yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Recoil989,

thanks for your commendation.

Flashing the Radio ROM won't work with this method, because access to the Radio chipset is not possible via JTAG.

I'm in a hurry right now, i might come back to this topic later.

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Recoil989:
Ok the flash and everything ran through as you described. was a mission to get the wires soldered onto the pins. anyway conclusion is that this Hermes seems to also have write protection.

After flashing im still on 1.04 and 2.03.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Not sure ...

Hi again,

maybe your JTAG operation was successful, but you did'n realize it :D

If you took the binary i posted in this thread (IPLSPL04.bin), it is no surprise that....

...because IPLSPL04.bin is put together from factory IPL 1.04 and SPL 2.03 :p

Anyway if you like to flash olipro's hard-SPL and your bootloader is still working, you may do it the "classic" way by using the software flash tools. I personally would advice you to do so!

Have a look in the wiki or search this forum on how to use them.

If you like the thrill you may also assemble your own binary from olipro's hard-SPL package to do the JTAG method again. You got the choice!

Furthermore i found out that the NAND flash, maybe stuck in write-protection due to some hardware problems or corrupted bootloader (IPL or SPL got bricked).

Apart from the bricked radio NAND, i'm pretty sure that some parts of your device are still in good conditon because your bootloader is still working.

To fix this we need:

1. Find out where the JTAG testpins for the Qualcom chipset are located

2. Some kind of adaptor and a software tool to flash the radio NAND

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Recoil989:
Aah that would be problematic :). I had a suspicion before flashing that that might be the case so i whipped open the IPLSPL04.bin you posted and searched for the text SuperCID (assuming that olipro's HardSPL was the only SPL with that text hex edited into it) which I found. i thus assumed that it was HardSPL loader. Just in case i extracted the SPL from the HardSPL nhb file and flashed only that to block 1 of the nand (hoping that it would leave the IPL alone and only overwrite the SPL. this ran through successfully as well, however the IPL and SPL versions in the bootloader remained the same.

Unfortunately this isnt an option as a cant boot into the OS to run the SSPL. i tried with the SD card method only to realise later that without the HardSPL you cant flash any code that isnt supplied by the manufacturer. this includes the operating system.

So basically i need to get an OS onto the device before i will be able to HardSPL it, but there are no OS only shipped roms :). The reason i cant flash a shipped rom is that the Radio is NAND is corrupted and wont let me get past 11% of the flash :). thus i need HardSPL to be able to use the SD card method to get a custom OS only rom onto the device. its a catch 22.

I reckon your suggestion to find the Pins for the Qualcomm sound like the only way out. alternatively finding a work around the nand protection could possibly work. Since im relatively new to these sort of things, have you got any tips/pointers as to how i would start investigating these options? apart from the work you've already done it doesn't seem as if anyone else is researching this.

Thanks again

Recoil
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Recoil989,

i'm quite sure there is a possibility to upgrade without a working OS.

If i remember correctly, i once did that successful on my device.

You need a special RUUwrapper for this task.

Anyway here's olipro's Hard-SPL in binary format ready to flash via JTAG. Flash it to page0, block0.

But please be careful, don't brick your device even harder :eek:

I need to find a work around to disable NAND write-protection using JTAG.

With this feature done, it will be always safe to flash anything to hermes NAND, even a linux-bootloader like u-boot:D

Made some progress already, but it's not yet finished :rolleyes:

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Recoil989:
Thanks scholbert, ill give it a try sometime this week, and revert back with the results.

btw found this while searching around the net for something completely different. its a JTAG pin header finder for arbitrary devices. http://www.c3a.de/wiki/index.php/JTAG_Finder. May or may not be helpful.
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
you remember wrong. (unless you mean using that bug in SPL 1.04)

anyway, i havent looked at what jtag software you are using but if it allows ram access and execution of any address (i have seen that's possible for other devices where the software had this functionality for the specific cpu), then (possibly after executing some extra hw init code) you can download and execute SSPL and let it flash the SPL into nand.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Uuups!

