CDMA Touch Pro XIPs 20764 20771 20954 21015 21018 21028 21032 21109

[FormerPalmOS]

BE SURE YOUR SYS INCLUDES WinCENLS_WWE as this has been removed from the XIP.

Show me some thanks if you use one of these XIPs please.

EDIT 25-Mar-09: 21032 version added in 2nd post along with .RGU file to fill in some missing reg entries and remove some unneeded stuff.

EDIT 17-Mar-09: Version 8 added in 2nd post, SYS 21028, no encryption.

EDIT 14-Mar-09: Version 7 added in 2nd post without storage card encryption. +64K free virtual memory, +64K program memory. FAST!

EDIT 8-Mar-09: Version 7 loaded in 2nd post, same as others, MSXIPKernel 20771 (Thanks fr4nkl1n).

EDIT 23-Feb-09: Version 6 loaded, same fixes as 3-5 using MSXIPKernel 21018. Thx to Drellisdee for pointing me in the direction for this version.

EDIT 17-Feb 09: Version 5 loaded, same fixes as versions 3 and 4, using 21015 MSXIPKernel for use with 21015 SYS. FWIW, 21015 is definitely faster / more responsive than 20954. I'd say it's on-par with 20764. Not sure if 21015 of 20764 is faster, but 21015 does include a newer IE and Adobe Flash.

EDIT 16-Feb-09: Version 4 loaded, same fixes as version 3 (same boot.rgu). 20954 MSXIPKernel for use with 20954 SYS.

2E = 21109 (has been tested now)
3E = 20764
4E = 20954
5E 21015 = 21015
6E 21018 = 21018
7/7E 20771 = 20771
8 21028 = 21028

EDIT 5-FEB-09: Version 2 updated with fixes in version 3. Still 21109 sys. New os.nb.payload attached. I HAVE NOT TESTED THIS YET (too happy with my current ROM to re-flash). If you use it successfully, please let me know. NOTE - you will need the .ROM and .VM and boot.rgu files from the 3E folder so download both - the 2E folder contains ONLY os.nb.payload.

List of changes vs. stock Verizon 19998 XIP:

1. Removed wince.nls from XIP - make sure it is in your SYS if cooking with this XIP
2. Removed DSMs for LangDB and MSXIPKernelLTK (both empty)
3. Compressed out XIP free space, increased free ram in ROMHDR.TXT. Note - to take advantage of this you have to also make changes in the .ROM and .VM files in your SYS. I've attached the changed files here. More info can also be found in post 68 of this thread.
4. Changed EncryptByDefault to 0 in boot.rgu. Changes to enable disk meta-data cache (system-managed sizes) and file filter cache.
5. Removed htcfilter, relfsd and fsdspy
6. Updated OEMXIP DSM for removed files from ver 1E
7. Updated os.payload.nb with new partition table and MSFLSH50 header based on smaller size XIP.
8. Default pagepool set to 10MB.

Feel free to provide any feedback.

- - - - - - - - - - - - - - - - - - -

One of the issues I have with some of the latest 21109 ROMs is that it seems somewhere someone thought removing cachefilt.dll and mencfilt.dll from the XIP was a good idea. I need storage card encryption - that is a showstopper for me. Plus, IMHO the file cache filter is a good thing, not a bad thing, if it's configured properly (which it wasn't). The encrypting filter will slow things down if it doesn't have a small data cache to work with. So I decided to change this, and port the XIP to 21109 SYS files at the same time.

Now, pause for thanks to those who deserve it:
1) scrosler - His VZNAV3 beta 2 ROM was good enough without this new XIP to show me how much nicer this phone can be than what Verizon ships us. http://www.scottcrosler.com
2) calku - His sys files are pretty good
3) ervius at xda-developers (porting tools)

DISCLAIMERS:
I have a day job. I will try to answer questions about this, but no guarantees. Also, this was intended for and tested ONLY on a Verizon CDMA Touch Pro. Might work on Sprint. Most likely WILL NOT work on a GSM Touch Pro and definitely WILL NOT WORK on any other phone model. If you ask about other phones, I will not answer and will instead direct you to read the first post (if someone doesn't beat me to the response).

Each file contains a ROM directory with os.payload.nb file, and a matching XIP sub-directory with matching boot.rgu. Make sure you replace the entire ROM directory!.

