Extended_Rom unlocker/unhider, get it here.....
 

I received my Mogul a few hours ago, haven't even activated it yet..... first things first....

I created this extended rom unlocker and unhider for myself and you all.

Here ya go. Unzip this .zip file, copy over the titan_extrom_tools.cab, run the .cab on your phone. It will install to "Program Files/ExtRom_Tools". Go to this directory using file explorer. Double click on the "titan_extrom_tools.cab" You should get a "success" popup. Soft reset.

"Extended_ROM" should now be showing as a "Flash Drive" in file explorer and is visible from your activesynced connected PC.

One note, the mogul is protesting everytime I delete or add a file to the ext rom, saying this is write protected, just hit ok or skip. Browse out of the directory and come back in to see your changes. (forces a refresh of the directory) If you do not change directories, it will look like nothing changed, but it did change and just didn't refresh. Copies from my PC directly into ext rom are showing up immediately, however.

Hope this helps to start some customizations. I have already cleaned my ext rom of things like goodlink and am working to evaluate the remaining items.

-Paul

As I said in the other thread, very nice work. I wish I had one to test this out on.

Same question, what actual function does the app perform to make the ExtRom writable?

nice job. just got mine and this is always one of the first thing on the "to do list".

thanks, cody

Re: External Rom unlocker/unhider, get it here.....
 

I tried this and am not able to remove anything, I get the error and when I click ok it still doesn't remove them. I also am not able to edit the config file.

Same thing here. I have the extended_rom unhidden, but not unlocked. :(

If you unpack the .cab file (XP lets you do this I believe; if not, it might be winrar that I'm using, which lets me extract the cab), look in the _setup.xml file. You'll see the registry changes that are applied, which is apparently what unlocks the extrom.

I think this would be the most likely place to post this... Just in case anyone is interested in what is on the ExtROM partition:

• AddContact
• AddContacts.exe
• AudioPara0330.sa.CAB
• AutoRun.exe
• Config.txt
• DefaultRingtone.sa.CAB
• GetGL.CAB
• GroveMobile_plugIn.sa.CAB
• MoveLnk.sa.CAB
• MP_CVSDcpl_20070129.cab

And the contents of Config.txt:
I did a hard-reset, followed by a soft-reset before it began installing anything from ExtROM trick, then installed this unlocker to get access to the files there. To confirm, I have NOT installed any of the CABs from the ExtROM, and I am still able to use the phone, as well as access the Internet, and I did NOT have to configure anything (like setting up the #777, Vision username, etc...). I can confirm that the Sprint-installed items are not on the Today screen, and there are no Sprint contacts automatically added. Note that the HTC Plugin app on the Today screen IS there, since that is installed by the manufacturer, and is not considered an "addon" that the ExtROM should install. I find the HTC plugin useful anyway, so I'm not bothered by it. Also, I'm currently using 5MB of the Storage memory.

I'll start digging through the existing CAB files and determine what each one does, specifically.

So, after several hours, I still can't figure out why I can't unlock the ExtROM, even with the supplied cab. I can read the ExtROM, but I'm not able to make any changes. Apparently the exe doesn't do what it's advertised to do. I noticed that the 'MountAsROM=0' and 'secure=0' reg settings get reverted automatically after a soft reset, presumably by the OEM_FLASHDRV driver. I found a thread at xda-developers with a tool that patches that driver to unlock the ROM, but it did not work for the Titan. I actually could not find the original OEM_FLASHDRV.dll file anywhere. After running the patch, the file showed up in \Windows, but then the ExtROM was not visible anymore (even tried installing the certs that the author says are required, and still no joy).

Renaming the "patched" dll, followed by a soft reset, brought the Extended_ROM partition back, but it was still not writable. To the original author: What specifically is the unlock tool meant to do, and how does it do it? It's obviously not working, but if I knew what needs to be done, it would help get a little closer to figuring out what's going wrong.

Is anyone able to get the unlock tool to work?

no we havent... only unhide part works

ok, maybe its just me... but after unhiding the Extended_ROM I get an error in Pocket Outlook when trying to enable the "When available, use this storage card to store attachments" option. Looking at the Storage card listed it has 9.21MB free (Sprint...) any ideas on a work around? I'm already running without any Sprint customizations and currently don't "NEED" to have the Extended_ROM... on the upside... with the app removed everything returns to normal. Must be something in the search order for storage cards within outlook. E before S...

Agreed, only the unhide version is working. I am actively working to decode the key to unlock the ExtRom. Hopefully have it in a day or two.
Sorry, I targeted the wrong key and the shadow writing feature is making it appear to work till a reboot, but it is not.

Soon....
-Paul Hammons

Any updates to share Paul? And thanks for working on this?

Merging...

now i see what u did lol. kk yea.

Well, I'm gonna assume that Paul can't figure this out....

