yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
HTC Hermes GSM JTAG pins

Hi again,

after a lot of wicked things had been done with my device, i decided to lift another secret.

Anyway i spent some time to do some investigation and managed to trace the JTAG testpins of the GSM chipset on the hermes!

So it's done!

To be 100% secure, this has again to be verified with some software.

Work is in progress!

To solve the "noGSM" issue we need a bullet proof flash tool to rewrite the radio bootloader.

Hopefully we could get the necessary information to do so!

Maybe someday all these "no GSM" devices could be brought to life again...

at least if it's software related issue (e.g. broken Radio bootloader)!!!

See the attachment for the pin location!

(had to make a zip because high-resolution pix)

These are the testpoints to get access to the Qualcomm GSM chipset and possibly fix broken radio bootloader!

Information about missing signals

TRST_N = could not be found (seems to be N.C.)

RTCK = could not be found (will only be needed for special debugger)

Mode0 = N.C.

We need your help!

If anyone got information about the JTAG chain of MSM6275 (BSDL file) or similar info, please PM me!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] alkizmo:
I have used JTAG on my linksys router when I bricked it.

It's actually pretty easy to make a cable for JTAG and uploading a ROM.

Did you actually manage to revive your tytn?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Flash access

Hi,

it seems to work fine with the program from the samsung site.

I just flashed IPL & SPL to my device.

See the screenshot:D

scholbert
[8525, TyTN, MDA Vario II, JasJam General] sphynx88:
thanks for this ill look into this. im still trying to figure out which part messed up on my phone. no power anymore not even charge light. dead. hardware? i think i burnt a capacitor coz it died while charging/connected to usb. Also i just flashed a radio rom but it was successful... before it died out. is yours the same case that it did not even show life of accepting power? thanks.
[8525, TyTN, MDA Vario II, JasJam General] sphynx88:
i was looking at the schematics and i think i need a technician for that but if i can revive my dead phone using that since im going to try and find the messed up capacitor anyway, ill learn and research.
[8525, TyTN, MDA Vario II, JasJam General] pof:
Congratulations!! :D this is a great and useful finding :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Thanks

Hi again,

thank you for adding a link to this thread in the wiki!

Unfortunately my device still won't start :(

There maybe anything else broken.

Anyway, the JTAG thing worked very smart, programming is quite slow though.

O.K. but that's the bit banging (i just remember, once flashed an image to the skeyepad and it took nearly half a day using an LPT adaptor).

@sphynx88:

What schematic are you talking about???

Do you got a schematic for hermes???

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Pudl:
Scematic

Hello sphynx88,

do you have a scematic of Hermes? I'm an technican and I'm used to JTAG programming. So if you have the scematic and I can have a look at it, perhaps I can help you bringing your hermes up again.

Greetings Pudl
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
More info

Hi,

first i'll have to quote myself:

There are some problems with rewriting flash on my device.

After some more investigation, i found out that my device still got OLIPRO'S IPL (version 1.04) but SPL is not HARD-SPL anymore (version 2.10 "Hard-SPL")

SPL was rewritten to original bootlader (version 1.04).

I made some memory dumps using the JTAG tools and compared the output with the binary files.

IPL and SPL do not match, that's why my device is not booting anymore.

For some reason i am not able to rewrite IPL with the samsung programmer.

There are no errors, everythings seems nice, but IPL remains unchanged after programming. No idea why :confused:

Maybe there's something special on hermes hardware, that protects NAND to be rewritten per default.

O.K., now that i found out what's wrong with my device, i'll have a look in the programmers source code, to understand what's going on.

I'll keep you informed about my progress :rolleyes:

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
...after having a look around, i'm quite sure that my flash is kind of blocked.

This maybe caused by damaged hardware :(.

If anyone would try to flash some bits to his damaged hermes, please let me know.

This would clear up if the the software provided by Samsung may be used to flash the hermes hardware and fix broken bootloaders.

At least flash content can be read out via JTAG, that's proven :p.

scholbert
[8525, TyTN, MDA Vario II, JasJam General] bauner:
I have bricked my hermes too.

