Dear all,
While waiting for the new version of ER2003edit that can work also with the Blue Angels extended roms, here is a work-around to manipulate the extended ROM.
You need Linux, either installed normally on one of your machines, or if you do not have / want a dedicated machine you can use a 'Linux on CD'
distribution (Like KNOPPIX) for this.
The idea is that the Extended ROM in priciple just a container file for a VFAT filesystem, and can be mounted on a loopback device under Linux.
You need to uncrypt the extended ROM first, to be able to access it, but this can be done easily with the xda3nbftool tool.
The command to do this is:
xda3nbftool -x ms_.nbf ms_.nba 0x20040522
Now you need to move the file to the Linux box, or mount the filesystem so thay you can access the file.
The mount command under Linux is:
mount -t vfat -rw -o loop,offset=0x70080 ms_.nba /mnt/loop0
(The image starts at another offset then the old XDA images, therefore the ER2003edit program does not work correctly. Old offset was 0x70040, so anyone who wants to hexedit/patch the er2003edit.....)
You can now work in the ROM image as you want. The access is R/W and you can remove and replace files as your heart desires.
Once finished, you need to unmount the device, and transfer the file back to the windows machine. Once done, you need to re-calculate the CRC checksum with the xda3nbftool tool, this is done with the following command line:
xda3nbftool -c -u ms_.nba
Now you need to crypt the ER back, also with the help of xda3nbftool to have the BaUpdateUt recognize it correctly.
xda3nbftool -x ms_.nba ms_.nbf 0x20040522
If you remove the other ROM files (Radio and OS) from the directory, only the extended ROM will be flashed, and not the whole shebang.
Credit goes to Luchtmacht & Camarque, they are looking now at ways to extract the bitmaps of the splashscreens.
Hope it's usefull.
Willem.
Hi,
I tried to mount in my Linux system (Redhat 9.x) which has an error message "mount: wrong fs type, bad option, bad superblock on /dev/loop0, or too many mounted file systems"
Please help? What I can do now?
And at Windows system, I use the nbf tool to decrypt the .nbf file, it has a warning "WARNING: this does not look like a nbf header, possible you provided the wrong password", does it correct?
Thanks for your help!
With the newer roms they changed the password and/or the encryption algorithm. Therefore the windows nbftool cannot decrypt them for now. You can try one of the older roms or wait until someone hack the algorithm and provides us with a newer version of nbftool
Related
No given passwords work with those files :x Since they are (PH20B), does relate?
Has anyone got those pw's? I repeat for Blue Angel only.
1) The files you are looking at are simply zipped cab files (See posting in Extended Roms thread)
2) The xda3nbftool has an extra command line option of -t which attempts to discover the xor key used to encrypt the .nbf files. This seems to work well for all files except the radio_.nbf file which causes it problems. Try it on roms that you are having problems with to see if it is the correct key. You can check the resulting .nba file with a hex editor to ensure the PH20B and other data is shown at the beginning of the .nba file.
3) The following are the "passwords" (Really xor values) working for most Blue Angel Roms:
ms_.nbf = 0x20040522
nk.nbf = 0x20040521
radio_.nbf = 0x20040523
I have posted an Excel sheet on the ftp server describing the Byte Layout for the BlueAngel Extended ROM with a view to creating a file extractor / creator so that we can build our own ms_.nbf files.
Please note that in order to work on ANY of the ROM files for the BlueAngel you must first decode them using the following:
Code:
xda3nbftool -x ms_.nbf ms_.nba 0x20040522
xda3nbftool -x nk.nbf nk.nba 0x20040521
xda3nbftool -x radio_.nbf radio_.nba 0x20040523
This results in producing three files with the same size and name but an nba extension. The ms_.nba file is the one we are concerned with at the moment, however if someone wishes to look at the nk.nba file it would be nice to be able to extract the base rom files directly as well.
The Excel sheet can be found here if you wish to have a play! There are some areas I am unsure of as yet and as such it is still a work in progress.
I have made a start at coding a fat file extractor but:
1) Have not been programming for some years now so it will probably take me until the XDA XVII comes out!
2) Hope that someone else has already written FAT16 file handling code and could help out!
Any help greatly appreciated.....
I have now created this as a Wiki Page which can be found here.
Took me a while to figure this out and I know it has confused a lot of other people. But - I got there in the end and this is what I did...please note this does have the potential to blitz your device - if you aint comfortable don't do it!!!!
Firstly - mine is an O2 (UK) XDA2s currently on the latest (1.06.00) ROM.
1 - copy the standalone files from the wiki site to your machine.
2 - do the following in DOS step by step:
REM The tool takes the file and reworks it as nda
xda3nbftool -x radio_.nbf radio_.nba 0x20040523
REM patches that file with the info you give it - notice codes for O2!
xda3nbftool -sd PH20B -so O2___001 -sl WWE radio_.nba
REM Works out the checksum and writes it back to the nda
xda3nbftool -c -u Radio_.nba
REM And posts the file back as ndf for the tool to use
xda3nbftool -x radio_.nba radio_.nbf 0x20040523
REM Kills the nda as it is not needed
del *.nba
Now simply sync your device and then run from windows (double-click) BaUpgradeUT.exe it *should* run a radio upgrade only.
Finally hard reset as per the instructions on screen.
Good luck!
R
Do you find BT3900 and Radio 1.08 a good combo? Is it worth upgrading now (looks like 1.10 is just around the corner)
tbh - not a lot different. I was hoping that it would make my bt better but it has not. Hope 1.10 is better
R
hi Rakh1,
i downloaded the 1.08.00 patch from wiki and directly patched the upgrade (without going thru the steps in dos you described) and it worked
do u think there's gonna be a problem later on? :?
