Buzzdev.org

Here is quite easy way to change the bootsplash image on Universal (MDA Pro, Qtek9000, Dopod 900, O2 Exec).

WARNING!
This procedure and tools applies to UNIVERSAL device only!!!
If you do the same on other devices, you can permanently damage them.

What we need

• bootsplash image prepared in RSB format
• UNI_splash.rar
• EnableRapi.cab
• ActiveSync

Info

The whole procedure is quite simple and safe, if you will not modify batch files in UNI_splash.rar package. These batch files are provided for your safety and convenience. So you don’t have to type the commands and offsets manually.

All you need to do, is to prepare the new splash image properly and execute the batch.

That’s it. On next reboot, you’ll see your new bootsplash, shining on your display.

Setup

• install EnableRapi.cab on your device
• unpack UNI_splash.rar on your desktop PC
• make sure you have working Active Sync connection (works also over Bluetooth)
• locate your converted and prepared splash.rsb

Usage

This is no program, it is just a simple MSDOS batch file. It works in two steps.
First, it will create a backup of your existing splash in .rsb format.
Second, it will write your new splash into the ROM.

UNI_splash.bat takes two input parameters:
UNI_splash.bat newsplash backupsplash
Don’t use spaces in filenames.
Don’t use special characters.

You can also run it without any parameter. In that case it will save splash backup as c:splash_backup.rsb and it will assume, that your new splash is c:new_splash.rsb.
If c:new_splash.rsb doesn’t exist, default splash will be flashed.

That’s it. You just have to reboot now. :o)

Your coments are welcome

What we need

• nice picture, which will become our bootsplash
• bitmap editor XnView (MS Paint is just fine)
• rsbbmp conversion tool

Info

Bootsplash image is a bitmap picture in RSB format just without RSB header. What we gonna do, is to convert .bmp image to .rsb, which is a format suitable for writing splash bitmap into the ROM.

Preparing new bitmap picture

If you did change your splash before, on your previous device, you might find it a little bit confusing, that splash image and the display is landscape oriented, however, splash is actually portrait oriented and saved in the ROM.

So open your favourite picture in the bitmap editor and scale it or crop it to EXACTLY 640×480 pixels in size.

Then rotate the picture 90 degrees to the right to have it portrait oriented.

Save it as .bmp 24bit format.

Converting new picture to RSB

Start rsbbmp tool.
Click AddFiles and choose your new splash bitmap.
Click Convert All.

Check in XnView, if the bitmap was correctly converted to .rsb format.

That’s it.

Now you are ready to write you very own, customized bootsplash into the ROM.

HERE’S HOW

Comments are welcome.

Here are some bootloader commands to dump parts of HTC Universal ROM.

Security level check

Before you can do any dumps off of your device, you must first pass the security check. You need to issue this command before any set of “d2s” commands.

task 32

Typical output looks like this:

USB>task 32
SD:Waiting for card insert.........

CMD3 for SD, it's OK, ready to get RCA from response.

SD:Detected one card

SD:ready for transfer OK

d.total_lba=F1F00
d.block_size=200
d.RCA=80CA
d.drv_type=40000000
d.busWidth=1
Total card size=1E3E0000

Level = FF

If the last line of output is Level=00 you are OK and your device is so called SuperCID device and you are allowed to dump the ROM content.
In case you’ll get Level=FF, you need to make your device SuperCID (see below).

Dump Bootloader

d2s 70000000 80000

OS ROM + splash

d2s 70100000 3FA0000

XtendedROM

d2s 74100000 A00000

Radio ROM

d2s 60000000 a24200

If you want to have them all on single SD card, you must add “sd a” at the end of each command except the first one.

OS ROM + Xtended ROM + Radio

d2s 70100000 3FA0000
d2s 74100000 A00000 sd a
d2s 60000000 a24200 sd a

Which program you use to do this?

We use good old mtty.exe version 1.16
mtty116 (64) - 15.18 kB

Important notice

Never copy & paste commands into mtty.exe. You always have to write it down there.
Use mtty.exe version 1.16, newer versions (1.42) are not working properly.

There are some devices, where the commands above are locked and you always get “Not allow operation” as response.
For these devices you have to use Universal SIM unlocker first, which will also unlock the CID of your device.

I can see, that many of you can’t install splash screen to HTC Himalaya device.
Here’s how to do it:

1. 1. Install Extended ROM Unlocker
2. 2. Unhide Extended ROM
3. 3. Reset
4. 4. Unlock Extended ROM
5. 5. Install your splash
6. 6. Reset

That’s it.

