[G1 Android Development] bart9984:
Ok guys,

what are you doing with jtag is amazing. The video is also a good proof that it could work :)

I don't know anything about jtag at the moment (and probably also in the future :) ), so the only option for me is software debrick or at least send the phone to you and pay for a recovery :D

I've just finished a python script that let to write on the Ram of the phone without download mode,using only diagnostic commands. It's slow (about 14 sec for upload 2048 bytes) but python itself is slow and maybe in c will be faster.

But It's not a problem for me i think.

I've tryied it, then using save memory functions of QMAT/PSAS I've checked data integrity and it works properly :cool:.

So at the moment I can load binary data to ram... well now how can I execute it? well, I have no idea... any suggestions?

How viperBJK said: sending a patched spl to ram and executing it it's possible to reflash the phone

I attach the scripts, the most problematic part was to calculate proper crc (thanks toLammert Bies http://www.lammertbies.nl/ for his work ;)).

The code is a very ugly code, really, but its all i need to load data to ram.

PLEASE pay ATTENTION using this script, I really don't know what can happen to your devices if "good" memory is overwritten, people that doesn't know what is doing (like me :D) its better you don't use it...

how it works?

here an example:

tested on a win32 machine, should work on linux too

1) First open the file and change the SERIAL_PORT value to the one you use to access your phone.

2) second put your mobile in dignostic mode, here how to do it:

open mtty.exe

boot the phone in blue led mode (trackball+power)

type GO2AMSS+enter to enter AMSS

after "at command interpreter ready" is displayed on mtty, type AT$QCDMG+enter to enter dignostic mode

at this point exit mtty and run my script

3)Running the script result in a 'basic' command prompt:

the commands avaibles are:

"!q" or "!quit" to quit the script

"!c [hex values]" to send raw command to the phone- example "!c 00" will execute the command code 00

"!a [str]" to send a string+0xd to the phone (can be used in AT mode but it's not a good option, it's better mtty :) )

"!sendfile [filename] [addr]" that is the function to write filename into the ram starting from address addr

To estabilsh a valid address I used PSAS ->Hardware Forensics->Use mobile ports-> diag port (QC) "Get HW Details" button, it says :

Memory Dump supported, starting at : C0000000

and in effects i can write memory from that address

here an example of use of the script (I'll upload only a 32 bytes file filled with all 0xff)

$>python serial_diag2.py
--------------------serial_diag

opening port
ok
>!c 00
sending raw data + crc + 7e
sent:
0078f07e
read:
0 41 70 72 20 32 32 20 32 30 30 39 32 32 3a 31 33 3a 31 32 44 65 63 20 32 39 20 32 30 30 38 32 34 3a 30 30 3a 30 30 53 44 43 41 41 4c 5a 4d 0 0 74 0 0 0 1 70 94 10 7e
Apr 22 200922:13:12Dec 29 200824:00:00SDCAALZM
>!sendfile 1.dat 0xc0000000
bad address
>!sendfile 1.dat c0000000
[192, 0, 0, 0]
ok at addr: c0000000 read: 
ok at addr: c0000008 read: 
ok at addr: c0000010 read: 
ok at addr: c0000018 read: 
sent: 32 bytes in 0.17675742995 sec
>!quit
port closed

Cheers,

bart99