Paul's guide to... backing up, rebuilding and restoring your SPV M700 ROM

[Guest Paul (MVP)]

[teaser]Welcome to our Tuesday Daily feature, 'Paul's Guide'.

It's fair to say that talk of ROM flashing, cooking (editing) and the like has always been something of a taboo subject. Of course, it is given a bad rap by leaked ROMs posted online and suchlike, which although great as an end user, has a habit of upsetting manufacturers, operators etc.

The truth is, a bit of playing with ROMs can really enhance your device without doing anything illegal, and there are some very talented people producing tools (primarily over at XDA-Developers) to help you accomplish what you want to achieve.

My primary device at the moment is a SPV M700, and i've noticed in the forums a lot of people have been asking whether there is a backup of the shipping ROM for them to keep just incase things don't work out. There isn't, so in this article i'm going to show you how to back up your ROM, and bundle it into a RUU for flashing back onto your device, should you need to.

I'm also going to show you how you can rebuild the shipping ROM, to give you more free memory!

With the default ROM, post hard reset, the available storage memory in the settings applet shows the following...

51.50 MB

and post rebuild...

54.72 MB

...as you can see, around 3.2 MB is liberated by the process. It really is something for nothing!

So let's get started... and kudos to the developers of all these tools. I have included them in this article for ease of use, but also linked to the original sources. Instructions are after the jump for portal page readers.

P

Coming next time: How to remove the bits you don't want from your ROM and preload things you do![/teaser]

Backing up, rebuilding and restoring your SPV M700 ROM

Reflashing your ROM is dangerous, and you could brick your device if it goes wrong. Only proceed if you are confident with what you are doing - we take no responsibility should anything go wrong!

Follow the steps below to backup, rebuild and reflash your ROM. Your device will need to be application unlocked prior to following these steps!

Step 1: Install Hard-SPL bootloader

Consider Hard-SPL an insurance policy. If all else fails, HardSPL will allow you to flash a working ROM onto your device.

Tool required: HardSPL - download link - original source

- Download file.

- Extract to a temporary directory.

- Flash using ROMUpdateUtility.exe

Step 2: Dump the OS partition of your device ROM

Tools required: itsutils - download link - original source

The next step is to get the OS area of the ROM from your device in it's raw format.

- Create a new directory (our 'working directory'), e.g. C:\ROM.

- Open a command prompt in the your working directory.

- Extract the itsutils download to your working directory.

- Type 'pdocread -l' at the command prompt. This will produce output similar to below, these are the addresses of the ROM sections. If this fails, ensure your device is application unlocked and that HKLM\Security\Policies\Policies\1001 has a value of 1, NOT 2.

114.88M (0x72e0000) FLASHDR

|		   3.12M (0x31fc00) Part00

|		   2.88M (0x2e0000) Part01

|		  50.13M (0x3220000) Part02

|		  58.75M (0x3ac0000) Part03

 10.00M (0xa00000) EXT_FLA

|		  10.00M (0xa00000) PART00[/code]

- We want to read Part02 on FLASHDR, so type  'pdocread -w -d FLASHDR -p Part02 0 0x3220000 Part02.raw' at the command prompt.. Now wait while a raw dump of the OS area of the ROM is created on your PC! It will take a while and not look like it's doing anything, but if you browse your working directory in Windows Explorer, you'll see a Part02.raw file growing in size :rolleyes: You should double check your values from the pdocread -l output, and adjust accordingly!

[i][b]

Step 3: Extract the RAW (IMGFS) file to a dump directory


[/b][/i][i]Tools required: ImgfsTools2rc2b - download link - original source[/i][i][b]

[/b][/i]

- Extract the ImgfsTools2rc2b download to your working directory.

- Now we have the IMGFS file, we're going to extract everything from it, ready for an optimised rebuild by the excellent ImgfsTools2.

- Type 'imgfstodump part02.raw' at the command prompt.

[i]

[b]Step 4: Build a new IMGFS file from the dump directory


[/b][/i]- We've finished the extraction now, and we're ready to start putting everything back together.

- Type 'imgfsfromdump part02.raw imgfs.new.bin' at the command prompt.

- When you look at the 2 .bin files in the working directory, you should notice the new one is smaller. Strange eh? They have the same contents!

[i][b]

Step 5: Download and split a donor NB file


[/b][/i][i]Tools required: A valid HTC Trinity RUU - download link

Tools required: WinRAR - download link

Tools required: NBHextract - download link - original source


[/i]- After installing WinRAR, copy the downloaded HTC Trinity RUU to your working directory.

- Right click the .ZIP file and select 'Extract Here'.

- Right click the produced .EXE file, and select 'Extract Here'.    

