yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

No problem, this is not silly a silly question.

As far as i understand it your device is still able to boot into bootloader, as well as show the operator start up logo, a.k.a. splash screen.

Although it seems it really got the nogsm error.

Using JTAG fro your device won't be necessary because bootloader is operational.

Have a look in the wiki and try to do a hard reset (hold power button & ok button & press reset) to get into the four coloured bootloader screen (not the operator logo screen).

Please report your version of IPL and SPL if possible. These numbers are shown in the bootloader screen.

You may use MTTY and get into the bootloader command line.

Within bootloader console there are several possibilies to set some flags using bootloader API. Try "set 14 0" or "set 16 0" using MTTY.

Maybe these commands will help you to boot into OS again.

Please have a look in the hermes wiki for further information.

It's the best place for research and get your bricked device alive again.

Hope this helps a bit!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
Hello,

thank you for reply, I tried use MTTY and set 14 0 and set 16 0 but still nothing done.

Still orange logo.

But write was sucess.

Here is my data:

M 95

S 94

B 06

D 3.35

HERM100

IPL-1.01

SPL-1.40.Olipro

and now I use MTTY and I do something and I have HERM 100 MFG SPL-1.01
[8525, TyTN, MDA Vario II, JasJam General] Monrad:
Try this:

1) Put your device in bootloader mode.

2) Flash this ROM: http://xdaforums.com/showthread.php?t=309322

3) If you succeeded, boot windows mobile.

4) flash latest HardSPL: http://xdaforums.com/showthread.php?t=296722 (REMEMBER TO FORCE SSPL)

5) Now try to flash any rom you like.

If you fail flashing a shipped ROM, try this:

1) uncompress the ROM you want to flash

2) locate .nbh file (70-80mb) and rename it to HERMIMG.NBH

3) Copy that file to a SD memory and put it in your Hermes.

4) Turn off your Hermes and put it inside the fridge for 20 minutes

5) Open your fridge and turn on your device IN BOOT LOADER MODE.

6) It should find your SD card, press POWER BUTTON to start flashing

7) Close the fridge and check every 2 minutes to see if it worked.
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
HI, Thank You Scholbert and Monrad!!!

I sucess, I flash by MTTY bootloader SPL-1.01 MFG instructions http://wiki.xda-developers.com/index.php?pagename=Hermes_BootloaderMFG

Than I use MTTY again and again and use this metod:

http://wiki.xda-developers.com/index.php?pagename=BA_FAQ_STUCK_AT_STARTUP

, but I send after "set 14 0" I set again "set 16 0" and than it works. Thank you, but I still have NO GSM but I can use it as pda and gps.

But if know some solution of NO GSM please introduce me.

EDIT:

Now I dont know why my fus blown, I tried activate KILT (I press OK + Power button + reset) and than all stop working I test fuse and is unplug.

Do you mean is only "lucky day" or I cant use this combination?

Because tomorow I wont solder this fuse and plug it with small peace of wire, that if is something else I dont have any fuse for CPU and I can blow it.

Please what do you mean?

And please have you some idea of my NO GSM problem? Can I use JTAG for it? Or is still undiscovered?

Many Thanks for reply you very help me

EDIT2: Now I read that KILT is no OK and Power button but comunication button, that I dont know why fuse blown I think it was only "lucky day"
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi jozinecko,

i have no idea why your fuse got broken, but this seems to be a sign of another serious damage on your hardware!

Please see post number 2 and one of my last in this thread about radio chipset...

Testpins have to be discovered!

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
Hello,

Thank you but I have other issue. I downgrde to MFG SPL-1.01 but now I can´t flash by hard spl or unlock, buecause now I want use MTTY for bootloader to 1.04 but I cant, because is lock, (task 32 => level = FF)

I now is not question in this thrat, please excuse me for it.

And all day I tryied reading and trying guides from wiki and forum but nothing happend.

Please have you some idea?

Many Thank you.
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
Hello,

please do someone know which is VCC, TDO, TMS, TRST, TDI, TCK ???

And how is VCC?

I dont know what and where I can solder.

