yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ulissescg:
Hi Guys

i have started again doing the unbrick on the android, now i have an ADP1 and i have did almost everything but i have get in the step to run the fastboot, looks like i have a problem with the ubuntu, I’m using lucid and I’m getting this error when I connect the USB Cable after I did the “cego” command and disconnect the Serial wire…...

[ 1215.992034] usb 5-1: new low speed USB device using uhci_hcd and address 21

[ 1216.400033] usb 5-1: device not accepting address 21, error -71

[ 1216.400057] hub 5-0:1.0: unable to enumerate USB device on port 1

I’m not a linux guru.. is there someone that could help me with some linux commands or advice??

Or in the other hand, if there is a way to continue using the serial and erase the boot and apply the recovery image??

I’m using segger j-link with OpenOCD

thanks
[G1 Android Development] robuser007:
Does the H-JTAG (10 usd Dollar, 5 Dollar shipping) also work with OpenOCD? I can't find any config files for the device, I have seen wiggler clones configs.

http://cgi.benl.ebay.be/LPT-JTAG-Pr...955?pt=LH_DefaultDomain_0&hash=item45f46d72db
[G1 Android Development] ulissescg:
i have used segger and the only think i did it was to modify the conf file and specify the interface, also i was using the segger software and I have enable the driver for that, but because the commands were different i decided to go and use the OpenOCD, just play with that…

Additional to this I have found that the Serial Ports and USB ( Tx, Rx, D-, D+ …) Goes to the main board thru the connector, I have track some lines and some of them can be access or soldered by wires on components like resistors or caps.. I will put the contact areas but I wanted help, if someone has one board where you can read the component part number or if someone knows what Chips are the drivers for the Serial ports I will take a look around and see if there are some open areas where you can solder some wires… like the Serial Port as a 50 ohms resistors to match the impedance and the D signals has some bypass caps I don’t remember well but, as soon as I get back to home I will double confirm..
[G1 Android Development] robuser007:
So I guess I can't use H-jtag for openOCD?
[G1 Android Development] scholbert:
There's only few things to consider when buying a LPT adaptor to handle with JTAG on the HTC Dream device (a.k.a G1):

1. You need a LPT Port on your host

2. Make sure you have a slight idea about how the things work out

(otherwise there are too many issues to fail and you might go mad)

3. The adaptor needs to handle with low voltage (Vref = 2.6V)

4. The adaptor should be OpenOCD compatible to follow ezterry's way.

If it's not, you'll need the connector assignments of the adaptor (assignment of the LPT-Signals basically) to tweak OpenOCD.

You know it's open source software but it will need some hacks :p

If you're a freak there's only few things to concern when building a LPT adaptor to handle with JTAG on the HTC Dream device (a.k.a G1):

1. You'll need a schematic of a wiggler clone or similar

2. You need some logic buffers to fiddle with (LVC or HC logic should do)

3. You may use any debugger for ARM9 to access HTC Dream and modify memory (OpenOCD, H-JTAG, ...)

Though it's very exhausting nowadays, but to read a good book of electronics is always a nice idea.

Stepping through the thread and do a little research on the web is recommended.

Best regards,

scholbert
[G1 Android Development] ulissescg:
ADP1 files needed and steps

Hi Guys,

i have set the serial USB ( i'm using Prolific PL 2303 ), the USB and Jtag ( J-link using OpenOCD) on a ADP1...

i have being trying to load the files on the wiki but looks like when i try to load the recovery (of course ) did not work on the ADP1, the i try to load the original files from developer.htc.com/adp but when i get to the stage of loading the recovery,then i loaded the 1.33.2004 but i could not get the cego commands with the steps on the wiki...

anyway if someone has unbrick an ADP1 could you please let me know what files have you use and if possible the steps to follow, i have connected well and i can sent commands i just attach the commands i get when i turn the device....

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)

NAND_FLASH_READ_ID : HYNIX_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Android

�flash 16 bit

-msm_nand_probe

[MDDI] Bitmap_Width = 480

[MDDI] Bitmap_Height = 640

[MDDI] RGB_Capability = 0x8888

[MDDI] Mfr_Name = 0xD263

[MDDI] Product_Code = 0x0

Board_PID : 0x1F

Wlan data header ++++++++++++++++++++

Signature : 0xEE1251

UpdateStatus : 0x2

UpdateCount : 0x5636

BodyLength : 0x2F0

BodyCRC : 0xA2F72348

aDieId(0) : 0x70018020

aDieId(1) : 0xA2CA7284

aDieId(2) : 0x20000000

aDieId(3) : 0x40A

countryID : 0x10

Wlan data header --------------------------

ARM11 Boot Mode: 3

Platform: HBOOT-7201A

[ERR] partition_read::Failed to read page 19840 or it is empty

[ERR] boot image does not exist!!!

