This website is using cookies. We use cookies to ensure that we give you the best experience on our website. More info. That's Fine
HPC:Factor Logo 
Latest Forum Activity

ROM cooking PNA Plenio VXA-3000/VXA-2100

« 1 2 3 4 5 6 ... Next »
phowarth Page Icon Posted 2009-04-18 10:47 PM
Avatar image of phowarth
Factorite (Junior)

Hi All,

I have been working on building a new ROM for the Plenio VXA-2100 GPS running WINCE 4.2

** special thanks to hpcmonex for her site and tutorial.

I have successfully created one minor tweak to the registry file and successfully uploaded the image once, but I haven't been able to add files or do major changes to the ROM.

I am looking for some help with adding softkb.dll and changing the registry to activate the SIP keyboard.

Here is the background on the unit and the steps that I have taken so far.

The ROM tools (bksamsung/bkondisk) designed to dump NAND ROM's do not work on the Plenio units. You can dump the kernal (nk.exe) from the 8Meg nor flash using Grabit.

Luckily Plenio has a nk.bin file on their support site that you can use.

Download the latest nk.bin from


Note that this ROM is for VXA-3000 but if you want to load it into the VXA-2100 then rename it to NK2100_.bin. (I have done this on my VXA-2100 with no issues, but the next time you upgrade the ROM you will need to name the file nk.bin since you now have the VXA-3000 ROM loaded)
My understanding is the the 3000 and 2100 are identical except the GPS antenna on the 2100 is detachable.

The ROM Dumping tools will not work on the downloaded file without removing some leading bytes.

I opened the nk.bin file with a HEX editor and removed everything before BOOOFF (28 bytes I think) and save the file under a new name, I used nk_edited.bin.
(thanks to andrewnprice on ppcwarez for this tip!)

The output of viewbin now looks like this.

ViewBin... nk_edited.bin
Image Start = 0x8C200000, length = 0x010F2050
Start address = 0x8C201000
Checking record #83 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x8d2f0544
ROMOFFSET = 0x00000000

Using the following I converted the file to RAW format

cvrtbin nk_edited.bin -r -a 8c200000 -w 32 -l 010f2050 nk_edited.bin

Then finally - Dumped the files contained in the ROM.

dumprom -d c:\tmp\vxa-3000 nk_edited.nb0

I now now have all of the files in the ROM extracted.

Using the perl scripts from hpcmonex's site I converted the default.fdf to default.reg and made a minor change to some text in one of the time zones.

I checked to make sure that the modified default.fdf file was the same size as the original and I then used binmod to put the default.fdf back into the bin file.

Loaded up the nk.bin file using the OS update tool in the Plenio and all was good.

binmod -i nk_edited.bin -r default.fdf
BinMod V1.0 built Apr 5 2006 11:32:47

Checking record #83 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x8d2f0544
rom offset = 0x00000000
Found 'default.fdf' in the image! - located at 8ce19d40, size 00007d26 compressed
Assuming pagesize of 00001000 for compression!
New file compressed = 00007d26, uncompressed = 000266c3
Original record checksum: 0x128a191
New record checksum: 0x128a191
New data written to image!
Original record checksum: 0x90a78
New record checksum: 0x90a78
TOC updated!

My challenge now is that I can not make any other changes to default.fdf and get the nk.bin to load on the GPS.

I have also tried the following tools to make changes, but I get the same results.

Adding default.fdf with dumpromx

dumpromx -v -f default.fdf -a default.fdf nk_edited.nb0
img 00000000 : hdr=8d2f0544 base=8c200000 commandlineoffset=8c200000
block 1 added buf=00440020 010f2050
ERROR: could not find pointer for ofs 00000000
Successful file default.fdf inserting
default.fdf.nb saved successfully

xipbin edited.nb0 0 edited.bin 0
Hooray, now all we need is some patience!
Input: Offset 0x00000000 in EDITED.NB0
Output: Offset 0x00000000 in EDITED.BIN
(0x is okay here because I say so)

My apologies: operation completed successfully. Maybe I can do worse next time!

