vB Easy Archive - Getting i398 MPs onto the E1 ROKR

Pages: 1

Getting i398 MPs onto the E1 ROKR
(Click here to view the original thread with full colors/images)

Posted by: krazedout

Hi, I've decided to make a small guide for everyone who's interested in getting i398 MPs onto the real ROKR. While you will not be able to get the flash on, (Meaning that the ROKR, as of now, is still stuck at 45R) you'll still be able to enjoy all the new skins and java programs, etc that the MP creators have worked hard to bring to you.

Tools you need
1. ShxCodec - Available from modyomoto.com
2. Motorola PST/MFF - Find this yourself or another flashing program.
3. Stock 45R MP for the ROKR - also available from modyomoto.com
4. Your desired I398 MP.

Now I've only tested this with 6FR MPs, so I'm not sure if anything else will work. Feel free to give it a try though.

Steps
1. Start Shxcodec and split the I398 MP.
2. Now split the stock ROKR 45R MP.
3. Click on the Flex row (or CG2) and then click on replace.
4. Choose the Flex of the I398 MP. The filename of the Flex - the I398 MP one - should end with a "CG2.smg".
5. Click yes when prompted.
6. Choose the Langpack row. Replace it with the langpack of the I398 MP. (Similarly, the filename of the new langpack should end with "CG4.smg".)
7. Replace the DRM as well. The DRM section of the I398 MP should end with "CG15.smg".
8. Click on "Combine Files to *.shx". (This button name may vary depending on Shxcodec version. I'm using 2.6.0.)
9. Flash the new SHX with MFF.

You should have a successful flash. Enjoy your new MP!

If my instructions are not clear enough, please tell me.

Posted by: CyberGreg

Dude - EXCELLENT work! Has it changed your iTunes 50 songs? We should actually be able to "release" a ROKR based MP. Sweet....

Posted by: CuBaNPiTBuLL

I tried it on Several i398 MP's the only one that seemed to work was Sysmaster's rokrVIPER the rest of the MP's always got stuck at 84% of flashing the flex

if anybody else is having this problem please let me know

Posted by: krazedout

@Cybergreg: Nope, I really think the itunes stuff has something to do with the PDS.

@cubanpitbull: Can you give me a link to the MPs that didn't work? I'm going to give them a try.

Posted by: CuBaNPiTBuLL

Kraze, I tried almost all of the 6FR MP's at Rassilon's site www.gocellular.org

the only one that worked was the babyVIPER 6FR, for now im gonna stay with my custom stuff on my 42R

OH!! i cant believe i forgot!! great find on this, really really cool man, keep the good work up!!

Posted by: krazedout

Hmm... did you use a E1 OEM 42R flash or 45R flash?

And thanks for the encouragement!

EDIT: Okay, looks like this process doesn't work very well with some of the 6FR MPs. Going to try and see what went wrong. However, I can confirm that it works with BlueZre and rokrViper Reactivation.

Posted by: CuBaNPiTBuLL

I actually used 42R for the first ones (i like that one more) i thought it would be the same?

is there a difference? sorry if its obvious

Posted by: krazedout

Don't think there should be any difference.

I've noticed that both rokrVIPER reactivation and bluezre have the same layout as the 45R MP. (I.E, the CG starting addresses are the same and they all have 7 CGs. However, other MPs have 6 CGs and have different starting addresses for the CGs. Each CG also seems much larger.)

What I'm thinking is that the bootstrap for 45R is unable to deal with this new layout. Although I'm not too sure how it works, but that is what I understood from reading the SHX modding guide at the hofo wiki.

So it looks like you can only use MPs with a similar layout to the 45R MP for now.

Posted by: CuBaNPiTBuLL

Thanks for the update Kraze, do you think that it would be possible to edit the CG's or maybe even patch the 6FR Firmware to be compatible with the ROKR?

sorry if my questions are stupid but this is the deepest that i have ever gone modding if there's anyway that i can help feel free to contact me any way you like

Posted by: krazedout

Don't worry about the questions! No question is too stupid.