Paul's mad busy. give the man time. he's got a bunch of kids and has a couple of businesses

Well...considering his last post on this matter was almost 3 months ago, I thought I would ask for an update.

I'd love to get rid of some of extra crap too

Well it worked fine for me but... how can I re-hide it?

I can see my external rom. I wonder what I can deep six.

Nothing - the unlocker doesn't work. It's only an un-hider at this point.

Yep. I can't delete a damn thing.

Well it was proven that it didn't work some posts ago. I don't know why someone brought this 3 month old post back up.

When I looked at this thread I was ready to download this, but I read the whole thread before I did. It doesn't work, I wish they could had closed this thread and wait for someone to post a new unlocker since the rom is being worked on at this time.

This thread is a total waste of time.

More than meets the eye...
 

I wouldn't say a total waste of time, the file in this thread gives a starting point for the process of unhiding and unlocking the Extended Rom area of the 6800.

I did learn one thing from this thread, when you examine the cab file in the first post, there is a lot less going on in this cab as opposed to the reg edits that unhide and unlock the 6700 Extended Rom.

Can anyone with more experience than me take a look at the difference in the reg edits? I am going to attempt to figure it out with some trial and error this weekend.

The changes below will unhide but not unlock the 6800 registry (based on the cab in the first post):

;6800 EXTENDED ROM Unhide

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ MSFlash]
"MountAsROM"=dword:00000000
"MountHidden"=dword:00000000

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ MSFlash\FATFS]
"MountAsRom"=dword:00000000
"MountHidden"=dword:00000000

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ EXT_FLASHDRV]
"MountHidden"=dword:00000000

;End 6800 EXTENDED ROM Unhide


Here are the reg entries that will unhide AND unlock the Extended Rom on the 6700: (i can't remember who posted this so i apologize to him\her for not giving credit :-()

;6700 Unhide and Unlock EXTENDED ROM

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ TRUEFFS_DOC1]
"MountHidden"=dword:00000000
"Folder"="Extended_ROM"
"PartitionDriver"=""
"Name"=""
"DefaultFileSystem"="FATFS"

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ TRUEFFS_DOC1\FATFS]
"DataCacheSize"=dword:00000080
"EnableWriteBack"=dword:00000001
"FormatTfat"=dword:00000001
"Flags"=dword:00000014

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ MSFlash]
"Name"="FLASH Disk Block"
"MountHidden"=dword:00000000
"Folder"="Flash Disk"
"MountAsROM"=dword:00000001
"PartitionDriver"="mspart.dll"

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ MSFlash\FATFS]
"MountHidden"=dword:00000000
"MountAsROM"=dword:00000000

; Second part
[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ TRUEFFS_DOC1]
"Bootphase"=dword:00000002
"Order"=dword:00000001
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\TrueFFS1"

[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ Relfsd]
"BootPhase"=dword:00000001
"MountFlags"=dword:00000001
"secure"=dword:00000000
"mount"="Release"
"LoadFlags"=dword:00000001
"Paging"=dword:00000000
"Dll"="relfsd.dll"

[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ TRUEFFS_DOC2]
"Bootphase"=dword:00000001
"Order"=dword:00000000
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\TrueFFS2"

[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ TrueFFS]
"BootPhase"=dword:00000000
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\TrueFFS"

[HKEY_LOCAL_MACHINE\System\StorageManager\Partition Table]
"26"="BINARY"
"25"="IMGFS"
"23"="RAWFS"
"22"="RAWFS"
"21"="BINFS"
"20"="BOOT"
"0F"="FATFS"
"0E"="FATFS"
"0C"="FATFS"
"0B"="FATFS"
"07"="NTFS"
"06"="FATFS"
"04"="FATFS"
"01"="FATFS"

;End 6700 Unhide and Unlock EXTENDED ROM

Still a waste of time, did you actually unlock the rom......hmmmm...no nobody has.

This thread stated...

"Extended Rom UNLOCKER/unhider...get it here". This is totally miss leading, since the unlocker doesn't work. Why turn this thread into an experiment? The fact is the OP stated unlocker...get it here. It doesn't unlock anything. Now you want to get it to work which is fine.... but please start your own thread.

The average person would look at this thread and download the file. Then you would have to contend with...HELP....I CAN'T DELETE ROM FILES ...WHAT AM I DOING WRONG?

We are at the time now when someone with knowledge of this will speak up and guide our way though this when it is cracked. No since of having to go through 5 to 15 pages of crap just to get the legit fix.

Dito....Have a great evening!!

steps, unless you want to get yourself banned you should tone your language down.

Bump - Bump
 

http://www.geekzone.co.nz/inane/758

Found this link for manually editing the registry on the 6700.

------------------------------------------------------------
You will need a Registry editor.... or if you dont care how it works, you just want to see your files, skip to the end.

Backing up your registry is always a good idea before modifying.


