XDA Flame User Forum at xdaflameusers.com

great idea thierry!

wow, 12 hours to launch a ROM? thats scary.

I'll be writing an article on creating a better extended rom selection this week

The extended rom tool not only can extract extended rom but also can dump the whole M$ OS Part & OEM Part of the ROM.

So what you are doing is dumping the ROM which you get many files (dll, bmp, etc, etc) which are residing in \Windows\ directory.

Some of this files belong to M$ OS/SYS and some OEM (Arima in our case) specific including drivers for our PDA used ICs.

If you separate them, in principle you can combine the OEM Part with the WM6 Part, but you will face a lot of problem that they may not combine too well. I am not an expert to debug all this problem, maybe we should ask those guys in XDA like Bebe, Mamaich, Helmi, Menisys, Jmcpwrites, Ivan, Midget, Leo, etc.

By the way, please let me know how you get the diskimage.nb0 for dumping the ROM?

Was you extraction of GSM & RIL successful?

Oh, I see, you are using the Mamaich tool to extract only the ROM to DiskImage.nb0 to StorageCard and has not proceed to dump the DiskImage.nb0.

What is the size of this DiskImage.nb0? Normally M$ OS + OEM should be 64MB or less.

Here is the list of the dump :
.ROM
.VM
1f1aca24-d942-464a-9281-10567741499c.exe
actsyncc.dll
afd.dll
appinstaller.dll
asyncmac.dll
ATCIUI.exe
atcmdint.dll
atlce300.dll
audevman.dll
AutoBind_lsp.dll
aygshell.dll
banner_o2.gif
bbres.dll
bbres.dll.0409.mui
beam.exe
browser.dll
browsres.192.dll
browsres.dll
btagsvc.dll
btdrt.dll
BthAGPhonebook.dll
bthatci.dll
bthlink.dll
bthutil.dll
BubbleBreaker.exe
cabinstl.dll
calc.exe
caldll.dll
calendar.exe
calnot.exe
calstore.dll
calupd.exe
ccoredrv.dll
ccoreutl.dll
cebits.dll
cebitsxf.exe
cedrmutil.dll
cefobj.dll
cellcore.dll
celltsp.dll
cemapi.dll
cemedia.dll
certinst.exe
ceshell.dll
cespell.dll
cfghost.exe
cgacutil.exe
chngtrk.dll
ciphase2.exe
citydb.dll
Cleanreg.exe
clock.exe
clockdll.dll
clocknot.exe
coldinit.exe
commctrl.dll
commctrl.dll.0409.mui
commdlg.dll
commdlg.dll.0409.mui
compime.dll
configmanager.dll
configmanager2.dll
conncfg.dll
connmgr.exe
connplan.dll
coredll.dll.0409.mui
coredpus.dll
coreres.192.dll
coreres.dll
coresecproviders.dll
cplmain.cpl
cplphone.dll
cprog.exe
credprov.dll
credsvc.dll
crypt32.dll.0409.mui
csp.exe
cspnet.dll
cspomadmconn.dll
cspproxy.dll
cspras.dll
cspvoice.dll
cspwwan.dll
ctlpnl.exe
cxport.dll
d3dm.dll
ddraw.dll
dhcp.dll
dhcpsrv.dll
dhcpv6l.dll
dlagent.exe
doclist.dll
dtpt_lsp.dll
dtpt_nsp.dll
dtpt_srv.dll
dw.exe
dwui.dll
DwXfer.dll
eap.dll
eapchap.dll
eapol.dll
eaptls.dll
ethman.dll
exappres.192.dll
exappres.dll
exsmime.dll
fatutil.dll.0409.mui
fexplore.exe
filesys.exe.0409.mui
find.dll
FunctionTest.exe
gdiplus.dll
gpsapi.dll
gsm610.acm
gwes.exe
gwes.exe.0409.mui
gx.dll
hotvoice.exe
htmlnote.dll
htmlview.dll
hwhelp.exe
icm.dll
idledetect.exe
IECEExt.dll
IECEExt.dll.0409.mui
ieO2.bmp
iexplore.exe
illumine.wma
imagelib.dll
imaging.dll
imgdecmp.dll
imgupdatecsp.dll
infantry.dll
inkobj.dll
inkx.dll
inreplce.dll
InstallCAB.exe
intshare.dll
IntShrUI.exe
