yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Software Development] bgcngm:
Guys, I request once again your help... :rolleyes:

[B]MAPS (original XIP)[/B]

80319000 - 80319000 L00000000 Start: start of RAM
80319000 - 8031a000 L00001000 initialized data of region_1 hd.dll
8031a000 - 8031e000 L00004000 initialized data of region_1 osaxst0.dll
8031e000 - 8031f000 L00001000 initialized data of region_1 osaxst1.dll
8031f000 - 80320000 L00001000 NUL
80320000 - 80326000 L00006000 uninitialized data of region_1 nk.exe
80326000 - 8038b000 L00065000 initialized data of region_2 nk.exe
8038b000 - 8039e000 L00013000 initialized data of region_1 kd.dll
8039e000 - 8039e000 L00000000 ------ start of RAM free space
8039e000 - 83abe000 L03720000 NUL
83abe000 - 83abe000 L00000000 End: end of RAM

Here's the result of using buildxip in the original and untouched XIP (as you can see, I haven't removed debug modules).

[B]MAPS (after buildxip)[/B]

80319000 - 80319000 L00000000 Start: start of RAM
80319000 - 8037e000 L00065000 initialized data of region_2 nk.exe
8037e000 - 8037f000 L00001000 initialized data of region_1 hd.dll
8037f000 - 80380000 L00001000 initialized data of region_1 osaxst1.dll
80380000 - 80386000 L00006000 uninitialized data of region_1 nk.exe
80386000 - 8038a000 L00004000 initialized data of region_1 osaxst0.dll
8038a000 - 8039d000 L00013000 initialized data of region_1 kd.dll
8039d000 - 8039d000 L00000000 ------ start of RAM free space
8039d000 - 83abe000 L03721000 NUL
83abe000 - 83abe000 L00000000 End: end of RAM

And here the result if debug modules are removed:

[B]MAPS (after buildxip with removed debug modules)[/B]

802e7000 - 802e7000 L00000000 Start: start of RAM
802e7000 - 8034c000 L00065000 initialized data of region_2 nk.exe
8034c000 - 80350000 L00004000 NUL
80350000 - 80356000 L00006000 uninitialized data of region_1 nk.exe
80356000 - 80356000 L00000000 ------ start of RAM free space
80356000 - 83abe000 L03768000 NUL
83abe000 - 83abe000 L00000000 End: end of RAM

As you can see in both situations, the nk.exe initialized data of region_2 is allocated before uninitialized data of region_1... I think this is why my phone doesn't boot.

Can anyone help me on this?
[Windows Mobile Software Development] spocky12:
No problem with this. Here's what I have on my ks20 :

802df000 - 802df000 L00000000 Start: start of RAM
802df000 - 802e0000 L00001000 initialized data of region_4 nk.exe
802e0000 - 802e6000 L00006000 uninitialized data of region_1 nk.exe
802e6000 - 8030a000 L00024000 initialized data of region_2 nk.exe
8030a000 - 8030b000 L00001000 initialized data of region_5 nk.exe
8030b000 - 8030b000 L00000000 ------ start of RAM free space

And no problem so far with xipport. But I guess that's why most htc xip tools don't work/crash (ie: prb) : they may assume that nk regions are ordered. I tried to contact bepe about this but he never replied...
[Windows Mobile Software Development] bgcngm:
Thanks for replying to all my posts, spocky12. :) I really appreciate.

Is that the MAPS after using XIPPort (with debug modules removed)? In your original XIP, do you have also nk.exe regions out of order (or with that order)?

By the way, as you already know PRB crashes with my nk.exe. Using buildxip results in a non bootable ROM. I'm only succeeded if XIPKitchen is used (which is based on XIPPort and uses the same method as you do in your kitchen). Have you ever tried to build a XIP using buildxip? Did it worked for you?
[Windows Mobile Software Development] utak3r:
Most of such kernels crash if regions are reordered... so PRB can't be used for them, unfortunately. All you left with is XIPAddrTool.
[Windows Mobile Software Development] bgcngm:
Thanks for your answer utak3r. Do you think that the cause for PRB crashing with my nk.exe is the same that leads to a non working XIP when buildxip is used?

