First off, my eternal thanks go to utak3r from BuzzDev.net. Without his tutorial I would of been buggered. I’m basically going to paraphrase his tutorial with a bit less techy-talk so you guys don’t get scared. Original thread is here;
[TUT] Flashing Himalaya from a SD card.
If you want to get some hands-on knowledge of how this all works, read on, otherwise, I’ve created a nifty little zip package that will do everything below (with the exception of a few manual bits, but my script is pretty noob-friendly, so don’t be afraid to give it a go!)
MakeSDBoot.zip – My automated SD Card restore suite!
1. Getting started.
Right. What you will need is the following;
HTC Himalaya (also known as O2 XDAII among other names, check out this link).
SD Card (the guide recommends 1GB or smaller. SDHC cards are NOT supported by the HTC Himalaya).
SD Card reader.
Windows XP 32-bit or Windows Vista 32-bit. You can NOT use 64bit as the driver does not exist for Microsoft USB Sync.
ROM Support Tools. Google “backup_SD_tools.zip”.
Mtty 1.42 or newer.
Patience.
2. Disable ActiveSync USB connection.
Open up ActiveSync (Windows XP) and go to Options -> Connections and untick “Allow connections via USB”. When you connect your device later on, a new device called “Microsoft USB Sync” should be found and should install fine on 32bit.
3. Put device into Bootloader mode.
Sounds scary, but it isn’t. Remove any cards that are in the device. If you don’t know already, to put your Himalaya into Bootloader, press the reset button whilst holding the power button and the D-Pad. It should boot into a grey screen with black writing that should be very hard to read, but should read “Serial” at the top with “v1.xx” at the bottom. When you have got this done, release all buttons and put the device into the cradle. It should change from “Serial” to “USB”. Now we’re in business.
4. Getting a header.
What is a header? Who cares, you need it. How to get it? This is where Mtty comes into play.
With the device in bootloader mode, plugged in and with a “Microsoft USB Sync” in Device Manager, go ahead and load up Mtty. Under the first dropdown box you will probably see “COM 1″. Change this to USB, leave everything as-is and hit OK. You will be greeted with a white screen that has nothing in it (it’s called a terminal). Hit enter a few times until “USB>” appears. Now we’re cooking with gas. Type the following;
password BOOTLOADER
Pass.
It should then just go back to the USB> prompt. There might be some other characters as well, but ignore it. It should be fine. Then type;
d2s
The prompt should now read “SD:Waiting for card insert………”. Insert your SD card now, and the phone will do the rest… this should take a minute or so. It will show a whole bunch of text and then come up with;
Store image to SD/MMC card successful.
USB>
The first bit is over! Let’s move on.
You now have the device backed up onto your SD card. It’s written RAW, which means you don’t actually see what’s on the card, so make sure you don’t accidentally format or overwrite anything on the card, or you’ll have to start all over again.
Using the “psdread.exe” you got from the SD Tools (or my awesome MakeSDBoot.zip package), you have to read the phone header from the SD card.
c:>psdread.exe m: 0 0x19c
Replace m: with whatever the drive letter is for your SD card. You should get something like this;
00000000: 48 49 4d 41 4c 41 59 41 53 20 20 20 20 20 20 20 HIMALAYAS 00000010: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0000000000000000 00000020: 31 2e 30 36 20 20 20 20 20 20 20 20 20 20 20 20 1.06 00000030: 78 7e a8 50 96 f5 45 3b 13 0d 89 0a 1c db ae 32 x~.P..E;.......2 00000040: 20 9a 50 ee 40 78 36 fd 12 49 32 f6 9e 7d 49 dc 1.P..x6..I2..}I. 00000050: ad 4f 14 f2 44 40 66 d0 6b c4 30 b7 32 3b a1 22 .O..D.f.k.0.2;.. 00000060: f6 22 91 9d e1 8b 1f da b0 ca 99 02 b9 72 9d 49 .............r.I 00000070: 2c 80 7e c5 99 d5 e9 80 b2 ea c9 cc dd 00 4c f2 ,.