yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] zxvf:
HOW TO ENTER CDMA DBG> mode (BOOTLOADER Full admin mode)

EUREKA I'VE GOT IT...

I should be making a wiki page instead of posting here but these are the steps that are needed to enter CDMA DBG> mode which allows the use of extended commands like l, rbmc, s2d, d2s etc.. full access it seems..

here's the commands I used.

hope they work, I was wrong about the password being BOOTLOADER infact thats a password that most sellers have to do a few fixes, but not give them full control to screw up our devices..

I don't really know much about the commands except the info that they return, so just bear with me and follow along if u really wanan get to this, as of getting to the CDMA DBG> isn't dangerous u are not writing anything (YET) in order to get there, just modifying some switches etc.

ok so first the password: 40r0~0y~~5~0000

so type

USB>password |40r0~0y~~5~0000

u should get "HTCSPass1.CMˆËHTCEUSB>"

[DONT PRESS ENTER/RETURN JUST CONTINUE TO TYPE]

HTCSPass1.CMˆËHTCEUSB>set 1 0

This makes it so the Operation mode currently is set to "User" (maybe allows user interaction, not sure)

type set 5 7777 (not really sure if this is needed, all it does is set the background color value to 7777)

not the last command rtask a

here's what mine looks like

USB>shmsg 5 0 " Upgrade "

USB>shmsg 7 0 " Radio Stack "

USB>shmsg 9 0 "Please Wait..."

USB>rtask a

Radio image flash by external bootloader.

ÿ

HTC Integrated Re-Flash Utility for Harrier

This version is used for developig CDMA system

Copyright (c) 2003 High Tech Computer Corporatio

CDMA DBG>h

now if I type

l (DONT DO THIS UNLESS UR READY LOOK AT THE SYNTAX FIRST) I was stupid enough to just try it I got this

CDMA DBG>l

start cdma download

instead of the "not allowed or what ever that error was.."

now I hope this doesn't do something bad to my device, but I can't seem to get out.. *GULP*

Anyways thats all the info I have, hope it helps in any way :) Cheers.
[Upgrading, Modifying and Unlocking] zxvf:
P.S you can look at the syntax of 'l' if u search in the wiki pages.. information brought to us by itsme here is a direct link to his page. I'll also paste the 'l''s section here..

http://www.xs4all.nl/~itsme/projects/xda/bl-ii-usage.html

syntax for 'l':

usage_cmd_l = sub_9004C74C(1)

sub_9004C74C

Usage:

l [path_name [startAddr offset ["cp"]]]

Download BIN file across from serial/USB port.

Startaddr offset(MSB bit is a sign bit): Start address offset of every packet in bin file.

When 'cp' is given, it will just compare data of file with ROM image.

When path_name is not given, the file to be downloaded is determined

by ppfs on the host.

Otherwise, path_name on the host is downloaded regardless the ppfs setting.

The file must be in the format of BIN (preprocessed SRE).

The code is auto-launched once downloaded.

Auto-launched is disabled after downloading.
[Upgrading, Modifying and Unlocking] obelix:
Nice job zxvf! Thats some good digging. I didn't follow this section before getting to the Debug mode:

USB>shmsg 5 0 " Upgrade "

USB>shmsg 7 0 " Radio Stack "

USB>shmsg 9 0 "Please Wait..."

USB>rtask a

Radio image flash by external bootloader.

What is shmsg and rtask doing? Do the shmsg commands actually do some upgrades and if so from what image? I have never seen them and wonder what those steps do.
[Upgrading, Modifying and Unlocking] obelix:
I tried this on a Sprint Harrier and the same technique works and I was able to get to the Debug bootloader. I don't have any images to install to test but this is a great way to get to the lower level commands!
[Upgrading, Modifying and Unlocking] zxvf:
no no, the shmsg = sh (screen) don't know about the h (maybe height) ? but basically waht shmsg does is puts text on the display of ur harrier, I was monitoring a Upgrade thus it said Upgrade please wait, when u do an actual upgrade from a real .exe provided by the provider, or maker, if u look at the screen u will see the same thing printed on the screen thats also what

the numbers do, they are the position of where to start writing the text. (to make it all perty an stuff) and rtask a, I'm really not sure what that one does, but I think this sets the flag that allows u to maybe r (read) task, and a (all) ?

