Database Develop

How to dump HTC Shift ROM

To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)

Excellent
This is just too much good news in one day.
Will order the HTC Shift today as this is what we needed to know.
We see the HTC shift as the killer device for our software PocketReperion and
now we see a light at the end of the tunnel.
Will post a special WM6 Shift version of PocketReperion soon.
http://www.reperion.com/newclient

pof said:
To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
Sorry that I am not a technical guy, but I am really interested to revive my Shift. What is this for??

Help please
Hi ppl.Can anyone help me
Im looking to cook a ROM at my own taste/add some usefull Apps and flash it to my device,but is becoming a headake job to do"Wich gives me a empty OEM folder. And only .VM and .ROM in SYS folder wen i try to cook."Its consuming me a lot of time
Were can i get Pdocread.exe . It might be the solution.
Can someone help im a noobie,that feels very very nooooooobie,lol
Devices:HTC TyTN II SuperUnlocked_Trying to cook a live ROM 4 it.
:Qtek 9100 SuperUnloked { All thanks to Pof }

Hi Blueangel69
In the very first post, pof mentioned that you have to download rapi tools (itsutils) from itsme.
>>To dump Shift's CE ROM use itsutils from itsme:
You will see pdocread.exe in that zip file.

Trying to dump my rom with itsutils but keep getting the message:
"could not update itsutils.dll to the current version, maybe it is in use? try restarting your device, or restarting active sync, or maybe your device is application locked".
I tried different versions of itsutils, delete itsutils.dll from windows directory in WM and try again but still getting the same message. Any ideas?????
My Shift is not hardSPL (maybe thats the problem?)
Edit: I hardSPL my sift and still getting the same message. I even tried 'pput itsutils.dll \Windows'. Any ideas?????

Install EnableRAPI.cab on your shift. Search for it, has been posted many times here.

Thanks a lot, everything is OK now.

reconstructing ROM NBH
pof said:
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
pof
You mean this url http://forum.xda-developers.com/showthread.php?t=337066&highlight=reconstruct+ROM+nbh
and also should I just copy this line and run it as it is or do I have to change any parameters passed to this util, pmemdump.exe 0x8c000000 262144 SPL.nb
Could you please sticky this thread!
thanks
Ram

pof said:
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
I saw the post http://forum.xda-developers.com/show...struct+ROM+nbh but I don't know what to do. Should I use the indicated files from Kaiser???
What should I do with the file SPL.nb

motowiz said:
I saw the post http://forum.xda-developers.com/show...struct+ROM+nbh but I don't know what to do. Should I use the indicated files from Kaiser???
What should I do with the file SPL.nb
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=422914 from thaihugo is much easier
Thanks
Ram

Please pin this thread.
pof
Could you please pin/stick this.
Thanks
Ram

@saiweb: Done

pof said:
@saiweb: Done
Click to expand...
Click to collapse
pof
Thank you very much
Ram

Need Help.
I was able to dump all raw files except Part00.raw. I used the command prompt. Am I supposed to use another program or am I using the right one?

hey I got an error when doing the 4th raw :
"ERROR: ITReadDisk : read 00000000 bytes - Adresse de bloc de contrôle de stockage non valide."
(storage control's bloc address is not valid)
I have the 4 raws created and the 4th has the size : 37.7MB (39.583.744 bytes)
edit : sorry was stupid yesterday.... in fact the size of Part02 and Part03 were not the same as you Pof.... so I just needed to change that
well... doing it again ! in Windows 7