Can anyone point me in the right direction to be able to make more substantial changes to default.fdf and successfully get them into a working nk.bin file? I suspect that I have an incorrect offset or checksum issue that I don't have enough experience to figure out.

Any help appreciated.


 Top of the page
phowarth Page Icon Posted 2009-04-22 7:46 PM
Avatar image of phowarth
Factorite (Junior)

OK.. a bit more info.

I am 99% certain that it is a checksum issue. I can now successfully insert and extract files within nk.bin as long as the changes are very minor. For example I can change a few characters inside the copyrts.txt file.

I then successfully use the OS update utility on the device to load my new image.

BUT.... to my surprise.. no changes take effect on the unit after reboot.

example I changed the first word in the copyrts.txt file from "Depending" to "ependingD", but the file correctly showed "Depending" when I opened it.

The OS upgrade utility is apparently using the checksum to "correct" these minor changes before loading the image into ROM.

To confirm this, I extracted copyrts.txt from the nk.bin on the SDCARD after I completed the update and sure enough, the spelling error I put into the file had been corrected.

I am now going to focus on figuring out how to change the checksum of the NK.bin, but I would appreciate any pointers on how correctly do this.

below is the records dump from viewbin that list's the checksum on each record if that helps.

viewbin -r nk_edited.bin
ViewBin... nk_edited.bin
Image Start = 0x8C200000, length = 0x010F2050
Record [ 0] : Start = 0x8C200000, Length = 0x00000004, Chksum = 0x000001EB
Record [ 1] : Start = 0x8C200040, Length = 0x00000008, Chksum = 0x00000215
Record [ 2] : Start = 0x8C201000, Length = 0x000826D0, Chksum = 0x03E7420D
Record [ 3] : Start = 0x8C2836D0, Length = 0x0000392C, Chksum = 0x0013B0B0
Record [ 4] : Start = 0x8C287000, Length = 0x000768D8, Chksum = 0x02F9E0EC
Record [ 5] : Start = 0x8C2FD8D8, Length = 0x000377CC, Chksum = 0x014C46F3
Record [ 6] : Start = 0x8C336000, Length = 0x000A3ED0, Chksum = 0x042474E5
Record [ 7] : Start = 0x8C3D9ED0, Length = 0x0003E1A8, Chksum = 0x0172CAD9
Record [ 8] : Start = 0x8C419000, Length = 0x00004FFC, Chksum = 0x001E2B6C
Record [ 9] : Start = 0x8C41E000, Length = 0x0005135C, Chksum = 0x02058421
Record [ 10] : Start = 0x8C46F35C, Length = 0x0000F67C, Chksum = 0x0066C005
Record [ 11] : Start = 0x8C47F000, Length = 0x0002D000, Chksum = 0x0116DFDF
Record [ 12] : Start = 0x8C4AC000, Length = 0x0002B0C8, Chksum = 0x010DDBB5
Record [ 13] : Start = 0x8C4D8000, Length = 0x0001F100, Chksum = 0x00BE4D6A
Record [ 14] : Start = 0x8C4F8000, Length = 0x0002C000, Chksum = 0x0112B2B6
