yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] jimyx17:
Hi!

I've just finished to build my own serial cable and I reach something... different in my HTC G1. This is what I get in normal boot:

And this is what I get in blue led mode:

Ey!!! Where is my oemspl???? I think my nand partition table is corrupted, so I cant access to oemspl. I guess my only hope is a fully JTAG solution. I'll continue my research.

Thanks for this realy interesting thread!!!
[G1 Android Development] ezterry:
Did you power the serial wire (include the +5v wire to pin 1)?

I've had problems with oemspl starting when its running battery charge code..

2 solutions:

1 - disconnect the +5v wire..

2 - enter blue light mode then plug in serial wire.

If hboot works for you.. you can also run 'rtask a' or 'rtask b' to switch from the oem hboot serial commands to oemspl/amss command line.

Enjoy the hacking.
[G1 Android Development] scholbert:
Hi jimyx17!

Seems not to be a total brick.

Have you tried to enter fastboot mode?

Though this is only possible with engineering SPL or Hard-SPL...

Regards,

scholbert
[G1 Android Development] jimyx17:
It works!!! Ok, now I can access to the oemspl!!

No, hboot doen't work for me, so I'll keep playing with the serial.

Thanks again!!!
[G1 Android Development] gymmy:
Ok I have spent all night tonight going through roms gathering AT commands here is what i have found :)

AT+CMEE=1

AT+CRC=1

AT+CR=1

AT+CREG=1

AT+FCLASS=0

AT+CMGF=0

AT+CSCS="HEX"

AT+CSSN=1,1

AT+COLP=0

AT+CCWA=1

AT+CMUT=0

AT+CLIR=0

AT+CNMI=1,2,2,2,0

AT+CGREG=1

AT+CUSD=1

AT+CPPP=1

AT@v;+RADIOVER

AT@v;+RADIOVER

AT@HTCCSQ=1;+ENCSQ=1

AT@HTCDIS=1;@HTCSAP=1

AT+CREG=2

ATE0

AT+CSCA?

AT+CGSMS=%u

AT+CPPP=%u

AT+GTKC=%u

AT+HTCAGPS_AUTOCS=%d

AT+HTCENS=%d

AT+GIMG=%u,%u,%u,%u

AT@HTCDORMANCYSET=%u

AT+CGEQREQ=%u,%u,0,0,0,0,2,0,"0E0","0E0",3,0,0

AT+HTCmaskW1=%u

T+HTCmaskW1=%u

AT+HTCmaskW1=%u,%u

AT+HTCCNIV=%u

AT+HTCCTZR=%u

AT+HTCAGPS=%u

AT+HSDPA=%u

AT@ICF=%u

AT@HTCPDPFD=%u

AT+CMEMFULL=%u

AT+3GNCELL=%u

AT$FTM=%u,%u

AT$FTM=%u

AT+GTKT=%d

AT+GTKD=%d

AT+CMUT=%d

AT+CSSN=%u,%u

AT+CMGW=%u,%u

AT+CMGD=%u

AT+ENCSQ=%u

AT+BANDSET=%u

AT+CLIR=%u

AT+CPBS="%s"

AT$VTS=%c,%c

AT+VTS=%c

AT+CNMA=%d

AT+CMMS=1;+CMGS=%d

AT+CMGS=%d

AT+CREG=%u

AT+CFUN=%d

AT+HTCAGPS_AUTOCS?

AT+CSAS=%u

AT+CSAS

AT+CSCB?

AT+CGAATT=2,2,0

AT+CGAATT=2,1,1

AT+CGAATT=2,2,2

AT+CGAATT=0,2,0

AT+CPMS="SM","SM","SM"

AT+CMEMFULL?

AT+Q3GNCELL

AT+Q2GNCELL

AT@ACOUSTICINITED

AT$3G_DL_TF_COMB_ST_3?

AT$3G_DL_TF_COMB_ST_2?

AT$3G_DL_TF_COMB_ST?

AT$3G_RESEL_EVENT?

AT$3G_AGC_STATUS?

AT$HSDPA_CQI_STATUS?

AT$3G_UL_RLC_AM_ST?

AT$3G_DL_RLC_AM_ST?

AT$3G_UL_TF_STATUS?

AT$3G_DL_TF_STATUS_3?

AT$3G_DL_TF_STATUS_2?

AT$3G_DL_TF_STATUS?

AT$3G_BLER_STATUS?

AT$3G_NEIGHBOR_ST_2?

AT$3G_NEIGHB

AT$3G_DCH_STATUS_D?

AT$3G_DCH_STATUS_M?