I'm just getting it might be something completly different, maybe a google will give us some info... FYI I'm using a VERIZON Wireless Harrier PH20A3 my self.. so luckely we have the same phone, night not work with others ;)

I think the rtask a command is needed though since it starts/runs the radio external bootloader.. but again those are just my educated guesses...

and yea same here, got no images to try, and the ones I do, i'm to timid to even do, until I get very confortable with the bootloader, and binary files... and at least have a way to undo something if it did does something bad to the device.
[Upgrading, Modifying and Unlocking] obelix:
I figured that out, those are some fun commands. I just tried the same technique on a locked iMate Blue Angel. No dice. The password you had didn't work. I tried another Blue Angel password which was accepted but the Debug mode never came up:

USB>password |40r0~0y~~5~0000
HTCSInvalid password.R¿ËPHTCEUSB>
USB>password BOOTLOADER
HTCSPass.<set 1 0
Type (0x1)(Operation mode flag): cOpModeFlag=(0x0).
USB>set 5 7777
Type (0x5)(Background color value): g_wBColor=(0x7777).
USB>shmsg 5 0 "Test Upgrade!"
USB>rtask a
Radio image flash by external bootloader.

It basically was stuck after the rtask a. I reset the device and its OK but didn't get to the Debug screen. I would guess it would say something like GSM DBG>
[Upgrading, Modifying and Unlocking] obelix:
Oho, so you found a way to sniff the HimaUpgrade.exe program. That is very very clever. You dont need to fill in more details as I already can make it work using my Harrier. But how do you do that sniff or are you looking through the EXE? I want to do the same thing you did but using the Blue Angel BaUpgradeUt.exe RUU loader. How come the one you used says HimaUpgrade.exe, does the Harrier use that as well?

Let me know how you do it and I'll run it and post the details for the Blue Angel RUU tool.

Can't wait!
[Upgrading, Modifying and Unlocking] buzz_lightyear:
great work guys... keep it up!!

actually, shmsg is nothing more than 'SHowMeSsaGe'...

it shows messages on the screen while upgrading.

I guess, that u used serial port monitor/sniffe , right?

buzz
[Upgrading, Modifying and Unlocking] obelix:
I just tried to use a USB Sniffer called SnoopyPro.exe but while that captured a sniff during an RUU ROM upgrade, it seemed like an encrypted sniff and I couldn't spot any cleartext in it.
[Upgrading, Modifying and Unlocking] buzz_lightyear:
guys, if you need some .bin files for 'l' command, just let me know..

buzz
[Upgrading, Modifying and Unlocking] buzz_lightyear:
@zxvf

hi there, can u please post your bootloader image(dump)?

i have 1.06 and the password |40... is no go for me...

THANX

buzz

PS: tar zxvf :o))
[Upgrading, Modifying and Unlocking] obelix:
Hi zxvf, you've kept us on pins & needles <g> What's the technique you used to capture the USB flashing traffic? I can't wait to try it on a Blue Angel.
[Upgrading, Modifying and Unlocking] zxvf:
been a while since i've written anything, the program I used was USBMONITOR.exe u can look for it on here, or just search for it online, basically it monitors every packet sent, (this is how I got the information) surpriced other people hadn't tried it, I just got the weird idea to give it a shot and EUREKA :)

anyways, like I said I really don't know much about the Himaupgrade or the Maupgrade or anything like that, when one doesn't work I try the other, and eventually one will work.. hehe, thus I though they were basically the same just different ones had a different password perhaps...

also most of the passwords are the name's developer but backwords upper case-lower case-uppercase-lowercase (u get the idea)

so for Harrier it's ReiRraH

also the password for unlocking the extended rom is that..