It doesn’t matter, if you ran DOC_Tools or not.
You MUST UNHIDE and UNLOCK your ExtendedROM.
Otherwise, splash will NOT install.

Currently there are no Application available to backup your
Personal Information Manager even the builtIn xBackup will not make it
possible
“;”
But there is a way to BACKUP your whole Device .. i once describe it here

WM2005: Weird way to Backup Your Data under MAGNETO

but what if you want only the Contacts and Appointments .. and need it
badly so incase a hard reset will needed to be done .. you can restore
your contacts and Appointments without any problem .. and you know what
it is very SIMPLE.. :)

heres how to Manually Backup your PIM to SD card..

1. Open built-in FILE EXPLORER, you cannot use Resco File explorer in this
2. Go to Root Directory of your device
3. Then copy pim.vol, if not visible just tap Menu then Show All Files
4. Then paste the pim.vol to your SD/MMC card, pim.vol will be your Backup Files ..

Now heres how to Manually Restore your PIM

1. Open File Explorer or Resco File Explorer
2. Go to Root Directory of your device
3. rename pim.vol to something else like pim8.vol, pim.old or anything
4. then Copy the pim.vol that you have from SD/MMC, or the pim.vol that contain the contacts
5. then Perform a soft reset using a Soft Reset Utility Program, dont use the Reset Button ..

Thats it .. you manually BACKUP and RESTORE your PIM ..

:)

Important Note:

okih GUYS .. heres my instruction .. i believe buzz will create a UI
for his wonderful Hima_DOC_Tool … its a lot better and a lot easier
to restore the old partition using that option best part is even you
lost your SD backup of DOC .. you can still use that application to
restore the OLD Partition..”;”

anyway for the MEANTIME heres the very long Method on how to restore your Partition using your OLD SD backup ..

for those WHO HAVE THERE ORIGINAL DiscOnChip SD ROM BACKUP ONLY ..

1. Kill or End Processes of wcescomm.exe under Windows Task Manager (Ctrl+Alt+Delete)
2. Put Your device in Bootloader mode (Power+Directional Pad+Reset)
3. Put the Device in your Cradle Then Run Multi-Port TTY (mtty.exe or romupdate.exe)
4. On the ListBox choose .WCEUSBSH001 if you are using mtty v1.11a or USB if newer(like version 1.42)
5. under the Multi-Port TTY Window enter this command ….. task 28
6. Then Remove the Device in your Cradle
7. Then Now put your SD that contain the SD backup ..
8. Put Your Device Again in Bootloader (Power+Directional Pad+Reset)
9. Wait till you see the Message Saying PRESS Power to Flash, Then
   Press power Button, If it didnt respond and the message is not Showing
   just, Press Camera Button

now for those who lost their SD backup heres the instruction ..

• Kill or End Processes of wcescomm.exe under Windows Task Manager (Ctrl+Alt+Delete)

• Put Your device in Bootloader mode (Power+Directional Pad+Reset)

• Put the Device in your Cradle Then Run Multi-Port TTY (mtty.exe or romupdate.exe)

• On the ListBox choose [b]\.\WCEUSBSH001[/b] if you are using mtty v1.11a or [b]USB [/b]if newer(like version 1.45)

• Put a Blank SD/MMC in your Device SD slot

• under the Multi-Port TTY Window enter this command .. d2s 70000000 01080000

• after this dont remove your Device in the cradle, now use
  PSDread.exe to extract the Binary0: or the first 80000h bytes + the SD
  Header

if your using bootloader 1.01 to 1.06 heres the command
psdread.exe i: 0 0x0008019C DOC_Binary0.img

if your using lowerthan bootloader 1.01 (1.01 is not included) use this
psdread.exe i: 0 0x000801DC DOC_Binary0.img

• now Download the DOC_Fat0.img and extract on the same location that you put DOC_Binary0.img

• Open the Command Prompt (Start->RUN->type CMD then Enter)

then type this
type DOC_Binary0.img>DOC.img
type DOC_Fat0.img>>DOC.img

• Now Ntrw the Doc.img to your SD, put your SD to your Card Reader

and under the DOS Command Prompt use this command
NTRW.exe Write DOC.img i:

• Back on the Multi-Port TTY Window enter this command

task 28

• Then Remove the Device in your Cradle

• Then Now put your SD that contain the SD backup ..

