yashsingh1/xdaforums huggingface dataset:
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
sorry for that, I assumed HTC kept the mapping the same when booting OS so I didn't ask for a memmap. but apparently not... you got this error as the address is not mapped. we'll see if next dump goes fine. :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
rbmc will not work as by default it is limited to OS/Storage dumping. (need to patch SPL)

as for reading.. explained in my other post now.

what do you want to do with KITL logging?

btw, cool about your expertise, what kind of hacking did you do on x86? :)
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Nice to see more experts here :) With the help of cmonex i was able to dump the SPL now.. If she gives her okay, i'll attach it here and tell you how to do it yourself. Of course, credits go to her.

rofl. Seems that there is some kind of ASCII-art alphabet inside.. :)
[HD2 Windows Mobile 6.5 ROM Development] htc-hd2:
I would love to flash my Dutch version to an English one.

I'll even donate for this if needed....

Hell I'll even give away some Google Wave invites if needed :-)
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Okay.. First we need to patch the SPL we extracted to accept wrong signed code. If anybody could comment on how to start on this? I haven't found out much on it yet.

What we seem to need is a modified version of SSPL, which was initially developed by DES. Some kind of holy grail, i think. :)

In short it is a windows mobile utility, which "reboots" the device, and loads our modified SPL into RAM, so that we, in theory, could flash wrong signed code.

We need to modify it to include our patched SPL and the modified start address of the SPL on LEO.

If i understood it wrong, please correct me. :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
you can send me a PM and I'll help. :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
sure, you can attach it, it's probably the same version as in a shipped RUU anyway, but still very useful to have! I'd like to see it :) ASCII art? :O :D
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
that's correctly understood, by and large. btw I'm already working on this but I don't have files ready for test yet.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Yes.. ASCII art xD. Starts at 00005a20h. File attached. Nice to hear that you are working on it! ^^
[HD2 Windows Mobile 6.5 ROM Development] kholk:
On x86 i used to hack some mainboard's BIOSes, adding the support on old machines for large HDDs, or adding the support on new mainboards (AM2+ socket) for BIOS overclocking ... and some other architecture controls (such as cores unlocking where possible etc).

However, my work doesn't stop at BIOS hacks, I'm helping the linux community to go on fixing bugs that I can fix ;)

...and last of all, I've used to crack the debug kernel protections in windows betas...

Anyway, I've never worked with platforms that are different from x86/x64 and I don't know exactly what kind of debug platform KITL is, but I wanted to try (as for now, I haven't tried, didn't got time).

Ouh, if you got an SPL dump of the HD2, I'd like to have it.. and I'd like to examinate it. ASM instructions are so much familiar to me (x86 BIOSes are all written in assembly).. and I know that ARM assembly is not EQUAL to the x86 one, but at least it's similar and I think that I can understand somewhat because of my knowledge on x86 systems.

It's never too late for begin ;)
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
I have attached it in the above zip file in post #1..

However i couldn't manage to get any ASM code out of it with IDA (used the ROM image setting).. If you get it.. Tell me. :)

This 502 error is driving me mad... *grml*
[HD2 Windows Mobile 6.5 ROM Development] JohnQ:
thread collected. ..thanks.
[HD2 Windows Mobile 6.5 ROM Development] depl0y:
cmonex, I sent you a PM. I was wondering if you could help me get the WWE version of the ROM on my Dutch HD2.

Ofcourse for a donation (which I just made, ID: 5JA17699B6240460P)..
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
replied to your PM :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
ah, I see what you mean. ;)
[HD2 Windows Mobile 6.5 ROM Development] depl0y:
And I replied to yours ;). I am not sure if I get this thread right completly, but this is work that also needs to be done to get the HardSPL done for the HD2?
[HD2 Windows Mobile 6.5 ROM Development] kwanying:
cmonex, dont' forget to check your pm.

My Transaction ID: 05P51085RK464715L

Thanks alot
[HD2 Windows Mobile 6.5 ROM Development] kholk:
I'm trying to disassemble the SPL with IDA Pro 5.2 but I have to ask some help....

I'm using the disasm_wince_bootloader.idc script by itsme, but it shows off an error while trying to use it:

Runtime error at process_bl+0x0000008C: Attempt to call undefined function 'MakeTable'

I've tried to search for that function, but I can't find any information.