Record [ 15] : Start = 0x8C524000, Length = 0x00020000, Chksum = 0x00CA6540
Record [ 16] : Start = 0x8C544000, Length = 0x0004CC60, Chksum = 0x01F14316
Record [ 17] : Start = 0x8C590C60, Length = 0x0000E414, Chksum = 0x0059A36A
Record [ 18] : Start = 0x8C5A0000, Length = 0x00000010, Chksum = 0x00000004
Record [ 19] : Start = 0x8C5A1000, Length = 0x00034000, Chksum = 0x0148C966
Record [ 20] : Start = 0x8C5D5000, Length = 0x0002AFF8, Chksum = 0x010983A3
Record [ 21] : Start = 0x8C600000, Length = 0x0004DAB4, Chksum = 0x0215C1FC
Record [ 22] : Start = 0x8C64DAB4, Length = 0x00011634, Chksum = 0x0048FE31
Record [ 23] : Start = 0x8C660000, Length = 0x00040000, Chksum = 0x01A24C7A
Record [ 24] : Start = 0x8C6A0000, Length = 0x0003CFFC, Chksum = 0x015B7EF2
Record [ 25] : Start = 0x8C6DD000, Length = 0x00006110, Chksum = 0x00167CA1
Record [ 26] : Start = 0x8C6E4000, Length = 0x00025FFC, Chksum = 0x00F15BC2
Record [ 27] : Start = 0x8C70A000, Length = 0x0003F0AC, Chksum = 0x0198C3ED
Record [ 28] : Start = 0x8C74A000, Length = 0x00063960, Chksum = 0x026E10F7
Record [ 29] : Start = 0x8C7AD960, Length = 0x0000A69C, Chksum = 0x0028E301
Record [ 30] : Start = 0x8C7B8000, Length = 0x0003E000, Chksum = 0x0189D592
Record [ 31] : Start = 0x8C7F6000, Length = 0x00032FFC, Chksum = 0x0126422B
Record [ 32] : Start = 0x8C829000, Length = 0x0001C030, Chksum = 0x00A888CF
Record [ 33] : Start = 0x8C846000, Length = 0x0003FFFC, Chksum = 0x0164D995
Record [ 34] : Start = 0x8C886000, Length = 0x0003DFFC, Chksum = 0x01393D95
Record [ 35] : Start = 0x8C8C4000, Length = 0x0000D010, Chksum = 0x004CABAC
Record [ 36] : Start = 0x8C8D2000, Length = 0x00023114, Chksum = 0x00DF2F9F
Record [ 37] : Start = 0x8C8F6000, Length = 0x000050E4, Chksum = 0x001F46C1
Record [ 38] : Start = 0x8C8FC000, Length = 0x000000E0, Chksum = 0x000034B8
Record [ 39] : Start = 0x8C8FD000, Length = 0x00012060, Chksum = 0x006B73AE
Record [ 40] : Start = 0x8C910000, Length = 0x0003D000, Chksum = 0x019FCA82
Record [ 41] : Start = 0x8C94D000, Length = 0x00014A0C, Chksum = 0x008B11DF
Record [ 42] : Start = 0x8C962000, Length = 0x0000E88C, Chksum = 0x0063BBB4
Record [ 43] : Start = 0x8C971000, Length = 0x00009920, Chksum = 0x0042582D
Record [ 44] : Start = 0x8C97B000, Length = 0x00000010, Chksum = 0x00000000
Record [ 45] : Start = 0x8C97C000, Length = 0x000130F0, Chksum = 0x00853A79
Record [ 46] : Start = 0x8C990000, Length = 0x0000F0F0, Chksum = 0x00679A04
Record [ 47] : Start = 0x8C9A0000, Length = 0x0001E964, Chksum = 0x00D8C89D
Record [ 48] : Start = 0x8C9BF000, Length = 0x00004128, Chksum = 0x0018DBE7
Record [ 49] : Start = 0x8C9C4000, Length = 0x00006944, Chksum = 0x002CD4FA
Record [ 50] : Start = 0x8C9CB000, Length = 0x000010C0, Chksum = 0x000702BA
Record [ 51] : Start = 0x8C9CD000, Length = 0x000090C8, Chksum = 0x003DD81B