I will try to flash IPL and SPL with the JTAG programmer.

How can I build a bin file for the programmer from an official RUU_signed.nbh or from the extracted 00_IPL.nb and 01_SPL.nb?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi,

It's sad that your Hermes got bricked :( .

Maybe it will be the first device revived by JTAG flashing.

Here we go:

00_IPL.nb and 01_SPL.nb are already binaries.

Refer to the memory map in the wiki to know where the contents have to be placed.

So you might flash them seperately or build one file to flash (see attachment).

To make it easier have a look in this slightly modified table, it shows the block numbers of NAND flash ( :

------------------------------------------
0x50000000	Page0
Block0	IPL
0x5001ffff	Page63
------------------------------------------
0x50020000	Page0
Block1	SPL
0x5003ffff	Page63
------------------------------------------
0x50040000	Page0
Block2	SPL
0x5005ffff	Page63
------------------------------------------
0x50060000
...	not used
0x5009ffff
------------------------------------------
0x500a0000	Page0
Block5	CID, S/N
0x500bffff	Page63
------------------------------------------
0x500c0000	Page0
Block6	WLAN
0x500dffff	Page63
------------------------------------------
0x500e0000	Page0
Block7	MainSplash
0x500fffff	Page63
------------------------------------------
0x50100000	Page0
Block8	MainSplash
0x5011ffff	Page63
------------------------------------------
0x50120000
...

Good luck ;) !!!!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] bauner:
Thanks a lot for your help I flashed my IPL/SPL an now my hermes is working again
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hey :D

Congratulations!!!!

So everything went fine using the provided tools?

Did you use a wiggler (clone) for the job?

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] bauner:
yes everything worked fine with this tools.

I used this Interface:

Holly Gates' Schematics for the JTAG Dongle
[8525, TyTN, MDA Vario II, JasJam General] sphynx88:
Im sorry to have replied for so long but i gave up on my hermes and have not been checking. ill subscribe to this thread. After crazy searching and one site leading to another i did find what i think was schematics for the hermes. a service manual. it was in chinese and i couldnt understand it but i saw one for my samsung one which was in english and i think it really is the service manual with schematics. ill try and retrace my tracks. cross fingers.
[8525, TyTN, MDA Vario II, JasJam General] sphynx88:
anyway, in my case, the phone died. not bricked. something inside short circuited. it was on and charging via usb then the next thing when it reached 100 coz i was pretty sure it was 90 the time i started installing apps, it just died. no turning on, no nothing not even the rlod. i opened the case and i think there might be a fuse to the left of the charger entry, maybe changing it would simply fix the whole problem. i dont know but hopefully my cpu isnt broken so i may even have two phones.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
JTAG flashing proven, my device definitely broken

Hi,

same with my second device, sphynx88.

Something hardware related is damaged.

I may use the flash tool a 1000 times, the flash seems unaccessable for programming. Maybe the WP-pin stucks to GND on my device :(

Anyway it's nice to access the device via JTAG, also debuggers may be used :cool:

Have fun!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I know what's wrong

Hi again,

can't stop my investigation and like to bring my dead hermes to life!

I started to look around and i found the WP testpoint :)

So i made sure what i assumed, the WP pin of flash is tied to ground.

This prevents NAND flash to be rewritten -> write protection!

I made some further measurements and found out, that there must be a general purpose pin responsible for this function. Obviously this pin is set low during basic setup, maybe it's done in IPL (after reset all pins are tied low by internal resistors).

The only way to find out which pin is responsible for write protection, is to set some of the GP output pins to high level and and measure the voltage level at the testpoint (maybe it's GPC4 because it's very close to WP).

So this goes out to pof or olipro who already done a lot reverse engineering on this platform :D

Any idea which pin is used for NAND write protection on hermes????

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
@dolst:

Yeah try the heatgun :D

I discovered this during my investigation on a dead hermes!

But be aware that there's also some danger that your device never comes up again!!!!

@vojche:

Normally you won't need JTAG if you are still able to enter the bootscreen.