Can someone help me?
[HD2 Windows Mobile 6.5 ROM Development] thechefcooks:
my failed attempts to get my nld hd2 to accept wwe file

i started my hexeditor and tried the following to get my dutch hd2 to accept wwe

i know you people dont have a need for reading on a failure of flashing attempt altough others reading might find out this way it doesnt work and saves them the time involved in what i tried.

i hex compared the wwe file against the nld file and spotted the first differences:

- version number, i left that one for what it was.

then i found:

- nld file: 00000210 4e 4c 44 versus

wwe file: 00000210 55 53 41

then i edited the wwe file to match the nld string and got rid of the 0/1 % error msg, but the flashing stayed on 0% and after 5 mins i got an timeout

it would be a laugh if it was the solution but sadly is wasnt.

i also hex edited & copied 00010020 to 000100a8 as i expected this to be the check routine but unfortunately that did not help either.

so if there are people thinking of doing the same, go ahead but you will be dissapointed by the results.

i guess there are more hidden checks/crc's put in by htc, i only need to find them like others are looking for a solution ....

goodluck on your quest(s) to success, i will be hunting 00010111010 for a while longer

i also looked if i could find the $offset for the language part to exchange the nld to wwe but have not found it as it seems some parts are crunched and others are not.

thats all for my pathetic attemps for now. if any of you guys & gals get luck i hope to hear from ya :-)
[HD2 Windows Mobile 6.5 ROM Development] fmcastro:
Well, I don't know much about this but I think you can't just modify the ROM files. They're signed so any changes you make are easily identified by the device which in turn rejects the modified file.

That's why everybody talks about modifying the SPL, which is the piece of code inside the device that does the signature check.

Unless, of course, you are able to crack the key HTC uses to sign their files but that is a whole different approach...
[HD2 Windows Mobile 6.5 ROM Development] daleski75:
Shame I don't have the know how to modify SSPL, JUMPSPL or USPL, maybe some guru could have a look at this thread and see if they can work some magic on it for the leo?

http://xdaforums.com/showthread.php?t=293632

http://xdaforums.com/showthread.php?t=398945

http://xdaforums.com/showthread.php?t=355730

Anyway even if none of this is relevant keep up the good work guys it is very much appreciated.
[HD2 Windows Mobile 6.5 ROM Development] thechefcooks:
I know it wont be easy, but i just had to try, that what others do too, and my first attempt failed but i'm sure others will succeed sooner or later, sometimes defeating a protection can be just as easy as yes vs no. i will keep examining the rom data for a while, maybe just maybe i get lucky:D

i vote for HTC to sign their files with HTC hehehehe
[HD2 Windows Mobile 6.5 ROM Development] kholk:
It's exactly what we are doing :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
that approach won't work due to the strong RSA key they use for signing

see wikipedia or some other site on what RSA is / how it works.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
probably those idc's are quite old.. I'll admit I 'm not familiar with itsme idc, I never use idc's for disasm'ing the SPL as I know most of the code by looking at it

idc can be very useful when disasm'ing some very big thumb radio firmware, though :D
[HD2 Windows Mobile 6.5 ROM Development] thechefcooks:
cmonex thanks for the info, i just had to try, have had luck in ye olde days with this approach. i was giving it just an attempt to do it in a different way as others do it nowadays. i find it interesting to see some parts of the file is crunched and other parts are plain code. guess i better leave it up to you and other skilled people.

all the best
[HD2 Windows Mobile 6.5 ROM Development] anja31:
Thank you cmonex,

now my dutch HD2 speaks german with me :)

Everything works perfect

regards

Anja31
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Hey you late night lover :)

Could you advise me to read a good book about ARM reverse engineering/coding ASM?
[HD2 Windows Mobile 6.5 ROM Development] kholk:
@cmonex

what are u using for disassembling the SPLs?

