Paul's guide to... changing the HTC Touch / T-Mobile Wing PagePool size

[Guest Paul (MVP)]

[teaser]Welcome to another edition of 'Paul's Guide to...' :P

Today's guide is aimed at owners of the HTC Touch and the T-Mobile Wing, as they are 2 devices that seem to have particular problems with device memory, but the same techniques can probably be applied to other devices (untested by myself).

HTC Touch and T-Mobile Wing owners will know that these two devices suffer somewhat from low memory problems. Users need to be careful with what they have running at any one time, particularly if launching memory hungry applications such as the Camera.

Deep in the depths of the operating system of your device, there is something called the 'PagePool'. Without going into too much detail (and as I understand it!), the PagePool is a special area of memory reserved for loading apps into from ROM. This PagePool is a lot faster than ROM, so when things are executed from this 'cache' instead, the performance of a device will be quicker. On the flipside, if you have a 8MB pagepool (HTC Touch) and you're using, say, 4MB of the pagepool, then 4MB of space is wasted that could be program memory. Similarly if you have a 12MB pagepool (!) (T-Mobile Wing) in this instance you would we wasting 8MB of space!

The key is striking the balance...

On both my Touch and my Wing, i've been experimenting with the PagePool, and have personally settled on 4MB. I've tried 2MB (bad), 4MB, 6MB and 8MB, and I think I can happily use 4MB without noticing a performance decrease. I'm tempted to try 6MB out for a bit longer, particularly on the Wing (which has a generally better state of affairs than the Touch it seems), but this guide will let you choose your own.

Sadly, these PagePool settings are in an area that cannot be easily changed, hence this is a ROM guide.[/teaser]

Firstly, a disclaimer.

This guide involves downloading, editing and flashing of your device ROM.

This is dangerous, very dangerous. In a worst case scenario using these techniques, your device will become unusable, with a corrupted 'OS area'. While your bootloader will (should) still be accessible, your device will be a paperweight until such time as a RUU (Rom Update Utility) becomes available for your device with the shipping ROM. We won't be able to help you, and your operator / manufacturers won't either. It's quite possible your warranty will be invalidated by editing your ROM.

If you follow this guide, you take full responsibility for what could happen. I have of course successfully been through this guide myself, but be aware that I TAKE NO RESPONSIBILITY SHOULD SOMETHING GO WRONG.

You've read the disclaimer and you want to have a play, now what do you need to do? Here's the guide... enjoy :rolleyes:

Step 1: Install the permissions CAB to your device

In order to be able to do the read / write operations on your ROM, the security on your device needs to be set up in a certain way. Download this CAB file, and run it on your device.

ITSUTILS_Preperation.CAB

Step 2: Create a directory and download itsutils

Now we need to create a working directory. I suggest creating a directory called 'pagepool' on your desktop. When you've done this, download this ZIP file, and extract it to the new directory.

http://nah6.com/~itsme/itsutilsbin-20070323.zip (Kudos to Willem Jan Hengeveld (aka itsme) for this excellent toolkit!)

Step 3: Extract the ROM from your device

We're now going to extract the ROM from your device. This is a completely safe operation, so don't panic yet :D Take the following steps...

- Ensure device is connected to PC and Activesync'd / WMDC'd

- Open a command prompt at your new directory

- Type 'pdocread -l' (minus the quotes of course)

You will then be presented with something that looks like this:

 70.95M (0x46f2000) TrueFFS

	   |		   3.06M (0x30fc00) Part00

	   |		   3.06M (0x310000) Part01

	   |		  64.82M (0x40d2000) Part02[/code]

We want to read the Part02 area (the bottom line above), so...


- Type 'pdocread 0 0x40d2000 Part02.dump' substituting 0x40d2000 with the appropriate value from your 'pdocread -l' output


You will see something like 'CopyTFFSToFile(0x0, 0x40d2000, Part02.dump)' appear, and after a wait of a few minutes (it is dumping a lot of data!), you'll be returned to the command prompt. During the operation you can open Windows Explorer to your working directory and see the file growing.


[b][i]Step 4: Use a hex editor to modify the pagepool size[/i][/b]


To edit your Part02.dump ROM image, you'll need to use a Hex Editor. The instructions below assume use of the excellent, free HxD application.