I use Holly Gates JTAG DONGLE but I dont know if is good for this, I need to change bootloader from 1.01 MFG to some other because this dont flash any ROM, it stop work in 0%.

Many Thanks for help
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi jozinecko,

please have a look at the samsung user's manual for the jtag software.

If you compare the schematics of both adaptors, you may find out the following:

LPT	Buffer	HollyGate's JP2
pin	function	pins	pin	function
2	TCK	A8 -> Y8	3	TCK
3	TDI	A7 -> Y7	4	TDI
4	TMS	A6 -> Y6	2	TMS
11	TDO	Y5 <- A5	5	TDO

TRST is not used.

VCC has to be connected to hermes 3.15V I/O voltage.

For the test pin location on hermes PCB have a look in the first thread.

That's what it's all about dude!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
OK thank you. Yes I have there pics from first threat. And do you think that I flash boot loader for one which can work? because this MFG is not working and I cant flash it to another by MTTY.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

Yes sure that's what these tools are made for!

You may flash anything you like into hermes flash using JTAG, but the best is a working bootloader :D

What do you exactely mean with "MFG"?

Default factory bootloader????

Do you get a bootscreen?

This will never work, even if bootloader is in perfect state!

With Hard-SPL you are able to upgrade using SD-card.

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Chaly:
Hmmm....nice research...

Can I run this method for herald too?

My herald get bricked when using SD Card update method....:(

Now I can't access bootloader menu anymore...and i assumed its a ROM error...
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Chaly!

I never saw a detailed picture of the herald mainboard.

But if there are some JTAG pins you're in!

So first you'll need the position of the JTAG testpins on herald mainboard.

Second i suggest a simple JTAG debugging tool, to verify the connection.

Last you'll need a flash programming tool for TI OMAP 850.

(By the way i don't know the type of flash herald is using...., could be quite impossible to re-flash if it is a m-systems disk on chip)

Of course you'll need a bootloader binary to flash in the end :D

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Chaly:
I'm not sure if i'm in the correct path...

But I found this expensive tools from googling around....

http://focus.ti.com/docs/toolsw/folders/print/tmdssdsfru.html

Wonder if i just need this tool....

Looking around to find cheaper solution...:(
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
R&D

Hi Chaly,

i'm no TI OMAP expert :rolleyes:.

Perhaps it's a good idea to open up a new thread in the herald section of this forum to discuss the JTAG issue ;).

By the way there are also other HTC devices using the same processor.

Some people in the wizard section had a discussion about JTAG:

http://xdaforums.com/showthread.php?t=306892&page=3

There are very useful information down there :D

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Lt.Cmdr.Ivan:
Hi excellent thing, i repaired 2 mainboards with an unbuffered jtag cable.

It worked absolutely perfect.

Thanks guys.

Regarding the GSM chipset, i think i have a broken board, that i can use for the task to trace the pins, the only thing i need, would be the confirmation, or better the software and description how to use these jtag pins to access and flash the the gsm part of the phone, because i have a second hermes board to test the software on (it has a broken gsm atm).

greetz

me
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Wow!

Hi Lt.Cmdr.Ivan,

it's an honour to see you posting in this thread!

I'll have to quote my first post again:

So in the end it became a round up solution, because of some very useful tips of nice people around here :D

You're help is highly appreciated!

As you might have noticed, i already posted a picture from the JTAG pins beneath the GSM chipset main unit.

I also have some details about the pinout of this chip, but of course we'll have to find the testpoints at another location, to get usable access to it. I'll give you some information about that, using PM.

I got a broken mainboard as well but was not able to trace the signals, due to lack of time.

Next would be a useful software tool and as you already mentioned the GSM bootloader binary. I'll need to do some research about that also :o

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Lt.Cmdr.Ivan:
Absolutely right :)
[8525, TyTN, MDA Vario II, JasJam General] KiLLWarez:
Hi to All!

I wanna say big thanx to all who find out jtag, published info about, patched samsung tool and made my hermes unbricking possible.

Recovering Hermes for me was hard cause I'm more software guy than hardware, I even bought small soldering station with tiny iron, but it didn't helped me. :)

My device recovery take about 1-2 month. Step by step I understand info posted on xda-developers. Find out that only JTAGing will help me.

