[Upgrading, Modifying and Unlocking] zxvf:
yes that u should see the cdma DBG> after rtask a

here is the exact steps that the HimaUpgrade.exe goes through for ur reference most of the actions are not documented, and some u can figure out by the output.

first it does a

'task 32' (w/o quotes always)

it should reply:

SD: waiting for card info

insert Level = FF

then it does a

'info 2'

replies:

HTCS 56450001(this will be diff i think carrier) ,IuF HTCE

then it does a

'info 3' (DO NOT DO THIS COMMAND IT WILL LOCK IT UP WAITING FOR INPUT, I'm thinking this is where the upgrade program sends it the information to compare the language, operator and version etc?)

the reason why I say this is because the input that is given to it, is this (short version)

HTCS

P.H.2.0.A.3.........

.........................

.........................

.........................

.........................

56450001...........

......[]......o......p.

..HARRIER

.........................

1.02

.........................

thats what is sent to the phone by the upgrade program, thats why if u just run it then it sits there and waits for input

then it does a

'info 6'

this did not reply anything just put u back to the USB> prompt maybe it's needed maybe it's not, so try either shoudn't hurt

then it does a

'password 0000000000000000'

this output's

HTCS Invalid password (so maybe some bootloaders password is the one above and others is the |40..etc ??

then it does a

'password |40r0~0y~~5~0000'

this output's

HTCS Pass1...CM[]E HTCE

then it does a

'set 1 0'

outputs:

Type (0x1) (Operation mode flag): CopmodeFlag=(0x0)

then it does a

'set 6 FFFF'

outputs:

NONE

then it does a

'set 2 1'

outputs:

NONE

then it does a

'set 5 7777'

outputs:

Type (0x2)(ba) .... (getting tired of typing so i'm going to start making the output as short as possible so just bear with me, and check similarities heh.

then it does a

'shmsg 5 0 " Upgrade "'

'shmsg 7 0 " Radio Stack "'

'shmsg 9 0 "Please wait....."'

then it does a

rtask a

outputs:

Radio image flash by external bootloader HTC Integrated Re-Flash

Utility for Harrier this version is used for developing CDMA system copyright (c) 2003 High Tech Computer Corporation

...... Version: HA0.04 Built at: May 11 2004...CDMA DBG>

press enter and now u should be at

CDMA DBG>

then it does a

'rerase 20000 10000'

replies junk along with HTC EO CEC DM

then it does a

'rerase 30000 10000'

replies more gibberish along with CST UE O HTC EC DM

then it does a

'rerase 40000 10000'

replies: giberrish (ok all the rerase give out about the same gibberish, and you can see the pattern on how rerase is being used to erase the flash, i think)

I think it goes all the way until

'rerase 2f0000 10000'

then from there it starts writing the upgrade

'rwdata 20000 8000'

output/input: data (the upgrade)

then it does a

'rwdata 28000 8000'

then it does a

'rwdata 30000 8000'

P.S. BTW I think right now it's updating the RADIO (oh yea duh it says it on top lol)

then it does a

'rwdata 38000 8000'

and u can see the pattern there as well

and I think the last one is

'rwdata 2f8000 8000'

which seems to be blank FF FF FF FFF FFF etc

then it does a

'rchecksum 200002e0000'

it replies:

HTCSh.W.a.>n HTCE

then it does

everything from set 1 0 all over again except the shmsg are changed to

'shmsg 7 0 "Extended ROM"

...

I need to get going, so I'm going to have to finish it off tomorrow or another day, hope this is enough info to get u going....

ciao