iphlpapi.dll
ipnat.dll
ipsec.dll
ipsecsvc.dll
ipv6hlp.dll
ircomm.dll
irdastk.dll
irsqrt.dll
jscript.dll
l2tp.dll
lap_pw.dll
lassd.dll
libEGL.dll
libGLES_CM.dll
mailtrns.dll
mdsmailsvc.dll
MdsRes_wpc.exe.0409.mui
Mezza.wma
mfcce300.dll
miscres.dll
mlang.dll
mlang.dll.0409.mui
mmtimer.dll
MouHid.dll
mp3dmod.dll
msasn1.dll
mscoree.dll
mscoree1_0.dll
msdmo.dll
MsgStore.dll
msim.192.dll
msim.dll
msnewmnu.dll
msnsspc.dll
msrle32.dll
msscript.dll
mstli.exe
mstsc40.exe
msxml3.dll
ndis.dll
ndisuio.dll
netbios.dll
netcfagl1_0.dll
netmui.dll
netmui.dll.0409.mui
netui.dll
notes.exe
note_prj.dll
notify.dll
notify.dll.0409.mui
nspm.dll
ntlmssp.dll
ntlmssp_svc.dll
NvAudioTransformFilter.dll
NvH264Transform.dll
NvMPEG4TransformFilter.dll
NvVideoRenderer.dll
nvwmpplugin.dll
o2.htm
O2ApiServices.dll
O2Default(Landscape).skn
O2Default(Portrait).skn
O2Landscape.gif
O2Landscape.skn
O2Portrait.gif
O2Portrait.skn
O2_API.dll
obexapi.dll
obexinbx.dll
obexsrvr.dll
OEMSourceFilter.dll
office.dll
officeres.192.dll
officeres.dll
ole32.dll
oleaut32.dll
olece300.dll
omadmclient.exe
osmosis.wma
ossvcs.dll
outres.192.dll
outres.dll
packageinfoapi.dll
pegcards.192.dll
pegcards.dll
peghelp.exe
phone.dll
pimapi.dll
pimdlg.dll
pimg.exe
pimgdll.dll
pimstore.dll
pimutil.dll
pmsn.cpl
poutlook.exe
ppp.dll
ppt.exe
pptp.dll
pptres.192.dll
pptres.dll
pushprxy.dll
pushrouter.dll
pword.exe
pwwiff.dll
pxl.exe
pxl2xls.dll
pxlfile.dll
quartz.dll
quartz.dll.0409.mui
rapiclnt.exe
rdpapi.dll
rdpdr.dll
redir.dll
regextdev.dll
rehost.dll
remnet.exe
repllog.exe
riched20.dll
richink.dll
ril.dll
riresdll.192.dll
riresdll.96.dll
riresdll.dll
rnaapp.exe
rra_stm.dll
rundll32.exe
scard.dll
schannel.dll
sdhc.dll
secur32.dll
servhost.dll
services.exe
shell32.exe
shellcelog.dll
shellres.192.dll
shellres.dll
shellresapps.192.dll
shellresapps.96.dll
shellresapps.dll
shfind.exe
shlwapi.dll
shlwapi.dll.0409.mui
shutDownAnimation.exe
shutil.dll
siclnt.exe
siminit.dll
simsec.dll
sms.dll
sndplay.exe
softkb.dll
solitare.exe
spnego.dll
sqlcese30.sys.dll
srvtrust.exe
ssllsp.dll
supsvcs.dll
sym.txt
synccsp.dll
syncmgr.dll
syncres.dll
syncutil.dll
syscsps.dll
tapi.dll
tapres.192.dll
tapres.dll
taskdll.dll
tasks.exe
tcpip6.dll
tcpstk.dll
termctrl.dll
tkitapp.exe
tmail.exe
tmailutl.dll
tmarshaller.exe
tmp.txt
toolhelp.dll
tpcutil.dll
Transcriber.Exe
TranscriberSip.Dll
TraRecoEnu.dll
TraRes0409.192.dll
TraRes0409.dll
TraShapeSelector.Exe
trustmarshaller.dll
tsctrc.dll
tshres.192.dll
tshres.dll
udp2tcp.exe
umarshaller.exe
unimodem.dll
unimodem.dll.0409.mui
updatebin.exe
urlmon.dll
urlmon.dll.0409.mui
usbmsfn.dll
VBarCall.dll
VCOMCtl.dll
veim.dll
VoiceBar.dll
VoiceCtl.dll
voicedll.dll
wap.dll
wapdrv.dll
waveapi.dll
waveapi.dll.0409.mui
wceload.exe
webview.dll
welcome.exe
wininet.dll
wininet.dll.0409.mui
winscard.dll
winsock.dll
wlclient.dll
wldap32.dll
wm.gif
wmadecoder.dll
wmcore.dll
wmdrm.dll
wmlview.dll
wmplayer.exe
wmploc.dll
wmpocx.dll
wmvdecoder.dll
wmvdmoe.dll
wrlsmgr.exe
ws2.dll
ws2instl.dll
wsp.dll
wsp.dll.0409.mui
wspm.dll
wsppush.dll
wwan.dll
wzcsapi.dll
wzcsvc.dll
xls2pxl.dll
xmeevtsnd.dll
zlib.dll

