Archive for June, 2007

SD Card performance

June 21, 2007 Leave a comment

Card Type VFS MARK Device
Sandisk 512M Ultra II 292 Treo 600
Sandisk 1GB 221 Treo 650
Sandisk 1GB 437 Treo 650
Lexar 1GB 32x 687 Treo 650
Sandisk 1GB ExtremeIII 504 Treo 650
Sandisk 2GB 950 Treo 650 (FAT32)
Transcend 2GB 150x 656 Treo 650
Transcend 4GB 150x 697 Treo 650
Transcend 4GB 150x 525 Treo 650 (FAT32)
Transcend 4GB 150x 676 Treo 700p
Transcend 4GB SDHC 633 Treo 650 (FAT32)
Transcend 8GB SDHC (2) 694 Treo 650 (FAT32)
Transcend 8GB SDHC (6) 886 Treo 650 (FAT32)
Transcend 8GB SDHC (6) 920 Treo 700p
Transcend 8GB SDHC (6) 1071 Treo 700p
A-Data 8GB SDHC (6) 958 Treo 700p
Tags: ,

Holux GPSlim236 boot mode

June 18, 2007 Leave a comment

Should the urge grab you to play with firmware on these SiRFStarIII handheld GPS units, you will undoubtedly discover there is a boot mode one must enable before the 4Mbit flash chip can be read from or written to using SiRFflash.

Whilst we can send message 148 (0x94) to it from SiRFdemo to enable this mode, it’s handy to know one can also short the highlighted pads above (two gold pads enclosed in the white square border just above the label ‘C48’) whilst turning the unit on to achieve the same thing.

“PSRF100,0,38400,8,1,0” is the NMEA sentence to enable SiRF mode.
“94” is the SiRF binary code to enable boot mode.

As long as we always communicate at 38400 baud, it is perfectly possible to flash the firmware over bluetooth, and as you now know the location of the boot mode enabling pads, you can easily recover from a bad flash (eg. trying to push updated SiRF firmwares from other products onto it to enable proper SBAS support).

To put the GPSlim236 into boot mode, you’ll need : (thanks Antineutrino!)

Then to read or write the firmware to the GPSlim236, you’ll need : (thanks Antineutrino!)

Here is a backup of my old Holux V5 firmware (binary, not Motorola format):
GSW3.1.1_3.1.00.07-C23B1.00.bin (From SiRFflash, 0x00 to 0x79999)

And here is the Holux V6 firmware (binary, not Motorola format):
GSW3.2.2_3.1.00.12-SDK003P1.bin (kindly extracted by ‘brio2001’ from

And here is the Holux V7 ? firmware (binary, not Motorola format):
GSW3.2.4_3.1.00.12-SDK003P1.00a.bin (kindly extracted by ‘tsp’ from

Note the V6 firmware supposedly has better support for SBAS based DGPS, which is EGNOS for those of us in Europe. Just have to wait until September when the three birds begin transmitting non-test correction data.

Note the V7 firmware is extracted from a rev.C board and may cause problems if you flash it to a rev.B board, though at least one user has successfully done so.

Tags: , ,

Treo680 sounds

A quick note of where the power-on and power-off sounds are kept within the 680 ROM.

I had expected them to be WAV resources, but no, they’re MIDI.

HsSysResource.prc has them at resource ID’s 25002 and 25003.

Both are 152bytes each, the longest MIDI resource in there is 289bytes.

Tags: , ,

Treo 680 Varnish

To allow Palm to cater to carriers wanting to change the branding, Palm seem to have come up with the following.

Varnishator.prc – gets the ROM token (ROW|ATT|etc) and calls CapLib.prc

CapLib.prc – Unpacks and parses CapData.xml

Varnishator.prc is probably called after a reset, depending on the comparison of the ROM token and the CapData.xml, the splashscreens are then extracted or not. If they aren’t extracted (because the ROM token is different), then the splashscreens in TelephonyUI_CNGW_enUS.lprc are used as default.

In terms of using this behaviour to create our own custom ‘varnish’, we are probably looking at modifying the XML to match whatever our ROM token is, and changing the JPEG’s included in

Rebuilding of will be awkward though as the JPEG images will need to be split into record sized (4k) chunks and padded accordingly with the original. So instead, we ensure the filenames contained in don’t match what the XML will look for, by doing that, Varnishator is somewhat defeated and we fall back on the Telephony_UI prc which is much easier to edit with custom splash screens using the same process as for the 650.

We thereby go from custom ROMs with branding like the original Cingular and the rebranded AT&T splashscreens, both unsuitable for an unbranded ROM, to the Treo650 splashscreen (because it was the only stock image I could find). All without having to muck about with copying splashscreen files to RAM which I think is a rather unclean approach until such point as a ROM update arrives for the unlocked GSM 680’s.
Tags: , ,

Treo680 ROM recovery

I thought I’d figure out how to use the debug tools to flash the Treo. But before that, I thought I’d document a few Palm codenames I’ve seem floating around in some of their official ROM flashing tools.

Codenames :

Palm T5 : Angus (Platform), TnT5(DeviceID)
Palm TX : Devon (Platform), D050(DeviceID)
Lifedrive : Brahma (Platform), TunX(DevceID)
Treo 650 : Ace (Platform), H102(DeviceID)
Treo 680 : Lowrider (Platform), Camino(Hardware), Nitro, D053(DeviceID)
Treo 700p : Ventura (Platform), D052(DeviceID)
Treo 755p : Torino (Platform), Sherlock, D060(DeviceID)

Essential reading:

Programming Development Tools Guide.
Alvin Mok’s Palm codename list


Down and reset > SmallROM debugger (bootstrap code to initialise the hardware), starts communicating at 57600 baud.

Interesting commands :

bootstrap <“hwInitFileName”> <“romFileName”> [\slow]
dump <“filename”> <addr> <numBytes>
save <“fileName”> <addr> <numBytes>
g <addr>
storeinfo <cardNum>
t and s (step)

===== Welcome to the Palm OS SmallROM Debugger!! =====
+$00EC  10000448  *PEA       $FFFFFFFF                   ; FFFFFFFF    | 4878 FFFF

Booting ROM...
Tags: , ,