yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] HTCGlacier:
Hello,

i have an 32b and yesterday i opend

the device. But there is a lot of glue on the jtag pins.

not a little ..

What is the best way to pull this off?

a needle or an little screw driver?

sry, for my bad spelling i am from Germany.. :-)

/Glacier
[G1 Android Development] scholbert:
Forget about the screwdriver... even little screwdriver are solid tools to scratch on a PCB.

That's what bart did...

Depending on the amount of glue, i would recommend some heated soldering iron with a very thin tip to remove most of the glue.

The glue gets very weak while heated.

Afterwards you may also use a needle to clean the testpoints.

I would be very careful with using chemicals as long as you know exactly about the characteristics.

Always take care of the thin traces on the mainboard while removing the glue.

Regards,

scholbert
[G1 Android Development] 3izz:
thanks for sharing the replacment of the jtag device but i find it difficult to get it (we are not experts) is there a way you can give more details on how to get max232 from a board, like a video. if you can also post an image or other details on ic-74245, it would be appreciated, because all i get are data-sheets when searching for ic-74245 online.

thank in advance.
[G1 Android Development] wantxapas:
Hi everyone,

First, thanks you for the effort guys. It's incredible!!!

I have been reading the thread and I will try to fix my G1.

Some years ago I bought this JTAG based on the 74HC244.

h t t p :// w w w.novenaplanta.es/wp-content/uploads/2010/04/IMAG01321.jpg

I can't attacht images... :(

Can I connect the G1 to this JTAG? (OCD compatible?)

In case yes what I understood is that I have to connect:

* TRST-N --> PIN 5

* TDI ------> PIN 3

* TMS -----> PIN 4

* TCK -----> PIN 2

* TDO -----> PIN 11

* GND -----> GND

* vREF (L317 circuit) --> To the battery pin?

Thank you!
[G1 Android Development] lbcoder:
That device should be fine.

vREF should go to your 2.6v source (wherever that is).

I'm not sure if the HC chip will work for you, you may need to swap it for an HCT.
[G1 Android Development] lbcoder:
Its better to play on something BIG and CHEAP when you start off. Like an old radio. Destroy something worthless. If your first soldering project is on a PHONE, you WILL destroy it.
[G1 Android Development] gymmy:
I love to destroy things :) Destroy i say, go forth and destroy... Opps i mean fix :) and thoes phones cant be too expensive a magic over here sells for $400 NZD about 150 pounds or 200USD

But yeah i agree, something big that pulls low amps but enough to give u a decent jolt so that you learn to disconnect the battery, and enough to make the IC melt and smoke so you know you have really screwed things up ;)

Oh how i hate that smell ! If only i could come up with a way to push that smoke back into the chip !

G
[G1 Android Development] stlouie65:
Great job. How much would you charge to bring my original Mytouch 3g back to life?
[G1 Android Development] crazyknallchopf:
hey lbcoder...

can i send you a little package with my briked dream and 10 Euro to repair? :D
[G1 Android Development] lbcoder:
I'm afraid that 10 euro wont cover the time it takes me to open the box you send it in ;)

I bill high.

VERY high.
[G1 Android Development] sangeet.003:
what are the actual tools needed like is there any dongle etc needed ?

i am a noob for these hw stuffs..

the openocd does it have any dongle/connector which needs to be buyed or it can be done using the instructible serial cable ?

& through what software are the commands to be passed to the radio ?

I have got an hardware guy who is willing to try it for me so need to give him some info ..

plz help
[G1 Android Development] ezterry:
no openocd uses smoke signals to talk to the phone... (How did you find reference to openocd w/o reference to the JTAG adapters..)

Please be very careful as jtag may be very dangers to your phones health if not correctly done.. also please ensure you and/or your friend have a very good understanding of what is described on the wiki page and not to proceed until you do. If you run into software related issues communicating with the radio and SPL I will try my best to help; but things such as how to set up openocd is best done by reviewing its webpages and forums

(Why do I sometimes feel I put links in my posts and signature for my own reference only)
[G1 Android Development] sigo2oo9:
Given that pretty much everything now exists in the Wiki, you should have simply posted

"http://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC"

:)

Great work guys... Can't wait to give this a shot once the parts on order arrive - Stupid Australia
[G1 Android Development] gymmy:
hahaha im having the same issue with stupid USA haha, i should have looked in Aus its just over the ditch !
[G1 Android Development] hoyitzpnoiboi:
wow!

would anyone be willing to debrick a mytouch? if so howmuch??
[G1 Android Development] bart9984:
Lol :)

bart99
[G1 Android Development] sangeet.003:
Reading the wiki, m a lil confused...

