yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] scholbert:
Hi!

Firts let me point out something:

We should be careful not to mix things up and cause a lot of confusion here :o

Anyway these are great investigation and hopefully this will led us to a nice solution to unbrick G1 and/or G2.

@bart9984:

You once wrote that your device is a htc Magic 32A.

So all the experiments you did so far were done with this device.

Is this correct?

EDIT:

Some words concerning download mode:

As far as i know QPST and PSAS use special binary code that is loaded to RAM with the help of radio bootloader.

These special "bootloaders" handle NAND access and do image verification. The commands to talk with this code are implemented in the host-tools.

Have a look for NPRG7200.BIN in the PSAS environment. There are similar things in QPST.

What version of QPST did you use?

This dumped data does not look like something valid to me.

Which radio ROM is loaded on your device?

@ezterry:

Allready did some dumps using JTAG and found out some of the bootcode offsets for HTC Dream.

There are mainly two things of interest:

1. Memory map inside NAND chip

(we got a pure raw dump from G1, no problem to recover those positions)

2. Load addresses of boot code in RAM

(JTAG is very helpful here, as long as we do not get the MMU activated)

I started to diassemble SPL some time ago using the same offsets!

So they seem to be correct.

From the ARM9 point of view this code also exists at 0x0 after entering bootloader mode. At least this was one of my discoveries with JTAG debugging.

To use some bootcode form another device (e.g. Kaiser) will be like fishing in the dark. It's not known how the device would behave with this code!

I will post the offset for radio bootloader in RAM tonight (my notes are at home) :rolleyes:

Regards,

scholbert
[G1 Android Development] ezterry:
Agreed, and I promise I didn't flash and of the Kaiser SPL; nor did I flash over any of my SPL. The only reason I tried/mentioned it is it indicated I flashed something somewhere.. so there is still hope in the radata command if I can figure out where to flash too.. and how to format the image..

As for the radio most of the QUALCOMM code is in an embedded elf file; so I see its loading things all over at least in a virtual memory map.

However the boot loader command line is not part of that elf
[G1 Android Development] scholbert:
Hey bart9984,

thanks for the details about what you've done.

I will try to follow these steps with my G1.

Did you get anything on your display apart from going dark?

Would be interesting to load own modified ARM code into RAM and get it executed.

This could be a solution for reflashing.

Maybe the binary from PSAS could already be used, if we ask ViperBJK for some help ;)

Mmmh could be caused by broken code snippet or this is quite normal behaviour.... not sure about that.

@esterry:

Thanks for the file.... but i guess i'm already a step ahead :D

All the intial ARM9 boot codes are located in G1 radio ROM:

QCT_BOOT_V622019 (inital boot code for radio)

OEM_SBL1 (looks to me like nothing but a jump table)

OEM_SBL2 (same here)

HTC_BOOT_V2.22.19 (radio bootloader with command line interface)

On the other hand the systems SPL should be executed by ARM11.

There's more to come :rolleyes:

Regards,

scholbert
[G1 Android Development] bart9984:
when the phone reboots it boots in default bootmode (the one chosen by setboot command) so the screen is dark or stucks in arm11 bootmode 3 as before. I don't know if it crashes or if its normal a reboot when entering dload mode...(I think its a crash)

if you can switch in download mode there is a downloadcommand that's named "execute" :)

ViperBJK should be the one who can save us a lot of time I think

bart99
[G1 Android Development] ezterry:
Not surprised; I admit to not being a reverse engineering expert. (I just have lots of theories and learn fast)

For others: attached is the (very) crude radio splitting python script I used.

Just I only promise it works on ota-radio-2_22_19_26I just put it in the same directory as radio.img and run it split it into radio.img.part_???

(Note this is just to split the radio image into more logical pieces to investigate.. might help with some advance jtag hacking.. but I don't have a jtag cable at this point in time)

Note: the following appears to extract the radio better: http://nah6.com/~itsme/cvs-xdadevtools/xda2nbftool/parsegsmv2.pl

(seems to have been made for the Kaiser; but seems to extract the code segments of a G1/Dream radio w/o issue)

(Willem's home page creater of parsegsmv2.pl http://www.xs4all.nl/~itsme/ )
[G1 Android Development] scholbert:
Hi ezterry!