- Extract the NBHextract download to your working directory. 

- Type 'nbhextract ruu_signed.nbh' at the command prompt to convert the NBH to it's component parts.

- Type 'nbsplit -hermes 06_os.nb' at the command prompt to split the OS NB file.

- Type 'ren 06_os.nb.payload 06_os.nb.old.payload' at the command prompt to make way for our new NB payload.

[i][b]

Step 6: Convert the new IMGFS file to a new NB payload file


[/b][/i]- Type 'imgfstonb imgfs.new.bin 06_os.nb.old.payload 06_os.nb.payload'. This copies all data except the IMGFS partition from  to , then adds the IMGFS partition from .[b]

[/b][i][b]

Step 7: Merge the new NB payload into a new NB file


[/b][/i]- Type 'nbmerge -hermes 06_os.nb' to create our new NB file.[b]

[/b][i][b]

Step 8: Convert the new NB file to a NBH file


[/b]Tool download required: Custom RUU Updater - download link - original source


[/i]- Create a new directory inside your working directory called 'flash'. Extract the Custom RUU updater to it.

- In the flash directory, you'll see a 'Workshop' subdirectory. Run ROMbaker.exe from in there.

- Click the 'Browse' button next to the 'OS' box, and browse to your working directory. Select the 06_OS.nb file. DO NOT SELECT ANY OTHER NB FILES.

- Click Generate NBH, enter the filename log.txt, and click 'Save'.

- In your working directory, you should now see a 'ruu_signed.nbh' file. Move this to your 'flash' directory.

[i][b]

Step 9: Flash the new NBH file[/b]

[/i]

- We're ready to go!

- Run 'ROMUpdateUtility.exe', follow the prompts (you may also have to confirm a prompt on the device itself), and enjoy your new ROM build! :P Keep a copy of this 'Flash' directory, and you always have an Orange OS ROM to go back to at a later date should you start cooking your own custom ROMs!

[Guest The Doctor]

Very nice guide Paul :rolleyes:

Especially useful if you need to flash back your original ROM for warranty reasons :P

Phil

[Guest James]

That's a very useful guide!

This will cut down the searching through 100's of pages over at XDA-Developers for any person wanting to get into playing with ROM's :rolleyes:

:P

[Guest MECX]

:rolleyes: :P :D :D Brillant, thanks for this Paul

[Guest The Doctor]

A similar process will also work on the Hermes, below is a slightly tweaked method for the hermes :rolleyes:

[EDIT: I've moved it HERE to avoid clutter of this thread :P]

Many thanks to Paul for the original method :D

Phil

Edited May 22, 2007 by The Doctor

[Guest Bongmaster]

sweet :rolleyes: any chance it working on my Monet?. having a backup would be usefull while i am hunting for a way to rid the device of any virgin content :P

[Guest The Doctor]

sweet :rolleyes: any chance it working on my Monet?. having a backup would be usefull while i am hunting for a way to rid the device of any virgin content :P

You will be able to dump your ROM, however you wont be reflash it as there currently isnt a way to flash unsigned code to the Monet via the bootloader

Phil

[Guest OzzMosiz]

was gonna try this but can't download "Tools required: A valid HTC Trinity RUU - download link"

anyone got a copy?

[Guest OzzMosiz]

Ok, got all the software, when running RomUpdateUtility, it wants to downgrade my ROM version - is this normal?

Sorry I am a newbie on this :rolleyes:

[Guest The Doctor]

Ok, got all the software, when running RomUpdateUtility, it wants to downgrade my ROM version - is this normal?

Sorry I am a newbie on this :P

As in the ROM version is lower on theupdate, than on the device?

If it is, don't worry about it, you will still have the same ROM version after flashing the ROM you just made :rolleyes:

Phil

[Guest Paul (MVP)]

Yeah, it calls it 'rombaker' version or something IIRC?

P

[Guest OzzMosiz]

Yeah, it calls it 'rombaker' version or something IIRC?

P

Verify that you want to update the ROM version:

From:

Image Version: 1.23.61.5

To:

Image Version: 1.20

[Guest The Doctor]

Verify that you want to update the ROM version:

From:

Image Version: 1.23.61.5

To:

Image Version: 1.20

The image version number doesn't really matter. It's fine to flash away :)

Phil

[Guest streefkerka]

Paul,

I am in a bit of a pickle. I have a Orange SPV M700 which I flashed with the following ROM - RUU_Trinity_DOPODASIA_WWE_1.23.707.6_6275_1.35.00.11_108_Ship.exe

This ROM has virtually rendered my phone useless as I can no longer register on the UK Ornage mbile phone network?

I notice from this blog that you are fairly experienced in this area?

