yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Software Development] Ameet:
Yes you can use your own ROM as payload template :)

Is the screenshot of your payload or nb? Coz the MSFLSH50 region is seen in the MBR section :eek:

Normally the MSFLSH50 region starts from 0x800 till 0x1000. If you see the values in 1C2, 1D2, 1E2, 1F2, those are the flag of the partitions which are mentioned in the boot.rgu
[Windows Mobile Software Development] cruzzmz:
yup that is my cooked rom payload ... and after reading ur tut i am surprise to see it there too ... btw i cant use msflshtool to insert the new xip ... there is error :(

so by hook or by crook i hv to use the insert.exe

to confirm back, payload is os.nb.payload right? extracted using nbsplit?
[Windows Mobile Software Development] !Aman!:
there is nothing wrong with that ... it shows that the sector size of that payload is 0x200 (just like Elfins), thats why MSFLSH50 region is right next to MBR region.
[Windows Mobile Software Development] !Aman!:
what did u modify in the MBR? post a screenshot of the edited MBR section.

yes.
[Windows Mobile Software Development] cruzzmz:
No modification done yet.

So mind sharing where is my xip start add?
[Windows Mobile Software Development] !Aman!:
it starts at 0x320000... notice the 00 19 00 00 string. it is the starting block of your XIP, which means 0x1900 after decoding. multiply it with your sector size 0x200 and u get the logical block address of the XIP as 0x320000 :)
[Windows Mobile Software Development] cruzzmz:
Thanks dude :D

so my XIP start at 0x320000

meaning -d 0x00320000

is it correct -s 0x00260000 ????

(BTW does all xip start at offset x01D6? i can guess that the value 19 00 =1900, but where did u get 200 sec size?)

so final would be insert.exe -i xip_out.bin -o OS.nb.payload -d 0x00320000 -s 0x00260000?

is it necessary to put -s?

OT i have passed the 1k posting barrier ;) today
[Windows Mobile Software Development] Ameet:
:D Forgot to note I was testing on Diamond payload with a sector size of 800 ;)

Aman got the 200 sec size since the MSFLSH50 starts at 0x200. Gonna modify my guide to read that to an extent ;)

-s 0x00260000 would be the size of your new xip_out.bin. If you dont specify the -s switch then there may be problems since the imgfs start wont be defined and there may be overflow of the earlier XIP in between the space, which you can now check :)
[Windows Mobile Software Development] Ameet:
Guys, Aman, made a few changes to the first page of this thread for easy access to info. Also added all guides to pdf tutorial with the imgfs gain guide pictorial for easy understanding. Do let me know if anything is to be added :)
[Windows Mobile Software Development] Calkulin:
I'm having a problem getting my ported 20931 XIP to boot on my CDMA Diamond with the nk.exe included(didn't include it once and it booted but phone was not usable), so what am I missing? I have tried 4 different OEM XIPs & MAP.txt shows no overlapping but I do keep getting ERROR! Unknown o32 region flags: d0000040 when I try to realloc P because 4 of my files that call for that region, so I figured it's ok. I attached the map.txt & xip_out if anyone wants to take a look and tell what I'm doing wrong
[Windows Mobile Software Development] Ameet:
The txt looks ok, although you may choose to play around in the ulRam section a bit to increase the free Ram space :D but otherwise it looks ok

Did you say the device worked when you didnt include the nk.exe? :confused: Did you run the Mreloc_nk to realloc the nk.exe like its imageinfo.txt? Also are the OEMXip from your device's ROM OEMXip?

Never ported for any CDMA devices before, so wont be in position to say much here on this. But do tell me the answer to above ;)
[Windows Mobile Software Development] anryl:
as i remember the bug in xipport is to dont use mouse or enter always use space on ok . than should be fine.

dont kill me if i'm wrong :D
[Windows Mobile Software Development] Ameet:
:D Ghekeke.. This is a funny bug I have heard of :D

The errors are seen since the 4 regions are not read by XIPPort tool for some reason. Doesnt matter what you click ok with :p
[Windows Mobile Software Development] Calkulin:
Yes, it booted fine without the nk.exe and I did it twice to verify. As for using, M'Reloc_nk, no I didn't as the values looked correct, so I didn't change it, was I suppose to? Also is it ok to play with the dllfirst line to remove that nul up top? And yes, I did use the OEM folders from the OEM XIP. BTW, thanks for tip on the increasing the free ram
[Windows Mobile Software Development] :
when i go to insert the XIP_out. i get source size 0x0000000

insert.exe -i xip_out.bin -o OS.nb.payload -d 0x00320000 -s 0x004C0000

that is the code i am using, it is on a CDMA diamond.