pof said:
To dump Shift's CE ROM use itsutils from itsme:
LIST NAND PARTITIONS
Code:
$ ./pdocread.exe -l
85.88M (0x55e0000) FLASHDR
| 3.12M ([COLOR="DarkRed"][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR="DarkOrange"][B]0x380000[/B][/COLOR]) Part01
| 41.38M ([COLOR="Olive"][B]0x2960000[/B][/COLOR]) Part02
| 37.88M ([COLOR="Teal"][B]0x25e0000[/B][/COLOR]) Part03
STRG handles:
handle c34713fe 37.88M (0x25e0000)
handle e348c912 41.38M (0x2960000)
handle c348c8ee 3.50M (0x380000)
handle 2348c71e 3.12M (0x31f000)
disk c34713fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e348c912
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c348c8ee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2348c71e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DUMP THEM!
Code:
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR="DarkRed"][B]0x31f000[/B][/COLOR] Part00.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR="DarkOrange"][B]0x380000[/B][/COLOR] Part01.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR="Olive"][B]0x2960000[/B][/COLOR] Part02.raw
$ pdocread.exe -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR="Teal"][B]0x25e0000[/B][/COLOR] Part03.raw
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
To reconstruct a ROM in NBH, use the same instructions as posted previously for Kaiser (search button is your friend)
Click to expand...
Click to collapse
I have dumped all the raw files, howere I can't reconstrct a rome in NBH by the above instructions same for Kaiser.

pof said:
To dump Shift's CE ROM use itsutils from itsme:
DUMP THE BOOTLOADER:
Code:
$ pmemdump.exe 0x8c000000 262144 SPL.nb
thanks
how can i write back spl on my gene?(hardspl ok)
$ pmemdump.exe 0x8c000000 262144 SPL.nb
Click to expand...
Click to collapse

Code:
pmemdump -p -f 0x00000000 > SPL.bin.txt
This show the bytes for my device in the text file below, I am having issues locating a decent guide to dump the bootloader. I am trying to dump the bootloader off my stock Sprint Touch Pro 2. The rest of the process in the first post was perfect for getting the RAW files, I have them split to SYS, OEM, EXT, and XIP. Now, I just need a little guidance dumping the bootloader and dumping <Part00.raw> and <Part03.raw> into useable files.
Can anyone help out on this, I have found the start length on the pmemdump.exe (simple enough, start at the beginning...I think). But in the first post, there was a number after the start length...is this the same across the board? If not, how do we determine what this number should be? How should we determine the start length? Or will starting at 0x00000000 be okay?
Feel free to PM me about this since this is not a thread for the Touch Pro2...but it has been the most helpful thread so far for dumping the stock ROM off this thing to have around for backup purposes.

Hi all.
Please help !
Anyone have the orignal dump from HTC Shift (French) ?
My hard disk crash, and I lost my DUMP...
Thank all ...

T-Mobile ROM dump problem

I have a T-Mobile compact IV with the following system:
ROM: 1.37.114.3 NLD
ROM date: 06/20/08
Radioversion:1.00.25.03
Protocolversion: 52.26a.25.09U
Before flashing another ROM I want to dump the original, using pdocread. Reading the device went OK, but the problem came with verifying. The read (pdocread -l) shows the following:
210.50M (0xd280000) DSK1:
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 110.13M (0x6e20000) Part02
| 92.88M (0x5ce0000) Part03
3.75G (0xf0000000) DSK7:
| 3.75G (0xf0000000) PART00
STRG handles:
handle 27198516 3.75G (0xf0000000)
handle 87ca38da 92.88M (0x5ce0000)
handle 07db27be110.13M (0x6e20000)
handle c7db279a 4.38M (0x460000)
handle a7db2752 3.12M (0x31f000)
disk 27198516
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87ca38da
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 07db27be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c7db279a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7db2752
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00​
A verify of Part 2 however (pdocread -w -d DSK1: -p Part02 -t) showed the following:
real nr of sectors: 1 - 512.00byte, 0x200​whereas I expected something like
real nr of sectors: xxxxx - 110.13Mbyte (0x6e2000)​
The same result was obtained when verifying the other parts.
I checked itsutils.log for a line referring to block size (e.g. STOREINFO dev='Name' store='StoreName' nsect=2dd9 bpsect=1000 free=0 maxpartsize=0), but no such line exists in that log.
What have I done wrong or should I do? I cannot now give the correct instructions to pdocread to dump the ROM.

use blocksize -b 0x800
pdocread -h XXXXX -w -b 0x800 -t
or
pdocread -d DSK1: -p Part02 -b 0x800 -w -t
willem

Thanks Willem. I tried and it works as expected.
After my post (it's alwards afterwards) I found the following thread which also mentions 0x800: http://forum.xda-developers.com/showthread.php?p=2460483#post2460483
Topic closed I'd say.

Backup hole phone ROM?

