SD Card Boot Force ROM Upgrade Method ?

[Liquid3d]

Hi jdesvin. I think you've hit the nail on the head. Using CDCheck I've created lots of CRC's using MD5, CRC-32, ADLER32, GOST32, SHA1, TIGER, RIPEMD etc. but the problem is we dont know how the 'checksums' should be placed in the .CRC file.

Why not just look at the crc from a ipaq update and go from there as they seem to want the same files it would be where i would start

I'll look into it tomarrow and report back if i find anything

The CRC from what iPaq update?
The old ipaqs did not use a CRC file in the update from CF or SD cards.

[jdesvin]

Hi jdesvin. I think you've hit the nail on the head. Using CDCheck I've created lots of CRC's using MD5, CRC-32, ADLER32, GOST32, SHA1, TIGER, RIPEMD etc. but the problem is we dont know how the 'checksums' should be placed in the .CRC file.

Sample output from CDCheck looks like :-

Code:

[Info] Version=1 Format=SHA512 Date=28.11.2005 CreatedBy=CDCheck (http://elpros.si/CDCheck/) [Data] DIR e649a436795381943de04ea279ffc712ae32e407d35a83782c018eb045a32e1b6d57ed2eace8414ec23a2b8499dd0650ea52f6c7d9931d2c1dd533df334de728 diag.nb0

...but of course the Dell bootloader wont be looking for all that proprietary stuff (unless they used CDCheck to create the .CRC file in the first place which would be nice). At this stage I think we may need an example file rather than just blindly trying to push ahead.

Which takes me to the post above about the guys over at handheld.org. I think that is now the best approach. Thanks for the info X51V_User :) We should see if they have any good news for us on file formats etc.

EDIT:- The other approach would be to find someone who can reverse engineer / decompile the bootloader so we can find out how it parses the .CRC file. There's a thought.

There are references in the ROM to CRC32 but I'm no coder for this platform so wouldn't know if it's worth looking at :-

I like your idea about querying the other organization for any possible details. No sense in reinventing the wheel, right? :) In the event we are at square one on this, I would suspect that Dell probably used a standard CRC algorithm as opposed to an encrypted hash such as MD5.

Since Dell has a procedure for how to flash the device with an appropriate ROM it seems as if they should also have the corresponding files which they make reference to. I wonder how one could go about obtaining those from Dell?

If someone does manage to somehow extract the boot loader code from their device, I would be interested in seeing a copy. Reading assembler code is far from enjoyable, but its probably the fastest way to overcome this problem if the other methods fail.

As a side note, your comments about observing CRC32 would lead me to believe that the crc file should contain nothing more than a 32-bit value which represents the checksum. The checksum may be stored as base 10 text representation, base 16 hex representation, dword data little endian/big endian. You can give those a shot if you want to brute force more.

Also, if you can send me the image you are trying to create a CRC for I can generate up a variety of crc formats for you to try. www.yousendit.com

Thanks, Jd

I agree, if they are using a CRC string it should be CRC32.

I agree, if they are using a CRC string it should be CRC32.

I'm now working on that assumption. I've tried basic hex and txt crc files just containng the crc32 checksum but it's not picking it up so I guess there must be some padding in the file that the loader wants to process.

BTW, I meant to check if the Axim has any kind of BIOS (I'm pretty sure it doesn't) or whether the bootloader will definately be in the ROM.

The boot loader is in the ROM and it's part of the bin you dumped.

[sivero]

has any of you heard of HARET?

"HaRET

Handheld Reverse Engineering Tool

HaRET is a very useful tool for accessing the hardware internals of a Windows CE handheld to get Linux up and running on it.

It also contains a linux loader (loads the kernel and initrd into memory then kicks out wince and runs the kernel. It's an alternative to Linexec. "

I think that´s what the linux guys are using as a bootloader, maybe it can be used to load the windows ROM as well.

Yeah, it's worth chasing up at
http://handhelds.org/moin/moin.cgi/DellAximX50
http://www.handhelds.org/hypermail/a...-port/current/ is the mailing list

I'm unavailable for the next few days (possibly up to a week) so if anyone could step in that that would be great.

[ndepuy]

woah... this is EXACTLY wot i need to do to my x50v
i upgraded to wm5 a few weeks ago... wot a big mistake that was.
made the thing really unstable and now it has finally flopped.
it refused boot, reset, hard reset, nothing.
diagnostic system reports all is well in axim land.

i;m guessing my only hope of ever getting it working again is by flashing back to 2003 via the SD card.

also i read somewhere, probably here, that someone managed to pull appart a dell rom update file.. and said that it contained nothing like what it should. he thought it must have been encrypted or something.

Just an idea, I've had Memory errors on my x50v and I can get them to go away by removing the battery and letting the pda sit for a couple of days and then installing the battery and putting it on the cradle (no computer connecton) and it has worked for me 3 times. Good luck

[narco]

Just an idea, I've had Memory errors on my x50v and I can get them to go away by removing the battery and letting the pda sit for a couple of days and then installing the battery and putting it on the cradle (no computer connecton) and it has worked for me 3 times. Good luck

already tried leaving it overnight (~12hrs) and it didn;t help. besides, the backup battery is only meant to last 30min or so.

[xless]

I've got an x50v available to me for a couple days which I'm more than happy to test on. If it bricks, no big deal -- it's going back to Dell anyway for a battery issue. PM me if you'd like me to test.

Someone should really take a look at this. Most of it is over my head but I'm told it looks like the one used in the X50!

http://www.bfamily.us/~richard/tmp/arm/bootloader/

[narco]

ok i gave dell tech support a go to see if they could give or tell me anything about the files needed to perform an SD flash.
Short story is, dell tech support is google. and all they could give me was the intructions.. word for word from this thread no less.
i managed to get a little futher up line and discovered that people before me have tried to squeeze out the information. and failed. apparently the product development group for the axims don't have the files. Dell basically claims they don't exist. (and we all trust dell don't we. don't we? :p)
i've sent of an email to dell customer relations as advised about this, and if i here back, i'll let you know.

In the mean time I can't live without my pda anymore. I'm forgetting stuff and generally don't know what day it is without it. So its going back to dell for a replacement.

Keep at it guys and good luck!

[R K]

On other HTC devices, you could get the NB0 file by backing up your current ROM image. Has anyone tried this?

I think you'd need WM2003SE to try it though since the only ROM Backup program I know of comes with Dell's ROM Update utility but I don't think it will work for WM5 since the WM5 utility only updates the ROM and doesn't backup or restore.

[narco]

On other HTC devices, you could get the NB0 file by backing up your current ROM image. Has anyone tried this?

I think you'd need WM2003SE to try it though since the only ROM Backup program I know of comes with Dell's ROM Update utility but I don't think it will work for WM5 since the WM5 utility only updates the ROM and doesn't backup or restore.

we tried dumping a rom and using it as the source for the update.
But we believe may have cut the rom file wrong (missed the start of the rom)

also... the dell backup util produces RIS files. They seem to be identical in format to the .img dell provides with the update system. And therefore, don't work with the SD updater.