Check out other methods to recover first.

If you are used to handle with electronics, you may reflash your bootloader very simply with the JTAG method.

You may flash anything you like into hermes flash, because you got low level access.

But be careful you may also damage your device, doing such an operation :p

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] dolst:
My endeavors

Well, last night, I tried the heat gun. It didn't seem to make a difference. So that brings us to my epic JTAG pin saga. I said I'd post my progress here, so let us begin:

Day 1.

I procured a soldering iron with a small enough tip to actually tin the JTAG pin pads and keep them from shorting. I was quite proud of myself. So, I soldered the first wire. It seemed alright. Upon inspecting the connection, I managed to break the wire and take the pad with it.

Project has crashed on takeoff.

THE END.

I would be marginally satisfied using my poor little Hermes as a WM6 PDA, except for the delays in any kind of meaningful activity when trying to use it. I go to the comm manager and put it in airplane mode, and it still acts like it is trying desperately to contact the Qualcomm chip. So, until further notice, I have no Hermes.

I suppose I could just blast it with the heat gun repeatedly until either it works or completely dies. Anyway, thanks for your time everyone. I am now yet another proud owner of an HTC Brick. Surf Wisely.
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
is this possible to buy jtag pin in india? my hermes 100 is dead any one help me
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
my nand flash type is K505657ACA is this possible to flash this one?
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
here is the screen shot of my chip detecting logs do u have any latest programmer for this chip K5D5657ACA
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
if select 1 it said source file is not valid than it quit out from the programm any one pls help me to recover my mobile
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
hi scholbert now exe working fine but its not detect my nand chip here is the screen shot

pls scholbert help me to solve this one
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
now chip is detected but say program error here is the screen shot pls help
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
at last i succeed very very thank to MR SCHOLBERT am realy happy to see my mobile alive again once again thx here is the screen shot
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
............urrrg bad blocks!...but fixed?

Hi sundar83,

i'm sorry i'd been offline for some time.

You'll have to use the special flash tool modified for Hermes (see the first post!)

But i think you found that out and fixed it yourself. Seems like your device was affected by some bad blocks???

...it seems that JTAG programmer has rewritten these blocks succesfully and also updated sector information :confused:

I'm a bit confused about this, but the essential thing is that your mobile is back alive :D

Congratulations!!!

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] sundar83:
s sir am also bit confused abt the block error after recovered thru jtag i flashed wm6.5 os but am getting hanging trouble like so am decided to downgrade my os to wm 6 professional now working like charm once again thanks Mr.Scholbert
[8525, TyTN, MDA Vario II, JasJam General] dannyogolo:
Jtag Confusion

I realised this was the right place to post:

1. This phone is a T Mobile MDA (HERM300)

2. It came to me for unlocking.

3. I noticed some1 else had done some stuff

4. I tried using the usual "HTC_Hermes_SIM_CID_Unlock_v3a" , but it always failed.

5. I tot to flash the shipped ROM to get it back to original (assuming the 1st guy had messed up something.

6. I used "RUU_Hermes_TMO_UK_3.60.110.4_6275_1.50.00.00_108_ Ship" but the process stopped around 17% and phone was stuck on BOOTLOADER

7. I hit the Wiki and followed "Problem 4: Device is stuck in bootloader mode (tri-color screen)". I used the mtty.exe according to the instruction. I noticed 1 exception though: on the mtty i didnt get USB as was written, instead i got cmd> , but I proceeded. Then after the 1st command "Type set 14 0" the phone was now half dead: it will only blink white for a mili-second and goes off, BUT I could still put it into Bootloader by OK and ON buttons.

8. I tried flashing RUU, ROM or even unlocking again, all failed, it seemed the phone was dieing deeper, so I wiki'ed again got something that looked like my problem

9. I used the solution on wiki: "Phone bricked when writing to the Extended ROM" and "Bootloader 1.01MFG" . I also did not see USB as was written, but i got CMD>, but i proceeded and after just the 1st command "USB>task 32" - mine was cmd>task 32 , phone now is totally dead, not responding to anything: hand anc PC.