How to backup your hole Phone, (ROM)?
And how to install a ROM?
No experience with this, only with Nokia Mobiles.
Cheers,
DawnJW

I have seen a lot of people asking this, but no answers so I had a search myself.
I found this which is a 'how to' which started off fine and even sorted the 'locked issue'.
PHP:
C:\x1>pdocread -l
459.88M (0x1cbe0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 168.00M (0xa800000) Part02
| 284.38M (0x11c60000) Part03
3.80G (0xf2e80000) DSK7:
| 3.79G (0xf2a80000) Part00
STRG handles:
handle 8ffedfb6 3.79G (0xf2a80000)
handle 0feac77a284.38M (0x11c60000)
handle cffa1c2e168.00M (0xa800000)
handle 2ffa1bfa 4.38M (0x460000)
handle 2ffa1946 3.12M (0x31f000)
disk 8ffedfb6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 0feac77a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cffa1c2e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2ffa1bfa
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2ffa1946
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
However, then I came across a problem:
PHP:
C:\x1>pdocread -w -d FLASHDR -p Part00 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part01 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part02 -t
real nr of sectors: 1 - 512.00byte, 0x200
C:\x1>pdocread -w -d FLASHDR -p Part03 -t
real nr of sectors: 1 - 512.00byte, 0x200
This thread had someone with the same issue on his iPaq. I've now reached a dead end, as the solution for him won't work for me, my log is like this:
PHP:
ERROR: DeviceIoControl(FL_IOCTL_NUMBER_OF_PARTITIONS) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_BDK_OPERATION, BDK_GET_INFO) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_CUSTOMER_ID) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_UNIQUE_ID) - The parameter is incorrect.
ERROR: DeviceIoControl(FL_IOCTL_NUMBER_OF_PARTITIONS) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_BDK_OPERATION, BDK_GET_INFO) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_CUSTOMER_ID) - A device attached to the system is not functioning.
ERROR: DeviceIoControl(FL_IOCTL_UNIQUE_ID) - A device attached to the system is not functioning.
.
.
.
So, over to you.

hi there!
i also would like to dump my original rom using the hermes howto but i am having the same problem as grayme.
i am using itsutilsbin (20080313) with vista and already changed registry value HKLM\Security\Policies\Policies\00001001 from 2 to 1 on my x1.
any help is very appreciated!

I've got a bit further last night, let me have a play tonight and post where I got to.
I managed to create the raw file, and split it, but it failed on recompaction, so nearly there.

Bread Pitta said:
hi there!
i also would like to dump my original rom using the hermes howto but i am having the same problem as grayme.
i am using itsutilsbin (20080313) with vista and already changed registry value HKLM\Security\Policies\Policies\00001001 from 2 to 1 on my x1.
any help is very appreciated!
Click to expand...
Click to collapse
Sorted, you have a PM.

Hi,
I have dumped my Vodafone X1, do you have any ideas/tools to use to rebuild into a ROM or NBH file?
Thanks,
Phil Rich