Also what is the -s 0x004c0000 used for?
[Windows Mobile Software Development] kokotas:
Just to be clear, for this to work insert.exe , xip_out.bin & OS.nb.payload should be in the same dir

-s <hex> parameter is for the size of the xip area

(from xip start address till imgfs start address or in a kind of a "math" expression: imgfs start addr <hex> - xip start addr <hex> = -s <hex>)

but Ameet&Aman have already made that clear in previous posts, so do check them:)

Oh, here it is also from first page:

Regards!
[Windows Mobile Software Development] :
okay thanks for the help, I was able to get it by using xipport. and i just added it rihgt into the os.nb. thanks everyone for the help and everything else. this is just great.

haha my first XIP port. i feel so happy.
[Windows Mobile Software Development] alind:
Oh, thank you.

I had the same problem.

was also helpful for me
[Windows Mobile Software Development] Sherrin:
You guys are GODS.... Thank you,,... :D
[Windows Mobile Software Development] mbarvian:
*just saw the answer*

thanks man for these awesome tutorials
[Windows Mobile Software Development] Ameet:
What answer? Care to share the question? :D

Hopefully the ULDR tutorial will be seen very soon too ;)
[Windows Mobile Software Development] :
HAHA Great cant wait for the ULDR tutorial :D
[Windows Mobile Software Development] Ameet:
Guys added the ULDR size reduction tutorial in post 7 ;) Enjoy 3 more MBs in storage space
[Windows Mobile Software Development] cruzzmz:
dude u r the real KING :D
[Windows Mobile Software Development] Ameet:
:D Thanks brother. Great help from Htctouchp too ;)
[Windows Mobile Software Development] !Aman!:
:D and trust me i didn't expect it to be so hard to make u understand these HEX calculations :D
[Windows Mobile Software Development] Sherrin:
Cmonex, Htctouchp, Abusalza,and my dear friend Ameet Babrekar.. THANK YOU..GENIUSES.. Exciting times lay ahead for me, thanks to your hard work.. God bless..

Cheers!!
[Windows Mobile Software Development] Ameet:
Looks like you just wished us twice :p

Hoping to read comments from you too to make this tutorial even better
[Windows Mobile Software Development] abusalza:
hi guys, just want to ask. what an active module always working in our device?
[Windows Mobile Software Development] Ameet:
Guys updated the Index in 1st post and added screenshots of MBR & MSFLSH50 regions for easy understanding in Post #8: http://xdaforums.com/showpost.php?p=2944860&postcount=8 :D
[Windows Mobile Software Development] abusalza:
hi ,AB...

about my question above, maybe we can make reduce power consumption.
[Windows Mobile Software Development] Ameet:
Hmm.. interesting thought that is. But for my low level of knowledge into this its very difficult to know. Someone else might find that easy :D

Maybe Aman would come up with an experiment to support this theory :D
[Windows Mobile Software Development] cruzzmz:
Problem wz MReloc_nk

Guys / Gals

I have a problem here. I am trying to port a cavalier xip with the new 20757 xip.

The prob that i am facing now is i cant do a MReloc_nk. Seems like i cant enter the o32_realaddr with hex value (A-F).

Can i just change the imageinfo.text real addr only? will it work?

i am attaching both xips & my Ported-XIP out.

Maybe AB or the rest can help ...

