Converting .img to .nb0 to recover a 'bricked' Axim

[PaulH]

Hi all

In an attempt to recover an out of warranty dead Dell Axim X50v I'm trying
to discover the differences between the Dell downloadable ROM .img file and
an .nb0 raw file.

Here's a picture of the start of the latest A05 ROM .IMG file in ultraedit
:-
http://tinyurl.com/7wmqe

..and here's another example from the .IMG file for the WM5 upgrade :-
http://tinyurl.com/ckm4b

Now I know that the header in the IMG files (before the zeros) contains
information about ROM version and language to prevent downgrading or cross
flashing to another language version.

What I'm wondering is if I remove the header from an IMG file including the
leading zeros, will I end up with an NB0 file?

If it's not quite this straightforward then perhaps someone could enlighten
me?

Of course, I need an .NBO (and possible a .CRC file as well?) in order to
boot directly from an SD card and force the ROM onto the currently
inoperable Axim. I can't sync to the PC and update the firmware in the usual
manner due to the unit being out of service.

Thanks
Paul

BTW, for completeness here are the SD boot instructions :-
--------------
Follow these steps to install

1. Copy the image file (*.nb0) and the corresponding CRC file to one SD card
root directory (the SD card must be formated as FAT32).
2. Insert that SD card into PDA
3. Hold "Power" + "Wireless" + "Reset" simultaneously for one second.
Release "Reset" and hold the other two buttons until system comes up a
screen for SD Update Mode.
4. Use the navigator (Up or Down) to select which image you want to update
if more than one valid image existing on the SD card
5. Wait till reflash completes.

Note: If the card cannot be recognized, or no file is found, please
re-format the SD card and repeat the above steps.
--------------

[PaulH]

Post by PaulH
Hi all
In an attempt to recover an out of warranty dead Dell Axim X50v I'm trying
to discover the differences between the Dell downloadable ROM .img file and
an .nb0 raw file.
Here's a picture of the start of the latest A05 ROM .IMG file in ultraedit
:-
http://tinyurl.com/7wmqe
..and here's another example from the .IMG file for the WM5 upgrade :-
http://tinyurl.com/ckm4b
Now I know that the header in the IMG files (before the zeros) contains
information about ROM version and language to prevent downgrading or cross
flashing to another language version.
What I'm wondering is if I remove the header from an IMG file including the
leading zeros, will I end up with an NB0 file?
If it's not quite this straightforward then perhaps someone could enlighten
me?
Of course, I need an .NBO (and possible a .CRC file as well?) in order to
boot directly from an SD card and force the ROM onto the currently
inoperable Axim. I can't sync to the PC and update the firmware in the usual
manner due to the unit being out of service.
Thanks
Paul
BTW, for completeness here are the SD boot instructions :-
--------------
Follow these steps to install
1. Copy the image file (*.nb0) and the corresponding CRC file to one SD card
root directory (the SD card must be formated as FAT32).
2. Insert that SD card into PDA
3. Hold "Power" + "Wireless" + "Reset" simultaneously for one second.
Release "Reset" and hold the other two buttons until system comes up a
screen for SD Update Mode.
4. Use the navigator (Up or Down) to select which image you want to update
if more than one valid image existing on the SD card
5. Wait till reflash completes.
Note: If the card cannot be recognized, or no file is found, please
re-format the SD card and repeat the above steps.
--------------

I'm not sure if this posted first time so I'm just giving it a second go.

[PaulH]

Post by PaulH
Hi all
snip

If anyone is famiiar with the .nb0 file format for the Axim X50 then please
head on over to http://www.aximsite.com/boards/showthread.php?t=105233 where
we've managed to dump the ROM and are now trying to convert it to .nb0

The ultimate upshot of all this is the possibility of recovering 'bricked'
axims and the more elusive goal perhaps of eventually running linux on the
Axim.

Any offers of help would be much appreciated. Perhaps this is not the most
appropriate place to post. If so where would be a better group?

Many thanks
Paul

[Steve Maillet (eMVP)]

NB0 file format is brain dead simple; it's a byte for byte copy of the data
as it should appear in ROM for execution. That is - there is no "format" to
it at all, it's just the raw data.

[Steve Maillet (eMVP)]

the .IMG format is not documented and you would need to reverse-engineer it
to figure out if it is compressed, or encrypted or both.

[PaulH]

Many thanks for the pointers Steve.

We've had a good bash at recreating a suitable diag.nb0 file but the
bootloader flash app on the Axim just sits there doing nothing with it. I
think we need to create a suitable .CRC file.

Not knowing which CRC algorithm Dell favour I created a CRC32 plaintext file
like :-


-----
CRC Values for diag.nb0

diag.nb0 -- 1293EAB9
------

...and named this diag.crc but it doesn't seem to be in the right format so
we're now on the search for some way of putting some/all of the following
details into various CRC formats:-

filename diag.nb0
length 62,601,657 bytes
CRC32 'checksum' 1293EAB9


Any help from any quarter would be much appreciated.

[PaulH]

Is there anyone who'd be happy to create a few CRC files in common formats
that we could try? Access to the ROM binary if necessary is not a problem.

Paul
x50v(spamtrap)rom_AT_googlemail_DOT_com

[PaulH]

Post by PaulH
Is there anyone who'd be happy to create a few CRC files in common formats
that we could try? Access to the ROM binary if necessary is not a problem.
Paul
x50v(spamtrap)rom_AT_googlemail_DOT_com

Actually the above request is bunk.
I should have provided more info. Of course I've tried plain text and binary
files just containing the CRC value using various CRC algorithms but I think
the bootloader is parsing the CRC file expecting some proprietary format.
Brute forcing the correct format is probably out of the question. So what we
really need is someone who could decompile/reverse engineer the bootloader
and see what it's looking for.