Nice script, could be very useful indeed :)

As i promised here are some additional infos:

The offset of HTC_BOOT in RAM is at 0x00900000 after starting up in blue led mode.

I also did some investigation on NPRG7200.bin.

This file should be located at 0x00a00000 after transferred to the device.

Should be verfied using the debugger again.

@bart9984:

Just finished extensive session with QPST. There's a lot of features, but i was not brave enough to enter software download mode, because my device is not bricked right now :D

Anyway i think i will read the user manual and do some research about the functions.

Would be awesome to rewrite some parts of NAND, but i think we'll need to put the files into *.mbn format.

EDIT:

And yes you're correct, another interesting thing would be to investigate on this:

(PowerOn Status,Boot Reason)=(17,4).

Cheers,

scholbert
[G1 Android Development] viperbjk:
Howdy :)

I just saw this topic right now, as I'm quite busy in implementing new features to PSAS.

To clear things up :

1. Download mode won't write NAND directly, but will only allow to upload

original signed .mbn files (the ones we don't have) .... AND radio must be

intact for that (if oemsbl and qcsbl are dead then byebye baby).

Another problem : MSM7201A is different from MSM7200, and the

bootloader doesn't have the needed NAND config. We would need to patch

that first.

2. Jtagging is the best way to write NAND. You may ask why I didn't use

homebrew jtag hardware and why I didn't integrate it into PSAS/QMAT

for free :

Reason : I did a lot of experiments with ARM ETM mode using wiggler,

amontec jtagkey etc ... They all weren't stable enough to write NAND

savely to modern MSM (7200 and above), thus I got stuck with Segger

Jlink ARM, Trace32 and Openice A1000 .. those are the only ones that

really work stable.

As Segger has no free SDK, I need to pay license costs every year, but it

is still the less-cost end-user solution (99 Euro for non-commercial

version).

Currently, I do only accept ETM as it easiest to handle. But MSM can also

be in MSM Jtag mode which is similiar to BSDL mode. Right now I do not

know how to switch between both, but I guess it must be a hardware

mod.

3. SPL has some problems ... like setboot 4 that will ensure that the phone

goes into a nice loop, leaving the phone dead (as it doesn't get out of

oemsbl init) which is imho just a bad bug.

Feel free to ask any further questions, nice to see some skilled people over here playing with jtag.

Cya,

Viper BJK
[G1 Android Development] bart9984:
Hi Viper BJK,

On Htc Magic I've tryied the setboot 4, with a serial cable you can change the bootmode again, so the phone is not dead :)

bart99
[G1 Android Development] viperbjk:
Ah, good to know. Well, I had this with my Diamond (didn't even boot anymore), and this was the reason for jtagging it then :D
[G1 Android Development] ReverseEngineered:
It looks like the watchdog timer has timed out and forced a reset. For those not familiar, a watchdog timer is there to restart the phone in case it ever freezes up. Once started, it will run continuously, and unless it is cleared periodically by the program running on the phone, it will reset the phone.

Perhaps the code to reset the watchdog isn't being run in QMAT's bootloader code. That would imply we would need to write our own bootloader that either disables the watchdog or resets it periodically.
[G1 Android Development] bart9984:
:) let me be more accurate: even on setboot 4 i can alway enter blue led mode,

I tryed also setboot5, wich is the default when the phone is charging, output on the serial console many statics and values of current and percent of charge

bart99
[G1 Android Development] bart9984:
hi ReverseEngineered,

the phone reboots cause to the attempt to put it on downloadmode, thanks to viperBJK I know now that'is normal cause to reconfigurations needs.

Cheers,

bart99
[G1 Android Development] hause:
On my magic it does not block, it listens for a answer.

