yashsingh1/xdaforums huggingface dataset:
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
It's possible to revive them...but you'll need a special SD Card Image ROM...

Google a little bit about .nbh images, SD Rom Boot images, etc.

Once you have this special SD Card ROM Boot image prepared, you put it on the phone, put the phone in bootloader mode (camera + power + reset),and check the screen: - a message will appear telling you to "press power to flash", and you do it. Let it flash and reboot.

Magician revived.

Best Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
The file header of the SD Card ROM must be the same of my magician ROM, isn't it? Now the problem is I can't get the header of my magician ROM, when I use "d2s" command the magician dead.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Well i don't quite get what you mean by "header of Magician ROM"....i assume that you are refering to the bootloader...what version do you have? Does it says 1.2 or 1.0? Have you tried to flash a different bootloader from a different model or something?

Anyway, I don't quite get what is your problem exactly - Is it with the Radio part or windows part? Does the WM2003se boots or not ?

- If your problem is only with the WM2k3 not booting, then you must upgrade only with a ROM image for the OS (nk.nbf) - (Try and use an original ROM first...don't you use cooked ROMs.)

- If it's both WM2K3 and radio, then you need to put the nk.nbf and radio_.nbf on the same directory where the MaUpgradeUt.exe is.

- If you also want to upgrade your Extended ROM, then beside both files mentioned, you also need to have the ms_.nbf.

Anyway, regarding the radio part: try this: google for "MagicianRadio_1.13.00_maupgrade"

Finally: don't forget that you need to download and use the "MaUpgradeUt_noID.exe" or the magician will complain about the country code error + some BS.

Best Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
I heard that the front 416 bytes of SD card ROM image must be the same as the PDA, and then can falsh it. The front 416 bytes of every PDA ROM are different, so I must get my magician ROM header (416B), but I cannot.

My magician can boot, but cannot be flashed a new rom. The error code returned to me is "Get Device Data Error".

btw, the bootloader is v1.02, how can I reflash a new bootloader? I don't know how to do that, maybe it can resolve the problem.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Forget about changing the bootloader - you could end up with a brick on your hands...besides, that's the latest (final?) version of the bootloader for magicians.

Anyway, that message seems to be related to usb data transfer between your pc and your phone...you DID disabled the "Allow USB Connections" on ActiveSync BEFORE TRYING to do an upgrade, didn't you?

If you use windows Vista, there's a known problem when trying to flash a new ROM with it...

check this link on how to use vista for ROM upgrades: http://mahmood1.com/upgrade_pocket_pc_ruu_in_vista.aspx

Best Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
My system is Windows XP, thank you all the same.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey, try this:

1) Download this image: http://www.t-mobile.nl/zakelijk/media/download/MA_TMNL_11300_132_11200_Ship.exe

(It's an original image from T-Mobile).

2) Extract the .exe content using winrar.

You will get the following files:

- EnterBL.exe

- GetDeviceData.exe

- RUU.dll

- RUU.conf

- UI.dll

- ROMUpgradeUt.exe

- nk.nbf

- ms_.nbf

- radio_.nbf

3) Delete the ms_.nbf, radio_.nbf and ROMUpgradeUt.exe files.

4) donwload this file: ftp://xda:xda@ftp.xda-developers.com/Magician/Tools/MaUpgradeUt_noID.exe ...and put it on the above directory.

5) disable ActiveSync "allow usb connections".

6) put your phone in bootloader mode

7) run MaUpgradeUt_noID.exe and let it finish. (It may take some time...)

8) hard reset your phone.

Now, if you want to try to upgrade just the radio, repeat the above steps but delete the nk.nbf from that directory and and put a radio_.nbf there.

NOTE: You WILL loose everything that you've got stored on your phone...contacts, sms, etc...so do a backup 1st if you want.

Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
:mad: It not worked. The RUU.log is this:

00:01:01:890 [msg] : Version : [1.5.0].

00:01:01:890 [msg] : Config Info : [776571],[1],[1],[0].

00:01:01:890 [msg] : RadioFile Not Exist !

00:01:01:890 [msg] : MSystemFile Not Exist !