just got the exttool program to work, and yep it unlocked my external ram.. woohoo

ciao
[Upgrading, Modifying and Unlocking] zxvf:
ooh and and buzz, here is the bootloader file u requested, this is extracted from my PDA, using the Bootblaster program.. if u need me to do another way, I would be more then happy to do so, Sorry guys for keeping u guys waiting, I just relocated to Utah, SLC and thats a huge change for me so still trying to re-adjust... finally got internet woohoo..

http://www.hexcode.net/xda-dev/mybootloader.bin

also, could u redirect me to some .bin files tho use with l, or even some .nb0

s to use flash? or is it .nb1 I forget.. anyways would like to try and get WM2005 working on my VX6600 / blueangel
[Upgrading, Modifying and Unlocking] zxvf:
for your convinience u guys can download the usbmon program at

http://www.hexcode.net/xda-dev/usbmon.exe

enjoy, and happy hunting

buzz: that's exactly where my nickname came from don't ask me why, but it's been with me for 6 year or so.
[Upgrading, Modifying and Unlocking] buzz_lightyear:
hehe... cool...

actually it would be much better, if you guys get yourself serial cable, coz you;ll get much more output through serial...

There is a serial port monitor/sniffer program. i guess it's from the same company as that usbmonitor...

i've used it before, when i was playing with motorolas.... serial sniff is much clearer that USB... :o)

thanx zxvf

buzz
[Upgrading, Modifying and Unlocking] zxvf:
I have a serial cable, actually one of those cradles that have the serial cable & USB it came with my old HP3800 anyways, I tried to see if the VX6600 would fit but it didn't.. so I'm thinking if there might be a way to rewire it, either using the original's VX6600's cradle, and just using the cable. or by rewiring the extra VX6600 adapter, for direct power, that came with my phone, I would think it's the same voltage same info, I think I even read it on here, on how to do that, I havn't really done much research just stating what i'm doing, so i'll probably start doing my research and actually get it converted, BUT HERE is my real problem, I'm on a laptop, without any type of serial ports, (besides printer LPT1) what do I do about that? buy a pcmcia that has a serial port? (do they have them) or bluetooth (need to get an adapter for the lappy since it doesn't have bluetooth) or ?

is it possible to get a converter to convert the end that goes into the pc's serial to USB instead or is that basically voiding the perpuse of using a serial cable?

and glad I could help.. anything else ask :)

P.S. If you guys remember, I have every file that was in the server prior to the deletion of them locally, so if u guys need any old file u guys can imagine thats not in the xda-dev's ftp already I'm sure to have it..

peace
[Upgrading, Modifying and Unlocking] obelix:
zxvf, using the USB Monitor, how did you get it to continue the session once the Harrier rebooted? That closes the USB connection and then its reestablished. I didn't see the USB logger pick that up and contine the capture. Can you outline how you did the capture or maybe even post the session profile that the app can save?

Thanks, this is fun.
[Upgrading, Modifying and Unlocking] zxvf:
I wish I could get on this forum a lot more often, but with all the moving it's hard

What I did is first started the usbmon, make sure u select the USB PocketPC under the controller section of the one u used, not the controller it self, (I made that mistake my self.) tell me what exactly are u doing, I can replicate what u did, and send u the complete log/session, so u can see how it goes... I think my trial has expired so I need to set my clock back heh.

If for some reason the program restarts the usbmon then first run the update/upgrader and then really quick create a new session. that should do the trick, look under the "complete" tab, for more info, and it shoudn't disconnect ur upgrade.. (atleast it didn't to me) play around with it, I'm sure that it will work eventually, I guess i'm just lucky to have it work always at first time.. hehe

ciao
[Upgrading, Modifying and Unlocking] obelix:
I definitely have picked the Pocket PC USB USB selection low down.