Try this:

Send:
rseed<return>

Get (values changed, real output looks different):
HTCS00102030405060708090A0B0C0D0E0F0.*+:HTCE

Hex:

Send:
72 73 65 65 64 0d

Get:
48 54 43 53 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 30 41 30 42 30 43 30 44 30 45 30 46 30 16 2e 2a 2b 3a 48 54 43 45

Now send the stuff back with rpass:

Send:
rpass<space><return>HTCS00102030405060708090A0B0C0D0E0F0.*+:HTCE

Get:
HTCSF kEØ(HTCE

Hex:

Send:
72 70 61 73 73 20 0d 48 54 43 53 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 30 41 30 42 30 43 30 44 30 45 30 46 30 16 2e 2a 2b 3a 48 54 43 45

Get:
48 54 43 53 46 20 20 20 6b 45 d8 28 48 54 43 45

Found this here:

hxxp://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoaderPassword
[G1 Android Development] bart9984:
hi hause,

yes after i figured out what to do with rpass,

tnx :)
[G1 Android Development] scholbert:
Hey,

things start movin' .... :D

That's right!

HTC Dream boots up with ARM9 mode on the primary port.

As far as i know the following is required to enter MSM JTAG mode:

MODE2 and PS_HOLD must be pulled to Vio=2.6V.

BTW i asked BinaryDroid to verify position of PS_HOLD testpoint again.

After powering up the JTAG ID had changed (0x0000000e, if i remember correctly). No further experiments had been made in this mode, because i need to finish some piece of software first.

It's good to have some shiny faces aboard :)

Regards,

scholbert
[G1 Android Development] viperbjk:
I will do some tests the next days regarding bootloaders. Maybe this way I will find a solution that works if at least qc diag mode is working.

PSAS also had some bad "bugs" I need to fix now, as nand isn't nand and it takes a lot of time to get used to bad block databases, bad block handling, spare handling and page register handling of course.

OneNand chipsets are the first steps for easier nand handling, qc nand controllers are a real mess right now, at least now I'm getting used to MSM7xxx.

There are still other problems we will have to cope for, when thinking of bricks. If the 0:HTC partition is messed up, whole IMEI + Simlock Info has to be created from zero. Thus, I'm now working on identifying partitions in nand that weren't known so far.
[G1 Android Development] viperbjk:
Ok ...

using ftcjtag.dll (ftc chipset), I could only get the idcode via jtag, but I couldn't get it to read or write the memory (dram).

See my code over here :

http://forum.revskills.de/viewtopic.php?f=15&t=381

If someone is willing to offer a hardware schematic for the ftc chipset (lpt is no real option, but usb is, and if I remember a schematic already exists on the net), and another one helps me to get read/write memory working for ARM devices, I will built a free tool to debrick diamond/magic etc.. means for all MSM7xxx phones.

Cya,

Viper BJK
[G1 Android Development] scholbert:
Hey viperbjk,

sound good :)

Sounds fantastic :D

See my post over here:

http://xdaforums.com/showpost.php?p=5166488&postcount=52

So if we look into the table, OOCD-Link and USBJTAG is open hardware.

OOCD-Link from Joern Kaipf seems to be the one that we should focus on.

More Info here:

http://www.joernonline.de/contrexx2/cms/index.php?page=126

Schematic and PCB fiels over here:

http://www.joernonline.de/contrexx2...&path=/contrexx2/cms/media/archive1/oocdlink/

It's open hardware but i might contact the author to inform him of what we are trying to do here.

Any comments on that?

Cheers,

scholbert
[G1 Android Development] viperbjk:
Yes, OOCD-Link seems to be the best way to go.

Now we only need some jtag freaks good at c++ implementing memory read and write for ARM jtag.

The rest (the hardest part) I'll then do myself .. the MSM7xxx cpu implementation.
[G1 Android Development] scholbert:
O.K. sounds very promising.

I am a JTAG freak and good excellent undersatnding in hardware, but unfortunately got no idea about C++.

