yashsingh1/xdaforums huggingface dataset:
[JAM, MDA Compact, S100 Software Upgrading] coly:
Thank you Keeper.

This method not worked. It didn't run to the breakpoint in WinDbg, the last sentences in windbg were:

(da0.d74): Break instruction exception - code 80000003 (first chance)

eax=7ffd7000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005

eip=7c921230 esp=00acffcc ebp=00acfff4 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\windows\system32\ntdll.dll -

ntdll!DbgBreakPoint:

7c921230 cc int 3

0:001> bp 0x100070FB

*** WARNING: Unable to verify checksum for D:\ROM\3.02\818\RUU.dll

*** ERROR: Symbol file could not be found. Defaulted to export symbols for D:\ROM\3.02\818\RUU.dll -

0:001> g

ModLoad: 76fa0000 7701f000 C:\windows\system32\CLBCATQ.DLL

ModLoad: 77020000 770ba000 C:\windows\system32\COMRes.dll

ModLoad: 770f0000 7717b000 C:\windows\system32\OLEAUT32.dll

ModLoad: 25000000 25033000 C:\Program Files\Microsoft ActiveSync\rapistub.dll

ModLoad: 5fdd0000 5fe24000 C:\windows\system32\netapi32.dll

ModLoad: 20000000 20549000 C:\windows\system32\xpsp2res.dll

ModLoad: 7c9c0000 7cc7e000 C:\windows\system32\msi.dll

ModLoad: 26000000 26008000 C:\Program Files\Microsoft ActiveSync\rapiproxystub.dll

ModLoad: 76d70000 76d92000 C:\windows\system32\appHelp.dll

ModLoad: 7e550000 7e6bf000 C:\windows\system32\shdocvw.dll

ModLoad: 765e0000 76672000 C:\windows\system32\CRYPT32.dll

ModLoad: 76db0000 76dc2000 C:\windows\system32\MSASN1.dll

ModLoad: 75430000 754a1000 C:\windows\system32\CRYPTUI.dll

ModLoad: 76c00000 76c2e000 C:\windows\system32\WINTRUST.dll

ModLoad: 76c60000 76c88000 C:\windows\system32\IMAGEHLP.dll

ModLoad: 76680000 76722000 C:\windows\system32\WININET.dll

ModLoad: 76f30000 76f5c000 C:\windows\system32\WLDAP32.dll

ModLoad: 74d90000 74dfc000 C:\windows\system32\RichEd20.dll

ModLoad: 76060000 761b6000 C:\windows\system32\SETUPAPI.dll

ModLoad: 75c60000 75cfe000 C:\windows\system32\urlmon.dll

Then the Magician stuck.
[JAM, MDA Compact, S100 Software Upgrading] coly:
It not worked. It always showed "Invalid command ".

and "d2s" may cause a stuck.

log:

USB>password BOOTLOADER

HTCSPass.< YHTCEUSB>s2d

Invalid command : s2d

For a help screen, use command ? or h

USB>password 000000000000000

HTCSInvalid password.R克PHTCEUSB>s2d

Invalid command : s2d

For a help screen, use command ? or h

USB>password BOOTLOADER

HTCSPass.< YHTCEUSB>password 0000000000000000

HTCSPass1.CM埶HTCEUSB>s2d

Invalid command : s2d

For a help screen, use command ? or h
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Coly, the l command should help, but for this we need 3rd password, that we don't have :(

If You have Your OS working, try to search for "itsme tools" - may help.
[JAM, MDA Compact, S100 Software Upgrading] coly:
Hi nedam, I tried command "pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb", but not worked.

C:\>pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb

CopyTFFSToFile(0x0, 0x10000, original-bdk1.nb)

ERROR: ITReadDisk: outbuf==NULL

the size of file "original-bdk1.nb" is 0B.

After I removed the SD card,

>pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb

ERROR: ITGetStoreMgrList

ERROR: GetDefaultDiskName: ITGetStoreMgrList

WARNING could not find default device
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
nadam the password 0000000000000000 doesn't work (at least on mine it doesn't)...

Also, from what i've read, the bootloader has a dynamic algorithm which works like this:

- The RUU upgrade utility sends a "info 3" command to the bootloader...

- The bootloader returns a hash string to the RUU upgrade utility...

- That hash string is then passed to a cryptographic algorithm (you can check it here: http://xdaforums.com/showthread.php?p=1005969 ), which is inside the RUU.dll...

- Then, the upgrade RUU, returns to the bootloader the corresponding key to that hash.

- If valid the bootloader drops "HTCPass1" if not, then RUU upgrade gets: "wrong password".

