28 replies to this topic

[PaulOBrien]

[teaser]Welcome to our Tuesday Daily feature, 'Paul's Guide'.

It's fair to say that talk of ROM flashing, cooking (editing) and the like has always been something of a taboo subject. Of course, it is given a bad rap by leaked ROMs posted online and suchlike, which although great as an end user, has a habit of upsetting manufacturers, operators etc.

The truth is, a bit of playing with ROMs can really enhance your device without doing anything illegal, and there are some very talented people producing tools (primarily over at XDA-Developers) to help you accomplish what you want to achieve.

My primary device at the moment is a SPV M700, and i've noticed in the forums a lot of people have been asking whether there is a backup of the shipping ROM for them to keep just incase things don't work out. There isn't, so in this article i'm going to show you how to back up your ROM, and bundle it into a RUU for flashing back onto your device, should you need to.

I'm also going to show you how you can rebuild the shipping ROM, to give you more free memory!

With the default ROM, post hard reset, the available storage memory in the settings applet shows the following...

51.50 MB

and post rebuild...

54.72 MB

...as you can see, around 3.2 MB is liberated by the process. It really is something for nothing!

So let's get started... and kudos to the developers of all these tools. I have included them in this article for ease of use, but also linked to the original sources. Instructions are after the jump for portal page readers.

P

Coming next time: How to remove the bits you don't want from your ROM and preload things you do![/teaser]

Backing up, rebuilding and restoring your SPV M700 ROM

Reflashing your ROM is dangerous, and you could brick your device if it goes wrong. Only proceed if you are confident with what you are doing - we take no responsibility should anything go wrong!

Follow the steps below to backup, rebuild and reflash your ROM. Your device will need to be application unlocked prior to following these steps!

Step 1: Install Hard-SPL bootloader

Consider Hard-SPL an insurance policy. If all else fails, HardSPL will allow you to flash a working ROM onto your device.

Tool required: HardSPL - download link - original source

- Download file.
- Extract to a temporary directory.
- Flash using ROMUpdateUtility.exe

Step 2: Dump the OS partition of your device ROM

Tools required: itsutils - download link - original source

The next step is to get the OS area of the ROM from your device in it's raw format.

- Create a new directory (our 'working directory'), e.g. C:\ROM.
- Open a command prompt in the your working directory.
- Extract the itsutils download to your working directory.
- Type 'pdocread -l' at the command prompt. This will produce output similar to below, these are the addresses of the ROM sections. If this fails, ensure your device is application unlocked and that HKLM\Security\Policies\Policies\1001 has a value of 1, NOT 2.

114.88M (0x72e0000) FLASHDR
|		   3.12M (0x31fc00) Part00
|		   2.88M (0x2e0000) Part01
|		  50.13M (0x3220000) Part02
|		  58.75M (0x3ac0000) Part03
 10.00M (0xa00000) EXT_FLA
|		  10.00M (0xa00000) PART00

- We want to read Part02 on FLASHDR, so type  'pdocread -w -d FLASHDR -p Part02 0 0x3220000 Part02.raw' at the command prompt.. Now wait while a raw dump of the OS area of the ROM is created on your PC! It will take a while and not look like it's doing anything, but if you browse your working directory in Windows Explorer, you'll see a Part02.raw file growing in size You should double check your values from the pdocread -l output, and adjust accordingly!

Step 3: Extract the RAW (IMGFS) file to a dump directory

Tools required: ImgfsTools2rc2b - download link - original source

- Extract the ImgfsTools2rc2b download to your working directory.
- Now we have the IMGFS file, we're going to extract everything from it, ready for an optimised rebuild by the excellent ImgfsTools2.
- Type 'imgfstodump part02.raw' at the command prompt.

Step 4: Build a new IMGFS file from the dump directory

- We've finished the extraction now, and we're ready to start putting everything back together.
- Type 'imgfsfromdump part02.raw imgfs.new.bin' at the command prompt.
- When you look at the 2 .bin files in the working directory, you should notice the new one is smaller. Strange eh? They have the same contents!

Step 5: Download and split a donor NB file

Tools required: A valid HTC Trinity RUU - download link
Tools required: WinRAR - download link
Tools required: NBHextract - download link - original source

- After installing WinRAR, copy the downloaded HTC Trinity RUU to your working directory.
- Right click the .ZIP file and select 'Extract Here'.
- Right click the produced .EXE file, and select 'Extract Here'.    
- Extract the NBHextract download to your working directory.
- Type 'nbhextract ruu_signed.nbh' at the command prompt to convert the NBH to it's component parts.
- Type 'nbsplit -hermes 06_os.nb' at the command prompt to split the OS NB file.
- Type 'ren 06_os.nb.payload 06_os.nb.old.payload' at the command prompt to make way for our new NB payload.

Step 6: Convert the new IMGFS file to a new NB payload file

- Type 'imgfstonb imgfs.new.bin 06_os.nb.old.payload 06_os.nb.payload'. This copies all data except the IMGFS partition from to , then adds the IMGFS partition from .

Step 7: Merge the new NB payload into a new NB file

- Type 'nbmerge -hermes 06_os.nb' to create our new NB file.

Step 8: Convert the new NB file to a NBH file

Tool download required: Custom RUU Updater - download link - original source

- Create a new directory inside your working directory called 'flash'. Extract the Custom RUU updater to it.
- In the flash directory, you'll see a 'Workshop' subdirectory. Run ROMbaker.exe from in there.
- Click the 'Browse' button next to the 'OS' box, and browse to your working directory. Select the 06_OS.nb file. DO NOT SELECT ANY OTHER NB FILES.
- Click Generate NBH, enter the filename log.txt, and click 'Save'.
- In your working directory, you should now see a 'ruu_signed.nbh' file. Move this to your 'flash' directory.