As far as i know OOCD-Link is already integrated in OpenOCD.

That's not enough i suppose...

I should contact the author of OOCD :rolleyes:

Stay tuned!

scholbert
[G1 Android Development] viperbjk:
I found some nice ARM c++ source code, but only for LPT.

If we can port it using ftcjtag.dll functions it would be our solution I guess :

http://sourceforge.net/projects/jtag-arm9/

Cya,

Viper BJK
[G1 Android Development] akty123:
good news on save bricked g1

I found some nice vedios on how to fix bricked G1 by JTAG

http://www.youtube.com/watch?v=eITMEEF_AIc:D:D:D:D:D
[G1 Android Development] scholbert:
Yes sure it's possible, HTC did it 1000times while under development :p

To be exact, they have access but fix a brick is more....

The problem is that these are comercial solutions and you'll have to buy software/hardware bundle at about 200EUR :o

http://www.multi-com.pl/index.php/en_US,details,id_pr,6503,menu_mode,categories.html

Could anyone buy such a hardware and open it :D

Of course there's a lot of hard work behind all these boxes and progs and i give a lot of respect to these hackers, but it's also obvious that they do profit from information we share for free!

Anyway it's another proof of concept.

@bart9984:

Cool stuff, so this is a little code injector...

Executing the code would indeed need some more tricks, i guess.

Thinking....

@viperbjk:

Why not use the OpenOCD environment, there's ARM9 support already.

So i guess you'll need something to handle the stuff on a windows host.

Best regards,

scholbert
[G1 Android Development] bart9984:
A little, discovery (at least for me)

I wrote in older post how the command 3a to put the phone in downloadmode cause the phone to reboot. Well in normal boot the ram is all erased, but if the reboot is caused by the DownloadMode command after the boot the data I wrote to memory with my script is still there :) so I can write to ram reboot into oemsbl and use commands like radata for example

what do you think about it?

little update for my script: disabling print output and serial read in send_file function divide the upload time by 30 :) now 72kb in 13 sec

Cheers

bart99
[G1 Android Development] viperbjk:
Simple reasons :

1. Has no gui (people need to use console) and scripting is problematic.

2. (main reason) : It is way too slow.

3. The source is hard to read and even more problematic to patch.

4. Regarding upcoming ARM12 secured platform, there is low chance that dominic will add support
[General Questions and Answers] austin8868:
I am new to all this, i just got my Hd about a week ago i already have a rom downloaded i was just wondering what software i need to download to install it and wm6.5 Thanks
[General Questions and Answers] mancsoulja:
check the stickys in the touch HD rom development thread, you need to flash hard spl b4 you can flash a new rom ;)
[General Questions and Answers] timmymarsh:
Please check out the blackstone wiki and read before you flash so you understand the process, you dont want to turn your hd into a nice black shiney doorstop right?

Go here : http://wiki.xda-developers.com/index.php?auto_redirect=1&pagename=TitleSearch&s=blackstone
[G1 Q&A, Help & Troubleshooting] Nelze21:
so today i was trying to change my current JF ROM to CyanogenMod and everything seemed to be going well untill the second reboot. My g1 stayed at the tmobile G1 screen and wont go past it. i dont think my phone is bricked because i can use the HOme+Power and go to that screen. However thats all i can do. What can i do to make my phone work again?
[G1 Q&A, Help & Troubleshooting] xP1GxB3N1Sx:
do you have the cyanogens 1.4 loader?
[G1 Q&A, Help & Troubleshooting] B-man007:
did you follow these directions precisely?

http://wiki.cyanogenmod.com/index.php/Upgrading_From_Older_CyanogenMod_or_other_rooted_ROMs
[G1 Q&A, Help & Troubleshooting] wizme:
hi.

may i noe whats the background like when u boot in to the hboot.(power+back)
[G1 Android Development] kingskidd268:
Some thing In found out on 2.0 by Eugene and Twisted is the Phone portal. It is a real cool app. Whta is even cooler is if you are tethering you can conect to your pc and phone over the wifi tether app that is on the phone.