Thank you all guys!

PS: For noobies! In this topic you can find all required info on Hermes JTAG recovery. Disassembly manual, right JTAG pinout for samsung flasher and many other info helped me clearing my mind on what I've done. So just read it few times.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hey KiLLWarez!

thanks for appreciation :D

It's nice to see all of you bringing hermes back to life using the JTAG method.

At least i also learned so much in this forum, so it's nice to give something back :rolleyes:

I also really appreciate the help of some of the cracks out there!

To get into contact with them was a pleasure.

XDA-developers is a nice place to be!

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hey geeks,

the testpoints for the GSM chipset of hermes have been discovered!

Please have a look at the second post of this thread:

http://xdaforums.com/showthread.php?p=2184868#post2184868

I decided to place all JTAG related stuff for hermes in this thread to avoid double posts.

At the moment the traced signals will have to be verified with some software.

I'm very lucky, that Lt.Cmdr.Ivan was willing to help out on this issue :D

So thanks goes out to you at this point!

He already brought useful stuff into this forum and it was an honour to get into contact with him!

Stay tuned!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] rmorera84:
i can use this cable for the test point??

http://cgi.ebay.com.my/JTAG-Cable-L...m14&_trkparms=72:835|66:2|65:12|39:1|240:1318
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi rmorera84,

maybe???

I don't know what the pinout is like on these simple toys.

Anyway you may change the adaptor to fit the samsung software, or modify the software to fit your adapter....

Please refer to documents and schematic in this thread and read the information how to do this.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] rmorera84:
I have the Red light on the Hermes, i tried all the possible solutions, but nothing, i change the battery, the charger, put and take off the battery many times and nothing. So i can tried this solution??
[8525, TyTN, MDA Vario II, JasJam General] KiLLWarez:
if we can downgrade radiobootloader with hermes gsm jtag of softbank x01ht devices it will make any x01ht unlockable
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi there,

Recover OS bootloader:

If your device got bricked during bootloader update or your OS bootloader got corrupt in any way, you may use the tools from the first post to recover your systems bootcode.

Recover GSM bootloader:

All i can say, there's no solution for broken radio so far!

I only published the testpoints for this part of hardware.

Any kind of software access has still to be verified :rolleyes:

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] mike3000:
excellent work scholbert!!

I have a 8525 with a bricked radio rom that I would love to get working. If there is anyway i can test anything let me know, I bought this phone for dirt cheap so if i ruin it in the process its no biggie.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi mike3000,

thanks for appreciation :D

Any help is welcome of course!

Decide yourself what to check out with the given information.

It seems no one has some piece of software for direct access to any of these qualcomm chips.

So what could be done, is to check the JTAG connection with a simple adaptor and a standard ARM debug software, to read out the chip ID. I'm quite sure you'll have to power up the device and boot completely to OS to do so!

The MSM6275 should then confirm itself as ARM9 device and a certain ID, like e.g. 0x01234567 or similar.

This would give us the assurance, that the testpoints were traced correct and JTAG access is possible in practice :rolleyes:

My time is very limited to spent more time on that right now....

Anyway, maybe some solution could be found over the year!

Good luck,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] mike3000:
Awesome, I'll be able to start working on this in 1.5 weeks, school is retarded and i have finals the week after this instead of before winter break XD

after that school for me is done for a while so I will have plenty of time to play around with this.

I just hope that a majority of this is because of software and not hardware =( I guess time will tell. anyway thanks everyone and especially scholbert
[8525, TyTN, MDA Vario II, JasJam General] Kebal:
White screen htc tytn

Hi everyone. This is my first time posting a reply.

For your information, i have htc tytn, and it seems the software broke and turn to white screen. When i try to hard reset, it seems that nothing happened (still in white screen condition).

I am very interested to restore my htc using jtec. The problem is:

But i don't have the tools call "jtec dongle" if i'm not mistaken.

And i'm not familar with jtec.

Could someone please help. If there any way i can get the tools, and some instruction to do it?
[8525, TyTN, MDA Vario II, JasJam General] mike3000:
good news, school is over and free time has arrived!

had some free time tonight so i began work.

