 | Change boot picture part 1: find out the address of the picture in the flash |
There are two ways to find out the offsets, the graphical way and the Hex way.
Method 1: the graphical way
Tool you need:
Corona_editor
RandomSHX or SHXCodec
Steps:
1. use RandomSHX or SHXCodec to extract/split the MP that you want to mod;
2. open the CG1 bin/smg file in Corona_editor, as shown in following screen;
This is translation of the Corona_editor screen:
3. set width/height/color according to your phone, for example, 176/220/16bpp respectively;
4. click "jump to", then repeat clicking "Down page" until you find a screen similar to the following one;
5. click "Down/Up/Right/Left" button to adjust the picture position, until you see the full picture on screen;
6. click "+ Color" button to have a nicer preview, re-adjust the position if necessary;
7. write down the address, for example: 53E3C7
8. if you want to also replace the Welcome screen, repeat steps 4-7 to find out the address for the "Welcome" picture;
9. open offset.ini file in the folder of motorola bootscreen replacer, add the offset setting as follows;
"backup_shift" is the starting offset of CG1. "backup_shift=92000" is the setting for V360/L7. Other model may have different offset.
10. you are ready to replace the bootscreen pictures. In part 2, I will show you how to replace the boot picture using motorola bootscreen replacer.
(The offset you got using the above method might not be 100% correct, but it is near. You can use the 2nd method to verify the offset.)
Method 2: the Hex way (more accurate)
11. open the CG1 bin in a HexEditor, search for the following Hex strings to find the Hellomoto picture;
14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15 14 15
12. the offset of the first "14" minus 1 will be the address of the Hellomoto picture;
13. search for the following Hex strings to find the Welcome picture;
F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00 F8 00
14. the offset of the first "F8" minus 1 will be the address of the Welcome picture;
15. follow steps 9 & 10.
Download:
Corona_editor: [4shared]
| Sponsors links: |
5 comments:
Post a Comment or Discuss in forum
Hi yuet very good tutorial but mi file is a sbf file how pas the sbf file to bin to search the image
rodrigo, to split the sbf file. follow these steps:
1. Connet your phone via usb and start RSD Lite.
2. Select the sbf MP file.
3. Start as if flashing your phone, but you do not need to complete the whole flashing process. Just look at the RSD Lite screen carefully and once it finishes generating image files then pull the usb cable out of your phone. After that, do not close RSD Lite. Look at the folder where the sbf file is located. You will see image files created by RSD Lite.
4. Move these images files to different folder because once you close RSD Lite, the files will be deleted.
5. Combine CG 0 and CG 1, then save it as CG1. That is, you need to insert CG0 into CG1 using HexEditor (XVI32). After that you can delete the CG0 file. This combined CG1 file is the CG1 bin that you are going to hack.
Enrique
This tutorial is amazing :P
I tried to look for the Hellomoto image on a C650 cg1 but couldn't find it, do I have to do something else? or.. how can I change the hellomoto image on this phone?
Enrique, I am not familiar with c650, but if you can't find the image in CG1, maybe it is in the DRM.
I loaded Corona_editor on to my 9qh (WM6.1)and attempted to open it. Access was denied because program is not signed. How do I get around this?
Post a Comment or Discuss in forum