yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Your welcome!

Hi meshuggah!

No problem, i may invite you to some technical journey ;)

Right now we only got access to the application processor.

You called it the Samsung "Sandwich".

The NAND flash of this part of the device could be re-written via JTAG, e.g. if the bootcode got corrupt (IPL+SPL).

Yes that's right.

Original vendor ROMs are always complete upgrades and also contain the radio ROM. It's obvious that on your device the radio part is not accessible any more.

So if you try to flash on of those "complete" ROMs, the update process tries to intialize radio ROM bootloader at a certain point.

If the radio ROM bootloader gives no response the update fails!

You may try to upgrade to a cooked ROM without radio (i think most of them contain the OS only)

You may also take out the radio part from a vendors ROM yourself.

There are many comfortable tools floating around. Search for ROM-tools or similar.

The QC got his own FLASH and RAM (radio ROM is the firmware of this part).

The QC and Samsung use I/O interfaces to talk to each other.

No problem! QC documents are hard to find.

Everything is confidential :D

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] meshuggah:
Thank You very much Scholbert,

I appreciate your Help!

Today I observe the MB and I found near the QC the flash IC.

I have heat both IC's but the NoGSM appears again. :-(

Second stupid question: If I take the flash IC from another working Hermes and put it to the bricked will I get a working GSM Modul or this will lead to blocked GSM because of the CS? Meaning is: are the CS in the Flash calulated with the QC ID or ?

In my case the OS sticks on Windows splash screen. I try many metods but without success?

First I'll try the JTAG metod and after that I direct the attention to QC :-)

Thank you again!

B.R.

George
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

Heating up the chips may not always work.

Maybe something else is damaged and prevents GSM chipset to start up properly...

No this won't work. Apart from radio ROM itself there is a variety of invisible settings stored in this part of memory.

These are device specific settings (e.g. IMEI) and won't be overwritten by radio ROM update or similar tasks. Even if you will manage to solder the new chip right in place this will lead to non working device.

So please forget about that, you will definetely crash the hardware.

Flashing olipro's Hard-SPL via JTAG may help to get at least PDA functionality.

If you manage to update your SPL to this version via JTAG, you're able to reflash cooked ROM using the SD-card method.

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] meshuggah:
Hi Scholbert,

I think I find the answer of the issue "no GSM".

The problem is THE F... SAMSUNG flash IC of the QC.

I've already post my problem in the forum :

In brief-My issue WAS:

IPL-1.01

SPL-1.09

NoGSM

Stack at WM6 splash screen!

info 2 : timeout

ref.:totaly brick - via JTAG only use as PDA

What I've done:

Take an other dead by heating HERM and just take down the Flash IC.

I was sure that the flash is O.K. and swap the IC.

This was the only thing i made.

And... it powers up !

The GSM have an indicative & the protocol too.

I think I have to make a ROM update but, no ... the WM6 boots well ...

I put the GSM card in and all is workin well.

And the conclusion is DEAD FLASH IC!!!

I have one more HERM with the "No GSM" issue. Will try something.

B.R.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
woah!!

Hi meshuggah!

Wow, that's crazy stuff. My respect and congratulations !!!

As i said, didn't believe that this is possible...

Seems that the chip was in good shape, as you took it off from the board.

No problems with the ball grid?

Anyway this is a task for specialists, would be nice to find an easy way to reflash this part of flash or similar.

This is really amazing :D

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] nuttapung:
how to flash GSM

scholbert

My hermes it No GSM please help me
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi nuttapung!

Sorry i can't help you!

There are many reasons for no GSM issue. Please have a look around.

You will see many different reasons, the successful fixes are very rare.

All i can say it could be hardware or software.

If it's hardware you could try to heat up the Samsung flash part of the Qualcomm chipset or try to resolder it, the way meshuggah did it!

If it's software related, you could try the solution that are already described in the wiki.

If your radio ROM bootcode is bricked, there's no solution for this right now.

If you don't know what i'm talking about, there's only one solution:

Read all the dedicated threads and look around for technical background.

We don't even know if we may talk to the Qualcomm chip using JTAG.

It's not proven, so check this out first.