###[ Fastboot Mode ]###

setup_tag addr=0xA8000000 cmdline add=0x8807103C

TAG:Ramdisk OK

TAG:smi ok, size = 64

TAG:hwid 0x0

TAG:skuid 0x1BE00

TAG:hero panel = 0x0

TAG:engineerid = 0xFFFFFFFF

Device CID is super CID

CID is super CID

Backup CID is empty

setting.cid::11111111

serial number: xxxxxxxxxxxx

command line length =286

active commandline: board_trout.disable_uart3=0 board_trout.usb_h2w_sw=0 board_

PARTITIOM_NUM_MAX =6 Valid partition num=6
[G1 Android Development] trock62:
If they would only come up with a snapon style chip like the PS2 I could revive two bricks.
[G1 Android Development] ezterry:
Um, I'm quite sure they will work if done as in the wiki.. and I'm not sure that's actually bricked since it entered fastboot mode.. and it says nothing is flashed to recovery.. provide more details.. my guess is your mixing and matching valid software stacks and running into issues.. or forgetting to flash something.

On a side note: Interesting the adp1 is super Cid '11111111' but still security locked.
[G1 Android Development] ulissescg:
Hi ezterry

yes that was also weird for me, also the "fastboot mode" that shows when i power on, but when i forced to pass the CID with your information on the wiki, after that i'm not able to unlock the CID and apply the cego command, before I did well but at this point did not respond to that.. i'm sure i did the steps as the wiki and at the end I can not apply the recovery because partition does not exist or something like that, the only think i remember it was that when i power on there was a fastboot letters on the phone with the phone logo on the screen, but i have connected the USB and the adb or fastboot did not respond....

i will do the steps as the wiki and take a note of the results and i will be posting here... i guess the ADP1 needs a different settings and files...

also with this we can search for those differences like you notice the CID pass or code and as an example we can see where the root variables are because this is rooted by default and the activation of the phone is different, when you first use the phone of after you apply an update the phone allows you to cancel the activation or postpone and you can enter to the system without connecting to the carrier or by a wireless network...

thanks

ulisses
[G1 Android Development] ezterry:
the jtag process dosn't touch the cid or security lock, just by passes the security lock for a specific radio.

Include the 'version' command so we can verify the radio.. and the commands to openocd.. no diffrent config 'cept for the adapter section I hope.

You are confusing many things here.. activation/root == android rom not radio/spl/recovery the '11111111' cid will allow roms from any region (nbh files) until you get a spl up and running this won't help much. And the process assumes the user isn't installing a stock rom.

My best guess is you missed something, or wrote something to the wrong place in ram..
[G1 Android Development] ulissescg:
OK, i will post all the steps and files i have used... by the way, for your information, i have being playing with the jtag and this j-link does not need the 2.6 v reference i have disconnected and i get same result with the commands and a succes connection... i can give you more datails also using the original software from segger...

thanks a lot

ulisses
[G1 Android Development] robuser007:
I just ordered one olimex parallel (25 Dsub) arm jtag which supports openOCD.

Can't use this one I guess? Can I lower the supported voltage?

EDIT1: Think I get it. I'll have to make this(link) when the JTAG has higher than 2.6-2.7 Vref voltage support. Am I right? http://www.national.com/mpf/LM/LM317.html#Overview

How much should it cost to make this (pieces)? Can anyone show me a picture of how it's made (I understand the picture, but I only saw those things in theory in college) ? How long should it take to make (maybe I ask in the electronic strore, I did that in the past) ?
[G1 Android Development] t3ntacle:
only blue led mode

Hi experts.

After I successfully debricked my friends G1, I bought a brick Magic on eBay for myself. The phone is always entering blue led mode, it does not matter what key I'm pressing (or not pressing) while switching on. I cleaned the trackball, checked the button with multimeter (it is OK, not closed by default).

Today morning after 8 hours switched off w/ battery connected, the first and only time the Vodafone logo appeared, and stucked as a normal brick does.

What can be the problem ?

