UPDATE: XDArit is outdated. It has long been replaced by XDAtools, a much nicer tool which does everything XDArit does and much much more. We would discourage you from using XDArit.
Previous versions of XDArit had a potentially serious bug. Upgrade to the version offered below (v1.02) as soon as possible...
The XDA has the ability to read and write ROM images to SD card. Using the XDA Rom Image Tool (XDArit.exe), you can use a Windows PC to read SD-cards created by the phone, and write to them as well. The program will also read the .nbf files distributed with the firmware upgrade software.
The XDA ROM Image Tool helps you create SD-card images that will cause your phone to overwrite its ROM. This is potentially dangerous, and could kill your phone. Make sure your phone battery is fully charged before flashing the ROM. Because the tool also writes to the first sectors of a disk directly, The XDA ROM Image Tool also offers an excellent way of screwing up the data on your harddisk if you select it instead of your SD-card. We absolutely, completely, categorically and utterly reject any responsability in case you screw up your phone or your disk. All software provided here comes with sourcecode but without support. You're on your own...
Presently the XDA ROM Image Tool only runs on Windows NT, 2000 and XP. This is because the tool needs to write to disk directly, and implementing raw disk access for 95/98/ME was not a priority for us. If you feel like incorporating it, please do.
In order to get your Windows PC to read and write directly to SD-cards, you'll need a PC-card adapter that takes SD-cards. You can probably get one in most computer stores, and in a zillion places on the web. We used this one (but paid way too much). It's OK if yours has USB instead of being a PC-card, as long as Windows ends up seeing the SD-card as a disk.
Instructions for flashing the ROM, the Bootloader Way
Check Wallaby Bootloader version
First, put the device in Wallaby Bootloader mode by keeping the power button pressed while performing soft reset. You will now see a screen that says "Wallaby Bootloader", together with a version number.
Dealing with 5.17 bootloaders
You can skip this chapter if you have a 5.14 or 5.15 bootloader. Version 5.17 of the Wallaby bootloader will only dump to and flash from SD card if a special key is written to the card. This key depends on the hardware ID of the SD card, and would need to be calculated before creating the card.
We have reverse-engineered most of how this key algorithm works, but ended up not using the knowledge because reading the SD serial number on Windows turned out to be fairly involved. It turned out there is an easier trick.
The makers of the 5.17 Bootloader have conveniently left a hole. They made it possible to insert a "diagnostics card" using the old format, without this special key. We have created a "Wallaby Patch Tool" on a diagnostics SD-card image that will patch the bootloader to jump over the card checks. The tool presents an extra menu from which you can dump the ROM to SD card, and flash from SD card.
To use the tool, start the XDA ROM Image Tool as described below to write an SD card, and load the Wallaby Patch Tool as a diagnostics image, and use the first (1 K) header format. The image is tiny, and it can be good to use some old 8MB SD card for this. If you insert this card and start the bootloader, it will tell you that it's patching the ROM, and then ask you to press "Action", which is the center of the rocker keys under the display. If you press it, you'll get the new menu. The new menu looks like this:
Wallay Patch
Tool 1.2/5.17
-------------
Boot -> SD
CE -> SD
Boot+CE -> SD
Restore SD
About
Exit
The first three options allow you to backup the Bootloader, the Windows CE ROM or both to SD card, "Restore SD" restores an image from the card, "About" displays a short message and "Exit" jumps back to the main menu of the Bootloader.
You'll need to insert the card with the Wallaby Patch Tool every time you want to use the SD card for dumping or flashing. So if you can find a 5.15 bootloader image, you may want to downgrade to it, since 5.17 only seems to introduce the card key "feature".
As usual, software by the XDA developers comes with source code, and without support.
Creating an image from ROM
Enter bootloader mode on your phone, and select to make an image. On the patched 5.17 bootloader this is done with the menu described above. On 5.14 and 5.15 bootloaders, press the contacts button left above the screen after entering the bootloader. Choose either CE, Bootloader or both to save to SD card. Once the phone is done writing to the card, take the card out of the phone and insert it in the PC adapter. Now start the XDA ROM Image Tool and select the disk that is your SD card. You will then see something similar to the following:
Press "Read from SD card" to read the image from the ROM. You will then be prompted to enter filenames to save the bootloader and the Windows CE ROM. We've chosen .nb0 extension for the bootloader, and .nb1 for the Windows CE ROM.
Flashing from SD-card
To write images from disk, select "Write to SD card" and enter the filenames in the dialog:
The top field allows you to chose whether to write a header suitable for bootloaders before or after 5.17 (a 1k or a 3.5k header). The 3.5k header does not contain a correct 'Card Key', so you'll have to use the method described above to fix the phone before every time before you can flash a phone or read the ROM.
The software allows you to write an image that contains a bootloader, Windows CE or both. In addition, it allows the creation of a special "diagnostics card" which contains code that is ran on the XDA when it sees that card at Bootloader startup. The Wallaby Patch Tool described above is a diagnostics image. Diagnostics images have extension .nb2.
Please note that reading and writing to these slow SD-cards takes quite a bit of time.
A word about upgrading your ROM
If you upgrade to a version that was not meant for your area, the auto-installation feature won't offer defaults for your provider. This means you'll have to install the connections for GPRS by hand. We've found that a connection for some reason must have the same name, as well as the right access point name, for everything to work. So make sure you know what your old situation looked like, exactly, before upgrading. If you upgrade to some OS that you're not supposed to have, we hope it's obvious you'll need to flash back in your old OS and bootloader before turning the device in for warranty repairs.
XDA developers future roadmap
Ofcourse HTC could modify the next version of the bootloader to lock us out of new devices. Simply rejecting old-style diagnostics cards would already force us to write correct card keys, and creating a new, and better obfuscated card-key algorithm would be even worse. We've decided to focus future efforts on a tool that allows flashing the bootloader ROM directly from Windows CE, thus overcoming any protections that might be put in future bootloaders.
http://wiki.xda-developers.com/uploads/XDArit.exe