yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] Difool80:
6MHz

The LED still fixed (green or orange, It seems to depend on when I halt the mcu)

I have no idea of the current radio version.

# openocd -f arm_usb_ocd.cfg
Open On-Chip Debugger 0.4.0 (2010-02-22-23:00)
Licensed under GNU GPL v2
For bug reports, read
(url ...)
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
Info : clock speed 6000 kHz
Info : JTAG tap: arm9.cpu tap/device found: 0xa01700e1 (mfg: 0x070, part: 0x0170, ver: 0xa)
Info : Embedded ICE version 6
Info : arm9: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection from 0
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x0090dad8
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Error: No working memory available. Specify -work-area-phys to target.
Info : no working area available, falling back to memory writes
[G1 Android Development] ezterry:
The pattern changes when its transferring data.. if not please re-verify all your connections are clean, or lower the speed of the adapter..

If you just want to test a smaller transfer you can load some small file to those address
[G1 Android Development] alexbrickwedde:
That's it, the coax cable was loose on the other end.

Sorry for bothering you...

...Alex
[G1 Android Development] marchard:
GPS problem after debrick - SOLVED

I can confirm: gps problem after debricking was caused by a loose antenna cable! (how embarrassing :o)

So, all debricking guys out there: if your device can't see any satellites - make sure to reconnect the antenna cable! i just overlooked it... :eek:
[G1 Android Development] Difool80:
I've tested on a 32 bits machine and it works. It seems to have a problem with 64 bits machines ... (maybe an openocd or ftdi bug).

However, the led doesn't flash during the load_image command execution. It's flash before and after but not during.

And the download starts ~3min after the command execution (I've seen that by checking TCK and TDO signals).

Normal ?
[G1 Android Development] ezterry:
Seems you are booting into: ARM11 Boot Mode: 11

And currently only forcing 0,1,2,3 into fastboot

Well this isn't that bad:

mww 0x00000c00 0x98000C4C -- overwrites boot mode 0

mww 0x00000c04 0x98000C4C -- overwrites boot mode 1

mww 0x00000c08 0x98000C4C -- overwrites boot mode 2

mww 0x00000c0c 0x98000C4C -- overwrites boot mode 3

mww 0x00000c10 0x98000C4C -- overwrites boot mode 4

mww 0x00000c14 0x98000C4C -- overwrites boot mode 5

mww 0x00000c18 0x98000C4C -- overwrites boot mode 6

mww 0x00000c1c 0x98000C4C -- overwrites boot mode 7

mww 0x00000c20 0x98000C4C -- overwrites boot mode 8

mww 0x00000c24 0x98000C4C -- overwrites boot mode 9

mww 0x00000c28 0x98000C4C -- overwrites boot mode 10

mww 0x00000c2c 0x98000C4C -- overwrites boot mode 11

So change:

> mww 0x00000c0c 0x98000C4C
> mww 0x00000c08 0x98000C4C
> mww 0x00000c04 0x98000C4C
> mww 0x00000c00 0x98000C4C
> resume
> shutdown

to

> mww 0x00000c2c 0x98000C4C
> mww 0x00000c00 0x98000C4C
> resume
> shutdown

(Why did I think boot mode 11 was hboot by camera press?)

ALSO:

your normal boot concerns me:

ARM9_BOOT_MODE3, Boot Android and mARM stay in OEMSBL

run this in oemsbl: 'setboot'

if it return 'ARM9BootMode:3'

type 'setboot 0'

then 'powerdown'

then start blue light mode and continue as mentioned above
[G1 Android Development] Monrad:
Thanks ezterry, I'll try to do it tomorrow. I don't know if I'll succeed. Sadly, one of the JTAG gold contacts (TCK) have loosen itself and I don't know if I'll be able to connect JTAG again. However, I have some ideas on my mind.