00:01:05:703 [msg] : Current Not in CE Mode or in CE Mode but ActiveSync Not Connected.

00:01:09:828 [msg] : Disconnect ActiveSync .... [2]

00:01:09:968 [msg] : Current in BL Mode. Open Port : [\\.\WCEUSBSH001] OK.

00:02:48:281 [err] : BL Get Device Data Error.

00:02:48:281 [msg] : Update Image. CE : [4], MSystem : [0], Radio : [0]

I clicked "Upgrade" and it displayed "checking the information of your device..."...
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey...the only way i see it, is to try an SD Card Upgrade.

I can try and craft you an image for your SD Card but i don't know if it will work on your SD Card... What's the size(s) of your SD Card (s)?

I don't want to e-mail you 1Gb image (i only have 1 and 2Gb SD Cards) and has so i need to do this ( http://buzzdev.net/index.php?option=com_content&task=view&id=18&Itemid=41 )...which i've never tried...so let's hope that the SD Card header won't be a problem...

Anyway, i can't do it now...i'll pm you later on, when i get some free time.

Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Thank you.

I have a 2 GB SD Card, but it didn't work, I think the reason maybe the header of the SD Card Image not modified. But I cannot get the header of my PDA.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey, here we go.

Do this:

1) Download this Emergency SD Card image: http://rapidshare.com/files/56985459/Emergency_SD_Card_Image.rar.html

2) Download the NTRW in attachment

3) Format your SD Card using windows XP format option

4) Copy both files (ntrw.exe and SDCard.img) to your C:\

5) Open a dos command prompt and type: ntrw write SDCard.img <sd card reader drive letter>

( do note that <sd card reader drive letter> must be replaced with your own SD card reader drive letter...example: "ntrw write SDCard.img e:". Also do note that when writing to the SD Card, some errors might appear...ignore them...the image is/will be there in your SD Card)

6) Put your phone in bootloader mode

7) Connect the usb cable or power cord to your phone (This is a MUST! or you won't see the next step)

8) Insert the SD Card on your phone and check if the screen message changes to something like " Press power to flash "

9) Do has told: press the power button and WAIT! (if it seems to stop, leave it that way...it will eventually end the upgrade)

10) Hard reset your phone when the upgrade ends.

Note 1: This SD image and procedure was tested on my phone and it works. The image itself is an original T-Mobile ROM 1.13.

Tell me how it went.

Best Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Happy to hear you again. But I cannot download the image. I will try.
[JAM, MDA Compact, S100 Software Upgrading] coly:
:mad: I do this step by step, but after I inserted the SD Card on my phone, the screen message didn't change, it was "USB V1.02", if I disconnected the usb cable, it changed to "Serial V1.02".:mad:
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
It can't be...This image is in perfect shape. you must be doing something wrong or your bootloader is damaged seriously...

check this out:

- Your USB cable must be connected to your PC and ALSO to the Magician.

- Check if ActiveSync USB option is disabled.

- If both of the above are true, leave the SD Card inside the mini, and press camera + power + reset button again...(i've read that sometimes the process doesn't work at the first time...)

- Try to disconnect and connect the USB cable from your magician, with the SD Card inserted on the phone...check is the message on the screen changes...

Please post what you have tried already...

If nothing works, that means that your bootloader is f* up. You'll have to wait a little bit more so to give me time to check how to prepare an SD image (or an alternative way) for upgrading your bootloader.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
It not worked.

I just did as what you said. If I pressed camera + power + reset button with the SD Card inside, the screen was not changed even if I connected / disconnected the usb cable; but if I pressed camera + power + reset button without the SD Card inside, and inserted SD Card under bootloader mode, the screen can change from "USB" to "Serial", but I didn't see " Press power to flash ".

I think my Magician bootloader was corrupted, because the screen showed nothing after I typed "d2s" in MTTY. But I don't know how to upgrate bootloader.