There is also a SYS folder with new .ROM and .VM folders. Replacing these will allow your builds to take advantage of a little extra virtual memory space (not to be confused with program memory) - make sure your kitchen runs G'Reloc.exe. Note - replacing the SYS files is not necessary but is recommended (save your originals in case you need to revert).

If you are successful with cooking with this XIP, your start-up screen and ROM version on the device information page will show 1.FPOSXIP.2E (or 3E or 4E) as the version number.

SD Card Encryption - My XIPs with an E in the version number include mencfilt.dll but default to NOT encrypt. You can enable it by going to Settings -> System -> Encryption. If you don't see the encryption control panel aplet, go to HKLM\ControlPanel\Encryption\Hide and change it from 1 to 0 (One of Scott's ROMs had it set to hide this).

The encryption key is generated every time you hard-reset. After a hard-reset (or ROM flash), everything that was saved encrypted on your card will be un-recoverable. Stuff that was never encrypted in the first place will be unaffected.

Versions 7 , 8 and 9 (no E) do not implement encryption.

[FormerPalmOS]

Reserved for additional download space and bug list / change request.

As of 25-Mar
Versions 7 - 9 (non-E) may cause flickering icons for programs installed after boot (i.e. not cooked into a ROM). This happens with some SYS and not others. The problem can usually be fixed by one or both of the following:

1) Change the attributes of the shortcuts in \Windows\Start Menu\Programs to read-only

2) Apply the .RGU attached below

This problem does NOT seem to occur with the versions that include encryption - likely due to a difference in the way the file system filter stack-up is instantiated in boot.hv.

Note - if you use the .VM file in the versions 7-9 (non-E) XIP, you will gain about 64K of virtual memory (room to add more modules). Use ONLY with versions 7-9 non-E XIP - will break any other XIP. The version 7-9 (non-E) XIPs will also give you 64KB more program memory, even if you don't change your .VM file.

As of 23-Feb - No changes requested.

25-Jan Version 2 Change requests:

Bug list:
Ver 1 and 2 (broken versions no longer posted) - Phone Settings page gets stuck there - settings stick, but clicking OK doesn't take you out of the page. Cause - missing boot.rgu entries for Lockstream DRM.

17-Jan Version 1 Change requests:
Make version without mencfilt.dll (remove module, reallocate, see if can free any RAM, remove associated boot.rgu entries) - will do if time
Default to no encryption - done
Run pagepool changer patch and no cert patch - pagepool changer patch done, did not do no cert patch

[Mr. X]

it is a good idea to remove this from the xip. u know what would have been 789643298576329486523984% easier?

use those dlls in a OEMXIP Package rather then reinventing the wheel in putting them back into the xip. they are taken out to save space. that way if u need it u add it to the OEM XIP package... if you dont then you dont.

oh yah. patch the PP string in the payload, and no cert patch it. if your going to do the xip might as well patch it correctly so users can take full advantage of it.

[FormerPalmOS]

Originally Posted by Juggalo_X

it is a good idea to remove this from the xip. u know what would have been 789643298576329486523984% easier?

use those dlls in a OEMXIP Package rather then reinventing the wheel in putting them back into the xip. they are taken out to save space. that way if u need it u add it to the OEM XIP package... if you dont then you dont.

oh yah. patch the PP string in the payload, and no cert patch it. if your going to do the xip might as well patch it correctly so users can take full advantage of it.

You've built many more ROMs than me - so some additional explanation here would help. Here's my understanding - correct me where I'm wrong. My two goals for this XIP were to a) re-enable file filter cache and b) re-enable storage card encryption. For some reason (don't know - just going by MS suggestion), mencfilt.dll must load on every FAT file system or it won't work. I confirmed this by trial and (many) errors. That means it has to load in the XIP - can't load after boot. Same with cachefilt - it should be applied to the root filesystem and should therefore also be loaded in the XIP. The XIP modules must be individually located within the XIP address space, with a specific order for one particular module. The addresses for the module code, constants and data must all be allocated so there are no overlaps. Once complete, the whole thing is turned into one image and stored in the XIP section of the NAND. At boot this is copied into RAM and executed. It proceeds to load the actual OS.

So I don't know what an OEMXIP is - unless you are referring to the OEM modules which are device-specific (I extracted these from the verizon Stock ROM XIP dump) and are combined with the new 21109 MS modules which are not device-specific - the sum of the two is the device-specific XIP. But regardless of where the mencfilt.dll and cachefilt.dll are placed (OEM or MS) the module memory allocation process and XIP image building, etc. must still be done.