Since the bootloader uses a dynamic algorithm (for the HTCPass1), i don't see how you can use a static password like that...(!)

Anyway...coly, are you shure that you're inserting the correct break instruction? are you selecting the 2nd "lea instruction" ? (my 2nd lea instruction address was on "0x1000706B"...)

Check if you have done the procedure correctly...

(This procedure is better then using the USB Monitor, because with USB Monitor, you only sniff the traffic - you don't set a breakpoint on the RUU Utility upgrade, which means that the RUU utility WILL upgrade your phone.)

Keeper
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
uh....it seems that you guys have the password 0000000000000000 working...wierd...on my magician, it doesn't work...what's your phone brand? O2? Qtek? dopod? other?

Regarding the "l" command and others: you can check what previlege level you have with USB> task 32

If you get (at the end of the text) an FF, it means: "no privileges", but if you get 00, then you have full previleges...

from what i've read it seems that to get full privileges, you require to have your phone CID Unlocked...and it seems that noone has been able to CID unlock the magician...The CID lock is what differenciates one brand from another (A Qtek from a O2 phone, has an example)...I would think that the CID lock refers to and/or is associated to the Securitypass... If we could find out how the CID unlock was done on other phones, we might be able to try and duplicate the technique used to our magicians...

We are missing the bootloader commands...maybe we just need to use a command so to set the phone in DBG mode and be able to use the "l", "s2d", etc, commands..

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Hi Keeper, I did the procedure correctly, but it not worked.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Okey..i've got one crazy ideia...hehehe

Have you guys tried to completely discharge your phones? (i mean, not just discharge the battery but also the internal battery...) If not, try it and after being completely discharged, plug in the battery + USB, remove any SD disks, and try to run a FULL upgrade (RADIO + ROM + EXTROM).

I've read somewhere that this technique worked for a few people - it forced their phones to loose all configurations that were stored in the phone memory - which is what you guys have - a trapped bootloader and/or GSM bootloader.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
A crazy idea, I will try it.
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Tried - didn't help :(
[JAM, MDA Compact, S100 Software Upgrading] coly:
:mad: My battery still has power... I am still waiting...

if it not worked, need I try again?
[JAM, MDA Compact, S100 Software Upgrading] nedam:
Yes I did it before, unfortunately didn't help.

You can try - good luck !
[JAM, MDA Compact, S100 Software Upgrading] coly:
It cannot repair the bootloader, I think.:(
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
check this thread...

http://xdaforums.com/showthread.php?t=304408

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
It not worked.

After I typed "task 8" the Magician soft reset. But I still cannot reflash it.

If I only input "set 14 0", then closed mtty, then flashed the magician, it still got "get device data error".
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
okey...your bootloader is completely f* up, so, the only way i can think about on how to solve your problem is by messing with the phone's hardware...:

(Now, this is really hard and dangerous...so, if you're not willing to do it, there's no point on going any further...)

I can only think of three ways so to solve your problem:

1st one: http://wiki.xda-developers.com/index.php?pagename=WallabyJTAG

IF you're willing to do it, then we should start looking on the internet for the cpu pinout (it's a PXA10 if im not mistaken), because we will need to trace the tracks so to figure out the JTAG test points and also to create a BSDL file. (check here for more info about what is this BSDL file: http://www.interfacebus.com/Design_Connector_JTAG_Bus.html )... you will also need to build a JTAG parallel cable (there's quite a few schematics on the internet for jtag cables + software for them...all free source). Finally, we will nee to learn on how to create an image so to reprogram the flash... (btw: this solution will allow you to be able to use the microsoft developement platform and test bootloaders from other mobiles, roms, whatever you want ;) )This solution is really cheap...maybe 10 ~ 20€ for the cable parts.

2nd one: desoldering/soldering the intel flash by using the method posted on the above link for the wallaby, so to reprogram the flash using a pic programmer.

( honestly, knowing the costs of a cheap pic programmer [around 200€...] i don't think that this solution is interesting, unless you want a pic for other tasks... )

3rd and last one: repair it on a repair shop. (100€ ~ 200€ repair...) or donate it to xda / ebay it for spare parts.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
Bad news, I will send it to repair shop.
[JAM, MDA Compact, S100 Software Upgrading] coly:
:( They said I must change the font library chip...
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
I didn't got it...what do you mean ?

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
The system fonts were burned in a chip, and the system couldn't start-up and we couldn't flash it if these fonts were corrupt. They can replace the chip to a good one, but it was too dear.

The bootloader maybe in this chip, too.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
okey i (sort of) got it although...