Do you think AUX_TCK on the other side of the board should work? :confused:

Oh BTW, there's a free beer waiting for you. As I said, don't know If I'll succeed, but you deserve it for your hard work.
[G1 Android Development] marchard:
@Monrad: It happens to me too, that one of the testpoints lost contact to the pcb. What i did: i removed the protective lacquer on top of the regarding pcb track with a scalpel by scratching. But you have to be very carefull! if you do wrong (eg. removing the track itself or cut it) you could destroy your last chance to contact to the jtag controller!

Good luck, by, Marc.
[G1 Android Development] scholbert:
Nope won't work....

See my older thread:

http://xdaforums.com/showpost.php?p=8724303&postcount=898

Regards,

scholbert
[G1 Android Development] ezterry:
Well regardless using the serial wire try to fix the arm9 boot mode it may at least leave you in a fixable mode..

I have once (with trst-n but tck might work ) held a wire to the edge of the trace next to the lifted pad to successfully to get jtag to partly work.. wont be fun but if you half script the softboot, once everything is in ram and you resume you don't need to hold the wire in place..
[G1 Android Development] Monrad:
I can confirm JTAG still works. I soldered a nail to a cable connected to the JTAG Interface. Only problem is I have to hold the nail with my fingers in order to make contact with TCK. I only need patience and to script everything because I won't be able to type without moving the nail.

I tried to make an adapter with a nokia JTAG cable but it won't touch the little copper left on the PCB.

@marchard: sadly, TCK had no track, there's only a very little copper point (upper left). That's what I have left :p I better not heat that part any more. I still have a chance.

@scholbert: thanks for the information :)

@ezterry: I'll be doing it in 2 hours I think, wish me luck :p
[G1 Android Development] marchard:
Hi Guys!

Sorry, i need some help! I stuck here...

I cant halt the arm9 and i don't know why. JTAG seems to work proper, as you can see below. But when i try to halt, i get error message: Halt timed out, wake up GDB.

openocd:

Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
parport port = 0x378
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
Info : clock speed 500 kHz
Info : JTAG tap: arm9.cpu tap/device found: 0xa01700e1 (mfg: 0x070, part: 0x0170
, ver: 0xa)
Info : Embedded ICE version 6
Info : arm9: hardware has 2 breakpoint/watchpoint units
Info : accepting 'telnet' connection from 0
Info : Halt timed out, wake up GDB.
Error: timed out while waiting for target halted
Command handler execution failed

telnet:

Open On-Chip Debugger
> halt
Halt timed out, wake up GDB.
timed out while waiting for target halted
Command handler execution failed
in procedure 'halt' called at file "command.c", line 650
called at file "command.c", line 361
>

I tried so many thing the hole evening... once a soft_reset_halt worked. but then the transmission of the radio failed...

What can i do? What can i test? What could prevent to halt the cpu?

I know, that my config file works, cause i debricked already a magic with this configuration before. hmm.. Any ideas?

THANKS!

Bye, Marc.

Edit:

Everything worked out! Regarding the failing "halt"-state: i guess there was an issue with my TRST line (resoldered). Also this time my jtag setup was not that stable: disconnecting serial cable while transfering data with jtag helped. Also using command "verify_image" after load_image", to make sure transfer worked out -> i will add a hint in wiki...

Thanks everyone again for helping to debrick my second Magic!
[G1 Android Development] Monrad:
Ok guys, an update:

I almost got crazy yesterday trying to connect the JTAG. First I tried to hold the nail on the copper with my fingers. It was impossible to get a good connection.

After that I realised I needed some help, but I was alone in there and it was late. So I picked up one of those helping hands and attach the nail in there. I managed to make the nail make pressure on the PCB without using my hands, but it still didn't work. When uploading the hboot.img it crashed with some error I can't even remember (JTAG connection was lost that's for sure).

