[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] mbarvian:
How to Port the XIP (CE OS number) of a ROM: (all credit goes to Ameet and KMFM$!)

What you'll need:

A Hex Calculator

Insert.exe (used to insert the xip_out.bin into the OS.nb.payload)

XIPPort.exe

M'Reloc.exe

Kaiser's OS.nb.payload

XIP.bin from the build you want to port

NBMerge.exe (Needed to build OS.nb)

To keep it easy, I zipped all of these tools up (you'll need to get the XIP.bin

you want to port and the shipped ROM's OS.nb.payload, I'll tell you how

later). Just download the attachment at the bottom of this post. Just

download it and unzip it to a folder on your desktop.

Getting the Necessary Files

=====================

Now, we'll need to extract the OS.nb.payload and the XIP.bin from the Kaiser

Base ROM that you are using. For instance, I am using the newest HTC

Shipped Kaiser ROM (3.34), so I put NEWKAISERROM.nbh into the Extract

folder. If you are using the Kaiser 3.29 ROM as your base, you would put

that .nbh file in the Extract folder. Once you have the .nbh in the

Extract the Payload folder, double-click on RunMe.bat. Viola, the

OS.nb.payload and XIP.bin are now in your main folder, along with a new

ROM folder that I'll explain later. Don't delete anything yet

Now, enter back into your main folder and double-click on XIPPort.exe. Then

click on (in order): dump xip.bin, write maps, make pkgs. You should

now have an OUT folder in your main folder. Double-click it and you should

see some .txt files and Files and Modules folders. Enter the Files folder and

delete the MSXIPKernel and MSXIPKernelLTK folders. Delete the same folders

in the Modules directory.

Then, go back into your main folder, rename the OUT folder to OUT_original,

and the xip.bin file to xip_original.bin. Then, place the XIP.bin file from the

build you want to port in this main folder. Once it's there, double-click on

XIPPort.exe and click (in order): dump xip.bin, make pkgs. Now you

should have: an OUT folder, an OUT_original folder, a ROM folder, xip.bin, and

xip_original.bin. Go into your OUT folder, then your Modules folder, then your

MSXIPKernel folder and delete the following directories/files:

hd.dll (folder), hd.dll.txt (file), osaxst0.dll (folder), osaxst0.dll.txt (file).

Also, if you can find bmui.nb0 in one of your

MSXIPKernel folders in your OUT directory, delete it along with

bmui.nb0.imageinfo.txt. Don't worry if you can't find

it, though, because sometimes I can't myself :).

Now, copy the folders MSXIPKernel and MSXIPKernelLTK from Files and

Modules folder in your OUT folder and paste them in their corresponding

folders in the OUT_original directory. Now, go back to your main folder,

rename OUT to OUT_port, and OUT_original to OUT. Now, double-click

XIPPort.exe and click (in order): undo, realloc p.

*Ignore any errors it might give you about unknown regions!.

Then click write maps.

Fixing the Addresses

================

Now, here's the tricky part. Open your MAP.txt file in the OUT folder. Look for !!!!!!!!!. If you don't find them (very rare), just skip to the end, called "Putting it All Together". If you do, we'll have to take care of that. Here's an example of the bottom part of MAP.txt:

[e32_vbase] addresses

02000000 - 03e16000 L01e16000 NUL

03e16000 - 03e1f000 L00009000 Virtual base address of wce_rex.DLL

03e1f000 - 03e24000 L00005000 Virtual base address of MMMAP.dll

03e24000 - 03e2b000 L00007000 Virtual base address of htcfsfilter.DLL

03e2b000 - 03e4c000 L00021000 Virtual base address of FLASHDRV.DLL

03e4c000 - 03e52000 L00006000 Virtual base address of ceddk.dll

03e52000 - 03e56000 L00004000 Virtual base address of cecompr.dll

03e55000 - 03e56000 L00001000 !!!!!!!!!!!!!!!!!!

03e55000 - 03e59000 L00004000 Virtual base address of regenum.dll

03e59000 - 03e68000 L0000f000 Virtual base address of pm.dll

03e68000 - 03e70000 L00008000 Virtual base address of mspart.dll

03e70000 - 03e80000 L00010000 Virtual base address of mencfilt.dll

03e80000 - 03e8c000 L0000c000 Virtual base address of imgfs.dll

03e8c000 - 03e96000 L0000a000 Virtual base address of fsreplxfilt.dll

03e96000 - 03eac000 L00016000 Virtual base address of fsdmgr.dll

03eac000 - 03eb5000 L00009000 Virtual base address of fatutil.dll

03eb5000 - 03ec8000 L00013000 Virtual base address of fatfsd.dll

03ec8000 - 03ece000 L00006000 Virtual base address of diskcache.dll

03ece000 - 03eda000 L0000c000 Virtual base address of devmgr.dll

03eda000 - 03f4c000 L00072000 Virtual base address of crypt32.dll

03f4c000 - 03fe2000 L00096000 Virtual base address of coredll.dll

03fe2000 - 03ff0000 L0000e000 Virtual base address of certmod.dll

03ff0000 - 03ffa000 L0000a000 Virtual base address of cachefilt.dll

03ffa000 - 04000000 L00006000 Virtual base address of busenum.dll

04000000 - 80000000 L7c000000 NUL

]]