Hi cmonex,

thanks for clearing things up!

I really wasn't sure about that :p

The software to access the flash is from samsungs website and fits perfect to all devices using S3C2442.

In the meantime i did some slight mods, but WP pin could not be disabled on my device. So i thought to ask for some advice :rolleyes:

I started some private conversation with the cracks out there (e.g. pof, olipro). Pof gave me some useful information for a work around using a debugger.

Some more work is needed to get things rollin' ;)

It's similar to your description.

I will post some details about that later!

Anyway this method requires some skills and a working debug environment.

I'll try to use freely available stuff for that.

Please remember that all this is only needed, if NAND on the bricked device is blocked. As soon as i find out which pin is responsible for that, i'll put some code in the programming software to make it a little easier!

Stay tuned.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
OK... good luck! :) you could post more details on what exactly you want to do.. maybe you can get more suggestions ;)

also, are you not the scholbert who also had a simpad / skeyepad and played with jtag there?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi cmonex,

thanks!

I will need it :p

At the moment i'm a bit limited in sparetime, but i will post some details about debugging the hermes soon ;)

First i need to patch the IPL with some tweaks that have been worked out for trinity (posted by pof). Search for splxploit.

Yepp it's me!

I remember there was also a JTAG related discussion in the forum at hpc-factor and i tried to give some hints.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
hey :) I got your PM. btw on hpcfactor I don't read PM's, so either talk in xdadevs PM or open a forum thread on hpcfactor.

JTAG: yeah... got that worked out since then :)

as for splxploit, that is only relevant for trinity. will not be any good on hermes (I know the insides of that program quite well since I was porting it to other devices). I'm not sure how that is relevant for JTAG anyway.

I can help with patching IPL (have done that before for loading SSPL on some htc devices). what would you need?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
This is going deep now! Maybe need help...

Hi,

Very nice, thanks for the information. Not sure when i will check this out, need some more sparetime i guess.

I followed your thread at hpc. Great work!!!!

Yes i know that. I do not really need the hacked SPL because i may find a hardware fix and use the factory SPL. Thought of short circuit the relevant buttons while debugging to get into bootloader or similar stuff.

This damned write protect issue drives me mad.....

I think i'll need a patched IPL that prevents SPL loaded from NAND memory to SDRAM!

As far as i know this method was once used on trinity to load the hacked SPL into RAM.

O.K. maybe i'll give a short overview of my progress so far:

Right now i use the AXD from the arm developer suite.

Underneath i use the H-JTAG tool, it works like a charm :cool:

I'm able to load some IPL into internal SRAM, as well as addressing SDRAM at 0x30000000 and load some file to it.

This means when i enter into debug state and the CPU is halted by the debugger, the SDRAM is already initialized by IPL loaded from NAND.

At this point i'd like to load the modified IPL into SRAM of S3C2442 and put a valid SPL into SDRAM at 0x30000000.

If everything is just in place i'd like to jump back to 0x0 and start the patch IPL again with debugger.

The IPL does low level setup again and jumps to SDRAM where SPL is waiting.

Anyway that's the theory so far :rolleyes:

I already compared the patched IPL from trinity with original IPL from hermes.

Did some disassembly too, but not really sure which parts to change...

So this was a lot information and i'm not sure if someone else could follow these hacker stuff, but anyway if you're familiar with patching IPL code any help would be appreciated.

Maybe also pof will find some old hermes files again to help me out.

So no need to hurry!

If you need further information, no problem.

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
here's IPL I patched last year (the nex in OliNex version means cmonex).

(get it from attachment. it is 1.10, if you need another version, upload it and I'll patch it, no worries.)

(has nothing to do with splxploit except that that also used a hacked IPL)

I recommend you load an SSPL into ram after that, because that goes into the bootloader screen automatically, no need to hold the buttons.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi cmonex,

thanks a lot for your fast reply!!!

