Index

• 電源投入時のキー

D + Power = SD UPDATER (softbank change the name TF__ORCA.XLD to TFORCA_J.XLD )
A + J + Power = BootLoader
W + N + Power = RNDIS
Q + B + Power = USB download RNDIS
E + V + Power = UDC_ENABLED wait usb connection.
U + Power = LOOP RESET (unknown)
Z + J + Power = FLASH SCREEN (unknown)

• Version
  • IPL-2.17
    • IPL write password: 12345678

• アプリケーションロック解除
  • 以下レジストリを編集。この作業を行わないと次ステップのコマンドが実行出来ない。

[HKEY_LOCAL_MACHINE\Security\Policies\Policies]
"00001001"="1"

• Hermes_Howto Dump Rom
• パーティション情報確認
  • itsutilsを使用する

C:\itsutils>pdocread.exe -l
 76.95M (0x4cf4000) TFFS
|           1.25M (0x13fc00) Part00
|           2.13M (0x220000) Part01
|          73.58M (0x4994000) Part02
 36.00M (0x23ffa00) TFFS1
|          35.96M (0x23f5a00) Part00
767.00k (0xbfc00) TFFS2
|         510.50k (0x7fa00) Part00
982.50M (0x3d680000) DSK1:
|         982.38M (0x3d661a00) Part00
STRG handles:
handle a6df5756982.38M (0x3d661a00)
handle 87e60f0a510.50k (0x7fa00)
handle a7f52e36 35.96M (0x23f5a00)
handle 47fc3c96 73.58M (0x4994000)
handle 27fc39e2  2.13M (0x220000)
handle c7fc39ae  1.25M (0x13fc00)
disk a6df5756
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87e60f0a
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 1d 14 01 04 0d 17 0c b5 13 0a 06 c0
disk a7f52e36
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 1d 14 01 04 0d 17 0c b5 13 0a 06 c0
disk 47fc3c96
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 1d 14 01 04 0d 17 0c b5 13 0a 06 c0
disk 27fc39e2
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 1d 14 01 04 0d 17 0c b5 13 0a 06 c0
disk c7fc39ae
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 1d 14 01 04 0d 17 0c b5 13 0a 06 c0


C:\itsutils>

• テスト

>pdocread -w -d TFFS -p Part00 -t
real nr of sectors: 2558  -   1.25Mbyte, 0x13fc00
>
>pdocread -w -d TFFS -p Part01 -t
real nr of sectors: 4352  -   2.13Mbyte, 0x220000
>
>pdocread -w -d TFFS -p Part02 -t
real nr of sectors: 150688  -  73.58Mbyte, 0x4994000
>
>pdocread -w -d TFFS2 -p Part00 -t
real nr of sectors: 1021  - 510.50kbyte, 0x7fa00

• dump

>pdocread -w -d TFFS -p Part00 0 0x13fc00 Part00.raw
>pdocread -w -d TFFS -p Part01 0 0x220000 Part01.raw
>pdocread -w -d TFFS -p Part02 0 0x4994000 Part02.raw
>pdocread -w -d TFFS2 -p Part00 0 0x7fa00 TFFS2_Part00.raw

• OS部分のファイル抽出
  • 以下は古い！！ ImgfsTools を使うこと！！
  • Hermes_Howto Extract Imgfs
  • ActivePerl5.8.xをインストール　※5.10.xでは Xdaモジュールがインストール不可!!
  • rdmsflsh.plをダウンロード
    • rdmsflsh.pl
  • スクリプトの実行

>mkdir files
>rdmsflsh.pl -d files Part02.raw

[snip]

       0 0045 2006-12-05 00:16:10 blank.pwi
      28 0047 2007-11-09 14:13:55 .ROM
      16 0047 2007-11-09 14:13:55 .VM
statistics:
 25688 [ 0x00006458 ] compressed
 34036 [ 0x000084f4 ] datablocks
  1596 [ 0x0000063c ] ent_fffff6fd
   915 [ 0x00000393 ] ent_fffff6fe
  1158 [ 0x00000486 ] ent_fffffefb
   462 [ 0x000001ce ] ent_fffffefe
   917 [ 0x00000395 ] files
   460 [ 0x000001cc ] modules
  1596 [ 0x0000063c ] sections
  4064 [ 0x00000fe0 ] uncompressed

>

• TFFS2 Part00 内のファイル一覧

2000/01/01  00:00                 0 DONT_DEL.000
2000/01/01  00:00                 0 DONT_DEL.001
2000/01/01  00:00                 0 DONT_DEL.002
2000/01/01  00:00                 0 DONT_DEL.003
2000/01/01  00:00                 0 DONT_DEL.004
2000/01/01  00:00                 0 DONT_DEL.005
2000/01/01  00:00                 0 DONT_DEL.006
2000/01/01  00:00                 0 DONT_DEL.007
2000/01/01  00:00                 0 DONT_DEL.008
2000/01/01  00:00                 0 DONT_DEL.009
2000/01/01  00:00                 0 DONT_DEL.010
2000/01/01  00:00                 0 DONT_DEL.011
2000/01/01  00:00                 0 DONT_DEL.012
2000/01/01  00:00                 0 DONT_DEL.013
2000/01/01  00:02           129,496 encsyc.exe
2008/03/30  00:06            22,532 fingerfiles
2008/03/30  00:06                14 fingerinfofiles

• SuperRUU

• Package Tool

[Selected Path]
  D:\X01T\ROM-Tool\ImgfsTools\dump

[Core OS]
  Windows Mobile-based Pocket PCs

[Versions]
  SYS: 5.2.17740.200
  SYS: 5.2.17754.208
  NET: 2.0.7045.0
  SYS: 5.2.0.208
  OEM: 5.2.0.208

[Language]
  0411 - Japanese (Japan)

[DPI]
  192

[Certificates]
  CN=Microsoft Windows Mobile PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  CN=THOSHIBA Ship Root

[Missing Manifests]
  d92a4f0a-378a-4482-8fd3-bd127a05e4de.dsm
  723fb954-d931-4348-b672-82a188e587b5.dsm
  287a705d-e59e-8e39-1615-30c934970cb3.dsm
  3bb37e9b-3417-4a4d-9a1a-2cb23c6e7fa0.dsm
  dd731d28-fa4d-4f62-99af-3ccee47d569f.dsm

[Selected Path]
  D:\X01T\ROM-Tool\ImgfsTools\X01T-EN-dump-Pack

[Core OS]
  Windows Mobile-based Pocket PCs

[Versions]
  SYS: 5.2.19202.1000
  NET: 2.0.7045.0
  OEM: 5.2.0.1000

[Language]
  0409 - English (United States)

[DPI]
  192

[Certificates]
  CN=Microsoft Windows Mobile PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  CN=THOSHIBA Ship Root

[Missing Manifests]
  45116509-e364-4775-9098-c25f0b1fbac2.dsm
  d92a4f0a-378a-4482-8fd3-bd127a05e4de.dsm
  723fb954-d931-4348-b672-82a188e587b5.dsm
  096328f6-d0e5-fb26-6412-483a1bda5680.dsm
  dd731d28-fa4d-4f62-99af-3ccee47d569f.dsm