Database Develop

New header nbf (Wizard etc)

The Device Typhoon/Tornado/Wizard use the alike method of the building of the file nk.nbf.
The Headline where is found information on section and other data.
See http://wiki.xda-developers.com/index.php?pagename=TyphoonNbfFormat.
For Typhoon (ROMUpdateUtility) to versions from 0.9.õõ before 1.2.õõ had a size of the headline 200(Hex) byte.
See
Code:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 48 54 43 00 00 00 00 00 00 00 00 00 00 00 00 00 HTC
00000010 53 54 32 30 43 00 00 00 00 00 00 00 00 00 00 00 ST20C
00000020 31 2E 31 2E 32 33 2E 38 34 00 00 00 00 00 00 00 1.1.23.84
00000030 47 45 52 4D 41 4E 00 00 00 00 00 00 00 00 00 00 GERMAN
00000040 31 2E 31 2E 32 33 2E 38 34 00 00 00 00 00 00 00 1.1.23.84
00000050 53 50 4C 00 00 00 00 00 00 00 00 00 00 00 00 00 SPL
00000060 00 00 00 91 00 00 0C 00 87 12 BF 95 49 50 4C 00 ‘ ‡ ¿•IPL
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 
00000080 00 08 00 00 1B 4C 75 C2 53 70 6C 61 73 68 20 53 LuÂSplash S
00000090 63 72 65 65 6E 00 00 00 00 00 00 92 00 00 02 00 creen ’
000000A0 F9 06 9C 02 47 53 4D 00 00 00 00 00 00 00 00 00 ù œ GSM
000000B0 00 00 00 00 00 00 00 96 00 00 29 00 6F A2 23 76 – ) o¢#v
000000C0 4F 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OS
000000D0 00 00 04 82 00 00 B0 01 94 5A 37 4D 00 00 00 00 ‚ ° ”Z7M
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000F0 00 00 00 00 00 00 00 00 05 00 00 00 11 00 00 00
00000100 54 2D 4D 4F 42 30 30 31 00 00 00 00 00 00 00 00 T-MOB001
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 89 D3 7F FF ‰Óÿ
use for decryption ROM TyphoonNbfTool_03.exe.
For Typhoon (new Rom T-mobile SDA ) ,Tornado and Wizard(Prodigy) -(ROMUpdateUtility) to versions 2.0.õ have a size of the headline 400(Hex)
See
Code:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 48 54 43 00 00 00 00 00 00 00 00 00 00 00 00 00 HTC
00000010 50 72 6F 64 69 67 79 00 00 00 00 00 00 00 00 00 Prodigy
00000020 31 2E 36 2E 32 2E 34 00 00 00 00 00 00 00 00 00 1.6.2.4
00000030 57 57 45 00 00 00 00 00 00 00 00 00 00 00 00 00 WWE
00000040 31 2E 30 36 00 00 00 00 00 00 00 00 00 00 00 00 1.06
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00
000000F0 00 00 00 00 01 00 00 00 0C 00 00 00 11 00 00 00
00000100 57 49 5A 54 4D 4F 30 34 00 00 00 00 00 00 00 00 WIZTMO04
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000200 07 00 00 00 49 50 4C 00 00 00 00 00 00 00 00 00 IPL
00000210 00 00 00 00 00 00 00 90 00 08 00 00 80 AE 96 39  €®–9
00000220 53 50 4C 00 00 00 00 00 00 00 00 00 00 00 00 00 SPL
00000230 00 00 00 91 00 00 0C 00 40 2B 7F DE 47 53 4D 00 ‘ @+ÞGSM
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 –
00000250 00 00 28 00 14 4F BE 4B 4F 53 00 00 00 00 00 00 ( O¾KOS
00000260 00 00 00 00 00 00 00 00 00 00 04 80 00 00 90 03 € 
00000270 A8 09 20 D3 53 70 6C 61 73 68 20 53 63 72 65 65 ¨ ÓSplash Scree
00000280 6E 00 00 00 00 00 00 92 00 00 03 00 6F A0 78 CB n ’ o*xË
00000290 45 78 74 65 6E 73 69 6F 6E 20 52 4F 4D 00 00 00 Extension ROM
000002A0 00 00 00 9B 00 00 A0 00 3D 4D 94 2C 48 54 43 20 › * =M”,HTC
000002B0 4C 6F 67 6F 00 00 00 00 00 00 00 00 00 00 00 9D Logo 
000002C0 00 00 01 00 A5 F0 3C 09 00 00 00 00 00 00 00 00 ¥ð<
000002D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003F0 00 00 00 00 00 00 00 00 00 00 00 00 97 AC 6C AD —¬l*
use for decryption ROM TyphoonNbfTool_04.exe.