AT$3G_DCH_STATUS_A?

AT$PRACH_RACH_INFO?

AT$L3_RRC_SIGNAL?

AT$WCDMA?

AT$3G_RESEL_STATUS?

AT$3G_RESEL_PARA?

AT$2G_RESEL_STATUS?

AT$2G_RESEL_PARA?

AT$AMR?

AT$GPRS?

AT$GSM?

AT$FTM?

AT+CMUT?

AT+BANDSET=?

AT+CLIP?

AT+CLIR?

AT+CPBS?

AT+SIMTYPE

AT@SDLOG?

AT+CGSN

AT+CIMI

AT+COPS=?

AT+COPS=3,2;+COPS?

AT+CGREG?

AT+CREG?

AT+CSQ

AT+CLCC

AT+CPIN?

AT+GTKR=%s

AT+GTKE=%s

AT+CSCB=%d

AT+CSCB=%d,"%s"

AT+CSCB=%d,"%s","%s"

AT@SIMLOCK=%u,%u,%s

AT+HTCNV=%u,%u,%u

AT@SYSTEMTIME=%d,%d,%d,%d,%d,%d

T+CHLD=%d%d

AT+CHLD=%d

AT+CPIN="%s","%s",%s

AT+CPIN="%s","%s"

The most interesting are

AT@SIMLOCK=1,%x,%s

[RADIO_ERR] >Enable SimLock %x error!

AT@SIMLOCK=2,1,%s

[RADIO_ERR] >Add Network Code error !

AT@SIMLOCK?%x

[RADIO_ERR] >List SimLock Code %x error!

AT@SIMLOCK=3,%x

[RADIO_ERR] >Clear SimLock Code error !

AT@SIMLOCK=7,%d

[RADIO_ERR] >Set Security Flag error !

AT@SIMLOCK?AA

@secu_flag:

[RADIO_ERR] >Get Security Flag error !

@secu_flag:

AT@SIMLOCK=9,%x

[RADIO_ERR] Unlock SimLock by SmartCard NG

AT@SIMLOCK?40

AT@IMEI?

There is also a heaps i other commands which i cant try as i dont have a security unlocked device... some checking the arm11 so here they are would be interested in someone trying these of course not in the AT-Command console

A11S_CLK_CNTL

A11S_CLK_SEL

A11S_STANDBY_CTL

A11S_TESTCLK

A11S_CLK_ROOT_EN

A11S_CLK_ENABLE

A11S_CLK_INV

A11S_SLEEP_EN

A11S_CLK_STATUS

Hope this is of help :)
[G1 Android Development] scholbert:
Hi gymmy,

great work!

This is the most comprehensive list of AT commands i've seen so far.

Though it is not documented could be quite helpful :D

BTW, could you give some details in which part of code you found it?

I'm pretty sure there the AT commands were not stored as ASCII in radio ROM.

At least i looked for it quite some time ago....

EDIT:

Maybe someone should add this to the wiki!

Thanks a lot!

scholbert
[G1 Android Development] gymmy:
I downloaded a HEAP of roms fro all over the place, ran then through strings and concatanated them into a 22meg text file, and just slowly picked my way through.

The @simlock commands were used with hardspl.img to get security and supercid which unlocks the phone well for the hero anyhow, so im going to work on this... this would bring a lot of us into the same playing field with security off phones to play with...

One step at a time, IM Pretty sure that one of the rom images i have hasnt been packed (opps) so there are a HEAP of other commands in it also but not sure if they work on an s-off phone...

This has become kinda fun , so might see if i can get a hold of some hardware to RevENG some of this not too sure if i can find something that will allow this on a non-arm processor.
[G1 Android Development] scholbert:
Hi gymmy!

Aah i see... in the meantime i managed to get some useful disassembly of parts of the radio. Also found parts that belong to the AT commander.

But it's too early to give details here...

BTW this is a bunch of code :o

Would be nice indeed...

Already started some investigation about it.

Notinhg worthy to report though :rolleyes:

Your welcome :D

scholbert
[G1 Android Development] anthonws:
Hello guys,

Not being very proficient in electronics :P (shame on me)... where could I buy a serial usb cable for MyTouch/G1?

Thanks!

Anthon.
[G1 Android Development] gymmy:
what are you using for your disassembler ? I use IDA Pro for ATT and x86 but would be interested in what people are using for the ARM ?

A.
[G1 Android Development] lbcoder:
objdump

...
[G1 Android Development] bart9984:
:D

I want to be the first to congratulate with you :)

That's really amazing!!!!!!

:D

Confratulation again my friend

bart99
[G1 Android Development] gymmy:
great work there !