A small explanation: System fonts refers to the operating system text fonts, which ain't in any way related to what you're saying...what they probably meant was that there is a few/some corrupted (overwrited) memory addresses due to a bad flashing which caused your bootloader to not work properly and now they need to desolder the intel flash and install a new one which has been previously reprogramed with a pic programmer.

Regarding your bootloader doubt: the Intel flash (ROM) is where everything is...: bootloader + OS image + radio bootloader(*) + everything... (imagine the intel flash has an Hard Disk Drive if you will). So, yeah, of course the bootloader is inside the flash...

Best Regards,

Keeper

(*) I'm not shure if the radio part is in a separate flash like a on a few phones - i.e.: Iphone - or if it's all on the same flash...
[JAM, MDA Compact, S100 Software Upgrading] coly:
I got this info:

80000000-80040000 0040000 BootLoader

80040000-82400000 23C0000 osROM

82400000-82c00000 0800000 backup area ( contacts, calendar, etc )

82c00000-83f00000 1300000 extended rom

83f00000-83f80000 0080000 unused

83f80000-83fc0000 0040000 bootsplash image

83fc0000-84000000 0040000 device version + type information

But I didn't know how to check and repair it.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Those values are the memory locations where each part is located inside the flash memory...you can't reprogram each part separately since your bootloader is damaged...(hell, not even the "SD emergency image" works on your cellphone...). Anyway, in case you still don't get it: the bootloader is like a PC BIOS: if it is demaged, your motherboard won't work properly, and to repair your "BIOS", you need to reflash it with a external tool...(PIC Programmer)

Once again, your only and best option (since it seems to me that you're not willing to try any hardware related task), is to go to a repair shop and let them repair it.
[JAM, MDA Compact, S100 Software Upgrading] coly:
I would like to try any hardware related task, but one matter is I couldn't find any software used to repair bootloader via JTAG.

I didn't see any info about Magician + JTAG.
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Coly, okey...if you're willing i'll guide you through...but not tonight...i'm really tired...

Anyway, 1st step is to find the CPU pinout which means that we need to google a little bit for the cpu datasheet (.pdf with every info about it)...the CPU model is an Intel XScale PXA272 416 Mhz (it's exact reference is: pxa272fc0416)...

There's tons of chinese websites refering it and their datasheet, but i don't know chinese...so your help will would be appreciated :)

talk to you tomorrow.

Regards,

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
I only got PXA272 datasheet, no PXA272FC0416 datasheet.

PXA272 datasheet:

http://rapidshare.com/files/58758329/datasheet.pdf.html
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Coly that doesn't do...that only shows the pins for interconnecting a cypress flash memory to the cpu...

we must find the entire pinout of the cpu...start looking in here: ftp://download.intel.com/

there's an old link ( http://www.intel.com/design/pca/prodbref/253820docs.htm ) that had the entire cpu layout but it doesn't work anymore...

Keeper
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
i've found this which is for our cpu and even includes the cable schematics and a link to a intel jtag software!!! -> http://kelp.or.kr/korweblog/upload/19/20060213114810/u-bootportingtoPXA270_v0_9.pdf

unfortunately i don't speak korean...we must translate this doc.!!! (you don't know korean, do you? :) )

Anyway, i've found the CPU white paper that we will need. -> http://sunsite.rediris.es/pub/mirror/intel/pca/applicationsprocessors/datashts/28000305.pdf.

One thing i've noticed: you can't heat up the cpu more then 125ºC or it will be damaged permanentely...so, if you are going to use that oven technique, please make sure that you don't go past this temperature...(oh well...let's leave this for the time being, we still have ALOT of work to do before reaching that subject...)

I'll start looking at this pdf tomorrow.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
I don't know korean, too.

Must I remove the CPU? It's a crazy idea.

I used to flash embeded linux bootloader whit JTAG (ARM9), but I removed nothing.

Someone do this: Fitting a JTAG interface to an iPAQ 3600.

http://openwince.sourceforge.net/jtag/iPAQ-3600/
[JAM, MDA Compact, S100 Software Upgrading] b0ris747:
To find JTAG pinouts, the ingredients are:

-A PDA to be cooked

-A oven

-A processor of the PDA documentation

Cook the PDA @ 230°, processor face down.

When the chips have felt from their support, you have a blank motherboard on which it is possible to follow the tracks to find accessible JTAG pinouts for the other users.

That's the way it is!
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
Hi Coly!

Okey i'll post my concept on how to do this and explain a few things along the way....

