yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Software Development] Ameet:
Well said brother. At first even i found that line scary, but then it was a piece of cake ;) To realloc nk.exe you need to use this M'Reloc_nk.exe

There another way of hex editing the S002 (I think) but never tried it. Txt looks like the safest way to me :D

Although just to further clarify on the values, o32[2].o32_realaddr is calculated based on the o32[1].032_vsize & o32[1].o32_realaddr (meaning in colors below Red + Grey = Blue)

o32[1].o32_vsize: 0000[COLOR=gray]6000[/COLOR]
[COLOR=black]o32[1].o32_realaddr: R=[/COLOR][COLOR=red]80310000[/COLOR]
[COLOR=black]o32[2].o32_realaddr: R=[/COLOR][COLOR=blue]80316000[/COLOR]

Rest all well said Dupin :) Was too lazy to write this myself :D Added this explanation to the offline manual
[Windows Mobile Software Development] evalu8t0r:
It's an exe file... if you don't know how to run that then get a new hobby... - just kidding :o)

It looks for an OUT/MODULES/ folder and takes the imageinfo.txt from every folder there (OUT\MODULES\busenum.dll\imageinfo.txt, OUT\MODULES\cachefilt.dll\imageinfo.txt and so on)

So place the exe in the folder where your OUT folder is and run it
[Windows Mobile Software Development] cruzzmz:
dude how did u get the 8030c000?

in my case ... what is the best value

80413000 - 80413000 L00000000 Start: start of RAM
80413000 - 80414000 L00001000 initialized data of region_1 giisr.dll
80414000 - 80420000 L0000c000 NUL
80420000 - 80426000 L00006000 uninitialized data of region_2 nk.exe
80426000 - 80449000 L00023000 initialized data of region_3 nk.exe
80449000 - 80449000 L00000000 ------ start of RAM free space
80449000 - 83c00000 L037b7000 NUL
83c00000 - 83c00000 L00000000 End: end of RAM

i know that i have to push nk.exe so i will have more free ram but how do i get the value?
[Windows Mobile Software Development] cruzzmz:
ok thanks AB for the info

804114fc - [color=red]804124da[/color] L00000fde filedata 723fb954-d931-4348-b672-82a188e587b5.dsm
804124da - 804124da L00000000 End: highest physical address

so from mine above ... my value is 80412000?

my psylast now is 804124DA in ROMHDR.txt, so i need to do a mreloc_nk

o32[2].o32_vsize: 00006000
o32[2].o32_rva: 0004E000
o32[2].o32_psize: 00000000
o32[2].o32_dataptr: 00000000
[color=red]o32[2].o32_realaddr: R=80420000[/color]
o32[2].o32_flags: C0000080

o32[3].o32_vsize: 00022E00
o32[3].o32_rva: 00054000
o32[3].o32_psize: 00000600
o32[3].o32_dataptr: P+00066970
[color=blue]o32[3].o32_realaddr: R=80426000[/color]
o32[3].o32_flags: C0000040

so my 80420000 hv to be change to 80412000

& 80426000 have to be 80416000

right?

regards
[Windows Mobile Software Development] DupinBJK:
Another example for Basic Free RAM Increase

Sorry, but it was just a typo. The right address is 0x80306000, I've updated the post.

About the address 0x8030c000, if it's still unclear: see the address of the "uninitialized data of region_1 nk.exe" ? It's 0x80310000. I have to stack it up to address 0x80306000, and the size of that segment is 0x6000:

[B]80306000[/B] - 80310000 L0000a000 NUL
[COLOR="Blue"][B]80310000[/B][/COLOR] - 80316000 L0000[COLOR="Red"][B]6000[/B][/COLOR] uninitialized data of region_1 nk.exe

so the next available address will be 0x80306000 + 0x00006000 = 0x8030c000

In your case, you'll have to stack the address of "uninitialized data of region_2 nk.exe" up to 0x80414000. Then, since the size of that segment is 0x6000, the next available address will be 0x80414000 + 0x00006000 = 0x8041a000, to which you'll have to stack up the address of the "initialized data of region_3 nk.exe".

Your new value for ulRamFree will then be 0x8041a000 + 0x23000 (the size of the "initialized data of region_3 nk.exe") = 0x8043d000

To resume

:

o32[2].o32_realaddr: R=80414000

o32[3].o32_realaddr: R=8041a000

ulRamFree: 8043d000

BJK
[Windows Mobile Software Development] cruzzmz:
ok let me get the values straight

i have to change all to

1. physlast = 804124DA

2. ulRamStart = 80413000

3. nk region 2 = 80413000

4. nk region 3 = 80419000

or

3. nk region 2 = 80414000

4. nk region 3 = 8041a000

i am confused now :confused:

as for the nk.exe regions, in zinc it will start in 2 & 3 ... so if MReloc_nk only do region 1 & 2 then a lill bit of a problem for me :(

but then i hv to try & see
[Windows Mobile Software Development] cruzzmz:
found out something,

Correct one is

ulRAMFree = 8043d000 NOT ulRamStart

to get the result

MAP.txt

0413000 - 80413000 L00000000 Start: start of RAM
80413000 - 80414000 L00001000 initialized data of region_1 giisr.dll
80414000 - 8041a000 L00006000 uninitialized data of region_2 nk.exe
8041a000 - 8043d000 L00023000 initialized data of region_3 nk.exe
[color=red]8043d000[/color] - 8043d000 L00000000 ------ start of RAM free space
8043d000 - 83c00000 L037c3000 NUL
83c00000 - 83c00000 L00000000 End: end of RAM

ROMHDR.txt

physlast: 804124DA
nummods: (00000000)
ulRAMStart: R=80413000
[color=red]ulRAMFree: 8043D000[/color]
ulRAMEnd: 83C00000
[Windows Mobile Software Development] tonio94:
Ok, extracting/inserting xip works with 1 instead of l but...

...I still get the "IMGFS signature not found" with ImgfsFromNb

If I try to extract imgfs with osnbtool, it's extracted but I get an error message when I try to rebuild with ImgfsFromDump (Compression DLL does not support compression type ' ')
[Windows Mobile Software Development] utak3r:
that's pretty strange message.

Can you upload your whole nbh file somewhere?
[Windows Mobile Software Development] tonio94:
I mixed up my source files and I was using the old os.nb.payload.

I took the original one, made the modification again and now it's working.

Thanks !!

EDIT : Ok, I probably have a deamon launching spells on me...

I flashed with the built rom and it stopped at 99 or 100% saying "error 270 : upgrade error" and "PSOC_Diam STAGE_PVT v0x30", "Upgrade ROM code error Please try again" on my device.

After a few more tests, it seems to fail each time I insert a xip with a different size than the original one. I should probably change a memory allocation somewhere ?
[Windows Mobile Software Development] tonio94:
Any idea, utak3r ?
[Windows Mobile Software Development] utak3r:
"Different" - is it smaller or bigger?

Try inserting with XIPPort (just set a proper address and os.nb.payload filename instead of nk.nba) - it will fill the remaining free space with 0xFF.
[Windows Mobile Software Development] tonio94:
Inserting with XIPPort solved my problem. I've been able to insert my xip and to flash and boot correctly.

I succeeded in porting my current xip to 21040 :D

One last issue, I try to change the cecompr.dll module to be able to compress using LZX instead of XPR.

I delete the original cecompr.dll folder and replace by theone amhet posted here. I don't need to realloc according to the MAP. I succeed in rebuilding the xip but the device doesn't want to boot any more. Stuck on splash screen with no IPL/SPL/Radio/...so I guess the XIP is corrupted ?

What am I doing wrong ?
[Windows Mobile Software Development] utak3r:
...and this map was generated when?... with the old cecompr? ;) Use "realloc P" function of XIPPort.
[Windows Mobile Software Development] tonio94:
I tried to "realloc P" and it gives me a "ERROR! Unknown o32 region flags : 60002020"
[Windows Mobile Software Development] utak3r:
has this new cecompr the same number of sections as the old one?....

Try to find the version with the txt file - it was posted here in this thread... now you have the new cecompr with one section more probably and the old txt file.
[Windows Mobile Software Development] tonio94:
Ok it's getting me sooooo crazy :D

I tried with the two cecompr.dll modules posted here with an imageinfo.txt in it and no way...

I attach my OUT folder and the several cecompr.dll I tried (all from this thread). If you guys could have a look at it would be so happy :)

1) OUT + cecompr.dll (original XPR) = ok

=> XIP working and rom booting

2) OUT + cecompr.dll (entry same key already exists) = same number of section than original but way bigger (32ko instead of 4ko).

=> error message when realloc package with XIPPort ("An entry with the same key already exists").

=> message removed by changing cecompr.dll section 0 and 1 flag from 60002020 to 60000020 and apparently no overlap but...

=> Stuck on bootloader (second screen with IPL/SPL/Radio...)

3) OUT + cecompr.dll (no boot) = 1 more section than original

=> 1 section to realloc

=> XIP corrupted (not even IPL/SPL/Radio displayed)

Each time I use the Imageinfo.txt from the cecompr I use.
[Windows Mobile Software Development] utak3r:
imageinfo.txt file is... irrevelant ;) what I meant is cecompr.dll.txt file (used in XIPPort)... outside the cecompr.dll module folder :D
[Windows Mobile Software Development] tonio94:
Arf... Unfortunately, nobody posted a "full package" including this file :(
[Windows Mobile Software Development] akty123:
HELP

how to use the "MReloc" to change the “e32_vbase busenum.dll "and the”e32_vsize “？did i misunderstand "To reallocate the addresses for o32_realaddr, follow the above calculation, only this time replace the e32_vbase busenum.dll with o32_realaddr and e32_vsize with o32_vsize"!if i were,how to do this!!!!
[Windows Mobile Software Development] béotien:
Run M'reloc ( Double click on it ) : choose the module you want to reallocate in the right folder ( usually : C/base folder of your kitchen/xiptools/out/modules ) , report the calculated e32 realadress in first section , and the o32 one in the second section , then click Do it : this will reallocate the module's imageinfo.bin , but you also need to edit the imageinfo.txt for this module with notepad because xipport.exe reads the .txt files and needs them to write maps , as far as I understood
[Windows Mobile Software Development] béotien:
Hi , I tried to port a 21198 XIP , with a working 21198 SYS ( provided by a master chief on Modaco ) on my Omnia ; from the original XIP , I deleted hd.dll and oxast.dll , and then done my porting ; I finally ( after hours and hours ) got my device to boot , porting is not defective because popup windows during preconfiguration are orange ( porting is defective if they are grey on Omnia ) ; I replaced wince.nls by the WWE one posted here by FormerPalmOs , and edited wince.nls.imageinfo.txt file with the values he mentionned . I deleted the Windows Live folders from SYS , and checked the boot.rgu in XIP folder for HKCU/MUI value:CurLang : dword is 409 and HKLM/MUI value SysLang is 409: but the phone is like this

I would like to know what I' m doing wrong , because I don't know at all where to search
[Windows Mobile Software Development] utak3r:
Of course, all the mui files in SYS are 0409, right?
[Windows Mobile Software Development] béotien:
yes , all the .mui files in SYS are 409 . The only thing I changed in OEM folder are the two modules ( hd.dll and oxast.dll ) I moved from XIP , into OEM Drivers , without converting them into files . I didn' t add any packages in OEM folder , and did not remove Office nor OneNote in SYS
[Windows Mobile Software Development] utak3r:
maybe in imgfs, in the main registry, there's a duplicated entry of language setting... check it on a running system.

btw, you can safely remove those two modules completely.
[Windows Mobile Software Development] béotien:
thanks , I ' ll try to check for it tonight
[Windows Mobile Software Development] anryl:
this LOL is looking like wrong font issue dingdong font its not even 804 :)
[Windows Mobile Software Development] béotien:
I agree with you , because when I had the PIN unlock screen , the symbols were letterboxes instead of * ; it' s the very first time I attempt to port a new build , so could you point to me where I can begin to search ?
[Windows Mobile Software Development] giorgosm:
hello. i managed to port the xip for Omnia it boots ok but when it passes the logo i get different color dots on the screen.

is it problem of xip or sys?
[Windows Mobile Software Development] béotien:
Hi Sector :)
[Windows Mobile Software Development] tonio94:
Hi guys,

Could sb post a XIP with a LZX compatible cecompr.dll on it please ?

Not just the dll, the full XIP or at list the cecompr.dll folder + cecompr.dll.txt file

Many thanks for your help
[Windows Mobile Software Development] MAFoElffen:
XIP Question...

I've been following this thread before I ever joined XDA. It's been a great tutorial. I've been hanging on explorations, changes and/or advances that have been made or explained "right here."

Okay this XIP porting question may just be a step further...

First, a little background: The XIP file "nk.exe" is device specific. In ROM cooking and porting, we hex edit this file for updated info shown and for setting page pool, etc. But historically, since nk.exe is device specific, we took what we had and lived with it...

Recently, chavonbravo and Cmonex came up with a patched nk.exe (and possibly other files involved) for Polaris that "fixed" memory issues. As it is being discussed, it sounds like fixing memory leaks in 6.5 and having more avaiable memory- period(?). After that, Anryl and ervius took that and adapted it to Kaiser...

I thought about trying to track them all down to ask... But then thought, what better place than "here."

So I guess the first question is- Are these changes adaptable to other devices? How?

Next question (which I think is even more important)- With the nku changing in 6.5 and beyond... Can we patch these changes into the device specific portions of the XIP?
[Windows Mobile Software Development] béotien:
Hi , I' m back with my strange font issue

I checked in the .rgu files [HKLM/system/GDI/SysFont] , [HKLM/system/GWE/BarFnt] , and [HKLM/system/GWE/PopFnt] within the two folders in SYS ( Base_Lang_409 and OS ) : there are no differences between ported folders and stock ones neither in the boot.rgu from the stock XIP and the ported one as shown

I wonder what to check now

Any idea would be much appreciated

Regards , Philippe
[Windows Mobile Software Development] ivanmmj:
I may not know much about this, but one thing I DO know is that the kaiser and the Polaris are almost identical internally, which would explain why porting it wasn't very hard.

But I DO wonder if the "patch" would be easy to port to other device's NK.exe's.
[Windows Mobile Software Development] anryl:
memory patch

it was posted the hex adress for polaris no idea whats it for where they got it or whats so ever then i started playing on it with ida pro with no succes at all so the solution was ervius asked him to look at it he showed me that i need nk.exe file showed me how to dump it then he found the ram-end adress to modify and thats it . its not compatible with 3d devices as per two modules that u have to change in oemdrivers as posted in polaris thread.

adaptable to other devices ? might be ? find the endram adress and play with it :cool:
[Windows Mobile Software Development] utak3r:
True, the only thing this patch was doing is RamEnd value fixing... and this thing is really device specific and on every device this value will be different... it's just few months ago (around the summer last year? I think) the newest kernel for Kaiser were screwed in this matter and now it was fixed.

What I want to say is... there's nothing to port into other devices, it was a device specific issue only, it's not any kind of a global fix for all to have more memory. It COULD happen that on some other devices one could try to shift this value (RamEnd), too - although it would mean that someone have screwed it earlier ;)
[Windows Mobile Software Development] abusalza:
for kaiser if you won't hexing the nk.exe just using nk.exe from shipped 3.14...
[Windows Mobile Software Development] ivanmmj:
How much RAM are we talking about here?