Edit : this list is wrong, I have not done a "dir /a", and a lot of files were hidden.

Last edited by thierryb (2007-08-24 19:02:56)

what do you use to browse your extended rom directory?
I use Resco explorer, but I prefer Total Commander because I do not need to change the registry. Probably these files are considered as system so not visible if you do nothing.
Do you have name of a tool to propose me?

why do you say the 3 roms?
Probably this is the main difference between the two versions of the extended rom.

Files (with their size) of the extended rom (not all in fact. removed directories):
autoconfig_en.cab  35590  (34654)
camera.cab  1268102  (1265571)
o2smsplus.cab  99747  (99297)
cellbroadcast.cab  53847  (54871)
devonecwpro6.cab  497434  (
diskimage.nb0  65536000  (absent)
eboot.nb0  524288  (absent)
fmradio.cab  1419565  (1424323)
FMRadioRDS.CAB absent (16903)
java.cab  998211  (
midi_engine.cab  341708  (
mms.cab  1147079  (
o2autoinst.cab  87230  (
o2connect.cab  225523  (223786)
o2cplprop.cab  128562  (30531)
o2mediaplus.cab  12264693  (
o2phoneplus.cab  109418  (108752)
o2themes.cab  317787  (312436)
pdf.cab  2216816  (
rc.cab  1845845  (
self_diagnostic.cab  989502  (
smsbackup.cab  143719  (
videotelephony.cab  3241658  (3294306)
wifisychip.cab  135674  (
worldmate_se_english.cab  3551732 (

edited to add the size of the files as published in 4pda.ru (added in bracket if different)

In HTC device, it is another 2 Keys (not the hard reset 2 keys) + poke Reset Hole. The 2 keys varies even among HTC devices.

It should be the same way, except we do not know which 2 keys, you have to try all the possible combinations of any 2 of the available hard keys (except the 2 for hard reset). This is part of the fun.

Let us know when you find them.

Is it possible for you to send me DiskImage.nb0 and Eboot.nb0?

Hmm... which ROM/Versions?