Then I start up an RUU OS update tool and let it run but once it rolls one of the first things it does is reboot the device into boootloader mode. At that point USB Monitor says it has lost the connection with the Pocket PC. I didn't see an opportunity at that point to reconnect the USB session. Also I would imagine that the RUU is sending commands pretty fast so how do you re-start the capture fast enough to capture the commands? Definitely the first few commands it issues is the most important since it throws the bootloader into debug mode. Once that happens life is good!
[Upgrading, Modifying and Unlocking] toenailed:
i love this thread so much .. been reading this quite a lot ..

well done obelix and zvxf .. i ve learn from you guys a lot .. :)

USB>l d:\image.bin
:F=d:\image.bin

start download
S
HLoad ADDR: 80080000 Length: 1F00000

Programming flash blocks by serial port...

Flash ID = 89,8802
Trumbull INTEL StrataFlash 128 Mbit MEMORY (K3/k18) found
Number of chip = 2, bus = 32
***************************************
****************************************
****************************************
*****

*Done

Code entry point unknown

and the IPL .. :D

USB>l d:\himipl.bin
:F=d:\himipl.bin

start download
SH
Load ADDR: 80040000 Length: 9328

Programming flash blocks by serial port...

Flash ID = 89,8802
Trumbull INTEL StrataFlash 128 Mbit MEMORY (K3/k18) found
Number of chip = 2, bus = 32
********

Done

Code entry point at 0x41000

USB><CE-31><CE-1167><CE-995>

.. .. :)

-toe
[Upgrading, Modifying and Unlocking] buzz_lightyear:
TOENAILED THE GREATEST!!!!!

Cheers bro!!!

:o))))

buzz
[Upgrading, Modifying and Unlocking] toenailed:
cause i choose a right person to be my IDOL

heheh YOU ARE !!!

cause you are the TRUE GREATEST .. :D

-toe
[Upgrading, Modifying and Unlocking] zxvf:
Hey toenailed:

(sorry everyone for not posting before):

I kinda just screwed up my radio, don't remember what I did but i did, eventhough somehow I can still get on my PDA except I get the DM FAIL messages on the P and R, which means I did something (in the process of trying to get on VZW's QNC free internet switch board) to not allow them to run... anyways I don't have a serial cable connection (havnt really had to chance go buy one or build one) could u posibly point me to the cable u have (grr i forgot my laptop doesn't have serial ports) do u think u might be able to do a s2d and then make an image of ur card and send it to me? or someone ?! *please* :) I don't think u can flash .bin files as easy as u did with ur serial connection, (just have the cadle connection). I can still use the Hilaupgrade all those programs fine, I can even re-flash the radio stack, but something tells me it has to do with the registers

ANYWAYS in another note, I found more commands that appear to be very dangeous so be careful:

P.S: THIS WILL ONLY WORK IN THE CDMA DBG> mode

the new commands, I have not really examined what they do I might do that later.. and post it, if u feel adventures and daring you can try it ur selfs, but WARN U BE CAREFUL with them:

ew, be, uart1, fuart, nverase, flashtest, chksum32, rrbmc, rerase rwdata, rchecksum, rwdata, version, rinfo, rwbl, backdoor (wow, don't know what it does, but what a name heh) lol, rpass...

CIAO
[Upgrading, Modifying and Unlocking] buzz_lightyear:
WOW, backdoor !!!! cool :o)
[Upgrading, Modifying and Unlocking] obelix:
getting the usbmon to wirk

Hey zxvf, any luck recovering your Harrier?

Can you maybe try and revist your effort to determine a reproducible way to get the USBMON program to log the USB activity that leads into the RUU reboot of the XDAIII? I want to post the same info you had from the Harrier but for the BlueAngel. Your bootloader commands worked perfetly for me on a Sprint Harrier so I'll bet once we nail the commands for a Blue Angel that would be equally universal.

Thanks a lot!
[Upgrading, Modifying and Unlocking] TofClock:
Oooooooh yeeeeeeeeees !!!

