[Guide] Changing the bootscreen on an L2/L6
Last Updated: Feb 10, 2007


Preliminaries

There are a few things you will need prior to starting this guide:

1. RandomSHX or SHX Codec

2. Injector 0.2

3. SBF ReCalc 1.2 (optional if you're splitting with RandomSHX as you can recompile with it as well)

4. RSD lite and/or Flash & Backup 3

5. A patched firmware with RSA removed (this is a requirement, if you don't have one of these, then you will need to check out another guide on how to remove the RSA from your firmware as I am writing this guide strictly for changing the bootscreen.)

6. Your desired bootscreen replacement image in 128x160 resolution

All the tools listed are available in the download section of M3 (with the exception of RSD lite).

If you've just split and patched your firmware, you can go straight to step 2 of the procedure. Otherwise, you will need to make a backup of your phone (a .shx file) with Flash & Backup 3.


The Procedure

1. Split your SHX backup with either RandomSHX or SHX Codec.

2. Open Injector 0.2, click the "..." button under the "flash file:" section.
Navigate to where you split your SHX in step 1.
If you used SHX Codec to split the SHX, choose the file that contains "CG1".
Otherwise if you used RandomSHX, choose the file that ends with "2.bin"

3. Under the "image file:" section, click the "..." button and choose your desired replacement image (must be 128x160).

4. Under the "search" section, leave the default range (450000-650000) alone and click on the Auto button.
This will search for the RAW hellomoto screen in the firmware.
When it is finished, it will give you two addresses where it has found the image.

5. Now that it's found the offsets, it's time for replacing the Hellomoto screen.
In the offset (hex): box, put in the first offset that was found and click "incject" (yes, it's spelt wrong ).

Note: when you click the incject button, it will automatically save the firmware.

It should give you a message saying "Done!".
You can check to see if it was injected or not by using the image preview on the side. Simply enter the offset in the image preview area and click on "Read from flash file" and it should be your custom image.

6. You will need to use the second offset and inject to that as well, simply follow step 5, but this time use the second offset that the search found. (This may or may not be necessary, but I went and changed the image at the second offset for good measure, I really didn't want the Hellomoto image If someone can confirm that this is necessary or not let me know.)

7. Now that we're done with changing the image, we can re-compile the SHX by either using RandomSHX or using SBF ReCalc.

For SBF Recalc, click the "Open CG Folder" button and choose the folder that you have split your SHX to.

Click Create SHX to re-compile your SHX

Note: If you want to fix the header checksums, you need to click ReCalc Checksum and then Create SBF and then convert to SHX with Flash & Backup 3. If you ReCalc and create SHX with SBF ReCalc, it will still have the incorrect checksums in the header for some reason.

8. Flash your re-compiled SHX to your phone with RSD lite or Flash & Backup 3.

Once it's flashed, power your phone off and then power it back on and you should see your custom bootscreen instead of the blue Hellomoto screen.

For reference, I used R3517_G_0A.63.12R when I did this.