~...........L. 00000080: 53 41 30 30 e1 dc d6 ae 83 90 49 f1 f1 ff e9 eb SA00......I..... 00000090: b3 a6 db 1e 87 0c 3e 77 24 42 0d 1c 06 b7 47 de .......w$B....G. 000000a0: 6d 12 4d c8 43 2e cb a6 1f 03 5a 7d 09 38 25 1f m.M.C.....Z}.8%. 000000b0: 5d 9f d4 fc 96 f5 45 3b 13 0d 89 0a 1c d3 90 2d ].....E;.......- 000000c0: 48 9a 50 ee 40 78 36 fd 12 49 32 f6 9e 81 49 dc H.P..x6..I2...I. 000000d0: ad 4f 14 f2 44 40 66 d0 6b c4 30 b7 3c 84 f2 87 .O..D.f.k.0..... 000000e0: 61 49 d1 4f 0a d8 16 e7 72 e6 bb 12 84 34 a6 77 aI.O....r....4.w 000000f0: 02 37 e4 97 2c 74 cb c9 12 68 33 74 9e ad 87 d5 .7..,t...h3t.... 00000100: fa 16 bb 11 ad ae 24 88 79 fe 52 db 25 43 e5 3c ......$.y.R.%C.. 00000110: b3 12 4d c8 43 bb 8b a6 1f 03 5a 7d 09 38 25 1f ..M.C.....Z}.8%. 00000120: 5d d4 cb fc 96 f5 45 3b 13 0d 89 0a 1c db ae 32 ].....E;.......2 00000130: 20 9a 50 ee 40 78 36 fd 12 49 32 f6 9e 7d 49 dc ..P..x6..I2..}I. 00000140: ad 4f 14 f2 44 40 66 d0 6b c4 30 b7 32 3b a1 22 .O...D.f.k.0.2;. 00000150: f6 22 91 9d e1 8b 1f da b0 ca 99 02 b9 72 9d 49 .............r.I 00000160: 2c 80 7e c5 99 d5 e9 80 b2 ea c9 cc 53 bf 67 d6 ,.~.........S.g. 00000170: bf 14 d6 7e 2d dc 8e 66 83 ef 57 49 61 ff 69 8f ...~-..f..WIa.i. 00000180: 48 54 43 53 41 30 30 34 30 30 30 30 30 31 46 43 HTCSA004000001FC 00000190: 30 30 30 30 46 45 46 39 46 32 43 44 0000FEF9F2CD
- Means absolutely bugger all to us, but it contains some important bits. Let’s have a look at the last two lines;
HTCS A0040000 01FC0000 FEF9F2CD
A0040000 – location of the OS image in hexadecimal on your backup.
01FC0000 – size of the OS image (in hexadecimal bytes) *important*.
FEF9F2CD – checksum
You need to take the OS image number, and add 4 bytes to it. So 01FC0000 + 4. Use a hexadecimal calculator or type it into Google. This number might be different, which is cool.
c:\> psdread.exe m: 0 <number> os.img
Now you’ve got an image of the OS that was on the device. Now we get the header file.
c:\> psdread.exe m: 0 0x19c header.img
5. The core operating system.
We need something called os.nb. This exists inside the ROM you were trying to flash, so we need to extract it using the SD Tools. Get the nk.nbf from the ROM you were trying to flash, or any ROM that you want to get the Operating System from, and then do the following;
c:\> xda2nbftool.exe -x nk.nbf nk.nba 0x20040304
Now we’ve got an nk.nba. This is where we extract the all-important os.nb file.
c:\> dump.exe -o 0x40040 -l 0x1FC0000 nk.nba os.nb
Magic!
6. Making our SD ROM Flash Image.
More commands to type! Basically putting everything into one file ready to flash on your phone. Make sure you use the right amount of “>” in the next two lines;
c:\> type header.img > SD_img.img
c:\> type os.nb >> SD_img.img
Now we’ve got a file called SD_img.img. This is your ROM! We’re almost done, not long to go! Not too hard is it?
c:\> psdwrite m: SD_img.img
Again, replace m: with your SD card drive letter. This takes a little while, be patient. When it returns to your “c:\blah” prompt, your SD card is ready to rock!
7. Flashing your device.
The scary bit!
Well, not really 
Turn off your Himalaya (your best bet would be to pull out your battery), put your SD card in and turn it on. If all goes sweet, after a few seconds (allow up to 10 seconds) it should display a message: “press power to flash”. Just press the power button and wait until it finishes. Wait. I mean it. Don’t touch it. Leave it alone, this could take a while (anywhere from 10-25 minutes). Go make a coffee or something.
When it is done, it should show “Checksum OK!”. Sometimes it will show “Checksum FAIL! Flash Failed!” or something similar. Ignore this. Go ahead and hard-reset your device (Hold Camera + Voice Record + Reset). Let go of the reset button when it turns back on but wait until it comes up with 3 menu options;
- Enable KITL : No/Yes
- Clean Registry Hive : No/Yes
- Format Storage : No/Yes
Use the Voice Record button to move down the menu and use the Camera button to toggle “Format Storage” to yes. Hit the DPAD and you should be booting Windows Mobile!
Enjoy your recovered HTC Himalaya. And next time you flash, follow the instructions, or RTFM!
Comments (0)