If we built up the instructible cable, is the ocd wiggler needed ?
[G1 Android Development] marxmarv:
You need both a JTAG and an async serial cable to perform the current state-of-the-art unbrick procedure. An all-JTAG solution may be possible, but as far as I know nobody's worked on this yet.
[G1 Android Development] bucharsky:
Hi everyone. I`m using that manual but with J-link JTAG adapter.

_ttp://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC

And now i have one trouble:

When i connecting both JTAG and serial wire i don`t recieve any replies such as

Invalid command : ? (stage 5 of the manual)

When i connect only serial wire and boot at normal mode i see that:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : SAMSUNG_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Linux
Y2╠┘м║│8 bit
-msm_nand_probe
[MDDI_HW_ERR] mddi no response
[MDDI_EID] mddi_eid_probe enter.
[EID_HW_ERR] mddi_eid_probe: Unknown panel type!!
Board_PID : 0x1F
Wlan data header ++++++++++++++++++++
Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0xC001
BodyLength : 0x2D9
BodyCRC : 0x6835A94D
aDieId(0) : 0x8C044068
aDieId(1) : 0x52D59284
aDieId(2) : 0x20000000
aDieId(3) : 0x1794
countryID : 0x10
Wlan data header --------------------------
ARM11 Boot Mode: 3
Platform: HBOOT-7201A

And that in "blue light" mode:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : SAMSUNG_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE1

And still no replies on my comands "?"

What can be wrong?
[G1 Android Development] ezterry:
There are two reasons I've experienced that cause the serial wire to fail

1) a wire is loose (ie.. the phones TX is attached to the computers RX but the computers TX is not connected to the phones RX)

2) +5V is attached to the HTC EXTUSB port; this is known to cause bluelight mode to fail to boot.

Also you will only be at the command interface in bluelight mode (regardless of whether the jtag is attached.) since normal boot entered "boot mode 3" which is failing to load a recovery.

===

from your output it is most likely number 2; I've added a note to the htc serial wire requirement on the wiki to leave +5 detached from the EXT USB
[G1 Android Development] bucharsky:
I have no 5V wire connected.

I have disconected pin #3

_ttp://groups.google.com/group/android-platform/browse_thread/thread/439d3f3af7a88a09/10a80eb835e8dbcc?lnk=gst&q=serial&pli=1

but i still can see this output (GND is connected):

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : SAMSUNG_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE1

maybe i should try another pinout?

Upd: i have tried all pins but still no effect =(
[G1 Android Development] marxmarv:
Good Mr. Kondik, you rocked my world just in time for Penguicon. Cash kudos to you.
[G1 Android Development] gymmy:
JTAG arrived this morning and its raining yippeee good excuse to g33k out :)

but ill have to find a 2.6vref point as i dont have the 2.6v regulator.

Anyhow well let you know later today if i kill it :)

G.
[G1 Android Development] sigo2oo9:
Good luck mate!

There are plenty of 2.6v points on the board from what I checked so that's not going to be hard at all :)
[G1 Android Development] bart9984:
Hi,

it seems your connection from pc tx to phone rx is not working,since you can only read the output but not send. Which extUsb connector are you using? and which usb->uart adaptor?

@gimmy:

let us know how is going :) and if you was able to build the mask to avoid soldering

bart99
[G1 Android Development] ezterry:
The variable regulator is at least a cheap way of getting the vref w/o one less wire to the board.

but can someone confirm the test point in question (see image) as vref (my board is not really 100% functional)

If it is I will create a nicer test point image and link it to the wiki
[G1 Android Development] ezterry:
Like bart99 said .. you are not properly sending your message to the phone (but seeing the phone's messages)

Are you using: http://www.sparkfun.com/commerce/product_info.php?products_id=449 ?? (was linked on your google groups page)

If you are try attaching pin 'B' in the google groups page to VCC on the serial adapter.

