yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] lbcoder:
Perhaps, but perhaps not.

Those spring-loaded type contacts don't tend to be particularly reliable. I remember doing some hacker stuff that need not be mentioned, that almost everybody who used those kinds of contacts ended up having problems because they didn't connect well enough.

I guess the idea is that if you're only going to do it ONCE, then the chances of ripping the contact point off the board are fairly low.

However, the main thing that needs to be considered when soldering wires onto the board is to use wires that are NOT TOO RIGID!!!

If you use very light and thin wires, you'll most likely have no problems at all. If you use a 6GA wire you bought at home depot, you'll probably destroy everything in its path. Remember that you use BIG WIRES for BIG CURRENT. The current you'll be dealing with is NEGLIGIBLE. Even the very thinnest wire you can come up with will be enough.
[G1 Android Development] bestrafer:
here is my attempt to unbrick "a dream":

1. Serial wire soldered and it works (Nokia DKU-5 cable used)

2. Got LPT wiggler http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=350348768870

3. Friend of mine soldered all test-points under microscope.

4. The board is powered by battery

6. 2.6V is taken from the board itself http://www.omnia-repair.com/forum/topic/htc-dream-g1-jtag/page/2

I grabbed an OpenOCD config for Wiggler from the cyanogen wiki page:

Should I connect also the serial +5v voltage to let openocd to detect target as bart9984 suggested:

Which pin should be used for +5v voltage?
[G1 Android Development] ezterry:
I rather the other 2.6V testpoint as that one is surrounded by ground and higher voltage points.. but if used correctly it ought to work. (actually I just convert the voltage from the laptop and save myself the extra solder point)

While there may or may not be something strange on the magic that requires this; I recommend leaving it open on the dream; I promise you it is not needed.. and your issue is elsewhere.

But if you really want to quickly test it without poking the wire you can just plug in a USB wire and swap back to the serial one when you are ready.

---

That said before doing anything else take out your multi meter (and if you don't have one you are missing a tool for this type of work) and check the following:

1) Put phone into blue light mode if serial is attached and power isn't: you will see bootmode 1

2) verify your v-ref is actually 2.6v (usually within 0.05v) when compared to the ground (any of the shielding) of the main board. You have one of the right points so there is an issue with the connection if its not.

3) now start open ocd: and check that trst-n is now also 2.6v when compared to ground. (if not your adapter is not working with the 2.6v.. very possible)

4) with that done and you are still having problems as we said before check the soldering work.. Here there are two possibilities:

A) bridges - the wire is in contact with something in addition to the testpoint

B) bad joints - while the wire may act attached it is not. (Others must be able to explain this better than myself..)

The tiniest bit of flux goes a long way here..

One quick thing you can test is that none of the 5 test points are connected to ground (disconnect rtck for now its one less variable) and that none are shorted to eachother.
​

Other things to check:

* How long are the wires.. My setup runs much faster and the wires are not exactly short .. but the more wire the more chance for noise..

* is the speed acceptable with the parport (if this is a real parport I'll hope openocd has sane defaults but it is something to keep in mind)

* phone is in blue light mode (the phone can disable the jtag port.. this happens when amss is booted either via the GO2AMSS command or when the linux kernel is started. I also have no issue connecting to JTAG while the battery is charging.

* Ensure the openocd application is not running when you boot the phone.
[G1 Android Development] bestrafer:
thanks ezterry, I'll check all these points step by step.
[G1 Android Development] bestrafer:
2. v-ref is 2.61V

3. ntrst is 0.

I'm using this Wiggler http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=160435230149

Should I try to supply 5V to v-ref pin?
[G1 Android Development] scholbert:
Hi bestrafer!

This is the correct value.

This the wrong level. nTRST must be at high level (~2.6V) after openocd is launched.

With nTRST sticking low the MSM7201A debug unit is in reset state.

The pinout suggests to supply the adaptor with 3.3V.

For Dream hardware Vref=2.6V should be used here to power the buffers of your adaptor.

PIN.1 (VTREF) Target voltage sense

As i could point out on the pics, the adaptor is using HC logic family.

Normally 2.6V should be enough to power these circuits.

Maybe your printer port reaches its limit of high level voltage being at a maximum of ~2.6V.

No please don't, this won't help... much worser if you apply 5V to Vref this might destroy your hardware.