If you are good programmer you may find a solution :D

I won't, because i stopped working on these issues.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] meshuggah:
Hi Scholbert,

Refer what I already made on device :

change the SPL to Hard SPL 2.10 oli - w/o problems

update the ROM 3 times : WM6.1 ; 2 X WM6.5 - w/o problems

update the radio ROM to 1.48.00 - w/o problem

The electronic is hobby of mine, I'm bank officer, but the BGA I like :-)

It would be problem with the QC , because of the missing stancil for this type, but for the Samsung Nand I'm well equiped :-)

Anyway, I think there is no software restriction different from the update procedure to write in the QC flash. The only reason I think fot this "No GSM" and unable to flash the NAND is broken connection or dead IC.

I'll try to prove my words. I'll try to solder a new empty NAND and after that I'll try to write full stock ROM and I see what I get :-)

The issue now:

IPL-1.40

SPL-2.10 oli

"No GSM"

Booting WM6.1 well

info 2 - answers

What I'll try:

1. Rehot the Nand of the QC

2. Rehot the QC

3. solder a new Nand K5D5657ACB

4. Report !!! :-)

Gruss Dich

mfG

George
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Yeah, very nice!

Maybe this will be also useful for others, unless they are able to follow this technical excursion :D

I'm looking forward to the report!

Danke ;)

scholbert
[8525, TyTN, MDA Vario II, JasJam General] devilgenius:
I have some questions....

I have a Hermes200 Bricked phone, the bootloader is not working so.... i want to TP it.. but i don`t get something...

1. I want to do this with an unbuffered JTAG cable. (but i don`t know where i need to put VCC and Ground).

2. After i solder those Test Points and i connect them to the JTAG Cable and then plug the cable on the PC, i need to reassemble the phone or just connect the phone battery?

Sorry for my bad english :)

Thanks in advance ! :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
No problem here i am :D

Could be many reasons for this...

If you choose the unbuffered ones no need for VCC. The Ground connection should be connected to the phones ground. You may find the assignment in the first post.

There's no need for a complete assembly, if you're able to attach the battery in a proper way, it's O.K.

You'll need to press the power button for 2-3 seconds afterwards, because the logik needs to be powered up and supply the CPU.

Also i seems that still nothing happens, there should be some life in your device to use the JTAG interface. To get 100% sure you may measure at the VCC pin. There should be something around 3V...

No problem with that. Your english is fine!

Maybe you could tell what happened before. Did you brick the boot area in any way?

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] devilgenius:
I did the Test Point ... but i don`t know what to do now ... because if i power on the phone goes in bootloader (HERM200 IPL-1.04 / Herm200 SPL-2.10.Olipro).

Now i need to flash an ROM ..right?, but i dont know what type i need (Shipped or Cooked? / and if i chose Shipped, what version do i need ?

Thanks in advance! :cool:

***********

The JTAG process :D

LE: I flashed an cooked ROM and now i don`t have the NO GSM Problem ... YUPPY :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi devilgenius,

seems that you solved the issue!

Some more words on this... (This was not clear before :D)

As long as you reach the bootloader mode, there's no need to use JTAG and reflash bootcode.

So i think you reflashed the firmware to the device with some "standard" flashing procedure.

To flash the OS by JTAG is not recommended, main thing is that is will quite need some time to put everything in place :rolleyes:

Congratulation for your successful recovery!

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] brewhoxs:
Is there any chance or any other way to fix Hermes No GSM without this JTAG pins flashing methods? Cause it's too risky for beginner user! Any other way?
[8525, TyTN, MDA Vario II, JasJam General] Exeland:
Hi! Sorry for my English, I'm Russian. I have a question. Where can I buy Nand Flash in Russia?
[8525, TyTN, MDA Vario II, JasJam General] Yomarshal:
i understand one thing

i have dead hermes and i want use jtag start program msp_2442 cpu detected

i start cmd and write c:\jtag\Msp_2442.exe \c:\jtag\loader.bin and dont work wrote me

Error: Uknown option c/ is detected

s3c2440x......

i select function 0 and nex write me :

Error: Source file name is not valid

pls where i copy loader.bin(isplspl) i look for others and everybody wrote /f :xxxx.bin

pls help
[8525, TyTN, MDA Vario II, JasJam General] Yomarshal:
Problem is repair

one problem is repair i have next problem

k9fig08 NAND FLASH JTAG PROGRAMMER

EPGIO A VALUE = 0xf202

EPGIO B value = 0xffa0

ERROR: K9f1g00 is not detected. Detected ID-0xffff.

anybody help me
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
If i understood correctly your CPU has been detected successfully :confused:

Please have a look in the first post again...