Presently HTC Wizard(Prodigy) -(K-jam test ROM on xda-developers and ROM K-JAMin on ftp://ftp.clubimate.com/ and etc) has changed headline for ROMUpdateUtility versions 2.5.õ -has a size 800(Hex)
See
Code:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 48 54 43 00 00 00 00 00 00 00 00 00 00 00 00 00 HTC
00000010 50 4D 33 30 30 00 00 00 00 00 00 00 00 00 00 00 PM300
00000020 31 2E 30 2E 39 2E 31 31 34 00 00 00 00 00 00 00 1.0.9.114
00000030 57 57 45 00 00 00 00 00 00 00 00 00 00 00 00 00 WWE
00000040 31 2E 30 00 00 00 00 00 00 00 00 00 00 00 00 00 1.0
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00
000000F0 00 00 00 00 00 00 00 00 0D 00 00 00 11 00 00 00
00000100 50 52 4F 43 44 4C 30 31 00 00 00 00 00 04 00 00 PROCDL01
00000110 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000003F0 00 00 00 00 00 08 68 04 07 02 03 46 71 E3 07 4E h Fqã N
00000400 07 00 00 00 53 50 4C 00 00 00 00 00 00 00 00 00 SPL
00000410 00 00 00 00 00 00 00 91 00 00 0C 00 AA B6 B6 CF ‘ ª¶¶Ï
00000420 00 08 00 00 01 00 00 00 49 50 4C 00 00 00 00 00 IPL
00000430 00 00 00 00 00 00 00 00 00 00 00 90 00 08 00 00 
00000440 F6 D2 9A 46 00 08 0C 00 01 00 00 00 47 53 4D 00 öÒšF GSM
00000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 –
00000460 00 00 28 00 04 1E 44 11 00 10 0C 00 00 00 00 00 ( D
00000470 4F 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OS
00000480 00 00 04 80 00 00 90 03 C0 94 12 FB 00 10 34 00 €  À” û 4
00000490 00 00 00 00 53 70 6C 61 73 68 20 53 63 72 65 65 Splash Scree
000004A0 6E 00 00 00 00 00 00 92 00 00 03 00 5D 63 3E 65 n ’ ]c>e
000004B0 00 10 C4 03 00 00 00 00 45 78 74 65 6E 73 69 6F Ä Extensio
000004C0 6E 20 52 4F 4D 00 00 00 00 00 00 9B 00 00 A0 00 n ROM ›
000004D0 41 CB FA 5C 00 10 C7 03 00 00 00 00 48 54 43 20 AËú\ Ç HTC
000004E0 4C 6F 67 6F 00 00 00 00 00 00 00 00 00 00 00 9D Logo 
000004F0 00 00 01 00 6E AA 8B 6D 00 10 67 04 00 00 00 00 nª‹m g
00000500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000005F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000600 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
..............................................................................
..............................................................................
000007B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000007C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000007D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000007F0 00 00 00 00 00 00 00 00 00 00 00 00 51 6A 7F 06 Qj

The Program TyphoonNbfTool with opened by code -for new headline necessary to change the program.
http://cvs.sourceforge.net/viewcvs.py/nbftools/TyphoonNbfTool/
Here, there is programmers who can do this correct ?
You may decode the headline for (Wizard 800Í byte) for study -using program cpuHdrDec.exe (many thanks Onk for help).
Source code is enclosed.
Use : cpuHdrDec.exe <file.nbf>decode_header_outfile

So what do this mean?......can we modify/add or change the basic applicatios between?...

I have also seen headers of size 0x400.
not sure if it is correct, but i assume that the byte at 0xf8 functions like a header version.
i made a new version of typhoonnbfdecode.pl that understands the larger headers.
another change is that in the latest wizard rom, there are 2 copies of the spl and ipl, one for the 'g3' model, one for the 'g4' model.
willem