A have not attached the jtag yet (I can't solder that small testpoints at home), but the serial connection is working:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE1

It seems that is really a blue led mode.

If I flash the correct radio and spl, may the phone boot in other mode than blue led ?

Thanks,

t3ntacle

PS: I asked this in other thread already, but I think it's a better place for this problem :)
[G1 Android Development] scholbert:
Hey robuser007!

I've written a lot of comments already concerning voltage supply and logic families, but it seems no one reads it :o

It depends on the logic buffer inside your LPT-Adaptor if it might handle the voltage level.

The background:

All JTAG signals on HTC Dream are working at 2.6V.

The adaptor sends and receives data from the mainboard.

The data send from the mainboard will not increase above 2.6, because it is the driving voltage of the output buffer on the mainboard.

The adaptor must be capable to understand these levels and detect high or low accordingly.

On the other hand the adaptor should not send any data to the mainboard higher than ~2.6V.

If the voltage from your adaptor is too high you might damage the JTAG interface of your Dream.

Basically you'll have to take care to use levels in this range.

It doesn't matter what you use to power your adaptor (mainboard Vref or external LM317 power supply) if it is limited within 2.6V appr. +/- 5%.

Maybe 3V is little too high... if you're a risky person try it!

I'm not a teacher and maybe this sounds very confusing, but i hope you understand what i tried to explain.

Best regards and good luck,

scholbert
[G1 Android Development] robuser007:
You mean that all the wires from the jtag to the dream will send 3V, even if I use LM317 ? In that case it doesn't matter if I use the LM317 (just a waste of time, but now I already know how to build it).
[G1 Android Development] scholbert:
Partly.... the adaptor will only send 3V to the dream if it gets powered with 3V.

This might be worse.

If the adaptor is powered with 2.6V (either from the mainboards Vref, or external LM317 supply) it will send the correct signal levels.

The main issue is, that the logic inside your adaptor must be capable to work at 2.6V, that's all ;)

At least HC or LVC buffer types will do!

Other's might fail to work because missing low voltage support.

The other thing is your LPT port.... but i'm tired to write that down again.

Try and report!

Regards,

scholbert
[G1 Android Development] robuser007:
Thanks again. I actually bought this JTAG because I couldn't find another type (LPT) with cheap shippings, overlooked the voltage because it was an olimex.
[G1 Android Development] scholbert:
Yepp!

These are logic families.

Refer to: http://en.wikipedia.org/wiki/Logic_family

Yeah, it's the same.

Try and error is the best.

Yepp, try EPP first, you may also try standard mode in your BIOS (generic LPT).

No problem... maybe this thing would do it ;)

Regards,

scholbert
[G1 Android Development] ulissescg:
Almost Done

I have succesfull load the recovery and now I have see the recovery menu….

After that I have loaded the Cyanogen mod 4 because it should work with the actual radio I load by jtagging… but after resetting the phone it stuck on the TMobile logo and I have wait for about 10 minutes and decided to disconnect power (battery)…

After that I try to load the DangerSPL using the fastboot mode because it should work with the actual radio I have but it boots correctly and restarts … after that did stock on the tmobile logo…

Again a try to load the radio 6 to load the cyanogenmod 6 but did not accept the radio 6 with the fastboot mode…

I know I’m doing crazy think in here and maybe mixing but it’s hard to read a lot of pages and information…

One question that cames to me yesterday, some rooms ask you for a rooted phone, but after doing the unbrick you don’t have a room installed isn’t?? if that is the case we need to load an original rom (Factory Default) and then continue qith the process of rooting and upgrate the SPL, Recovery, Radio and ROM??

Did someone know the procedure to load a newest Rom and what are the best ones??

Thanks for your help
[G1 Android Development] ezterry:
You lost me...

The jtag procedure leaves you with an ebi1 (3.x) radio and an ebi1 recovery ready to flash an ebi1 rom

If you dont want the ebi0 rom, the page also has instructions for returning to an ebi0 (2.x) radio and ebi0 recovery to flash an ebi0 rom

Either way you had if you followed the dream instructions danger spl 1.33.2005 that allows full fastboot access to flash any system you want (magic users with an equally strong spl on the magic 1.33.2009)

Cm 4.2, 5, 6 can all be flashed as per normal cm instructions once you can boot either the ebi0 or ebi1 rom (flashing the ebi1 port file as needed)

If you do return to the ebi0 radio you can also flash many other roms such as chromatic, super-d, even the androd 1.5 version of the adp1 from the 'recovery' zip on the htc websitre.

