yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] BinaryDroid:
'

Hehe, well all i did was remove the shielding, removed the epoxy, used my IR desoldering machine and heatplate to take the cpu itself off without damaging anything, then reballed the pins on the cpu so i could reapply it once this is figured out. i was up most of the night on saturday, up until about 6:30AM sunday to get it done along with another smaller project i'm working on so I didnt get time to actually connect to the JTAG port. I did get all the pins traced, had trouble finding some as their not all on test points. theirs i think 2 that are attached to a resisitor near the test points...which i Beleive are the pullup resistors for selecting the Mode. I was late for work today so didnt have time to copy my information from my desktop. first thing after work its gonna be posted. its 2:15PM here, at around 9:30-10PM i'll have what you need posted, then hopefully we can all try and tackle interfacing. i'm not used to actually connecting to the ports, mainly replacing parts of faulty boards but I do have a buffered cable I made for doing this kind of thing, just hoping it actually works. cable seems too simple to me compared to what i'm used too. lol.
[G1 Android Development] LeonardoFloripa:
Wish you...

.. all the luck colleague.
[G1 Android Development] coolthecat:
Quick Question guys!

Ok, I have a paperweight at this point! The worst thing about it is that it's my sisters g1. I did this on mine and everything turned out great. I checked her bootscreen prior to flashing my SPL and it was the updated version. ending in 26I. So I figured there was no need to flash the radio. But alas I'm stuck at the tmo g1 screen. Like a good big brother I gave her mine! Until/If I get hers fixed or replaced I'll switch her back! BTW anyone got one for sell, if this doesn't work!:confused:
[G1 Android Development] ReverseEngineered:
Godspeed, sir. I have a freshly bricked one that I'd be happy to solder a JTAG cable to.
[G1 Android Development] dr.frankinfurter:
I love you.

Marry me? Seriously though, you are my hero. Hopefully you and r3nrut can piece together something nice for us helpless peons.
[G1 Android Development] BinaryDroid:
Ok I have a quick question, I didnt forget about you guys, I was up till 3am last night trying to find a better place to mount the last 2 wires so its doable at home with just a soldering iron. heres the problem, the Primary Jtag interface is completely done, traced to the easily accessible test points, thats 6 wires for the primary....now the secondary/auxilillary interface is were the problem comes in. the only place I found for the last 2 pins is next to impossible to get too for home users trying to fix the phone while the board is out.

I think I may have found something i wasnt expecting that might make things easier, im gonna verify it and work on the detailed writup with pictures. just a warning though, those that decide to do this need a steady hand and might need to build a small jig out of PCB and some tacks.

Please just hang on a little bit longer while i work on a better setup.

Also wanted to add, whats the reasoning behind not being able to use the primary interface? I dont know what the difference is, can someone break it down for me?
[G1 Android Development] kassy_ok:
if you pull this one off i will buy you 1x24 beer cans :D (trough paypal)
[G1 Android Development] R3nrut:
Oh crap. Sorry about that. :p
[G1 Android Development] BinaryDroid:
Hey R3nrut can you please give me an idea as why we cant use the primary interface? i have never used jtag before but have been looking to learn it to help with my work so i'm pretty much new to jtag, i've done pretty much everything else so i can follow any detailed explanations you can give me. if we could get the job done through that port users would not even need to take their phones apart to jtag besides the rear housing 1 shot deal.
[G1 Android Development] R3nrut:
I'll take a look at it tonight and see what I can find out. If all else fails I have a guy at work that has worked exclusively with JTAGs for years and can answer the question.
[G1 Android Development] ReverseEngineered:
I've read over what datasheets are available and I didn't see anything indicating that we can't use the primary JTAG port. Unfortunately, the actual datasheet we need (the one that describes the JTAG debugging process) isn't available to us. It's possible that there is a programmable fuse to disable that JTAG port, and it's quite possible that it has been blown at the factory, but unless HTC is replacing entire boards in their returned phones, I'd suspect they have left the JTAG port accessible so they can reflash it. Why not try it and see?

