ROMPatcher by ZoRn & FCA00000 + Detailed procedure by swankyleo [Updated 18-JUNE-08]

ROMPatcher for S60 3rd Edition Devices!
By ZoRn and patches by FAC00000

ROMPatcher by -=ZoRn=-

Installation:
1. First you need install MetroTRK on your mobile and launch it.
2. Change address (and/or checkVal) in RPInstaller.ini to yours.
For Symbian 9.1 address is 60000148 for 9.2 it C0000148
3. Launch RPInstaller.exe, select MetroTRK COM port and press Install
4. If no errors occurs then you have ROMPatcher installed on your mobile

Patches:
Patches should be in E:\Patches directory on mobile and have rmp extention.
Symbols count for addresses and patch data must divided by 2. 12345 - WRONG, 012345 - RIGHT.

Example patch:
This line (first 256 symbols, I think it enough) will be shown while you choose "Patch info" submenu.\nThis patch just for test. Replace Z:\resource\versions\sw.txt

Lines that dont start with one of patch method (like this one ) just ignored.
abs:F93C70A6:34002E0030003600330032002E0030002E003 30038:35002E0038003800380038002E0037002E00360035

;This line also ignored. Next line show relative patch method. Doing the same as line above, but not only for N80 FW 4.0632.0.38
rel:resource\versions\sw.txt:06:34002E003000360033 0032002E0030002E00330038:35002E0038003800380038002 E0037002E00360035

//Another method of patches above - Search'n'Replace
SnR:resource\versions\sw.txt:34002E003000360033003 2002E0030002E00330038:35002E0038003800380038002E00 37002E00360035




From FCA00000

patch: EnableHiddenMenus

Save this as
e:\Patches\EnableHiddenMenus.rmp
and activate it.


Code:
; *** EnableHiddenMenus 1.0 ***
; *** Enable Hidden Menus ***
; Author: fca00000 , fca00000-at-yahoo-dot-es
; Date: 2008.04.18
; Firmware: tested on N80 v 5.0719.02 . Might work on preFP1+FP1
;
; In the main applications menu some options disappear if you select a program or a folder.
; This patch shows all of them, allowing to rename applications and creating sub-folders inside folders.
; Seems to work on preFP1, although on FP1 it doesn't show the menu to rename apps.
;
; For the curious people: I changed eikcoctl.dll in
; method CEikMenuPane:eleteMenuItem
; so that it simply returns
;F8F29D56 PUSH {R0,R1,R4-R7,LR} ; patch to BX LR
;F8F29D58 SUB SP, SP, #4
;F8F29D5A LSLS R6, R0, #0
;F8F29D5C LDR R0, [R0,#0x70]
;F8F29D5E MOVS R7, #0
;F8F29D60 CMP R0, #0
;F8F29D62 BEQ loc_F8F29D66
;F8F29D64 LDR R7, [R0,#4]
;
; As far as I know, nothing is broken. But I decline all responsability, of course.
; Anyway, here it is. Enjoy
; end of EnableHiddenMenus
SnR:sys\bin\eikcoctl.dll:F3B581B00600006F0027:7047 81B00600006F0027
patch: ChangeSwipolicyPath (allows installing unsigned apps)

Save as e:\patches\ChangeSwipolicyPath.rmp

Code:
*** ChangeSwipolicyPath 1.0 ***
; *** Change swipolicy path ***
; Author: phrig
; Released by: fca00000 , fca00000-at-yahoo-dot-es
; Date: 2008.04.24
; Thanks to -=ZoRn=- for his wonderful ROMPatcher and phrig for making this changes . I am just publishing and polishing it.
; Credits also go to Symbaali for his initial great discovery about that, back in 2007
; Firmware: tested on N80 v 5.0719.02 . Might work on preFP1+FP1
;
; Change path to swipolicy.ini in securitymanager.dll to e:\system\data\swipolicy.ini
; You also need to copy the file from Z: into E:
; then, you can modify it.
; I suggest:
; AllowUnsigned = true
; UserCapabilities = NetworkServices LocalServices ReadUserData WriteUserData UserEnvironment Location SurroundingsDD UserEnvironment NetworkControl SwEvent AllFiles NetworkControl DiskAdmin ProtServ TrustedUI DRM WriteDeviceData ReadDeviceData MultimediaDD PowerMgmt CommDD TCB
; with these changes, you might run some programs that are unsigned.
; Warning: not all unsigned programs can be installed. For example, if supplier is untrusted or certificate has expired.
; Warning: installing a program from untrusted sources is dangerous and might destroy your phone.
;
; For the curious people: the change is done in securitymanager.dll
;
; As far as I know, nothing is broken. But I decline all responsability, of course.
; Anyway, here it is. Enjoy
; end of ChangeSwipolicyPath
SnR:sys\bin\securitymanager.dll:1C0000007A003A005C 00730079007300740065006D005C0064006100740061005C00 73007700690070006F006C006900630079002E0069006E0069 00:1C00000065003A005C00730079007300740065006D005C0 064006100740061005C0073007700690070006F006C0069006 30079002E0069006E006900
[18-JUNE-08]
Updated ROMPatcher with AUTO-RUN OPTIONS is now available. Download link from Post#2 below.