It's a very good thread :)

i'm monitoring a TOTAL upgrade ....

maybe a lot of new stuff ..... cross the fingers ...

password for himalaya bootloader : ~F0>~kv~a~~~~000
[Upgrading, Modifying and Unlocking] buzz_lightyear:
wonderfull!!!

Keep it alive!!!

buzz
[Upgrading, Modifying and Unlocking] toenailed:
Newer Himalaya Device BOOTLOADER and SOMe new Bootloader from Other Device contains three passworded protection

Pass

Pass1

SecurityPass

i believe the Pass password is BOOTLOADER

Pass1 can be trace by USB Sniffer

but in Himalaya Pass1 differs with Different Bootloader Version

but it always start with ~F0V> and ends with ~000

again in HIMALAYA

v1.01 and 1.02 are both protected only with Pass

but with 1.03 to 1.06 it is protected will all three Pass, Pass1 and SecurityPass ..

now my Question .. guys .. do you know how we can trace the password for SecurityPass ??

-toe
[Upgrading, Modifying and Unlocking] zxvf:
I think that unless we can find a program that might use that password to enter a higher security ranking we aren't going to be able to find that password, perhaps thats the password that the repair people persay at the verizon stores, have to repare the device? or maybe it's a command that might look like something else. persay set 1e 1 ? I coudn't figure that out, but I did realize that when I forgot to type that, some of the other commands said not allowed then I typed it, and then tried the command again, forgot which one it was, might have been rwdata or rerase I forget, but then after that it worked perfectly without an error... I spend most of my type trying to look at the hexdumped code from my d2s dump... I mean I've been spending the last couple of days doing nothing but that, and i've found some pretty interesting things.. hopefully I can find the code in that run, I know it's so much code to actually look at, but i'm so desperate trying to get my device fixed (no I havn't yet :(() that I've been doing that...

if anyone can provide me with a full d2s dump of their HARRIER with bootloader 1.02, I would appreciate it..

also I can't get the 'l' or the lnb or the rrbmc or any command to work, none the less the s2d dump, from another device I keep getting not allowed, and I even followed toenails examples, (thanks lots buddy) but nothing, *scratches his head* I went out and bought a serial cable as well, (the dual usb and serial cable one that Cingular cell for their SX-6600) which verizon refuses to sell.. and with that I have the same luck, I cannot send it times out waiting for host(2)

any more deeper help would be appreciate..

thanks guys... Oh and to top that lol, verizon canceled my request for a new device don't know why, but apparently the order never went through I need to call them up again.

well anyways careful with ur devices...

i learned that the hard way

CIAO

p.s I should of listened to obelix :/
[Upgrading, Modifying and Unlocking] zxvf:
p.s anyone know what task 32 does?
[Upgrading, Modifying and Unlocking] obelix:
Sorry your Harrier is still hosed. I am out of town now but when I am back in a week I can do a backup of my Harrier and post the dump.

Task 32 is an unlock to allow the l (load) command to work under certain conditions.
[Upgrading, Modifying and Unlocking] zxvf:
obelix: ok do you know what are the circumstances? what does it enable? I've been trying to flash it with my old .bin files backed up from osloader, but It just won't budge, also you happen to know if a .nb1 .nb .bin or an unencrypted .nbf? are they same thing?

I know they differe in very little mostly the header, but anything else that u might know... ones I get my harrier fixed, i'll be glad to help u again with the usbsniff...

I got my self a serial cable, and toe was right u can get a lot more information (error messages) that way

you know i'm starting to wonder if the reason wy my device is screwed up is because I been playing around the rrouter and rroute commands... maybe i'm routing to things that i'm not suppose to?

anyone know the default parameters?
[Upgrading, Modifying and Unlocking] is0-mick:
Hi All,

was just trying some of this on a XDAIIi to see what results were obtained.

here is the output i got

USB>password BOOTLOADER

HTCSPass.< YHTCEUSB>

USB>

USB>password ~F0>~kv~a~~~~000

HTCSInvalid password.R¿ËPHTCEUSB>password 40r0~0y~~5~0000

HTCSInvalid password.R¿ËPHTCEUSB>password |40r0~0y~~5~0000

HTCSInvalid password.R¿ËPHTCEUSB>password 0000000000000000

HTCSPass1.CMˆËHTCEUSB>password |40r0~0y~~5~0000

HTCSInvalid password.R¿ËPHTCEUSB>

USB>

USB>

USB>set 5 7777

Type (0x5)(Background color value): g_wBColor=(0x7777).