Great stuff :D

Hopefully i'll be able to check this out the next days. Will report what happened!

O.K. nice advice.

I extracted sspl-hermes.exe and got some raw files afterwards.

Normally i will need some matching binary files to load to RAM.

Not sure if my output file would do it (contains special IPL & SSPL):confused:

Anyway thanks a lot for helping me out!

As i said i will report my progress soon.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
upps posted twice....

Have fun!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
It's time to get back on track...

Hi folks,

it's me again :D

Those who followed the last posts in this thread, might have thought:

"What the hell is it all about???"

O.K. my final goal was to find out what's up with my bricked device and why it could not be reflashed using JTAG.

I neither want to reapeat myself all the time, nor bother all the daily user of mobile hardware.

But assuming there are some poeple out there who are still interested in all these things, especially using the JTAG interface to gain access to some mobile hardware, here's a short conclusion:

1. I found out by tracing some pins that there's some mechanism to keep the NAND flash in write protect mode. This is a common issue to prevent writing to flash in some cases (e.g. during power up or in the case of sudden power loss).

2. Apart from this fact some devices have been reflashed succesfully using the JTAG method.

3. It seems some device cannot be revived because the WP pin is not deactivated. As a result the NAND is blocked. The reason of this behaviour is not fully discovered. Maybe it is a pure hardware issue or there's some part of bootloader responsible for this.

The only way to get a better idea of this issue is your report of a hardware recovered from brick using the JTAG method.

Anyway i tried a lot to get my device revived using a debugger.

There were some really nice people out there who helped me out with some piece of software to get the bootloader started completely out of RAM.

This goes out to you pof, cmonex and also olipro!!!!

Thank a lot for your advice!

This kind of debugging is quite heavy stuff and you'll get in touch with the hermes heartbeat.

Though it wasn't successful, it can be stated that this is a very deep inside view of the hermes hardware and you may learn a lot. At least i did :cool:

So if your a geek and ever may revive your hermes using JTAG please report it right here!

Maybe this leads to a 100% working reflash method :rolleyes:

Thanks a lot!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
did the IPL not go?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi cmonex,

i spent some time on debugging my unit. Maybe something else is affected in the end.

No it didn't work :(.

Again, thanks a lot for the binary but i tried everything without success.

If there would be more interest in this thread i might give more details, but i think it is boring for most of the people out there.

Anyway, i got further plans and if you are feed up with reading stupid posts have a look around :D.

Just kidding......

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] raju-007:
How to Guide for dead HERMES300

HELLO Dear all

I bricked my device Herm300 (T-mobile MDA Vario II).

It doesnot turn on. Bootloader mode is not possible as it do not respond to any button including Power Button. Ony when it is attached to USB or Charger without Battery it shows RED LED. But as I insurt battery in the device there is no any indication, LED.

I have tested that Battery is fully charged. I checked it with Battery from my friend's other well conditioned working Herm300.

Please May I get How to Guide Debugging with the help of JTAG pin adaptor ( Step by Step ). I hope that with this Techno help I could unbrick my Device.

Please .............
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Step by step

Hi raju-007,

it seems that your device is a real brick :(

To use JTAG method you'll need to disassemble your device (at least partly).

Follow the steps in the service manual.

http://mikechannon.net/PDF Manuals/Hermes Service Manual _A03_[2].pdf

Thanks to Mike ;)

Unfortunately my time is still very linmited and some documents are not finished for publishing. So please try to follow the first posts in this thread.

