yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] xaueious:
I wanted to ask for an update for JTAG progress on the HTC Magic. It's been a while since the JTAG points have been discovered, but I'm wondering any of you guys got a Magic to play with now.

Shanzhai Android

Oh and off topic, but I think Android handsets have not been cloned directly because the cost of cloning the device makes the device more expensive than what most Chinese consumers would pay, as the cost of components makes the new Shanzai phones equal in cost to the gray market refurbished phones. The few that have come out actually are more expensive than used HTC phones brand new, and suffer from a range of quality issues.

This is my own term, but gray market refurbs refer to phones that contain parts from different physical phones, and will have unmatching IMEI numbers between the physical components. Look-a-likes, which typically run MTK OS and have much slower hardware specifications where the manufacturers are cutting corners to make money and to bring down the cost of the handset. Typical cost for look-alikes are around $1000RMB, where as refurbs cost a similar amount of money as used units ($1800 and up RMB) since there is no distinguishable difference between a genuine and a refurb to most. I'd imagine that the production efficiency of HTC and other real manufacturers make up for what even the Shanzhai manufacturers try to pull off.

In any case, those look-alike clone phones are physically different than HTC phones all the time. I have yet to see Shanzhai cellphone clones that are actually replicas. They usually just clone the looks, then downgrade the hardware significantly and slap MTKOS with an iPhone skin on it.
[G1 Android Development] ezterry:
bart9984 sounds close to attempting a de-brick from a SPL/radio flash boot mode 3 brick.

Otherwise regarding the rogrers magic phones I'm still waiting for a phone to poke; http://xdaforums.com/showpost.php?p=6127419&postcount=137

One person has indicated interest in providing a test phone.. but we have yet to find a mutual time to link up.

Since my debrick and re-root I'm not sure I've heard of other attempts... successful or otherwise;

Unless we count (a) commercial products posting in as many places as possible to increase google results. (b) the fact I've repeated the process a few times now..
[G1 Android Development] gymmy:
im still working on debricking the Magic with serial interface, have managered to be able to write to the NVRAM with a utility so i hope (fingers crossed) that ill be able to get a NVdump from phone that is operating so i can see if there are many differences between the 2 and look at changing these.

Does anyone have one ?

G.
[G1 Android Development] sigo2oo9:
Hey All,

Apologies for putting some more Magic info in here, I know the JTAG points have been posted for the 32A, just took some pictures of my 32B and trying to confirm theyre the same - Couple of pictures below, same thing in both just not sure which is easier to view.

The red are the ones I'm assuming are the same as the 32A hardware however the green/blue I'm not sure which is the correct point? I think it's green given the proximity to the upper side of my picture when compared to the points outlined over here http://www.omnia-repair.com/forum/topic/htc-g2-32a-jtag-pinout

The other question I have is trying to find a 2.6vref off the magic's internals.

I haven't looked yet as I'm waiting on the parts for the serial cable etc to arrive before taking it any further.

If anyone has any further info on the Magic I'd love to know :)

Thanks
[G1 Android Development] scholbert:
Hi sigo2oo9!

Think you're right, the green one seems to be the RTCK signal.

Concerning Vref...

Personally i got no Magic board, so i'wont be able to measure anything..:p

Good luck for your research!

scholbert
[G1 Android Development] ezterry:
The green one.. but you don't need to hook up either the green or blue its RTCK

..I'm not sure what you are asking exactly..

If you have raw access to ram.. just try to simulate my softload of the SPL:

http://xdaforums.com/showpost.php?p=5934885&postcount=6

If you have raw access to flash load a SPL+Recovery compatible with your radio

SPL starts at: 0x02400000 (block 288) [hboot.img]

Recovery starts at: 0x26c0000 (block 310) [recovery.img]

2005 SPL:

Tidus:spl ezterry$ ../fastboot-mac oem listpartition
... INFO[radio] start block=0, size=287 (36736 KB)
INFO[hboot] start block=288, size=6 (768 KB)
INFO[misc] start block=294, size=2 (256 KB)
INFO[mfg] start block=296, size=2 (256 KB)
INFO[sp1] start block=298, size=6 (768 KB)
INFO[misc2] start block=304, size=3 (384 KB)
INFO[mfg2] start block=307, size=3 (384 KB)
INFO[recovery] start block=310, size=40 (5120 KB)
INFO[boot] start block=350, size=20 (2560 KB)
INFO[system] start block=370, size=720 (92160 KB)
INFO[cache] start block=1090, size=240 (30720 KB)
INFO[userdata] start block=1330, size=718 (91904 KB)
INFO[cpld] start block=0, size=0 (0 KB)
INFO[microp] start block=0, size=0 (0 KB)
OKAY
[G1 Android Development] gymmy:
Hi ezTerry,

No i dont have direct access to memory yet, but i think there may be a way to turn S-ON to S-OFF from settings that are stored in NV-ram.