Not much so far, just began prepping the phone so that the programmer can access it. I still need to make the programmer XD but that shouldnt be too much of an issue once i get my hands on a 74LS541 or a 74AHC541

anyway here are some pics i managed to take

anyway its a start, will keep you guys posted, and thanks again for all the hard work scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Wow!!!!

Hey mike3000!

Very nice work, looks promising :D

I made very good experience with H-JTAG

http://www.hjtag.com

It is an excellent tool to fiddle around with unknown CPU's :p.

And what i like most is, nearly any adaptor could used, because you are able to customize the interface!

Good luck for your experiments!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] mike3000:
thanks,

and i forgot to mention the points ive taken care of so far are td0, tck, tms and tdi so basically the setup for writing the boot loader, no gsm, but i got a question:

1. seems the trst_n and rtck have not been traced back yet (please correct me if im wrong). since this phone is very functional (i can boot into wm6, this phone is actually in very good condition aside from the fact that the radio is corrupted. Basically what I am saying is that i dont really want to tear the qualcom ic apart to trace these points since this phone is still in good shape. I do have a dead htc wizard board, and since the wizard is the predecessor to the hermes, maybe the layout is similar and I can tear that one apart to see if i can get an idea where these points are at. But this job is perfect for anyone with a completely dead hermes (i think scholbert or Lt.Cmdr.Ivan mentioned this earlier)

anyway i havent messed with this wizard in a while, so idk if the hardware specs are actually similar.

thanks again everyone, great work
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I looked everywhere on hermes PCB, but it seems they are not connected to any testpoint.

Anyway, i suppose you won't need these signals for simple debugging.

rtck - is only needed as feedback signal for soem ARM debuggers (mainly for Multi-ICE mode)

trst_n - is only needed to put the TAP controller into definite state (this is also needed under certain circumstances)

It won't be of any use to trace signals on a wizard. This is completely different hardware and the PCB is also different of course.

I suggest to leave everything as is, connect your adaptor and do some simple tests with your hermes.

Would be very interesting to know if the ARM core inside the Qualcomm chip is recongized in any way.

Lt.Cmdr.Ivan had no luck so far and i have not found any sparetime right now to try.

My hermes devices are also in good condition, so to check the connections i had to rip one of them apart.

Maybe i will some day :p

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Lt.Cmdr.Ivan:
That looks promising.

Has anybody access to the softbank x01ht radio bootloader upgrade tool named

update_h182.exe ?

It makes the devices simlock permanent, at least afaik, but maybe it repairs the radio bootloader and the phone is useable again.

greetz
[8525, TyTN, MDA Vario II, JasJam General] Zgembo:
i have update_h182.exe here, at the safe distance from my phone that is...

anyone interested just let me know.

EDIT: Searching for my ROMz archive CD, where the hell have i put the damn thing?!?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Wah'sup???

Hey mike3000!

Any news from the laboratory?

Did you get a connection to QC?

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] mike3000:
heh sorry for the lack of communication, been busy with the job and modding/repairing a lot of xboxes lately.

My third machine (used primarily for flashing xbox 360 drives and programming, etc) took a dump on me last week, so im currently waiting for a new motherboard to come in to get that machine up and running.

I am excited to give this a shot
[8525, TyTN, MDA Vario II, JasJam General] KiLLWarez:
Hi!

As I see you guys found radio jtag pinout. Now we need some flasher? Is there some info, maybe from other HTC devices or BenQ-Siemens?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Yepp, was in luck and traced the signal on a broken mainboard :D

And yes we need help, see thread #2

The best would be to write our own flasher using low-level TAP access (similar to the Samsung software for the main CPU)...

...but without BSDL file, no chance to do so :(

The other way would be to use debugging mechanism to start some code on the qualcomm chip and see how to access the flash.

Due to lack of time, i was not able to confirm JTAG access so far...

I you like help follow the last posts ;)

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nico82227:
Hi Scholbert, I need the exactly procedure for flash Hermes with jtag mode. Can you post it please?

I've downloaded attachment of the 1 page of this post but I don't know to use program J-Tag and I don't know which is Hermes-PC interface to build that is necessary for operation.