After installing and launching HxD, do the following...


- Open your new 'Part02.dump' file

- Click 'Search'

- Enter 'NKKD8'

- Press F3 to find the second instance

- Click 'Search' again

- Change 'Data Type' to 'Hex Values'

- Enter 'FF FF FF FF FF FF FF FF 9B 4F FF FF 64 B0 00 00' and hit search


You will then be presented with the search results as shown below.




After 8 more values, you'll see your pagepool setting. In the screenshot aobve, it is set to '00 00 40 00', which means 4MB. The possible values are as follows:


4MB = 00 00 40 00

6MB = 00 00 60 00

8MB = 00 00 80 00 (HTC Touch default)

12MB = 00 00 C0 00 (HTC Wing Default)


(for reference, on both my Touch and my Wing the offset location is 37B558... you can go straight to this location be selecting 'Search -> Goto').


So, to change your pagepool size...


- After locating your current pagepool value, update it to one of those shown above by selecting the value and overtyping

- Select File -> Save As, and enter a new name (e.g. Part02.4MB.dump)

- Exit the hex editor


You have now edited your ROM dump, and are ready to flash it back to the device!


[i][b]Step 5: Flashing your edited dump back to the device[/b][/i][b]


[/b]So this is where it gets dangerous. If you've done something wrong with your dump, then nasty things could (probably will) happen. If the flashing process goes wrong, then nasty things could happen. One final warning - you undertake this step at your own risk! Ready to continue? OK then...


- Ensure device is connected to PC and Activesync'd / WMDC'd

- [b]Put the device in flight mode[/b]. This is for safety reasons... receiving a call during the flash would probably be bad

 - Open a command prompt to your working directory (or use the one you already have open)

- Type 'pdocwrite Part02.4MB.dump' (or whichever name you used in the step above)


You will see something like 'CopyFileToTFFS(part02.4mb.dump:0, 0, 040d2000)' appear, and after a wait of a few minutes (it is writing a lot of data!), you'll be returned to the command prompt. DO NOT USE THE DEVICE DURING THIS OPERATION!


[b][i]Step 6: Soft reset, cross fingers[/i]


[/b]Has that command finished (i.e. you have control again at the command prompt)? Then you're done! Simply press the soft reset pin on your device, and when it comes back up, you should see you the amount of program memory in the Settings -> Memory applet has changed. Good job! You can breathe easy again :D 


P

[Guest Gemini420]

Hi Paul,

Thanks for your HowTo ! This is great news. Reading your post gave second thoughts about returning my new Wing/Atlas. Don't get me wrong, I love the phone, but what good is a app filled phone if you can't use the apps?

Anyways, I've followed your tutorial, extracted the ROM, edited it, and saved it back out as a separate dump file.

I stopped there b/c I don't want to brick my new phone. I've flashed many ROMs and BIOS, etc. so I know the risks. I guess under normal circumstance the 'worst case' involves sending the device back and paying the repair/shipping costs.

Your disclaimer, "In a worst case scenario using these techniques, your device will become unusable, with a corrupted 'OS area'. While your bootloader will (should) still be accessible, your device will be a paperweight until such time as a RUU (Rom Update Utility) becomes available for your device with the shipping ROM. We won't be able to help you, and your operator / manufacturers won't either. It's quite possible your warranty will be invalidated by editing your ROM."

Wouldn't the original ROM that I extracted be viable if the edited one is corrupt? I guess I wouldn't have access to flash it back if a reboot was unsuccessful?

Why wouldn't HTC be able to fix a corrupt ROM (if a worst case and I send it back?) Or would they simply prefer that I pay for a new phone?

I guess I understand the risks involved, but am concerned by your disclaimer that mentions that there is ABSOLUTELY NO FIX.

Should I just wait until there is a 'RUU (Rom Update Utility) becomes available for your device with the shipping ROM'?

Thanks again for your great post!!

Shane

BTW: My ROM size appears to be slightly smaller, but the offset to the page pool size was the same.