Thank you itsme -I converted perl in exe file .
hdubli cpuHdrDec.exe -this only for study of the headline

i found what the 'g4' and 'g3' model means, it refers to the type of 'disk-on-chip' used.
willem

this refers to type DOC - G4 or G3?
http://www.m-sys.com/site/en-US/Sup...electedProduct=mDiskOnChipG3&selectedType=All
http://www.m-sys.com/site/en-US/Sup...selectedProduct=DiskOnChipG4&selectedType=All

itsme said:
I have also seen headers of size 0x400.
not sure if it is correct, but i assume that the byte at 0xf8 functions like a header version.
i made a new version of typhoonnbfdecode.pl that understands the larger headers.
another change is that in the latest wizard rom, there are 2 copies of the spl and ipl, one for the 'g3' model, one for the 'g4' model.
willem
Click to expand...
Click to collapse
Hi Willem!
This code can extract modules fine. But there is still poblem with coding to .nbf and sd image.. Can you add keys for Wizard?

the wizard uses the same keys as tornado / charmer / prodigy.
encoding the larger headers i still have to do. ... when i find the time and need to do so.
willem

From qtek S200
RUU_Prophet_2090724_20907106_020720_QtekWWE_Ship
Code:
48544300000000000000000000000000 - HTC.............
50726f70686574000000000000000000 - Prophet.........
322e392e372e31303600000000000000 - 2.9.7.106.......
57574500000000000000000000000000 - WWE.............
322e3900000000000000000000000000 - 2.9.............
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000002000000 - ................
00000000000000000d00000011000000 - ................
50524f51544b30310000000000040000 - PROQTK01........
03000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
000000000010740459edb8d121122d3a - ......t.Yφ╕╤!..:
blversion 322e39
device Prophet
entrycount 0
extralist
Stranger yet Prophet Doesn't list the contents of the nbf in the header.
Also the number of sections returns as 0
From analysing RUU output I've found this nk.nbf has the following sections:
Code:
ruuflashdoc 91000000 c0000 5e443726 SPL
ruuflashdoc 90000000 800 15593234 IPL
ruuflashdoc 96000000 280000 fc466813 GSM
ruuflashdoc 80040000 3900000 757e3094 OS
ruuflashdoc 92000000 30000 140d16aa Splash
ruuflashdoc 9b000000 a00000 da2d783f ExtRom
ruuflashdoc 9d000000 10000 6d8baa6e HTC Logo
Bye,
Ricardo
EDIT: Added code section formatting

Another tidbit of info.
The header That I listed in the previous post goes from 0x0000 to 0x7FF. The rom sections follow, having no spacing between them...
Hipothesis:
The Sections offsets are hardcoded in the RUUUpdate now...
Couldn't find any info of them though...
Hipothesis wrong... The section still exists
I'm trying to decode it right now...
Bye now,
Ricardo

Checked the RuuUpdateUtil Header decoding:
The Decoding table values are the same from both
After debugging a RuuUpdateUtil header decode:
The decoding from itsme script is equivalent to the one on this "New" header type file
In other news:
RIP: HTC Prophet no. 1... You'll be missed

Hehe... I'm a jackass...
itsme's perl script works on the new rom... (Was not using -tp option...)
Code:
48544300000000000000000000000000 - HTC.............
50726f70686574000000000000000000 - Prophet.........
322e392e372e31303600000000000000 - 2.9.7.106.......
57574500000000000000000000000000 - WWE.............
322e3900000000000000000000000000 - 2.9.............
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000002000000 - ................
00000000000000000d00000011000000 - ................
50524f51544b30310000000000040000 - PROQTK01........
03000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
000000000010740459edb8d121122d3a - ......t.Yφ╕╤!..:
0900000053504c000000000000000000 - ....SPL.........
000000000000009100000c002637445e - .......æ....&7D^
000800000100000049504c0000000000 - ........IPL.....
00000000000000000000009000080000 - ...........É....
3432591500080c000100000053504c00 - 42Y.........SPL.
00000000000000000000000000000091 - ...............æ
00000c00da87a6de00100c0002000000 - ....┌çª▐........
49504c00000000000000000000000000 - IPL.............
000000900008000037e0383800101800 - ...É....7α88....
0200000047534d000000000000000000 - ....GSM.........
000000000000009600002800136846fc - .......û..(..hFⁿ
00181800000000004f53000000000000 - ........OS......
00000000000000000000048000009003 - ...........Ç..É.
94307e75001840000000000053706c61 - ö[email protected]
73682053637265656e00000000000092 - sh Screen......Æ
00000300aa160d140018d00300000000 - ....¬.....╨.....
457874656e73696f6e20524f4d000000 - Extension ROM...
0000009b0000a0003f782dda0018d303 - ...¢..á.?x.┌..╙.
00000000485443204c6f676f00000000 - ....HTC Logo....
000000000000009d000001006eaa8b6d - .......¥....n¬ïm
00187304000000000000000000000000 - ..s.............
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
00000000000000000000000000000000 - ................
000000000000000000000000927d6781 - ............Æ}gü
!!! storedcrc=4ddbe507 calculatedcrc=d171d945
blversion 322e39
device Prophet
entrycount 9
flags 17
flags2 13
hdrcrc 0x4ddbe507
language WWE
magic HTC
operator PROQTK01
rest ♦ ♥
rest2
version 2.9.7.106
91000000 000c0000 5e443726 SPL_1
90000000 00000800 15593234 IPL_1
91000000 000c0000 dea687da SPL_2
90000000 00000800 3838e037 IPL_2
96000000 00280000 fc466813 GSM_0
80040000 03900000 757e3094 OS_0
92000000 00030000 140d16aa Splash Screen_0
9b000000 00a00000 da2d783f Extension ROM_0
9d000000 00010000 6d8baa6e HTC Logo_0
Here you go! A prophet NBF decoded!
Why are there 2 SPL's? and 2 IPL's?