USB>rtask a

Radio image flash by external bootloader.

Invalid cmd!Invalid cmd!Invalid cmd!Invalid cmd!Invalid cmd!Invalid cmd!Invalid cmd!Invalid cmd!

the last parts are when I was typing ? and H (followed by return).

It was still accepting commands but I didnt have a prompt as you can see.

i just tried it again after a reset.

USB>

USB>

USB>password 0000000000000000

HTCSPass1.CMˆËHTCEUSB>set 1 0

Type (0x1)(Operation mode flag): cOpModeFlag=(0x0).

For a help screen, use command ? or h

USB>set 5 7777

Type (0x5)(Background color value): g_wBColor=(0x7777).

USB>rtask a

Radio image flash by external bootloader.

Invalid cmd!Invalid cmd!Invalid cmd!

whatever i type (and press return) it echoes back "Invalid cmd!"

it seems on my xdaIIi

BOOTLOADER is password

0000000000000000 is password1

Mick
[Upgrading, Modifying and Unlocking] TofClock:
On noooooooo ....

i want write in rom with lnb , but ... "Not Allowed Operation" :/

i've tried with the wdata command but i don't know how o send the data ....

i want to try write #10000h bytes at address #70000000h ...
[Upgrading, Modifying and Unlocking] obelix:
restoring zxvf's harrier

Hey zxvf, I am back and have my harrier. I couldn't find any instructions on how to backup the bootloader/ROM without using an SD card.

What exactly can you still do? Can you get into the bootloader?

if so you ought to be able to get into the DBG mode as you had discovered and be able to do a l (load) command to load a working version of your OS. Is the radio screwed up as well? What do you see when you reboot the device in the lower right of the boot screen?

On the FTP site here, do they have .bin files as well as .nbf files?

The bootloader 1.02 may already be out there.

Look for posts from a guy called itsme as he wrote most of the tools and is a wizard around backup/restore.
[Upgrading, Modifying and Unlocking] zxvf:
obelix:

thanks for trying to help me, but I got a replacement phone, and got lucky and sent me a XV6600 with cam, which I original had the WOC one.. so I got a 640x480 cam (eak res) anyways, I can can continue my work, so what exactly u need to me describe etc?

oh and to dump the rom u do.

and to do a dump, u enter the bootloader have to have a SD card bigger then the size of the rom

and type this

d2s 80000000 02000000 <-- this will backup the CEROM + BOOTLOADER to ur SD card. :)

cheers..
[Upgrading, Modifying and Unlocking] obelix:
thats great news about getting a new device! I had been asking about backing up the ROM since dumping to SD card wouldn't have helped you since I wouldn't have been able to upload an SD card to you <g>

My earlier question was getting the steps nailed to be able to reproduce your USB sniff. I have not been able to duplicate your technique with a Blue Angel since I can't get the USB sniff team to be able to continue monitoring the USB traffic once the device boots up into bootloader mode which is the point when the USB sniff tool simply stops seeing USB traffic.
[Upgrading, Modifying and Unlocking] zxvf:
thats kinda odd, for me it stops when it reboots, but the USBmon program picks it up right away, again.. my trial has expired so I'm going to try and find a way to get more time or a different program.. later today I'll get a tutorial on what I do exactly which is probably what ur doing...
[Upgrading, Modifying and Unlocking] kocoman:
Does anyone have more info about the CDMA DBG> mode? I can dump the CDMA Bootrom.. but not the CDMA Firmware or CDMA nvram..? Thanks