G:\Windows_Mobile_6_Software\ROM_editing\itsutilsbin-20070323>pdocread -l

63.94M (0x3ff0000) TrueFFS

| 3.06M (0x30fc00) Part00

| 3.06M (0x310000) Part01

| 57.81M (0x39d0000) Part02

39.73M (0x27ba000) TrueFFS

| 3.06M (0x30fc00) Part00

| 3.06M (0x310000) Part01

| 57.81M (0x39d0000) Part02

9.99M (0x9fd800) TRUEFFS

| 3.06M (0x30fc00) Part00

| 3.06M (0x310000) Part01

| 57.81M (0x39d0000) Part02

1.90G (0x79a00000) DSK1:

| 1.90G (0x799e1200) Part00

Edited June 24, 2007 by Gemini420

[Guest Paul (MVP)]

Wouldn't the original ROM that I extracted be viable if the edited one is corrupt? I guess I wouldn't have access to flash it back if a reboot was unsuccessful?

No, because if it won't boot, you can't flash it back :)

Why wouldn't HTC be able to fix a corrupt ROM (if a worst case and I send it back?) Or would they simply prefer that I pay for a new phone?

They probably can!

I guess I understand the risks involved, but am concerned by your disclaimer that mentions that there is ABSOLUTELY NO FIX.

There IS a fix, but it involves returning the device.

Should I just wait until there is a 'RUU (Rom Update Utility) becomes available for your device with the shipping ROM'?

Your call... only you can make that decision.

BTW: My ROM size appears to be slightly smaller, but the offset to the page pool size was the same.

Your numbers are normal for a Wing, the numbers above are from a Touch :P

P

[Guest phatman81]

Paul,

Great guide! Tried it this morning on my Wing, and i have 22+MB of ram. I LOVE IT! The only question i have for you is if this is compatible with the Dash (excalibur). I am pretty sure that it is, since it is the same OS (after t-mobile upgrade), but was more curious if it is at the same hex location. (wanted to check, but left it at a friends house). Have you experimented with any other HTC devices than the ones mentioned?

Edited June 23, 2007 by phatman81

[Guest Paul (MVP)]

Not sure if it'll work on the dash, the hex location will not be the same. I've only tried this on the Touch and Wing.

P

[Guest Mrhotsteppa]

paul i have a question, i have my working directory set to my desktop which i just basically created a new folder called "pagepool" i have everything set right now all i'm doing is waiting for the dump right now, all i want to know is how long does the dump take because its been dumping for like 6 mins so far, and does the dump go in the "'pagepool" folder? because i'm not seeing the folder size increasing.. thanks in advance.

[Guest thematrixz]

paul i have a question, i have my working directory set to my desktop which i just basically created a new folder called "pagepool" i have everything set right now all i'm doing is waiting for the dump right now, all i want to know is how long does the dump take because its been dumping for like 6 mins so far, and does the dump go in the "'pagepool" folder? because i'm not seeing the folder size increasing.. thanks in advance.

The size of the dump file will increase, not the folder size.

[Guest Mrhotsteppa]

The size of the dump file will increase, not the folder size.

o ok but another thing is after the dumping, when i try to open the file in the hex editor i don't see the Part02 dump file so i don't know which one to open??? thanks in advance

[Guest kinoons]

Hello Paul, thanks for the work sofar. I am having some issues with getting the dump file.

Sofar I have ran the ROM unlocker and downloaded the pdocread file. When I run "pdocread -l" I get the following for my part 2

"50.63M <0x32a0000> Part02"

When I type "pdocread 0 0x32a0000 part02.dump" I get this response

copy TFFSToFile(0x0, 0x32a0000, part02.dump)

ERROR: ITReadDisk : Read 00000000 bytes - A device attached to the system is not functioning

And I don't get a part02.dump file. Any ideas? thanks!

Kinoons

[Guest Raphael on Elf]

Hey Paul! thanks for sharing this amazing trick.

But I've some questions about changing Hex for increasing memory.

I used Elf(HTC Touch), After i found Hex valued, is 8MB = 00 00 80 00 (HTC Touch default)

Then what i should do next. Changing this Hex valued to 4 or 6 MB, Is i'm right?

and my CODE is 0x42d3000 not 0x40d2000 when i run pdocread-l

[Guest Paul (MVP)]

'Mrhotsteppa,' did the dump complete successfully?

'kinoons', if you're not on a Touch or a Wing, I can't help you as those are the only devices i've done it on.

'Raphael on Elf', if the size from 'pdocread -l' is different that's not an issue, just follow the instructions.