TIA
[Windows Mobile Software Development] Ameet:
:D Simple workaround to that problem is copy the value of original nk e.g. 803FE000 then copy only the red and paste it in the Mreloc_nk text box overwriting everything and manually type the last 0 ;) Then click DoIt :D
[Windows Mobile Software Development] cruzzmz:
Got it :D thx u r da man !!!!
[Windows Mobile Software Development] itje:
trying to port to xperia

After preparing the base with new modules and files, Im starting xipport to realloc P, but then I get this error?

what am I possibly doing wrong?

cheers
[Windows Mobile Software Development] Ameet:
Thats ok since that error is seen coz XIPPort tool doesnt recognise the newer address. You may get that error 4 times while realloc P. Simply ignore and go ahead
[Windows Mobile Software Development] cruzzmz:
AB

a question for u & all that can reply.

I have successfully port the xip for cavalier but not sure why when i patch it to a working WM6.1 which i use a BJII sys file, beta tester inform me that it is not stable & will eventually crash after using it for 30 min esp when text-ing.

I didnt change the nk.exe to make it give more free ram since last time when i did the ram free thing the dev wont boot.

Any idea on why it crashes?

TIA ;)

MAP.txt
---------
.
.
.
801b5000 - 801b5068 L00000068 o32 region_2 rva=00003000 vsize=00000068 real=03ed3000 psize=00000068 f=40000040 for regenum.dll
801b5068 - 801b6268 L00001200 o32 region_1 rva=0003c000 vsize=0000b1c4 real=0004c000 psize=00001200 f=c8000040 for filesys.exe
801b6268 - 801c0268 L0000a000 filedata boot.hv
801c0268 - 801c7268 L00007000 filedata mxip_initdb.vol
801c7268 - 801cce3c L00005bd4 filedata boot.rgu
801cce3c - 801da154 L0000d318 NUL
801da154 - 801da154 L00000000 End: highest physical address

801da154 - 801db000 L00000eac NUL

801db000 - 801db000 L00000000 Start: start of RAM
801db000 - 801e0000 L00005000 NUL
801e0000 - 801e6000 L00006000 uninitialized data of region_1 nk.exe
801e6000 - 8020c000 L00026000 initialized data of region_2 nk.exe
8020c000 - 8020c000 L00000000 ------ start of RAM free space
8020c000 - 83e00000 L03bf4000 NUL
83e00000 - 83e00000 L00000000 End: end of RAM
[Windows Mobile Software Development] Ameet:
I'll look into this and reply in detail a bit later (unless if someone beats me to it ;)) In meantime, can you attach your complete MAP.txt and mention what exactly did you edit / change or do to your XIP?
[Windows Mobile Software Development] cruzzmz:
boy u r fast :D

I deleted all the can be deleted files ... hd.dll, osaxst0, enflict & menflict

There were only 4 conflicts ... I relocate it back as u can see in the map.txt

Then I do an insert.exe to my working WM6.1 rom
[Windows Mobile Software Development] Ameet:
Thats coz I'm online right now :D

Cant find any errors in the MAP.txt, you sure this issue is not because of the SYS that you are porting? Frankly, if the XIP has any issues, the device wont boot in first place. Moreover, looking at your txt, are you sure you got all the modules included in the XIP? Can you post your original XIP's MAP.txt too? Just in case ;)
[Windows Mobile Software Development] cruzzmz:
I have to check back the sys

Ok attaching my ori map txt

Thx
[Windows Mobile Software Development] Ameet:
IMO the problem lies with SYS that you using. Btw, any particular reason why you changed the serial of modules in virtual base?

[B][COLOR=red]Original[/COLOR][/B]
03ec9000 - 03ed4000 L0000b000 Virtual base address of FLASHDRV.DLL
03ed4000 - 03eda000 L00006000 Virtual base address of ceddk.dll
03eda000 - 03ede000 L00004000 Virtual base address of cecompr.dll
03ede000 - 03ee2000 L00004000 Virtual base address of regenum.dll
03ee2000 - 03ef1000 L0000f000 Virtual base address of pm.dll

[B][COLOR=red]Ported[/COLOR][/B]
03eb6000 - 03ec5000 L0000f000 Virtual base address of pm.dll
03ec5000 - 03ed0000 L0000b000 Virtual base address of FLASHDRV.DLL
03ed0000 - 03ed4000 L00004000 Virtual base address of regenum.dll
03ed4000 - 03eda000 L00006000 Virtual base address of ceddk.dll
03eda000 - 03ede000 L00004000 Virtual base address of cecompr.dll

Although I cant say the problem is coz of this, since I never modded the serial of modules
[Windows Mobile Software Development] cruzzmz:
what do u mean by modding the serial of modules?