Thank you very much.
[JAM, MDA Compact, S100 Software Upgrading] coly:
Now I find a new problem: I couldn't delete some fonts files stored in "/storage/fonts", even if I hard reset PDA. After I setup a new font named QooQooCN, I cannot uninstall it, seems wince.nls running. But I still cannot delete /storage/fonts/*.ttf files. Why? If this is the reason why I cannot reflash my PDA?

Need help.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Coly, here it is the 1.02 bootloader from my device. Put it on your formated sd card like explained previously. Reboot in bootloader mode with the sd card inserted and with the USB cable connected...see if now you can get the "press power to flash"

If it still doesn't work, we will have to crack the passwords for the bootloader debug mode.

anyway, post your results, please.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Thank you for your help, but a bad news is that I didn't see the "flash" screen. It didn't work.

CRRRRRRRRY
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey we've got to go other way.

put your phone in bootloader mode.

- connect the USB cable (disable the activesync option).

- insert a formated sd flash card on your mini

- execute the terminal program in attachment and choose the \\.\WCEUSBSH001

- press enter.

- type the following: USB> password BOOTLOADER

(you should see something like this afterwards: HTCSPass.<YHTCEUSB>)

- type the following MANUALY (don't copy paste from here):USB>d2s 80000000 00040000

- let it finish

- remove the sd card and put it on your sd card reader.

- put the file psdreader.exe (in attachment) on your c:\ or something.

- go to a dos prompt and type the following: psdread <your sd card reader drive letter> 0x401A0 bootldr.bin

(example: c:\psdread e: 0x401A0 bootldr.bin

post a message with that file bootldr.bin so that i can compare it with mine.

btw: did you check if your SD card is unlocked by any chance? (mine has a small button that locks it and unlocks it...)

oh! and while at it, do the following at the terminal: USB> task 7 0

(it is supposed to unlock the ROM...) and try to reupgrade your phone.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Hi Keeper.

I have same problem with my Magician : cant be flashed not with regular update utility nor with SD Card.

When I use d2s command my Magician stuck and screen goes off.

More than that, when I connect USB cable with SD card inside Magician, I get "Unknown device" message.

Hope You can help us.

Thanks.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Well, im not an expert here...but i'll do my best...i'm also learning a little bit about how the bootloader works, their commands, passwords, etc...

I'll post some new ideias once i figure out a few things...meanwhile, try what i've posted:

- type the following at the terminal:

USB> password BOOTLOADER

...and then:

USB> task 7 0

...finally, prepare one SD card with the Emergency image that i've made (check the previous posts on this thread).

BTW, i never explained what's inside of that image - it is composed of a special header + original T-mobile ROM...that special header is what makes the SD Card bootable.

regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
did it - not worked

regards
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey, i've figured out some passwords with the help of zxvf posts...(thanks!)

Im not exactly shure how this passwords are related to themselves but i would imagine that they are ordered in (sort of) this way:

Guest mode: that's what we all have (bootloader locked - when you try to run a command it doesn't work or it simply says: "access denied")

User mode: BOOTLOADER

(gives access to a few commands)

Supervisor mode: S~~00~0me~~m~000

(gives access to a few/alot more commands)

System mode: i didn't got the password. (i would imagine that this kind of access would allow you to change quite of a few things...imei? digital certifcates? product serial? everything? who knows)

That's all for the time being.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Hi Keeper, I couldn't get the bootloader image. I did this:

USB>password BOOTLOADER

HTCSPass.< YHTCEUSB>d2s 80000000 00040000

Then Magician's screen showed nothing, I waited some miniutes, but It seemed Magician stuck.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey...it's time to try some more agressive methods...hehe

- download and install this program: http://rapidshare.com/files/57171394/usb-monitor.rar

- disable activesync usb option

- put your phone in bootloader mode and connect the usb cable on both PC and phone.

- start usb monitor and:

1)on the left window, select Pocket PC USB.

2)afterwards, on the center window, double click the URB View (it will move to the right window).

3) Finally, on the right window, select the URB View and press the start button (located and the bottom)

4) On the central window, there will be two tabs: Basic and complete. Select Complete.

- Start an upgrade from an original RUU image. Let it go until the end.