Do you by any chance have a Orange SPV M700 ROM that I could flash my phone with to get it back to factory standard?

I look forward to your reply :-)

[Guest Paul (MVP)]

Sounds like you might have broken the radio stack or something. Have you tried reflashing that same ROM?

The M700 ROM was never made available as a RUU IIRC...

P

[Guest WinDoze9t8]

would a similar method using imgfstools, and a key "-nosplit work on elf? as I trying to get mine working again after a failed ROM update (error 720)

I have a RAW image of an elf - thanks to LSVW - Just thought I'd research and try different methods to make it work before I call Orange and say it stopped working (forgetting to mention i broke it, by playing.

Luckily I still have my m700 which I have managed to Flashes ROMs to successfully

[Guest rowbot]

Hi, I get the attached error (ERROR[294] : INVALID VENDOR ID trying a WM6 Rom

(RUU_Trinity_DOPODASIA_WWE_3.00.707.18_6275_1.46.30.11_108_Ship.exe)

Any ideas?

[Guest Paul (MVP)]

That's completely irrelevant to this topic, but flash HardSPL and I think that will solve it.

P

[Guest Skid82]

Hi Paul,

I came from the Dev's to your wonderfull guide because I want to backup my MDA Touch alis HTC Elf/Touch.

I change the FLASHDR to TrueFFS an the dumping was good.

So, till step 6 went all ok and without failures.

Then I type "C:\dump>imgfstonb imgfs.new.bin 05_os.nb.old.payload 05_os.nb.payload" in the command line und hit enter. 05_.... because the Elf has only 5 parts in the RUU_Signed.nbh.

This is the ROM:RUU_Elf_DOPODASIA_WWE_1.11.707.1B_4.1.13.42_02.93.90_Ship

But when I execute I get following error:

ImgfsToNb 2.0 RC 2

MSFLSH50 header not found. Exiting.

I can't get to the next step to merge the nbh-File.

What is the Error, or better what went wrong?

Thanks for your help

Greetings

Denis

[Guest zfs]

Hi,

I have tried on a spv m700: "pdocread -w -d FLASHDR -p Part02 0 0x3220000 Part02.raw"

But I got the following error :

CopyTFFSToFile(0x0, 0x3220000, Part02.raw)

ERROR: ITReadDisk : read 00000000 bytes - The storage control block address is invalid.

The error was displayed near the end of the copy process.(size is similar with the one displayed by pdocread -l)

[Guest balu06]

Hi

have a Problem to save my ROM.

Please help me.

Error:

after imgfstodump part02.raw > Cannot map file part02.raw

Greetings

Balu

[Guest linxbox]

My SPV M700 has developed a fault with the GPS :wub:

The trouble is, I've flashed the ROM to WM6 and therefore need to flash it back again before returning it. Stupidly I didn't backup the ROM beforehand and so am now a little scuppered ;)

Can anyone help me by providing an image of their original Orange WM5 ROM or something very similar to it?

Thanks

[Guest Reddall]

Hi and thanks for the ROM backup Procedure! I followed it to the letter (I think) and I have one observation and one question.

1. Obs - when I split the file the bit was named '06_Uknown.nb' rather than '06_os.nb' so I went ahead and substituted 'unknown' wherever it said 'os'. Should thisi be OK?

2. Question - after I merged it all back I re-flashed the SPV M700 and it looks much the same as before BUT I after some thought I wondered why it hadn't adopted the splash screens from the donor ROM since as far as I could (mis)understand we only changed the OS part of the donor ROM? Am I right or completely misunderstanding what I am doing here. For this dumped ROM to be just like the original Orange ROM shouldn't I be building in all the other bits from the original to overwrite the donor??

[Guest eaglesteve]

Hi, all of you who have gone through step 2 should be able to answer my question.

I try to follow the procedure to backup my WM6 ROM on my Athena/Dopod U1000.

In step two, my value for Part02 is 0xZZZZZZ.  At command prompt, when I typed in pdcread -w -d FLASHDR -p Part02 0 0xZZZZZZ, I got the following error message:

ERROR: ITTFFSGetInfo = the device is not ready for use.

WARNING: using default 512 bytes for sectorisize

Hexdump TFFSToStdot (0x0, 0xZZZZZZ)

ERROR: ITReadDisk: outbug==NULL

- The device is not ready for use.

My question is why am I getting this message.  

If I put the device into bootloader mode before executing the above command, then I don' t get the above message, but nothing seesm to be happening.  When I look into the ROM directory with file explorer, I don't find any Part02.raw there.

What am I doing wrong?

Edited November 4, 2007 by eaglesteve

[Guest Paul (MVP)]

Er, 0xZZZZZZ is not a valid value!

P