I don't have any error when using buildxip:

EDIT: One thing that is also bugging me (besides these problems with buildxip and PRB) is that, according to buildxip output, my device RAMEnd is 0x83ABE000. ETEN DX900 specs are 128MB of RAM, so RAMEnd should be something like 0x86xxx000... At least, when compared to LG KS20 (has 128 MB of RAM) and RAMEnd is 0x86400000. Don't you agree?

EDIT2: By the way... your website (http://utak3r.buzzdev.org/2009/08/30/loading-modules-into-ida-pro/) is down.
[Windows Mobile Software Development] utak3r:
Yep - there were already few cases of such mistakes. You can try to move it - although it *may* require changing a kernel :/

uh, thanks for heads up....
[Windows Mobile Software Development] bgcngm:
I already tried to change RAMEnd in ROMHDR.txt and then "realloc P" with XIPPort, but it didn't work, so... if this is really a mistake, it will require changing the kernel. That's why I wanted to go to your website... to see your guide on how to open modules with IDA Pro. ;)

EDIT: In this case, if I wanted to apply ervius method (http://xdaforums.com/showthread.php?p=3806368#post3806368), I would need to search for any instance of 0x83ABE000 within my nk.exe, right?
[Windows Mobile Software Development] utak3r:
Here you have a Polish version if this tut:

http://forum.mobione.pl/index.php/topic,10944.0.html

Generally yes :) and then search for the reference.
[Windows Mobile Software Development] utak3r:
uh, one thought.... bgcngm: it *may be* that your RAMEnd is as such, because you have two physical RAM chips... (2x64MB). If it is true - then this value could be right.
[Windows Mobile Software Development] bgcngm:
Uhhh, you are probably right...

But how can I have this with a 128MB of RAM device?

I know that some of the space is taken by pagepool (6MB in my case), but what about the rest?
[Windows Mobile Software Development] spocky12:
On ks20, there's approximately 82Mb total memory available for the system. The rest is shared between pagepool and video 3d memory (on kaiser, you'll see patches to increase memory to more than 100mb, but then, hardware 3d acceleration is not possible anymore) and perhaps something else, I don't know.

As for buidxip, I also have the same issue. The only xip software that works on ks20 is xipport. What I posted above is what I have after using xipport, after removing debug modules. The order is the same as stock xip.

If prb crashes really come from unordered nk regions, does anybody know a method to reorder nk regions so that we could then use prb and not this hybrid method ?
[Windows Mobile Software Development] serfer222:
Hi, I'm building ROM for Iolite and cannot understand how it uses RAM and FLASH. Detailed description is in this thread.

Can you help me to get more RAM and storage? =)
[Windows Mobile Software Development] bgcngm:
I'm not totally sure that PRB crashes due to the unordered nk.exe regions... You say that in your stock ROM, you already have unordered regions, but in my case, the regions are originally ordered and it crashes anyway.

Besides that, look at this:

And regarding buildxip:
[Windows Mobile Software Development] anryl:
buildxip was designed for hermes like devices with old kernel.

on kaiser with newer kernel was buildxip not working that is why was this thread actualy started .

prb is working on htc devices.

manual xipport is working on all devices but it is not easy

xipporterex some older rev. are working as well as they are using realoc from imgfslike tools

the newer xipporterex were using prb :) htc only

xipporterex is posted by me somewhere in this thread if no more i could search for tje links

bye :)
[Windows Mobile Software Development] dan15:
Hourra!

I'have found the rule for the End RAM of the Trinity in the nk.exe. i have now 58,5 Mo free !

here is my patched S000. I'll posted tomorrow the way to modified.

=============================================================================

I'll come back with the explanation after a good night :-):

firstable, a great thank's to Ervius to point the cmonex'discovery :-).

when i red this post, i didn't understand why it was not possible to enter a value more accurate than a 10 Mo range (from 83000000 to 84000000). so i installed IDA and search a bit deeper in the code.

.text:8004F7A4 LDR LR, =unk_802AB374

.text:8004F7A8 LDR R5, =unk_802AA04C

.text:8004F7AC LDR R6, =unk_802A794C

.text:8004F7B0 LDR R1, =sub_80058F38

.text:8004F7B4 LDR R0, =unk_802A6EAC

.text:8004F7B8 LDR R4, =unk_802A7960

.text:8004F7BC MOV R3, #0xA10

.text:8004F7C0 MOV R2, #0x83000000 : the high part of END RAM.

.text:8004F7C4 ORR R3, R3, #1

.text:8004F7C8 ORR R2, R2, #0xA00000 : the low part of END RAM

.text:8004F7CC MOV R7, #0x40

.text:8004F7D0 MOV R8, #1

ARM is only able to load 8bits value, so to make a 32bits value, it shifts on the right 4 bits by 4 bits the 8bits in the register.(for instance, you load 0x00000083, and you shift 4 times to have 0x83000000). if you stop there, you can only move the address by 10Mo step!

so i continue to study the code, and i find an other loading : the "lower" part of the address; in my case, it was 0x0000000A. shifted 6 times, i have 0x00A00000. with an ORR instruction, you mix the two values and obtain the end address 0x83A00000. that's it!

i just need to change the second value, calculate the right shift and i have my new END RAM address.

.text:8004F7C8 ORR R2, R2, #0xD20000 : the new low part of END RAM

for the Trinity, the hard code is following :

MOV R2, #0x83000000	=> 83 24 A0 E3

ORR R2, R2, #0xA00000	=> 0A 26 82 E3 than you change in ORR R2, R2, #0xD20000 => D2 28 82 E3.

due to drivers "hard" loaded by HTC in the high of the RAM, it's not possible to go higher.

i haven't nk.exe from other phones, but i expect it's similar. the structure of the hard code is a bit different depending on the way you load the register and the register you use, but it's the same rule.

so with this method, my Trinity has now a free RAM usable of 58,5Mo, and after one day, i have more than 22 Mo free (with PP=4, and SD inserted), and the problem is not to boot with 28 Mo if you fall to 18Mo after two hours!...

so, either you are a boss with an hex editor, and you do the change in the S000 file of the nk.exe module, or you use the file attached, it's up to you.

have a good day.
[Windows Mobile Software Development] bgcngm:
Please do that. I'm very interested. :)
[Windows Mobile Software Development] dan15:
that's done, i edited my post :D
[Windows Mobile Software Development] bgcngm:
Thank you! I did try to apply that trick once, but without any success. Can you please check my S000 to see if you can find the right value to change?

http://www.4shared.com/file/154475528/5b78d84b/DX900_nkexe.html

My DX900 (128MB device with only 69MB available) ROMHDR:

dllfirst: D=01FA01FE
dlllast: 02000000
physfirst: P=80040000
physlast: 8029F000
nummods: (00000019)
ulRAMStart: R=802A0000
ulRAMFree: 8030B000
ulRAMEnd: 83ABE000
ulCopyEntries: (00000001)
ulCopyOffset: P+0005BFF0
ulProfileLen: 00000000
ulProfileOffset: 00000000
numfiles: (00000004)
ulKernelFlags: 00000000
ulFSRamPercent: 00000004
ulDrivglobStart: 00000000
ulDrivglobLen: 00000000
usCPUType: 000001C2
usMiscFlags: 00000002
pExtensions: P+00002674
ulTrackingStart: 00000000
ulTrackingLen: 00000000

Thanks in advance
[Windows Mobile Software Development] dan15:
sorry, i have only the demo version of IDA, so i can't reverse process the S000 file. if you want i have a look, i need the nk.exe, or if you dont- know how to make it, your xip file.
[Windows Mobile Software Development] bgcngm:
Here's my XIP: http://www.4shared.com/file/154499116/65020f8a/DX900_XIP.html.