- When it aborts or ends (whatever comes first), press PAUSE on the top bar (do NOT press STOP!) - it's located above the center window

- Finally, right click on the URB View window (central window) and select export. Save that file has an .html file.

upload it to rapidshare or somewhere else so that i can check out what's going on with your usb connection.

Cheers!

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Thank you Keeper, I got the log here:

http://rapidshare.com/files/57195441/log.html

Waiting for you news.

regards

coly
[JAM, MDA Compact, S100 Software Upgrading] coly:
:( When I sended "task 32" from mtty, the Magician dead...

If I didn't send command "task 32", then "info 2", "info 3", "info 6" all would send something back.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
okey...try this...

go to your console and type:

-------------------------------

USB>password BOOTLOADER

USB>rtask a

-------------------------------

see if there's a message saying something like: "waiting for radio flash" or something like that...if not, try issuing the "task 32" command right after the password.

Oh! Tell me something, beside not being able to upgrade (or downgrande) a ROM (radio and/or Extended ROM and/or OS ROM), does the magician works fine? i mean, does windows boot up fine? does the radio part works?

One other Q: what kind of cell network do you use? CDMA or GSM?

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Keeper, Coly !

Same problem - task 32 stuck Magician.

There is 3 levels of protection in bootloader :

first, Password : BOOTLOADER

second, Password : 0000000000000000

third, password " ???? - I dont know.

in third level we can run commands like " l " - load file.

We have to find third password, this may be helpfull

regards
[JAM, MDA Compact, S100 Software Upgrading] coly:
“USB>password BOOTLOADER

HTCSPass.< YHTCEUSB>rtask a

Radio image flash by external bootloader.”

Then what to do?

My Magician works looks fine, radio is well because I can phone, all other functions looks well, the network is GSM.
[JAM, MDA Compact, S100 Software Upgrading] coly:
Really? Let's try to find it.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey rtask a works...i would suggest to try and craft an image for the SD Card with a bootloader + Radio...but right now i don't have the time to check it. if it doesn't work, then we would need a developement platform where we could boot an external bootloader and an external rom...with that in hand we would (will?) be able to reprogram the phone...entirely...i think that WINCE (?) is one...not shure.(?)

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
I try to find something about Magician programing. Thank you all very much.
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Let me get things toogether and put some accents.

Something happened to Magician bootloader. I see many complaints about same problem.

Device can't be flashed in any way (software or SD card image)

I'm not shure that getting Securitypass will help.

Task 32 - stucks bootloader

Inserting SD card in slot causes Magician to behave strange.

IMHO only JTAG can help.

I'm giving up and sending my Magician to repair lab.

If price will be too high at least I'll get their conclusion / diagnostics that may help You.

P.S.

Coly , what ROM do You have on Your Magician and what previos ROM was ?
[JAM, MDA Compact, S100 Software Upgrading] coly:
nedam, my Magician now is:

ROM version: 2.03TX WWE

Radio version: 1.12.00

Protocal version: 1337.42

the previous Rom is the BigStorage Rom. I forgot the version information.

Best regards,

coly
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Coly

I had 2.01TX WWE or 2.02TX WWE I cant remember.

I'm sure that problem caused by 2.0xTX WWE ROM.

I tried to contact the author of this ROM's but never get reply.
[JAM, MDA Compact, S100 Software Upgrading] coly:
Maybe or not, I'm not sure. Good luck for everyone.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
neadm, prepare yourself to pay has much as for a used (2nd hand) one...i would say around 150€ (£100 or so)... See if it worths it before sending it.

I've only tried once the taxist ROM and i've ran into tons of problems...honestely i've felt that something isn't/wasn't right with that ROM so i removed it 1h later after installing it...hehe

Regarding the hosing - yeah - there's a few people that had their phones hosed and unfortunately, the only ones that have been able to repair it, where the ones where a modified IPL/SPL exists, which allowed them to access everything on their bootloader.

Since it seems to me that there's no modified IPL/SPL(*) for the magician and that there isn't anyone working on one, this issue will take a little bit time to solve...impossible? no...time consuming? yes...

