[G1 Android Development] bart9984:
Hi sholbert,

yes my device is a Magic 32A.

For the download mode: I'm using qpst version 2.7 build 323. To enter download qpst and qmat/psas use a binary command (code: 3A) that is sent when the phone is in AMSS dignostic mode (start the phone in blue led mode, type GO2AMSS, then send AT$QCDMG command).

What you said about special binary code that is loaded to RAM is a function of QMAT. Intercepting the traffic on the serial cable I saw that to load a bootloader into Ram qmat tryies to put the phone in downloadmode (3A), then uses downloadmode commands to write to the ram (in diagnostic mode command 07 poke a dword, in downloadmode the commands all begin with 7E, the command used to write in dwonloadmode is 7E 07). I will post now a dump of what happens (in green my comments):

[COLOR="Green"]from blue led mode[/COLOR]
[COLOR="Red"]Com port open "mtty1[1].42.exe" (PID: 1992)

47 4F 32 41 4D 53 53 0D GO2AMSS.
[/COLOR]
[COLOR="Blue"]Answer:15/02/2010 15:28:25.84264 (+6.1230 seconds)

41 54 2D 43 6F 6D 6D 61 6E 64 20 49 6E 74 65 72 AT-Command Inter
70 72 65 74 65 72 20 72 65 61 64 79 0D 0A preter ready.. [/COLOR]

[COLOR="Green"]Switch to Diagnostic mode:[/COLOR]

[COLOR="Red"]Request:15/02/2010 15:28:31.65864 (+5.8008 seconds)

41 54 24 51 43 44 4D 47 0D AT$QCDMG.
[/COLOR]
[COLOR="Green"]ok[/COLOR]
[COLOR="Blue"]Answer:15/02/2010 15:28:35.26464 (+0.0176 seconds)

30 0D 0. [/COLOR]

Port Closed
[COLOR="Green"]Now i pass to QMAT[/COLOR]
Com port open "qmat.exe" (PID: 5092)

[COLOR="Green"]this command switch the phone in offline-d mode:[/COLOR]

[COLOR="Red"]Request:15/02/2010 15:29:09.82464 (+34.5605 seconds)

29 01 00 31 40 7E )..1@~ [/COLOR]

[COLOR="Green"]command accepted:[/COLOR]
[COLOR="Blue"]Answer:15/02/2010 15:29:09.82864 (+0.0039 seconds)

29 01 00 31 40 7E )..1@~ [/COLOR]
[COLOR="Green"]
Here I use the function by QMAT to load the bootloader into ram and execute it.
COmmand to switch in downloadmode:[/COLOR]
[COLOR="Red"]Request:15/02/2010 15:29:23.78964 (+13.9609 seconds)

3A A1 6E 7E :¡n~ [/COLOR]
[COLOR="Green"]Accepted without errors[/COLOR]
[COLOR="Blue"]Answer:15/02/2010 15:29:23.80964 (+0.0195 seconds)

3A A1 6E 7E :¡n~ [/COLOR]

Port closed

Com port open "qmat.exe" (PID: 5092)
[COLOR="Green"]Command to begin sending data:[/COLOR]
[COLOR="Red"]Request:15/02/2010 15:29:24.18764 (+0.3789 seconds)

7E 07 C7 84 7E ~.Ç„~
[/COLOR]
[COLOR="Green"]but the phone has restarted[/COLOR]
[COLOR="Blue"]Answer:15/02/2010 15:29:27.18764 (+3.0000 seconds)

00 0D 0A 62 6F 6F 74 20 72 65 61 73 6F 6E 3A 20 ...boot reason:
50 4D 5F 57 44 4F 47 5F 54 4F 55 54 5F 52 54 5F PM_WDOG_TOUT_RT_
53 54 0D 0A 0D 0A 28 50 6F 77 65 72 4F 6E 20 53 ST....(PowerOn S
74 61 74 75 73 2C 42 6F 6F 74 20 52 65 61 73 6F tatus,Boot Reaso
6E 29 3D 28 31 37 2C 34 29 0D 0A 4E 41 4E 44 5F n)=(17,4)..NAND_
46 4C 41 53 48 5F 52 45 41 44 5F 49 44 20 3A 20 FLASH_READ_ID :
4D 49 43 52 4F 4E 5F 35 31 32 4D 42 5F 46 4C 41 MICRON_512MB_FLA
53 48 5F 31 32 38 4D 42 5F 53 44 52 41 4D 0D 0D SH_128MB_SDRAM..
0A 0D 0A 41 52 4D 39 5F 42 4F 4F 54 5F 4D 4F 44 ...ARM9_BOOT_MOD
45 30 2C 20 42 6F 6F 74 20 41 6E 64 72 6F 69 64 E0, Boot Android
0D 0A 5A BA 43 85 4B 5B AE 5B E5 2B CB 8B D6 05 ..ZºC…K[®[å+Ë‹Ö.
C9 BD 89 95 35 52 1A 15 B5 95 C9 85 81 9A 6A D5 É½‰•5R..µ•É…šjÕ
A4 F8 5B 4D 44 44 49 5D 20 42 69 74 6D 61 70 5F ¤ø[MDDI] Bitmap_
57 69 64 74 68 20 3D 20 34 38 30 0D 0A 5B 4D 44 Width = 480..[MD
44 49 5D 20 42 69 74 6D 61 70 5F 48 65 69 67 68 DI] Bitmap_Heigh
74 20 3D 20 36 34 30 0D 0A 5B 4D 44 44 49 5D 20 t = 640..[MDDI]
52 47 42 5F 43 61 70 61 62 69 6C 69 74 79 20 3D RGB_Capability =
20 30 78 38 38 38 38 0D 0A 5B 4D 44 44 49 5D 20 0x8888..[MDDI]
4D 66 72 5F 4E 61 6D 65 20 3D 20 30 78 44 32 36 Mfr_Name = 0xD26
33 0D 0A 5B 4D 44 44 49 5D 20 50 72 6F 64 75 63 3..[MDDI] Produc
74 5F 43 6F 64 65 20 3D 20 30 78 30 0D 0A t_Code = 0x0
............ etc etc
[/COLOR]

Note how this time the boot reason is changed...

if I use this command:

07 dword addr; byte lenght; dword data to write (in dignostic mode) i can write from address 0xc0000000

radio version installed is

+RADIOVER: 62.52S.20.18H

obtained using AT+RADIOVER command in AMSS serial

Cheers,

bart99