• Put Your Device Again in Bootloader (Power+Directional Pad+Reset)

• Wait till you see the Message Saying PRESS Power to Flash, Then
  Press power Button, If it didnt respond and the message is not Showing
  just, Press Camera Button

Introduction

Background of the IDEA

TOOLS

• Multi-Port TTY (any version will do)
• NTRW.exe version 2.0
• SD/MMC(minimum of 16MB will do but i recommend 64MB so you can backup everything including the OS)
• PSDREAD.exe (optional)
• PSDWRITE.exe (optional)
• Panasonic SD Formatter v1.1 (optional)

PROCEDURES

I. BACKUP

1. Kill or End Processes of wcescomm.exe under Windows Task Manager (Ctrl+Alt+Delete)
2. Then Run Multi-Port TTY (mtty.exe or romupdate.exe)
3. On the ListBox choose .WCEUSBSH001 if you are using mtty v1.11a or USB if newer(like version 1.45)
4. Under the Windows enter the following command to Backup the OS and the Data (Minimum SD size 64MB)

For 1.60a, 1.50f.01FRE, 1.50f.00WWE(Gora’s Device)

• d2s 71080000 00EA0000
• d2s 80040000 01FC0000 sd a

For 1.50f.blWWE, 1.50g, 1.50h, 1.50i.64

• d2s 94000000 04000000
• d2s 80040000 01FC0000 sd a

For 1.50i.96

• d2s 96000000 02000000
• d2s 80040000 01FC0000 sd a

For 1.50i.32

• d2s 92000000 06000000
• d2s 80040000 01FC0000 sd a

But you can only Backup the Actual ROOT Files System and Disregard the OS Rom by doing only the command (d2s 80040000 01FC0000 sd a is optional, it will backup your OS rom as well, i recommend you to do it but not including this command will also work)

For 1.60a, 1.50f.01FRE, 1.50f.00WWE(Gora’s Device)

• d2s 71080000 00EA0000

For 1.50f.blWWE, 1.50g, 1.50h, 1.50i.64

• d2s 94000000 04000000

For 1.50i.96

• d2s 96000000 02000000

For 1.50i.32

• d2s 92000000 06000000

II. Saving the Backup in your PC

• NTRW.exe -> this is the most popular method to command is

ntrw.exe read backup.img i:

whereas

i: is the Drive letter of SD/MMC Card Reader

backup.img is the output file location and file to be contain the backup

the
problem with this tool is it will extract the entire Binary Disc Image
of your SD/MMC to your PC, depending how big your SD/MMC the
extracted backup.img will be the same as big as your SD/MMC ex. 1GB SD will create a 1GB backup.img

• PSDREAD.EXE -> is
  more advanced way of extracting the Binary Disc Image in your SD/MMC.
  You can choose the legth of the Image will be extracted and when to
  start.

heres the Syntax Usage of Psdread.exe

 Usage: psdread [-DSKNR | drive:] start [ length [ filename ] ]
-t     : find exact disk size
-l     : list all diskdevices
-3   is the disknr of the sdcard on the xda2/himalaya
-1   is the disknr of the sdcard on the xda1/wallaby

if the filename is omitted, the data is hexdumped to stdout
if no length is specified, 512 bytes are printed

For 1.60a, 1.50f.01FRE, 1.50f.00WWE(Gora’s Device)

• 0x0000019C -> SD Header
• 0x00EA0000 -> Storage Memory
• 0x0000001C -> Append Header
• 0x01FC0000 -> OS ROm
• 0×00000004 -> HTCE (4bytes)

So the Command will be

psdread.exe i: 0 0x2E601BC backup.img

For 1.50f.blWWE, 1.50g, 1.50h, 1.50i.64

• 0x0000019C -> SD Header
• 0×04000000 -> Storage Memory
• 0x0000001C -> Append Header
• 0x01FC0000 -> OS ROm
• 0×00000004 -> HTCE (4bytes)

So the Command will be

psdread.exe i: 0 0x5FC01BC backup.img

For 1.50i.96

• 0x0000019C -> SD Header
• 0×02000000 -> Storage Memory
• 0x0000001C -> Append Header
• 0x01FC0000 -> OS ROm
• 0×00000004 -> HTCE (4bytes)

So the Command will be

psdread.exe i: 0 0x3FC01BC backup.img

For 1.50i.32

• 0x0000019C -> SD Header
• 0×06000000 -> Storage Memory
• 0x0000001C -> Append Header
• 0x01FC0000 -> OS ROm
• 0×00000004 -> HTCE (4bytes)

So the Command will be

psdread.exe i: 0 0x7FC01BC backup.img

Whereas:

i: is the Drive letter of SD/MMC Card Reader

0 is the starting offset (0 means begginning of the SD)

