[Upgrading, Modifying and Unlocking] caoxt:
Recent clue, Similarly passes on 6915

Recent clue, Similarly passes on 6915

Specially orders reads to flash RADIO has the help:

password

set

erase

task

lw

rtask

The HP IPAQ 6515 uses the boot loader2 password to unlock the full help menu in the serial console interface. It does not allow access to more commands than before and simply shows help for more commands.

If you are interested in viewing the commands there are a couple of passwords that would unlock it depending on your exact 6515 model.

•	BOOTLOADER

•	BEETLES

•	0000000000000000 - (16 x 0s) password for level 1 which unlocks additional RUU functions

Personally, both BOOTLOADER and 0000000000000000 worked fine for me on a HP IPAQ 6515e and you can enter level 1 directly with 0000000000000000

USB>password BOOTLOADER

HTCSPass.<Y-HTCEUSB>password 0000000000000000

HTCSPass1.CM^EHTCEUSB>

If you typed the wrong password, you will get

USB>password 0000000000000000

HTCSInvalid password

Similarly passes on 6915 !

This is a use MTTY Connection of me exploring the IPAQ 6515e’s bootloader firmware

USB>? full

Available monitor commands are:

? [command] [full]

h [command] [full]

r [[register] [[=] [hex_value]]]

eb Addr

eh Addr

ew Addr

mb [StartAddr [Count [Filler]]]

mh [StartAddr [Count [Filler]]]

mw [StartAddr [Count [Filler]]]

string [Type [String]]

info [Type [Value]]

password [string]

l [path_name [startAddr offset ["cp"]]]

lnb nb-file [StartAddr [Length [SkipOffset ["cp"]]]]

ppdl [startAddr offset["cp"]]

s StartAddr Count Pattern...

map

cp reg# OPC_2 CRm [value]

stress [Type [Count(Hex)]]

d2s [StartAddr [Len [Type [Append[SkipStartAddr SkipLen]]]]]

s2d

set [Type [Value]]

task [Type [Value [Value1]]]

shmsg [Row [Col ["String"]]]

rbmc [FileName [StartAddr [Len]]]

erase [StartAddr [Len]]

wdata [StartAddr [Len]]

checksum [StartAddr [Len]]

prouter [PortID1[Baud1[PortID2[Baud2]]]]

lw [path_name [startAddr offset ["cp"]]]

rtask [Type [Value]]

rroute [UART Path1[Baud Rate1[UART Path2[Baud Rate2]]]]

USB>? set

Usage:

set [Type [Value]]

Set control flags.

Type(hex) : Control function types.

Value(hex) : Setting values for types.

If value is not given, default is 0.

Type 0(Echo on/off): 1(on) and 0(off).

Type 1(Operation mode): 1(auto) and 0(user).

Type 2(Back color on/off): 1(on) and 0(off).

Type 3(Inverse on/off): 1(on) and 0(off).

Type 4(Front color value): 16 bits data

Type 5(Background color value): 16 bits data

Type 6(Set color of screen): Fill color to whole screen one time.

Type 8(COMM queue flag): 0(TX_RX disable),1(RX enable),2(TX enable) and 3(TX_RX enable).

Type 1E(RUU command read/write flag): 1(unlock) and 0(lock).

Current flag settings:

Type 0(Echo flag): cEchoFlag=(0x1).

Type 1(Operation mode flag): cOpModeFlag=(0x0).

Type 2(Back color flag): cBackColorShowFlag=(0x1).

Type 3(Inverse flag): cShowInverseFlag=(0x0).

Type 4(Front color): g_wFColor=(0x0).

Type 5(Background color): g_wBColor=(0xFFFF).

Type 6(Set color of screen): None.

Type 8(COMM queue flag): g_cCommQueueFlag=(0x0).

Type 1E(RUU command read/write flag): g_cRUUCommandRWFlag=(0x0).

USB>? info

Usage:

info [Type [Value]]

Type(hex) 0: Get platform name(16 bytes) and [value](hex) is ignore.

Type(hex) 1: Get bootloader version(16 bytes) and [value](hex) is ignore.

Type(hex) 2: Get device CID(8 bytes CID with 8 bytes dummy data(0x20)) and [value](hex) is ignore.

USB>info 4

HTCS L?3?HTCE

USB>info 5

USB>info 0

BEETLES

USB>info 1

0.21

USB>info 2

USB>info 8

USB>? rtask

Usage:

rtask [Type [Value]]

Type(hex) 0: Reset radio and [value](hex) is ignore.

Type(hex) 1: Turn on radio, lease use type 3 and 4 instead.

Type(hex) 2: Turn off radio and [value](hex) is ignore.

Type(hex) 3: Run radio image and [value](hex) is ignore.

Type(hex) 4: Run radio bootloader and [value](hex) is ignore.

Type(hex) 7: Radio AT Command Debug.

Type(hex) 8: GSM trace route.

Type(hex) 9: Run radio external bootloader and [value](hex) is ignore.

Type(hex) A: Radio image flash by external bootloader and [value](hex) is ignore.