Why unroot once you have an enginering spl..

If you need details for a specific rom look on the roms website/post
[G1 Android Development] ulissescg:
Hi ezterry

An small intro:

Well, I have being investigating what does each part on the android phones, what does the radio does, the SPL, the HBOOT, EBi1, 32B, 32a Board etc… please understand that there is a lot of information that is not structured well on this and other forums, all of the guys that have experience they talk in their terms and with the words but for some one that it’s just entering it’s hard to understand in that way…

I really appreciate your time ezterry and also to scholbert that always take your time to explain…

Going back to the topic….

Let me clarify::

Rooting your phone is to allow you to load custom roms, this needs a modified version of radio and recovery, radios under 3. X Are already modified?? So if you have a 3.x radio you don’t need to root again?? Under 3.x you called ebi1, what it that means?

Below 2.x radio you are in a ebi0 and you can only load a factory roms??

The engineering SPL we have load thru the jtag (1.33.2005) allows us to flash any system we want like as you say the danger SPL does, or if I wanted to flash most of the roms out there it’s recommended to have the Danger SPL??

I think I got it, I’m missing to load the ebi1 port to my device…..

this is why the cm 4 could not load it... i will check it...

Ok I will play more with my device later today…

I have confirmed that the segger jlink does not need the 2.6 V ref and I will sent you the conf file I have used and you can upload in to the wiki, I remember some one was using a different device that have a command similar to the ones in the segger to write a 4B 8B data, I think it will be good to post those commands for a different jtag interfaces..

Thanks again

Ulisses
[G1 Android Development] ulissescg:
success

i was missing the EBI file...

anyway, i have successful unbrick the phone and now i'm using the CM6..

is there something else to do and start investigating, i will keep this phone with the jtag, serial and usb for testing....

regards

ulisses
[G1 Android Development] scholbert:
well done........

Also followed your adventure... Congratulations!!!

Maybe we should give away the gold medal award for de-bricking ;)

Mmmh, we should start to integrate MSM NAND flash support for OpenOCD some day... but that's more software hacking.

Anyway now that your environment is perfected, you might debug and/or dump some memory areas in IRAM (phys. 0x80000000, especially 0x8000e000 onwards) using blue led mode.

There's still no de-bricking solution for devices sticking in this part of boot code as a result of corrupted radio ROM.

Have fun!

scholbert
[G1 Android Development] joeleenus:
Bricked G1...

Hi,

I want to ask for some advice!

I just purchased a "broken" G1 from ebay in the hope that I would be able to fix and sell on...

However, it is proving more difficult than initially assumed.

The phone fails to turn on unless charging. It doesn't boot into recovery and instead stalls at the flash screen (T-mobile G1). The phone feels relatively new (slide is tons better than my working G1) and I don't think has been rooted.

Discovered not rooted, but when updating via the T-Mobile over-the-air service system froze.

Is there anything I can do to salvage this G1? Or is it destined to return to ebay...

If this isn't appropriate for this thread please let me know!

Many thanks,

Joeleenus
[G1 Android Development] robuser007:
I've received my olimex J-tag today (send wednesday from Poland to Belgium), paid a few hours before, so it's a good adres for fast and cheap shipping (Europe).

I've dismanteled my G1: those soldering point are really very small, I'll buy an adapter.
[G1 Android Development] marquez.om:
Bricked my G1 :(

Hello guys,

Since I bricked my G1 last night finding this thread has been the only good news.

I have the G1, producing blue led light with Action + Power.

Anything else leads to the T-mobile G1 screen and stays there until the battery is pulled out.

At home I'm running Fedora Core 12.

Can any one point me into the right direction to acquire the JTAG components soft and hard needed for the revival ?

Also, anybody locally in Chicago that have done this ?

Thanks

Om
[G1 Android Development] scholbert:
Hey,

took me some time to find my notes about the headset....

Though most things had been pointed out already.

The shipped headset is called TM-151.

Here are the cable colours:

| A B C D E |
\1 2 3 4 5 6|

A: GND
B: NC
C: +DATA
D: -DATA
E: +5v

Connector Shield: GND (TM-151 headset: red/blue)

1: +Mic (TM-151 headset: white)
2: +Right (TM-151 headset: red)
3: Switch / Rx / CABLE_IN2 (TM-151 headset: green)
4: GND / Tx / CABLE_IN1 (TM-151 headset: red/yellow)
5: GND (TM-151 headset: yellow)
6: +Left (TM-151 headset: blue)

As you see everything we need is wired to the connector and if unsoldered from the little PCB would be a perfect base for serial adaptor.