Please try to find the reason, why the level of nTRSt is sticking low.

Maybe you'll have to tweak the cfg file. There are several options for the behaviour of nTRST.

If you don't manage to find a working cfg, you may cut the nTRST connection to your adaptor and pull the Dream's nTRST signal to Vref=2.6V permanently.

Normally this should also work... the debug unit will then leave reset state immediately after power up.

Good luck!

scholbert
[G1 Android Development] Beast24:
HTC JTAG

Hey guys been reading up on your progress seems like awesome news!!!! for guys like myself with a bricked HTC Dream. I just want to find out if it is necessary to soldier the jtag wires on the pcb or can you use the HTC extusb instead?
[G1 Android Development] bestrafer:
I'll try this approach.

Meanwhile attached is the schema of the Wiggler above
[G1 Android Development] scholbert:
Thanks for the schematic... looks like a true clone.

BTW, here's my config file (hade to rename it to *.txt).

To be more exact i use another DIY adaptor and just changed the cable entry for wiggler.

Check it out ;)

Regards,

scholbert
[G1 Android Development] scholbert:
Right now you'll need to fiddle around with the JTAG signals and use the extUSB serial connection to send some commands to the bootcode.

No solution for using extUSB only so far :o

Cheers,

scholbert
[G1 Android Development] bestrafer:
it looks like only #srst_pulls_trst is changed compared to the version on the wiki site

I tried with

with no luck..
[G1 Android Development] scholbert:
...duuuuh, that's strange!

How about the level of nTRST?

Maybe you should force it...

BTW, did your output message change in any way?

Regards,

scholbert
[G1 Android Development] he3r0:
serial connection messed up?

Or did i messed up something? im getting jibrish out of my serial...

First im getting this

y½§HHÑÛT

and after i`ll hit enter im getting this:

<CE-24>êÊZöûU¥}Ý}Em¥Õ5…m]e]•ëåë¯_!5a#¿Y=§{!!¿[5=!#*…¯§*åëc}cwAsg}YoA[u}wAmw¿‹¿Y}eYUcqA›•“e{Asg}YoA›e{AYw[}eååë

what did I messed up?

im using build in rs232 in my laptop that i dug up out of the basement...

i have:

computer -> phone

#2 -> #9

#3 -> #8

#5 -> #7

do i have to supply additional, 3.3 or 5v to the phone?
[G1 Android Development] bart9984:
are you using rs232 from laptop without any voltage level conversion?

If so you have many chances to have your phone burned up by rs232 signal's voltage... you should use a TTL/UART serial converter and use 2.8V (3.3 V also works) voltage reference....

Stop using rs232 without any modification

read the thread, you can find how to build a proper serial cable
[G1 Android Development] he3r0:
I'll do that then.

thank you for your answer,

--

Maciej.
[G1 Android Development] zewt:
Poking at the radio code a bit out of curiosity--I don't have a brick, and I like my phone working, so I won't be poking too hard. I'm far behind, but consolidating info as people reverse stuff would be useful.

Maybe for people investigating at the radio images, we should all pick a single version of the flash to examine, so we're all looking at the same code and offsets. I've been looking at 26I.

Some random interesting addresses in that version's oemsbl, and arbitrary symbolic names where I know enough to give one that's meaningful, to make discussion easier:

0x0095C0C4 (unsecured_flag) - set to 1 for unsecured

0x0095C0D0 (unsecured_commands) - list of pointers to unsecured commands (null-terminated)

0x009038D8 - checks whether a command is available (uses both of the above), and then other stuff

0x0090CB44 - only other place I've seen that references 0x0095C0D0

0x0095254C (CRCTable) - standard CRC32 table (the same as in the link below)

0x0090C85C (do_rpass) - executes "rpass" (xref the function that calls this and you'll find the rest)

Has anyone tried to reverse the rpass code (since the one at [1] seems to not work)? I took a look at the code that seems related to that, and it's referencing memory at 0xA9C00000 that's not in code. Some searching suggests that's a flash memory mapping [2], so there may be a secret key stored there in flash. Maybe someone with JTAG can pull it out--it could be the same on all devices. (Is this where the stuff is stored that we can't directly flash, eg. IMEI/simlock? I havn't examined refs to this area in the main radio code.) I'm not entirely sure what rpass is for, so I don't even know if figuring this out would buy us anything.