Now I thing i am left with the JTag option, and I have downloaded everything there, but im not an electronically iclined tech, so I cant understand the JTag Pix. I can totally solder the Herm part, but my issue now is this:

1. Am i left with only the JTag option ? If Yes,

2. Is the Jtag a straight wiring issue (That is from LPT Plug straight to phone PCB?) if yes,

3. Can some1 pls put the pix of the LPT side of the diagram showing: gnd, vcc, tdo, trst, tck, tms, tdi ? If im able to get this, I can disassemble an LPT and do the wiring.

4. If my Q2 is not so (That is its not a straight wiring issue), can some1 pls put an easier scheme than that on the samsung UserGuide.

Thanks a lot in advance
[8525, TyTN, MDA Vario II, JasJam General] zac_cosmin:
sall

:) kan you help my how and wat chain of components you put in pls sory for my english
[8525, TyTN, MDA Vario II, JasJam General] nicktgr15:
Hi.

Could something similar be done with HTC Advantage (X7500)?

Can i somehow find the jtag connectors to restore my bootloader?

Thanks!...
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

I'm quite sure that the X7500 offers JTAG interface at some of the testpoints.

The first you may do, is disassemble your device and investigate your mainboard.

If you find something like this:

http://xdaforums.com/showpost.php?p=2512981&postcount=12

...you are in luck!

This is known as the HTC debug port.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] dannyogolo:
How about my info ?

@ scholbert,

On another forum, some1 gave me simplified link how to build the JTag here http://www.diygadget.com/store/building-simple-jtag-cable/info_12.html .

My problem now seem to be the Tagging of the JTage Pinout.

After building the Jtag (which seems to be easier now with the link), there are gnd, vcc, tdo, trst, tck, tms, tdi to be soldered to PCB, but on the samsung manual, u have an 8 plug/sucket . Can some1 who knows or has a link pls decipher which of these wires should be used for gnd, vcc, tdo, trst, tck, tms, tdi ?????????????????????

Thanks again
[8525, TyTN, MDA Vario II, JasJam General] dannyogolo:
OK, all info gotten

O tok time to go thru this thread from page 1 to 20 and got all the info I need.

Tomorrow, we will do the soldering and proceed.

Stay tuned
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi dannyogolo!

Yeah that's very good idea!

I'm sorry but my time is abit limited right now to guide you through all the steps.

To make it short:

1. You may use this simple adaptor, but take care on the signals that are mapped in a special order on the LPT port. The mapping of signals must match the software tool.

Please have a look at the samsung schematic and use it as a reference (simply use the same mapping for your adaptor)!

2. Simple adaptors won't need VCC. Only GND, TDI, TDO, TMS and TCLK is needed!

3. See the picture of hermes mainboard in the first post.

You'll have to attach your adaptor straight to this testpoints (1:1)!

4. Use the MSPHERM.exe and IPLSPL... whatever, from the first post!

Make sure you got the giveio.sys driver installed on your host (search the web for details)!

Things should work out nicely if you follow these simple steps :D

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Pudl:
Your PM

Hello dannyogolo,

it seems that you have your solutution allready. If you still have any questions PM me again.

Greetings Pudl
[8525, TyTN, MDA Vario II, JasJam General] dannyogolo:
THE END

My Project has ended when it was about to begin.

After I had everything setup, and was about to connect the LPT Pin to my PC, the whole package fell off my hand and the TP Points peeled from the PCB, now I only have TRST, VCC, GND left on the PCB.

Do I still have a chance ?