<< The trick to reading the o32 and e32 table is this:

* the first column is the modules starting address (o32_realaddr or e32_vbase).

* the second column is it's ending address (which should be the same as the realaddr/vbase for the next module).

* the third column (The one that starts with 'L') is the file's "vsize".

>>

These are the overlaps which need to be taken care of by reallocating the modules in Initialized Data and Virtual Base addresses

You need to work our way up from the bottom of the list since the busenum.dll is reallocated at the last address of the memory.

For example:

03e4c000 - 03e52000 L00006000 Virtual base address of ceddk.dll

03e52000 - 03e56000 L00004000 Virtual base address of cecompr.dll

03e55000 - 03e56000 L00001000 !!!!!!!!!!!!!!!!!!

03e55000 - 03e59000 L00004000 Virtual base address of regenum.dll

Meaning, e32_vbase address of cecompr.dll is overlapping the reserved space of regenum.dll by 1000 (L00001000).

I recommend you use M’Reloc.exe for reallocating the addresses in imageinfo.bin and Notepad to reallocate the addresses in the corresponding imageinfo.txt files.

Since the binaries (S000, S001...) must actually be relocated using M'Reloc, it is not enough to just adjust the values in the imageinfo.txt files.

To calculate the new addresses of the overlapping modules, open the hex calculator.

* You can use windows calculator for this. Open the calculator, click "view" and select "scientific". Now, press "F6" or click "HEX" to put the calculator into hexidecimal mode.

Now to correct the e32_vbase of cecompr.dll, follow this calculation as a base (e32_vbase regenum.dll - e32_vsize cecompr.dll = correct e32_vbase cecompr.dll)

Meaning, (03e55000 – 4000 = 03e51000) hence the correct e32_vbase address for cecompr.dll is 03e51000

Now since the cecompr.dll is reallocated using the above calculation, the modules next in line above that will also have to be reallocated. Namely, ceddk.dll (although not overlapping cecompr.dll yet since we have not "realloc P").

To calculate the e32_vbase of ceddk.dll you will need the new e32_vbase address of cecompr.dll which you got just now (03e51000).

I recommend writing down the e32_vbase, e32_vsize, o32_realaddr and o32_vsize of each module so it will be easier to calculate the correct addresses for reallocation).

Remember, you need to work our way up from the bottom of the list since the busenum.dll is reallocated at the last address of the memory.

To reallocate the addresses for o32_realaddr, follow the above calculation. Only this time, replace the e32_vbase with o32_realaddr and e32_vsize with o32_vsize.

Now open the corresponding imageinfo.txt file for each module and change the e32_vbase and o32_realaddr address values in the txt file of the values mentioned with V= and D=, seen for e.g. like this:

Module name: cecompr.dll

e32_vbase: V=03E52000

...

o32[1].o32_realaddr: D=01FEE000

You will notice that the 'FLASHDRV.DLL' module has the realaddr at 2 regions. Although I have not found a way to calculate the difference between both regions but I change the values as per Abusalza’s MAP.txt

o32[1].o32_realaddr: D=01FCC000

o32[3].o32_realaddr: D=01FD4000

Since the OEMXipKernel modules never change, I only correct values of the ported MSXipKernel modules

This is helpful if the MSXipKernel modules ported from donor ROMs are similar in the sizes. If not then you will need to do the calculation and correction of values

Once completed the address reallocation, open XIPPort.exe and click “realloc P” to re calculate the addresses for writing maps. It will show you errors regarding some regions, ignore those and click “write maps”.

Open the new MAP.txt and recheck for (!!!!!!!!!!!!!!!!!!). If there are no errors that means the XIP has been sucessfully ported.

Putting it All Back Together

=====================

Now open XIPPort.exe and click “build xip_out.bin” to create the resulting XIP to be inserted into the ROM .payload file (xip_out.bin).

Now, double-click RunMe.bat in the MAIN folder. Congratulations chef, your ROM folder is ready! Now just move the ROM folder and replace the one in your kitchen with it!