I think this pertains to DOC -see above. Depending on type DOC is used or one or other SPL IPL.
You may look initial KITL output.
see
http://forum.xda-developers.com/viewtopic.php?t=43203
Code:
(CoreCon) 11:31:56 03/07/2005 W. Europe Standard Time: Download service map set to NONE; ignoring download request!
The Kernel Debugger is waiting to connect with target.
0 PID:0 TID:0 Searching for G3/P3 based DiskOnChip
0 PID:0 TID:0 Found G3P3-based DiskOnChip
0 PID:0 TID:0 Searching for G4 based DiskOnChip
0 PID:0 TID:0 Did Not find G4 based DiskOnChip
0 PID:0 TID:0 SAFTL was registred to manage the flash.
0 PID:0 TID:0 GetModelName- 80,85, Name is PU10
0 PID:0 TID:0 Searching for G3/P3 based DiskOnChip
0 PID:0 TID:0 Found G3P3-based DiskOnChip
0 PID:0 TID:0 Searching for G4 based DiskOnChip
0 PID:0 TID:0 Did Not find G4 based DiskOnChip
0 PID:0 TID:0 SAFTL was registred to manage the flash.
P.S. I can mistaken in this question.

Think you're right Arc!
BTW: Nice to see you around here!
Bye,
Ricardo

Request if someone can inform as how to do the KITL Debugging and see the Log....Is this possible in Wizard?

This it is necessary to ask besidebuzz_lightyear

Hi there. Sorry for pulling out this old thread. Im making a flash tool for prophet, and didn't know about this thread, nor the programs you guys use. So i found out myself how to decrypt and use the header (0x800), and found about about the sections and everything.
But i still have one question about this: There are 2 SPL and sometimes 2 IPLs in the Header/ROM. How do i know which one goes to which phone? So far i've read its dependant on the DOC, and if its a G3 or a G4. But how do i query the phone, so that i can interprid which DOC it has? and how do i know which SPL goes with the DOC then?
Hope someone can help me with this.

How to dump HTC Shift ROM

To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)

Excellent
This is just too much good news in one day.
Will order the HTC Shift today as this is what we needed to know.
We see the HTC shift as the killer device for our software PocketReperion and
now we see a light at the end of the tunnel.
Will post a special WM6 Shift version of PocketReperion soon.
http://www.reperion.com/newclient

pof said:
To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
Sorry that I am not a technical guy, but I am really interested to revive my Shift. What is this for??

Help please
Hi ppl.Can anyone help me
Im looking to cook a ROM at my own taste/add some usefull Apps and flash it to my device,but is becoming a headake job to do"Wich gives me a empty OEM folder. And only .VM and .ROM in SYS folder wen i try to cook."Its consuming me a lot of time
Were can i get Pdocread.exe . It might be the solution.
Can someone help im a noobie,that feels very very nooooooobie,lol
Devices:HTC TyTN II SuperUnlocked_Trying to cook a live ROM 4 it.
:Qtek 9100 SuperUnloked { All thanks to Pof }

Hi Blueangel69
In the very first post, pof mentioned that you have to download rapi tools (itsutils) from itsme.
>>To dump Shift's CE ROM use itsutils from itsme:
You will see pdocread.exe in that zip file.

Trying to dump my rom with itsutils but keep getting the message:
"could not update itsutils.dll to the current version, maybe it is in use? try restarting your device, or restarting active sync, or maybe your device is application locked".
I tried different versions of itsutils, delete itsutils.dll from windows directory in WM and try again but still getting the same message. Any ideas?????
My Shift is not hardSPL (maybe thats the problem?)
Edit: I hardSPL my sift and still getting the same message. I even tried 'pput itsutils.dll \Windows'. Any ideas?????