Tanks and exuse me for my bad english!!!

IN ITALIANO

Ciao, mi servirebbe sapere come fare a flashare esattamente il mio TyTN con il J-TAG.

Non ho capito com utilizzare il programma di flash e l'interfaccia da costruire.

Un grazie a tutti i colori che mi aiuteranno.

Grazie e scusate per il mio inglese nel post!
[8525, TyTN, MDA Vario II, JasJam General] nico82227:
I need the procedure for JTAG mode because my Hermes is bricked, no booting, no OS work. Work only in bootloader mode and I'am IPL 1.04 e SPL 2.03. Normal process with original ROM HTC WM6 stop at 87% of flash process and at 97% of flash proces when I use the original HTC ROM WM5. I've many bad block in partition OS and it is not possibile to install SSPL Olipro. I've tried method fo flash Hermimg.nbh with method Sd card but not work!

Help me please.....
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
It's all there....

Hi nico!

The JTAG method is to restore broken bootloader. As long as this part of code is working you should try other methods to bring your device back to life.

Please search the forum to solve the bad block issue. JTAG won't help you!

What did you do excactely? Do you hav Hard-SPL installed?

Anyway the procedure itself and the requirements were discussed a thousand times here. Remember, you'll need FAT32 formatted card!!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nico82227:
Hi Scholbert,

Thanks for your reply but I've SPL 2.03. CID is FF and it isn't possible fix bad block. For fix is necessary CID=0 (NOT SPL 2.03). I've tried to flash SPL 2.10-2.20-2.30 in any way but don't work.

I've tried flash rom with SD CARD formatted FAT 32 but result is the same: error at 87% for ROM WM6 and error at 97% for ROM WM5.

Under Windows the stop flash is "Error 226 flash write". With mtty i've 506 bad block in OS CE partition.

I ask if possible to flash bootloader SPL 2.10 via J-TAG and then fix bad block when i've SUPER CID!

Thanks

Nico82227
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Nico,

o.k. i see!

Basically it is possible to flash any bootcode you like. That's the why i tried hard to discover all this stuff.

Not sure about the CID though. So give it a try :p

I you read through the thread you'll find everything you need. There should be also the correct binary file in the first post to flash hard-spl to your device.

Although all this stuff is ready to use and the process works 100%, you may need some basic skills in electronics.

Anyway, if you follow the steps and read through the documentation of the samsung flash software, you should do the job :D

Unfortunately my time is still very linmited and some documents are not finished for publishing. So please try to follow the first posts in this thread.

EDIT: Just found a short step through guide i once posted here.

So quoting myself:

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nico82227:
Great Scholbert!!!!

I've all that i need. I think that with JTAG mode i can flash SPL Olipro 2.10 with Super CID and after fix bad block with command task 28 and task 32 with mtty.

Tanks Scholbert, i try!!!

Regards,

nico82227
[8525, TyTN, MDA Vario II, JasJam General] Erikih:
Hi scholbert, i've created a JTAG cable with this tutorial http://www.diygadget.com/store/building-simple-jtag-cable/info_12.html

But i dont think its the right jtag cable for htc hermes. I've bricked my hermes trying to flash a v1 spl over an HERM200 phone. Can you please help me?
[8525, TyTN, MDA Vario II, JasJam General] Erikih:
NVM, ive tried it but with no luck. Now are the points ****ed up. I'm trying to get a new motherboard for my old pda. Or maybe i buy a used hermes with the same problem and use it for msn and that kind of stuff.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Erikih!

please read the thread there's so many info about all this stuff.

Basically even an unbuffered adaptor should work...

... at least some people had done with success.

Aaarghh, that's worse :(

If the mainboard is damaged now there's nothing you could do.

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nico82227:
Hi Scholbert

This morning i've flashed my hermes with JTAG mode. I have used IPLSPL2.10_olipro.:D

See print screen image attachments, its has worked well but... when I start my hermes in bootloader mode the SPL is always 2.03 don't 2.10.:eek:

You are sure that the SPL attachments at first page of this post is hard spl 2.10? Or you have SPL 1.04 or 2.30 in bin format?!?:confused:

Thanks

Nico