Just the filenames, size & dates?

Mine is the same version as yours right?

It is difficult cause it has other install Apps too. So we will know which is ROM and which is not.

Hard reset also there is backup, still have to redo the emails setup manually.

Ok, I went further with pdocread. I have succeeded to grab TFFS2. It is probably the Extended Rom. I just need now to verify it is really the case.
And I have also succeeded to get part of StrataF. I have to continue my job also in that direction.
I have also discovered on the net, again in 4pda.ru (thangs google to help me to find it and translate it, because I do not know any word in Russian) people that have also grabed the rom but using WM5torage. I have also to verify if their data is consistent with the one I will have.
Ref : http://4pda.ru/forum/index.php?&sho … &st=60
Dump : http://4pda.ru/forum/attach/839243/flame_nk.rar

Awesome progress thierry! How do you guys make Wm5Storage work though? Whatever I do, I either get a non-working PPC that needs a hard-reset or I need to do a soft-reset. Advise?

cwkj wrote:

You can check with Menisys, he understands Russian.

I know that, but Google was enough. So no need to disturb him.

Spritebackup, I am using the very old version hacked from my iPaq. It serves me well for backing up the ROM, Apps and Registry. PIM does not work with this old Spritebackup, so I also use PpcPimBackup.

Do not use Sprite Backup, it is to expensive, but it is not a reason to hack it. If you like it, you have to pay it.
You can use SKTools, even without registering, you can do a backup and a restore, as long as you want. And he works well, except for SMS (and perhaps for mail box configuration).

I can now confirm that the diskimage.nb0 and the eboot.nb0 that are in my extended rom are the bootloader and the rom of the Flame.
I can also confirm that the rom extracted by Wm5torage by people in russia is also the rom. I have not compared them byte by byte (I will do it later), but 99% of them are identical, except diskimage starts 0x20000 bytes earlier than the nk.nba (russian one).
I have not succeeded to use pdocread completely, but using grab_it I get a dump of the rom, Eboot starts at adress 0x0 of the dump, Part00 of StrataF starts at 0x102000, and goes until 0x23FFFF, Part01 starts just after at 0x240000 until 0xA40000, and Part02 starts at 0xAC0000; diskimage.nb0 starts at 0x80000 and nk.nba (Russian) starts at 0x100000.

Using pdocread, I was able to read completely the Extended Rom in TFFS2. I have discovered files that I have added to it using TotalCommander. I have not tried to modify it using pdocwrite.

I can not go further without discovering how to enter in the bootloader. In fact we are in the bootloader when we try to start the Flame when the battery is to low. I have extracted strings form the eboot and discovered strings that appears at this moment. The eboot is really big, 1,3 Mb, and have a lot of features
Some of them :
================  EBOOT FLASHIMAGE  =============   
Change CPU speed...
Run Mode   = %d MHz
Turbo Mode = %d MHz
Bus Mode   = A[%d], B[%d]
TURBOMode       = %s
Voltage     = %dmV

--------------------------------------------------------------------------------
Arima Engineering Menu                 VER[%d.%d(%c)%d]
--------------------------------------------------------------------------------
[0] Return to Main Menu
[1] SP3600 Board Test Menu
[2] Download Menu
[R] Reset/Reboot System
[S] Shut Down System
[E] Erase Eboot Boot Cfg Block

Enter your selection:

Engineering Menu:
[1] Memory (SDRAM/Flash)     [2] nVIDIA 5500 
[3] Display Panel         [4] TV-out    
[5] Camera              [6] WM9713    
[7] EMP              [8] FM (Silicon4701)
[9] Touch Screen        [10] Battery
[11] Charger (24010)        [12] PMIC
[13] SD/SDIO Card        [14] LED (PCA9633)
[15] Keypad            [16] Light Sensor
[17] Vibrator            [18] RTC
[19] TV-out(iMagis)