Install EnableRAPI.cab on your shift. Search for it, has been posted many times here.

Thanks a lot, everything is OK now.

reconstructing ROM NBH
pof said:
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
pof
You mean this url http://forum.xda-developers.com/showthread.php?t=337066&highlight=reconstruct+ROM+nbh
and also should I just copy this line and run it as it is or do I have to change any parameters passed to this util, pmemdump.exe 0x8c000000 262144 SPL.nb
Could you please sticky this thread!
thanks
Ram

pof said:
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
I saw the post http://forum.xda-developers.com/show...struct+ROM+nbh but I don't know what to do. Should I use the indicated files from Kaiser???
What should I do with the file SPL.nb

motowiz said:
I saw the post http://forum.xda-developers.com/show...struct+ROM+nbh but I don't know what to do. Should I use the indicated files from Kaiser???
What should I do with the file SPL.nb
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=422914 from thaihugo is much easier
Thanks
Ram

Please pin this thread.
pof
Could you please pin/stick this.
Thanks
Ram

@saiweb: Done

pof said:
@saiweb: Done
Click to expand...
Click to collapse
pof
Thank you very much
Ram

Need Help.
I was able to dump all raw files except Part00.raw. I used the command prompt. Am I supposed to use another program or am I using the right one?

hey I got an error when doing the 4th raw :
"ERROR: ITReadDisk : read 00000000 bytes - Adresse de bloc de contrôle de stockage non valide."
(storage control's bloc address is not valid)
I have the 4 raws created and the 4th has the size : 37.7MB (39.583.744 bytes)
edit : sorry was stupid yesterday.... in fact the size of Part02 and Part03 were not the same as you Pof.... so I just needed to change that
well... doing it again ! in Windows 7

pof said:
To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
I have dumped all the raw files, howere I can't reconstrct a rome in NBH by the above instructions same for Kaiser.

pof said:
To dump Shift's CE ROM use itsutils from itsme:
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
thanks
how can i write back spl on my gene?(hardspl ok)
$ pmemdump.exe 0x8c000000 262144 SPL.nb
Click to expand...
Click to collapse

Code:
pmemdump -p -f 0x00000000 > SPL.bin.txt
This show the bytes for my device in the text file below, I am having issues locating a decent guide to dump the bootloader. I am trying to dump the bootloader off my stock Sprint Touch Pro 2. The rest of the process in the first post was perfect for getting the RAW files, I have them split to SYS, OEM, EXT, and XIP. Now, I just need a little guidance dumping the bootloader and dumping <Part00.raw> and <Part03.raw> into useable files.
Can anyone help out on this, I have found the start length on the pmemdump.exe (simple enough, start at the beginning...I think). But in the first post, there was a number after the start length...is this the same across the board? If not, how do we determine what this number should be? How should we determine the start length? Or will starting at 0x00000000 be okay?
Feel free to PM me about this since this is not a thread for the Touch Pro2...but it has been the most helpful thread so far for dumping the stock ROM off this thing to have around for backup purposes.

Hi all.
Please help !
Anyone have the orignal dump from HTC Shift (French) ?
My hard disk crash, and I lost my DUMP...
Thank all ...

Backup hole phone ROM?

How to backup your hole Phone, (ROM)?
And how to install a ROM?
No experience with this, only with Nokia Mobiles.
Cheers,
DawnJW

I have seen a lot of people asking this, but no answers so I had a search myself.
I found this which is a 'how to' which started off fine and even sorted the 'locked issue'.
PHP:
C:\x1>pdocread -l
459.88M (0x1cbe0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 168.00M (0xa800000) Part02
| 284.38M (0x11c60000) Part03
3.80G (0xf2e80000) DSK7:
| 3.79G (0xf2a80000) Part00
STRG handles:
handle 8ffedfb6 3.79G (0xf2a80000)
handle 0feac77a284.38M (0x11c60000)
handle cffa1c2e168.00M (0xa800000)
handle 2ffa1bfa 4.38M (0x460000)
handle 2ffa1946 3.12M (0x31f000)
disk 8ffedfb6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0feac77a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cffa1c2e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2ffa1bfa
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2ffa1946
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
However, then I came across a problem:
PHP:
C:\x1>pdocread -w -d FLASHDR -p Part00 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part01 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part02 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part03 -t
real nr of sectors: 1 - 512.00byte, 0x200
This thread had someone with the same issue on his iPaq. I've now reached a dead end, as the solution for him won't work for me, my log is like this:
PHP:
ERROR: DeviceIoControl(FL_IOCTL_NUMBER_OF_PARTITIONS) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_BDK_OPERATION, BDK_GET_INFO) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_CUSTOMER_ID) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_UNIQUE_ID) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_NUMBER_OF_PARTITIONS) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_BDK_OPERATION, BDK_GET_INFO) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_CUSTOMER_ID) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_UNIQUE_ID) - A device attached to the system is not functioning.
.
.
.
So, over to you.

