yashsingh1/xdaforums huggingface dataset:
[Atrix 4G General] el_venga:
i have jtag tools because i do that for a living. i don't have a device to do some tests but I'm hoping someone could make the contribution at least to find the pinout. my biggest issue is returning the device as it costs a lot in my country so if anyone has damaged device that at least turns on it would be the best way to start.
[Atrix 4G General] anaschillin:
I have been in contact with MobileTechVideo guys and they are working on a unbrick methods using a JTAG, it should be out soon.
[Atrix 4G General] Malloy:
Atrix 4G JTAG Pinout
[Atrix 4G General] Malloy:
working phone dump

ATTENTION phone is not cloned

h_t_t_p://depositfiles.com/files/o3u0ksqam
[Atrix 4G General] irfanmkw:
Atrix 4G jtag pinout

Hi Brother,

Could you please guide me how to unbrick hard bricked atrix 4g without jtag. Is there any way to unbrick it with nvflash?

If not then please guide me how to unbrick with jtag.

Thanks

---------- Post added at 12:31 PM ---------- Previous post was at 12:05 PM ----------

Hi Connexions,

Malloy has traced the jtag pinouts to unbrick hard bricked atrix 4g. Is it possible now to unbrick if yes guide me please.

Thanks
[Atrix 4G General] maheshjagadeesan:
Any news on this yet?

I know this is a shot in the dark, but has anyone - anybody at all - managed to get something working?

My phone is in a non-responsive, non-bootable state (no RSD, no Fastboot, won't even boot to the M logo - just the green LED and a black screen), and I've tried nearly every way to power on the phone with different keys pressed. Recently, I even tried to get it to power on with a factory cable. All to no avail. Tried using NVFlash, but I don't have the SBK, so commands fail.

I can confirm that both the original (dying) battery and the new replacement battery that I purchased have enough juice in them. If anyone knows of a solution to get my phone working again, I'll be grateful to receive information. Alternatively, I'm willing to pay any reasonable amount if someone offers to get my phone to start up again.
[Atrix 4G General] cupidstunt:
Are you sure it's not the screen. I thought my phone wasn't booting once and the LCD cable had become disconnected. Does the screen appear to turn on?
[Atrix 4G General] Semseddin:
Hello,

MB860 level 3 schemes
[Atrix 4G General] maheshjagadeesan:
Yes, pretty sure. It powered down as it ran out of battery and has powered back up.
[Atrix 4G General] kyanox:
Possible a JTAG solution could also restore the 4.1.1 locked and unrootable bootloaders?
[Atrix 4G General] Dr_Wolodya:
Link dead, re-upload please.

What address to write Boot Partition 1.bin and Boot Partition 2.bin?
[Atrix 4G General] onurugurr:
ist it possible

is it possible, ım hearing this first time.???
[Atrix 4G General] Feche:
Any news?
[Atrix 4G General] Cab121:
Yes it's doable but a pita.

The pins are located next to the Sim card reciever. Two rows of solder points. The pinout map is accurate. What you need is an arduino to flash the boot loader via script and image per the above file, a breadboard to connect the arduino header to the jtag solder points and a lot of patience. I have seen this done once and if you use a mini or uno I think a jtag flash box could be built for around $50 us. The pain is cutting the shield off of the main board to access the header. Delicate work.

Btw I have only seen a few main boards truly hard bricked. If you get anything from the usb and I do mean any response like data + - . Then your better off forcing a boot loader via flash. As long as a port works then your in business.
[Atrix 4G General] vim1:
eMMC / atrix

Direct eMMC connection may allow to do that easy.
[Atrix 4G General] lehjr:
Getting to the JTAG pads is a lot easier than soldering anything to them.
[Atrix 4G General] Feche:
Is there any howto?
[Atrix 4G General] akizakian:
Hi Malloy,

What exactly are those files? What address are they taken from? Had a look on them, does not look like a bootloader, is it encrypted?
[Atrix 4G General] akizakian:
Hello guys!

I was looking at the schematics file posted here before, there is something interesting, have a look:

Do you think we might be able to boot from external mmc?
[Atrix 4G General] lehjr:
Possible, but not likely unless you have a very early build of the device.

A couple things to remember:

The schematic is for both pre-production versions (prototypes) and production versions

DNI = Do not include. Not only will these things not be present in production builds, the actual solder pads for them may not be there either, and given the scale and nature of surface mount components, it is difficult to trace things out in order to make modifications.