Step 1) Grab the CPU Datasheet so to identify the CPU Pinout in order to locate the following signal pins:

TRST (Test Rest )

TDI ( Test Data Input )

TDO ( Tet Data Output )

TMS ( Test Mode Select )

TCK ( Test Clock )

Step 2) Search for a software that supports this CPU Model + Flash ROM.

This is usually one of the most crucial parts...in our case it's even more critical since this CPU uses a stacked flash... (the cpu and flash are "glued" one to each other)...We must read almost all this PXA27x .pdf files ( http://rapidshare.com/files/59083313/PXA27x_Documentation.zip ), so to be sure that we understand what exactly we need in terms of software.

Step 3) Search for a JTAG cable schematic that is compatible with the software mentioned above.

We will need to check the schematic and gather the BOM (Bill Of Materials) so to make the cable later on.

Step 4) Remove the CPU so to trace the tracks.

...Since this CPU has a FSCSP (aka FSBGA) package type, we can't trace the pins directly without removing the CPU (they are below the cpu and not around it)...

Knowing that noone until now has figured out the JTAG test points for this model, we will need to remove it so to trace the tracks, starting from below the CPU connection pads, up to somewhere outside...

(Check the picture in attachment for an ideia of what i'm talking about.)

We will also need to find two additional pins (which are easy to find): VCC (input voltage) and GND (Ground), so to power up the JTAG cable. (this cpu uses a 1,8v if im not mistaken...more on that later on)

Step 5) Prepare everything

Make the cable (using the schematic found on Step 2)

Solder the CPU back to it's place

Solder thin wires on the board's jtag test points

Check and double check if everything is right

Test the cable + software by reading from the flash

Step 6) learn on how to create a raw flash (by studying the raw image that we've previously exported from the flash) so to reprogram the magician again.

Okey, so now we should start concentrating on Step 1 - learning which pins (motherboard pads) will correspond to the signals that we will need.

ttyl

Keeper
[JAM, MDA Compact, S100 Software Upgrading] Keeper:
B0ris747,

I don't think that your way will work...1st because the CPU can't handle more then 125ºC (it's on intel specs - you CAN'T heat the cpu with more then that temp or you will damage it - those temps refer to a NON-WORKING condition), 2nd because before the cpu falls down, other resistors + caps + sdram, etc will fall first since they have fewer soldered pins...and we don't want that ;) )

The ideia here is to melt a little bit the CPU solder points so to be able to easilly remove it with one (or two) clamps.

Keeper
[JAM, MDA Compact, S100 Software Upgrading] coly:
:mad: 230°... I don't want to kill her.
[JAM, MDA Compact, S100 Software Upgrading] b0ris747:
I know that point... But if you think you can unsolder a CPU and solder it back AT HOME, you might be a sort of guru with industrial machines... I'm not. If you tell him to remove its CPU and tell him he'll be able to put it back, I'll be very disappointed when the worth will come!

I'm just clear about that: "How did they do to find JTAG?"

Answer: "They cooked a dead device"

If he doesn't want to cook it for the community, he'll have to wait that someone does it for him!

Next topic is what? DIY PPC? With a dead calculator and bluetak to keep the parts together :)
[JAM, MDA Compact, S100 Software Upgrading] coly:
I give up.

It's a hard work to solder the cpu back, I cannot ensure the Magician working well after desoldering and soldering.
[JAM, MDA Compact, S100 Software Upgrading] Rhonald:
Keeper, please upload the SD card ROM image or please post the download link... thnx...
[JAM, MDA Compact, S100 Software Upgrading] Khalid Salih:
Hi all of you I have this problem

I stock at this image

I can received Calls but nothing else ,

I can explore my phone using Active Sync and with Pocket Controller Pro

But no start Menu

Please I need your help

ROM details:

R 1.12.10

G 13337.42

D 2.03 TX WWE

Keeper what can I do for this
[JAM, MDA Compact, S100 Software Upgrading] Rhonald:
We have the same problem bro... and after my battery drained I can charge no more!!! My magician now is useless..

Plz help us here people!!!!!
[JAM, MDA Compact, S100 Software Upgrading] nedam:
The solution for problem is replacing mother board = buy second hand Magician
[JAM, MDA Compact, S100 Software Upgrading] Rhonald:
WHAAAAAAAAAAAAAAATTTTTT!!!!!

Is there any other cheaper option???
[JAM, MDA Compact, S100 Software Upgrading] spyridakosr:
hy

i have a magician t-mobile and i wanted to update the mda. at 60% radio flashing the process ended with an error. now i can flash the other 2 parts, but not the radio.Also when it`s boot up say NO GSM.

