|
||||
|
Helmi's been really busy with work lately, he's disappointed that he doesn't have time for his hobby. he's already looked at some interesting things, but with little free time it might be a bit before something huge.
__________________
Note: 3 Color screen is stuck in bootloader NOT "bricked"; just flash a stock rom exe
Touch Custom rom unlocker Undoing advances in Mogul's since 2007. Titan ReLocker, WM5 roms (don't use w/ gps radio): Telus, TNZ |
|
||||
|
ok now i am having trouble extracting the XIP with rommaster. I am currently using ver 2.3 but it looks like there isnt wm6 support and keeps exiting because the end of the xip is past the end of the rom
|
|
||||
|
Quote:
no2chem, imcokeman, anyone else interested/who has the knowledge... i have had some success dumping, modifying, rebuilding maps, and repacking xip.bin using coredll.dll from other device ROMs using xipport. there are a couple of versions of xipport out there. some (the author) say that the newer xipport will correctly update tables and update nk.exe automatically using the reloc p function. some say that it will update imageinfo.txt correctly for each module, but you then must reference that to rebuild the maps by hand before outputting xip_out.bin. i can do this no problem. really, at this point, i THINK i have an xip_out.bin that works and contains the aku 0.4.4 kernel. the problem i have now, is reinserting the new xip into my os image. xipport allows me to write xip_out.bin to a certain address in nk.nb (or any file). now maybe its because ive been staring at this stuff for hours, but i am confused on 2 things: how can i find the start address of the xip in my os image? do i want to be writing this into the full os.nb, or should i split os.nb and write into (os.fat / nk.nb / os.nb.payload / how many different things do we call the os image without the device specific headers?) i believe that it wont matter whether i put into os.nb or os.nb.payload as long as i find the proper start address to insert to. no2chem i am not sure if you have played with xipport much, and imcokeman im not sure if you've gotten into xip at all, and im not sure if anyone else with xipport clue is lurking, but this seems to be the most relevant thread at this time.. |
|
||||
|
The xip location to replace with is 00320000, but it looks like you have to manually extract the xip from that location first (not use rommaster). Replace it into the complete OS.nb.payload (after the "headers" or extra bytes are removed) BTW the headers are everywhere so this location would not be the same if they were present as well as you would be inserting and overwriting the headers where the new xip is, but the rest of the area would have headers that would probably mess everything up.
I would only do this mod on a stock rom OS.nb for now as i think no2chem was seeing odd errors earlier when using a custom. Last edited by ImCoKeMaN; 10-28-2007 at 11:18 PM. Reason: updated address and directions |
|
||||
|
edit: ppcgeeks quote button is possessed
thanks very much for the good info eric. i had wondered whether the headers were clumped at the beginning or throughout as you describe. i really wish i had the assembly knowledge to look at this at a lower level, but maybe xipport will handle it so i dont have to. has no2chem had success with inserting xip into a stock rom? Last edited by dcd; 10-28-2007 at 12:46 PM. |
|
||||
|
Both no2chem and I have been able to rebuild stock roms with modified XIPs with success, but i still want to check with helmi before i would be sure i did all the proper steps. I have this feeling that if no2chem and I picked this part up so quickly there is probably something else to look at =)
Last edited by ImCoKeMaN; 10-28-2007 at 01:46 PM. |
|
||||
|
i have confirmed md5 difference of xip.bin / xip_out.bin; os.nb.payload / os-new.nb.payload; os.nb / os-new.nb; dcd0.4.4_t1.nbh / dcd0.4.4_t2.nbh
i beleive the new coredll.dll was put into xip, the xip was put into nb.payload, etc etc. i beleive i have the new coredll.dll booted. just making sure i didnt fool myself and really boot the old one |
|
||||
|
yeah dcd looks like the one that will affect boot is actually 00320000 and you must manually extract it from that location (not rommaster). Guess that explains why the crazy thing i did actually booted.
|
![]() |
|
|
|