0x2E601BC or 0x3FC01BC or 0x5FC01BC or 0x7FC01BC is the length of Actual Backup

backup.img is the output file location and file to be contain the backup

III. Writing Back to SD

• NTRW.exe -> this is the most popular method to command is

ntrw.exe write backup.img i:

whereas

i: is the Drive letter of SD/MMC Card Reader
backup.img is the file containing the backup

if will return an Error but dont panic it is just normal

• psdwrite.exe -> this is the most popular method to command is

psdwrite.exe i: backup.img

whereas
i: is the Drive letter of SD/MMC Card Reader
backup.img is the file containing the backup

IV. Restoring the Backup

• Go to Bootloader Mode By pressing and Hold the Following Buttons

1. Power Button
2. Directional Pad (Action Button)
3. Reset Button

• After Seeing the Serial v.106(version depending on your device) insert the SD that contains the backup
• Wait till you see the Message Saying PRESS Power On to Continue, Then Press power Button
• If it didnt respond and the message is not Showing just, Press Camera Button

The most important role of Bootloader is thru FLASHING both using himaupgradeut.exe(nbf), “l” and “lnb” command in mtty.exe or even with SD Flashing (backup first your ROM in your SD/MMC with mtty.exe).

We use also Bootloader for other stuff like reading/writing the content of ROM and RAM. We use it for Backuping the ROM and some other stuff thats beyond the OS enviroment.

Technically there is no reason for changing your bootloader. Almost all bootloader performs as it with other bootloader.

But like the OS update, some bootloader is is not compatible with newer or even older ROM upgrade utility and need to be change if needed.

“;”

Currently there are Six ways to Change your BOOTLOADER in your GOOD old HIMALAYA but i’ve only tried four methods .. and to be exact none of them is safe ..

First Method is Changing thru nbf(HimaUpgradeUT.exe) - ALL nk.nbf contains a BOOTLOADER but some nbf has an emptied/Blank portion for bootloader and can cause for a brick device. But technically by default our devices is set to skip the bootloader during FLASHING. I really dont know how exactly but some upgrade can really change your bootloader (but only in HIMALAYA and BlueAngel Type I ROM, in Magician, BlueAngel Type 2 ROM and Alpine .. you can modify the nk.nbf to also write the bootloader but this method is the most dangerous of ALL method).. :)

Second Method is thru BootBlaster - ByteBlaster is design for changing the bootloader of Ipaq. I havent try it so i cannot make sure if this can really change the bootloader of HIMALAYA

Third Method is thru JTAG - technically it should be the safest method cause changing the bootloader is thru communicating to the chip itself so if you made it incorrectly then you can repair it again (unlike in other way that if you made mistakes once you already brick the device) but still it is the most dangerous way since you can totally damage the device. DO this only for the last resort

Fourth Method is thru mtty.exe(or Romupdate.exe) - in mtty.exe there are two commands you can use to change your bootloader

• thru “l” command (not i but small Letter L) – but you need a B000FF .bin files to do this, the command is just typing this in mtty.exe window:

l c:bootloader.bin

• thru “lnb” command – in this command you need now a RAW binary files of Bootloader the extension is sometimes use as .raw, .bin(raw), .nb0 or .nb, bootextract.exe can get a raw binary files of Bootloader in your device. The command is :

lnb c:bootloader.nb 80000000 00040000 0

For other Bootloader Commands and its function. Click Here

Fifth Method is thru SD ROM Flashing - yes SD Flashing cannot only backup your OS ROM, Extended_ROM and Radio ROM, but it can Also backup your BOOTLOADER and as a matter of fact it can backup everything in your device and YES can overwrite it aswell. In Order to backup your bootloader in HIMALAYA you have to make this command in mtty.exe

d2s 80000000 00040000 -> Backup bootloader only

or

d2s 80000000 02000000 -> Backup Bootloader + OS Rom (HIGHLY RECOMMENDED)

for a Detailed Explanation on how this works Click here

Sixth Method is thru itsme’s PNEWBOOTLOADER.exe - this method is definitely the easiest and fastest method. Not to consider the safest method of all (but still DANGEROUS). Currently the pnewbootloader.exe is compatible to the following Device with the FOLLOWING OS ROM version installed.

WALLABY with any of the following OS installed
3.04.00 ENG

3.16.52 ENG

3.17.03 ENG

3.18.04 ENG

3.19.01 GER

4.00.10 ENG

4.00.01 ENG

4.00.05 ENG

4.00.16 ENG

4.01.16 ENG

HIMALAYA with any of the following OS installed
1.60.00WWE

1.52.00WWE

1.66.00WWE

1.66.01GER

1.72.00WWE

MAGICIAN with any of the following OS installed
0.68.00 WWE

1.00.00 WWE

1.03.00 WWE

1.12.00 WWE