Of note is that the available datasheets do mention in the section on security, if the primary bootloader fails to authenticate the secondary bootloader from NAND, the phone goes into a JTAG debugging/download mode. Perhaps this is what happens when the phone hangs at the splash screen?

Unfortunately, none of the available datasheets describe why there are two JTAG ports. Especially since the primary port is a dedicated port, it doesn't make sense why they would add a secondary port.
[G1 Android Development] LeonardoFloripa:
Hm

Random mumbles about unknown subject mode on

Think this way, they're returning the broken and frozen units too easily. Should be it that the two jtag ports belongs to distinct parts ? Like one to SPL, one to Radio ?

Is there a way to know if they're reusing the units replaced ?

Is there a way to know if they can rewrite the IMEI codes on the units ?

Should the dreaded blue led mode has anything to do with some of these questions?

Random mumbles about unknown subject mode off
[G1 Android Development] BinaryDroid:
We think alot alike hehe, I read all the available information and came to the same conclusion, thats why i wanted to know if anyone had a specific reason we couldnt use the primary. also, its highly unlikely they disabled the jtag interface via the qfuse but that has crossed my mind, I know for a fact that the IMEI and SN on other HTC devices can be changed and many other phones as well but it requires special keys into the devices/chip. it would be illogical to replace the chip every time they require service or get bricked, theirs only so many imei's in the system, surely they would run out at some point if they didnt change them so my guess is the qfuse is not burned, or if its disabled its only disabling the configuration of the CPU itself which in the datasheet says even customers(HTC) cant change. theirs also information on the development board docs that say once the SPL fails to boot a red light comes on....this could be similar to the blue light on the phone itself. i'm gonna play around more tonight see if i can figure out how to actually get the software and hardware to recognize each other over the primary. if that fails i'll try secondary. its going to be DEAD simple to do this in the future if the primary works. I have a backup solution if jtag fails to work but its not something that can be done at home unfortunately

Note: sorry about run-on sentences and not spell checking, typed this in a couple min as i'm leaving work. i'm not giving up on this until theirs a way to recover all the bad phones.
[G1 Android Development] infernofalcon:
Your resolution is appreciated. Godspeed.
[G1 Android Development] ReverseEngineered:
Hey Binary, I don't mean to rush or bother you, but would it be possible to post the JTAG pinouts before testing the interface? I'd be happy to test it along side you, but I'd need to know the pinouts first. :)

No doubt the reason we think a lot alike is because I am an electrical engineer. I currently work with transistor-level IC design (actually, developing EDA tools for such designers), but I've done some stuff with microcontrollers and embedded systems, so I've played with JTAG and in-circuit programming before. Unfortunately, I don't have access to many fun tools like IR reflow stations and logic analyzers, but I can easily toss together a JTAG cable and load up an in-circuit debugger.

Thanks as always for your effort. Looking forward to good news.
[G1 Android Development] raptoro07:
I have a G1 (black) that I bought on Ebay. When I press power, camera+power, home+power, and vol. down+power, I get the same thing. The screen with the arrow coming out of the box going to the phone. I cannot get into bootloader or recovery. Now this: According to the person I got it from, it was only installing an OTA, not any other flashing. Is it possible that the phone is bricked from an OTA install, or is it not really bricked? I haven't tried to use ADB yet, but the best I can tell I can't get into fastboot so I'm boned.

Also, I contated T-mobile and told them my situation and that it was from an OTA, but they said no warranty on this phone, and I would have to send to HTC for out or warranty repair. Any suggestions?
[G1 Android Development] ReverseEngineered:
Raptoro, this thread is for figuring out how to recover bricked phones. Please ask whether or not your phone is bricked in another thread.

