[HD2 Windows Mobile 6.5 ROM Development] gauner1986:
Well this is just my second HTC device.. But has anybody ever wondered why information on creating HardSPL and stuff is seeded sparely? We're just waiting until olipro, cmonex (bless their work!!! :) ) or some other mod finishes the Hard-SPL.

If this is an illegal talk or something then just delete my thread..

I find this is an interesting topic.. So why not colaborate with each other and report status on this, so that we eventually could hack something together..? At least for the sake of interest.. I ever liked hacking embedded devices, but my knowledge in these things is not so good. Would like to dig more into this and solve this kind of mystery :)

I have found interesting bits of information at the following places:

http://wiki.xda-developers.com/index.php?pagename=Wizard_ROM_Layout

http://xdaforums.com/showthread.php?t=334667

http://www.xs4all.nl/~itsme/projects/xda/tools.html

http://wiki.xda-developers.com/index.php?pagename=SPL%20Questions%3F

http://xdaforums.com/showthread.php?t=501871

The first step seems to be extracting the stock SPL.. I read something about pmemmap, a tool to show the memory map of the phone and pmemdump, a tool to dump memory areas of the phone to disk.

This rises the question of how to find out the address, where the SPL lies in our LEOs and then how to dump it?

If there are any constructive comments on this, everybody is invited to add his thoughts here, or point out the right way :)

Update:

SPL seems to be dumped, credits go to cmonex. - Now it's time to investigate further steps. :) Currently looking into it.

Okay.. You can read the SPL from your LEOs with the following command:

pmemdump 0x8ff00000 0x80000 dump.bin

But i have attached it here for your convenience. :)

Update 2:

For all those people that are curious about the technical background behind SPL hacking i am giving an update of my research now (of course cmonex will finish that work, and she will do it good, but as you probably know, i want to get into that kind of stuff):

I managed to get an MFG SPL (the SPL that isn't shipped with stock ROMs and that is used by HTC to debug) now. This type of SPL is needed to do any further steps regarding flashing Hard-SPL.

This may not be complete or even correct, so if you have any information to add, please share it with us.

As far as i understood the rough procedure now would be to relocate the SPL and its .data section in RAM (that means all the data referenced by code) to a new address. This is needed because the address where the SPL and its data section lie now is protected by the MPU (Memory Protection Unit?), which is set up by the radio bootloader, which is running on another CPU (the ARM9). Every write there will lead to nowhere and as our SPL would execute, it would crash, because of missing data. This is why we need to relocate our SPL to a new address by changing all the hard coded references to data (such as strings etc.) in code.

I need someone to comment on the process of changing all the hard coded addresses to another one. I don't know how to do it yet.

If this is done and all code runs well (there could be further glitches, such as the NAND write/read issue - please comment on that) we would use JumpSPL to load our SPL in RAM into an unused address and execute it. This would give us all the tools needed for flashing HSPL.

I have attached a copy of the MFG SPL i obtained (if this is against any rules, please remove it) together with an analysis in IDA32, which i just made (for the lazy ones).

It would be nice, if we could get some further info here.

Btw.: I found this funky stuff on the PSAS forum. It is a tool that actually simulates an ARM processor and let's you step through the instructions. Really nice, if you want to understand what's going on.

If you want to flash another language ROM to your HTC device you can go here. Please don't use this thread for such requests. Let's keep it about SPL talking. Thanks :)