What can i do?

I have a friend that have jafwm and i try to fla**** with that one , but still no flash.

thanks.
[JAM, MDA Compact, S100 Software Upgrading] excogitation:
The result: result
[JAM, MDA Compact, S100 Software Upgrading] kenji101:
hi, i have the same problem as him before.

i downloaded original ROM from imate.com,

connected my imate jam to pc; uncheckedc allow to connect from usb.

then run the exe.

my problem now it, every time i do soft reset, or remove the battery,

it reinstalls the WCE again, so the files and programs i have got removed...

any solution
[Moto 360 2015] Zammo76:
Mobilefun has the Moto 360 2 Sport listed as being quite a bit cheaper than the Standard 360 2, Standard model is £269, Sport is £219 . I find this a little bit surprising as the Sport comes with a GPS chip in it, so I'm wondering if the specs will be scaled down in some other way, or if its just the actual watch strap, which is a lot cheaper?

Sport:

http://www.mobilefun.co.uk/motorola-moto-360-sport-2nd-gen-smartwatch-black-p54780.htm

Standard:

http://www.mobilefun.co.uk/motorola-moto-360-l-2nd-gen-smartwatch-cognac-leather-p54778.htm
[Moto 360 2015] kodiak799:
Moto has said relatively little about the Sport, much less when it will be available and pricing.
[Moto 360 2015] ksekhar:
It sucks that there is no GPS on classic one. Dont like the sport looks but need GPS :(
[Moto 360 2015] Martinjv71:
That GPS will kill battery life I bet though.
[Moto 360 2015] bossman137:
i've used the sony smartwatch 3, and its just like the gps hardware in the android phones. By that I mean when GPS funcionality is called upon (which for the watch would be during a run or bike ride) then it comes on, otherwise its doesn't effect a thing. And when I was using it for biking, i didn't find it was that bad.

thanks for the heads up OP, the sport appears to be skipping out on the outer metal casing and leather band in place for an injected molded rubber/silicon band, so i could see it being a decent price break IMO.
[Moto 360 2015] gadgetrants:
Call it "guilt by association" but I couldn't find the following blurb (from mobilefun's description) anywhere on Moto's site:

But what left me shaking my head "no" was the really odd use of the word "consciously" and the misspelled "your". Taken together, I call "fake." I'd trust that preorder price about as far as I can throw it.

In the meantime, I owned the MS Band for about 8 months, and generally found that I could run GPS on it for 4ish hours before it died. Not saying the Moto Sport uses the same module -- just noting that for the Band, you could do a decent run, hike, or bike ride with GPS on and still have power left.

-Matt
[Moto 360 2015] anthonyvardiz:
Hoping Moto will release some information about the sport model soon. I actually like the feel of silicon rubber and the GPS makes it the top choice atm.
[Moto 360 2015] gadgetrants:
I have a (non-GPS) Garmin that looks very similar, both size-wise and in the band design. I'd definitely make it my daily timepiece! Though...from reading up on the 1st gen 360 it's starting to sound like it would need a nightly charge. As a Microsoft Band owner, I was hoping the new 360 would do sleep-tracking but that's looking somewhat unlikely.

-Matt
[Moto 360 2015] Martinjv71:
There is a sleep tracking app for all android wear search the market man.
[Moto 360 2015] gadgetrants:
Yep...right after my post I started to do a bit of research. Looks like the most popular app (Sleep as Android) is good but has mixed reviews. I guess I misspoke -- I wasn't thinking of third-party apps, but instead that the 360 was specifically designed for sleep tracking. In particular, the Band (and I guess, other activity trackers) have a number of optimizations to allow the device to continue running through the night without killing the battery while gathering data...HR, motion, body temp, etc. I'd imagine that third-party efforts would normally be a lot tougher on the battery, and perhaps not have the same level of access to the hardware.

-Matt
[Moto 360 2015] gadgetrants:
Looks like the listing in the OP

http://www.mobilefun.co.uk/motorola-moto-360-sport-2nd-gen-smartwatch-black-p54780.htm

Has been updated from "preorder" to "register interest." Preorder price has been wiped as well. Hopefully we'll have some real data on price/availability in the next several weeks!

-Matt
[Moto 360 2015] gadgetrants:
OK, some good news (I think). The black 360 Sport has shown up for preorder on Amazon-Italy for 299 EUR, which is a perfect match to the 219 GPB the OP mentioned. Seems legit. Shipping date unknown.

http://www.amazon.it/Motorola-Moto-Sport-Smartwatch-Generation/dp/B015FON5Y8

-Matt