Try http://xdaforums.com/showthread.php?t=557091. It has a similar problem. Doesn't look like there were any solutions, though.
[G1 Android Development] dr.frankinfurter:
I am ecstatic about the activity this thread has been getting lately. Such knowledgeable people working to help.. keep up the good work guys!
[G1 Android Development] R3nrut:
I know this has been posted before, if not by myself than at least by someone else working on this project.

If anyone has any information on locating the following document, it would be greatly appreciated and will help to figure out a solution much much quicker:

JTAG Setup Procedure on MSM7500/MSM7200

(80-V9038-13)

File Format: .pdf

Thanks in advance!

*edit

I added this cry for help to my blog to reach a few more eyes.

http://r3nrut.com/?p=172
[G1 Android Development] Danny_man1990:
I tried this

I tried this and once i tried to boot into bootloader from blue light the light when out and now i cant even get the device to the G1 screen. anyone want the phone for testing?
[G1 Android Development] chev:
i dont really know if this makes sense but my trackball is stucked and whenever i restart my phone it gives me a blue led. I just keep on pushing the trackball and reset and it goes in
[G1 Android Development] BinaryDroid:
I could use it for testing the JTag solution on a device that is already bricked.....currently i'm trying to interface with my working phone. but i wouldnt want the whole phone, only the mainboard, keep everything else for spares or something. only if its the famous blue light mode brick though.
[G1 Android Development] Danny_man1990:
ok

what do you mean by that? i dont know much about circut boards. i got the phone fore free primarily because the plastic around the touch screen of my working G1 is cracking and the screen is coming out. i need to know if i can switch out the sliding touch screen and how. if you know where i can find instructions to do so it would help. as for the brick upon removing my SIM and SD card the phone will boot into the G1 splash screen but still no recovery or bootloader. if you can help that would be awesome. PM me or text at 17758152442 and we can sort out how i can get you the main board if you want it.
[G1 Android Development] brios86:
not sure if im bricked??? i CAn go into recovery and i can see my spl and everything but i cant pass G1 screen wipe reflash and wipe ext and still nothing stuck on G1 screen
[G1 Android Development] iPhone iWing:
danny and brios. what is your spl and radio? for brios sounds like you didnt finish your spl flash and you are on the edge of brick. danny, connecting the phone to the computer with cmd prompt open and boot the phone now type

adb shell reboot fastboot

hit enter now your computer should say "waiting for device"

now unplug your phone and take the battery out, now put the batt back in and connect the phone while its still saying waiting for device and boot it. see if it takes you to fastboot.
[G1 Android Development] brios86:
ok thankz for the response i knew i should of put that info in my sig well its

dream100 pvt 32b

hspl 10.95.3000

cpld-4

radio 2.22.19.26I

i am on

CM 4.1.9999

(iwas trying to flash the MLING hero rom and it said error line 80 like xbin/system <~~~ some thing like that

so i went to put back CM and there we go stuck i had recovery 1.4 but i manage to flash RA recovery trew recovery so i can try wiping ext patition and i did so but im still stuck i tryed the HRDSPL again but not sure if i did it rigth
[G1 Android Development] riasnyman:
Looks like we stuck for now

....

Hopefully some good news soon from you guys... I can't even return phone as it is on mtn network in sa... starting up with a t-mobile splash screen...::eek:
[G1 Android Development] BinaryDroid:
Bad news is that the primary JTAG port is unusable, it either has a burned Qfuse or the disable debug pin is shorted out from the factory(Logic Probe confirms this as well), that only leaves the secondary interface which is a pain in the butt to attach wires too. going to do that test tonight and report back. I could really use that missing documentation though. Their has got to be a way to get this working without those documents.
[G1 Android Development] kassy_ok:
damn..it was to nice to be true....keep up the good work Binary and let us know wht's gonna happen
[G1 Android Development] JonnyFlash:
has anyone tried

Has anyone tried accessing the phone with the Blue LED using a Terminal program (something like Procomm Plus) and a bluetooth connection as a modem/serial-connection. I'd imagine using VT-100 or Wyse 50 terminal emulation, 9600 Baud 8-N-1. Seems like it's supposed to be some kind of debugging mode of sorts. My phone isn't bricked, but for giggles, I rebooted my phone holding the scroll down. If you can access this way there may some UART commands to flash the hardware back to system defaults.