What i want to do is get a identical dump from a 32b S-OFF and compare the 2 .

There is a tool in the qsrp bin directory called RF_nvdump (i cant check this at the moment as im at work) when you run this u can get a dump of the RF NV settings. and there is also another tool which allows to dump the entire NVram which has a few security settings in, Issue is , is that to write to NVram it normally tries to restart the phone in download mode (which doesnt work as its in ARM11 Mode3) and fails :( But... RF NVdump can write to the phone when in AT Command mode which is great.

Hope this makes a little sense

G.
[G1 Android Development] ezterry:
We don't know any one with a true S-OFF phone.. but I'm fairly sure that is a configuration in flash but I wish you luck.

The Eng SPL and either are hard coded to have S-OFF regardless of the radio/phone security flag; or have a fastboot option in the case of the Nexus and some Magic SPLs to override (but presumably not change) the radio/phone security flag [which is likely saved in MISC next to the boot mode]

I won't say there is no exploit on the AMSS command line that we can't exploit.. we just don't know it yet so its no simple task [I have a long list of things that if 1 byte was different we could use but no way of setting said bytes]
[G1 Android Development] jcarrz1:
Are these methods working reliably enough that any given g1 could be un-bricked? With enough knowledge of course.
[G1 Android Development] ezterry:
any current g1/dream where blue light mode still works yes.. there may be some poking on the software side to make it succeed but it ought to work.

The trick I mention here ought to even help make the various software stacks behave the same at least until you get booted again; then you can flash your system of choice as usual.

In theory we may be able to restore some G1s where the blue light mode is not functional but this requires some more software to operate (the ORT solution already has such software.. but we have not found the time)

This is assuming of course you are not looking for a support agreement.. if you want that you will need to check out other G1 jtag solutions.
[G1 Android Development] gymmy:
Yeah i agree with you over the one byte toggle, just nop out the jump or call and it would be all sweet but alas i cant get access to ram without jtag at the moment..

You by chance dont know the format of the radata command do u ? i know this works on S-ON along with a few others, and S-ON i dont think is HARD coded, but is more a switch as the radio images still contain the other S-OFF commands so im sure there is some way to toggle this ...

So pretty much im working on turning S-ON to S-OFF and then going from there as soon as i get sick of it ill donate the phone to the jtag efforts, but i would be surprised if there isnt a serial solution.
[G1 Android Development] ezterry:
yes..

radata [start address of radio.img in physical memory] [length of radio.img]
​

it validates radio.img's checksums and signatures.. well unless we poke another word in memory..

Its validations will trigger a memory read from the address specified which in turn triggers an exception handler for a memory read.. in older versions [pre-android phones] entered DLMODE to upload info to the phone and change bits in memory.. this also seems blocked to us..
[G1 Android Development] gymmy:
great work mate !

I see that spark fun are doing jtag arm devices for about 50$USD so might grab one of them and sort it out on my phone also.

Anyhow great work, i really should sort out my 32b, but i bought a nexus1 in the mean time.

G
[G1 Android Development] ezterry:
Congratulation again.

I've updated my original post with the offsets to 3.22.20.17 (as you can see its the same as the 26I radio .. indicating EBI0 and EBI1 are really very similar probably just some build variables changed.

odd.. maybe you nop-ed 0x00902b30 instead of 0x00902b2c

regardless you managed the correct end result.. so not much to worry about (I know you spent many waking hours on this in the last 24 to 48 hours)

As for the power thing.. I've never needed to have +5 connected to start the jtag successfully.. maybe part of your battery issue.. or a quirk of the phone.. (unless the phone was showing the blue light but not really booted)

The needing it detached for oemspl to work however I have experienced ..
[G1 Android Development] scholbert:
Congratulations....

Fantastic!

Well done bart!!!