[TUT] Dumping an Rhodium ROM / SPL

Stolen from udk's Jade Dumping thread
First all, thanks to Pof, here his original thread and cmonex for her orginal post here.
Download itsme's utils: http://nah6.com/~itsme/itsutilsbin-20080923.zip
List NAND Partitions
Code:
pdocread.exe -l
210.38M (0xd260000) [COLOR="DarkOrchid"]FLASHDR[/COLOR]
| 3.12M ([COLOR=DarkRed][B]0x31f000[/B][/COLOR]) Part00
| 3.50M ([COLOR=DarkOrange][B]0x380000[/B][/COLOR]) Part01
| 69.38M ([COLOR=Olive][B]0x4560000[/B][/COLOR]) Part02
| 134.38M ([COLOR=Teal][B]0x8660000[/B][/COLOR]) Part03
STRG handles:
handle e7489c1a134.38M (0x8660000)
handle 474960e6 69.38M (0x4560000)
handle c74b0fda 3.50M (0x380000)
handle 074b0eee 3.12M (0x31f000)
disk e7489c1a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 474960e6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c74b0fda
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074b0eee
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Dump Them!
Code:
pdocread -w -d [COLOR="DarkOrchid"]FLASHDR [/COLOR]-b 0x800 -p Part00 0 [COLOR=DarkRed][B]0x31f000[/B][/COLOR] Part00.raw
pdocread -w -d [COLOR="DarkOrchid"]FLASHDR [/COLOR]-b 0x800 -p Part01 0 [COLOR=DarkOrange][B]0x380000[/B][/COLOR] Part01.raw
pdocread -w -d [COLOR="DarkOrchid"]FLASHDR [/COLOR]-b 0x800 -p Part02 0 [COLOR=Olive][B]0x4560000[/B][/COLOR] Part02.raw
pdocread -w -d [COLOR="DarkOrchid"]FLASHDR [/COLOR]-b 0x800 -p Part03 0 [COLOR=Teal][B]0x8660000[/B][/COLOR] Part03.raw
The most important files are part01 (XIP) and part02 (ROM).
Dumping the SPL
Code:
pmemdump 0x9a000000 0x80000 spl.nb
As monx points out below you may need to "App Unlock" your device before pdocread will work.
Either follow his reg hack, or just use this CAB by Chainfire : http://forum.xda-developers.com/showthread.php?p=3973249#post3973249.
Have fun.
Thanks to d474rpr for testing SPL dumping
Dave

For those interested here is the extracted SPL from the Rhodium.
Rhodium SPL
enjoy!

Just an additional info. need to apply this reg :
[HKEY_LOCAL_MACHINE\Security\Policies\Policies]
"0000101a"=dword:1
"00001001"=dword:1
(Dumping with Vista SP2 x64 + WMDC6.1 with virgin Rhodium )
EDIT: Done. Will upload in case somebody want it.

Okay here is RHODIUM_WWE_ASIA_v1.19.707.1(51489)_051509_OEM_FULL

DaveShaw said:
Dump Them!
Code:
pdocread -w -d FLASHDR -b 0x800 -p Part00 0 [COLOR=DarkRed][B]0x31f000[/B][/COLOR] Part00.raw
pdocread -w -d FLASHDR -b 0x800 -p Part01 0 [COLOR=DarkOrange][B]0x380000[/B][/COLOR] Part01.raw
pdocread -w -d FLASHDR -b 0x800 -p Part02 0 [COLOR=Olive][B]0x4560000[/B][/COLOR] Part02.raw
pdocread -w -d FLASHDR -b 0x800 -p Part03 0 [COLOR=Teal][B]0x8660000[/B][/COLOR] Part03.raw
The most important files are part01 (XIP) and part02 (ROM).
Click to expand...
Click to collapse
I assume it's a stupid question - but I need to change the storage adresses according to the list of the NAND Partitions?
Thank you
CHfish

yes. follow the address shown in ur prompt windows.

monx® said:
yes. follow the address shown in ur prompt windows.
Click to expand...
Click to collapse
Thank you monx® - faster then all support hotlines

@monx:
I have a Hong Kong CHT version of the Rhodium that I would like to switch to WWE. Can I use the RHODIUM_WWE_ASIA_v1.19.707.1(51489)_051509_OEM_FULL dump you provided to do so? If so, how?
Or is there an RUU package that I can use?
Pardon my ignorance...this is my first WinMo device and I'm still learning...

@e60202
Hi friend, my dump is not a complete rom (it is just rom sources to share)
Yes, we can rebuild the rom becomes the complete one but it wont have the required signature required by stock device SPL. So, we cant flash it until our device is flashed with Rhodium HardSPL (not available yet)
To change your device rom language, it is possible. U need to create GoldCard using QMAT (if i'm not mistaken u hv to buy this for full function to create GoldCard) & Mtty. Then u can flash stock shipped (signed) WWE rom.
For more info, pls search for GoldCard or u can try ur luck to ask for cmonex further help

so i take it then... if i do a rom/spl backup of my phone and then bugger it up, i'm unable to flash the backup back to the phone ?

drawflex said:
so i take it then... if i do a rom/spl backup of my phone and then bugger it up, i'm unable to flash the backup back to the phone ?
Click to expand...
Click to collapse
If you bugger up your phone, just Hard Reset to get it back to how it was.
You dump your ROM so that after flashing custom ROMs you can go back the one your phone came with. But we need Hard SPL to flash custom ROMs as well as dumped ones.
Dave

is there actually no problem in warranty? flash new rom .. **** it up.. flash original rom.. send it in