Pick up 2.0 here http://xdaforums.com/showthread.php?t=589344

1) Start tether app make sure you computer is connected to G1 tether or what ever the wifi singal for the tether app.

2) Start the Phone portal on the phone that you are using. I am using the Myouch 3g.

3)Go to web browser, i.e. I am using Ineternet Explore 8 on window 7. and type in Http link that is on the phone. and their you have it Moto Phone Portal.

Video Uploaded Ringtone test http://www.youtube.com/watch?v=QY3UPa8IW_Y

Video Uloaded Wallpaper test http://www.youtube.com/watch?v=dTrbv3rNUts

I hope you all have fun on this portal,

Thank you Eugene and Twister
[Windows Mobile Development and Hacking General] PeterWijngaard:
I am trying to delete a file in windows mobile 5.0 via the "run dialog". I was expecting that "del <filename>" would do the trick but that generates an errormessage saying that the file "del" could not be found. Can anybody advise me what syntax I need to use to delete files via the run dialog ?
[Windows Mobile Development and Hacking General] Senax:
WM5 / WM6 Classic and Professional RUN Dialog

(A little late reaction, but..)...

The 'RUN Dialog' does what is says!

Both in WM PocketPC / Windows OS PC we can run executables like;

beam.exe (strangly enough :confused: no shortcut for this *.exe with or without using TF3D).

ContactEditor.exe (idem).

DataDisconnect.exe (idem).

eT9MyWords.exe (idem).

FieldTest.exe (idem) .

*more shortcuts to nice *.exes which R 'missing' :confused: ah well...

Only on Windows PC we have that 'command' which is typed after Run (WindowsKey+R)!

Then after typing cmd/command and getting the MSDOS PROMPT you/we/I could use the command ;

DEL

-=[ WM5 / WM6 Classic and Professional 'RUN Dialog' ]=-

On the main Today screen of a WM Pocket PC (Windows Mobile Professional or Classic) you can tap and hold down the ‘Action’ key while tapping and holding the stylus on the clock shown on the nav bar, then hold and slide to run, then release and tap run.

!!! The ‘Action’ key is usually the center of the D-Pad or CTRL if you are using the former SIP emulator;

(It's just a picture, I don't have this 'skin', I am still looking for it though ;)).

When you release the ‘Action’ key a small popup menu will appear,

and you can select the ‘Run’ option which will display a small dialog. Within this dialog you can enter the path to any executable, as well as any required command line parameters.

:)

!!! As an additional tip, did you know that if you tap and hold without the ‘Action’ key being pressed, a different popup menu will appear? This one allowing you to select between an analogue ~ and digital clock being displayed on the navbar! :D

Senax
[G1 Apps and Games] young1:
hi all just wondering who is using google wave and if your olike me and not many of your friends use it maybe we could add each other for android related waves :p

brit
[G1 Apps and Games] Phace:
i would, but i need an invite! id be more than happy to exchange droid news with you!

calbizz at gmail is the address
[G1 Apps and Games] Ssantos6981:
any other invites?

I've tried to get my own invite from google but it seems to be taking time. I'm always scouring the internet for new information regarding the G1, as well as other phones, and any upcoming phones (I'm looking for my next G1).

Hope someone invite me! ssantos6981
[G1 Apps and Games] simplyTravis:
I am mtlovett@googlewave.com if you want to add me. I've got a bunch of G1'ers on there already linked up to me.
[G1 Apps and Games] newjaruz:
anyone else who posts an email will get an invite from me along with the two who have already done so.
[G1 Apps and Games] sockpuppet4:
if anyone has an extra invite can you throw one my way? KnowFear@gmail
[G1 Apps and Games] jonnunez:
an invite for google wave by anyone would be appreciated, thanks in advance.

jonnunez87@gmail.com
[G1 Apps and Games] dskid807:
I have google wave. Mine is dskid807@googlewave.com
[G1 Apps and Games] Ssantos6981:
7 invites left...