Today I realised my battery was almost empty and that could've been the problem. To make the story shorter, I managed to load hboot into ram and enter fastboot mode. I erased everything and installed the new hboot image and recovery image and after that my phone was alive again :)

I can enter bootloader and fastboot. I flashed 2.22 radio because it's a tmobile G1 and I'll continue with the flashing tomorrow. I'm pretty sure I have a working phone. Thanks everyone specially ezterry :)

Some pictures of frakenstein (sorry about bad quality, I could've done better, let me know if you want better pictures, I'm assembling the phone in 8 hours):
[G1 Android Development] Liquid211:
Hello Guys. For the ones of us who just don't want to make our own serial cable. Can i use these things to make a JTAG repair?

http://www.gsm-technology.com/index.php/en_US,details,id_pr,7864,menu_mode,categories.html

and

http://bestcelldist.com/htc_magic_serial_data_cable.html

Can anyone point to a more newbie friendly guide?

I'm pretty sure I will make it work if I just didn't have to make any cables myself :)
[G1 Android Development] fsl13:
Hi Everyone

Its a humble request

you guys have made so much effort together

How about if someone Please post a video tutorial

or even screenshots in which you show stuff done

onscreen and offscreen a lil more clearly

I know i can do it but im just too stoned to understand at the moment

i have artistic hands and quick learning brain but with photo memory

Please Help
[G1 Android Development] elharraq:
I AGREE WITH MR.fsl13 PLEASE HELP US. STEP BY STEP WITH PHOTOS OR VIDEO WOULD BE THE BEST TUTORIAL FOR DEATH DREAM OWNER.
[G1 Android Development] fsl13:
Hi Guys

I have done so much of reading and still i am nowhere

Its a request to Please give us a windows based solution

1 Like how to start openOCD (with link to download)

2 Terminal ? what terminal windows?

3 Is it ok to attach it with H-Tag?

4 Ok if its attached with H-TAG than what?

5 which software to use for Flashing Boot

I cant find NBH file to flash

Please Someone respond

No one knows anything here about LINUX (UBUNTU bla bla)

Everyone uses windows here

Before this i successfully Jtagged HTC WIZARD using H-TAG and NOICE

6 One last thing (Isnt it possible to flash the device using the SD CARD after going into bootloader?

7 And what about Pl2302 data cable used for OLD SONY ERICSSONS they are USB to SERIAL Interfaces

Please Post a few line seniors

Thanks a lot in Advance and Hats off to you all!
[G1 Android Development] robuser007:
Then your device isn't bricked at all
[G1 Android Development] marchard:
You don't need a linux machine to debrick. I've done everything under windows.

Most of your questions are answered in the wiki: http://xdaforums.com/wiki/index.php?title=JTAG_Softboot_for_Magic_and_Dream

1: follow the wiki: openocd -f magic/dream.cfg (download the cfg-file mentioned in the wiki), search for openocd: http://lmgtfy.com/?q=openocd+windows+download+0.4

2: any terminal will do. google is your friend: http://lmgtfy.com/?q=windows+serial+terminal, i use "hterm, but a less advanced one will also do.

3: Never heard of "H-TAG".

4: i dunno. Follow the wiki. Get a jtag-cable.

5: Read the wiki. you will need openocd, telnet to talk to opneocd and a terminal programm to send commands oder serial cable. that's it.

links to download radio and hboot are also mentioned in the wiki. you don't need any NBH...

btw: you can't tell who is and who is not using windows or linux or mac or something else.

6: if you can access anything like bootload, i think it is not neccessary to do this procedure.

7: also, look at wiki: you will need a serial cable with around 2.7V output level

I suggest: study the wiki page mentioned above. read it and read it and read it. That's how i did it. All questions are answered there. If there is a problem, which is not answered in this wiki, post it here.

Edit: oh, someone was faster... sorry
[G1 Android Development] suchi7:
HI,

My HTC dream phone bricked while downgrading from 2.1 to build 1.6.

I need to recover it. Can you please share the steps you did to recover the phone using JTAG tool.

Any help is appreciated.
[G1 Android Development] marchard:
Step-by-Step tutorial, which contains all info you need, can befound here: http://xdaforums.com/wiki/index.php?title=JTAG_Softboot_for_Magic_and_Dream

Read it and read it and read it again. Use the search button to search this long thread.