If not, probably I will start searching for a PCB. Its a T-Mobile Vario-II (HERM300, but I believe HERM100 and 200 will also fit-in

Thanks to all
[8525, TyTN, MDA Vario II, JasJam General] patricchia:
Waiting the progress

:o :eek::o:rolleyes::p:D:

My computer just success to detected the processor by using Jtag method after go through many tests and cable checking.:) Now is running the step of 7 to reflash my NAND memory. But the progress running is so slow.. about 15min.. make me waiting like 2 hour.. :eek: ok success flashing the memory at 2.30pm 5/6/2009.

scholbert,Lt.Cmdr.Ivan,pof you all are genius!!!!

regards,

patric chia
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi patricchia,

thanks for appreciation and congratulations to sucessful flashing :D

Huuh, seems like a long time flashing ;)

Anyway it's good that you solved the issue.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] optyqus:
How precisly can I make a jtag cable? my hermes is dead... no bootloader, no light, no nothing... the screen only turns on in three colors in a sorta incomplete bootloader, and with no light. So I consider to try the jtag method, but the problem is that none of you explained what are the steps for flashing via jtag.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi optyqus,

i just decided to write down a short howto :rolleyes:

Please have a look at the first thread!

http://xdaforums.com/showpost.php?p=2184776&postcount=1

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nicktgr15:
Hi and sorry for the off-topic. I have disassembled the x7500 and yes there is debug connector on the motherboard. I also bought a wiggler clone cable. Which software should i use to reflash the bootloader? I have extracted the nbh file of a stock athena rom and i have 00_G4IPL.nb and 02_SPL.nb, are they useful? I also have the memory mapping of athena so i know where spl and ipl are. Should i use jflashmm like in the atom case? If yes the command would be like this: jflashmm pxa27x32 02_SPL.nb P 0 PAR ? Or i have to find the nb0 file?

Thanks!
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi nicktgr15!

Nice to hear that x7500 got this interface.

So i guess the pinout would be the same. You may get acces to the PXA via JTAG using the jflash software.

Programming the bootloader into G4 DOC is another other challenge :rolleyes:

No one has ever made this on a low-level JTAG base (the low level routines for M-Systems DOC are unknown).

Some may have done using a debugger to load modified SPL to RAM. This is no easy task, because you need to reverse some parts of bootcode and tweak some binaries. No idea if this will ever work on X7500.

Anyway this is far beyond my scope right now.... apart from that i got no X7500 and this is a Hermes thread.

Perhaps you may start a topic in the Athena forum!

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] meshuggah:
Hi all,

Because I think I have case to use the JTAG solution, but I want to be sure there is no other way of solving it and I want to have your confirmation.

I have already post this in the "upgrading" section but nothing!

The case:

SPL is 1.09 & No GSM ! To downgrade it to 1.04 I have to write the file to device. - Not possible because of the sticking in Windows Mobile Splash.

My Idea was to flash the original ROM in order to get the device working, but I get The ERROR MSGs 2XX or "invalid Vendor ID" even with the original ROM update !!! On the front panel of device is SWISSCOM. I don't know if the device was flashed already with different ROM. I bought it in that condition.

I think the Radio ROM is corrupt I can get all CHS via MTTY except the CHS of RADIO - "Timeout" Using mtty "info 2" is givin me : CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>

Is there any sence to search CID information in order to try rom updates or to use any command in order to boot the Windows.

Or its time to try the JTAG and use this junk only as PDA?

AAA, first I try to heat the QC!!

Please for any Idea!

Thanks

George
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi meshuggah!

Please remember the no GSM errors can't be fixed by JTAG method yet.

No one ever has confirmed the access to GSM chipset on hermes using JTAG.

But back on track...

Sometimes it might help to heat up the QC to "repair" noGSM issue.

Please be careful anyway, otherwise you may end with a total brick :rolleyes:

For bootloader commands have an intense look in the wiki, you may find something useful there.

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] meshuggah:
Vielen Dank Scholbert,

Can You help me with some questions?

Is it means that if I write SPL via JTAG this is the End for the normal Vendor RUU update (In Case possible "No GSM" repair)?

What is the reason I can't flash even the original Vendors ROM. Is it because of the damaged Radio ROM?

Because I didn't see any other flash IC only the Samsung "Sandwich", is it means that Samsung & QC are using diferent Addresses in physicaly same flash IC, or the QC has own flash?

Sorry for the stupid question but I don't find good specification of this QC.

Thank You again

G.