[9] Update    EBOOT    FLASHIMAGE    (EBOOT.nb0)    via MDOC
[a] Get Hidden partition size
[5] Download    RAMBOOT    RAMIMAGE    (RAMBOOT.nb0)    via Serial Transport
[6] Update    IPL    FLASHIMAGE    (IPL.nb0)    via Serial Transport
[7] Update    EBOOT    FLASHIMAGE    (EBOOT.nb0)    via Serial Transport
[0] Return to Arima Engeering Menu:
[1] Download    RAMBOOT    RAMIMAGE    (RAMBOOT.nb0)    via micro-SD 
[2] Update    OS    FLASHIMAGE    (diskimage.nb0)    via micro-SD
[3] Update    IPL    FLASHIMAGE    (IPL.nb0)    via micro-SD
[4] Update    EBOOT    FLASHIMAGE    (EBOOT.nb0)    via micro-SD
Download Menu:


================================
[0] Return to Platform Test Main Menu
[1] Status Information Dump
[2] Test Battery Cover Sensor
[3] Battery Voltage Record
Battery Test Menu:


[7] Set Search Level
[8] RDS Information
[9] FM Register Dump
[1] FM Tuner On (Reset)
[2] Down Search
[3] Up Search
[4] FM Tuner Off
[5] Set Volume
[6] Set Radio Station Frequency   (Current Freq: %d.%d MHz)
FM Test Menu   


  Manual Configure the RGB PWM Values and Group Brightness Intensity   
--------------------------------------------------------------------------------
Press the key defined in the "[]" on the table below:

            Red     Green    Blue   Brightness 
Increase:  [1]      [2]      [3]      [4] 
Decrease:  [q]      [w]      [e]      [r] 

Press [0] to exit...


press '+' or '-' key to control volume, press space key to stop test !!
Master volume = %d
Audio output Test Menu
[0] Return to WM9713 Test Main Menu
[1] Speaker L channel
[2] Speaker R channel
[3] Receiver
[4] Headset
[3] Codec register read and write
[1] Audio output test
[2] Mic test


iMagis TV-out Test Menu:

0) Return to Platform Test Main Menu
1) I2C reg write
2) I2C reg read
3) iMagis_CVBS_menu_NonEnh
4) iMagis_CVBS_rotate Right
5) iMagis_CVBS_rotate_Left
6) iMagis Power On
7) iMagis Power Off
8) I2C host reset
9) Read ID


===== Test Various Charge Mode =====
====================================

This test is available from P3D HW revision
There are 3 charging rates :
1: 1000 mA
2: 500  mA
3: 100  mA

Enter your choice (1 digit):
[1] Status Information
[2] Quick Charging Set
[3] Normal Charging Set
[4] Verify various charging mode
Charger Test Menu:


[1] NV5500 Display init
[2] Normal Test
[3] Advance test
Display Menu
18:28:55 Display Test Menu         version:[%d.0%d]        %s %s
[1] NV5500 CCM init
[2] Preview Test(2M)
[3] Preview Test(VGA)
[4] Torch mode on
[5] Torch mode off
[6] REGW
[7] 2M Advance Menu
[8] VGA Advance Menu
CCM Menu
CCM Test Menu             version:[%d.0%d]        %s %s
Set GPIO 91+ 
[1] NV5500 ID Test
[2] Reset ID Test
[3] Code Test
[4] IO Test
NVIDIA 5500 Test Menu

CCM VGA Menu:

1) REG_W
2) Normal Test
3) Flicker Auto
4) Flicker 50Hz
5) Flicker 60Hz
6) Normal effect
7) Monochrome effect
8)Sepia effect
9)Negative effect
10)Solarize
11)Solarize 2
12)zoom test
13)Switch to conetxt A
14)Switch to conetxt B


So there is a contest : find how to reach the bootloader. I will ask my son to find it, he is able to do a lot of things with his fingers on is gameboy ;-)