[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi,

it's done!!!

Today i discovered the JTAG pins of HTC hermes.

My device got bricked and was not able to boot anymore. Not even the bootlader came up.

Anyway i decided to do some investigation, there was nothing to loose :D

Thanks to Lt.Cmdr.Ivan who discovered the JTAG pins on the universal hardware.

(It made the step successful!!!)

See the attachment!

(had to make a zip because high-resolution pix :rolleyes: )

These are the testpoints to access Hermes main system Samsung MPU and recover OS bootloader!

To get access to the GSM chipset please have a look in the second post!

You may use this package to access the platform.

http://210.118.57.197/Products/Semi...or/ARM9Series/SC32442/JtagFlash_Prog_Code.zip

EDIT: If the link is not working, see attachment (backup package form samsung site, source code included)

See the documentation in the archive for information how to build a LPT adaptor, to use this software!

EDIT: The software tool has been modified to handle the /WP issue.

See attachment MSP_HERM.zip!

What ever happens to IPL/SPL on your device, it can be recovered quite easily now, using the JTAG method!

EDIT: Added Olipro's 2.10 (Hard-SPL V7) for completeness.

This is a pure binary file, ready to flash via JTAG. Thanks again to olipro for this beautiful bunch of bits!!

EDIT: Due to the numerous questions of some users how to go through this, here's what has already been written down all over the thread.

Follow these steps:

1. Disassemble your device (link to the Hermes Service-Manual is in the wiki).

2. Locate the JTAG pins on PCB (download/extract htc_hermes_jtag.zip -> look at the picture)

3. Use a very small soldering iron and attach some wires to the testpoints (only experienced users should do this!)

4. Use one of the wiggler clones (LPT-adaptor) to built up a connection to the JTAG pins using LPT port of your host pc.

Please have a look in the software documentation for the schematics (JtagFlash_Prog_Code.zip -> Source files and doc included).

Whatever your adaptor would look like, follow the pin assignment, that is used in the schematic (e.g. LPT pin 2 -> TCK, LPT pin 3 -> TDI, LPT pin 4 -> TMS, LPT pin 11 -> TDO)

5. Partly assemble your device and insert fully charged battery. Check all connections and press and hold power button on hermes (min 2sec.).

Though the device won't start if your bootloader is bricked, this step is necessary to activate internal power supply.

To check if power is O.K. measure the VCC pad (VCC ~ 3.15V).

6. Use the modifed samsung software on your host (download/extract MSP_HERM.zip -> MSP_HERM.exe is a command line tool)

Please make sure that the processor is recognized. If not check all connections again!

7. Grab IPLSPL210_OLIPRO.zip, extract it and put the file the directory where flashing software is located.

8. Use flashing software (MSP_HERM.exe) and try to reflash your NAND.

type: MSP_HERM.exe /f:IPLSPL210_OLIPRO.bin

type: 1 to choose the flash type

NAND flash type on hermes is k9f1g08 and should be recognized

type: 0 K9f1g08 Program

Start page and block must be set to 0

9. Be patient and cross fingers while flash is programmed.

Alternatively you may grab some coffee or beer and relax!

10. Enjoy the rebirth of your device.

Credits:

A warm and healthy "Thank you!" goes out to pof, cmonex, cr2, the_dipe and the others who gave useful hints or helped testing.

Regards,

scholbert