Hi,
The steps in DOS purely match the radio update to your device and language. I tried doing it straight out without these stepsfirst too - except for me it turned my device into a paperweight!
If you managed sucessfully wthout them I can see no problems further don the line...
Rich
Hi Six,
Did you use the SD card method to back up all your roms (CE, Radio, ExtRom)?
I think yours are asian ROM that should be alright with my device in HK.
Thanks very much in advance.
Cheers,
Hi,
i just downloaded the file BA_DT_GER_14001_154_11200_Ship.exe from the xda-developers ftp-server.
now i try to change the id's for the .nbf files so that the updater-program updates my xdaIII from o2.
xda3nbftool -x ms_.nbf ms_.nba 0x20040522
WARNING: this does not look like a nbf header, possible you provided the wrong password
xda3nbftool -x nk.nbf nk.nba 0x20040521
WARNING: this does not look like a nbf header, possible you provided the wrong password
xda3nbftool -x radio_.nbf radio_.nba 0x20040523
WARNING: this does not look like a nbf header, possible you provided the wrong password
Perhaps someone can tell me what i did wrong?
thanks in advance.
Best wishes from germany
Sascha Schmidt
EditFix.bat ?
I'm new at this myself but I think there's something missing when you're re-doing the ID. I think you need to use GetDeviceData.exe to get your device info and then use EditFix.bat with that info (or run the xda3nbftool directly) with the -so -sl -sd options.
Hello, today I tried upgrading to Mamaich's Wizard, but unfortunately didn't get that far... I was following the WIKI, and got as far as ' Download EditFix.bat and XDA3NbfTool. Patch your ROM with the data in DeviceData.txt -- read EditFix.bat for the how-to. '
This seems rather vague, and when I click on the How-to it doesn't explain it at all, so I simly ran the .bat in the folder and it began processing it, until I got the following message...
WARNING: this does not look like a nbf header, perhaps you entered the wrong password
If what bytemybits is true, can someone explain how one should run editfix.bat properly?
Thanks for your help
Leo
Okay let me be more clear as I found that somewhat vague as well.
Download GetDeviceData.exe to your desktop, then copy it to your phone. Run it on your phone, it won't look like it did anything but there will now be a file called DeviceData.txt in your \Windows\ folder. Copy that file to your desktop and open it with your favorite text editor. It will be one long line with a bunch of non-printing (usually square boxes) characters. Remove the non-printing characters. You should now have something like:
PH20B 0 0 ORANG001 1.40.00 0 0 1.40.00 0 0 1.13.00 00
Now open the EditFix.bat file in that same text editor. There are a bunch of REM statements that tell you what to do. Basically you take the DeviceData information and use it to fill in the question marks in the bat file. So where there is a -so ????? change it to read -so PH20B (or wehatever you have). Do the same for the other question marks replacing them with the appropriate info. Save the EditFix.bat.
Now that's done run the EditFix.bat as instructed.
Ahhhh, thanks for your help! I shall try that later and let you know if I have success.
Thanks again bytemybits!
Leo
saschahb said:
Hi,
i just downloaded the file BA_DT_GER_14001_154_11200_Ship.exe from the xda-developers ftp-server.
now i try to change the id's for the .nbf files so that the updater-program updates my xdaIII from o2.
xda3nbftool -x ms_.nbf ms_.nba 0x20040522
WARNING: this does not look like a nbf header, possible you provided the wrong password
xda3nbftool -x nk.nbf nk.nba 0x20040521
WARNING: this does not look like a nbf header, possible you provided the wrong password
xda3nbftool -x radio_.nbf radio_.nba 0x20040523
WARNING: this does not look like a nbf header, possible you provided the wrong password
Perhaps someone can tell me what i did wrong?
thanks in advance.
Best wishes from germany
Sascha Schmidt
Click to expand...
Click to collapse
it's not gonna work. Any rom newer than 1.22 is Type II, that means that xda3nbftool can not be used for it. You have to use MaUpgradeUt_noID.exe for upgrading.
xda3nbftool For 1.40, 1.42 does not exist?
And to carry out operation nbf-> nba for roms newer than 1.22 it is impossible?
I have correctly understood?
Problem in the password?
I get the below when trying to extract some files from a rom.
I am trying to upgrade my G4 Cingular with WM5 to a rom with WM6. I just got the phone yesterday used from a friend. So far I have unlocked phone so that it works with my T-Mobile sim. Been reading and trying to update rom since last night.
A set of instructions I found wanted me to run typho5 from the dos prompt. but it appears to be looking for typhoonbfdecode.pl
Any help would be appreciated...
C:\newrom>typho5.exe -x nk.nbf
Usage: typhoonnbfdecode.pl filename
lists contents of filename
or typhoonnbfdecode.pl [-i] [-v] -x infile
extract modules
-i decode as sd header image
-t file is tornado nbf, with large header
-v also list headers
-s convert SPL to memory image
or typhoonnbfdecode.pl [-r module=file] [-p param=value] -c outfile
create new nbf
-s convert SPL memory image to nbf image
-t file is tornado nbf, with large header
-r specify the modules to read, module can be one of:
os, ipl, spl, splash or gsm
-p specify the header values, param can be one of:
device, language, magic, operator, flags, version or blversion
or typhoonnbfdecode.pl [-r module=file] [-p param=value] -d outfile
create sdcard image
-r specify the modules to read, module can be one of:
os, ipl, spl, splash or gsm
-p specify the header values, param can be one of:
docuniqueid, blversion, cid, seclevel, timestart, timeend
keys, cardid
Use WST (check my signature) and you'll have a nice GUI to do it for you
cheers
mestrini said:
Use WST (check my signature) and you'll have a nice GUI to do it for you
cheers
Click to expand...
Click to collapse
thanks...hope it's help me to learn how to cook my own rooms...