I can't find anything about wince bootloaders disassembly!
[HD2 Windows Mobile 6.5 ROM Development] Step2p:
I don't know if this is what you are looking for, but you can find the arm opcodes here.
[HD2 Windows Mobile 6.5 ROM Development] VirtR:
Is there a plan to make a USPL too?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
No.. I fear.. Just the syntax won't help :) I'm a newbie in such things.. Have to learn it from start. ^^
[HD2 Windows Mobile 6.5 ROM Development] Step2p:
Check your pm.. I have quoted some links with tutorials that you may find useful.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Thanks.. I will have a look at it :) In the meantime.. Can somebody tell me what has to go into the following dialogs in IDA?

Would like to have a first look at the code... Some kind of instant gratification. I like to work and learn practically ^^

And where do i have to press 'C' to start the analysis (and probably how to find out about it...)?
[HD2 Windows Mobile 6.5 ROM Development] DrBasem:
I figured out why i cannot understand what's going on here :)

it must be all in old (ancient) latin :D

Just wanted to admire the great effort that's going on here (or so it seems to me) :D:D:D

And, if anyone needs medical help I'll be in service :D
[HD2 Windows Mobile 6.5 ROM Development] stepw:
CPU is apparently generic ARM. You can use the offset you have dumped it from as RAM start, then load your dump at that offset. Don't bother to create ROM segment.

You would typically start anaylsis from... the beginning. Hit 'c' at RAM start offset to get going.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Ah.. Now i see. Very nice. Seems to be THE program for such things :)

Thank you for clarification.

Seems that there are still large areas (actually 99%) of just binary data (DCB instruction).. Is this normal? Do i have to identify code and payload data like strings and something myself?

Okay.. Just saw that there are short keys for converting actions.. Now another question.. Recognizing strings and pressing A is easy... But how do i differ data from code? :)
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Just did some work.. Analysed the whole SPL file in IDA following my intuition..

Maybe someone could comment on it - Pointing out some errors or something.. :)

Hope you can open it.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
hi, I was traveling for a full day then slept another day :) back now.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
No reason to excuse. Just came from a friend and going to sleep now after hours of german Autobahn :) *yawn* Good night.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
uhm, where should I start to explain this.. a lot of things to say :) do you have IRC? I'm on #xda-devs at irc.freenode.net
[HD2 Windows Mobile 6.5 ROM Development] kholk:
comin' to you on irc :D
[HD2 Windows Mobile 6.5 ROM Development] maati:
Any updates on the progress?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
kind of.. There was some "mysterious" guy in IRC today, who told us a hex address to patch.

But we can't test it yet.. I tried with JumpSPL. Loaded the patched file to 0x8FF00000, but the HD2 froze.. Seems like there is a kind of memory protection.

Does anybody know how to circumvent it?
[HD2 Windows Mobile 6.5 ROM Development] maati:
Have you tried pdocread/write from itsutils?

EDIT: Has anyone heard of Olipro lately?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
no.. They're writing/reading from flash i think.. We first need "SoftSPL".
[HD2 Windows Mobile 6.5 ROM Development] maati:
That's right... well, I've got no idea how to circumvent the memory protection. That would require more details. Maybe that "mysterious" guy from IRC can help?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Unfortunatly.. He's gone ^^. So we need an expert here... :)
[HD2 Windows Mobile 6.5 ROM Development] maati:
That sounds a bit discouraging. Even an expert will probably not be able to circumvent the protection without having a device himself.

What about cmonex and Olipro? Are they getting devices? Any other experts here?

I could possibly dump the SPL and create SoftSPL, but I can not explore/hack any memory protection, for that we need an expert with an HD2.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Just quoting from IRC:
[HD2 Windows Mobile 6.5 ROM Development] maati:
Mysterious..... but he seems to be able to flash ROMs, is he?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Exactly what i thought... And yes.. At least he pretends :)
[HD2 Windows Mobile 6.5 ROM Development] maati:
Well, maybe he did pdocwrite the SPL, but that's a bit dangerous...

I hope he comes back to give some more answers.
[HD2 Windows Mobile 6.5 ROM Development] Spike™:
so if he can, can't he/she supply us with the files we need?

or we send him/her the files needed?
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
pdocwrite is no good.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
dont fret - as we're already working on it.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
I know, and I will do it, honestly I dont know why so many worries in this thread.

[SIZE=+2]EDIT: maybe it helps if I give info on where we are :) HSPL itself is patched up obviously as it's the smaller task anyway. working on loading SSPL.[/SIZE]
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
perhaps he has the htc cert, but i highly doubt that. he does have some neat ROMs and code, but that doesnt mean anything;) and he cannot share them so dont nag him.

