Edit your hw6500′s Extended ROM

As the title reveals, this time it’s about hacking your HTC Beetles / hw6500 (in fact mine is branded hw6515) EXTROM. I know it’s a rather old device, but it makes fun (sort of)  – wouldn’t it be fun, to have a autostarting bootloader and a linux kernel in the Extended Rom of the Device? Hell Yeah!

As Linux support is already in the Handhelds.org 2.6 Kernel Tree, but unfortunately it seems to run only on the HTC Sable / hw6900, and the Kernel does not start on the HTC Beetles.  Except the Memory size, and the lack of WiFi, there seems to be no difference between the HTC Sable and the HTC Beetles, and so, the whole codebase for Sable is shared with the Beetles.. Anyway, i can’t test this kernel on the HTC Sable (my husband has one), because i cannot write to that iffy 2gb MiniSD thingie with both of my Cardreaders, not even in windows..

But fortunately enough, i was able to mount and reorganize the EXTROM with my linux notebook, maybe it’s also possible with windoze, but i don’t want to know that. just get yourself familiar with linux possibly this also works with the hw6900 aka HTC Sable, and probably other htc devices – i don’t know, if you want to try, theres a little guide at the end of the post.

i assume the following:

1. your knowledge what’s that Extended Rom is about (and that you can brick brick brick (!) your device!)
2. you know how to get into the bootloader mode of the HTC Beetles (see xda-developers wiki) and save the whole Content of your hw6515 on a appropriate sized SD card.
3. all these steps are done on the latest ubuntu lucid lynx beta and works for me.
4. I don’t care (nor do i take any(!) responsibility) if your device never works again after that procedure. Be warned, it could squish your beetle!
5. the process will wipe the content of your HTC Beetles, do a backup of your device first!
6. (almost forgot that) to control the bootloader of your device, put it into your usb-connected cradle. use minicom -d /dev/ttyUSB0 or something alike, and you’ll get the bootloader commandline.

Fine! We start right at the point after you created your shiny new SD Image. Put it in your Cardreader of your linux box. Don’t Panic, the Image on the SD has some special raw format, and your box can’t mount it and will (maybe) ask you to format that card. Don’t!

open a terminal and get root (or use sudo), and let’s assume your SD card is /dev/sdX in your system. inform yourself about the real location of the card, check dmesg. you could kill some partition on your harddrive if you don’t use the right device, be warned once more!

enough of the warnings, let’s start the fun. Execute the following command

# dd if=/dev/sdX of=hw6500_rom.bin

you have to wait patiently, because dd copies every bit of your SD card into that file. The Image Size is depending on the SD Card size you use, i guess. mine got 1GB, i don’t think that it really uses all space on that SD, the Rom on the Device itself is 64MB. Maybe you can strip that hw6500_rom.bin with a hex editor, i haven’t checked that.

when dd finishes its job, get that sdcard out, label it with something like ‘backup’ and store it in a safe place, if you screw things up, you can use it (possibly) as backup as long as your bootloader works, again, i haven’t checked that, because there was no need to do so

Finally, the easy Part, create some temporary directory in your home folder, and invoke:

# mount -t vfat -o loop,offset=0x334019C hw6515-rom.bin tmp/

now you can access the funny Cab files HP or your provider put into your Extended Rom for customizing. There is a autostart.exe and a config.txt you can use to autostart something (the config.txt is pretty self-explanatory) and there’s some documentation about that on the xda-developers wiki. i can’t help you with that

when you’re done with customizing:

# umount tmp

then, insert a new (preferrably empty) SD card into your cardreader, umount it if linux mounts it automagically.

# dd if=hw6500_rom.bin of=/dev/sdX

after that, put your hw6500 into bootloader mode again, and invoke the rom upgrade from sdcard. it takes some while, just be patient. if it explodes or does absolutely nothing anymore, that’s bad luck – see point 4 of the introduction. at the end of the flash process my hw6515 said ‘download failed’, ‘crc error’. i rebooted the ipaq, and everything went fine, windows ce was loading, and the extrom was the way i expected (i had to set the mountflag in the windows registry, using phm regedit and start the load_vdisk program, found in \windows\autostart – before that the ‘free memory’ display goes bananas

So, and now to other HTC users, take your dump or your .nbf file into a hexeditor and search for FAT16 header. somewhere is a FAT16 in ascii, thats 46 41 54 31 36. Go back some offsets and look out for EB FE(?) for FAT16 or E9 49(?) for FAT12 (found on HP iPaq h6315, that offset was 0xc28 in iPAQROM.nbf).