Okay, I think I've figured out how to get most of the non-working 6FR MPs onto the ROKR. It looks like the default RAMDLD for ROKR 45R was flashing all the CGs into the wrong places. I'll be updating the guide in a short while to reflect my findings. Currently I've managed to get Extreme for life 6FR onto my ROKR, which I previously was not able to do. Other similar MPs should now be able to be flashed on the E1.

EDIT: Okay, it looks like I can't edit. I'll be posting the new guide at the bottom then.

As for 6FR, I've been looking into the 6FR for a while and while I always get to the point where I think I've gotten 6FR into a workable state for the ROKR, it always fails. I'll post what info I have on 6FR (I'm still new to all this too

) so maybe other people can work on it as well if they're interested.

From what I can tell, I398 flashes always start with 11FE0000. (Look at the flash with a hex editor) E1 flashes, however, all seem to start with 10BCXXXX, where XXXX seems to be some sort of randomly generated number. (Actually I couldn't tell what they were for.)

E1 42R:
10BCD3D0

E1 45R:
10BCDC6C

I398 6FR, 45R, 42R:
11FE0000

Some bytes later on also seem to reflect this "code":

E1 42R:
11FE000011FE07FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF10BCD3D0

E1 45R:
11FE000011FE07FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF10BCDC6C

I398:
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11FE0000

However, that's as far as I got. I have no idea how to calculate the value of the first few bytes. Maybe it's a signature or something. There's another small patch required for the I398, I believe.

Look for:
20014770E59FC000E12F (On I398 Flashes)
and replace with
477846C0E59FC000E12F (To turn into an E1 flash? Not too sure on this.)

This piece of code is always near a "!m.GxF" text string. There should only be one patch required.

Well, that's all I got so far.

----------------------------
Updated guide
Tools needed
1. ShxCodec - Available from modyomoto.com
2. Motorola PST/MFF - Find this yourself or another flashing program.
3. Xvi32 or another hex editor - Google
4. Stock 45R/42R MP for the ROKR - also available from modyomoto.com
5. Your desired I398 MP.

Note: I'll only be using 45R in this guide. As such, I can't gurantee that 42R will work perfect. However, I think there shouldn't be any problems. I'll be using Extreme for life 6FR MP and a stock E1 45R MP as an example.

Steps
1. Split the 45R E1 MP in Shxcodec.
2. Split the I398 MP.
3. Now you need to look for any inconsistencies in the MPs.

Notice that the 45R MP has an extra CG7 while EiL MP does not have. Thus, you must delete CG7 from your final MP if you're using an MP like EiL. Also, if you notice any inconsitencies with the starting addresses for both MPs, you will need to hex edit the 45R RAMDLD.

4. If you need to hex edit the RAMDLD for the 45R MP, open both the i398 RAMDLD and the 45R RAMDLD.
I398 RAMDLD

Notice the line I highlighted. Copy this line. (I think this is the table of addresses for the ramdld. Edit as desired if you know what you're doing.)

45R RAMDLD

Now paste it over the exact same location in the 45R RAMDLD. (Paste where I highlighted.)
5. I'm assuming that you still have the i398 MP open in shxcodec. Now replace the ramdld with the hexed 45R ramdld, the flash with 45R flash (CG1), the DSP with 45R DSP(CG3) and the signature with the 45R signature. (CG18) If you are using an MP with no inconsitencies with the 45R MP, e.g BlueZre, you may also want to replace CG7 with the 45R CG7.

PS. You may want to replace the langpack as well if you're using a customized langpack.

6. Combine to shx and flash your phone with the new MP.

I think that's all there is to it. Tell me if there are any problems.

Posted by: krazedout

Bump.. is there any way I can edit my first post?

Posted by: CuBaNPiTBuLL

Great Job Kraze...im too lazy to do it @ the moment but im sure that it works...will post confirmation later

Posted by: CyberGreg

@krazedout

You ROCK dude!!!!!

After much trial and error I have created (the first???) ROKR MP!!!!! I would really like a couple of people to test it before releasing it into the wild.

PM me if you'd like to test it out. I'm fairly sure you have to load the OEM 45R if you haven't done so.