Now if there is an easier way to do this (can't imagine a much harder way), then I'm all ears!

On the no cert patch and pagepool patch - the pagepool patch as-is would enable the pagepool changer to work (probably) - I didn't try it that way, preferred my way (though at 4am maybe not for any good reason). No idea what the no cert patch is for - I didn't do it and haven't run into anything I can't do as a result. What is the patch, what does it do? (Yes I know I could search the threads but as it stands I don't have a need for this and will therefore not take the time to do so until said need arises).

Thank you.

[FormerPalmOS]

EDIT - THIS POST IS DEPRECATED. You shouldn't be using one of the release 1 posts.

How to change the pagepool size (version 1 only - not needed for version 2 - use the pagepool_changer application):

1. Open os.payload.nb in a hex editor (I use XVI32)
2. Go to address 0x7A0E0. Verify you see the following hex string: 03 15 A0 03 03 15 A0 13
3. Change the 03s shown above in bold to 1/4 of your desired pagepool. Or change 03 15 to nn 16 where nn is 1/4 the pagepool size in MB. For example, to go for 8MB, change to 02 15. To go for 9MB, change to 09 16. Change both instances.
4. Save and re-cook.

Note - I have not tested this - but it should work as described. Here is the code in NK.EXE in the XIP that is being changed (note the addresses below are NOT the same addresses in os.payload.nb):
0005a06c: e59f3758 ldr r3,#0x5a7cc ; = #0xba0810c0 ; Load R3 with 0xba0810c0
0005a070: e59f0750 ldr r0,#0x5a7c8 ; = #0x80006b90 ; Unrelated register load, might be used in called sub
0005a074: e5933000 ldr r3,[r3,#0] ; Load R3 with data at address 0xba0810c0 + 0x00
0005a078: e3530c01 cmp r3,#0x100 ; Compare R3 with value of 0x100
0005a07c: e59f3740 ldr r3,#0x5a7c4 ; = #0x803d6350 ; Load R3 with 0x803d6350 (pointer to PP size constant)
0005a080: 03a01503 moveq r1,#0xc00000 ; If R3 compare was equal, load R1 with 0value xC00000
0005a084: 13a01606 movne r1,#0x600000 ; If R3 compare was not equal, load R1 with value 0x600000
0005a088: e5831000 str r1,[r3,#0] ; Store R1 at address 0x803D6350 (location of PP size)

This is how it was stock. In the os.payload.nb I changed the 600000 to C0000. This could be patched to allow the pagepool changer app to work, but I trust this more.

[scrosler]

Originally Posted by FormerPalmOS

How to change the pagepool size:

1. Open os.payload.nb in a hex editor (I use XVI32)
2. Go to address 0x7A0E0. Verify you see the following hex string: 03 15 A0 03 03 15 A0 13
3. Change the 03s shown above in bold to 1/4 of your desired pagepool. Or change 03 15 to nn 16 where nn is 1/4 the pagepool size in MB. For example, to go for 8MB, change to 02 15. To go for 9MB, change to 09 16. Change both instances.
4. Save and re-cook.

Note - I have not tested this - but it should work as described. Here is the code in NK.EXE in the XIP that is being changed (note the addresses below are NOT the same addresses in os.payload.nb):
0005a06c: e59f3758 ldr r3,#0x5a7cc ; = #0xba0810c0 ; Load R3 with 0xba0810c0
0005a070: e59f0750 ldr r0,#0x5a7c8 ; = #0x80006b90 ; Unrelated register load, might be used in called sub
0005a074: e5933000 ldr r3,[r3,#0] ; Load R3 with data at address 0xba0810c0 + 0x00
0005a078: e3530c01 cmp r3,#0x100 ; Compare R3 with value of 0x100
0005a07c: e59f3740 ldr r3,#0x5a7c4 ; = #0x803d6350 ; Load R3 with 0x803d6350 (pointer to PP size constant)
0005a080: 03a01503 moveq r1,#0xc00000 ; If R3 compare was equal, load R1 with 0value xC00000
0005a084: 13a01606 movne r1,#0x600000 ; If R3 compare was not equal, load R1 with value 0x600000
0005a088: e5831000 str r1,[r3,#0] ; Store R1 at address 0x803D6350 (location of PP size)

This is how it was stock. In the os.payload.nb I changed the 600000 to C0000. This could be patched to allow the pagepool changer app to work, but I trust this more.

