Recently I picked up this 'i-mate Ultimate 9502' while thrifting:

It is a really well-built phone and has a satisfying sliding screen to reveal the keyboard. It runs Windows Mobile 6.0 by default, but this one in particular has been upgraded to 6.1. It also came with the dock and a spare battery.

Notably this is one of the few Pocket PCs to support external displays, it can output composite AV via extra pins within the USB port. Unfortunately, I don't have the cable for it, but I've ordered a potentially compatible one from eBay (it is hard to tell if it even follows any standard). At the time of writing I am only aware of 2 other pocket pc's that support video out: the O2 XDA Flame, which is also 480i composite AV, And the Dell Axim x51v, which has a VGA adaptor and outputs 480p (and can apparently do higher with some registry hacks).

But nothing can ever be straight forward...

Some history:

As far as I can tell, this device used to belong to a large company (which I will not be naming) as some kind of employee onsite job logging device. I backed up all the software and info on it just in case it will come in handy or needs archiving, but there really isn't much on here aside from some VPN software and in-house software. That brings us to the first issue:

Resetting:

To reset this phone, you can either use the 'Master Clear' program in the settings, or hold `fn + Pickup' and press the reset pin. Doing so will bring up a confirmation. Once the phone has reset, you will be greeted with the standard initial setup. But upon finishing the initial setup, it starts immediately provisioning the device and installs company settings and programs back onto it.

This has a custom ROM loaded on by the company, so resetting will always reprovision it. No problem, I managed to find both a wm6 and 6.1 ROM on XDA Forums. But now the real issue:

i-mate decided to lock the boot ROM, and the only way to re-flash it was via a code that's printed on the box it came in. I don't have the box and trying to get that code from the company would be impossible (and generally not recommended imho as they might demand it back just to e-waste it.) Without that code, re-flashing is currently impossible as it seems like no one has done any reverse engineering work on it since the early 2010's.

Holding 'fn + Hangup' and pressing the reset pin will bring up "Easy Upgrade," but as the bootloader is locked it won't do anything (but maybe this key combo helps someone else out there.)

Making it work anyway:

When provisioning starts, it changes a bunch of settings and removes a couple programs, I would rather have it be stock instead of undoing everything the provision changes. This is what I've figured out after a bit of poking around:

Provisioning fights you, you can't cancel it or quickly start task manager and end it, it always fights for focus. Provisioning also does not happen until after the initial setup is complete (Welcome screen and first time settings,) but ActiveSync can access the device over USB while the initial setup program is running.

With that we can navigate to '\Application Data\Volatile' on windows and delete everything except Autorun.exe (as it is locked and in use). Once we do that we can finish the setup and it won't start any provisioning, leaving it stock. However, if we reboot the phone it will trigger the provisioning again and repopulate the volatile folder.

I'm not sure where it's getting the data from as I looked everywhere for it, there might be a way for an application to pull data from the ROM image(?) but I can't see it with basic file explorer. By installing a registry editor on the phone and doing some comparisons with another Pocket PC, I was able to find a key that started the provisioning under 'HKEY_LOCAL_MACHINE\init\Launch90' with the value 'CP_install.exe'.

After deleting that key it and rebooting the phone, it will no longer reprovision. I will need to do this whole process whenever I want to factory reset it but I'm fine with that as this is as close to stock as I can get without that rom key.

random: While researching ways programs could auto start, I discovered putting "autorun.exe" in a folder named "2577" will auto start a (Signed) program upon SD card insertion. the 2577 refers to the CPU id of strongarm which most pocket pc's use. There is some more info about that here with a list of other CPU types: https://www.codeproject.com/articles/27917/automatically-starting-your-application-on-windows [Archive]

Now the device has been restored to a usable state, I can finally use it for Pocket PC things. The batteries are in decent condition considering the age and last a few hours, however one is slightly bulging.

Camera:

The camera is decently high res for the time at 3 megapixels, but there are issues with the autofocus. It seems to have gotten damaged at some point.

Some pics I've taken:

I don't like fake shutter sounds on digital cameras, as they are usually loud and obnoxious (and I think they are quite tacky.) The fake shutter sound on this phone is actually reasonably quiet and nice, unlike every other pocket pc ever. Despite this I still want to disable it, however there are no settings to do so in the camera program and it ignores the system volume. I attempted to delete ShutterSound.wav out of the Windows directory but most stuff can't be edited in there (or I haven't figured out how to yet). Copying 'Camera.exe' out of the Windows folder and running it elsewhere still plays the file. Time to hack!

Opening up Camera.exe, I searched for the following u16 string in a hex editor:

53 00 68 00 75 00 74 00 74 00 65 00 72 00
S.h.u.t.t.e.r.

I found and edited offset 0x6B3B6 from 53 to 4D, making it read MhutterSound.wav instead of ShutterSound.wav. I then edited ShutterSound.wav to be completely silent and saved it as MhutterSound.wav in the Windows directory. Now it is nice and silent.

Misc:

The keyboard is a bit too small for me to comfortably type on, maybe in 2008 this was desirable (and most PocketPC input was done with a stylus and the touchscreen) but my thumbs are too big for the buttons and I make too many mistakes. and after about 10 mins of typing my hands feel cramped. I'm pretty sure I can type faster with T9 prediction on a Nokia and I haven't actively used that since 2012. I can type much faster on a modern smartphone despite the lack of tactile feedback. But as for using it as a typing device, particularly for "distraction free" writing (as I'm looking for something along the lines of that), I would prefer to get the AlphaSmart Dana I own out of storage instead.

I would test out the network capability and put a sim card in it but Australian telcos have decided 3G is "too old" and have just shut off the 3G network in mid 2024. My 3G+LTE Samsung Note 3 isn't even that old and it can't be used as a phone or on cellular data anymore.

That's it for now, I'm just going to continue fiddling with it and add some games n stuff. I may update this if I have anything else interesting to show off about it. Maybe if I can obtain or make a video-out cable I'll show that off.

Bonus:

"pinkderg.art" on internet explorer mobile (but locally hosted as https isn't supported)