I don't see any code within oemsbl writing to unsecured_flag, to unsecure the phone.

There are big blocks of noise in the main radio code; there may be code masking going on--if so, it might be helpful to try to take a full live memory image over JTAG, to see if you can grab this code after it's been unmasked (if it's typical simple single-pass code masking). Maybe that's where the guts of the security flag setting is.

(Or I might be way off. Not too much I can do just poking through disassembly without a debugger hooked up, and I'm not quite ready to start buying bricks off eBay and spending money on JTAG hardware...)

[1] hp://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoaderPassword (url masked due to "can't post outside links" silliness--and that's not even an external link...)

[2] hp://google.com/#hl=en&q=A9C00000
[G1 Android Development] bestrafer:
okay, I shorted vref with nTRST. Thus, when the board is in "serial mode" both vref and ntrst have 2.6V

Output remains the same:
[G1 Android Development] bart9984:
I had the same problem: "all zeros" during my attempt.

Take a multimeter and check if all the wires are connected, you can measure the resistence between them and gnd to be sure there is no high-impedance. Also check if there are some shortcircuit between them, just check every wire with all the others.

Then if you can get a "all ones" error message like me, you can try to start openocd with usb cable and then attach the serial one.

bart99
[G1 Android Development] excogitation:
Is anybody already able to fix a 32B?

If so, what's the damage? (how much do you charge to repair mine ;-)

I still got a brick sitting at splash2 because of an incompatible radio firmware.
[G1 Android Development] MGA2009:
Hi.

Thank you for all the development on JTAG. I've read the post from the start.

I may repair my G1 sometime in the future, too bad in my country I can't get an USB JTAG interface (too expensive) nor a working LPT one. So, I'm trying to make Scholbert's Wiggler...

Anyone can help me with the YAWC Scholbert posted on #412:

The cap's can be electrolytic or they must be ceramic?

Also in J2, pin 1... this one goes to 74LVC245 pin 20?

R1 and R2 in the "power supply" scheme, how many watts? carbon is OK?

One image = thousand words.

Scholbert, sorry I used your scheme I just want to check I'm not worng before soldering (if any problem, let me know and I'll delete it).

Thank's
[G1 Android Development] Beast24:
JTAG Wiggler

Hey guys i am a difficult time tracking down the 74LVC245 chip are there any other models that i can use or does it have to be this one?

FYI I live in South Africa, Cape Town.
[G1 Android Development] lbcoder:
So... how can you be in south africa and be using fido (canada)?

In any case, you should be able to substitute that 74LVC245 with a bunch of different options.... a 244 should also do the job (might require a different circuit -- do google for "74244 jtag schematic"), and LVC means "lowest voltage clamp", which really shouldn't be required -- we really aren't dealing with that low of voltages here. You can probably go with an HC or HCT.
[G1 Android Development] ozzyozwana:
?.?

Hey ppl.. New to this forum and new to jtag..

I practically made a list of the things i need so i can buy 'em but I m not sure whether everything will work.. please help.

Jtag -> Arm USB Tiny -> from OLIMEX

Jtag Adapter for G1

Serial Logic Level Converter (USB to RS232)

extUSB breakout

and obviously the tools required to open the thing up...

Also.. other question, will these things ever come to some other use in my life? How compatible is that jtag thing with other stuff?
[G1 Android Development] scholbert:
Both will be O.k.!

Yes, that's right. Your mod is correct, if using an external source.

1/4 or 1/8 Watts should be sufficient.

No problem... it is all based on original wiggler schematic :p

Try HC-family first. As lbcoder pointed out a 74HC244 should also do the job.

That's all you need...

Don't know what you intent to do in the future...

Olimex JTAG adapter could be a useful tool if you'd like to debug ARM SoC's.

Regards,

scholbert
[G1 Android Development] bestrafer:
Hi guys!

I've been having no luck with making openOCD see the Wiggler JTAG http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=350348768870

I've sent my dream board to the seller of JTAGs ) with the intention to let him check which JTAG he has would recognize my board.

Here is a result of his check:

1. J-Link JTAG recognized the board out-of-box, no configuration required at all

http://www.bravekit.com/usb_arm_arm7_arm9_cortex-M3_jtag_jlink_j-link_v7_programmer_debugger

2. We were able to check main commands I'd require to load image into the memory (see the attached images)

3. J-Flash is also available and sees the board

We did not load any image to the address in memory yet, but tried halt, resume(go) and some other info commands.