At least to give you a small guide follow these steps:

1. locate the JTAG pins (pic in first post)

2. use a very small soldering iron and attach some wires to the testpoints

3. use one of the wiggler clones to built up a connection to the JTAG pins using LPT port of your host pc

4. insert fully charged battery and press power on button on hermes

5. use the samsung software (msp_2442.exe) and check if processor is recognized

6. grab IPLSPL_1.04.zip from post #13

7. use samsungs software and try to reflash your NAND

type: msp_2442.exe /f:IPLSPL1.04.bin

type: 1 to choose the flash type

NAND flash type on hermes is k9f1g08 and should be recognized

type: 0 K9f1g08 Program

Start page and block must be set to 0

8. be patient and cross fingers while flash is programmed

alternatively you may grab some coffee or beer!

Hopefully this will bring your device back alive :D

If not please report it. You may have read some of the posts in this thread and wonder about this write protection issue. If your device is affected too, you won't be able to write to flash, because of WP pin.

Anyway report your progress.

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] raju-007:
Building JTAG cable

Thanks for help. I got info about dissembling Hermes and daigram/picture to test. within 2 days i will try to build JTAG cable/dongle and will go ahead. Hope i may get success. I will inform you any development.

I find some information on how to build JTAG cable.

http://www.diygadget.com/store/building-simple-jtag-cable/info_12.html

.

Please let me know if i should fallow this way ????????

Does any more hardware is required ????????
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi raju-007,

there are many different aproaches to built a JTAG adaptor for LPT port.

I'd personally prefer to use a wiggler clone.

It's a buffered one and more secure, because it uses the correct voltage levels.

At least you'll need identical pin connection to LPT-port to use the samsung flashing software.

Anyway the resistor based adaptors are very minimalistic ones and may also do the job.

I may post a schematic of the one i used, if you like!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
My hermes is also bricked :(. It won't pass the windows mobile screen and i can't connect to activesync so I can't upload a rom into it.

Is this a way to egt a new rom onto it or not:confused:.

Tyvm for helping me :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
not fully bricked

Hi Wupper,

your device is not totally bricked, because your bootloader is still working :D

You'll have to enter bootloader mode, use mtty and enter some special commands to solve this issue.

Please have a look in the wiki or search the forum how this can be done.

Anyway i won't suggest to use JTAG for a complete firmware upgrade.

It definitely would take a few hours to flash the hole WM part to it :p.

No one ever tried this before and you'll need raw binary image files and the right offset addresses to do so.

So please don't try this.

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
Well.. i think I've to sell it.. The mtty option doesn't work at my hermes :(. Ty for helping ;)
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
I sent you a PM
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
please give more details. I'm interested.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
degugging journey

Hi cmonex,

o.k. i'll try to resume...

First some history to my device:

The device once had the no GSM issue and i tried a lot to revive it, considering all the methods described in the forum.

One day i decided to get back to original bootlader. Don't remember why i did that, but it's meaningless now.

I exactly followed Mr. Vanx guide to step back from olipro loader.

The flashing process finished but the device did not come back from reset.

This was the point of no return. Apart from the "no GSM" issue the device seemed to be fine :o.

Anyway i was able to access the platform with my debugger a few times before the MMU got activated and fill the memory with the modified files (IPL & SPL).

Afterwards i put all registers to reset values by writing zero's and set PC to 0x0.

Then i let go!

Nothing but errors!!!

Most of the time a debug error occured reporting the CPU raised an exception.

Once i was able to go into the code without an error.

After a while (some minutes) i stopped the CPU again and it stuck in higher memory at 0xfffffxxx.

All the memory content up there was filled with zero.

During another attempt, the device stuck in a loop.

I was able to halt the CPU again with a debug command and realized that all content in SDRAM was lost and it was not initialized anymore :confused:.

Another time i read back the memory contents before i let the CPU start executing, to verify if everything was placed correctly in memory.

Verify O.K.

I never reached bootloader and i really don't know what else to try. Also the f**king WP-pin still stucked to GND.

Tried using some breakpoints too.

I'm really at a loss with this device and it seems nothing could be done to make it work again.

Maybe some hardware is really messed up.