PLEASE USE THE ATTACHMENTS/LINKS PROVIDED IN THIS POST [Updated 18-JUNE-08]

Dear iPmartians! What we were all waiting for is finally here, thanks to mighty FCA00000 and discoveries made after his platform hack, Zorn has managed to make a ROMPatcher. Big THANKS to FCA00000 and to ZoRn for all their effort in empowering us with the ultimate freedom to customize & improve the functionality of our phones. We will never find the right words to thank them and will be always grateful to them!
Quote:
What is ROMPatcher?
ROMPatcher is an amazing piece of code, application allowing you to patch the ROM in a very easy and secure way. We are only limited by our imagination when it comes to the number of uses for it. There is no real danger in using it because it maps the ROM into RAM and then modifies it, so the patch is not permanent and a phone restart will clean all changes made by the patcher. After restart, you have to manually enable the patches again.

What is the difference between the FCA's hack & Zorn's hack?
FIRST STEP
The first step involves hacking the phone from PC to gain access to the system folders. For FCA's hack you have to install Metro TRK and a dummy application called HelloCarbide on the phone. Only Metro TRK is required for Zorn's hack.
For FCA's method you are required to install python & related libraries on PC.
Based on the work of FCA, Zorn simplified this process by using Windows API. In short no need to install python & extra stuff.

SECOND STEP
For FCA's hack you have to install CapsOn/CapsOff to toggle the phone security. This is done by manually installing the SIS files.
Zorn simplified this process too by giving us an option in the first step itself to install the ROMPatcher. In ROMPatcher options you get the same functionality to enable/disable phone capabilities.

LET US BEGIN

Quote:
Update:14-MAY-08
If you have already applied Leftup's root certificate as mentioned HERE, then you can directly install the ROMPatcher from this SIS file and then skip to the Patches section below, otherwise proceed through the tutorial.

Those who have already installed ROMPatcher (any version), can again install from the SIS file. This will give you the option to uninstall ROMPatcher from App. manager first restart your phone. Then try installing the SIS file 2-3 times. First few tries will fail with error "Update failed!" But last try will always succeed.
Download the applicable RAR file for you phone and extract the contents to a folder. You can check out your phone model HERE. Transfer the TRK SIS file to your phone and install it to phone memory. Make sure Nokia PC Suite is not running. Now connect your phone to PC using the USB cable in PC Suite mode.


By default TRK starts in Bluetooth mode, cancel it. Then go to Options->Settings and set then as shown below. When done TRK will show connected.


Now find out the port number of your phone USB connection from the device manager. (Tip: Start Menu->Run->devmgmt.msc). In the following image it is COM4 for my N73.


On the PC now run RPInstaller.exe and enter the COM port number. Now click on Install Button (do not tick the box). If successful, you will see something like this:


If no errors occured, you will find a new application ROMPatcher in your phone's Applications folder (Do not start it yet). Now close the RPinstaller application on your PC. Exit from the TRK on your phone and then disconnect the cable and reboot your phone.

HOW TO APPLY PATCHES

Make the folder E:\Patches on your phone. All the supplied/future patches should be copied into this folder. Patch files are simple text files you can open in any text editor.


The application lists all the patches available in E:\Patches. You can simply enable or disable a patch as shown below:


You can download the available patches from the next post below. After ownloading, just copy them to E:\Patches on your phone.

Using this ROMPatcher:
To disable caps (same as CapsOff): Select Options->Disable caps
To enable caps (same as CapsOn) : Select Options->Enable caps

Quote:
Update [01-MAY-08]: DumpTools has been updated (Works faster now)
Zorn has also released a tool to create a ROM dump for debugging. It is not useful for the noobs, but if you are interested you can download it from HERE. Just install DumpROM to phone memory and run it (Note: The process takes a lot of time).
ROMPATCHER AUTO-RUN VERSION ADDED - 18-JUNE-08. LINK BELOW

Rompatcher with autorun option (update)



Attachments have been updated on 14-MAY-08
ROMPatcher with new icons released...