It is MotoModders themed with custom startup and shutdown screens (the E398 has a custom splash screen but I couldn't get the ROKR to load).

Here's what it includes:
Software: R373_G_0E.30.45R
Flex: MModders_cgV3.6a
Memory: 5788Kb
Free: 1235Kb

DRM:
Custom, but not by me (I'd give credit but I don't know who made it)

Skins: all 3x4 menu unless noted
Moto (w/red icons)
MotoMac (OS X)
iTigerWB
Neon
StarTrek (Techno style menu)
WinXP (full)
Xbox (Techno style menu)
MModders (default)
Incredibles
Tux

Java Apps:
Age of Empires
AlphaWing
Asphalt UrbanGT
BaldursGate
Colin McRae 05
Dictaphone
Eon the Dragon 2
Harry Potter
iPhone Explorer
JBenchmark2
Mahjong
Medievil Combat: Age of Glory
Midnight Bowling
Midnight Pool
MiniGolf - Castles
Opera Mini 1.1
Pitfall Glacier
Prince of Persia 4
Prince of Persia: Warrior Within
Rainbow6 Lockdown
Rayman3
ReadManiac 2.4
TombRaider2
War of the Worlds
XIII
Xyanide
ZUMA

Ringtones: Removed some original ones, kept some, added some MP3's.

Includes MMS templates, numerous web sessions (although I can only test the Cingular ones, they are the default). Also includes several custom desktops that can be deleted. No video's.. sorry..

The only area that I have not really worked on is Video. I think you can only record about 20-30 seconds of video. I'm still working on my E398_45R MP so if I can get that to record like 90 seconds or so I can recreate the ROKR MP.

I loaded it three times onto my ROKR and its still unlocked and loaded just fine each time (using MFF).

Posted by: odnerd

Subscribe to thread...

Posted by: psinet

Subscribing....

Top work guys. I am holding out on MP flashing my new ROKR because I am watching the developments here closely

Go for it!

Posted by: CyberGreg

All of my MP's including a 45R ROKR are available for download from my RapidShare site. Click Here to view.

The "unofficial" MotoModders 45R ROKR MP

It is MotoModders themed with custom startup and shutdown screens. I have been working on both a 45R MP and a 6FR (for my E398). Basically unlimited video is not that important to me so that’s why I used 45R. I’ve been testing it for weeks and I’m quite sure it will work great but as with all MP’s I’m interested in the first few people that load it to make sure it’s flawless.

PS This MP is for a real ROKR only, not an E398. See my other post for an E398 MP.

Here's what it includes:
Software: R373_G_0E.30.45R
Flex: MModders_cgV3.6a
Memory: 5312Kb
Free: 976Kb
Download file name: ROKR_MModders_45R_cgV3.6a_19-Jan-06_.7z
MP file name: ROKR_MModders_45R_cgV3.6a(19-Jan-06).7z

DRM:
Custom, but not by me (I'd give credit but I don't know who made it, based on V360 I think)

Font & LP:
Default font and English, Bahasa Melayu and Chinese (LP0024 I think). I was not able to get another LP to load properly onto the ROKR.

Menus:
(1)Phonebook (2)Message (3)Dial Services (4)WebAccess (5)Games & Apps (6)Settings (7)Security (8) Multimedia (9)Tools (10)Ring Styles (11)Connectivity (12)Shortcuts

Note: For Techno Style menu - (9)Security (10)Ring Styles (11) Connectivity (12)Shortcuts will be in the (9) Extra menu

Home Keys: All keys are reprogrammable
Up: Ring Styles | Down: Phonebook | Left: Personalize | Right: Recent Calls
Softkeys: Left: Tools | Right: Messages
Smartkey: Video Camera

Skins: all 3x4 menu unless noted
Moto (w/stock red icons) | MotoMac (OS X) | iTigerWB | Neon | StarTrek (Techno style menu) | WinXP (full) | Xbox (Techno style menu) | MModders (default) | Incredibles | Motoskins (Large Menu) | Tux | Indium