Step 9: Flash the new NBH file

- We're ready to go!
- Run 'ROMUpdateUtility.exe', follow the prompts (you may also have to confirm a prompt on the device itself), and enjoy your new ROM build! Keep a copy of this 'Flash' directory, and you always have an Orange OS ROM to go back to at a later date should you start cooking your own custom ROMs!

[The Doctor]

Very nice guide Paul

Especially useful if you need to flash back your original ROM for warranty reasons

Phil

[James]

That's a very useful guide!

This will cut down the searching through 100's of pages over at XDA-Developers for any person wanting to get into playing with ROM's

[MECX]

        Brillant, thanks for this Paul

[The Doctor]

A similar process will also work on the Hermes, below is a slightly tweaked method for the hermes

[EDIT: I've moved it HERE to avoid clutter of this thread ]

Many thanks to Paul for the original method

Phil

Edited by The Doctor, 22 May 2007 - 10:22 PM.

[Bongmaster]

sweet any chance it working on my Monet?. having a backup would be usefull while i am hunting for a way to rid the device of any virgin content

[The Doctor]

Bongmaster, on May 29 2007, 14:25, said:

sweet any chance it working on my Monet?. having a backup would be usefull while i am hunting for a way to rid the device of any virgin content

You will be able to dump your ROM, however you wont be reflash it as there currently isnt a way to flash unsigned code to the Monet via the bootloader

Phil

[OzzMosiz]

was gonna try this but can't download "Tools required: A valid HTC Trinity RUU - download link"
anyone got a copy?

[OzzMosiz]

Ok, got all the software, when running RomUpdateUtility, it wants to downgrade my ROM version - is this normal?
Sorry I am a newbie on this

[The Doctor]

OzzMosiz, on Jun 21 2007, 10:07, said:

Ok, got all the software, when running RomUpdateUtility, it wants to downgrade my ROM version - is this normal?
Sorry I am a newbie on this

As in the ROM version is lower on theupdate, than on the device?

If it is, don't worry about it, you will still have the same ROM version after flashing the ROM you just made

Phil

[PaulOBrien]

Yeah, it calls it 'rombaker' version or something IIRC?

P

[OzzMosiz]

Paul (MVP), on Jun 22 2007, 11:44, said:

Yeah, it calls it 'rombaker' version or something IIRC?

P

Verify that you want to update the ROM version:
    From:    
        Image Version: 1.23.61.5


    To:
        Image Version: 1.20

[The Doctor]

OzzMosiz, on Jun 22 2007, 11:55, said:

Verify that you want to update the ROM version:
    From:    
        Image Version: 1.23.61.5
    To:
        Image Version: 1.20

The image version number doesn't really matter. It's fine to flash away

Phil

[streefkerka]

Paul,

I am in a bit of a pickle.  I have a Orange SPV M700 which I flashed with the following ROM - RUU_Trinity_DOPODASIA_WWE_1.23.707.6_6275_1.35.00.11_108_Ship.exe

This ROM has virtually rendered my phone useless as I can no longer register on the UK Ornage mbile phone network?

I notice from this blog that you are fairly experienced in this area?

Do you by any chance have a Orange SPV M700 ROM that I could flash my phone with to get it back to factory standard?

I look forward to your reply :-)

[PaulOBrien]

Sounds like you might have broken the radio stack or something. Have you tried reflashing that same ROM?

The M700 ROM was never made available as a RUU IIRC...

P

[WinDoze9t8]

would a similar method using imgfstools, and a key "-nosplit work on elf? as I trying to get mine working again after a failed ROM update (error 720)

I have a RAW image of an elf - thanks to LSVW - Just thought I'd research and try different methods to make it work before I call Orange and say it stopped working (forgetting to mention i broke it, by playing.



Luckily I still have my m700 which I have managed to Flashes ROMs to successfully

[rowbot]

Hi, I get the attached error (ERROR[294] : INVALID VENDOR ID trying a WM6 Rom

(RUU_Trinity_DOPODASIA_WWE_3.00.707.18_6275_1.46.30.11_108_Ship.exe)

Any ideas?

Attached Files

•  vendor_id.jpg   43.09K   154 downloads

[PaulOBrien]

That's completely irrelevant to this topic, but flash HardSPL and I think that will solve it.

P

[Skid82]

Hi Paul,

I came from the Dev's to your wonderfull guide because I want to backup my MDA Touch alis HTC Elf/Touch.

I change the FLASHDR to TrueFFS an the dumping was good.

So, till step 6 went all ok and without failures.
Then I type "C:\dump>imgfstonb imgfs.new.bin 05_os.nb.old.payload 05_os.nb.payload" in the command line und hit enter. 05_.... because the Elf has only 5 parts in the RUU_Signed.nbh.
This is the ROM:RUU_Elf_DOPODASIA_WWE_1.11.707.1B_4.1.13.42_02.93.90_Ship

But when I execute I get following error:

Quote

ImgfsToNb 2.0 RC 2
MSFLSH50 header not found. Exiting.

I can't get to the next step to merge the nbh-File.

What is the Error, or better what went wrong?

Thanks for your help
Greetings
Denis

[zfs]

Hi,
I have tried on a spv m700: "pdocread -w -d FLASHDR -p Part02 0 0x3220000 Part02.raw"
But I got the following error :
CopyTFFSToFile(0x0, 0x3220000, Part02.raw)
ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid.

The error was displayed near the end of the copy process.(size is similar with the one displayed by pdocread -l)