(to everyone else this is pin4 on the usb-ext breakout board's silk screen)
[G1 Android Development] gymmy:
Hi ,

I have had a poke around on the board and have found a couple of 2.6v dc points, im just investergating a little closer just to make sure they dont jump hi or low when the phone boots etc ill then post a picture of where it is. just in the process of making my adaptor from perspex so i dont have to solder directly onto the board :)

G.
[G1 Android Development] bucharsky:
@bart9984 and ezterry

What i`m using:

ExtUsb connector --> sparkfun.com/commerce/product_info.php?products_id=9078

usb adaptor --> docs.google.com/fileview?id=0BxEZbmI5Hxi8MTNjNmMzY2ItZDY2NC00Mjk2LTk2NjMtYTk2ZGYwNDUzMzQ0&hl=en

(sorry about links)

UPD:

i tried to connect via special programm (like PuTTY but using hex)

Response was

...41524D395F424F4F545F4D4F4445310D0A

which means

...ARM9_BOOT_MODE1

Then i tried to send "?" command (3F byte). I was successfully sent but still no response from the phone.
[G1 Android Development] bart9984:
A stupid question: are yo typing enter? The serial sends the character soon as you type it

But the phone will response only after character 0x0d...

Try ussing a serial port sniffer to read the traffic

bart99
[G1 Android Development] BinaryDroid:
I would just like to pop in to congradulate everyone on the progress that has been made and all of the research that has went into coming up with a procedure for un-bricking. I knew you guys would pull it off! In the time i've been gone I have aquired 4 HTC parts phones with working boards, but only 2 complete setups that are fully functional. I plan to do all sorts of nasty things to my spare boards with the knowledge I've gained since i've been away to get a better understanding of how the radio communications work as well as understanding how each piece of hardware gets initialized.

If anyone ever needs the title updated here again or anything else please send me a PM so i get the email alert to check? I only visit this forum to check on the progress thats made in each version now that i am on CDMA, although after catching up on this progress I have my clean G1 charging now to poke around with the recent work.
[G1 Android Development] gymmy:
hi guys, well im slowly getting there.

I get this error when i try and run openocd (i dont have it connected to the phone at the moment, and not sure if this is causeing the issue ?

sh-3.2# ./openocd -f openocd.cfg

Open On-Chip Debugger 0.4.0 (2010-04-30-18:04)

Licensed under GNU GPL v2

For bug reports, read

http://openocd.berlios.de/doc/doxygen/bugs.html

trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain

dcc downloads are enabled

fast memory access is enabled

Error: unable to open ftdi device: unable to claim usb device. Make sure ftdi_sio is unloaded!

Command handler execution failed

G.
[G1 Android Development] ezterry:
From what I can tell this is an issue between openocd and your jtag adapter. (hopefully just mis-configuration or driver conflicts)

Some general tips are:

* ensure no other driver decided that the JTAG adapter was a usb serial adapter

* ensure the cfg has the driver definition for your JTAG adapter

Otherwise what operating system/Jtag adapter are being used?

you will see different errors if the jtag adapter is found but the device doesn't reply or fails to reply correctly.

(fyi I just updated a magic cfg on the wiki using same as the dreams just added the device ID provided by bart9984)
[G1 Android Development] gymmy:
Hey there ezterry,

Im using OSx 10.6 and pretty sure that it thinks its a serial adaptor i might just load up a VM and do it though there, what OS did you use? I have a choice of XP Win7, OSx, RedHat, Ubuntu
[G1 Android Development] shaji007:
are we close yet?!

t-mobile denied me a repair and now ive stuck with a contract sim and no phone :(

(ps according to them its water damaged)
[G1 Android Development] bonesy:
go to htc, The people at t-mobile are rubbish, refuse most repairs
[G1 Android Development] scholbert:
Hi BinaryDroid,

no need to hurry....;)

I guess it's me your refered to, because i made this schematic :p

Anyway, LCX types should also do the job i guess.

http://www.fairchildsemi.com/ds/74/74LCX245.pdf

The critical part is the output voltage level!

If you look into the datasheet on page 4, the output voltage is specified at Vcc-0.2V.

So this gives us 2.6V-0.2V=2.4V which is exactely the lowest level for LPT port to accept high-level signals. This is the critical point.

It's the same with LVC family this is a constructive barrier of these kind of adaptors.

I guess we need real level shifting for this piece of hardware

...aah and i nearly forgot!

Of course you will need a reference ground, for all parts!

Use LPT ground pins of the connector only, no need for shielded ground.

Could you point me at testpoint for mode 2 please?

Regards,

scholbert
[G1 Android Development] lbcoder:
Holy crap.

Got confused there for a bit since I don't remember having posted any schematics.

But yeah BD: it was scholbert's schematics.

This is my usual jtag: http://www.angelfire.com/ex2/spider9909/New files/bjtag101.pdf

Uses 74hct244.