Open your registry editor,

Browse to:

HKLM\System\StorageManager\Profiles\TRUEFFS_DOC1

Change the DWORD Value of "MountHidden" to 0

now browse to

HKLM\System\StorageManager\AutoLoad\TRUEFFS_DOC1


Change the DWORD Value of "BootPhase" to 2


you can now exit the editor, and soft - reset your device,

after restarting, you will be able to see the extended_ROM, through the file explorer in much the same way you can see / explore a Storage card.

You now have Read Access to Your Extended Rom,

I'll Post Part 2 containing the information on how to unlock your Extended rom for Write access shortly.


For those of you who just want to see your files,

Open notepad;

paste everything in italics into it into it:

[HKEY_LOCAL_MACHINE\System\StorageManager\AutoLoad\ TRUEFFS_DOC1]
"Bootphase"=dword:00000002
"Order"=dword:00000001
"LoadFlags"=dword:00000001
"DriverPath"="Drivers\\BuiltIn\\TrueFFS1"

save as bootphase.reg


create a new text doc.

paste everything in italics into it

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ TRUEFFS_DOC1]
"MountHidden"=dword:00000000
"Folder"="Extended_ROM"
"PartitionDriver"=""
"Name"=""
"DefaultFileSystem"="FATFS"

[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\ TRUEFFS_DOC1\FATFS]
"DataCacheSize"=dword:00000080
"EnableWriteBack"=dword:00000001
"FormatTfat"=dword:00000001
"Flags"=dword:00000014





save as
Mhidden.reg

copy both files to your apache.

browse to them, tap them, tap yes, soft reset, all done.

----------------------------------------------------------

PART 2

----------------------------------------------------------

http://pdaphonehome.com/forums/ppc-6...clean-rom.html

In this thread someone implies they got the 6700 scripts to unlock but not unhide. I am unsure if he had it backwards or not.

----------------------------------------------------------

I am going to manually look at the registry to see if the Apache shiz looks similiar. I started looking at paul's XML doc to edit it, but i will verify the reg keys first.

Anybody else have any feedback on this now that we have some Titan ROM's floating about?

I'm not too savvy when it comes to ROMs, or have any idea about what you just posted... however, what exactly are you trying to accomplish?

You do know the Titan has been unlocked and some experimental custom ROMs are already out there right?

Check the Stickys!

If what you posted has nothing to do with custom ROMs and what I just said... then disregard it ;)

I have been searching all evening for a working ExtRom Unlocker/Unhider for the Titan. I See Colonel and others with ROM's but i havent found the ExtRom Unhider which unlocks as well.

man if you know where to point me....please....do so

What i posted was about manually editing the registry to unlock the ExtRom.

The Extrom is still not able to be unlocked, the device may need to be SuperCID to do that. That would involve editing radio NVM and that is a seperate topic, but also not yet possible. Another option would be a tool to edit the extendedrom.nb file from the rom dump. I have started looking into this, but it is different than any other i've seen and it may be hard to get developers working on it since new devices seem to be moving away from extended roms. Perhaps the partition will be removed completely, but for now there isn't really any extended rom customizing solution.

Thanks for the update, good to know.

Question: so people can only "Add" to the ExtRom as of now?

Do you know how i can keep it from installing the SPCS shiz after a hard reset without doing the immediate soft reset trick?

Then of course the next logical step is how can i tell it to install my apps which i store in the ExtRom? I realize soon i will be able to cook my own ROM with apps.

Just really super curious!

Think of it as read only you can't update it at all, deleting or adding. There are registry entries to stop the extrom from loading after a hard reset, but for that to work it would have to be cooked into the rom itself anyway or it would be erased when you hard reset.

thanks again

Yeah that was my understanding as well.

I was going on the statement in Paul's first post in which he states that if you refresh the directory you can indeed see changes which implies that he was able to write some data to the partition.

I didnt notice, do any of your or the other Custom WM6 Titan ROMs modify the ExtROM?

I know it was a long shot... guys gotta have hope!

How about the Touch ExtRom unlocker on XDA?

Lastly any eta on a Kitchen? ive been living in the FTP but have not seen anything other than prebuilt custom ROMs.

I am determined to delete that damn waste of space and get it back :-)

The extended rom format is 12-bit transaction safe fat, while other devices use 16-bit tfat - it's hard to say why htc chose to use 12-bit tfat with the mogul. I've had some luck reading the extended rom nb file, but modifying it is a different story. I would rather just do away with the extended rom all together and just turn it into storage.

Ditto, thats my goal too.

extended rom files
 

Does any one know what the mp_cvsdcpl_20070129.cab files is for and also I do not have the audiopara0330.sa.cab file in my config file or in the extended rom does the 2.16 update remove this file

One thing that i have done on my roms is make an OEM for a ExtRom in the flash, redirect the autoloader to the flash one and away we go