(btw, I skipped about 15 pages of posts before this idea popped into my head, so this may have already been covered).
[G1 Android Development] ReverseEngineered:
Was worth a try...

Thanks for your effort, Binary. It's unfortunate that the primary is no good, but even a functioning secondary will be better than nothing for those of us brave (or desperate) enough to try it. Still better than a brick, right?

Keep us posted.
[G1 Android Development] kid2escobar:
plz help me revive my android

my g1 will automatically boot me into recovery mode and it wont let me use any commands

it says E:cant open /cache/recovery/command

home+back doesn't function

alt+L does

alt+s doesn't

alt+w doesn't

alt+x doesn't

it wont let me even get to the camera+end function so that i can revert to rc29

is there anything i can do?
[G1 Android Development] LowLevelDesign:
Serial UART debug access to flash ROM's?

Has anyone tried plugging into the serial UART on a bricked phone? Qualcomm has an application (QPST) that can flash system images, etc, through the serial port connection.

If anyone has one of those HTC 11pin miniUSB breakout boards and a TTL level converter, it would be interesting to see if you can gain debug access on a bricked phone. I would assume that would be how the factory technicians do it, since there is no physical JTAG connector on the mainboard.
[G1 Android Development] ReverseEngineered:
From what BinaryDroid said, it looks like there is a physical JTAG port (not an actual connector, but testpoints), but that it's disabled in the CPU. During manufacture, the machines producing the boards can connect to these testpoints and program the CPU with bootloaders, then blow the Qfuse to disable the JTAG port.

By the looks of the HTC service manual, they never reprogram boards -- if the bootloader is broken, they just replace the board. It's entirely possible that we'll be faced with the same choice.

I can think of one alternative: other than the boot code that is built directly into the CPU (and, according to Qualcomm's docs, aren't programmable by the carrier), all code is read from external NAND flash. It would be a pain in the ass, but we could reprogram that flash chip. With such a small chip and so many pins, it would be nearly impossible to do without specialized equipment. I'm thinking an IC test clip would be needed.
[G1 Android Development] ReverseEngineered:
If you can get into recovery, you should be able to get into the bootloader. Can you get into the bootloader? If so, you should be able to replace the recovery, ROM, and everything else. It's probably jumping directly to the recovery because it detects the regular ROM is bad.
[G1 Android Development] ReverseEngineered:
Have you tried getting into that "blue light" mode (power on while holding in the trackball)? It does seem like a strange mode for the phone to enter and I also think it may have some bearing on debugging. Perhaps this affects the disable debugging pin?

Also, are you able to trace that disable debug pin? If we can find out if it's shorted and where it's shorted, it may be as simple as cutting a trace or desoldering a resistor -- common fix for modding consoles.
[G1 Android Development] ReverseEngineered:
Another possible complication

Without the right docs, it's hard to know for sure, but many systems will require some sort of authentication or other special code before they will enter a debugging mode. Sometimes this is as simple as an undocumented opcode, but for other devices entire authentication sequences with passwords may be employed. Perhaps this is why the primary JTAG port appears dead -- we haven't activated the correct sequence to enable it.

I don't know enough about JTAG to know if it has an authentication mechanism built in or not. Even if not, Qualcomm could have added its own mechanism.
[G1 Android Development] LowLevelDesign:
In looking over the datasheets, the hardware UART has direct access the the microprocessors (Baseband topics, page 55)... On a normal working phone you can access the debug functions through the UART using the special HTC 11pin miniUSB breakout.

http://www.instructables.com/id/Android_G1_Serial_Cable/

I'm curious if anyone with such a cable is able to get debug feedback from a bricked phone using one of these connections? If so, it may be possible to use Qualcomm's QPST diagnostic software to directly access the two ARM modules and re-flash them. This is what the software was designed to do, so perhaps it's what the factory techs intended to use for low level reprogramming, post-manufacture.
[G1 Android Development] lbcoder:
Thought:

Possible differences between ADP1 and consumer version.

