yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] scholbert:
Hey bart9984!

Nice, looks like a perfect cable for serial debugging :D

Nope, got no clue. Maybe you should also try to find that at the bay :rolleyes:

Cheers,

scholbert
[G1 Android Development] bfikkert:
Is this something, http://www.handy-datenkabel.de/deutsch/produkte/datenstecker/index_usb.htm
[G1 Android Development] bart9984:
Hi bfikkert,

this should be good according to the image, I don't know german but it seem to be what I need. Thanks for the link, I've bookmarked it :)

For now I have decided to do a little experiment. After googling for a price to get the phone repaired I've noticed that there are not many news about the costs of a repair from HTC. Seems that if the phone is still on warranty and the phone freeze but displays the original logo (so no evidence of their mod tentative) , someone has obtained a full repair/substitution. But what if the phone freeze displaying a changed logo? I expect that the warranty is a goner but... :D So I sent the phone to get a budget from htc to repair the briked phone. If the budget is not much expensive (considering ship costs and budget costs) we have a proof that is possible to de-brick the phone with j-tag or serial commands, and wich is the cost. If the budget is about 250 euro so they want to change the entire board, in that case I wil return to the experiments with J-tag/serial hack because maybe they are too lazy to re-flash the phone via j-tag (we are pretty sure for now that is possible no?). I know what are u doing is also for the knowledge and I'm with you, but for thoose that have bricked their primary phone I think its a try :)

Cheers,

bart99
[G1 Android Development] lbcoder:
If it comes back fixed, it'll have a new IMEI. Proof of board change.

Note that they will ONLY do part swaps since that is easier than hooking it up -- the board has to come out anyways, so swap from a bin of boards that have *already been* reprogrammed.

They'll take the board out, put it in the "to be repaired" bin, shove in a new one, and send it back to you. Then YOUR board will go to reprogramming and testing, and get put into the "repaired" bin (or the crusher if it is totally fried), ultimately being installed into someone else's phone.

Or another possibility is that they simply don't bother with reprogramming and they all just go to the crusher.
[G1 Android Development] bart9984:
Hi,

yeah I agree width you, but I think it's different the cost of this operation if the board can be repaired or not. In case the demage is out of warranty and they have to send the board to the crusher the cost for me is the price of a new board. Different if my board can be repaired, in that case the costs should be very cheaper for me. In effect in this situation the budget for repair is the only true indicator of what they can/want to do ;)

bart99
[G1 Android Development] bfikkert:
bart99,

That would be a smart way to check if they can repair your phone true software flash and not with changing the main board. Maybe you can set some markers somewhere so that you can see if they have take it apart.

In my daily work i'm a production manager and I can not understand they assemble a product like the G1 with the software already in there. A Normal process will be to assemble all the electronic components onto the board and assemble that into the phone and then flash the software in there like one big package. Looking at the pictures where all the Jtag point are doesn't make sence. They cannot be reached in a simple way. Even when you disassemble the phone for a bit it is almost not reachable. :confused:

They have produced the phone without the software and somehow they (HTC) flashed it in there the easy way. (Time is money )

Probably by the time we find out how, the phone is obsolete. :rolleyes:

But hey... we had some fun in finding out how. :D

Good luke. And let us know when you find something.
[G1 Android Development] bart9984:
emmm... too late sent without markers :D

Yes, I can understand your reasoning. Maybe only the radio is flashed before assemble, so they can flash the remaining via serial commands (it would be a great scenario :) ) after phone assemble... Or maybe they flash all the software via specifics shapes that fits the jtag pinout before plastic/screen assemble. It would be interesting to know the best money/time procedure :) but i think its a bit offtopic :p

Sure i let you know the verdict ;) (Hoping its not too much expensive)

bart99

----------------------

IT COULD WORK!!
[G1 Android Development] irmatt:
i really am hoping on this to fix my G1, any more progress?
[G1 Android Development] scholbert:
Nothing worthy to report, i guess.

At the moment i'm struggling with some weird hardware issues on my device.

It seems i'll have to exchange the mainboard :o

I'm going to attach some serial adaptor the next days, to step into radio bootloader. Maybe i get something useful out of it :rolleyes:

BTW, i wonder where the other hackers had gone, e.g. BinaryDroid, r3nrut, Freedroid....

Heard/read nothing for quite some time now!

@BinaryDroid: Did you manage to get a new mainboard?

Cheers,

scholbert
[G1 Android Development] awebagar:
you can build your own JTAG

this schematic is working good..
[G1 Android Development] kotbehemot:
Some datasheets I found on the net

I found some files concerning 7000A and 7000. I know they differ a bit, but maybe it would be helpful for the main developers in this thread. I don't know if it's ok to post it here publicly, so just let me know by pm if you need it.

- MSM7200™ Software Interface Manual

- MSM7200A™ Chipset Training MSM7200A Baseband Topics (rather common)

- MSM7xxx Qfuses and Security 80-V9038-15 Rev. C (quite interesting read about the boot process and chip safety)

I will be debricking my brothers Magic when my BusBlaster arrives, so I wanted to have the opportunity to thank you guys for your hard work. I read the thread (it took me one day, with follow ups) and it was a great read. Also the insight you were able to get from the code disassembly was awsome. Thanks and in case of any problems with the process (I think I know the process quite well now, so maybe I will be able to debrick on my own) I will be back here for help :).

Great read!

Edit: I think I will try to limit soldering to the board, so has anybody any input on the quality of w!!!ww.ipmart.com/main/product/JTAG,Adapter,Compatible,For,HTC,Google,G2,,Magic,307712.php?prod=307712 vs w!!ww.multi-com.pl/index.php/en_US,details,id_pr,7864,menu_mode,categories.html ? The multicom (even though I'm from Poland) is 2x the price inc VAT and shipping, then the one from china (the other side of the globe). I would still like to get some feeling if I won't buy cheap, but 2x - as the Chinese quality may be inferior :)

Sorry for broken links (new/old user)
[G1 Android Development] kotbehemot:
My little brother's Magic works again. I used BusBlaster as JTAG, LM317 as 2.6V source, BusPirate as 2.6V UART, old broken headphones as ExtUSB cable and the cheap Chinese adapter. As I already had Buspirate and some other components, I managed to limit the cost to the adapter and BusBlaster (this one will be useful for my other projects, so I don't consider this cost as just for unbricking). Adapter was ~10usd (it works, but it's quality could be a bit better. There is some hot glue holding pogo pins together on top side etc), busblaster was ~50usd with shipping.

Some things I noticed:

-it's best to run openocd from virtual machine if you don't use linux already (it works well - it is rather complicated to crosscompile openocd as there is some problems with mingw compilation). Of course you need to compile it to be used with ft2232 interface.

-I used openocd 0.5 but I had to add adapter_khz option to config (10000 worked, higher probably possible). It had some warnings:

"Info : JTAG tap: arm9.cpu tap/device found: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)

Warn : JTAG tap: arm9.cpu UNEXPECTED: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)

Error: JTAG tap: arm9.cpu expected 1 of 1: 0xa01700e1 (mfg: 0x070, part: 0x0170, ver: 0xa)"

It seems that it finds arm9 core with a different version then in config specified in debricking manual. It works though without any changes.

-I had initial problems that I had 6.x radio that I didn't know of, so I had load_image second time with a proper offset. That solved all the problems (thanks for that info).

- After first attempt with cego it went into a different boot mode (as a result of watchdog, or the watchdog event itself was a result of some error in boot process). The second attempt was successful and it went into fastboot.

The fastboot allowed me to clear all the partitions and upload hboot and recovery, but after reboot the recovery didn't boot.

-THIS IS THE IMPORTANT PART: What I found out from console output, it always entered boot mode 1 no matter which combination of buttons I pressed. What I did to solve it was in console, in blue led mode, I wrote "setboot 0" and enter. It allowed to start in the modes depending on buttons pressed.

Afterwards the standard way to load the system from recovery was all what was needed to start a working system. I want to thank all the people that had input into this thread and who spent massive spare time to develop this open solution to debricking of magic. Thanks!

edit: I updated wiki on cyanogen to include the setboot 0 step in case it doesn't work.
[G1 Android Development] benosedr:
jtag

For repair boot zone to HTC Mozart, it's ok these interface?
[G1 Android Development] tonne99:
Hi,

after De-Brick my Dream only boots with stock firmware 1.5:

boot reason: PM_WDOG_TOUT_RT_ST

(PowerOn Status,Boot Reason)=(16,4)
NAND_FLASH_READ_ID : SAMSUNG_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Linux
Clearing RAM...
Load Bootimg header, addr=0x507C0000 taget=0xA8100000
bad=0x15E
Load Bootimg header OK
Load Kernel, addr=0x507C0800 taget=0x80008000 Size=0x00153004
bad=0x15E
Load kernel OK
bad block=0x15E
bad block num=1
Load ramdisk, addr=0x50934000 target=0x81000000 Size=0x00022C1D
Load ramdisk OK
SPL2 doesn't exist
Load OK.
SetupTAG addr=0x80000100 cmdline add=0xA8100040
TAG:Ramdisk OK
Get CID OK
androidboot.serialno=HT852KV01331
boot reason=0x0
commandline from head: no_console_suspend=1
command line length =277
active commandline: board_trout.disable_uart3=0 board_trout.usb_h2w_sw=0 board_t
rout.disable_sdcard=0 board_trout.smisize=64 androidboot.baseband=1.22.12.29 an
droidboot.bootloader=0.95.0000 androidboot.carrier=TMA board_trout.keycaps=qwert
z androidboot.serialno=HT852KV01331 no_console_suspend=1

PARTITIOM_NUM_MAX =6 Valid partition num=6
jump to linux kernel

Everytime after flashing another custom rom like CyanogenMod, Ginger Yoshi, SuperBler (with the recommended hboot / radio) it doesn't start up :confused::

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : SAMSUNG_256MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Android
Y2±…Í¡8 bit
-msm_nand_probe
[MDDI] Bitmap_Width = 480
[MDDI] Bitmap_Height = 640
[MDDI] RGB_Capability = 0x8888
[MDDI] Mfr_Name = 0xD263
[MDDI] Product_Code = 0x0
Board_PID : 0x1F
Wlan data header ++++++++++++++++++++
Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0x321A
BodyLength : 0x2F0
BodyCRC : 0xE829B1C1
aDieId(0) : 0xD00D4080
aDieId(1) : 0x7D087284
aDieId(2) : 0x20000000
aDieId(3) : 0x964
countryID : 0x30
Wlan data header --------------------------
chipset_bootmode reset_reason:0
ARM11 Boot Mode: 0
Platform: HBOOT-7201A
[ERR] partition_read::Failed to read page 22400 or it is empty
[ERR] boot image does not exist!!!

###[ Fastboot Mode ]###

I've tried it several times with fastboot erase commands:

fastboot erase hboot
fastboot erase recovery
fastboot erase system
fastboot erase userdata
fastboot erase cache
fastboot erase boot

But no success.

Any suggestion to get my Dream working with an up-to-date rom?

Regards,

tonne
[G1 Android Development] demkantor:
jtag was used to get your phone back right? then from there what was the radio and spl you had? from this point it booted to a stock 1.5? what were the steps you took to root and upgrade recovery, radio, spl and rom from here. if you are up to the spl 1.33.0013d then you cant use anything in fastboot besides fastboot -w. so what is your current recovery, radio and spl.
[G1 Android Development] tonne99:
After De-Brick I've had SPL ...2005 and radio 2.22.19 26I. But CyanogenMod didn't boot. So I flashed SPL ...33d and radio 2.22.27.08 to try Ginger Yoshi 1.5. No success, no boot. But everytime I start over from bootloader with inserted sd card and dreaimg.img on it and "downgrade" the dream, 1.5 boots without any error.

And then to test it once again: Rooting -> telnetd -> flashing recovery -> flashing radio ...26l -> flashing danger spl -> flashing CyanogenMod -> no boot

I've tried super wipe from recovery before flashing another rom. No boot after flashing a new rom.

I hope this is more precise to understand what's the problem.

I am familiar with hboot, S-OFF, S-ON, fastboot and I know that several commands do not work with some hboot versions / security settings.

Regards,

tonne
[G1 Android Development] demkantor:
if downgrading and rerooting works, try this and flash a rom from recovery that is compatible with your radio spl (like cm4) and this should work. if so try to upgrade to the danger spl and then try updating through recovery something like cm5. if this works great if they dont work try updating through fastboot.

once all of this is confirmed working update radio and spl and then try something newer like froyobylaszlo.

i only recommend all these steps to see where the problem occurs
[G1 Android Development] BLKro:
I think that I have at last figured it out. I have serial working, openocd responding to commands. So I know that the setup is OK-ish.

I have tweaked the supply voltage from 2.59 to 2.61 and saw that I get more errors when I am not at 2.6. So it seems that the JTAG is unstable, even without serial cable attached. I am trying now to find out why, I will try changing the power supply to an external one (I am currently using USB to power the JTAG through an LM317). I will try filtering the supply better. If I am at around 2.6V (as close as my multimeter allows), I am able to write and verify a 500kB test file. I still do get errors from time to time, but not as many as before (when I was at 2.61-2.62).

If I have on the phone a 6.xx radio, how can I change these offsets so that I can get into fastboot:

halt
mww 0x0090379C 0xea000013
mww 0x9029d8 0x0
load_image /tmp/hboot.img 0x0
mww 0x00000c0c 0x98000C4C
mww 0x00000c08 0x98000C4C
mww 0x00000c04 0x98000C4C
mww 0x00000c00 0x98000C4C
resume
shutdown

As I remember, the reason for my phone not turning on is an incompatibility between recovery and radio. If I can get into fastboot (having to enter shorter commands, maybe the JTAG will work) and write the RA recovery, I think I will be able to turn on the phone, or not?

As far as I can see from the serial output, when turning on the phone normally, it goes into bootmode0 then enters bootmode3, finds some errors and resets. I think this is the problem and I have no idea how to get around it without having to write that big radio file (which seems impossible at this time), so that the offsets work and enter fastboot.

Regards,

A.
[G1 Android Development] BLKro:
I have managed to unbrick using the Olimex USB-Tiny adapter. Now everything seems to be working, but when I want to powerdown the phone, from Android, or from recovery, it just restarts. What could be wrong? I have read something about radio 3.22.26.17 not meant for the Magic (I've got a 32A), people recomended 3.22.20.17. Should I install this version?
[G1 Android Development] grunf:
help needed

hi to all.

I have magic 32b that is bricked because of incompatible recovery and radio.

I have made wiggler clone with 2.6v supply and i have rs232 level shifter. All of them are working.

Problem is that Magic is not communicating over serial port (i have used connector from headset to make cable). I have tried and failed to enable communication.

Question: is there any way that I can force processor to jump to certain address in memory and to load fastboot?

JTAG communication works and I can send and control fine. just serial port is ether busted or not initialized on boot.
[G1 Android Development] gospeed.racer:
I know this is really far-fetched, but has anyone ever tried to have a conversation with a HTC technician? I am always surprised at what info there is to be had by just knowing when to act dumb and when to act smart. With the knowledge you guys have, why not just talk to HTC; ask to talk with a tech, tell them your "update failed" and simply ask them what they do. I would be willing to bet they just swap out the board, but if they say that they reflash somehow, bring up that you work in an industry that works with jtaging (that cannot be a real word LOL), and ask what methods they use- simply as conversation. I have people ask me all the time how to fix their own stuff instead of bringing it in. Like I say, I am sure it is far-fetched, but might be worth a try.
[G1 Android Development] bart9984:
Ok as promised I'm here to update you with the latests news about my htc repair.

Well, at the moment no luck with htc assistance. They've sent back to me the phone without doing nothing :eek:

I think there has been a mistake. They thought I wanted the phone repaired on warranty, so they haven't considered a paid repair (no budget estimation). After a request I'm waiting they call to tell me if the phone can be repaired, how and at what price...

Speaking with the operator she said that if the rom has been changed normally they don't consider a repair neither paying :confused:, so I replied I'm a developer and the result is "I'll call you to let you know" but I start thinking it's a hopeless case :rolleyes:

For you traying jtag: After some reading I've noticed that msm7200a on my htc magic differ with the g1's msm7201a only for a few things (maybe I'm wrong here).. So maybe jtag is a very similar operation over theese two phones. Searching on google.com "qualcomm 7200a jtag" on page 1 I've found a thecnical pdf paper on the processor (7200a) actually is the last link on google reuslts page 1, maybe will help.

Cheers,

bart99
[G1 Android Development] xile6:
Just throwing this out here probably wont work but i use to do it for some other things.

basically get a clip that will hook up to the chip and flash it directly, but that would mean you would have to know how to send the info.

**edited**

i believe that thats ^ what the jtag is

and @ bart9984

they told you they wont fix it because you flash another rom? even if you pay?
[G1 Android Development] bart9984:
hi,

yeah it's what i've understood. Waiting tomorrow for a official response, i'll let you know
[G1 Android Development] marxmarv:
That doesn't work so well anymore with the advent of BGA chip packages and multi-layer boards.

So far it looks like people who can get to the JTAG pads can do the standard ARM debugging operations on at least one of the 7201a's cores. It's also known that one or possibly both cores can read and write the NAND flash once the system is running. The missing pieces are in the middle, probably hidden in a data sheet the good people at Qualcomm legal don't want us to have. But it should be possible, albeit not particularly fast, to program the NAND flash through bit-banging the boundary scan registers or through the cores' JTAG debug facilities, either by writing directly to the flash or writing to RAM and using stripped-down MTD drivers to copy data into place.