I really love this hardcore hacking stuff....:D

Simply nothing more to say.

Cheers,

scholbert
[G1 Android Development] bart9984:
here again after some sleep :)

I tried loading both 1.33.2009 and my original spl (not the one installed but the the original by tim) and I remember to have nop-ed with mww 0x902b2c 0x0. But as you said I was waked for a lot of time and now I can't be sure any-more

bart99
[G1 Android Development] anthonws:
Hi gymmy,

Is this the jtag device you talked about? http://www.sparkfun.com/commerce/product_info.php?products_id=8278

Thanks,

Anthon.
[G1 Android Development] shawe_ewahs:
It's the same proces for HTC Magic 32B? Or its the same for HTC Dream?
[G1 Android Development] dr4stic:
offered as a service?

I know this likely doesn't want to be seen here, and I'm sorry about that. But I'm having a hell of a time cold calling stores and finding anyone locally that can do this sort of work.

Does anyone know if there is a mail in service (or a place reasonably near miami) that does this sort of thing? What might one expect to pay for something like this anyways?

I don't have the technical experience to do this sorta thing myself, but I'd be willing to learn. Are there any guides/info/equipment I should look into if I wanted to try this myself?

Thanks, and I appreciate all the work you all have put into this. You guys are amazing!
[G1 Android Development] gymmy:
nope its this one

http://www.sparkfun.com/commerce/product_info.php?products_id=7834
[G1 Android Development] gymmy:
have just bought the jtag device so will make up an actual adaptor this weekend rather than soldering on to the main board.

Just have to wait for the item to arrive from the US now.

If it works well i don't mind unbricking a few peoples devices for them for free of course.

Mind u i am in NZL

G.
[G1 Android Development] bart9984:
Hi Gymmy,

Jtag interface is the same used by me and ezterry.

It's a good idea to create an adaptor since pin on magic are very closer each other... Also me was thinking about something similiar but where I'm now I have no drill and other stuff. From my measures the pin are 1mm diameter and distance between two pin is also 1mm.

You can think to use one of the screw hole to fix the adaptor. If I remember well the hight from pins and top of the metal plate is about 2.5 mm

Here I post a picture of a top view scheme I drawed some days ago, you should verify the measures. I also attach a svg and dxf version.

Let us know if you got to make it :)

bart99
[G1 Android Development] gymmy:
cheers for that,

i have some vero-board lying about so will make it up out of that and some pins i have from a PC adaptor and should be able to just clip it together .

G
[G1 Android Development] cmarti:
This is great! I can send my Fender to anyone that knows how to unbrick it, I flashed the wrong radio and now it says perfect SPL.

I am in the US (Orlando Florida)

Don't mind sending it oversears and I can pay by paypal or any other method you see fit.

I'd love to see my Fender up and running once again.
[G1 Android Development] olvap377:
thats sick
[G1 Android Development] marcimix:
good one ;)

this is a way to pspl 1.76.0009?

Please help but this metod to hard for me ;(
[G1 Android Development] sigo2oo9:
hey guys, anyone know if this one would work?

http://www.littlebirdelectronics.com/products/JTAG-Programmer{47}Debugger-for-ARM-processors.html
[G1 Android Development] gymmy:
it says that it works with OCD so i dont see why it shouldnt work.
[G1 Android Development] ezterry:
If you are using the parallel port anyway:

http://www.robotcraft.ca/webshop/Co...-bus-transceiver---74LVC245/product_info.html

And wire to parport as per scholbert's instructions

http://xdaforums.com/showpost.php?p=6055979&postcount=412

Since we don't use srst .. you can omit R1, R2, R3, and T1 and leave pin2 of the par port unattached. (making it really just one chip + male 25pin port. (and a capacitor)

If you decide to combine this with the L317 circuit rather than pull the 2.6Vref from the phone; C2 in the L317 circuit *is* C1 in the 74LVC245 diagram..

Given the tangle of wires going into the phone.. making this on a prototype board sounds like a no brainier .. 'cept for the fact none of my computers have parports anymore.

---

Otherwise [to return to your product in question].. make sure your $30 version of the $2-3 chip supports the 2.6V
[G1 Android Development] joeymombini:
Anyone want to unbrick my g1.
[G1 Android Development] skweints:
If anybody is interested, I've got a Magic 32B that needs to be debricked. I don't quite have the cash to go buying all this stuff I need, but if the price is reasonable, I wouldn't mind paying to have this done. I'm located in the US as well. :-)
[G1 Android Development] Reikan:
Anyone debricking for cash?
[G1 Android Development] lbcoder:
You don't have the $2 you need to buy the parts to fix it, but you think that someone will do it for you for LESS THAN TWO DOLLARS????
[G1 Android Development] ezterry:
Wiki Wiki Wiki

Ok ... I think my writing skills are gone for the day:

But JTAG via wiki.. still needs work [links to CFGs better jtag point images ect] but a start: http://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC

Obviously feel free to clean up; elaborate; and if applicable correct; [as it is a wiki] .. and the reason its on CM wiki not xda wiki is I much prefer the media wiki interface..
[G1 Android Development] ottawanate:
It costs a little more than $2 in parts my friend.

It's at least $50 for a JTAG USB OCD (no one has PARPORTs anymore)

Then u need a serial cable to make (yes that is $2)

I wish u would stop posting your "$2 in parts comments" in all the threads on here it's not helping anyone.
[G1 Android Development] dr4stic:
Yeah, I'll definitely agree with that. From a standing stop, it'd cost me AT LEAST $100 to get the stuff that would get me up to speed, and that's flying blind. That's also assuming I won't irreparably damage the phone in the process because I've never soldered anything more than 2 wires together before in my life.

So, lets realistically look at the parts list for a minute and see how the $2 stretches.... I've found plenty of Nokia DKU-5 cables online for something like $10 in shipping... Lets assume I have plenty of USB cables laying around I can use for the other end of that cable. I'll need a multimeter to verify the voltages and try and make sure I'm not doing something stupid, there's another $5-10 depending on how much I find one for. So, now I'm at about $15-20 for a cable that may or may not work because I may or may not screw it up pretty bad. Considering there's a HTC to Serial cable selling on the net for $35, the price doesn't seem that bad considering I still have serial ports nearby.

Lets now move on the JTAG part of the bill... The item linked in the wiki is gonna run AT LEAST $80 after being shipped. And lets be honest, even if there were other JTAG alternatives, I'm not gonna look for them because I don't really know how to judge what will work in this situation or not. Lets add in some of the equipment I might need... plenty of wiring, a half decent soldering iron with some really thin tips. Lets just say that adds another $20.

So now I'm at $120 and I've still never done this before.

I really appreciate what all the devs are doing here. You are doing tremendous work and you will ultimately save many linux devices that may otherwise have been headed to a scrap heap. I'm tempted to just consider my phone a complete loss and do my worst to it. I've already cracked it open to take a look at what I might be dealing with, and it was scary. The transparent glue on my Magic will have to be scraped away carefully after some heating with some sort of heat gun... being a noob I'm thinking a hair drier or a hobby knife that's been heated with a lighter. I'm also trying to figure out if I can just rig some pins into something that'll let me push them into the testpoints and hold in place long enough for me to do the unlocking, get a recovery on the beast, and let me seal up the thing.

Can you see the frustration now? There isn't currently a sure fire way to unbrick from serial alone, it's still a serial+jtag process. And the guys here are doing a fantastic job. But I can't see spending $150 to, lets face it, further botch a phone.

Personally, I'm thrilled that Omnia's come out with something that would let them unbrick G1's and Magics... I just wish I could locate a shop that would do it locally. I called about 20 of them on thursday.

EDIT: I wanted to add that for a lot of newbs following this thread, it'd be worth something to have someone more competent salvage their phone... It's certainly worth $50 to me, and I'm pretty sure my phone is a candidate for some salvage. Might even help pay for some of the equipment cost to do the deed in the first place :-)
[G1 Android Development] gymmy:
I really dont think that these types of comments are at all constructive mate, if you can do it for $2.00 good on ya, but I sure as hell cant.

$127 for USB Jtag device

$30 for ttl device

$11 for extUSB plug and cable

+ my time

This add to more than $2...

G.
[G1 Android Development] bart9984:
good job, i'll read it right now
[G1 Android Development] LeonardoFloripa:
My congrats...

.. to all the hacker working in this issue.

I still didn't got the guts to try what you've done, but I hope that others can jump in and further simplify this proccess.

Thank all of you.
[G1 Android Development] dr4stic:
does anyone know if this would work?