If you still got trouble, recharge your battery in another device, insert fresh battery to your bricked device and repeat the steps described in the first post.

You may also check your cable wiring again.

Good luck!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] konker:
Hi meshuggah,

What type of tools did you use to reball the BGA chip back onto the motherboard?

Is that chip hidden inside the shield near the battery connector just under the HTC adhesive label?

Reason I asked is that my phone is experiencing the No GSM problem intermittently & I suspect that it is some loose/broken connection that needs resoldering.

Typically, when I get a No GSM situation, I'd remove the battery & press hard at the area above the shield just in front of the battery connector. That usually solves the problem.

Will it work if I use a heat gun at a preset temperature (what would that be?) to reball the BGA chip?

Please advise.

Thanks!

Konker
[8525, TyTN, MDA Vario II, JasJam General] DmytroL:
When I was describing the (very same) problem with my Hermes to the service technician this morning, I mentioned reballing the GSM chip. What he replied was "actually, there's a number of chips scattered over the motherboard that provide the GSM functionality" - so, while you approximately know the location of the problematic chip, you might actually need to reball several ones.

BTW I wonder if the aforementioned NAND chip located right above the battery?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

Of course there are a lot chips responsible for the GSM, but the base system is build mainly around two chips.

Have a look at second post and extract the attached zip file

http://xdaforums.com/attachment.php?attachmentid=138571&d=1229686557

The NAND chip, that stores the radio ROM is the black one.

The baseband processor is covered by the pinout in this pic.

No need to reball these chips for a first try!

Try to heat the chips up and use some soldering fluid. If there are broken balls, they sometimes resolder this way.

I once did succesful revive a device this way

Please take care of all these tiny capacitors and resistors!! You may blow them away easily with your heat gun :D

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] dvdaio:
made my Jtag for my p3400 before and i revive my phone and now i have hermes and it

made my Jtag for my p3400 before and i revive my phone and now i have hermes and it have no gsm my phone boot ok on windows but no imei no gsm and i want to know if the jtag correct this problem or not and i want a picture of jtag to made a new board for my jtag and i wnat to know where is the points on the LPT connector to solid it and is ther any way to repair my phone i hva enow IPL 1.4 and SPL 1.40 Olipro can i fix my phone with this bootloader version or not

i mean i need a simple jtag the resistores that i must connect to jtag interface this points i didn't undersatnd from the PDF manual

dvdaio@hotmail.com
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi dvdaio,

uups i know it's a bit late, but maybe you read this...

The JTAG solution is to reflash SPL only.

There's no solution to rewrite radio ROM via JTAG yet.

Development on this topic has also stopped. Anyway you may find a lot of useful information about the noGSM issue in this thread and all over the forum.

So please have a look around to find a possible solution for your device.

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] virhan:
74ahc541 n 74ls541

I ca not get 74ahc541 and 74ls541, can I subsitution to other type??please help me
[8525, TyTN, MDA Vario II, JasJam General] MindMad:
hi

thank you for this thread

now Nand_wp = 0 V

what can i do now
[8525, TyTN, MDA Vario II, JasJam General] MindMad:
Thanks a lot for your help

I flashed my IPL/SPL and now my hermes is working again

Thank you again
[8525, TyTN, MDA Vario II, JasJam General] Fenoli:
Hi everyone.

I was given a broken HTC Hermes 200. It hangs while booting (completely white screen) most of the time, DHCP doesn't work when connected via usb. I had it showing the HTC logo once when booting, but it was really corrupted.

The phone was never flased from what I know, it's probably an hardware fault.

The thing is, I have to recover a SMS draft, and I don't know how. I tried two forensics tools (mobiledit and oxygen) but they cannot connect to the phone.

So my question is: could I, using the JTAG, access the memory area where SMS drafts are stored? Is there a better solution to my problem?

Thanks ;)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Uuuh, weird stuff...

You may first need to know where the drafts got stored.

If it got stored in Radio memory this JTAG solution is out of scope.

If it got stored in NAND memory of the Samsung CPU subset, there's a slight chance to get it, but it's a freaky way :rolleyes:

Apart from that, reading out 64MB NAND with LPT adaptor takes very long time.

So it would even be better to know in which part of NAND the user partitions got stored.

With JTAG you only do raw memory dumps, so the next challenge would be to extract the file from raw binary data.

IMHO i would try to search for another solution....

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cool_connor:
Hello, i have an hermes "radiobricked" i want to try this as solution...

my herm just stucks in boot screen with a "no gsm" message.

Im an electronics tecnician, but theres no "schematics" about the jtag cable, only a few indications.

Can specify which resistors are needed?

in which pin, which resistor?

what you mean with "TDO" "TDI" in your "schemes"? (sorry, im from a spanish speaking country, i dont understand these abreviations)

Lots of thanks in andvance!
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi cool_connor!

The solution presented here is for bricked SPL bootloader recovery only.

You may find a solution for your problem over here:

http://xdaforums.com/showthread.php?t=369434

Personally had success to solve a "noGSM" issue with a heat gun :p

In other words did a little re-work in the GSM area of the Hermes mainboard.

There's some documentation in thoose zip-files in the first post.

TDI, TDO are signals used on the JTAG interface.

See here:

http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cool_connor:
thanks! :)

Thanks for thaking time to answer and for the explaination...

i studied Jtag as "boundary test" in my college! xD i know Jtag with this name...

TDI = test data in xD (Entrada de datos de testeo)...

etc.

Just

Thank you! ^-^

now im triing what can i do whit this...

mmm about the heat...

i guess i have to reflash the radio rom in all the ways because i have a original radio rom problem (when the radiorom goes corrupt itself without a flashing process)

then i reflashed the radio rom...

and get an error, the flash process stucks on %22 xD

if i only heated the chip instead flash again the rom... maybe heat should work.

But i have a real flash problem now xD

:)

Again... Thank you!

(do you know which rom have kitl enabled?)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I'm not a lucky guy right now!

It's me again.

Unfortunately i damaged my favorite debugger yesterday. GRRRMBLL!!!!

There'd been a short circuit or something, due to wrong printer port setting.

Very sad!

So my experiments are stopped for a while.

Anyway i hope you will find some useful information and got an inside view of mobile gadgets reading this thread.

Of course i don't want to bother you out there, so if someone's interested i might post a pic of the WP-pin testpoint :D

See ya!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Infos!

Just to give you an idea of what i was speaking of in one of my last posts, have a look at this wiki page:

http://handhelds.org/moin/moin.cgi/HpIpaqRx3715Hardware

On RX3715 there's a dedicated pin to control NAND write protection.

Obviously on some hermes platforms (seems to depend on IPL or SPl version) the write protection seems to be disabled, in this case it is possible to rewrite NAND flash using JTAG.

Lucky bauner had done this succesfully!!

I just wanted to add this for completeness

scholbert
[8525, TyTN, MDA Vario II, JasJam General] sphynx88:
i tried following my steps and trying to search for the link where i found the manual but i couldnt find it anymore sorry for that. i open my browser and reached 10 or more tags hehe sorry
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi sphynx88,

If you're talking about the hermes service manual, this is no secret anymore and i already downloaded it some time ago. Unfortunately there's no schematic included.

If you got additional information about hermes hardware, please let me know!

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Blueangel69:
Hello all.

First im sorry to be posting in a Hermes Forum.

I recently tried to flash a HTC Diamond ROM Cooked on a Kaiser kitchen in my HTC TyTN II. So i killed it. Anything works.

But power is everywere as i opened it and tested with a meter. There is corrent on the mainboard,were i just centralised to find out that the problem is in the Mainboard.

Now.