Now to see if we can do it through just the serial console !! :) i might even strip down my magic tonight and have a look for the jtag points i even got the microscope out hahaha... im such a g33k !

Gymmy.
[G1 Android Development] Sleeepy2:
Nice Job.

You guys Rock.
[G1 Android Development] gymmy:
did a bit more playing with the phone this evening and decided to download qpst and see if i could get it to communicate with it. I managed to get it to work... but you have to put the phone in AT Command to do this, it then finds the phone, you can download the NV ram and do quite a few things, but if you try and put it into download mode it resets the phone and of course it gets stuck on the main splash screen :( to which you have to place it back into the AT Commander to get it to recognize again.

If there was only a way to change the arm11 mode 3 to something that would allow it to boot !

Anyhow this weekend i will completely disassemble the phone to see if i can find the jtag points.

One thing that i did notice was that qpst calls the AT Command mode "debug mode" just wondering if this is used instead of the jtag mode. ill see if u can set something up to sniff the commands that qpst sends to the phone and the commands tomorrow

Keep up the great work guys

G
[G1 Android Development] scholbert:
Impressive!!!

Hey ezterry!

Congratulation to the first successful and amazing un-brick!!!

Very impressive and a real nice hack :D

Though this will need some skills, no expensive environment is needed.

Thanks a lot for pointing that out.

I spent the last days on tracing some signals on my hardware to solve my weird trackball issue and it seems that i found it. Could be also helpful for someone, so i will give some details about it later.

Concerning radio ROM AT interpreter:

While disassembling some areas of the ELF file, i found some promising functions that are stepped through while starting up the AT command interpreter.

Though this needs more reversing, it's obvious that there's an area in RAM at 0x1ffc0000, that is one of the keypoints for the device identifying itself as sec-locked or not.

Whatever...

It's really nice to see some new faces joining in and help out to lift the secrets of the HTC Dream.

This phone is a real nice playground and will become even more open with these hacks ;)

Keep on hacking!

scholbert
[G1 Android Development] G1Hope:
Yay! A working unbrick! EXCELLENT news!

Apologies if I'm missing some info from the (very) long thread now -- and if other people have reflected on this already from the other relevant threads -- I'm having trouble keeping track of all the data.

So it looks like the big obstacle now for duplicating this for JTAG-less unbrick is getting arbitrary code execution from the serial console. If we can somehow just execute ONE write to unlock security in oemsbl, we can then do pretty much everything else to perform the unbrick.

So here's the question....

For a couple of years (msm7200-based) Kaiser/Tilt users have been able to recover from completely *blank* SPLs using only a security-locked oemsbl!

jockyw2001's tool "FrankenKaiser" (also on these forums), which from what I can tell forces the in-memory oemsbl into security unlocked mode (which you can then use the command line from to patch its settings to be permanently unlocked). There are no details I can find about how the exploit works, just that it is specific to a given radio ROM, so I assume it's offset-specific arbitrary code execution. No idea if it's trying to use radata or commands in AMSS to make it work... ...but supposedly it works from a system running ONLY oemsbl with no other valid flash needed?

Once you're in security unlocked mode, you then use your elevated powers to permanently patch it to unlocked. On the Kaiser oemsbl apparently it's just a matter of writing a grand total of 96 bits to the appropriate offsets:

(cut and pasted):

---

mb 9de8bc => dump HTC security area

mw 9de8bc 1 31313131 (replaces first half CID by SuperCID "1111")

mw 9de8c0 1 31313131 (replaces second half CID by SuperCID "1111")

mw 9de8e4 1 00000000 (Sets security flag to 0, sec unlocked)

mb 9de8bc => dump HTC security area again and check if CID and security flag are modified in memory

---

And then "setinfo" to dump it into nonvolatile storage. o.O;;; Is it really that easy to make it permanent?

So the *BIG* question is -- can we figure out what exploit FrankenKaiser is using and see if it still works in the oemsbl in our Dreams? Once we get security-unlocked, we can easily duplicate the JTAG unbrick just performed by patching the cego command in memory to do the extra write (instead of having the jtag debugger do it by freezing cego mid-execution).

Beyond that, for systems with completely destroyed SPL flashes, we can probably leverage the knowledge of people who've made SoftSPLs for other qualcomm-based HTC devices to figure out the details of modifying the Dream's HardSPL into a SoftSPL.

Any guesses?
[G1 Android Development] ezterry:
Yes a good update.. too bad I fried the original main board beyond such a repair

Specifically of a device that at the time of the bricking is security/CID locked

So from what I see FrankinKaiser (and I've had a good long look since I've bricked my original dream) it loads a hacked SPL via radata either via radata which apparently won't boot an os but will let you tweek the radio oemspl and flash. Then you re-flash a working spl

The partition table on the kaiser or the magic values expected by radata are different and the tool encodes only 2 block SPLs.. we have 4 block SPLs. So mimicking this has been hard.. but if I don't fry the unbricked phone I can work in the debugger with it via jtag so with luck this can be overcome.

From what I saw yesterday our 2005 SPLs are by default security unlocked and allow memory access so we can probably use it to security unlock our phones as is. If you can boot into the SPL. We may yet need a slightly hacked one for stuck in boot mode3.. as I modified mine in ram with the jtag hack.

The quoted memory values look like oemspl globals offset will change on each radio build.. I was noting setinfo.. this is a bit of a scary command to have access too if its help statement is true.. this is likely how they set the CID originally. So yes it ought to commit the secure block.
[G1 Android Development] lbcoder:
Killed one to save... thousands? That seems like an acceptable ratio to me ;)

If this could be pulled off, it would *REALLY* put a smile on the face of anyone with a robbers phone....
[G1 Android Development] bart9984:
We could try to ask jockyw2001 to join the discussion... :)

but from what i read from the readme it need a security ulocked device,so I guess it doesn't force the device in security unlocked mode...
[G1 Android Development] sangeet.003:
Congrats to The De-brickers & Thanks A lot...

Hope to get an more easy Read me with Images soon....

From what i had read b4 frm older posts, the Haykuro SPL (2005) already forces the Device to security unlocked mode.....

Edit Added The Quote....

so its like if you have bricked using H-SPL(2005) you already have security unlocked device.... i even had an HTC Touch Duel Security unlocked flashing some Kaiser Radio OR SPL.... so its all Dependent on Radio N SPL....

Conclusion : If You Bricked by Radio/SPL in-compatiblity, you already have an security unlocked device....

correct me if m wrong...
[G1 Android Development] lbcoder:
That sounds about right.... but you can't assume that the SPL in use is actually the (no-longer)deathspl. There are plenty of possible radio/spl combinations that could result in a brick, including ROGERS NEWEST SPL, which is locked up the wahzoo. Another possibility is a BAD SPL FLASH, which could result in a BLANK or PARTIAL SPL (i.e. result from power loss or crash during procedure).

This avenue also opens up the possibility of getting an engineering SPL onto the device ***WITHOUT ROOTING***, which would solve the ROGERS LOCKDOWN PROBLEM.

Note: One thing that can still go wrong that as-yet can't be fixed is a bad RADIO flash. Having a blank/broken/partial radio is still a brick, though I haven't heard of a single device that this has ever happened to.
[G1 Android Development] ezterry:
Not quite, the security lock is still enabled in flash so if you boot into blue light mode it will still be security locked.. however the oem bootloader command line ignores the lock like the oemspl after applying the cid bypass.

This means if you switch spls you will loose super cid.. a true securit.y unlocked devoce has access to the commands even on perfected spls.
[G1 Android Development] LeonardoFloripa:
Impressive indeed

Kudos to the geniuses in this forum.

In no time I think we will start seeding happiness all over the nets..

:):D;)
[G1 Android Development] t0mmy:
i dont have a brick, but this is quite an impressive job. keep up the good work
[G1 Android Development] Ohsaka:
Anyone have a bricked phone they want to sell? :)
[G1 Android Development] scholbert:
Hi!

Though i did not reach the step like ezterry did (simply got no soft brick :p)...

Count two, because mine died during extensive experiments

Anyway the progress of this thread is awesome... and it's worth all the time.

True, with deeper knowledge on the radio, anything could be modified...

...this also opens the door for illegal activities :rolleyes:

So we should be a bit careful what to post about IMEI and stuff.

True, the hack in thoose SPL code is only preventing the phone to check for CID during normal boot process. But it's still there of course and is checked by other parts of boot code (e.g. radio bootloader)

Though already stated... AFAIK, it should be possible to rewrite some volatile parts in RAM temporarily and use setinfo of radio bootloader to store it permanently in protected sector on NAND (e.g. procedure used for Hero).

First it would be nice to know which mod at the volatile sectors got which effect of course :p

Cheers,

scholbert
[G1 Android Development] lbcoder:
So from what I gather, the cid bypass basically jumps past the if(supercid) part of the security code and enables what is essentially radio-root.. right? Like taking the supercid by booting your kernel in runlevel 1 rather than by guessing the password...

Edit: never mind what I erased. There's too many different bits in the radio, I got confused between them.
[G1 Android Development] ezterry:
More like recoding the access control code to assume everyone has root access regardless of user id.

The bypass changes a beq instructions to just b. Thus changing an if(security on) to an if(false)

The spl patch is updating a switch lookup table to point model 3 at fastboot/ruu code

Just fyi fastboot and ruu mode are esentially the same however ruu sometimes has more permissions.

--------------

OTP-IBL

-initial boorloader rom on cpu no ui (some public keys however)

Qc-boot

-radioboot code. No ui

oemspl = blue light mode = radio bootloader

- radio commandline interface

Amss = at command interpriter

- radio interface primary function of the arm9

Oem = `hboot>´ prompt

- spl / android boot loader commandline interface

Spl also has the sd card nbh interface and fastboot/ruu
[G1 Android Development] marxmarv:
In the 26i radio:

9038dc: e1a07000 mov r7, r0
9038e0: e59f0114 ldr r0, [pc, #276] ; 0x9039fc, int *s_flag
9038e4: e1a04001 mov r4, r1
9038e8: e5900000 ldr r0, [r0]
9038ec: e3100001 tst r0, #1 ; 0x1
9038f0: 0a000013 beq 0x903944 ; skip sig checks if s-flag off
^-- gets patched to an unconditional branch ea000013

; code here checks some (RSA-1024?) signatures on who knows what, if no match then print "Invalid command" message and return

903944: e59f60d0 ldr r6, [pc, #208] ; 0x903a1c, struct {char *name, char *unk, ((int *)(funcp))(...)} **commands
; for each item in command table, if strcmp then call function

The code that writes the s-flag in RAM for the SBL and SPL is around 0x90cb44.

BTW, ezterry, brilliant work!
[G1 Android Development] t_rob76:
Can you imagine Ezterry's face when he did this... i bet he peed, did the happy dance and shouted WOOHOO!! all at the same time (no doubt scaring his... i am guessing Labrador retriever.

anyway great job, now to try to brick my phone (or not):D
[G1 Android Development] sangeet.003:
I think its time for updating the Threads Topic & First Post !!!

& If Possible Providing Complete instructions of JTAG too...

Like How to hook all those wires up, etc....

Many Hardware NOOB's(Users) including me have bricked devices....

Sangeet...
[G1 Android Development] 3izz:
please revive my magic 32a

hi all

congratulations for the de-bricking of the G1

but when will the magic get a chance to come back to life ?
[G1 Android Development] scholbert:
As long as JTAG access is required to un-brick, someone needs to find/trace the signals for the Magic first.

Because this thread has developed the way it is, only binarydroid could do it.

BTW, anyone heard about him?

Regards,

scholbert
[G1 Android Development] 3izz:
A) a phone working with jtag ????

hi please please how to get JTAG I live in Israel and i bricked my magic 32a

will the serial itself help me
[G1 Android Development] igord:
gymmy is working on it.

You will have to wait for gymmy to trace the pin outs.
[G1 Android Development] lbcoder:
So hypothetically, if one were to run your procedure on a bone-stock locked-up-the-wahzoo robbers dream, would the fastboot/ruu *work* (i.e. allow you to 'fastboot flash hboot hboot.img' with, for example 1.33.2005? Or are further hacks along the lines of what you were trying to do when you smoked your chip required? Note: I'm under the impression that fastboot does its own independent security checks and that the cid bypass won't affect it... if that is the case, is it possible to do a similar bypass for the fastboot security checks? I realize that that would require addition analysis of disassembled code. I am under the understanding that the 1.33.0010 SPL actually *has* fastboot, but that it is simply crippled due to a lack of permissions.

Or in this circumstance, would there be a simpler way to rewrite the SPL given that the cid check is bypassed?

Do you know WHY your previous chip died so that we don't repeat? Would the cid bypass have prevented it?

Can we fix it from S-ON to S-OFF on a board, thus eliminating the need to ever cid bypass that particular device ever again and enabling all the fancy magic permanently?
[G1 Android Development] xaueious:
1)

So does this bypass the signature checks during fastboot or not? I'm not clear on this. This wouldn't be about unbricking, but more about getting Rogers phones back to a rootable state.

2)

Is there a way to sim-unlock using jtag?

3)

Continuing to follow this thread.

I haven't figured out how to do my own jtag, and my friend has a Magic 32B brick. But This can benefit a lot of people :)

I need to get myself a jtag. This one right?

http://www.olimex.com/dev/arm-usb-ocd.html

Can we set up a wiki of some sort now that we can kind of consolidate this information? CM wiki will probably gladly make room for this.