If you find anything, is it easy to port it to my S000 file?
[Windows Mobile Software Development] andy206:
i don't understand,where have i to put s000 file to have much ram?
[Windows Mobile Software Development] dan15:
i'm a little bit confused : you say that you have 69 Mb free, but 83ABE000 - 8030B000 is a little more 55 Mb... can you explain where do you find this value?
[Windows Mobile Software Development] dan15:
the file i posted is only for Trinity. if so, you just copy the S000 in your nk.exe folder before cooking. your new XIP will use the new value. that's all.
[Windows Mobile Software Development] bgcngm:
No, it's not 69 MB free, but total available memory for programs (as can be seen in Windows System / About or Memory). In fact, 55 MB free is what Platform Rebuilder reports.
[Windows Mobile Software Development] andy206:
ok,thank you!
[Windows Mobile Software Development] D@vide:
Hi dan15

does this works also on wm6.5.x kitchen? I copied your file on nk folder before cook with a 23504 build by rubenalf here:

http://xdaforums.com/showthread.php?t=580288

but after flashing I have:

54.04 Mb total

25.47 Mb in use

28.57 Mb free

(Pagepool set=6 Lzx compression)

any idea?

Thank you in advance

D@vide
[Windows Mobile Software Development] ickebins:
worksforme -you should have checked before, it would have been 50,92Mb total :D

And: Thanks a lot, dan15! Great work!
[Windows Mobile Software Development] bgcngm:
dan15, were you able to find anything in my nk.exe?
[Windows Mobile Software Development] dan15:
I spent a lot of time this morning, and i am not sure my soluce will apply to your phone.

correct me if i'm wrong, but the XD900 has two sim. in the code, i find THREE sets of instructions that could be in order to point the ENDRAM !?!?

i went on forums dedicated to Eten, and everybody speaks of a low RAM for this phone.

as he has 128 Mo, i expect it uses 64Mo for each sim, one that you deal with, and one "shadowed".

also, you said that system\memory reported 69Mb. could you give me the exact value (69,? Mb) and also witch PagePool you cook? because, i have to add the PP to the memory reports in order to find the range of your actual ENDRAM. it's the only way to find precisly the right instructions... if it's "readable".

sorry for the delay and my approximate answer, but Eten clearly codes his nk.exe a different way than HTC.
[Windows Mobile Software Development] bgcngm:
I really appreciate your help. As I said, I also tried to find ulRamend in my S000, but with no luck. :(

Yes, you're right. DX900 is the first dual SIM Windows Mobile phone.

That's why I wanted to get a few MB more, especially to run WM6.5. :)

But why would SIM2 take 64MB? Doesn't make too sense...

Right now I'm running WM6.5, the exact total memory is 69,52 MB and PP is 6 MB. I don't know if this helps, but GSM Phone2 Firmware is always loaded from a 4,05 MB file that's within ExtROM.
[Windows Mobile Software Development] dan15:
ok bgcngm,

I have a hard day today, so i'm not sure i will have time to search deeper, but i 'll come back as soon as i find (or not) something.

A+ (see you... in french :-) )

I'm soory, but on the XD900 the ENDRAM address seems to be passed by arguments :(. so it's not possible to have a direct read of the address like on HTC. the only solution i see, should be to run the debugger in IDA and display all the changes!... but for that, i must have the XD900 connected to my PC, and i will not buy an XD900 "only for that" ;). so for the time beeing, i'm not able to go further on your nk.exe.

i keep your file on my PC, and if i learn new things about XD900, i'll go back on it.
[Windows Mobile Software Development] nikitto:
Thanks dan15 for the information.

I gave it a try in my Trinity, but I got only 51.79 MB. Can you share all your nk.exe ?

Thanks in advance.
[Windows Mobile Software Development] l2tp:
htc universal -- is this possible?

hey guys, do you mention modifying only trinity nk.exe or this can be applied to another models too?

i have htc universal with only 49.5 mb free memory available, is there any hope to increase this?

tried it but no success. so i attach my nk.exe, maybe somebody will be more lucky than me. thanks in advance for any help! :)
[Windows Mobile Software Development] Ameet:
hi l2tp. the manual xip porting can be used also for other devices provided u ve the calculations right. i wouldnt know the address offsets since never worked on any other device. try using the auto tools from lennysh or ervius..
[Windows Mobile Software Development] fire_z:
'bout ulRamEnd

Anyone can help?:)

I have cooked a lite ROM for Acer M900 and succesfully cooked a ROM with 71Mb free RAM (total RAM memory is 94.59)...

I want to try if I can still get some extra RAM by editing the xip.bin and changing ram end (by dan15)

Here is my ROMHDR.txt

dllfirst: D=01FA01FE

dlllast: 02000000

physfirst: P=80040000

physlast: 802F8950

nummods: (0000001A)

ulRAMStart: R=802F9000

ulRAMFree: 8032B000

ulRAMEnd: 83FA0000

ulCopyEntries: (00000003)

ulCopyOffset: P+00079FC8

ulProfileLen: 00000000

ulProfileOffset: 00000000

numfiles: (0000000C)

ulKernelFlags: 00000000

ulFSRamPercent: 00000004

ulDrivglobStart: 00000000

ulDrivglobLen: 00000000

usCPUType: 000001C2

usMiscFlags: 00000002

pExtensions: P+00002674

ulTrackingStart: 00000000

ulTrackingLen: 00000000

I tried changing the value of uLRamEnd, but it seems I cannot calculate the right value, cause when I flash my device with the ROM with my modified xip.bin, it does not boot:p

Can anyone guide me how to find the right possible values or calculate me one:o I only want just an extra 3-5mb RAM:) (it would be nice to have a total free RAM of 75mb)

Thanks for the help in advance
[Windows Mobile Software Development] rickou26:
Hi,

Firstly thank you to Ameet and all those who contributed to this tutorial. By following your instructions I have also increased the size of my storage memory 10M!

Thank you for your instructions :D
[Windows Mobile Software Development] kalpeshmist:
hi,

im a little confused with post #6 of increasing imgfs size. i want more storage in my Asus P527..

the payload i use is the combination of uldr, xip and imgfs. some info of my payload given..

xip start = 0x170000

xip size = 0x1C0000(bytes)

xip ends = 0x330000(calculated)

imgfs start = 0x330000(sector 0x1980)

imgfs ends = 0x340000

imgfs size = 0x10000

my payload's xip ends at 0x330000 and imgfs also starts from 0x330000! the payload don't have anything to be deleted..

i want to increase the storage size of my device which is in total just 32.19mb.. too low.. the storage specs of p527 is as same as touch elf.

pls help me,

kalpeshmist
[Windows Mobile Software Development] kalpeshmist:
pls help!!
[Windows Mobile Software Development] Ameet:
Appreciate the tutorials working out for you bro :)

Hello Kalpesh. I'm so sorry, I will ask Aman or experts from this thread to help you since I dont have my Diamond anymore (looking out for some 2nd hand devices to continue working on XDA though :)) Will surely try and get back to adding more tutorials soon :)
[Windows Mobile Software Development] kalpeshmist:
thankyou so much for the reply! will wait for further replies!!
[Windows Mobile Software Development] the_scotsman:
I've had a big read through this thread and "sort of" understand whats going on :p

I'm still somewhat new to kitchens, and have a question.

I have cooked 21888 for my Diamond, but am now keen on tweaking...

Here is my map:

80480000 - 80480000 L00000000 Start: start of RAM
80480000 - 80486000 L00006000 uninitialized data of region_1 nk.exe
80486000 - 80504000 L0007e000 initialized data of region_2 nk.exe
80504000 - 80505000 L00001000 initialized data of region_1 hd.dll
80505000 - 80509000 L00004000 initialized data of region_1 osaxst0.dll
80509000 - 8051c000 L00013000 initialized data of region_1 kd.dll
8051c000 - 8051d000 L00001000 initialized data of region_1 osaxst1.dll
8051d000 - 8051d000 L00000000 ------ start of RAM free space
8051d000 - 83000000 L02ae3000 NUL
83000000 - 83000000 L00000000 End: end of RAM

I have read that osaxst0.dll, kd.dll and hd.dll can be removed. Also then bump the other nk files up so there is more free RAM. Am I right so far?

I think I need to use mreloc_nk? I understand how to move up nk files but not how I can remove the other 3 dll files completely?

Also in my map.txt, futher up in the file I can see other references to osaxst0.dll and hd.dll. Should these also be removed somehow?

Oh and how can I be sure I have a native 6.5 DIamond kernel?

Thanks...awesome thread...brain overload :o
[Windows Mobile Software Development] kalpeshmist:
why this doesn't work in my p527..? im fed up trying different things to increase the storage memory.. anyway, is there any way to increase the total program memory?

pls reply..

EDIT: for program memory im looking at Misc XIP Updates..!!
[Windows Mobile Software Development] kalpeshmist:
pls help me

someone pls help me. i say PLEASE. i want to increase the total storage memory of my device which is just 36mb. the memory specs is as same as touch elf. 128mb ROM and 64mb RAM. im attaching the payload file. pls have a look into it.

Ameet, pls help me with this.
[Windows Mobile Software Development] Ameet:
hi kalpesh. will request aman to look into this since he is actively working on elf device.. also i am kind of an offline help since i dont have a win mob currently.. am putting on tutorials with a lot of testing help from aman
[Windows Mobile Software Development] ansar.ath.gr:
Hi,

Just delete modules hd.dll, osaxst0.dll and kd.dll from modules folder.

Also delete relevant imaginfo.txt of these modules from modules folder.

In ROMHDR.txt change startram from 0x8051d000 to 0x80504000

Finally realoc and build xip_out.bin

Regards, ansar.
[Windows Mobile Software Development] jerpelea:
you can easyly find max address using hexeditor on S000 and replace marked adresses

just search for

8224A0E3 85mb (128mb ram device/stock)

8324A0E3 101mb (128mb ram device/optimised)

8524A0E3 197 mb (256mb ram device/stock)

8624A0E3 224 mb (256mb ram device/optimised)

also note that page pool will "eat" you ram

0 page pool is automatic

32mb from my findings is maximum value used

ram on 256mb ram device pegepool dependent

0 mb page pool 229 mb free ram

16 mb page pool 213 mb free ram

24 mb page pool 205 mb free ram
[Windows Mobile Software Development] bgcngm:
Can you tell us how have you found that? I don't have a HTC device, so I wanted to find out how to apply those changes in my device NK.

Thanks in advance.
[Windows Mobile Software Development] jerpelea:
this is for msm 7xxx devices

wich cpu do you have ?

wich device?
[Windows Mobile Software Development] bgcngm:
I have an ACER DX900, with a Samsung S3C6400 processor.

I've posted my NK a few posts back and I would be glad to know if something can be done for my device. A few MB more would really help, at least for WM6.5. :D
[Windows Mobile Software Development] jerpelea:
i dont think that i can help

you can set page pool to 0 as microsoft recomands and you will have maximum free ram

you can also manage cash to recover some ram and stop unnneded services like ipv6 and ipsec

please send me full kitchen by pm

maybe i can help
[Windows Mobile Software Development] rickou26:
@jerpelea,

Hello,

On my LG KS20 CPU Qualcomm MSM7200 I with RAM_capacity: 128 MiB (accessible: 80.8 MiB). Can you tell me the hex string to search in the S000. More generally just how will the string from the available RAM.

Thanking you.
[Windows Mobile Software Development] jerpelea:
search with first and then with second

8224A0E3 85mb (128mb ram device/stock)

8324A0E3 101mb (128mb ram device/optimised)
[Windows Mobile Software Development] rickou26:
Hi,

I can not find 8224A0E3 or 8324A0E3 :(
[Windows Mobile Software Development] bgcngm:
I already tried that. Device performs really faster, but strangely memory after boot is less than with 6MB of default PP size and it runs out of memory really fast.

I don't cook with IPSECVPN package...

Well, here's my OEMXIPKernel. If you can find something I would really appreciate it. The kitchen that I use is based on bepe's PRB with my own modification because PRB crashes with my device NK. To build the XIP, I use XIPPort.
[Windows Mobile Software Development] Premananda_laishram:
how

I have a few questions.

1.How do I add back a file/module deleted from xip?

2.Will it be the same if I add a file that was not originally in the xip?

3.What will be the necessary changes to the maps?

4.And what do I write inside the text file for the added file?

I hope there are some experts that can give my answers.