Quote
cmonex - 2008-01-14 12:43 AM
yeah that makes it harder if you don't know what type of nand it has.
however you can attempt to dump the bootloader and the xipkernel, both are loaded in RAM. bootloader has low level nand read code
(especially IPL
), and xipkernel has the flash drivers required to load the rest of the OS.
Can you help me with this, it's from my ce5.0 bricked gps which I'm
trying to bring back to life. I cannot extract anything using your tools:
img 00000000 : hdr=8c96b35c base=8c856000 commandlineoffset=8c01ef20
ERROR: could not find pointer for ofs 00000000
NOTE: removing 486c2407 from e32 struct for nk.exe
NOTE: removing 48290c73 from e32 struct for atserisr.dll
NOTE: removing 4848a700 from e32 struct for coredll.dll
NOTE: removing 483a1860 from e32 struct for filesys.exe
NOTE: removing 483a1823 from e32 struct for device.exe
NOTE: removing 483a1821 from e32 struct for devmgr.dll
NOTE: removing 483a1824 from e32 struct for regenum.dll
NOTE: removing 483a1824 from e32 struct for busenum.dll
NOTE: removing 484e22a4 from e32 struct for pm.dll
NOTE: removing 483a1859 from e32 struct for fatfsd.dll
NOTE: removing 483a185c from e32 struct for diskcache.dll
NOTE: removing 483a185a from e32 struct for fatutil.dll
NOTE: removing 483a185c from e32 struct for binfs.dll
NOTE: removing 483a1858 from e32 struct for fsdmgr.dll
NOTE: removing 483a185d from e32 struct for mspart.dll
NOTE: removing 483a17d7 from e32 struct for ceddk.dll
NOTE: removing 486b5f3d from e32 struct for JWUILoader.exe
NOTE: removing 484e2292 from e32 struct for ddi.dll
NOTE: removing 484e2283 from e32 struct for utldrv.dll
NOTE: removing 484e2285 from e32 struct for flashdrv.dll
NOTE: removing 484e2286 from e32 struct for newflashdrv.dll
8c01ef20 - 8c856000 L008370e0 unknown
8c856000 - 8c856000 L00000000 rom_00 start
8c856000 - 8c856004 L00000004 JUMP to kernel start
8c856004 - 8c856040 L0000003c unknown ceeead8e adecdcc6 d9cecccf cecdcdcc ce6edef8 dbd6ccee 9cadecce 3351337b 73b7b373 3f47e737 b373fbb9 f7fa7bb3 33f33f36 117dbfbb 37fbbb3f
8c856040 - 8c85604c L0000000c 'ECEC' -> 8c96b35c 0011535c
8c85604c - 8c857000 L00000fb4 unknown
the list is long, there is lots of addresses and unknown ones, some .dll's, and at the end
8ca43d60 - 8ca43da8 L00000048 o32 struct newflashdrv.dll
8ca43da8 - 8ca43dd4 L0000002c rom extension entry chain information
8ca43dd4 - 8ca43e14 L00000040 rom extension data chain information
8ca43e14 - 8ca43e34 L00000020 rom_00 copy to ram: 8c9c36a8L0008e4 -> 8cc66000L046f28 8c9c36a8L0008e4 -> 8cc66000L046f28
8ca43e34 - 8ca44000 L000001cc unknown
8ca44000 - 8ca4643d L0000243d o32 region_2 rva=0007b000 vsize=00005008 real=03feb000 psize=0000243d f=40002040 for coredll.dll
8ca46440 - 8ca49327 L00002ee7 o32 region_1 rva=00030000 vsize=0000fb28 real=01fd6000 psize=00002ee7 f=c0002040 for ddi.dll
8ca49328 - 8ca695c6 L0002029e filedata wince.nls
8ca695c8 - 8ca6aba8 L000015e0 filedata boot.hv
8ca6aba8 - 8ca7b29d L000106f5 filedata default.hv
8ca7b2a0 - 8ca7c79a L000014fa filedata user.hv
8ca7c79c - 8ca9bee8 L0001f74c filedata tahoma.ttf
8ca9bee8 - 8ca9bee8 L00000000 rom_00 end
8ca9bee8 - 8df206c0 unknown
I was looking in this topic: Forums · Technical Support · Windows CE 4.x .net / CE 5.0/I've bricked my GPS but nobody posts there any more, if you would be so nice to give me some help, I would be very grateful. My email ojeoje@operamail.com
Thanks in advance
ojejoe