I only relocate the modules accordingly since there was conflict

Does FLSHDRV must be at the top?
[Windows Mobile Software Development] anryl:
probably xip virtual base overlapping with imgfs ?

original 03ec9000

new at 03eb6000

might be the problem with stability
[Windows Mobile Software Development] cruzzmz:
care to explain on the overlapping issue?
[Windows Mobile Software Development] anryl:
if SYS .VM starts e32_entryrva: 03DD0000 virtual xip the 03 must start later 03DE0000

with g'reloc will tell your imgfs entry
[Windows Mobile Software Development] Ameet:
Hey anryl, now thats something interesting which I'm going to add to the member updates ;)

Although I didnt understand "virtual xip the 03 must start later" care to clarify? Are you refering to the Virtual Base address in Greloc and what address in ROMHDR.txt?
[Windows Mobile Software Development] anryl:
actualy it is all here already in post 24 cmonex

it is in realocing the second xip adresses this are virtual adreses as they can not overlap the imgfs VM (virtual memory)

if they overlap u wil not boot or u have NON-stable system

IN XIP U HAVE map.txt

-dll adress ( 0- 02000000)

-virtual base (02000000 - 04000000 ) --------- this one is used in imgfs as well in .VM in SYS

-physical adress ( 80000000 - last dll )

-RAM adress ( start of ram - end off ram ) ---------- there u have nk.exe 2 regions

Module name: .VM
e32_objcnt: 00000000
e32_imageflags: 000001F9
e32_entryrva: 03DD0000
e32_vbase: 83400000

my VM ends at 03DD

02000000 - 03e2e000 L01e2e000 NUL
03e2e000 - 03e37000 L00009000 Virtual base address of wce_rex.DLL
03e37000 - 03e3c000 L00005000 Virtual base address of MMMAP.dll
03e3c000 - 03e43000 L00

my second xip starts at 03E2E

this is after imgfs so all fine
[Windows Mobile Software Development] Ameet:
:o Forgot the source :D Guess I need to take some vacation :D

P.s. the dlllast value can also be determined from the dumpMemoryMaps.txt ;)
[Windows Mobile Software Development] cruzzmz:
ok here is mine

Module name: .VM
e32_objcnt: 00000000
e32_imageflags: 000001FA
[color=red]e32_entryrva: 03E80000[/color]
e32_vbase: 83E00000

so it ends at 03E80000

02000000 - 03eb6000 L01eb6000 NUL
[color=red]03eb6000[/color] - 03ec5000 L0000f000 Virtual base address of pm.dll
03ec5000 - 03ed0000 L0000b000 Virtual base address of FLASHDRV.DLL
03ed0000 - 03ed4000 L00004000 Virtual base address of regenum.dll
03ed4000 - 03eda000 L00006000 Virtual base address of ceddk.dll
03eda000 - 03ede000 L00004000 Virtual base address of cecompr.dll

2nd starts at 03eb6000

so is mine after imgfs?
[Windows Mobile Software Development] anryl:
3e8 , 3e9 , 3ea , 3eb , 3ec , 3ed , 3ee , 3ef , 3f0 , 3f1 ........... guess :D
[Windows Mobile Software Development] joshkoss:
Filesys? maybe? I'm noob at xip but i know this manages memory load i believe
[Windows Mobile Software Development] cruzzmz:
:D

then it should be ok right? ehmm still puzzled by the unstableness :confused:
[Windows Mobile Software Development] Ameet:
You already answered it, right? :D
[Windows Mobile Software Development] cruzzmz:
i think i have to do a SYS port also wz that xip and see how it goes .... will report back on the status

Thx everyone

:D
[Windows Mobile Software Development] Marut_K:
How to patch XIP support 128 MB RAM

OK. May be I disturb all of you. Sorry about that, Please forgive me.
[Windows Mobile Software Development] mosfet:
Extract nk.exe from WM6.1 and WM6.0 or WM5

Hi,

I would need some help to extract the kernel file nk.exe from a WM6.1.