Contacts A...E are n.c.

@marquez.om:

Read the thread :p

Best regards,

scholbert
[G1 Android Development] ulissescg:
Hi scholbert

i was checking the hardware and see that the serial port goes from the daughter board to the Main Board and we can have access to the serial from the main board and also have 50 ohm serial resistor to match the impedance, actually you can notice on the daughter board the differential pair lines that goes out from the USB connector, anyway i will take a look in to that and will post some pictures of that...

with this you don't need the adapter, also i will post the connection using a commercial usb to serial adapter like the ones using prolific ICs or the ones maybe you already have for some other phones that you maybe don’t know you have it… this in case some guys already have some serial converters at home.... this is how i did !!! :)

Also let me know if you need to trace some more lines to use the MSM NAND flash, as you may remember I have a set of board were I can trace the lines….….

regards

ulisses
[G1 Android Development] robuser007:
Can I test without the HTC serial wire (only jtag) if I can make a connection with my HTC G1 and PC using LTP (to test if openocd config and mine 3-3.6v jtag work fine)?
[G1 Android Development] scholbert:
Yeah, you may test your JTAG environment without serial connection.

If the CPU is detected within OpenOCD you are fine!

Thanks a lot for this offer!

If you don't mind, i'd like to get some more information abbout the following:

1. verify the excact position of the testpoint or solderpad for WDOG_EN (MSM7201, pin AC4)

2. try to find testpoint or solderpad for the signal CE# (should be connected to EBI2_CS0) to disable NAND access (MCP package, pin B6 <-> MSM7201, pin Y25)

Please refer to my mainboard maps based on your pics (i once posted these files) and you'll find the refered pins easily.

Best regards,

scholbert
[G1 Android Development] Flandro:
Debrick G1

Is there anyone out there that has successfully debricked a G1 that is willing to help me out? I will send my G1 to the person willing to help. I will pay for shipping and a little extra for your time. I will also send you my brand new Acomdata 320GB external hard drive as a gift. Please. Isn't there some kind soul out there? Shoot me a PM if you are interested.
[G1 Android Development] robuser007:
It takes a lot of time to debrick, it's not plug and play (but the jtag and the jtag adapter (no need to solder) helps).

If you just send the mainboard it's much easier (takes some time).

If you want an cheap recovery: just replace the mainboard with another one.
[G1 Android Development] drutort:
if i get some time, i might have a few soon debricked g1 main boards.. but i dont know when ill have time to get into it... i bought a about a 12 g1's broken some working etc.. built about 4-5 that are almost like knew for family members ;) to get those members of off none smart phones (and replace a old winMo heh) :D and now im thinking of selling my cliq and used one of the g1s... the cooks are doing really good job and i have been enjoying the g1 with froyo hehe
[G1 Android Development] lbcoder:
Now, bluelight mode is, of course, a program within the radio. So what you're looking at, of course, won't help for a bad radio.... but might make it possible to do some interesting stuff, like totally disabling security mode and disabling carrier lock.... :D

Which would make further SPL-bricks fixable withOUT jtag.
[G1 Android Development] sangeet.003:
Need JTAG Wiggler

Hello again,

I would like to know where do I buy the Jtag Wiggler Clone, M from India so please suggest me some way i can get it, even the one who have already de-bricked their phones if willing to ship it here will do.. m ready to pay for it..

please contact me at my mail id sangeet.sugwekar@gmail.com

I need it urgently.. plz..
[G1 Android Development] scholbert:
As i said, it's just a proof of concept. So in fact i used a device which is bricked because of corrupted radio (stuck in QCT-Boot @ 0x8000...).

As far as the MMU is disabled and the debugger could access the platfrom, this will do!

Though blue led mode is safe here.

Basically this makes use of some standard OpenOCD JTAG commands and the NAND registers are accessed directly.

I guess it would even work without any valid content inside the NAND, because OTP-PBL inside MSM chip does a basic setup of the chipset.

No, JTAG would be needed... or i didn't get what you mean?

The goal would be to directly flash the NAND from within OpenOCD.

Regards,

scholbert