There's a bit of extraneous satellite hacking crud in that file. The main stuff is on page 6 and 16 (note: the table on page 16 can be used to map the connections on page 6 to what things are actually for -- any of the [20 PINs] IRDs).
[G1 Android Development] BinaryDroid:
Here are the other test points. if you need any others please let me know! I added them to the first post. Please note some are not on actual test points but single solder points.
[G1 Android Development] scholbert:
Hey BinaryDroid!

Awesome :D

Great work, thanks a lot!

Cheers,

scholbert
[G1 Android Development] patricchia:
Very nice!!!! Mr. BinaryDroid...

what a great job you had done.. I thought mY g1 is brick forever and keep it for so long time already, after see your post to step towards to make our G1 heart alive, I feel myself full of energy again, learn Jtag is one of the enjoyable topic..

THANK YOU!!

You help us save alot of time and money.....
[G1 Android Development] patricchia:
Very nice!!!! Mr. BinaryDroid...

what a great job you had done.. I thought mY g1 is brick forever and kept it for so long already but after see your post to step towards to make our G1 heart alive, I feel myself full of energy again, learn Jtag is one of the enjoyable topic..

THANK YOU!!

You help us save alot of time and money.....
[G1 Android Development] BinaryDroid:
Well today was a sad day for me as it looks like I wont be learning how JTAGing works using a newer device that hasnt been done.. I figured the best way to learn was to watch everyone else learn a new device as it happens and help were ever possible(in my case I spent many hours under a microscope with a multi-meter), some of you guys know the software side of things, some hardware, i'm, sure it will be worked out! I got my new device built up that should be able to run at 2.6v, was getting all the wires hooked up while I was at my day job and then accidentally put too much pressure on the TDI line on the main board thus removing said testpad. I am going to try a trace repair but their is not much trace left for a wire strand to grab so doubtful it will work, pretty much screwed myself...it happens. if anyone needs anything i'll be sure to monitor the thread but for now i'm off to crack open a router to test the device I built using the schematics here.

PS: if anyone has a bricked board they want to sell let me know! or anyone with no need for JTAG access that wouldnt mind swapping boards with mine PM me. my phone has the engineering SPL already loaded with Hero Rom, works flawlessly aside from the Primary JTAG port.
[G1 Android Development] lbcoder:
Ouch, sucks.

I have a bricked mainboard that someone sent me (though I didn't manage to get much accomplished with it). PM me address and I'll send it to you.
[G1 Android Development] Sirus20x6:
can a jtag be built with an arduino or basic stamp? LPT ports are so archaic ;)
[G1 Android Development] scholbert:
Hi!

You're correct, but LPT is quite simple to use...

For USB solution have a look over here:

http://www.hs-augsburg.de/~hhoegl/tmp/epjournal-1/oocd.html

You may take a closer look at table 6.

Some of these kind of adaptors should work out nice. We will need at least some kind of debug software for ARM9/11 inside MSM7201A

Quite good commercial solution is the Amontec JTAGKEY!

Regards,

scholbert
[G1 Android Development] scholbert:
JTAG confirmed

Hi there!

O.k. i found some sparetime to fiddle around with a broken device.

Though the mainboard got some damages i made it boot up these days only with display attached. So ROM is fine but parts of the hardware are definitely broken (e.g. connection to capacitive touch).

I don't care, because i will need it for investigation.

Personally, i like the simple things and so i took one of these LPT adaptors. You may find the schematic a few posts earlier.

As said before you'll need to attach to 2.6V I/O voltage to the driver chip.

First i tried to check out the default setup.

I did not pull any of these mode pins and left them unconnected.

RTCK was also left unconnected.

TRSTn was pulled to 2.6V, otherwise there were only FF's returning from the TAP.

All other signals from primary were attached to LPT2LVJTAG.

Put in the battery, pressed camera button and power button (i liked to reach bootloader only). See attachment for the result...:rolleyes:

It's obvious that H-JTAG is not the right tool for debugging, untill we tell the software to get along with the QC chip :o

Apart from that i could not find any information about ID-code 0xA01700E1.

Right now i'm not sure about the mode the device was actually in, but i'm sure i will find out soon :p

This procedure was verified a few times and i always got exactly the same ID.

So basically stuff works out nice :D

Anyway i will do some futher investigations as soon as i'll find some time.

Good luck to BinaryDroid for getting another hardware and thanks again for the hard work.