(I have a guess who he is, judging from his chat style:)
[HD2 Windows Mobile 6.5 ROM Development] maxtcee:
cmonex are you also working on the whitestone spl just curious
[HD2 Windows Mobile 6.5 ROM Development] lpsi2000:
I have a guess judging from her chat style:D
[HD2 Windows Mobile 6.5 ROM Development] kholk:
I realize why HTC protected those memory regions, but... well, most people are buyin' HTC because the Apple thingies are too protected. Like they're in jail.

If HTC enforces these protections there will be more fun for our hackers, but they'll lose money.

Anyway, working on SSPL...
[HD2 Windows Mobile 6.5 ROM Development] Bouloama:
cmonex and crew, take your time to work on a nice HardSPL for our beloved HD2's..

All the best.. just wait for a nice production of them.. which stands for great quality and its all trustworthy for now!
[HD2 Windows Mobile 6.5 ROM Development] maati:
Nice development... well, I'm only interested in HSPL... hope I can start cooking soon :)
[HD2 Windows Mobile 6.5 ROM Development] yosi199:
LOL this is like a movie. you guys chatting on irc and suddenly some mysterious someone logs in and give you what you been looking for... lol....
[HD2 Windows Mobile 6.5 ROM Development] digow:
Perhaps someone who is involved in developing htc roms and want to give the community hints so that individual roms can be cooked.

Or the developer isnt satisfied with the official rom and himself owns a hd2 but due to firm politics his ideas cant be implemented in the official rom.

I think its always better to have a customizable rom. And thats another reason to buy this phone.

Perhaps its an unofficial action by htc to get more unproffessional developers into programm stuff for the hd2 and future developments. The more people are involved the better the software gets.

I think there are some professional htc developers among us :D
[HD2 Windows Mobile 6.5 ROM Development] crazy cat:
With this words kholk finished up his work today. This nice news was postet in the IRC. Now cmonex and the other devs/hackers only need to make it noob-usable :D
[HD2 Windows Mobile 6.5 ROM Development] maati:
Nice!

So... let the cooking begin :D
[HD2 Windows Mobile 6.5 ROM Development] lucid:
believe me the Chefs have been cooking up many ROM's. The hard part begins now. The wait for loading the code into memory so everyone can flash ROM's.

For now, it seems that only highly skilled people can load a nonsigned ROM, but that is a giant step forward anyway. Hope Cmonex will find and crack the spell.

Don't know exactly what Kholk did, but I think he found the protection part in the bootloader which hadn't been found before.
[HD2 Windows Mobile 6.5 ROM Development] maati:
I've not started cooking yet. Doesn't make much sense if you don't know whether the ROMs will boot up on the HD2 at all. I'm waiting for HSPL until I start cooking, so that I don't waste my time on cooking something that won't boot up anyways.
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Hold on guys.. There's nothing ready for use yet and we don't even know, if it will work like it's supposed to work.. This is just theory.. And we are guessing.

But that unprotection code looks promising..
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
yeah. no worries there :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
I always thought XXXXXX was a he, but I may be wrong - we discussed this on IRC now anyway :)

EDIT: not sure why maati said not to mention his name...okay though, I removed it.
[HD2 Windows Mobile 6.5 ROM Development] maati:
Well, maybe you shouldn't mention him here?
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
AFAIK qualcomm doesnt use that approach for protecting the memory but I'm curious and will look.

nonetheless, if it doesnt work, my approach I did for other SSPLs recently, probably will. so no worrying either way, people, please :)
[HD2 Windows Mobile 6.5 ROM Development] maati:
Haha :D

Actually I don't know if he wants to be mentioned. I was just asking, cause maybe he doesn't want it. I don't know.

What about HSPL? Is it "flashable" yet or is there still things to hack?
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
sorry to disappoint, he didnt give any info new to me

PS: I do not want to sound conceited or anything. just wanted to correct some things here :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
I checked out kholk's code, even tried running it (apparently he did not have time trying it out), but as expected, this was irrelevant in terms of snapdragon's mem protection
[HD2 Windows Mobile 6.5 ROM Development] maati:
That's unfortunate... well, good luck then with your next attempt ;)
[HD2 Windows Mobile 6.5 ROM Development] DaveShaw:
Making Hard SPL's is easy enough, trust me, I have made one ;).