If you have really an issue/problem, that hasn't been discussed here, post it. But first search for it ; )

Good luck!
[G1 Android Development] he3r0:
follow this ---> http://xdaforums.com/wiki/index.php?title=JTAG_Softboot_for_Magic_and_Dream

you can download openocd for either linux or windows (goole for it)

http://openocd.berlios.de/web/

you can buy cheap (and i mean dirt cheap) JTAG off ebay,

http://cgi.ebay.com/Low-cost-Wiggle...870?pt=LH_DefaultDomain_0&hash=item519269f666

and do not be cheap with JTAG adapter for the phone, i tried, though im not the most saavy person with that, but i also do not consider myself a noob, it really makes things easy.

http://www.gsm-technology.com/index...&itlshop_recount_cart=1&pl_PL.x=13&pl_PL.y=15

as for the steps

1: take phone apart

2: follow wiki

3: put phone back together
[G1 Android Development] steveluigi:
When I was upgrading from 1.6 to 2.2, my G1 got bricked, but fortunately I know a friend who works in a place that has a jtag and he unbricked it for me, so this does work. the morel of this story is, when is a brick not a brick? when you have jtag equipment.
[G1 Android Development] OpTicz:
If someone can debrick my wife's 32B Magic for me, I would be forever grateful. I of course would pay you. I'm not familiar with JTAG at all, and I don't even want to try. Please PM me ASAP.

Thanks, Mike.
[G1 Android Development] lsl163lsl:
hi, I try to unbrick my G1 follow this, http://xdaforums.com/wiki...agic_and_Dream

but, I met some problem which are not mentioned

in the wiki.

So I ask help here. the details shown below

Open On-Chip Debugger

> halt

target state: halted

target halted in ARM state due to debug-request, current mode: Supervisor

cpsr: 0x000000d3 pc: 0x009436b0

MMU: disabled, D-Cache: disabled, I-Cache: disabled

> load_image radio-3.img 0x103B5300

No working memory available. Specify -work-area-phys to target.

no working area available, falling back to memory writes

Bad value '00000000' captured during DR or IR scan:

check_value: 0x00000009

check_mask: 0x00000009

JTAG error while reading cpsr

Command handler execution failed

in procedure 'load_image' called at file "command.c", line 650

called at file "command.c", line 361

> resume

target not halted

Command handler execution failed

in procedure 'resume' called at file "command.c", line 650

called at file "command.c", line 361

>
[G1 Android Development] marchard:
Yeah, i had something like that, too.

Try the following: disconnect serial cable during all your jtag communication. you can plug it in again, after you transfered the image through jtag.

Please give response, if it worked out.
[G1 Android Development] lsl163lsl:
unfortunately, now, the serial cable can't send any command to G1. but it still can received the message from G1.

I check it again and again, but can't find any difference than before.

Bad luck!
[G1 Android Development] marchard:
but jtag is working wis disconnected serial cable?

what kind if serial cable do you use?
[G1 Android Development] foxdl99:
I have a bricked G1 recently purchased locally from someone who failed. In any case, I'm adventurous and would like to give this a try, but wish to weigh the cost/benefit ratio. Is the JTAG cable listed previously all that is required to purchase? Most of the JTAG materials I find listed go over $50 in price which really isn't worth it to me unless I consider it an educational venture. Thanks.
[G1 Android Development] [opensys]:
Hello,

After i read this posts in a attempt to unbriked my htc magic 32a briked with a radio version of 32b the v2.22.27.08. i was stuck in the jtag commands.

openocd -f magic.cfg

Open On-Chip Debugger 0.4.0 (2011-01-02-15:41)

Licensed under GNU GPL v2

For bug reports, read

http://openocd.berlios.de/doc/doxygen/bugs.html

parport port = 0x0

trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain

dcc downloads are enabled

fast memory access is enabled

Info : clock speed 500 kHz

Info : JTAG tap: arm9.cpu tap/device found: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)