Record [ 52] : Start = 0x8C9D7000, Length = 0x000009CC, Chksum = 0x00045D93
Record [ 53] : Start = 0x8C9D8000, Length = 0x000010EC, Chksum = 0x00071FD1
Record [ 54] : Start = 0x8C9DA000, Length = 0x0007DC18, Chksum = 0x02EC8E93
Record [ 55] : Start = 0x8CA57C18, Length = 0x00023414, Chksum = 0x010E640C
Record [ 56] : Start = 0x8CA7B02C, Length = 0x0003E5F4, Chksum = 0x01E2F9DC
Record [ 57] : Start = 0x8CAB9620, Length = 0x0003DF2C, Chksum = 0x01DFE318
Record [ 58] : Start = 0x8CAF754C, Length = 0x00037CBC, Chksum = 0x01AF254E
Record [ 59] : Start = 0x8CB2F208, Length = 0x0003DC70, Chksum = 0x01E23592
Record [ 60] : Start = 0x8CB6CE78, Length = 0x00021664, Chksum = 0x00F4DE17
Record [ 61] : Start = 0x8CB8E4DC, Length = 0x0003E530, Chksum = 0x01D1CC62
Record [ 62] : Start = 0x8CBCCA0C, Length = 0x0000EF64, Chksum = 0x006D5779
Record [ 63] : Start = 0x8CBDB970, Length = 0x00036770, Chksum = 0x019A4E2F
Record [ 64] : Start = 0x8CC120E0, Length = 0x00090648, Chksum = 0x045E1186
Record [ 65] : Start = 0x8CCA2728, Length = 0x00001398, Chksum = 0x0007B65A
Record [ 66] : Start = 0x8CCA3AC0, Length = 0x000457C8, Chksum = 0x0217AC3F
Record [ 67] : Start = 0x8CCE9288, Length = 0x0004670C, Chksum = 0x02203069
Record [ 68] : Start = 0x8CD2F994, Length = 0x0003B3A4, Chksum = 0x01C21497
Record [ 69] : Start = 0x8CD6AD38, Length = 0x0003C2D4, Chksum = 0x01D29587
Record [ 70] : Start = 0x8CDA700C, Length = 0x00014DF0, Chksum = 0x009F26F0
Record [ 71] : Start = 0x8CDBBDFC, Length = 0x0005DF44, Chksum = 0x02249E65
Record [ 72] : Start = 0x8CE19D40, Length = 0x00039ADC, Chksum = 0x0128A191
Record [ 73] : Start = 0x8CE5381C, Length = 0x0001F74C, Chksum = 0x007283F1
Record [ 74] : Start = 0x8CE72F68, Length = 0x002DEEDC, Chksum = 0x0783C7F9
Record [ 75] : Start = 0x8D151E44, Length = 0x00038214, Chksum = 0x01B5E4BE
Record [ 76] : Start = 0x8D18A058, Length = 0x0002AFEC, Chksum = 0x014FE7E9
Record [ 77] : Start = 0x8D1B5044, Length = 0x0003D0C4, Chksum = 0x01DC778B
Record [ 78] : Start = 0x8D1F2108, Length = 0x0003D3E4, Chksum = 0x01DF6996
Record [ 79] : Start = 0x8D22F4EC, Length = 0x0003FFB4, Chksum = 0x01EE7F9D
Record [ 80] : Start = 0x8D26F4A0, Length = 0x0003D814, Chksum = 0x01E15197
Record [ 81] : Start = 0x8D2ACCB4, Length = 0x0003AF98, Chksum = 0x01C0C4F3
Record [ 82] : Start = 0x8D2E7C4C, Length = 0x000088F8, Chksum = 0x003D6D44
Record [ 83] : Start = 0x8D2F0544, Length = 0x00000054, Chksum = 0x00000A52
Record [ 84] : Start = 0x8D2F0598, Length = 0x00001AB8, Chksum = 0x00090A78
Record [ 85] : Start = 0x00000000, Length = 0x8C201000, Chksum = 0x00000000
Start address = 0x8C201000
Checking record #83 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x8d2f0544
ROMOFFSET = 0x00000000