-adrian- said:
is there actually no problem in warranty? flash new rom .. **** it up.. flash original rom.. send it in
Click to expand...
Click to collapse
Re-flash original SPL so they dunno u hv modified it

well .. never tried it before .. hope it will work with the tmobile GER branded phone
already ordered.

monx® said:
Re-flash original SPL so they dunno u hv modified it
Click to expand...
Click to collapse
Doesn't this only work though if you have a signed ROM installed. I didn't think that you could use HardSPL to install a dump and then push the OEM SPL back.

Okay here is RHODIUM_GER_v1.19.407.0(51489)_051609_OEM_FULL
the German Version

wootty2000 said:
Doesn't this only work though if you have a signed ROM installed. I didn't think that you could use HardSPL to install a dump and then push the OEM SPL back.
Click to expand...
Click to collapse
yes, you can use HardSPL to do this! (when it comes out )

cmonex said:
yes, you can use HardSPL to do this! (when it comes out )
Click to expand...
Click to collapse
I know that with HardSPL I can install a cooked ROM, but my understanding is that if I install HardSPL, then a cooked ROM and then push the OEM SPL back, the OEM SPL will fail to validate the cooked ROM and refuse to boot it
Or does the OEM SPL only do validation when flashing and not booting?

wootty2000 said:
I know that with HardSPL I can install a cooked ROM, but my understanding is that if I install HardSPL, then a cooked ROM and then push the OEM SPL back, the OEM SPL will fail to validate the cooked ROM and refuse to boot it
Or does the OEM SPL only do validation when flashing and not booting?
Click to expand...
Click to collapse
No, if you have a cooked ROM and a stock SPL it will still boot. The SPL checks signing, device id, model id, etc when attempting to flash a ROM, not booting.
Dave

I already dumped the ROM/SPL of my Rhodium according to DAVE's guide.
And I know from the guide the Part01.raw is XIP and the Part02.raw is ROM. However, what's the part00.raw and part03.raw?
And how can I put all of these raw files together to a NBH file? It's need to be NBH file before flash back, am I right?

We need the official AT&T Tilt 2 rom dump.

Can someone please, when you can..post the at&t tilt 2 rom so that any of us who should need to go back to it for various reasons can do so!
Thank You very much!!!

If there is a fairly quick & easy way to dump it, Id be happy to. My Tilt 2 should be arriving tomorrow afternoon (EST). I'd like to get an EnergyROM on it as soon as possible, but I'd be willing to take the time to dump the stock ROM if someone could point me to the tools to do so.

ROM dump & ril
Complete dump is here Thanks & credits to herg62123.
EDIT: removed extracted ril, does not seem to work with 4.47 radio

This appears to be the Fuze ROM? Are you sure you copied the right link?

I got my Tilt 2 2 days ago, I can dump it, but I have no idea how to do that.

I should have extracted mine, but I figured you party people would be on the ball already... oh well
I can't wait for it to be available to the chefs though cause I can't use my PTT button right now, and the contacts app isn't as nice as the one that was on the Tilt 2 stock (on the 6.5 manila 2.1 Rom from NRG)

beufford12 said:
This appears to be the Fuze ROM? Are you sure you copied the right link?
Click to expand...
Click to collapse
Yes it's the full Titlt2 dump. I extracted Rhodium OEM drivers, the 4.47.25.24 radio and some other stuff. This dump is strictly for those with WVGA, clearly won't run on the Fuze as is. It's 400 MB since the original NBH is included.

How can the ROM be extracted from the phone?