Note: All skins were “adjusted” to allow iTunes to look good in hide mode

Network:
Quad-band (850/1900 | 900/1800) Speed: Medium | Airplane and Engineering mode: Yes | Has My Network List: Yes | Has Service, Network & Drop tones: Yes

Multimedia:
Sounds: 2 imy, 21 mid and 10 mp3 (not removable)
Ring Styles: Loud and Soft preset (Default Soft)
Pictures: 27 extra wallpapers (removable)
Videos: None
Video Recording: full menu with style, flash, resolution, quality, etc.
Camera: with auto-timer and flash

Messaging:
MMS Templates: Yes | Quick Notes: Yes, 7 | Message animations (EMP) hidden properly | MMS: Set Receiving to 30 kb, 100 kb or 300 kb, default is 300 kb

Java Apps:
Age of Empires | AlphaWing | Asphalt UrbanGT | Asphalt2 | BaldursGate | Colin McRae 05 | Dictaphone | Eon the Dragon 2 | iPhone Explorer | JBenchmark2 | Mahjong | Medievil Combat: Age of Glory | Midnight Bowling | Midnight Pool | MiniGolf – Castles | Opera Mini 1.1 | Pitfall Glacier | Prince of Persia 4 | Prince of Persia: Warrior Within | Rainbow6 Lockdown | Rayman3 | ReadManiac 2.4 | TombRaider2 | XIII | Xyanide | ZUMA

Misc:
WebSessions: Many, default is Cingular – you can edit (alpha keys work) | Menu thump: NO | Volume: Loud | Calendar: from Sun to Sat | Sound Player can hide | Option for SMS to store in the SIM or Phone (Default: Phone) | Call Restriction enabled | USB: Default Data / Fax Modem | Entry Mode Set: Tap English, iTap English

Posted by: DaILoMaC

whats this format .7z.. is it a zip file???

Posted by: CyberGreg

More info here... http://www.7-zip.org/7z.html

Posted by: krazedout

Nice work Cybergreg!

Glad to see that you are releasing it officially!

What was the problem with the custom LP?

Posted by: psinet

*Breaks out the Bett Midler*

"Did you ever know that your my ......."

I cant say it. Top work.

Posted by: CyberGreg

Quote:

Originally Posted by krazedout

Nice work Cybergreg!

Glad to see that you are releasing it officially!

What was the problem with the custom LP?

Don't know... this MP still has LP0024 and the stock font. But I just had to get it out into people's hands... hopefully someone can figure out how to change the LP and get one of the new fonts into it.

Posted by: odnerd

Do I gotta upgrade to 45r before using this flash or does it do it for me?

Posted by: CyberGreg

Quote:

Originally Posted by odnerd

Do I gotta upgrade to 45r before using this flash or does it do it for me?

Actually that is what I'm trying to figure out. The MP has the 45R flash so it should upgrade your phone. It would be great if you could just try it first, don't worry even if you phone gets messed up we can fix it just by loading the OEM ROKR 45R MP.

What software are you at now, 34R or 42R?

Posted by: odnerd

34R - Acually don't know if I want to or not. I've already got 7 skins, 18 games, 23 wallpapers, 12 mp3 ringtones and all the cingular/moto stuff deleted. Spent a whole day doing that and don't know if it's worth changing now. I might wait on a couple ppls feedback about this MP first.

Posted by: odnerd

Quote:

Originally Posted by odnerd

......Spent a whole day doing that....

Well, more like an hour or two but still..... lol

Posted by: DaILoMaC

so odnerd.. whats the status.. did it work???

Posted by: aze2learn

Lol .. the other way around is to make a flexflash which is much simple ...

1) Open shxcodec and make sure the flex address starts at 11100000 or do not proceed.
2) delete all except ramdownloader and CG2
3) grab a ramdld from original ROKR 45R MP and replace it into this ramdownloader
4) combine the file
5) flash it into the phone .. viola

or ...

1) Open shxcodec and make sure the flex address starts at 11100000 or do not proceed.
2) open flashbackup and select the MP
3) untick all except flex
4) flash it into the phone

NOTE : some MP makers still use the old 07E0 ramdownloader which change the flex start address to 11140000 .. this is not possible to make a flexflash ..

regards