I have refined the procedure for extracting the WinCE components. I was using the wrong decompression method (wince4.x) when I should have been using wince3.x.
Code:
Usage: dumprom [options] imagefile [offset [imagefile offset ...]]
-d <dirpath> - save found files/modules to this path
-v - verbose : print alignment, struct contents
-q - quiet : don't print anything
-n - don't use negative rva fix
-u <ofs>L<len>:desc - add user defined memory regions to complete image
-x <offset> - process XIP chain at offset
-i <offset> - specifiy image start offset
-3 - use wince3.x decompression
-4 - use wince4.x decompression [ default ]
-5 - use wince4.x decompress, and e32rom for wm2005
Execute viewbin.exe to determine the start and length of the ROM image, and the CPU type.
Code:
ViewBin... \downloads\Knit_Machine\root\nk.bin
Image Start = 0x00200000, length = 0x004C2B7C <-------------
Start address = 0x00204990
Checking record #142 for potential TOC (ROMOFFSET = 0x80000000)
Found pTOC = 0x806c1eec
ROMOFFSET = 0x80000000
ROMHDR ----------------------------------------
DLL First : 0x01A70000
DLL Last : 0x02000000
Physical First : 0x80200000
Physical Last : 0x806C2B7C
RAM Start : 0x806C3000
RAM Free : 0x806E8000
RAM End : 0x81000000
Kernel flags : 0x00000000
Prof Symbol Offset : 0x00000000
Num Copy Entries : 1
Copy Entries Offset : 0x806C2B6C
Num Modules : 86
Num Files : 13
MiscFlags : 0x00000000
CPU : 0x014c (x86) <-------------
Extensions : 0x802026E0
Use a hex editor to change the CPU type in dumprom.exe from MIPS R4000 (66 01) to x86 (4C 01) and rename the file to dumprom_x86.exe.
00001E60 0C FF FF FF 66 01 8B 4D 0C 66 8B 11 66 89 95 0E
00001E60 0C FF FF FF 4C 01 8B 4D 0C 66 8B 11 66 89 95 0E
Then execute the following commands:
Code:
cvrtbin -r -a 0x00200000 -w 32 -l 0x004C2B7C nk.bin
md dumpwce3
dumprom_x86 -d dumpwce3 -v -3 nk.nb0 > dumprom_wce3.log
The contents of NK.BIN will be extracted/decompressed to the dumpwce3 directory and the results will be logged in dumprom_wce3.log.
Attachment:
WinCeDin.gif [ 4.27 KiB | Viewed 14435 times ]