hi there!
i also would like to dump my original rom using the hermes howto but i am having the same problem as grayme.
i am using itsutilsbin (20080313) with vista and already changed registry value HKLM\Security\Policies\Policies\00001001 from 2 to 1 on my x1.
any help is very appreciated!

I've got a bit further last night, let me have a play tonight and post where I got to.
I managed to create the raw file, and split it, but it failed on recompaction, so nearly there.

Bread Pitta said:
hi there!
i also would like to dump my original rom using the hermes howto but i am having the same problem as grayme.
i am using itsutilsbin (20080313) with vista and already changed registry value HKLM\Security\Policies\Policies\00001001 from 2 to 1 on my x1.
any help is very appreciated!
Click to expand...
Click to collapse
Sorted, you have a PM.

Hi,
I have dumped my Vodafone X1, do you have any ideas/tools to use to rebuild into a ROM or NBH file?
Thanks,
Phil Rich

Help Dumping Rom

Im trying to dump my rom before flashing another.
Im using the instructions from here:
http://forum.xda-developers.com/showpost.php?p=3078601&postcount=4
However when i get to step 6 i get the following error:
"ERROR: ITReadDisk: outbuf ==NULL
- The device is not ready for use."
Cam someone please help me, i've tried searching but can not find a solution.

Getting the same error - please help us
I am getting the same Device not ready error. Here's what I get from running pdocread.exe -l
Code:
C:\itsutils>pdocread.exe -l
209.50M (0xd180000) DSK1:
| 3.12M (0x31f000) Part00
| 4.50M (0x480000) Part01
| 79.63M (0x4fa0000) Part02
| 122.25M (0x7a40000) Part03
3.69G (0xec000000) DSK7:
| 3.69G (0xec000000) PART00
STRG handles:
handle e7a46f96 3.69G (0xec000000)
handle 87ab74a6122.25M (0x7a40000)
handle a7bb2136 79.63M (0x4fa0000)
handle 47bb2112 4.50M (0x480000)
handle 87bb20ca 3.12M (0x31f000)
disk e7a46f96
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87ab74a6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7bb2136
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 47bb2112
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87bb20ca
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C:\itsutils>pdocread -w -d FLASHDR -b 0x800 -p Part00 -t
real nr of sectors: 1 - 2.00kbyte, 0x800
C:\itsutils>pdocread -w -d DSK1 -b 0x1000 -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
ERROR: ITReadDisk: outbuf==NULL
- The device is not ready for use.
Please help.....

Backup stock rom

I have taken the steps in regards to what I have read to backup the stock rom.
Now I am not sure I have done this 100%.
This is the output of pdocread -l. The bolded parts are what I have backed up.
209.75M (0xd1c0000) DSK1:
| 3.12M (0x31f000) Part00
| 4.50M (0x480000) Part01
| 111.00M (0x6f00000) Part02
| 91.13M (0x5b20000) Part03
3.75G (0xf0000000) DSK7:
| 3.75G (0xf0000000) PART00
STRG handles:
handle e73510da 3.75G (0xf0000000)
handle a7e988ea 91.13M (0x5b20000)
handle e7fb27be111.00M (0x6f00000)
handle 87fb279a 4.50M (0x480000)
handle a7fb2752 3.12M (0x31f000)
disk e73510da
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7e988ea
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e7fb27be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87fb279a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7fb2752
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Click to expand...
Click to collapse
I tried following the guide from here http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom however when I get to step 9 I am not sure if I need to proceed with that step.
Can someone who has done this before please fill me in? I am completely at a loss. Normally I can figure this out but as this is a phone I use for business I don't want to screw anything up. And I want to have the stock rom backed up so that I can revert back to it if there is any need to return both the SPL and the rom to its original state.
Thanks!

I hate to bump threads and I know how annoying it is but does anyone happen to have an answer for this?