The schematic is not 100% accurate (ran into this a few times where the working code in the GB kernel actually contradicted parts of the schematic)
[Atrix 4G General] akizakian:
Thank you very much for answer! I'm still very keen to try to resurrect some hardbricks, now it's kind of hobby project for me, including looking into schematics or disassembling the bootloader and microboot. May be someday it will give some results, anyway it's interesting. I was wandering, since there already is a JTAG connection, why it is not possible to just flash the correct bootloader from pudding to the device? I think this will resurrect the phone. Plus, on schematics there is also this part:

May be that can give us connection directly to emmc to write necessary bootloader (microboot) to the device? Probably correction to BCT also will be necessary.

EDIT: Actually to be correct, microboot (CG47) should be from pudding and bootloader (CG44) should be from GB firmware.

What do you think?
[Atrix 4G General] firecode95:
I and Krystian had talked about bootloader hacking and made some work, tryed to reverse bootloader and microboot but no succes :( I had made flashable sbf with differnet bootloader and microboot, I now how things must be put together for thoose files using hex editor :D, I had tested leaked ics bootloader but it wont start phone up just say failed to boot 1, the rsd protocol and fastboot still work, and with serial console I had gained some start up logs from bootloader, I had made flashable sbf for enginering atrix bootloader(need to experiment with sertificates but I don't want to make so huge risk because I had only one working board and second, need some donating board) but only thing that is mising is signatures for microoboot and bootloader for it so flash procedure is aborting. And leked isc bootloader is locked so there is no much fun except that I had it on phone with failed to boot error mesage. If someone want to experiment on theyr phone without any warrantys about hard brick p.m me I can give thoose sbf and explayn how to flash.

P.S

In leaked ICS bootloader with fastboot culd be made some reserches and maybe somehow started kenrel manualy and then who now what can be found, maybe sbk can be gained because it not production bootloader :D
[Atrix 4G General] akizakian:
Thanks! I'm still working on disassembly, there are some interesting parts I think. One interesting part in microboot is USB enumeration routine, at some point, when device is bricked, battery drained, when you connect it with regular cable to computer, device is identified as MICROBOOT, nVidia Corp, dev id 0955:0101, os identifies it as storage device, but cannot enumerate it. I want to investigate this case more, may be some luck there? There is also DEV2HOST_INTERFACE or HOST2DEV_INTERFACE mentioned in the same routine, may be some luck in further looking into it? Another way is to try to boot from mmc instead of internal emmc, may be shortening some pins on the board? I'm into testing, but my device is bricked. It would be really interesting to talk to you guys, excellent progress with JTAG UART. I will definately try to get my JTAG done with a professional help, there is no way I can solder such a small piece on the board. Please let me know if I can somehow contribute, I will be really happy to work.

EDIT: I also tried to run bootloader on specially modified QEMU, but I cannot get serial output unfortunately. Debugging through QEMU GDB leads nowhere, bootloader is loaded fine at 0x108000, runs, but gets stuck at some point, QEMU is not Olympus :( Now trying to run microboot, but the problem is that it has to be loaded at 0x40008000, so far I cannot make it run.

Guys, I would appriciate if you can give me a full dump of emmc, 1 file, exactly how it is in emmc.
[Atrix 4G General] firecode95:
The microboot interface that show up in PC is microobotloader emegrency mode that is activated if microbootloader try detect booloder hash and it is diferent than expected, odm fuse has value that isn't defined(booloader downgrading case). Only way to repair is 1)with jtag reflash mmc chip 2) replace tegra2 cpu with fresh cpu who doesn't had sbk as sbk is stored at one time programmable tegra 2 fuse (look at china online shops for it aprox. 40 usd) so then you can gain nvflash (without failing sending commands) interface and use LG Optimus flash tools whit dumped booloader, microobootloader to flash.

P.S

Microbooloader is executed first and then they execute booloader.
[Atrix 4G General] andresrivas:
How can we do that? will

dd if=/dev/mmcblk0 of=/sdcard-ext/fulldump.img

do the trick, asuming we have an big enough sdcard?
[Atrix 4G General] akizakian:
I see! But, if battery is charged, if I'm not mistaken, MICROBOOT device does not show up. And also, why it shows as mass storage device?
[Atrix 4G General] firecode95:
I doesn't tryed to dump full mmc but to dump partition you need dd if=/dev/mmcblk0p1 of=/path/to/your/sdcard/mmcblk0p1.img

and whit this you can get all partition dumps just changing p1,p2,p3....