I'm interesting in finding out more about this.
[Windows Mobile Software Development] anryl:
around 20MB TOTAL RAM GAIN
[Windows Mobile Software Development] ivanmmj:
Wow... Are you serious?

If so, Please teach me/help me how to do this!
[Windows Mobile Software Development] Ameet:
WTF!!!!! :eek::eek::eek::eek::eek::eek::eek::eek::eek::eek:

20MB RAM GAIN????? :eek::eek::eek:

Show me how you managed to do it? Maybe Aman can help us out to play around on IDA to get it working on Diamonds too :D:D
[Windows Mobile Software Development] anryl:
ervius knows it better :cool: i just starting the ida pro thingy how locate the end ram adress and first was cmonex on polaris :D
[Windows Mobile Software Development] Ameet:
Share whatever you got so far :D
[Windows Mobile Software Development] ervius:
yes, I found the solution on kaiser, like polaris, but on diamond seems doesn't work, all start from cmonex, she posted the hex address, with ida I found the relative code, and instructions, I post them:

.text:03D0823C MOV R0, #0x800
.text:03D08240 BL sub_3D11354
.text:03D08244 CMP R0, #0
.text:03D08248 LDRNE R1, [R4,#0x44]
[B][COLOR=red].text:03D0824C LDRNE R0, =aL2dsize0xX ;this is the point![/COLOR][/B]
.text:03D08250 BLNE sub_3CF787C
.text:03D08254 LDR LR, =unk_1FAC1B0
.text:03D08258 LDR R0, =unk_1FA98CC
.text:03D0825C LDR R1, =loc_3D165A4
.text:03D08260 LDR R4, =unk_1FA8E2C
.text:03D08264 LDR R5, =0xAC0411D8
.text:03D08268 MOV R3, #0xA10
[B][COLOR=red].text:03D0826C MOV R2, #0x83000000 ;this is the value to change.[/COLOR][/B]

this is all that I found, search "string": aL2dsize0xX in ida, then you search above for endRAM (in this case 83000000), and change the value (in 84000000 in this case)

I found the relative, quit different in diamond nk.exe, but after fix, rebuild rom and flash, the diamond stucks in screen calibration....

maybe for other devices, this little tute can help, but remember, all greetings go to "cmonex", without her help, I couldn't write all this ;)

bye!
[Windows Mobile Software Development] anryl:
to make nk.exe file use

dumprom xip.bin -5 -d XIP

MD XIP

in ida ctrl+shift+pgdn C analyze directly then alt_t i search for 82000000 end off ram then RmB text view click on it then in hex view i see the string 82 34 a0 13 its similar hexstring to polaris SO change to 83

kaiser changed endram from 82000000 to 83000000

on kaiser 82 34 a0 13

on polaris 82 24 a0 e3

diamond 85 24 a0 e3 03 25 82 e3 ( :D ) 85c00000

and other thing was not compatible with 3D drivers as well as change off module from 3.14 oem wce_pmem.dll

thats all i know :D
[Windows Mobile Software Development] anryl:
:D ervius did it again i did not refresh before posting :D
[Windows Mobile Software Development] Ameet:
Diamond users have always been left out from these amazing things you can do by hexing or IDAing :( :( Hopefully cmonex or someone will find a way to make this work on Diamonds too :(

Ervius, I'm game for experiments if you want to do for Diamonds. We can chat on msn later and try :):D

EDIT: Added the link to your info in first post :)
[Windows Mobile Software Development] ervius:
for me now, are 13.00, I'm free again at 00.30, bye!
[Windows Mobile Software Development] Ameet:
Hi Ervius. I tried opening the Diamond nk.exe in IDA but the string you mentioned is not found :( :( I dont even get your view which you posted :(

Here's my nk.exe, hoping you would guide me in right direction :( I know you mentioned the Diamond nk.exe doesnt work, but still I want to experiment myself :D
[Windows Mobile Software Development] anryl:
u dont read well ?

nk.exe file not module is used for idapro read my post above a little more :cool:

attached u'r FILE to play
[Windows Mobile Software Development] Ameet:
:o nothing more to say :o

i'll try on this file :D
[Windows Mobile Software Development] ivanmmj:
The use of Ida is a little over my head. :( It fails when I try to search for that search string. (Assuming I'm doing even that correctly...)

