Extracts Windows CE ROM images (.BIN, .nb0) into usable files: reconstructed PE executables, media, registry, and directory structure.
Targets Microsoft Device Emulator images and OEM dumps (WM5 / WM6 / WM6.5 / WM6.5.3).
Warning
None of what this extractor does is proven correct. The de-baking process — in particular .reloc synthesis — has already shipped with several bugs that silently produced invalid PE images (e.g. relocations targeting .rsrc corrupting dialog templates, stripped .rdata relocations breaking C++ vtables). All other stages (XIP reconstruction, IAT repair, IMGFS extraction, registry conversion) are likewise heuristic and have not been independently verified against a reference implementation. Treat all output as best-effort; more bugs are almost certainly present.
- B000FF (sectioned container) and NB0 (flat binary) ROM formats
- XIP modules with LZX decompression and full PE32 reconstruction from
e32_rom/o32_romheaders - IMGFS filesystem extraction with Flash Translation Layer page mapping and XPRESS decompression
- Relocation fixup for XIP PEs: patches split-address references (
o32_realaddr) and generates.relocsections covering all absolute references within each module's image range - Import table repair: overwrites ROM-baked IAT entries with original ILT ordinal/name hints
- Directory structure from
initflashfiles.dat - Registry extraction (
.rguto UTF-8.regconversion)
python extract_wince_rom.py <image.BIN|.nb0> [image2.BIN ...]
Or place .BIN/.nb0 files next to the script and run without arguments.
Output goes to a directory named after the image (e.g. WM5_PPC_USA/).
| Image | Format |
|---|---|
WM5_PPC_USA.BIN |
B000FF |
WM6_PPC_USA_GSM_VR.BIN |
NB0 |
WM65_PPC_USA_GSM_VR.BIN |
NB0 |
WM653_PPC_USA_GSM_VR.BIN |
NB0 |
ASUS_A6X6_WM61.nb0 (OEM!) |
NB0 |
- Python 3.8+
- No pip dependencies
git clone --recursive <repo-url>
- KodaSec/wince-decompr -- LZX decompression for CE ROM sections
- coderforlife/ms-compress -- reference implementation used to verify XPRESS decompression correctness