Messages: Please use the inbrite.com forum for our discussions & Q&A.

News: It is reported that iTunes 9 is compatible with jailbroked iPhones... Now I got an iPhone 3GS. I will be posting something about it...

Sponsors links:

Friday, February 23, 2007

Change boot picture - part 1

Change boot picture
part 1: find out the address of the picture in the flash
You may know that you can use motorola bootscreen replacer to replace the boot pictures (Hellomoto or Welcome pictures). However, before you can do that, you need to find out the address of the pictures in the flash, unless the address is already known and configured in the bootscreen replacer. This guide will show you how to find out the address and configure it in motorola bootscreen replacer.

There are two ways to find out the offsets, the graphical way and the Hex way.

Method 1: the graphical way

Tool you need:
Corona_editor
RandomSHX or SHXCodec

Steps:
1. use RandomSHX or SHXCodec to extract/split the MP that you want to mod;

2. open the CG1 bin/smg file in Corona_editor, as shown in following screen;


This is translation of the Corona_editor screen:


3. set width/height/color according to your phone, for example, 176/220/16bpp respectively;

4. click "jump to", then repeat clicking "Down page" until you find a screen similar to the following one;


5. click "Down/Up/Right/Left" button to adjust the picture position, until you see the full picture on screen;


6. click "+ Color" button to have a nicer preview, re-adjust the position if necessary;


7. write down the address, for example: 53E3C7

8. if you want to also replace the Welcome screen, repeat steps 4-7 to find out the address for the "Welcome" picture;

9. open offset.ini file in the folder of motorola bootscreen replacer, add the offset setting as follows;


"backup_shift" is the starting offset of CG1. "backup_shift=92000" is the setting for V360/L7. Other model may have different offset.

10. you are ready to replace the bootscreen pictures. In part 2, I will show you how to replace the boot picture using motorola bootscreen replacer.

(The offset you got using the above method might not be 100% correct, but it is near. You can use the 2nd method to verify the offset.)

Method 2: the Hex way (more accurate)
11. open the CG1 bin in a HexEditor, search for the following Hex strings to find the Hellomoto picture;

14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15

12. the offset of the first "14" minus 1 will be the address of the Hellomoto picture;


13. search for the following Hex strings to find the Welcome picture;

F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00

14. the offset of the first "F8" minus 1 will be the address of the Welcome picture;


15. follow steps 9 & 10.

Download:
Corona_editor: [4shared]

Sponsors links:

5 comments:

6:02 AM, February 24, 2007 rodrigo said...

Hi yuet very good tutorial but mi file is a sbf file how pas the sbf file to bin to search the image

11:40 PM, February 24, 2007 Yuet said...

rodrigo, to split the sbf file. follow these steps:
1. Connet your phone via usb and start RSD Lite.
2. Select the sbf MP file.
3. Start as if flashing your phone, but you do not need to complete the whole flashing process. Just look at the RSD Lite screen carefully and once it finishes generating image files then pull the usb cable out of your phone. After that, do not close RSD Lite. Look at the folder where the sbf file is located. You will see image files created by RSD Lite.
4. Move these images files to different folder because once you close RSD Lite, the files will be deleted.
5. Combine CG 0 and CG 1, then save it as CG1. That is, you need to insert CG0 into CG1 using HexEditor (XVI32). After that you can delete the CG0 file. This combined CG1 file is the CG1 bin that you are going to hack.

2:34 AM, March 26, 2007 Anonymous said...

Enrique

This tutorial is amazing :P
I tried to look for the Hellomoto image on a C650 cg1 but couldn't find it, do I have to do something else? or.. how can I change the hellomoto image on this phone?

9:33 PM, March 26, 2007 Yuet said...

Enrique, I am not familiar with c650, but if you can't find the image in CG1, maybe it is in the DRM.

9:52 PM, April 06, 2009 Anonymous said...

I loaded Corona_editor on to my 9qh (WM6.1)and attempted to open it. Access was denied because program is not signed. How do I get around this?


yuetblog.blogspot.com Web