 Top of the page
phowarth Page Icon Posted 2009-04-26 7:15 PM
Avatar image of phowarth
Factorite (Junior)


No success yet, but I am determined. :0)

I have moved on to using hpcomex's xipport tool to see if I can repackage a ROM that will load and get past the checksum issue.

Following the tutorial I can successfully dump the files and modules in compressed format.

I have then taken the same copyrts.txt file that I have been using as my test file and made some minor changes and used dumpromx to insert the file and then xipport to dump the files into a separate directory.

Copied the extracted compressed version of the copyrts.txt files into my working "files" folder and used xipport to make it into a bin file.

Note - Even with the very minor changes in the copyrts.txt file xipport complains there is not enough space, so I deleted a module that supports a game that I don't use.

After deleting the module everything goes as per the tutorial.

Using Dumprom to test my new file I can extract all the files and modules and check that my copyrts.txt test file has the changes that I made, however I am getting the following for all the addresses at the end of the file.

ERROR: could not find pointer for ofs 8d2f7138
ERROR: could not find pointer for ofs 8d2f7137
ERROR: could not find pointer for ofs 8d2f7136
ERROR: could not find pointer for ofs 8d2f7135

I have used a hex editor to view the xip_out.bin and confirm that the file size shown after B000FF matches the actual size of the file on disk and it does.

So I thought that I would ignore the errors and use xipbin to process the file and try to load it up.

xipbin processes the file with success, but I was unable to load the file in the upgrade tool on my PNA. The upgrade tool on my PNA recognizes it as an upgrade file and try's to process it, but eventually comes back with a failed message.

Unfortunately I don't have access to the full bootloader menu or log to trace the root of the problem.

I am thinking that xipport is somehow inserting the incorrect file length for my OS upgrade file since it is normally just over 17Meg and maybe xipport is expecting to create a 32meg file?

Any thought's from anyone who has some tips on xipport would be appreciated.


Edited by phowarth 2009-04-26 7:16 PM
 Top of the page
phowarth Page Icon Posted 2009-05-01 5:46 PM
Avatar image of phowarth
Factorite (Junior)

Problem is now solved.

I can now make a valid rom image for the Plenio. I haven't tried any mod's yet as I don't have a working JTAG or any way to access the bootloader menu.

Here is the quick how-to summary

1. Download the latest OS upgrade from dvssales.com. (Currently 1.62)

2. Use a hex editor to remove the Plenio header at the beginning of the file. (Basically everything before B000FF.

Extra bytes preceeding B000FF

B0 BA B0 BA 01 00 00 00 32 00 00 00 D6 07 00 00
0C 0B 0F 3A 5F 95 0D 01 BC FA FA 65

This data is in little endian, which means you have to reverse the order of the bytes to make any sense of it.

Here is what I know about these bytes,

65 FA FA BC - this is the checksum of the NK.BIN file without the Plenio header. ie remove everything before B000FF and save the file. Open the parsed file in winhex and create a crc32 hash and you will get 65FAFABC.
01 OD 95 50 - this is the size of the NK.BIN file. (Again with the Plenio header removed)
3A 0F 0B 0C - no idea what these bytes are, but you can change them to whatever you want and the NK.BIN will still load. (=2007 in Decimal so maybe part of date?)
00 00 07 D6 - no idea what these bytes are, but you can change them to whatever you want and the NK.BIN will still load.
00 00 00 32 - no idea what these bytes are, but you can change them to whatever you want and the NK.BIN will still load.
00 00 00 01 - no idea what these bytes are, but you can change them to whatever you want and the NK.BIN will still load.
BA B0 BA B0 - Can not change these. Not sure why , but they seem to identify the file as an upgrade.

3. So with the above info you can change the registry etc, upload them to nk.bin with binmod.exe and put in a checksum by editing the NK.BIN Plenio header with the correct value.

My challenge in getting to this point sooner was the checksum calculation. I had downloaded several tool's but they all calculated an incorrect checksum. They were very close to 65FAFABC, but not exact. I finally downloaded winhex and used the built in checksum tool and voila! the result match the the value in the Plenio header.

I tried one quick mod using the copyrts.txt file mentioned above and the unit accepted it. I killed the power before the flash started, so that I can step back and check my work.



 Top of the page
rcfcu Page Icon Posted 2009-05-01 8:02 PM
Paul, this is great. I got a OS upgrade for version 1.64, which shows the header of:

Extra bytes preceeding B000FF

B0 BA B0 BA 01 00 00 00 32 00 00 00 D7 07 00 00
01 19 0F 2F BB FB 12 01 F8 51 62 67
 Top of the page
phowarth Page Icon Posted 2009-05-01 10:59 PM
Avatar image of phowarth
Factorite (Junior)

Interesting.. lots of people are always asking for version 1.64, not sure what the difference with it is.

Did they include the 1.64 ROM on a DVD with the unit?