P

[Guest Gemini420]

Hi Paul,

I ran it successfully. I had to try it ... I couldn't resist.

Set page pool to 6MB.

I haven't noticed any adverse affects from running a smaller page pool (as of yet), and have noticed that the device can handle opening more apps at the same time.

Thanks again!

Shane

Edited June 24, 2007 by Gemini420

[Guest Raphael on Elf]

Thanks Paul!

Finally I got 4 MB in my program memory :)

And on testing now.

Edited June 24, 2007 by Raphael on Elf

[Guest genaldar]

I'm officially an idiot, before it was common knowledge but now its official. I managed to changed it to 04 instead of 40, and not catch it until it was too late. I guess it'll be going in for repairs.

[Guest Paul (MVP)]

Eek, so I assume it won't boot?

This is exactly why it's risky before a RUU is released. If there was a RUU, you could now put it in bootloader and reflash to revive it.

:)

P

[Guest Mrhotsteppa]

'Mrhotsteppa,' did the dump complete successfully?

'kinoons', if you're not on a Touch or a Wing, I can't help you as those are the only devices i've done it on.

'Raphael on Elf', if the size from 'pdocread -l' is different that's not an issue, just follow the instructions.

P

yes the dump was successfully complete but i don't know where it is, i don't think its in the folder i created on my desktop called "pagepool" because i don't see it there....thanks in advance

[Guest Paul (MVP)]

I have no idea where it would have gone, sorry.

P

[Guest dario69]

Talk about a freaking nail biter. Thanks Paul. This worked out perfect. Great instructions.

26+ megs free after reboot. That is with Voice Command disabled and other mild tweaks to the Today screen and startup services. Awesome.

[Guest rope]

Eek, so I assume it won't boot?

This is exactly why it's risky before a RUU is released. If there was a RUU, you could now put it in bootloader and reflash to revive it.

:)

P

There is a (official Touch ROM) RUU available at pdamobiz:

RUU_Elf_DOPODASIA_WWE_1.11.707.1B_4.1.13.42_02.93.90_Ship.exe

I think this would help to get the Touch back to life if you damaged it with a wrong flash.

[Guest wayne2]

Hi Paul,

Thanks for the step by step. I was able to successfully change the pagepool size and I am happy to report that the program memory is much better. Your instructions were clear enough for even an ameteur like me to do it. I am still looking for tips on how to recover a bit more program memory. I am running an over the air corporate e-mail app (Good Mobile Messaging), that easily consumes 4MB of program memory. I noticed one of the members disabled voice command and made a few today edits. If you have tips on how to do those or any others please let me know. Thanks again!!

Wayne

[Guest Paul (MVP)]

There are a few things you can do to increase program memory, i'll post some tweaks when I get back from holiday!

P

[Guest madds]

gee, i'm with my fingers crossed, uploading the rom back to the device :)

my touch is alive and kicking... great!!!

thank's Paul :P

Edited June 26, 2007 by madds

[Guest wayne2]

Talk about a freaking nail biter. Thanks Paul. This worked out perfect. Great instructions.

26+ megs free after reboot. That is with Voice Command disabled and other mild tweaks to the Today screen and startup services. Awesome.

dario69, can you recommend, or provide tips on disabling Voice comand and your other tweaks to the Today screen and start up services? Thanks - Wayne

[Guest MrEBean]

dario69, can you recommend, or provide tips on disabling Voice comand and your other tweaks to the Today screen and start up services? Thanks - Wayne

i'm pretty sure you can just move the file ( voice command.lnk ) from the startup folder to anywhere else ...like a storage card, or other folder.

Edited June 26, 2007 by MrEBean

[Guest Paul (MVP)]

Here's a new idea for the Wing users... rather than doing the HexEdit thing, you can apply one of these patchers below to your part02.raw file - to do the edit for you - then just flash back. To use, copy to the same directory as your raw file and run!

So, THESE PATCHERS REPLACE STEP 4, note that they overwrite the part02.raw rather than creating a new file, so when you flash back you flash the part02.raw filename.

Let me know how it works out :)

P

PS These patchers have CRC checking enabled, so should be very safe!

T_MobileWingPagePool4MB.exe

T_MobileWingPagePool6MB.exe