Is it safe to load image (loadbin command) with this tool? What do you think?

The step would be as follows:
[G1 Android Development] MGA2009:
Scholbert, thank's for your answers.

I'll try to make the JTAG and make a picture guide for all the noobs like me.

Bye
[G1 Android Development] ozzyozwana:
Thanks Scholbert... I bet i ll be starting a new hobby :) hehe
[G1 Android Development] bestrafer:
it seems that JLink is able to download only into internal memory, but AFAIK radio image should be loaded into external Flash..
[G1 Android Development] ezterry:
The entire jtag process I have on the wiki page only uses the Jtag to halt the processor and write to ram; then resume once the ram values have been hacked into place.

The hack uses the radio command 'radata' for flashing a radio (this include all the usual signature checks) just as the SPL usually does

The hack then softboots (ie.. loads into ram and uses a hacked version of the bootloader command 'cego' to execute) a fastboot enabled SPL allowing you to correct the rest of the system.

--

As for J-Link to the bese of my knowledge it is supported by openocd; you may need to compile it yourself. Check out the openocd website and forums (btw your version looks like to fell off the SEGGER assembly line)

Or you can convert its commands to its own interface; I leave you to figure this out yourself; but as its just memory writes and image loading this ought to be simple.

--

I think your problem with the Wiggler was the low voltage.. I'm a little shocked (I knew it was intended for slightly higher voltage but seemed that it would have likely been close enough)

Both cfgs mine (on the wiki) and scholbert's ought to have worked.. We will see what people say once they build the low voltage clones.
[G1 Android Development] wraith3:
First off, this is an amazing achievement and a whole lot of work that went into this whole project. Congratulations on getting this far! I hope the work continues so we can soon use just a jtag or serial to fix bricks!

Being the kind of person that can't help but join in what everyone else is doing, a few days ago I decided to join some of the proud owners here at xda of an overpriced flashlight/paperweight. After which, I undertook some light reading (this entire thread). As a result, I feel I've learned that electrical engineers must have a fetish for acronyms, but not much else!

I've found a windows binary of openOCD that someone compiled, if anyone is interested: freddiechopin.info/index.php/en/download/category/4-openocd It might be helpful to have that in ezterry's excellent wiki.

I hope to enlist the help of my electrical genius friend to de-brick my G1, but I had a few questions. I'll be buying some of the harder to find parts so we can get straight to de-bricking when we meet up (he's a busy guy). I'm trying to achieve closer to lbcoder's fabled $2 solution than the $40 estimate on just the serial cable instructables page alone (realistically I'm expecting a total $20-40 solution even with wire, solder, soldering iron, and other tools provided).

1. I've heard it mentioned before, but is it true that the extUSB breakout isn't needed? Can I just cut up a regular mini usb instead?

2. As I understand it, I need to modify a usb-serial cable so that it doesn't fry my phone. I saw the schematic for modifying the serial cable's voltage using the MAX232 chip. So to do it that way, is the extUSB breakout and MAX232 chip schematic, all I need to make the cable? Or are there some additional parts I'm missing?

Thanks for all your hard work. If I succeed I'll try to post some of the results so we can settle down the price range (in the us) a bit and help all the noobs with super-friends like me :D
[G1 Android Development] dr4stic:
For the serial cable, I do highly recommend getting the extUSB breakout. The other option is to slice up a headphone cable that uses the extUSB connector, and then trying to figure out which wires go to the pins you're supposed to use.

As for the MAX232 chip, I actually went the route of using a Nokia DKU-5 cable. I purchased one on eBay, shipped within the US (from NJ) for all of $4. The DKU-5 is essentially a 3.3v serial cable and it works fine (for me). Once you get it, follow the instructions here (take a look at my notes in the last post):

http://xdaforums.com/showthread.php?t=595791

to figure out which wires you need to connect. Also, keep in mind that you'll have to figure out which driver you need to make it work. It likely won't be the nokia one, and it may not be recognized immediately by windows. However, I did manage to figure it out with Linux.

I liked my solution (DKU-5 + extUSB breakout from sparkfun). I also toned out the wires on a regular usb cable, and attached them to the appropriate pins on the extUSB to make it a full on data + serial connection. It has two USB connections to the computer, one for serial, one for data. I just connect the one that I need :-)
[G1 Android Development] lbcoder:
BAD IDEA.