One might think it possible that since ADP1 is produced for development/hacking, that there is a slight possibility that they are treated differently from the factory. We know that they come sim-unlocked and with a different bootloader, which means that there are differences at the initial programming/testing stage right from the factory. One of these differences (undocumented -- at least publicly) may be in the Qfuse. The marketing term is "hardware unlocked", which has an english meaning different from "network unlocked" or "root unlocked". Could this be what they mean? ADP1 not blown? Anyone with a bricked ADP1 interested in submitting for testing?
[G1 Android Development] kid2escobar:
no i cant get into boot-loader when i hold end and the camera button as the phone boots up it still just goes into recovery

THE ONLY THING THAT SEEMS TO WORK IS ALT-L WHICH IS TOGGLE DISPLAY :mad: :confused: :(
[G1 Android Development] lbcoder:
End?

You hold BACK and press POWER.

Start by unplugging and removing the battery (to guarantee full power off and refresh), put battery back in, press and hold BACK, then press POWER, keep holding BACK until it gets into fastboot.
[G1 Android Development] kid2escobar:
still wont do anything still going into recovery..... sigh:(
[G1 Android Development] ultma75:
why dont yall just buy phones off of ebay with broken screens or broken keyboards. just replace your working parts with the broken ones. simple fix ;)
[G1 Android Development] BinaryDroid:
Read the thread title, this is technical discussions on unbricking the G1, NOT replacing boards. you never know exactly what is wrong with busted ebay phones and they also can run from $40-75, the cable we need to do this will cost no more than 15 bucks at most to make for a buffered, under 8 bucks for non buffered which anyone here who can replace a motherboard can build a cable with just 5 resistors. were only missing 1 document to be able to get this done which i'm confident will be posted sooner or later. secondary JTAG interface does detect a chip so their is hope, if we had the right documents we could make it much simpler than soldering wires.
[G1 Android Development] lbcoder:
Still looking for the document listed in this post: (http://xdaforums.com/showpost.php?p=4796327&postcount=502) right?

Though it would obviously be nice to have that document, I think that ultimately, it is probably a "super secret" and we're going to have to just keep poking at it until it is figured out.

Do you think you could post the connection points you traced out for the secondary jtag port?
[G1 Android Development] BinaryDroid:
Wait, i didnt notice this post before, it says the one from the 7500 JTAg setup procedure will work also? I might have this already, i went searching for older msm chipset jtag documents but I did come across something but I did not think It was going to work due to different model. Maybe its possible they didnt change much in their JTAG setup? I'll have a look over it again when I get home. thanks for pointing the post out Lbcoder!
[G1 Android Development] ultma75:
LMAO! chill bro i was just throwing an idea out there lol no dis-respect. keep up the hard work
[G1 Android Development] uy4d:
Ok.. so I got my self a bricked G1 from my friend,

What I've tried:

1. Normally turn on the phone -> goes to TMobile G1 screen then blank screen

2. Recovery mode (Home + Power) -> same as 1

3. Bootlloader mode (Camera + power) -> same as 1

so basically everything that I did just sent me to a blank screen, I tried to connect it via USB, the devices didn't show up when I type adb devices or fastboot devices

another thing in common is, after it goes to the blank screen, i press the Alt+L button then it shows this message

"Android system recovery utility"

then I can't do anything, Alt+w, Alt+s didn't return anything...

does anyone knows how to fix this? or this thing just bricked for good..?

I don't know what's causing this, and my friend who owns the G1 didn't know too.. since he lend this G1 to his other friend and when it came back it's a bricked g1.. :mad: