[Windows Mobile Software Development] Ameet:
Gain more Storage Memory (increase imgfs size)

There are 4 partitions in Diamond ROMs

part00 – ULDR

part01 – XIP

part02 – IMGFS

part03 – FAT (This partition exists only on few devices)

We all port XIP from different devices to exclude few modules to gain space and to upgrade the kernel and make the XIP partition smaller in size. Although the new XIP is smaller in size but because of the insertion addresses of XIP & imgfs, there is a gap of wasted space filled with FF between end of XIP & start of imgfs. Although there is no way we can include this space into XIP as free RAM but make use of this space in imgfs and gain whatever storage space we can

Files used as example for this tutorial

xip_out.bin: My own ported XIP of size (30CA12 in Hex, 3195154 in bytes)

os.nb.payload: My own cooked payload (since I also wanted the final ROM to be a cleaner ROM)

imgfs start: in my payload at 0x7A0000 (unedited)

XIP start: in my payload at 0x320000 (unedited)

Before we move into hex editing, let me give an overall outlook of the MBR & MSFLSH regions of the ROM

MBR is the Master Boot Record of the ROM (512 bytes) from 0x0 to 0x1FF. The infomation of partitions types Flags in hex offsets are called from the registry entry mentioned in boot.rgu below

The starting block (LBA) and number of sectors for each partition are defined as shown below

part00. 1C6 – 1C9 (starting block) 1CA – 1CD (number of sectors)

part01. 1D6 – 1D9 (starting block) 1DA – 1DD (number of sectors)

part02. 1E6 – 1E9 (starting block) 1EA – 1ED (number of sectors)

part03. 1F6 – 1F9 (starting block) 1FA – 1FD (number of sectors)

[HKEY_LOCAL_MACHINE\System\StorageManager\PartitionTable]

"04"="FATFS" ; (hex: 1F2)

"20"="BOOT" ; (hex: 1C2)

"23"="RAWFS" ; (hex: 1D2)

"25"="IMGFS" ; (hex: 1E2)

MSFLSH50 is the Flash region of imgfs from 0x800 (see post #8 for screenshots, shown here is for Diamond) to 0xFFF. The starting block of imgfs is located in MSFLSH at 81C

e.g. if your device ROM's sector size is 200 then the MSFLSH50 region will starts at 0x200 and so on

Moving into the hex editing mode for making use of the wasted space between the actual XIP end & start of imgfs partitions

The new xip_out.bin is 30CA12 in total size (check your actual xip_out.bin size, shown here is just example) starting at 0x320000 (check you device XIP start, shown here is for Diamond) and ideally should end at 62CA12. But since the starting block of imgfs must be divisible by 20000 (see post #8 for screenshots, shown here is for Diamond) the imgfs needs to start at 640000. So the new XIP will have to be inserted into the payload at 0x320000 till 0x640000 with XIP size of 320000 and reduced wastage of 135EE bytes

The imgfs can also start at 630000 since this is directly after the XIP and also divisible by 20000, used here is 640000 as expansion for future xip_out.bin

Open the existing os.nb.payload in hex editor. Delete everything from 0x640000 till 0x79FFFF. This will move the imgfs from 0x7A0000 to 0x640000. Since we are now moving the imgfs partition next to new XIP, the number of sectors in new XIP and new LBA of imgfs needs to be edited to the revised value in the MBR region

To calculate the new starting block of imgfs partition we need the number of sectors in new XIP. To calculate that, use the following method

In Hex calc

Number of sectors = size of partition / sector size

e.g. (new XIP) 320000 (shown above) / 800 (see post #8 for screenshots, shown here is for Diamond) = 0640

since the coding is in little endian, we have to reverse these values to 40 06 00 00

Go to offset 0x1DA and change the values to 40 06 till 1DB and then 00 00

Now realloc the LBA of imgfs since we revised the number of sectors in XIP and to calculate that, use this method

In Hex calc

Logical Block Address (LBA) = Previous Partition LBA + Previous Partition number of sectors

e.g. (XIP LBA) 0640 + (XIP no of sectors) 0640 = 0C80

since the coding is in little endian, we have to reverse these values to 80 0C 00 00

Go to offset 0x1E6 and change the values to 80 0C till 1E7 and then 00 00

Logical Block Address (LBA) should be equal to (Previous Partition LBA + Previous Partition number of sectors * Sector Size)

e.g. (XIP LBA) 0640 + (XIP no of sectors) 0640 * 800 (see post #8 for screenshots, shown here is for Diamond) = 640000 (size of imgfs partition)

Similarly to imgfs calculate and change the LBA of FAT at 1F6 and 1F7 using the default imgfs no of sectors (use these since the cooking tools will change these as per actual size)

We have changed the LBA and number of sectors in MBR, but the OS needs to know the block address of imgfs in MSFLSH50 region

To calculate that, use this method

In Hex calc

MSFLSH50 Block Address = imgfs partition starting address / 20000 (see post #8 for screenshots, shown here is for Diamond)

e.g. (imgfs starting address) 640000 (shown above) / 20000 = 32

Go to offset 0x81C and change the value to 32

Save and close the os.nb.payload file in hex editor. Insert the new XIP into this file using this command

“insert.exe -i xip_out.bin -o OS.nb.payload -d 0x00320000 -s 0x00320000” (check your insert start address, shown here is for Diamond)

To calculate the size of XIP from MBR, use this method

In Hex calc

Size of XIP = Number of Sectors * Sector Size

e.g. (if the no of sectors in little endian) 0640 (shown above) * 800 (see post #8 for screenshots, shown here is for Diamond) = 320000 (sector size for diamonds)

This value shall be the "-s" while using insert.exe tool and to calculate the start of the XIP, use this method

In Hex calc

XIP Start = imgfs Start + "-s"