Actually I am trying to contribute to an open source project called cegcc(open source compiler based on gcc) and the problem is dll cannot be loaded anymore with WM 6.1.

So I need to be able to disassemble nk.exe from a WM6.1 and from a WM6.0 for instance to see the differences.

If you know how to extract this file from a ROM, please let me know.

Does someone know where I could find a WM6.0 and a WM6.1 ROM for the same device ?
[Windows Mobile Software Development] Ameet:
1st, what device ROM are you looking for?

2nd, you can get this nk.exe file from that ROM dump (XIP to be more specific) Dump the xip.bin and get this file
[Windows Mobile Software Development] mosfet:
I don't care, if I just could get a nk.exe from a WM6.0 AND from a WM6.1 it would be a first step. Then to make comparisons it would be easier to have it from the same model. I have a small preference for nk.exe coming from Smartphone(without stylus).

If I am asking here it's because it's so complicated to find the right tools for the right model and every time I try it always failed with some cryptic error message.

last time I found a ROM with XIP already extracted but when I tried to reassemble S000, S001, ... from nk.exe folder it failed once more.

So now I hope that someone who has a good knowledge of this manipulation could help me.

I also have a ROM for HTC Shadow2 but this is too recent and tools don't seem to work with it.Ideally this is from this ROM that I would like to extract the WM 6.1 nk.exe.
[Windows Mobile Software Development] anryl:
Nice request :cool: but u have to post the rom dump or whatever here for samone to try to extract it .

Just upload it somewhere and sure we would like to help :cool:
[Windows Mobile Software Development] mosfet:
You will find the ROM(Shadow2) here : REMOVED

Actually I have uncompress the HTC____XXXX.exe to obtain this RUU_Signed.nbh but I will post tomorrow this file so that you have full information about the ROM.

If you manage to extract the nk.exe please tell me which tools you have used and how you did it.
[Windows Mobile Software Development] anryl:
here u go http://uploaded.to/?id=ogskoo

standart hexexported xip :cool:
[Windows Mobile Software Development] pkoper:
Here's a strange one...

Ported XIP and inserted into os.nb.payload. Cooked rom, all ok.

Cooked again with all packages to one, same thing, and I get an old CE OS???

Was the XIP I was porting a fake?
[Windows Mobile Software Development] cruzzmz:
OT but have to ask,

shadow 2 is using WM6 or 6.1?, what ver is the CEOS?

THX
[Windows Mobile Software Development] anryl:
5.2.19604 aku 1110
[Windows Mobile Software Development] mosfet:
Here is the version I have :

CE OS 5.2.19604 (Build 19604.1.1.10)

Radio Version : W15.18.2.23_00.02.48.00

Rom version : 1.63.531.16.WWE

Rom Date : 09/06/08

So have you managed to extract my precious ???? ;-)
[Windows Mobile Software Development] cruzzmz:
not yet

so xip and sys 19604 eh

the chome is diff frm the normal chome right? hopefully can be ported
[Windows Mobile Software Development] mosfet:
Hum I don't really understand your sentence.

When you say "so xip and sys 19604 eh" you mean what ?

what is a "chome" ?
[Windows Mobile Software Development] cruzzmz:
actually frm ceos we could know what build that the rom is using. in the above case it is using both SYS and XIP of 19604.

as far as i know, the chome the today screen of a shadow is diff from the cpanel of an odinary wm dev
[Windows Mobile Software Development] Ameet:
Ok. As my first step of learning all about Virtual Memory, here's what i found

This is about the ROM size in GReloc or the space between ulRamStart and UlRamEnd
[Windows Mobile Software Development] !Aman!:
:D this one is about Virtual memory (page file) used in PCs, not PPC.
[Windows Mobile Software Development] Ameet:
True, but I think the same rule applies to XIP too. If you Koko's test results in SPC group he's mentioned the available RAM with different values ;) So it might mean that when we increase this value the VM increases which makes use of the space as free Ram during boot :)
[Windows Mobile Software Development] mosfet:
So does it sound good ? Actually you are talking hebrew to me...

How am I supposed to extract my file ?