Reprogramming the device through the ExtUSB port without major surgery on the hardware or expensive and unusual equipment is, if it can be done on production units, a superior and more user-accessible method.
[G1 Android Development] bart9984:
here again,

waiting for a response from those of htc I've decided to move the first step in serial cable construnction.

For the htc extUsb I've destroied my headset (I don't need it) because it's not easy to found a extUsb component here.

this is the result

(sorry but i can't take a better picture)

I've tested the line between the pins and the pinholes and they are connected.

I have the pins A, E, 1,2,3,4,5,6 according to

so i can use it to build a serial cable...

I found some usb to RS232 on ebay and other shops, starting from 8 euoros to 30 and over. Can I use any usb to rs232 db9 cable?

In my head i want to connect rx tx and gnd to the db9 rx tx and gnd

Cheers,

bart99
[G1 Android Development] marxmarv:
Standard RS232 levels will destroy your phone. You need to convert them down. The internet reports CMOS 2.8v levels, 115200bps 8n1. Google search for extusb pinout and read the first Google Groups link called "android serial debugging". You can probably find most necessary components through e.g. Futura Elettronica.
[G1 Android Development] bart9984:
ok I've got it, thanx...

I've found two usb to uart bridge, the first its the same used in the

http://www.instructables.com/id/Android_G1_Serial_Cable/step1/Items-Needed/

tutorial, based on a Silicon cp2102 chip, the second one is based on a ft232rl chip, price is almost the same, any suggestion?

bart99
[G1 Android Development] bart9984:
A little update,

I've noticed taht on my headset extusb the usb gnd is in short-circuit with pin 9 (tx) :mad: according to the google group suggested by marxmarv

http://groups.google.com/group/android-platform/browse_thread/thread/439d3f3af7a88a09

in this configuration the cable is in headset mode, i need to find a way to disconnect this pins

for my serial cable i will use pin 7 (audio gnd) as serial gnd, so maybe i'll try to break the usb gnd pin... or is it not considerable?

edit: yes breaking USB gnd and using pin 7 as serial gnd works

bart99
[G1 Android Development] gospeed.racer:
You may want to just have a look around for a replacement end, here is one that has a breakout pre-soldered and ready to go for $11usd

http://www.sparkfun.com/commerce/product_info.php?products_id=9167
[G1 Android Development] ezterry:
Serial Wire is a go

Well made a successful serial wire from:

As indicated:

http://www.sparkfun.com/commerce/product_info.php?products_id=9167

And:

http://www.pololu.com/catalog/product/391

(and used this to determine what pin goes where: http://www.instructables.com/id/Android_G1_Serial_Cable/ )

-----

Now I just need to de-brick the phone.. which is of course not as simple as merging the two items above into a working serial wire.

From what I see.. when I try to full boot ARM11 is attempting to boot in mode 3.. I believe that is not what I want.

Of course the serial console is only letting me change the boot mode of ARM9 the radio. (I'm sim unlocked but unfortunately still security locked which is not helping matters)

The radio image is working!! (I can even verify I'm sim unlocked from the serial console)

I never touched the SPL

(brick was due to flashing a EBI0 radio via the ota image in recovery; over a EBI1 radio w/ an EBI1 recovery/boot.. I think its trying to return to recovery which won't boot; and ignoring my desperate attempts to tell it to just go to the SPL bootloader [hboot] screen so I can fix it)
[G1 Android Development] bart9984:
I've just desolderd the usb gnd, if this will not work i'll buy a replacement end...

At the moment for a little test i've connected the extusb with my wires soldered and usb gnd pin disconnected. Turning on the device in blue led mode I have about 2.55 V between gnd and tx and about 2.46V between gnd and rx... is a positive thing no? :)
[G1 Android Development] ezterry:
Well for those still poking at serial wires.. here is what I see/don't see:

the parts in red are actions not part of the output (note the command interface has echo off)

What is interesting is the "ARM11 Boot Mode:" is part of the SPL; and the ARM9 mode string is part of the radio;

This means as I hinted at before that both the Radio and SPL are operational; However I have yet to find a way to override the ARM11 boot mode. (Boot mode 3 = force Recovery apparently; which seems to skip checking for key presses.)