SSPL are a different game alltogether, even before the memory protection stuff (IMHO).

Dave
[HD2 Windows Mobile 6.5 ROM Development] maati:
Then why not make just HardSPL for now, and then work on SSPL and release it later?
[HD2 Windows Mobile 6.5 ROM Development] Step2p:
If I understand correctly how it works, this would not be possible.

How are you going to debug if there is no SSPL? Once you flash you are done. This is HSPL, you can not replace it otherwise.

You may need some dozens of devices in order to complete debugging.
[HD2 Windows Mobile 6.5 ROM Development] maati:
Yeah, you're right. D'oh.

Thanks :D
[HD2 Windows Mobile 6.5 ROM Development] stepw:
There's little new in SPL patching, HTC has been using the same codebase for SPL for a while. cmonex et al. can probably patch SPL with eyes closed and hands tied and it will be a 100% working HSPL once it's flashed.

The challenge is to actually flash it, since stock SPL won't accept any .nbh that wasn't signed with HTC's certificate. That's where you need SoftSPL as it tends to be easier to circumvent RAM protection than it is to circumvent SPL signature verification. Ultimately if one can run unsigned code on a device, it should be possible to defeat most vendor integrity protection strategies. Windows Mobile allows for that and that's the vulnerability SSPL exploits.

HTC R&D engineers may realize one day that it would be more secure to put software upgrade code to radio bootloader. It's not as easy to execute unsigned code on the radio core that your OS doesn't have direct access to. With single core architectures becoming a thing of the past, this is likely to become fairly common security measure.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
LOL @ eyes closed&hands tied ;)

ehh, don't give ideas to HTC please... looks like TG01 already does that :P
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
SSPL is not for debugging, SSPL is to actually put the HSPL on the device
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
noo, the point is not debugging, SSPL is used to put HSPL on the device in the first place.

EDIT: duh, I managed to post this twice.. :)
[HD2 Windows Mobile 6.5 ROM Development] Step2p:
Thank you for clearing this out.
[HD2 Windows Mobile 6.5 ROM Development] yosi199:
Let me get this right... you guys have the HSPL but it's useless without the SSPL to mount it on the device?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Yes.. You always need to have a way to access certain memregions first. Then you can use the SPL you loaded into memory to flash a patched SPL, the HSPL.
[HD2 Windows Mobile 6.5 ROM Development] yosi199:
this is really interesting me, are you guys professional dev or is it just a hobbie? I know a litte C but could dream getting to this level...
[HD2 Windows Mobile 6.5 ROM Development] maxtcee:
thank you was debating on returning it but now maybe ill wait it out
[HD2 Windows Mobile 6.5 ROM Development] stepw:
LOL

Some things are obvious and don't get any more obvious if I talk about them :)

They didn't even bother to set up a security password in TG01's FSBL, so having image upgrade code in AMSS doesn't add a lot of security there. HTC would typically be smarter than that though...
[HD2 Windows Mobile 6.5 ROM Development] elyl:
To be honest, I think HTC know they've not got a lot to gain and an awful lot to lose by taking serious measures to prevent HSPL.
[HD2 Windows Mobile 6.5 ROM Development] Olipro:
yup.

hey guys, I have a stylus!!!!!!!1!11one1!!

...but no PDA.
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
mmm....some small baby steps (nonetheless very important ones) taken. =) I think by tomorrow we may have more results :D
[HD2 Windows Mobile 6.5 ROM Development] kwbr:
Sorry Oli???

That is great news cmonex!
[HD2 Windows Mobile 6.5 ROM Development] eskasi:
Awesome guys! Any step forward is awesome news!
[HD2 Windows Mobile 6.5 ROM Development] dragon_soft:
any update?
[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Not today.. cmonex went for dinner and never came back.....................................................

.............

*creeeeepy muuuuusic* :)
[HD2 Windows Mobile 6.5 ROM Development] cmonex:
eheh, I just crashed into bed when I got back @ 23:45, sorry... :P