EDIT:

I don't now why usb storage drive maybe because you need apx interface driver ;) and factory cable need too to sucesfully use nvflash but until you dont had sbk there is nothing to do.
[Atrix 4G General] akizakian:
Yeah, that's exactly what I need, dd if=/dev/mmcblk0 of=dump.img, so it will give me full partition dump, not just p1, with mbr (is there mbr?), I just need to have image exactly how bootloader and microboot sees it on emmc. I unfortunately cannot do it, my device is bricked. I need the one from GB device, with pudding flashed, since my device is unlocked.
[Atrix 4G General] andresrivas:
humm, he asked for a full dump of mmc in one file, so i guess it is ok. sadly my biggest sd is 8gb :( will try to connect a had drive to the dock's usb ports and see what happens
[Atrix 4G General] firecode95:
If you get it please share it and add info about odm fuse too. To make it smaller erase all internal memoy and then zip it.

P.S

The dump on some atrix revisions give just 00 or FF in whole mmc, some bootloader protection to aviod dumps. So if it hapens your last chanse is to use recovery (I use TWRP) and then in adb make dump.
[Atrix 4G General] akizakian:
Nono, I have factory cable and APX drivers, and in this case it goes to nvflash mode, correct, and of course no sbk. I'm talking about different case, normal cable, battery drained, when it connects, only green light is on. Than it either does it itself or you press any button and it is identified as MICROBOOT, manufacturer name: nVidia Corp., device id 0955:0101, rev 0101, mass storage device. But it cannot be enumerated. In microboot you can find those unicode strings. I know the place in bootloader where it happens. It's usb enumeration routine I think, I can show it in disassembly.

I cannot understand more, I'm not very good with ARM code and have no decompiler.
[Atrix 4G General] firecode95:
How you mean disasembly? hex? and whit normal cable battery will be drained too because microoboot enters in recovery mode in any case where phone is started, the moto logo is showed up whe nbootloader is loaded, so if microbootloader only works then nothing will be shown and when recovery mode is loaded phone looks like identicaly as it is when phone is off. And I think that manufacturer name: nVidia Corp., device id 0955:0101, rev 0101 is shown only for one reason, to easer identifay microboot recovery mode, but who nows maybe nvidia or moto had some tool for this.
[Atrix 4G General] akizakian:
Disassembly - IDA database I was working on. Now, if battery is not drained, phone starts up, says Failed to boot 0x1000, Entering nvflash mode bla bla bla, Battery is to low flash, and not identified by OS. But when battery is drained, there is no output on the screen, but device is identified as MICROBOOT. So looks interesting, may be there is a tool to somehow access emmc? Wild guess, I know, but still :)

Again, it only happens with normal, not factory cable. May be there some special driver is needed?
[Atrix 4G General] andresrivas:
Ok, in the meantime, this is mi ResrvedOdm contents:

~ # cat /sys/firmware/fuse/ReservedOdm

20000000000020002000200004000
[Atrix 4G General] akizakian:
Thanks! What's the size of emmc? 16 gigs? It's interesting to have the full dump with partition table and stuff, so it is exact copy of emmc.
[Atrix 4G General] firecode95:
well if you care about this I can give you explaiation about this.

phone starts, checks how many battery left, determinate error, starts recovery mode and then remember to check if it is ok then continue recovery mode and the screen flashes wery fast, showing failed to boot, entering recovery mode, battery is not inaf abort recovery mode starting and froze screen, all it is visible in serial console logs.
[Atrix 4G General] ravilov:
Why don't you guys use compression (gzip/bzip2) when dumping? Should help a lot, especially if you first wipe "private" areas with zeroes (/data, /cache, the FAT32 user storage).
[Atrix 4G General] andresrivas:
Yup, that was the plan, althrough I completely forgot about /data and /cache, you just saved me 2Gb xD
[Atrix 4G General] akizakian:
Well I think it's not completely like that. What I see from disassembly, it outputs that staff about NvMicrobootMain, bla bla, determines the powerup reason, prints it out, in one case goes to the battery level check and outputs it. Than, I guess, because it sees the usb cable as powerup reason, it jumps to USB enumeration. And that's where it is identified as MICROBOOT mass storage. Loading of the bootloader happens later with all the checks that bootloader does. Still looks interesting to me. Unfortunatelly I don't have ARM decompiler plugin for IDA, so it's hard for me to understand the logic of usb enumeration routine. Still this is guessing since I don't have serial output. Once I will get it done, hope I will see more messages on the microboot level.
[Atrix 4G General] akizakian:
Guys, does anybody know what is the type of connector to be soldered on JTAG pads?
[Atrix 4G General] lehjr:
Molex "SlimStack" 0.4 mm pitch
[Atrix 4G General] akizakian:
Great, thanks a lot!
[Atrix 4G General] akizakian:
Finally I have a working atrix to do some tests!