Info : Embedded ICE version 6

Info : arm9: hardware has 2 breakpoint/watchpoint units

Info : accepting 'telnet' connection from 0

target state: halted

target halted in ARM state due to debug-request, current mode: Supervisor

cpsr: 0x200000d3 pc: 0x00907348

MMU: disabled, D-Cache: disabled, I-Cache: disabled

magic.cfg:

interface parport

parport_port 0

parport_cable wiggler

reset_config trst_and_srst srst_pulls_trst

set _CHIPNAME arm926ejs

set _ENDIAN little

set _CPUTAPID 0x301700e1

proc dbreg {} {

#show 16 arm registers only

reg 0

reg 1

reg 2

reg 3

reg 4

reg 5

reg 6

reg 7

reg 8

reg 9

reg 10

reg 11

reg 12

reg 13

reg 14

reg 15

}

jtag newtap arm9 cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID

set _TARGETNAME arm9.cpu

target create arm9 arm926ejs -endian $_ENDIAN -chain-position $_TARGETNAME

arm7_9 dcc_downloads enable

arm7_9 fast_memory_access enable

Question is cfg ok for 32a?

When i got to blue led mode, i can write "?" so it works.

when i flash the new radio, i type 'resume' but i can't get access to the serial console to write the "radata 103B5300 01500000" seams freezed.

so i try pass the hboot, but to do it i need the mww address's to the radio "2.22.27.08", can anyone provide it?

i try the addresses of others radio but, no luck with the version or cego cmd shows up.

What can i do more?

OpenSys
[G1 Android Development] tonne99:
Magic 32B radata command failed

Hi,

I bricked my htc magic 32B with the radio version 2.22.19.26l and latest Cyanogenmod flashed before.

I followed the guide "JTAG for Dream/Magic" and got access via arm-usb-tiny adapter with following config:

#######################################
# HTC Dream/Magic - OpenOCD configuration
# > arm-usb-ocd profile
#
# For use with openocd 0.4
#######################################

## Device settings for arm-usb-odc
interface ft2232
#ft2232_device_desc "Olimex OpenOCD JTAG"
ft2232_layout "olimex-jtag"
ft2232_vid_pid 0x15BA 0x0004

##### HTC Dream configuration #####
# based on Atmel AT91rm9200
###################################

reset_config trst_and_srst srst_pulls_trst

#dream information (or something near it)
set _CHIPNAME arm926ejs
set _ENDIAN little
set _CPUTAPID 0xa01700e1

proc dbreg {} {
#show 16 arm registers only
reg 0
reg 1
reg 2
reg 3
reg 4
reg 5
reg 6
reg 7
reg 8
reg 9
reg 10
reg 11
reg 12
reg 13
reg 14
reg 15
}

jtag newtap arm9 cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID

# Create the GDB Target.
set _TARGETNAME arm9.cpu
target create arm9 arm926ejs -endian $_ENDIAN -chain-position $_TARGETNAME

# Work area non-functional at this point in time
#$_TARGETNAME configure -work-area-phys 0x00200000 \
# -work-area-size 0x4000 -work-area-backup 1
# .. seems to work until watchdog is triggered..
#arm9 configure -work-area-phys 0x103B5000 \
# -work-area-size 0x200 -work-area-backup 0

# This chip has a DCC ... use it
arm7_9 dcc_downloads enable
arm7_9 fast_memory_access enable

5V on HTC serial cable is not attached, because otherwise I have no output in serial command line.

Now I can load radio-3.22.26.17_dream.img with

load_image /tmp/radio-3.22.26.17_dream.img 0x103B5300

into RAM, but when I run serial command

radata 103B5300 01500000

the phone responds with

HTCSF kE�(HTC

.

No further output.

On page 70 of this thread I read something about an issue with Magic 32A and radio 6.x, but I'm shure that I have no 6.x radio on my phone.

Do I have to use other offsets for radata command?