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=160393160605

I'm trying to bring the cost down a little, and I do have a machine with a parport :-) This would be $26 vs. $80. If I could get the serial cable together for $10 or less, I'd definitely invest in the rest of the supplies to try and do this.
[G1 Android Development] ezterry:
I know its hard when everyone is fighting about the super expensive parts.. but I did post about a similar thing yesterday:

http://xdaforums.com/showpost.php?p=6282188&postcount=527

The problem is the Wiggler's low end is 2.7V and the phone requires 2.6 ... this means it might work; or might work if you use a slightly higher voltage than ideal.. but to be sure its safer to use something rated for 2.6. (and ideally a bit below that)

Simply there are two requirements for the adapter:

1) openocd compatible... many are (and certainly the Wiggler is)

2) supports 2.6V referance voltage.. if you don't see a voltage range assume it won't

At the end of the day i don't recommend it if the voltage range isn't specified (if you already own one maybe its time to experiment if the hardware you have has higher than rated tolerances.. please use multi-meter before phone..) but otherwise consider building scholbert's chip.. with ~$1.60 chip

Oh and for those thinking all the USB Jtag adapters are expensive.. I think I spotted a USB -> parport adapter on amazon for < $10 ... can't promise the Jtag will be fast (USB->parport->jtag) but it ought to get the job done
[G1 Android Development] lbcoder:
EVERYBODY still has parallel ports.

If not on your (crappy) laptop, then on your DESKTOP machine.

Definitely on the old sucker in the back of your closet.

And even if you don't, $5 gets you a USB-to-parallel port adapter. So you're up to a whopping $7.
[G1 Android Development] lbcoder:
$0.27 for a 74245.

$0.87 for a max232

wire is free. extusb plug NOT REQUIRED -- you're soldering anyways, might as well just solder on the serial wires.

Then throw in a few electrolytic capacitors and resistors, you're up to what... $1.25?

It isn't my problem if you are too close minded to hold on to your money. I'm telling you, if you use your head, you can do this for UNDER $2!!!
[G1 Android Development] marxmarv:
Uh, you forgot the soldering iron, hot rod. And the solder. Never mind that Rat Shack doesn't stock some of these parts and probably can't special order the correct series of 74245, not everyone has a Rat Shack close by, and shipping for any one of these items is well over $2.

So, back in the real world, unless you're already an electronics enthusiast with a healthy stock of parts and skills who places regular orders to electronics distributors and gets to use their parents' FedEx account for free, this is not a $2 project. Factor in the risk of damaging one's board, which even our good fellow ezterry with his mad skills did, and the average price goes up further still.

While I commend your efforts in abusing the noobs to drive them back to Q&A, you could at least get your facts right first.

@ezterry, typically the absolute maximum voltage range on I/O lines on most CMOS is -0.3v to Vdd+0.3v to avoid the risk of normally reverse-biased diodes conducting and latching up the chip. A small resistor (ten ohms or so?) in series with all lines except GND would reduce the risk of overshoot causing latchup, but you may have to reduce the TCK speed a bit to get full clean voltage swings to the chip.
[G1 Android Development] lbcoder:
EVERYONE, withOUT EXCEPTION, who has the ability to do this job, ALREADY HAS the required tools.

EVERYONE who has the technical capability of doing this KNOWS that ratshak is NOT an electronic components store.

EVERYONE who has the technical capability of doing this KNOWS a place that IS an electronic components store THAT DOES stock 74245's.

So YOU get back to the real world. There is NOT ONE SINGLE PERSON who does NOT have a soldering iron who has even the faintest chance of getting through the procedure without destroying their board.
[G1 Android Development] gymmy:
Well I dont see why i would want to re invent the wheel and i prefer to have a device which is manufactured to limit problems.

Anyhow i dont see how this is helping people that have bricked their phones.

As soon as things have arrived from the USA and i have built a board that mates up on the jtag points so there is no soldering id be more than happy to unbrick a "few" phones for free or for a donation to go to ezterry for his work in solving this issue.

I do live in NZL so postage would need to be covered. No guarantee's would be given and it would be at the owners risk.

G
[G1 Android Development] n3rdftw:
too true

if you don't own a soldering iron... well then you probably should never touch anything relating to circuitboards and should never deal with electrical components
[G1 Android Development] gymmy:
So were you born with one ? how many things did you kill while you were learning, and lets face it, its better to play on a phone than something running in high Amps !