With the ability to tinker with the ROM it may be possible to get activesync to work on the usb port and dump the flash in the future.

One good thing from your header is the file size of the ROM. It is bigger than the 1.62 ROM( 17,667,423), which gives us an idea of how much bigger we can go.

Yours is BB FB 12 01 in little endian. Flip it around (0112FBBB) and convert to decimal and you have 18,021,307 as the file size with the Plenio header removed. You can verify this by deleting your Plenio header and saving the file under a new name. Then right click on the file and look at the properties.

Your files checksum is 676251F8 which you can also verify with winhex by deleting the header and using the Checksum32 generator under the tools menu.

The other bytes that I would still like to understand are 01 00 00 00 32 00 00 00 D7 07 00 00.

I was kinda hoping that tinkering with them then flashing the unit would maybe bring up the bootloader menu after a reboot. I have tried making a few changes to the Plenio header and flashing the unit, but it didn't make any difference.

I am going to try a few more combinations tonight and see if I can't get to the bootloader menu.

If not I will bite the bullet, cross my fingers and load up a ROM with actual changes to the wince registry. I bought the unit for hacking and so I guess I will have to figure out the JTAG if I brick it.


Edited by phowarth 2009-05-01 11:37 PM
 Top of the page
phowarth Page Icon Posted 2009-05-02 12:44 AM
Avatar image of phowarth
Factorite (Junior)

I can now absolutely say that this all works.

I bit the bullet and made some changes to the registry and uploaded the ROM.

Here are my changes

"Launch50"="explorer.exe" *** changed this from mainshell.exe. It now loads the windows desktop.


"Default"="US Eastern Standard Time" ** changed from Pacific time.

Cut the following to make to make the default.fdf file a bit smaller that the original. This is required to get the edited file inserted with binmod.exe

"Settings"=hex:ff,ff,00,00,ff,e6,e6,00,80,80,80,02,9f,60,70,02,a0,a0,a4,02, ff,ca,ca,00,ff,ff,ff,02,00,00,00,02,00,00,00,02,00,00,00,02,ff,ff,ff,02,ff, 97,97,00,ff,97,97,00,9f,60,70,02,9f,60,70,02,ff,ff,ff,02,ff,97,97,00,7f,7f, 7f,00,89,89,89,00,00,00,00,02,00,00,00,02,ff,e6,e6,00,00,00,00,00,ff,ff,ff, 00,00,00,00,02,ff,ff,ff,02,ff,95,95,00,00,00,00,00

"Settings"=hex:ff,ff,00,00,d8,f5,eb,00,80,00,00,02,46,46,8c,00,8d,8b,cb,00, a3,e7,cf,00,ff,ff,ff,02,16,56,40,00,00,00,00,00,00,00,00,02,ff,ff,ff,02,64, d7,ae,00,64,d7,ae,00,80,80,80,02,70,70,b8,00,ff,ff,ff,02,64,d7,ae,00,80,80, 80,00,4f,65,7d,02,00,00,00,02,d7,d7,d7,00,d8,f5,eb,00,00,00,00,00,ff,ff,ff, 00,00,00,00,02,ff,ff,ff,02,64,d7,ae,00,00,00,00,00

"Settings"=hex:ff,ff,00,00,f0,f0,d5,00,00,40,1d,00,80,80,00,02,bc,bc,41,02, c4,c4,55,00,ff,ff,ff,02,00,00,00,02,00,00,00,02,00,00,00,02,ff,ff,ff,02,c4, c4,55,00,c4,c4,55,00,ee,ee,d0,02,80,80,00,02,ff,ff,ff,02,c4,c4,55,00,80,80, 80,00,8c,8d,8b,00,00,00,00,02,ff,ff,ff,02,f0,f0,d5,00,00,00,00,00,ff,ff,ff, 00,00,00,00,02,ff,ff,ff,02,c7,c7,61,00,00,00,00,00

Next step is to try to increase the overall file size and add softkb.dll to get a working keyboard.

 Top of the page
shpitz461 Page Icon Posted 2009-05-03 10:37 PM
Avatar image of shpitz461
H/PC Newbie

phowarth, very cool stuff you're doing.
I'm wondering if you can share with us the steps you take to extract the bin, then modify files, then put it back together, then flash the image.