Just got my Tilt2 today and noticed that the shipped ROM is build 21849.5.0.63. I believe the one posted above is perhaps a slightly earlier build.
Anyone know of a resource that has dumped the AT&T official ROM? I think I am like some others where I am a little gun-shy to flash unless I have an AT&T one to fallback on in case I need to do a warranty exchange.

l3it3r said:
I can't wait for it to be available to the chefs though cause I can't use my PTT button right now
Click to expand...
Click to collapse
ae button plus finds the ptt button. You wont have the at&t ptt service obviously, but it allows you to map it to whatever you'd like

I can confirm the build is 21849.5.0.63
I have extracted the ROMfollowing the steps at http://forum.xda-developers.com/showthread.php?t=501871
Code:
\itsutilsbin-20090515>pdocread.exe -l
461.75M (0x1cdc0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.75M (0x4c0000) Part01
| 226.75M (0xe2c0000) Part02
| 227.13M (0xe320000) Part03
7.42G (0x1db000000) DSK7:
| 7.42G (0x1dac00000) Part00
STRG handles:
handle#0 0ffa9b5e 7.42G (0x1dac00000)
handle#1 2fe19f0a 227.13M (0xe320000)
handle#2 cff4c8de 226.75M (0xe2c0000)
handle#3 cff4c8ba 4.75M (0x4c0000)
handle#4 6ff4c792 3.12M (0x31f000)
disk 0ffa9b5e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2fe19f0a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cff4c8de
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cff4c8ba
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6ff4c792
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part01 0 0x380000 Part01.raw
CopyTFFSToFile(0x0, 0x380000, Part01.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part02 0 0x4560000 Part02.raw
CopyTFFSToFile(0x0, 0x4560000, Part02.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part03 0 0x8660000 Part03.raw
CopyTFFSToFile(0x0, 0x8660000, Part03.raw)
itsutilsbin-20090515>pmemdump 0x9a000000 0x80000 spl
.nb
CopyProcessMemoryToFile(00000042, 9a000000, 00080000, spl.nb)
The extracted files are sized:
Part00 3,196 KB
Part01 3584 KB
Part02 74,040 KB
Part03 137,600 KB
spl 512KB
I just want to make sure this is OK as these raw files are smaller than how big it says at the top.
I have 7-zipped the files and am sending the 112MB file to my Dropbox right now, it will take about 40 minutes to finish.
I may update this topic with the link once it is done, anyone interested please feel free to message me.

Here are the raw files:
Part00.raw
Part01.raw
Part02.raw
Part03.raw
spl.nb
It is Ultra compressed with 7-zip and available at:
::edit::
Link removed, I think I screwed up the offsets of the dump. I was wondering why the part 2 was so small.....

digitalmatrixio said:
Here are the raw files:
Part00.raw
Part01.raw
Part02.raw
Part03.raw
spl.nb
It is Ultra compressed with 7-zip and available at:
http://dl.getdropbox.com/u/62596/ATT TILT 2 ROM DUMP.7z
Click to expand...
Click to collapse
Thanks! Now the trick is to recompile into a flashable nbh file...I found a tutorial on this and will possibly try my hand at it...

pinoymutt said:
Thanks! Now the trick is to recompile into a flashable nbh file...I found a tutorial on this and will possibly try my hand at it...
Click to expand...
Click to collapse
if you look on the first page you'll the the link to where herg provides a dumped tilt2 rom. it already has the .nbh. i've downloaded it myself

noggind614 said:
if you look on the first page you'll the the link to where herg provides a dumped tilt2 rom. it already has the .nbh. i've downloaded it myself
Click to expand...
Click to collapse
The dump from Herg is build 21839 the shipped ATT build is 21849.
I am not having any luck with any of the kitchens converting the files to NBH. Maybe I'll have more luck after a good nights sleep.

digitalmatrixio said:
The dump from Herg is build 21839 the shipped ATT build is 21849.
I am not having any luck with any of the kitchens converting the files to NBH. Maybe I'll have more luck after a good nights sleep.
Click to expand...
Click to collapse
This is the tutorial I was reading through, not sure if you used the same one?
http://forum.xda-developers.com/showthread.php?t=560519

Keyboard
Can anyone verify that the keyboard layout is the same as the HTC original or will there be a need for a keyboard fix like the T-Mobs TP2 ?

mystikal87 said:
Can anyone verify that the keyboard layout is the same as the HTC original or will there be a need for a keyboard fix like the T-Mobs TP2 ?
Click to expand...
Click to collapse
will need a fix

I just tried building the nbh file and didn't have much success. Anyone else care to try?

ATT HTC Tilt 2 Keyboard
The keyboard is different. Here is a picture of it I snapped with my Fuze.