Here's a copy of my nk.exe and xip.bin just in case you're feeling generous enough to want to help. :p

It's a Herald in case that makes any difference.
[Windows Mobile Software Development] Ameet:
Even I found a lot of instances but this IDA is over my head too :D Hope someone could make it work on Diamonds too :(
[Windows Mobile Software Development] MAFoElffen:
Memory and the nk.exe

So all...

The original fix was found by looking on Polaris and Kaiser by searching for a known RamsEnd which was 82000000 and which needed to be changed to 83000000... but was found by coinsidence. (But was still found). It was found by disassembling the nk.exe with IDA.

Being device specific, the RamsEnd might be different for other devices, but the "instruction set" setting up the RamsEnd would be the same (but the address for RomsEnd would be different), correct? Shouldn't we rather be searching for that common "instruction set" to see what the current RamsEnd is set to on that particular device and go from there? So what is the "instruction set" that is "common" in the nk.exe that sets this up- that we can search on?

In particular, I can't find 82000000 in Hermes nk.exe... But then the Hermes doesn't have as much RAM as a Kaiser (so of course the value would be different)... But it has a RamsEnd somewhere. Any RAM I can squeeze out is a blessing. I figured along the same lines... Disassemble the nk.exe. Find the "instruction set" that set up the processs that plugs in the value for "RamsEnd". See if it makes a difference in changing values...

Is that a valid idea to follow?
[Windows Mobile Software Development] mac_es:
For trinity, ervius post this in his kychen thread:

I have tried but it doesn't boot. I think is because whith this we are telling to nk to work whith 71MB of RAM, which obviusly we haven't.

Also, I was wondering should we modify romhdr.bin to reflect the change of the end of ram. If I change the value prb shows the new ram size but it doesn't boot.

In trinity we have 64MB ram chip, and the ram which romhdr declare are 60MB

RAM: 0x80263000 - 0x8029c000 - Used for kernel modules
0x8029c000 - 0x83a00000 - 55 MB free

so we need to extend the las ram address 5MB not 20MB...

but it is quite strange that if they have more ram they don't use it...
[Windows Mobile Software Development] xdmcdmc:
Guys, what version of IDA are you using to decompile nk.exe?

I use IDA 5.2 Pro and I had no luck decompiling nk.exe for Diamond.

When drag and drop nk.exe IDA detects the exe as Portable executable for ARMI and I've tried to change processor type from Intel 80x86 to all kind of ARM available (ARM, ARM710a - this should be for diamond, ARMB).

The error: File read error at 000001D8 (may be bad file structure), continue?

After that error, I get other errors and in the end I can't do nothing with what IDA displays.

Thank you in advance for your help.
[Windows Mobile Software Development] anryl:
DIAMOND

LDRNE R0, =aL2dsize0xX
BLNE sub_80047194
LDR R4, =unk_802E9870
MOVL R3, 0xA11
LDR LR, =unk_802E6F8C
LDR R0, =loc_80063984
LDR R6, =unk_802E64EC
STR R3, [R4]
LDR R4, =0xA80811D8
[B]MOVL R2, 0x85C00000[/B] ==== HEX 85 24 A0 E3 03 25 82 E3
LDR R7, =0xA80811DC
MOV R3, #0x200000

IDA PRO 5.2.0.908 64bit
[Windows Mobile Software Development] giorgosm:
hello everyone.

i would like to ask a question about LZX compression. i have an Omnia phone and followed exactly the procedure in 1st post to use the LZX compression with the appropriate dll files but the phone doesnt boot.

Any help please?