Is it possible ?
[Windows Mobile Software Development] cruzzmz:
:D

1stly sorry to AB if the topic is OT and seems like hijacking this thread

ok what do u want to extract?

frm ruu_signed.nbh, u can get os.nb then u can extract it to get SYS & OEM folder. Usually we need both folders for porting. Also frm os.nb u can get the xip.bin file which u can use it to port to other devices.

This thread explain on a manual way to port a new xip to ur device & also many2 more wonderful trick to max ur rom

regards
[Windows Mobile Software Development] mosfet:
I am not interested in porting/cooking/relocing/customizing.... ;-)

I only want to extract nk.exe file ...

If you don't want to do it, could you tell me which command I am supposed to run ?

I already tried with no success (actually I always fail whith XIP).
[Windows Mobile Software Development] cruzzmz:
extracting nk.exe ... sorry cant help u wz that since i also dunno how

xip porting is easy actually ... give it a try again and if u get stuck, post it here & everybody here can help
[Windows Mobile Software Development] mosfet:
So I will try by myself (-;
[Windows Mobile Software Development] cruzzmz:
1stly tis tutorial was done by AB ;) but i can give u all the tools but then it is not the latest one.
[Windows Mobile Software Development] mosfet:
Thanks a lot !

I have extracted(NBHExtract) the nbh and I have obtained the following files :

00_Unknown.nb

01_IPL.nb

02_SPL.nb

03_MainSplash.bmp

03_MainSplash.nb

04_GSM.nb

05_OS.nb

Then I suppose I need to run NBSplit.exe but what parameters do I choose ? kaiser, hermes, .... My device is of course not listed
[Windows Mobile Software Development] cruzzmz:
use nbsplit -sp os.nb if ur dev is not listed. BTW for more details on extracting i think u better PM me ;)
[Windows Mobile Software Development] cruzzmz:
anryl ... did u able to extract the shadow 2 sys, oem folder? seems that i cant ...
[Windows Mobile Software Development] anryl:
yes m8 it is extracted xipported so he just need to download it and there he has his nk.exe .

MORE READING MOSFET

http://uploaded.to/?id=ogskoo

standart hexexported xip :cool: FOR MOSFET click on the link the blue text
[Windows Mobile Software Development] mosfet:
THANKS !!!!

Your are the one...

Could you explain to me how you did this ? The more info you share the better people can contribute.

I was stuck with the XIP export... I tried something with rommaster but it didn't work.

And a last effort, how am I supposed to transform S000 ... S004 files into a standard nk.exe ?
[Windows Mobile Software Development] anryl:
http://xdaforums.com/showpost.php?p=2295427&postcount=20 there is recmod.exe for module to file transform

for xip nbsplit -data 2048 -extra 8 os.nb

then hexedit the xip from os.nb.payload 320000 xipstart to 600000 imgfsstart

open os.nb.payload in hexeditor

- goto (ctrl+g 600000) imgfs start ctrl+shift+end - delete

- goto(ctrl+g 320000) xip start ctrl+shift+home delete

- save as xip.bin

- close hexeditor

xipport dump xip.bin there u get u xip in OUT

OUT\MODULES\NK.exe

drag nk.exe on recmod - in folder u have nk.exe

FOR IMGFS ( OEM and SYS )

the manual way

imgfsfromnb os.nb.payload imgfs.bin

imgfstodump imgfs.bin

the easy way

the imgfs u can use htcRIE_0.4.0.49.exe on any ruu_signed

pkgtool - u get OEM and SYS

!! BUT FOR ALL MORE READING NEEDED !! everything is explained here on XDA
[Windows Mobile Software Development] mosfet:
Thanks !!!!!!!!!!!!!!!!!!!!

Sorry but there are so many information on XDA that it 's not so easy to find useful information, latest version of tools, ...

Update : I tried recmod and I obtain a nk.exe with 1kB size !!!!!!

When I tried on command line I get :Error! ProcessCase0: bit 5 is zero!
[Windows Mobile Software Development] Ameet:
Guys, this discussion is going into some other track

mosfet: please further discuss this with anryl & cruzz on pm and not in this thread. Lets stick to what we started discussing ;)
[Windows Mobile Software Development] cruzzmz:
yup i agree better PM if it is OT ;)