Also, if you need the v1.64 bin, I've uploaded it here: http://www.fileflyer.com/view/A5yonAP

Keep up the good work!
 Top of the page
naive Page Icon Posted 2009-05-13 5:21 PM
what are you tring to do here?

I want to update may map and even maybe put text to speech feature for my 2100. is it possible.
 Top of the page
uccoskun Page Icon Posted 2009-05-22 9:22 AM
I want text to speech on my 2100 and I want an update on my map. any luck here guys.

PS: if anybody needs, I have late 07 maps, I can create an iso file, then emule.
uccoskun at yahoo dot com.
 Top of the page
cmonex Page Icon Posted 2009-05-22 2:43 PM
Avatar image of cmonex
H/PC Oracle

Budapest, Hungary
congrats phowarth have you played with it anymore since then?
 Top of the page
uccoskun Page Icon Posted 2009-05-24 8:47 AM
are we tring to upload text to speach or some kind of operating system here?
 Top of the page
phowarth Page Icon Posted 2009-05-25 11:13 PM
Avatar image of phowarth
Factorite (Junior)

Hi cmonex,

I haven't done much with it since I bricked the original unit by changing the default documents and desktop file locations.

I have spent many hours trying to trace out the JTAG pins but so far not luck. I just bought a couple of used units off ebay so I will pick up the project again.

I am going to sacrifice the original board to hopefully find all of the JTAG pins before I brick another one.

I also picked up an XBOX 360 mod chip(infectus2) that can apparently reflash the NAND chip that is on the unit. I was going to use this as my backup plan if I can't get a working JTAG. Required some very fine soldier skills to even attempt.

For the others asking about maps and Text to Speach, AFAIK that has nothing to do with the ROM since those files are located on the SD Card. Since the primary use of the unit is in my boat my goal is a working keyboard with the system booting to the desktop and my own custom shortcuts to load OziExplorer etc.

So far I have

1. installed Ozi - works fine and you don't need a custom rom
2. installed a custom rom to change default time zone to eastern
3. installed a custom rom to boot to windows destop (works fine but I would save this mod for last next time to have a better chance of not bricking the unit testing other mods)
4. installed a custom rom to change the location of documents and destop folders - this brick the unit.

 Top of the page
a427 Page Icon Posted 2009-05-26 8:10 PM
Hello Phowarth !

Nice job for your NK file format investigations..

I've got a bricked GPS here that I would like to rescue (flash has been accidentally erased via the bootloader)
The GPS runs with an ARM926 CPU (centrality atlas ii I think), and windows CE 5.0

In your post, you mentionyour will to try JTAG;
do you have any information on how I could reprogram the flash of my GPS ?
I've located the JTAG pins on the board, and I have a separate JTAG probe for TI MSP430 micro controller

Do you think I could use the MSP430 JTAG adpater to reprogram the flash via the ARM ?
Or could I do with a simple, unbuffered, direct calbe ?
But then, what software would you advise me to use to do the actual JTAG programming ?
I heard about AtlasMgr but can't get it on the web...
Do you think that such open source projects such as urjtag or oocd could do the trick ?

Also I don't have a backup of the factory rom contents
and the manufacturer doesn't provide any on its website..
so do you think I could pick a random NK.bin file laying around (such as the ones referred to in this forum ?)

I'm a total JTAG-newbie...
thanks in advance...
 Top of the page
phowarth Page Icon Posted 2009-06-08 7:14 PM
Avatar image of phowarth
Factorite (Junior)

I haven't tried JTAGing yet.

I did download some tools Samsung's website by registering and I also found an open source JTAG program that runs on linux. Just google open JTAG and you will find some tools.

As for loading ROM image from a different manufacture, it won't work. The ROM images are built to specific hardware.

If you want to recover your unit you are going to have to find a working image for your specific unit.


 Top of the page
« 1 2 3 4 5 6 ... Next »
Jump to forum:
Seconds to generate: 0.394 - Cached queries : 66 - Executed queries : 10