* (im not shure what an SPL is...does the magician has one? idk - Help would be appreciated on this matter)

Anyway, i'll continue discovering how magicians work, so, i'll keep investigating it...and posting any new discoveries...

I really would like that someone more knowledgable would post some ideias, concepts, help, but it seems that noone one cares anymore about our little magician :-(

yeah..it's sort of old and limited but its really pretty, at least for me! :-)

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Hi Keeper, some Chinese guys have already disassembled the Magician ROM using a tool named "RomEditor", the url(Chinese): http://bbs.pdafans.com/thread-424998-1-1.html

I am not sure whether you know Chinese, I will try to disassemble the ROM. Ah, it's time to go to bed, I will do it later.

Best regards,

coly
[JAM, MDA Compact, S100 Software Upgrading] coly:
I split the nk boot file(http://rapidshare.com/files/57253168/nk.boot.html), but it's for ROM not bootloader, sigh, what should I do? go to bed now.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Hmmm interesting...

IPL and SPL

The Bootloader references two programs, the IPL (The Sausalito Bootloader) and the SPL (The Palm Loader). The IPL is the Initial Program Loader, the part of the bootloader that resides on the phones internal memory. It is what allows the bootloader to function on the phone, and establish an interface protocol with a pc. The IPL loads the SPL, the Secondary Program Loader, in the case of the Treo 650 it is the palm OS 5.4 Loader.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Keeper,

IPL and SPL exists in newest models of HTC devices.

Magician has only one bootloader.

More than that Magician has more common with HTC Himalayas.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Oh, thank you for the info, nedam... :-) i was a little confused about that subject...btw, although magicians and himalayas do have quite a few similarities, they have a different way of storing the bootloader + OS + radio...it has something to do with DOC (Disk-On-Chip)...(i haven't read it in detail).

Anyway...this thread is really interesting...

http://xdaforums.com/showthread.php?t=300096

The Microsoft test platform seems to be quite similar to the Wind River test platforms which allow us to interface with a device (aka target), and completely reprogram that target / test new OS builds / diagnose the hardware...

The problem is the BSPs (Board support package - aka drivers to the target CPU) - they are really hard to get since usually they are only given to manufacturers of the devices...i would think that the Microsoft platform also requires something similar...

Regarding KITL: KITL is something that is part of the bootloader (check this link: http://msdn2.microsoft.com/en-us/library/ms901824.aspx )...i do recall seeing a few options related to it on a friend's himalaya phone when it was set in bootloader mode, but i don't know if the magician bootloader has a KITL mode...if it doesn't, we would have to get a USB to Serial Converter so to connect to the platform...i think that we can't use the USB connection for this, since it doesn't do debugging...)

Regarding the test platforms: We need to get this: "Windows CE .NET 4.2 Evaluation Kit" - that's the platform that was used for building(?)/testing WM2003SE. Do notice that the "Windows CE 5.0 Evaluation Kit" might work but i'm not shure.

UPDATE: microsoft seems to be releasing the BSPs packages publicly which means we can interface with the magician CPU easily, IF we can get the eval platform kit :-)

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Keeper thanks for the info.

I'm not skilled enough to deal with Microsoft test platform, and don't want to by any special hardware to repair single device.

I'll stick with repair service option, i hope they have tools to repair my Magician for good price.

I'll keep You updated.

Thanks again
[JAM, MDA Compact, S100 Software Upgrading] coly:
It seems to be a long way to go.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Coly, if your interested, i can continue researching a little bit so to help you out...

Try this:

- remove your SD card from your phone OR at least, format it.

- follow the steps inside the attached zip.

- once you get the HTCPass1, see if the s2d command works.

(The s2d command is supposed to read an SD card image so to restore a phone...)

If the command works, then you should try and cook an image for the SD, using NTRW to write to the SD.

tell me how it goes.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Coly, as I said before, You can try :

Passowrd BOOTLOADER

then again

password 0000000000000000

and You will get HTCPass1 prompt, then You can try s2d command

In my case it (s2d command) not worked.

Keeper, thank You again for willing to help,

may be we should contact Pof, may be he can write something similar to Trinity xploit ...