1: Or i send it to repair and im going to be asked €360 for to repair it,wich i cant afford it neider many,many users and PDA Owners.

2: I can buy a device in second hand and maybe cheaper with a broken LCD,but i tried and im always outbided.

3: I can keep on searching for an consistent answere,till Mainboards are putted avaliable to everyone that owns a PDA and prices about repairing get cheaper"Dont think that will ever happend".

Im looking for some expert help here,please.

All of us that have a Dead or Bricked Device need more flexibility about getting the usefull devices to Personal,Professional life fixed.

Many ppl,like me,can apply a Mainboard to the device repairing it. But the problem is to find the Mainboards avaliable.

Please lets fight for this ppl.

I will keep on the strugle to have my HTC TyTN II working.

I just came to live in a new city,and now im lost cause i dont have a GPS and cant afford to pay the money required to repair the device.

Sorry to write so much.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Fix it ???

Hi Blueangel69,

it's sad that your device is broken :(.

Hope you will find another mainboard!

Fixing errors in hardware on these devices will become more and more complex.

At least you may try JTAG-tools to check wich parts are still working on your device.

This no easy task, but give it a try ...

;)

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Yudgin:
Hi Blueangel69,

you can create for help you new topic on the russian forum (it's meetings place for Recovery masters)http://pda2u.ru/forum/index.php?showforum=29

Use English :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Nice!!!

Hi Yudgin,

first of all congrats to all your friends at the russian forum for all that heavy work and recovering. Please consider to share some knowledge with all the reverse-engineers in this forum.

Perhaps you could help those guys with dead wizard and add some more details about the file to revive these devices.

http://xdaforums.com/showthread.php?p=2314357

Anyway i saw my files were published in that forum too!

http://pda2u.ru/forum/index.php?showtopic=298

Maybe someone could tell Medush, it would be nice to have a remark to this thread also (i don't speak russian).

Best regards

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Zonuna:
Help

Hi,

Can anyone guide me or pass me a links on How to enable an internal GPS on my phone, My PDA is HTC Jasjam. following is my config. (Device info)

Model No : HERM100

Windows 5

Rom Version : 1.20.305.3

Rom Date : 07/21/06

Radio Version : 1.07.03.10

Protocol Version : 32.41.7010.02H

ExtRom Version : 1.20.304.104

As i do not know much about my phone`s model or hardware I seek your Help
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Please focus on JTAG issues

Hi,

please read the wiki first:

http://wiki.xda-developers.com/index.php?pagename=Hermes_GPS_FAQ

Keep in mind, that this thread was opened to discuss issues related to JTAG or debugging the hardware.

Please read the forum or the wiki first for other hardware related stuff.

Join the discussion in the related threads or open up a new one :p

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] kubik1981:
Does anyone in here work on these for a living. I just went out and bought another 8525 because i my 1st one died. I had done no modding to it. Just put it on the charger at night got up in morning and it is dead. Nothing comes on not even charging lights. Can anyone possible fix this problem.
[8525, TyTN, MDA Vario II, JasJam General] scousemartin:
have you tried the battery out of your new one in your old one,might be just the charging circuit that has blown, there is a tiny fuse inside that could have blown
[8525, TyTN, MDA Vario II, JasJam General] Recoil989:
Good work Scholbert

i've got an bricked hermes [imate jasjam running IPL 1.04 and SPL 2.03] the Radio nand is corrupted. The OS is not working and any attempt to flash a shipped OS fails at the GSM poriton (+-11%).

Im am going to attempt this (for the HardSPL bootloader you attached IPLSPL04.bin) this evening. Im planning on using the Holly Gates' Schematics for the JTAG Dongle since the IC buffer is available here. Will let you know how it turns out.

Just a quick question though is the GSM.nb in bin format already as well or does it need converting? the reason i ask is that if i get the Hermes up and running with the HARD SPL bootloader and i am able to flash a custom OS only Flash onto the device the radio flash will more than likely still fail (will let you know) and i suspect the only way to recover is to JTAG flash a radio bin onto the chip. Does this sound right or am confused?

Thanks again for your awesome work (and Olipro, Pof and others that have spent so much time on this)

Regards

Recoil