You'll probably bluescreen part way through and fry the radio.

There is ABSOLUTELY NOT A SINGLE REASON why you should use that MS VIRUS to do this. DON'T TRUST IT!!!! Any decent bone stock linux distro will have openocd!

For $20-$40, you better be buying all the tools along with it.

Nothing fabled about it being $2 unless you are are intentionally seeking out the most expensive store in existence.

If you're going to be soldering anyways, solder your RS232 wires on. If memory serves, the RS232 pins are actually the AUDIO pins, which means that you won't be able to use a conventional mini usb plug.

extusb not needed. Max232 chip worth about $0.25. And you need about 5 cents worth of capacitors for it.
[G1 Android Development] wraith3:
Thanks for the help lbcoder. I'll admit that Freddie Chopin's default Joomla template is a little skeevy, but there are far easier and more effective ways of distributing a virus than through exclusive openocd distro's. I'll probably be using linux anyways since the manual said drivers could get tricky with windows, but I really doubt there is anything wrong with those binary's.

Anyway, I seem to be a little confused here. I understand that the headphone pins are the only pins that make extUSB different than normal mini usb jacks. So needing to use those pins would indeed mean I would have to use extUSB.

Here's where I get a little confused. To de-brick a G1, as I understand it, you currently need a jtag in addition to the serial wire. The serial wire needs extUSB. So what exactly are you suggesting I solder my RS232 wires on to, if not the extUSB breakout?
[G1 Android Development] dr4stic:
He was referring to windows (and microsoft) which, while I sometimes agree, was inappropriate for this discussion. You should use whichever OS you feel most comfortable with. As far as I can tell, Ubuntu is among the most popular desktops these days and it doesn't distribute the openocd version that's recommended on the Wiki. While I had no problem compiling the latest version, I'm also skilled at such things and would hate to have to explain it to a beginner.

You're not confused, you're making sense. Ultimately you need to find a connection with the extUSB. You can't do that from a regular mini USB. There aren't enough pins on those and the ones you need for the serial connection are the extra ones.

You could chop up an HTC headphone cable - either the one you got with your phone, or purchased on eBay - and then map out the wires to figure out which wire is which. I'm assuming that's what lbcoder meant. Personally I didn't find enough information online to make me comfortable doing that. It didn't seem to make sense to frustrate myself... alot... instead of just get one of those extUSB breakouts.
[G1 Android Development] lbcoder:
You think that you need to use an old version just to be compatible with a wiki? Nonsense!

You don't need to chop anything up! Just look at the plug to see which pin you need to connect to. If you don't know what pin to connect to, then having the other side of the plug isn't going to help you anyways.
[G1 Android Development] lbcoder:
How do you get from windoze virus to openocd virus?

No, but there IS something wrong with those windoze virus binaries.

Here's where I get a little confused. To de-brick a G1, as I understand it, you currently need a jtag in addition to the serial wire. The serial wire needs extUSB. So what exactly are you suggesting I solder my RS232 wires on to, if not the extUSB breakout?[/QUOTE]

The PHONE! You're going to be soldering on it anyways to connect your jtag device, some reason you're scared of soldering on your rs232 wires as well?
[G1 Android Development] wraith3:
Thanks for clearing that all up dr4stic. The supposed pre-existing extUSB was the missing link! I think I've lost all my extUSB cables and I don't think I'd want to chop them up anyway so I'll go with the breakout board. I think I'm pretty clear on all the other stuff I need to get started.

I'm no linux whiz, but I've compiled a few really easy things on Ubuntu before. Maybe I'll leave the os choice up to whatever os is on the computer that still has a serial port. I have to go digging for one!
[G1 Android Development] wraith3:
Oh, you're suggesting soldering on to the actual extUSB PLUG on the phone! That would be cheaper definitely, but I think I'll cut my loses there. It'll be faster and easier to solder on the breakout board. So I guess I will be shopping at the most expensive store ever :D Thanks for the help everyone!
[G1 Android Development] dr4stic:
The Wiki is very specific about using 0.4.0 and not soemthing else. Ubuntu Lucid (10.04) ships with the latest 0.3.x release. Before you continue being a jerk, seriously... get a grip.