each module and change the e32_vbase and o32_realaddr address values in the txt file of the values mentioned with V= and D=, seen for e.g. like this:

Module name: cecompr.dll

e32_vbase: V=03E52000

...

o32[1].o32_realaddr: D=01FEE000

You will notice that the 'FLASHDRV.DLL' module has the realaddr at 2 regions. Although I have not found a way to calculate the difference between both regions but I change the values as per Abusalza’s MAP.txt

o32[1].o32_realaddr: D=01FCC000

o32[3].o32_realaddr: D=01FD4000

Since the OEMXipKernel modules never change, I only correct values of the ported MSXipKernel modules

This is helpful if the MSXipKernel modules ported from donor ROMs are similar in the sizes. If not then you will need to do the calculation and correction of values

Once completed the address reallocation, open XIPPort.exe and click “realloc P” to re calculate the addresses for writing maps. It will show you errors regarding some regions, ignore those and click “write maps”.

Open the new MAP.txt and recheck for (!!!!!!!!!!!!!!!!!!). If there are no errors that means the XIP has been sucessfully ported.