I think it would be better and much more helpful to investigate the write protection mechanism for NAND on a working device.

Seems to make more sense to me...

Life's too short :D

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
very interesting stuff... write protection, I might be able to look ... but i think the SPL should really be able to run from RAM too... which SPL are you using ? an SSPL? which version?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hey Cmonex!

Yeah sure, that's what's it's all about. My device is blocked and can't be re-programmed using the software from first post!

I will post a picture of NAND write protection testpin tonight...

In theory yes :o

As i said maybe the hardware of my device is damaged. Could be some minor part of the hole device... :confused:

I used patched IPL and SSPL PM'ed by POF ;)

Versions:

IPL 1.01

SSPL 2.02

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
NAND WP testpoint

Hi again,

so here's the testpin for NAND hardware write potection.

Measure the voltage level:

~0V NAND is in write protect mode

1.8V NAND is not write protected

This pin was traced back to the stacked memory package on top of Samsung MPU using a multimeter.

To be 100% certain, this has to be prooven by software hack.

If this pic is not enough, i also got high resolution pic :D

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
JTAG adaptor

Hi geeks,

there are many questions concerning jtag on hermes that are arriving through PM.

You may also use this thread and help each other out ;)

Please use the download link given in the first post and read some of the documents published at samsungs website.

This may give some answers to the most common questions.

If the link is down please tell me. I got backup data of all files.

To give you an idea how a suitable LPT-adaptor should look like, please see attached document :D

This one is working perfect with the provided msp_2442 software :cool:

If you want to use other adaptors, you may need to change the pin definitions in jtag.h and recompile the flash tool using visual studio or similar.

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] amjad4u:
which is the best?

please tell me which jtag wiggler clone is the best & secure for my herm300?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi amjad4u,

it's all there ;)

Please have a look in the manual from the post above :D

You will find schematic and link to an opensource site.

I built up an adaptor on my own, so i cannot tell you which one is best and which one to take.

All the adaptors out there are very similar. If the pinout is different modify the software.

The buffered adaptors (see manual) are better than unbuffered (those with simple resitors).

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] amjad4u:
thanx scholbert

thanks for replay scholbert.. i build simple(register based) jtag dongle but i think it is not secure.. so please advice me or tell me about youers own! thanks in advance!!
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Look in the manual...........

sjf2440_UserGuide_v1.zip

That's all i can tell you ;)

scholbert
[8525, TyTN, MDA Vario II, JasJam General] amjad4u:
thanks....

i try......
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Good luck amjad4u!

Please report your progress.

scholbert
[8525, TyTN, MDA Vario II, JasJam General] igord:
I have UNBUFFRED jtag cable, do I need to change something in the flashing software? I dont have VCC wire?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Look for additional information!

Hi,

there are many possible solutions for JTAG access.

As i already pointed out, a buffered one is prefered (have a look in the sjf2440_UserGuide_v1.zip for a schematic).

If you use unbuffered adaptor no VCC is required :rolleyes:

I extracted the part of jtag.h, that may be modified according to your personal adaptor type. You'll have to define the right pins and functions used on the LPT port.

// Pin Connections
// TCK :DATA[0] (2)
// TDI :DATA[1] (3)
// TMS :DATA[2] (4)
// TDO :STATUS[7] (11)

#define TCK_H	0x01
#define TDI_H	0x02
#define TMS_H	0x04
#define TCK_L	0x00
#define TDI_L	0x00
#define TMS_L	0x00
#define JTAG_SET(value)	OutputPpt(value)

#define JTAG_GET_TDO()	( (InputPpt()&(1<<7)) ? LOW:HIGH ) //STATUS7 is read inverted.

If you don't like to change the source code, you may change your hardware to fit the software setting ;).

Please have a look around in the web for more information about JTAG and especially using the LPT port to get access to JTAG pins. There's a lot of useful information about that, if you are not sure how to start.

Best regards,

scholbert