[AT&T, Rogers HTC One X, Telstra One XL] darkspr1te:
Hi,

a couple of things that i feel are unclear and contradict qualcomm docs, in the ones i've been reading there are two .hex's

armprg & eprg

in the docs which cover the dload process it states that eprg will bring up the usb/ram etc but armprg does not, if we are using the wrong one at the time wont we have a conflict? edload and dload are not the same, in terms of protocol yes(commands are same), but function no.

Soul Shadow has a theory that you can still get to emergency download mode from userland/dload (sbl) by writing to the iram with magic values and doing a soft reset.

this is confirmed in theory but there are still some unproven/unresolved problems, the dload spec requires a security code, 64bit, if your luck like my msm8660 it's of so it responds ok, if unlucky it might need a leak of the code or brute force.

So to cover it in brief

edload(emergency download mode, ehostdl, blank flash/pbl) is not the same in terms of hex file as dload (qualcomm dload, qdload, sbl3 dload, dmss load)

before you can run/write code (go command, 16 or 32 bit write) you have to send the unlock code, 0x0B

structure :-

[U][B]field/Command Length bits description of cmd[/B][/U]
0x0B 8 pc sends to phone via hdlc/dload/dmms
security code 64 security code for phone

if it works you get a ack respone 0x02 (see 18th.abn logs for the repeated acks 0x02 )

if it does not work you get a NAK(0x03) response with 0x000c as result,

as i dont see 0x03 in the logs i am going to assume we are using a emrpg/edload hex in a dload situation causing it to crash.

i would try and upload the hex via revkills, it logs output to the main window and you can send canned messages in hdlc/qdload protocol.

There also a 3rd, unsigned code. the pbl does check the hex for signature AFAIK, there are many references to it in the qfuse docs.

there is no info on hand yet to me that states that it will respond a error on the dload/hdlc protocol for unsigned, it might just shut down for all i know or cause the system to reset, the latter is the case then you should be able to then upload a .hex again.

I would suggest one method which might work, you can instruct the qdload to force fail the sbl on next reboot by writing magic numbers to the iram via the qdload mode then do a reset via same, this invalidates the sbl1 loader leaving you in PBL Dload (edload, emergency dload) then upload the eprg hex.

I dont have a way of confirming which hex you have but i can confirm which mode you are in, if it's either edload or dload.

if you send a parameters request packet 0x07 to the com port it will respond with nothing or low version in edload and in dload mode will respond with the bootloaders version.

this is a 0x07 response for msm8660 in pbl

BOOT ROM VERSION: 1.4Q
HSUSB VERSION: 00.00.08

EDIT:

Two things occured to me, the hex could be the same but the entry point could not be, in software.exe of qpst it has the option of using emergency host dl, maybe that tells it to jump to a different vector when sending go command.

i know in edload when i upload the hex and go it's at 0x2A000000, i can also upload/execute the hex in higher memory value(0x2E000000 MM IMEM) but iram address 0x2A000000 (system IMEM) is norm for msm8xx devices.

the magics are as follows

location for 0x322A4F99 magic is 0x2003FC00
location for 0xC67E4350 magic is 0x2003FC04
location for 0x77777777 magic is 0x2003FC08

but those a default values and OEM's can change them.

so if you adjust those mem areas to values and soft reset then it should end up in edload.

i can confirm this in edload(pbl,emergency) but i've yet to get my device into dload, when i try it reboots normally so cant confirm dload magics.

Further Edit:

This link contradicts the base adress posted above

http://www.anyclub.org/2012/06/trustzone-l1-cache-dump-on-amss8960.html

it says to use

thats for trust zone, we need #define SHARED_IMEM_PBL_MAGIC_BASE 0x2a03fc00

Does the Switch to DLOAD do anything in emmcswdownload.exe? in my device it just reboots. no switch.

This is my theory based on the research i am doing, i hope it can help, if i am wrong let me have a last ciggerette before the firing squad :laugh:

darkspr1te