Type(hex) C: Select debug path.

Type(hex) D: Radio AT Command with GSM trace route.

Type(hex) 10: Set radio external boot UART mode(fast(1)/normal(0)).

USB>? task

Usage:

task [Type [Value [Value1]]]

Type,Value and Value1 are both DWORD(hex).

Value and Value1 are ignore in some case.

Type(hex) 0: Do hardware clear boot with delay time and [value](hex) is a delay time(unit is ms).

Type(hex) 7: Do flash ROM lock/unlock and [value]: 1(lock) and 0(unlock).

Type(hex) 8: Software reset with delay time and [value](hex) is a delay time(unit is ms).

Type(hex) 3C: Set terminal COM port baud rate.

Type(hex) 46: Force BT enter test mode.

USB>? lnbs

Usage:

lnbs nb-file [StartAddr [Length [SkipOffset ["cp"]]]]

Download nb file to ROM.

StartAddr : Start address for downloading(default=80000000).

Length : Length for downloading(default=FFFFFFFF).

SkipOffset : SkipOffset for downloading(default=00040000).

cp : Compare image with file data only.

USB>? d2s

Usage:

d2s [StartAddr [Len [Type [Append[SkipStartAddr SkipLen]]]]]

Backup memory to storage.

StartAddr : Start address for backup(0xA0040000).

Len : Length of memory will be backup. And if not given value, it will be

Total ROM size on board - ((StartAddress & 0x0FFFFFFF) - (ROM base address(0) & 0x0FFFFFFF)).

Type : Which storage(cf/sd) type will be selected(cf).

Append : Backup methods(a/).

SkipStartAddr : Start address of skip area(0x0).

SkipLen : Skip length(0x0).

Skip area must be less than or equal to one block size of flash.

Skip area must not over two blocks, must inside one block.

Nand flash: Skip area size need be page boundary.

Nor flash: Skip area size need be DWORD boundary.

DOC flash: Skip area size need equal to MBLOCKLEN(32kB).

USB>? s2d

Usage:

s2d

Restore memory from storage.

USB>? lw

The same as "l" command, but download to radio flash memory.

Usage:

lw [path_name [startAddr offset ["cp"]]]

Download BIN file across from serial/USB port.

Startaddr offset(MSB bit is a sign bit): Start address offset of every packet in bin file.

When 'cp' is given, it will just compare data of file with ROM image.

When path_name is not given, the file to be downloaded is determined

by ppfs on the host.

Otherwise, path_name on the host is downloaded regardless the ppfs setting.

The file must be in the format of BIN (preprocessed SRE).

USB>? password

Usage:

password [string]

Enter the password string to enable full help and command functions.

Enter the password string1 to enable some command functions related to RUU.

USB>rtask 8

GSM Trace Route.

Wait 2413 ms

USB>rtask 1

Please use type 3 and 4 instead.

USB>? task 32

Syntax error!

Usage:

? [command] [full]

Helps on command.

When no command is given, output a list of normal commands.

If "full" option used, display all commands(need password enable).

But if one command is given, It will show the command usage method.

USB>? erase

Usage:

erase [StartAddr [Len]]

Erase the contain of flash ROM.

StartAddr : Start address of ROM(default(hex)=A0040000).

Len : How many bytes will be erased(default(hex)=40000).

USB>rtask a

Radio image flash by external bootloader.

HTCS??6ú??HTCE

The IPAQ froze and I had to reboot the IPAQ before I could reconnect.

USB>password 0000000000000000

HTCSPass1.CM??HTCEUSB>? rtask

Usage:

rtask [Type [Value]]

Type(hex) 0: Reset radio and [value](hex) is ignore.

Type(hex) 1: Turn on radio, lease use type 3 and 4 instead.

Type(hex) 2: Turn off radio and [value](hex) is ignore.

Type(hex) 3: Run radio image and [value](hex) is ignore.

Type(hex) 4: Run radio bootloader and [value](hex) is ignore.

Type(hex) 7: Radio AT Command Debug.

Type(hex) 8: GSM trace route.

Type(hex) 9: Run radio external bootloader and [value](hex) is ignore.

Type(hex) A: Radio image flash by external bootloader and [value](hex) is ignore.

Type(hex) C: Select debug path.

Type(hex) D: Radio AT Command with GSM trace route.

Type(hex) 10: Set radio external boot UART mode(fast(1)/normal(0)).

USB>rtask a

Radio image flash by external bootloader.

2.12.00484830000EF23CB887AC20E08199E335&HTCE

Links

•	HOWTO: Change serial number and model number for HP IPAQ 6515

•	HP IPAQ 6515 Bootloader password

•	HP IPAQ 6510 / 6515 dead GSM after failed Firmware upgrade

http://blogs.unbolt.net/index.php/brinley/2007/07/09/howto_change_serial_number_and_model_num_6515

http://blogs.unbolt.net/index.php/brinley/2007/08/12/hp_ipaq_6515_bootloader_password

http://blogs.unbolt.net/index.php/brinley/2007/07/31/ipaq_6515_dead_gsm_after_failed_firmware