First, dd if=/dev/mmcblk0 of=/sdcard-ext/fulldump.img does not work:

/dev/mmcblk0: cannot open for read: No such file or directory

trying to run tcmd: no response at all. Does anybody know how to use tcmd utility?
[Atrix 4G General] andresrivas:
Run the mount command and check which partition is mounted on /system and dd it

Hit the damn thanks button instead!

Enviado desde mi MB860
[Atrix 4G General] ravilov:
That's not going to work. That will only dump the system partition.

Like I said before, while all the filesystems on all partitions are more or less standard, the partition table very much isn't. There is no easy way to dump the entire internal flash.
[Atrix 4G General] akizakian:
Thanks guys!

Actually did it with:

dd if=/dev/block/mmcblk0 of=/dev/block/mmcblk1

sdcard-ext - uses FAT32, file size is limited to 4 gigs, so we cannot output it as image file, so I did direct copy to sdcard. Worked nicely, 16 gigs outputed. Will try to play with it today. It's a full dump, not a single partition.

Question about tcmd stays the same, how can we use it? I have a feeling there is something interesting in it.
[Atrix 4G General] andresrivas:
That's what happens when you read in a hurry :P apologies

May I ask what is tcmd? My debian says it is part of a package called tcm and its description says:

"The Toolkit for Conceptual Modeling is a collection of software tools to present conceptual models of software systems in the form of diagrams, tables, trees, and the like. A conceptual model of a system is a structure used to represent the requirements or architecture of the system."

Hit the damn thanks button instead!

Enviado desde mi MB860
[Atrix 4G General] ravilov:
Try searching for tcmd in android context. ;)
[Atrix 4G General] akizakian:
I'm not entirely sure what tcmd does, it is kind of motorola service utility. Probably it accepts connections on certain port for service software to connect to it. It can display cellular network information, it can reset phone to factory defaults. Additionally what I can see from disassembly, this utility can be used to set the phone to production mode and burn SBK. So I really want to try to make it work, I just don't know at the moment how it operates, but I'll try to figure out. If you guys have any info, I would really appreciate if you can share.
[HTC Sensation] Alabama978:
Ok new to Android, I'm in UK and have an htc Sensation.

What I need is a simple app that will be like the car dock, i.e. let me run google nav, and make phone calls easily when the phone is mounted in an Arkon holder (not a dock).

Big buttons are good :)
[HTC Sensation] sbdags:
I use a combination of car dock home v3 and tasker. It works brilliantly.
[HTC Sensation] kpjimmy:
Not sure if car home ultra is available overseas, but that's what I use from time to time.
[Nexus S Themes and Apps] DirtyShroomz:
Is there anyway to restore apps without having to go one by one and hit install? I noticed my screen says hypershell needed but above that it says installed so i'm not sure what i'm missing.
[Nexus S Themes and Apps] Force.:
Have you paid for the pro version?
[Nexus S Themes and Apps] nickmv:
Only pro version supports batch restore.
[Nexus S Themes and Apps] DirtyShroomz:
Yes just realized I still had it set to interactive oops
[TouchPad General] nivlac978:
Type in "cd/" and hit enter. That will bring you to the c drive then just cd to the folder you want.
[TouchPad General] sLiKK:
worked like a charm. thanks
[HTC EVO 3D] crazy-master:
i am just trying to root my htc evo 3d gsm version, but i am not sure which ROM to use

which one is the best?

edit:

i have bought the phone from the carrier whose i am using, so its not a problem for me if the phone is locked only for him(if it is already locked)
[HTC EVO 3D] harpss1ngh:
Wrong section - this is the DEVELOPMENT thread, you're asking a QUESTION so goes in Q&A, learn the ****ing rules
[HTC EVO 3D] crazy-master:
sorry for the wrong section

i am really not sure which ROM is the best one, because here i see many ROMs

are there somebody who can help and suggest me which one to use?
[HTC EVO 3D] maek_it_happen:
What hboot do u have ? .....are you rooted already ? ...leedroid is probably the most used at this time ....kingkobra is what I use .....but were all waiting on ics or cm7

Sent from my Brick 3d
[HTC EVO 3D] crazy-master:
now i am trying to root it with this method:

http://xdaforums.com/showthread.php?t=1248231

is it good?

i just have opened htcdev site and i am following the steps. is that enough?
[HTC EVO 3D] maek_it_happen:
What hboor are you ....u can check by turning off ur phone then powering on holding vol up

Sent from my 3d Brick
[HTC EVO 3D] crazy-master:
hboot-1.49.0018

oct 3 2011
[HTC EVO 3D] MeatyCoins:
I have so far tried every single rom and leedroid has to be the best one but still has random bootlops. Use thr stock Europe rooted version by ganii it includes stock kernel...so far best for me.