first 7 to email me gets them. ssantos6981

EDIT: 3 invites left. Will only invite those who email. I'm not checking this board, only listening to my phone for emails.
[G1 Apps and Games] shortyellowbus:
please include me into one of your invites !

thanks :D

australipithican.kid@gmail.com
[G1 Apps and Games] Abbens:
I would like an invite Richardkruspe01@gmail.com
[G1 Apps and Games] trapdogg:
trapdogg@gmail.com invite please

i have mine
[G1 Apps and Games] Danmalone72:
Danmalone123@gmail.com can i get an invite?
[G1 Apps and Games] G1guy:
just wondering if people still need invites because i got 8 right now.

Anyone could add me:

theapodaca@googlewave.com

Edit:

Sent xtrip0dx
[G1 Apps and Games] xtrip0dx:
???????@gmail.com would be super duper....

EDIT: Thanks guys im all setup now you guys rock!
[G1 Apps and Games] ukm700user:
could you invite me please
[G1 Apps and Games] mrnv45:
yall add me!

da1unv45@googlewave.com
[G1 Apps and Games] DAKIDD236:
add me dakidd725@googlewave.com
[G1 Apps and Games] eessel:
Anyone can add me:

tfball58@googlewave.com
[G1 Apps and Games] simplyTravis:
Hey guys,

I would suggest PMing a person directly with your email address rather than letting it sit in the middle of the internet for anyone to pick up.

That being said, I have 7 more invites left if anyone wants one. Please PM me with your email.
[G1 Apps and Games] young1:
agreed please give out your email carfuly guys after all email addresses are the back account numbers of the internet
[G1 Apps and Games] digitaljeff:
i have 4 more invites available, pm me with your email if your interested.
[G1 Apps and Games] :
I've sent you one, please remove your handle from your other posts so you don't waste other people's invites. Thanks.
[G1 Apps and Games] dergezero:
8invites

i got 8 google wave invites hit me up with ur email
[G1 Apps and Games] Smokuevo:
i got about 35 google wave invites
[G1 Apps and Games] sicone1911:
Can anyone send one my way thesicone@gmail.com thanks
[G1 Apps and Games] er0x90:
invite

can someone send me one please? eder2690@gmail.com
[G1 Apps and Games] bigc07:
Can anyone send one my way bigc07@gmail.com thanks
[G1 Apps and Games] LeoGetz78:
I have a handfull of Wave invites. Just PM me and I will send them out till I run out.
[G1 Apps and Games] ^tyrant^:
sent ya a pm
[G1 Apps and Games] nolimit78:
I would be happy to invite and add, send me a PM
[G1 Apps and Games] zaliman:
invite

i have googlewave send the 'vites

ZALiMAN264@googlewave.com
[G1 Apps and Games] daggerx:
daggerx at googlewave dot com
[G1 Apps and Games] DrNamaste:
I have 6 invites

I have six invites to wave. Please PM me.
[G1 Apps and Games] SRKdrift:
srkdrift@googlewave.com
[G1 Apps and Games] SFXLEWIS:
lewisplume@googlewave.com - have invites spare also seeing as none of my friends are remotely interested in this sort of thing :)
[G1 Apps and Games] lucky 69:
pm me your email if you need a invite i have 6 left .i will add people to if they want ! i have only one friend that has it . so let me know .
[G1 Apps and Games] Roadmasta01:
anyone can add me:

roadmasta01 AT googlewave DOT com
[G1 Apps and Games] hettbeans:
It's just too bad that Wave is nigh unfuckingusable on the G1 browser. Slow, laggy, unresponsive POS.
[G1 Apps and Games] plasmadragon007:
I've got google wave, if you wanna add me on google wave zmartin76@gmail.com .
[G1 Apps and Games] davehasninjas:
I'm on wave dmwilson220@googlewave.com if anyone wants to add me.
[G1 Apps and Games] Picolini:
Already a thread for this...

http://xdaforums.com/showthread.php?t=578428&page=14