I had no issues changint he PP from 12 to 9. What are you two talking about? I dont get it? Or did you fix the XIP and re-up?

Also My sys files are fixed. Grab SSK 1.1

[scrosler]

DAMN! Encryption just ruined my day.

EDIT: Can you take the time to post a cab to default it OFF please? Or tell me where in the reg to look so I can cook it in.

EDIT2: Is this it:

[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\E NCFilt]
"EncryptByDefault"=dword:0

[FormerPalmOS]

Originally Posted by scrosler

DAMN! Encryption just ruined my day.

EDIT: Can you take the time to post a cab to default it OFF please? Or tell me where in the reg to look so I can cook it in.

EDIT2: Is this it:

[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\E NCFilt]
"EncryptByDefault"=dword:0

The above might work, but to be absolutely sure, un-hide the control panel aplet (HKLM\ControlPanel\Encryption\Hide=0) then un-check it there. It will default to encrypted in my XIP, but you can add the above to your .rgu in _scrosler and that should over-ride the XIP. The SDMemory profile isn't loaded during boot - only after OS load - so you should be able to change settings for SDMemory without changing the XIP.

The kicker with encryption is how well it works. If you save stuff to your storage card via ActiveSync or via the WM6 device in any way, and encryption is enabled, it is encrypted using a unique key stored on your device and re-generated with every hard reset (or re-flash). If you use an external reader/writer to write to the card (I have a Micro-SD to SD adapter and use that to read-write stuff I don't want encrypted like cab files) then those remain unencrypted.

As for removing it, the way I am doing this requires moving each and every DLL module loaded in the XIP - you have to move each one to a new address. It's a somewhat manual process that takes time. Granted, just removing it (and the associated registry keys and re-compiling boot.v and re-building XIP and re-inserting it into os.payload.nb) doesn't involve re-allocating addresses - OK to just leave a gap. But removing it wouldn't make the XIP space any smaller - so you really wouldn't buy anything by removing it. This is my understanding - those with more XIP experience may disagree.

By all means feel free to use this in future kitchens - but make the above changes in the .rgu file in _scrosler (unhide the control panel aplet and default it to not encrypt) so folks can see the control panel aplet and check / uncheck it as they please. I've made the change to default to not encrypt by default in my local copy - if I do this again, I'll do it to default to no encryption.

[scrosler]

Originally Posted by FormerPalmOS

The above might work, but to be absolutely sure, un-hide the control panel aplet (HKLM\ControlPanel\Encryption\Hide=0) then un-check it there. It will default to encrypted in my XIP, but you can add the above to your .rgu in _scrosler and that should over-ride the XIP. The SDMemory profile isn't loaded during boot - only after OS load - so you should be able to change settings for SDMemory without changing the XIP.

The kicker with encryption is how well it works. If you save stuff to your storage card via ActiveSync or via the WM6 device in any way, and encryption is enabled, it is encrypted using a unique key stored on your device and re-generated with every hard reset (or re-flash). If you use an external reader/writer to write to the card (I have a Micro-SD to SD adapter and use that to read-write stuff I don't want encrypted like cab files) then those remain unencrypted.

As for removing it, the way I am doing this requires moving each and every DLL module loaded in the XIP - you have to move each one to a new address. It's a somewhat manual process that takes time. Granted, just removing it (and the associated registry keys and re-compiling boot.v and re-building XIP and re-inserting it into os.payload.nb) doesn't involve re-allocating addresses - OK to just leave a gap. But removing it wouldn't make the XIP space any smaller - so you really wouldn't buy anything by removing it. This is my understanding - those with more XIP experience may disagree.

By all means feel free to use this in future kitchens - but make the above changes in the .rgu file in _scrosler (unhide the control panel aplet and default it to not encrypt) so folks can see the control panel aplet and check / uncheck it as they please. I've made the change to default to not encrypt by default in my local copy - if I do this again, I'll do it to default to no encryption.

The key I posted was good. I checked it and removed the hide encryption entry. All was well.

[scrosler]

Originally Posted by scrosler

DAMN! Encryption just ruined my day.

EDIT: Can you take the time to post a cab to default it OFF please? Or tell me where in the reg to look so I can cook it in.

EDIT2: Is this it:

[HKEY_LOCAL_MACHINE\System\StorageManager\Filters\E NCFilt]
"EncryptByDefault"=dword:0

I realized that this was in boot.rgu! DOPE! Stupid me! Changed it there and received the results I desired.