via HTC EVO 3D w/T-Mobile 4G
[HTC EVO 3D] crazy-master:
i am not completely sure that i understand you

which one is best? "leedroid" or the stock europe rooted version by ganii(can u please give me link)
[HTC EVO 3D] crazy-master:
one more question...

should i change my ROM if it is stock? maybe the stock one is the best one, or i am not right?

now i am with:

android 2.3.4

htc sense 3.0

software number 1.20.401.8

kernel version: 2.6.35.13-g47321df

htc-kernel@and18-2 #1

smp preempt mon oct 3 13:56:34 CST 2011

baseband version

10.59.9020.00U_10.15.9020.06_M

build number

1.20.401.8 CL105308 release-keys

browser version

webkit/533.1
[HTC EVO 3D] MeatyCoins:
Stock Rooted

Check the GSM development section I am on my phone and cannot link sorry

via HTC EVO 3D w/T-Mobile 4G
[HTC EVO 3D] MeatyCoins:
Yes that version you have is the one, just root and stick for now until ICS or MIUI stable is released

via HTC EVO 3D w/T-Mobile 4G
[HTC EVO 3D] crazy-master:
so i dont need to install other ROM, mine is enough good? custom ROMs dont have advantages than the stock rom?
[HTC EVO 3D] Bebida:
It depends on what u wana do with ur phone? I use leedroid with stock kernel no bootloops. Ive found that there are more mods, themes,tweaks ect that are built for leedroid. However if u like sense 3.5 there are roms for that if ur not that bothered as already stated stick to stock.

Sent from my HTC EVO 3D X515m
[HTC EVO 3D] crazy-master:
i am mainly using the phone for pictures and internet, i play games but not often

i want to get better battery life, but without losing the phone speed... thats why i am wondering what can be done for that too

i am not sure what is the difference with SENSE 3.0 and 3.5, i will try to find the difference
[HTC EVO 3D] Bebida:
Sense 3.5 is just the newer version of sense. I'm using honeysense theme by mayfield so my dock and pulldown are pretty different to stock. I get home from work after a 12 hour day with about 70% battery left with leedroid and stock kernel today I've been hammering data WiFi and a game and I'm at 57% probably 9hrs since charge. Best thing to do make a nandroid and flash away!

Sent from my HTC EVO 3D X515m

Here you go mate

Leedroid

Sense 3.5
[HTC EVO 3D] crazy-master:
that still dont answer my question

is sense 3.5 and other roms better than the stock one(which i have) in battery life

now my phone is about 8 hours after charged to 100% and now it is at 75%

usage:

display: 53mins

voice calls: 8 mins

opera mobile: 5 mins

wifi: 55mins(but only using it for ~5 minutes with opera)

righ now i am using only CPU Master Free and i made the cpu frequency from min to max and using it on 'demand'

can i improve the battery life with other ROM, an app or anything, without losing phone speed?
[HTC EVO 3D] Bebida:
Like I say make a nandroid and test some Roms out best bet is custom kernel and undervolt. I am no expert with this tho as I dont tend to do it. The search box will help.

Cheers

Sent from my HTC EVO 3D X515m
[HTC EVO 3D] cajones42:
Ur battery life seems pretty good to me. Thats kinda like u getting 4 hours screen on time off charger for 32 hours. Ive had best battery with eternity 1.3/stock kernal. Ive tried most of the stable releases and this is what i always go back too. U have to flash infected wipe, rom, kernal, su-fix. Thiabia also battery with settings turned on. I dont think battery life counts with screen off and flicking mobile networks on when needed.
[HTC EVO 3D] Bebida:
Just had a thought if battery life is your main concern there are a some good threads in EVO 3d accessories for extended batteries. Cant link because I'm in work.

Sent from my HTC EVO 3D X515m
[HTC EVO 3D] crazy-master:
i have an extended battery, but it is too big and i dont like the phone like that

i am looking for good battery life and good extras for my phone :D that maybe is not possible, but i decided to ask ;]
[HTC EVO 3D] Bebida:
I would try leedroid its fairly customizable I have jans tweeks, custom transition, slide to wake/sleep, mayfields theme you can also use plus some theme and loads of other stuff. Battery is good I'm at 70% after 15 hours and it runs smooth. Also u can get dancing android for incoming calls and its hilarious! Have a mess around if you don't get on with something just go back to stock. The devs are making good progress on ics cm7/9 and miui too so keep an eye on the dev section.

Sent from my HTC EVO 3D X515m