Regards,

scholbert
[G1 Android Development] shaji007:
raaa cannot believe something like that spl/radio could have caused this much problem to where we have to open up the phone ...

i miss my g1 :(

ps. does anyone know how i can contact the htc repair office for the UK? couldn't find anything on the website
[G1 Android Development] matthenry87:
@shaji007 Did your water indicator sticker turn red??
[G1 Android Development] shaji007:
hi I complained about that to t-mobile and said to them that that sticker I'm sure was not partially red since I've never dropped it in water

plus if I did dropped it in water I'm sure that the phone not turning on sounds more of water damage then the phone turning on and stuck on boot screen

obviously telling that to them was no use since they didn't want to listen.

goes to the fact t-mobile UK repair stations are liars I cannot wait till my contract ends and when the sale person rings up for an upgrade i'm gonna swear at em so much they give me a decent discounted tarrif and phone (did that with Orange got my Hero for dead cheap)
[G1 Android Development] gospeed.racer:
LB, if that is the board I sent you it is more than bricked- it would not boot/post/whatever we call it. It was totally dead. I was hoping it would be useful for desoldering and following traces. Not sure if the one I sent you is the one you are speaking of though.
[G1 Android Development] sangeet.003:
My Phone is Bricked N i have sent it to a shop he said he has that diagnostic BOX which HTC uses to recover phones...

My question is that is it so that there are two different ones for Windows Mobile & Android ?? M a little confused.

Mean while, I ll b visiting Him & will see what it can do, and will keep you posted...
[G1 Android Development] jaaronmoody:
did they give you a trouble ticket #

http://www.htc.com/uk/Repair_tracking.aspx
[G1 Android Development] scholbert:
Dream JTAG ARM9

Hi again!

Have to quote myself:

After some research i was able to get some further information about the default JTAG mode on HTC Dream.

As you might know ViperBJK first discovered JTAG on HTC Diamond.

Please refer to this page:

http://forum.revskills.de/viewtopic.php?f=25&t=117

So it's obvious that the Dream is also set to ARM9 mode on power up (same ID like Diamond).

Would be interesting to set true boundary scan mode for some further tests.

Here's some info about QC ARM9 ID:

|31|30|29|28|27|26|25|24|23|22|21|20|19|18|17|16|15|14|13|12|11|10| 9| 8| 7| 6| 5| 4| 3| 2| 1| 0|
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| 1| 0| 1| 0| 0| 0| 0| 0| 0| 0| 0| 1| 0| 1| 1| 1| 0| 0| 0| 0| 0| 0| 0| 0| 1| 1| 1| 0| 0| 0| 0| 1|
| A| 0| 1| 7| 0| 0| E| 1|
|Rev.= 0xA |Prod. ID= 0x170 |Man. ID= 0x70 (Qualcomm) |IEEE

Regards,

scholbert
[G1 Android Development] ezterry:
Me I have done all of the JTag hacking from a MacBook on osx :)

so [problem at hand] you will want to edit:

/System/Library/Extensions/FTDIUSBSerialDriver.kext/Contents/Info.plist

If you are using ARM-USB-OCD comment out or delete the following:

<key>Olimex OpenOCD JTAG A</key>
<dict>
<key>CFBundleIdentifier</key>
<string>com.FTDI.driver.FTDIUSBSerialDriver</string>
<key>IOClass</key>
<string>FTDIUSBSerialDriver</string>
<key>IOProviderClass</key>
<string>IOUSBInterface</string>
<key>bConfigurationValue</key>
<integer>1</integer>
<key>bInterfaceNumber</key>
<integer>0</integer>
<key>idProduct</key>
<integer>3</integer>
<key>idVendor</key>
<integer>5562</integer>
</dict>

(If you are using another adapter you will need to find its entry)

Then when the XML is edited reload the kernel module:

sudo kextunload /System/Library/Extensions/FTDIUSBSerialDriver.kext/
sudo kextload /System/Library/Extensions/FTDIUSBSerialDriver.kext/

information from: http://forum.sparkfun.com/viewtopic.php?t=8923 (OpenOCD + OS X + USB JTAG)
[G1 Android Development] gymmy:
CHeers for that exterry, issue is , if i do that it kills my other USB --> ttl serial device which is also connected to the phone..

Anyhow this is the least of my worries at the moment, im trying to think of a way to connect these pins without soldering them to the board A) because i dont wanna and B) its too risky ... I got some vero board today but the density is out, so looks like ill have to try another way :(

Hope ya day is going well.

G