Thanks,

t0nne
[G1 Android Development] [opensys]:
Solved!

I forget to put the destination address 0x103B5300

load_image /tmp/myradio32a.img 0x103B5300

Then in run serial command:

radata 103B5300 01500000

And works.

And now have fastboot :)

Just a notes:

jtag cable must not pass over 10cm from phone to jtag board, if he pass you may have transfers errors or unable to init the jtag.

TRST must have 2.61/2.62 volts not 2.65.. 2.68 volts

Jtag by lpt port takes 50 minutes to pass the 21MB radio.

That's ALL

:P
[G1 Android Development] tonne99:
Now I tried the solution in post http://xdaforums.com/showpost.php?p=5911627&postcount=302

and finally reached Fastboot Mode, but there is no way to flash anything:

C:\android-sdk-windows\tools>fastboot flash radio radio.img
sending 'radio' (21504 KB)... OKAY [ 5.979s]
writing 'radio'... INFOsignature checking...
FAILED (remote: signature verify fail)
finished. total time: 12.147s

---------

C:\android-sdk-windows\tools>fastboot flash hboot hboot.img
sending 'hboot' (512 KB)... OKAY [ 0.501s]
writing 'hboot'... INFOsignature checking...
FAILED (remote: signature verify fail)
finished. total time: 0.651s

Any suggestions? Please help.

Thanks,

t0nne
[G1 Android Development] ezterry:
If I understand you are forcing your current SPL to enter fastboot... this isn't very useful if its not an eng SPL.

You can try fastboot boot <recovery.img> but otherwise it may be best to softboot an SPL like in the original instructions. (if you want to use your current radio just load the 2009 SPL when you are halted at the breakpoint to 0x00 then continue with the memory write to force fastboot)

Also the radio flash problem sounds like a data error.. if not with the original file from the transfer.
[G1 Android Development] stewdk:
Fastboot did the same thing to me (even with an engineering SPL), so I just flashed an appropriate update.zip from the SD card. It may take some creativity to be able to see the screen, push buttons, and leave the SD hooked up while also having JTAG cables connected... It took me a while.

EDIT: oops, I meant that I flashed a sappimg.zip, not an update.zip. I swear I'm not crazy.
[G1 Android Development] tonne99:
:D Back to life :D

Hi @ all,

I tried different solutions mentioned in this long and interesting thread und a combination of some proposals did it.

I followed the steps in JTAG howto again but when I sent commands over JTAG I disconnected the HTC serial cable. When using the serial line I detached the JTAG adapter. And finally I was able to use

radata 103B5300 01500000

as expected und flash the radio.

Now CyanogenMod 6.1.0-DS rocks my reborn HTC MAGIC.

Thank you all for sharing your knowledge and experience.

Next project will be a bricked G1/Dream where 3 JTAG testpoints are gone due to inadequate soldering tools and skills.

I'm shure I will be back to ask more technical questions.

Greetings,

t0nne
[G1 Android Development] Daemonic79:
Thanks :)

After my initial post some time ago, my jtag adaptor finally arrived today (spent some time buying the required bits with spare cash).

I set about the debrick following the wiki guide, and my g1 is now alive again :D

Id just like to thank all of those involved with the research/guide for all your time.

p.s if anyone in the uk needs a debrick, give me a shout :)
[G1 Android Development] :
You could be the answer to my prayers, check your pm's :)
[G1 Android Development] Mach3te:
I have a bricked HTC G1 that I acquired, and have pretty much read everything in this thread and am about to attempt this procedure. I was searching the net for JTAG adapter for the G1 and I found this one at IPMart.

http://www.ipmart.com/main/product/...r,HTC,Dream,,Google,G1,277854.php?prod=277854

I was wondering if this would work and if anyone has used this particular model.

I was also wondering if there were any affordable USB JTAG programmers. The one's I have seen are about 50 bucks, with the "Wiggler" models that use the serial port being the cheapest I have seen. If anyone has any other suggestions I would appreciate it.

Thanks!