yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] adamw156:
This is what I got back from t mobile sorry about the quality of the photo. M.facebook.com/photo.php?pid=1559495&id=1203708927&m_sess=1203708927%3A666813184[/url]
[G1 Android Development] ezterry:
"Main Board Exchanged"

So it matches: http://androinica.com/2008/12/19/htc-dream-service-manual-now-available-for-download/

The manual indicates an attempt at a low level repair (as replacing ram/flash with a "good chip") may be done to save the rest of the hardware; but as the main board was not working they just replaced it for you now.

At no point does the service manual indicate the serial port.
[G1 Android Development] bart9984:
finally i've got an official response by htc assistance. They will not repair the phone even if I pay money. They said they found non official software so I can't make use of their technicians :eek: (I think that's ilarious)

My question is:

Is a mod version of android (wich is open source) a pirate software as they say?

My next steps at this point will be: 1- Try serial hack 2- At least, try to sell the phone for hardware pieces.

What ezterry has posted is a hope for people like me that is trying to de-brick their phones.

ezterry:

Have you tryied other setboot options or other commands like "list" for a list of possible commands? Are there commands like read or write? finally have you tryied psas - qmat to access the phone via serial cable?

Cheers,

bart99
[G1 Android Development] lbcoder:
Most definitely NO.

But unfortunately, the people who work for HTC are MORONIC MS FLUNKIES who know nothing except WIMO.
[G1 Android Development] bart9984:
lol :)

bart99
[G1 Android Development] adamw156:
The phone I sent them was a brick from using the haykuro spl when I got it back they said they couldn't repair it so they changed the main board. The phone came back with a different imei number
[G1 Android Development] kR105!:
Maybe they are reading this thread :o
[G1 Android Development] ezterry:
No list function; or echo on functionality unless you security unlock your phone

(not sure how to do that on a working G1.. forget about mine stuck in the arm9)

Commands are:

radata

powerdown

setboot

GO2AMSS

rseed

pmic_vib_off

pmic_vreg

pmic_level

pmic_vib_on

rpass

(as listed: http://xdaforums.com/archive/index.php/t-487945.html This is the OEMSBL console)

* radata is used to flash data .. and used by the SPL to flash data!!! now I just need to figure out how to properly use it.. but given how one other HTC phone worked with it; I think its possible to make a "slowboot" to act like fastboot over serial ... there has been some minimal luck with one kaiser radio verison

* powerdown powers down the device

* setboot I can see the help string in the radio image:

1 = blue light mode (and will always be entered if you hold action button on startup)

there may be a mode 5... sleep/charge (but I don't this it a wise idea to test if the action button will still bring up the command mode; if you put the phone to sleep on startup)

* GO2AMSS start up the AT command line [interface to the radio] .. if I was board I think I can make a phone call from here...... Other information such as if you are sim locked or not can be gathered from this prompt. very not user friendly intended for winmo/android phone app.

* rseed echos 32 hex digits in HTCS...HTCE encoding not sure how to use it

* pmic_vib_off turn vibrator off

* pmic_vreg set/view various level settings

* pmic_level level info requires parameter (didn't look interesting on other phones for my problem)

* pmic_vib_on turn vibrator on

* rpass radio? password
[G1 Android Development] scholbert:
Hey!

BOOTLOADER:

These are amazing discoveries :D

I also entered the boot console a few weeks ago after playing around with the DREADIAG functions.

Afterwards, i found the thread with the commands, very interesting...

JTAG:

In the meantime i did some experiments with a total brick, no startup, no vibra, not even blue led mode.

I realized that this device sends its JTAG ID but could not be entered in debug mode. The CPU refuses to halt :o

BTW, we should be aware that the engineers from HTC are coming across and know what we are writing here!

So it might be, that some of the methods we find out to get access to the platforms maybe blocked on upcoming devices.

Even JTAG testpoints could be banned from the mainboard of future gadgets...

Regards,

scholbert
[G1 Android Development] lbcoder:
You wouldn't believe the trouble it was to explain to an HTC "engineer" that the kernel was licensed under GPL and not APL.... which meant that they were OBLIGATED to provide the source code for any modifications they made and used on a device they sold (which they did subsequently provide at developer.htc.com).
[G1 Android Development] lbcoder:
I don't think that we should worry about "future" devices. The future devices could be anything and with any kind of differences. Quite honestly, I really doubt that HTC cares one way or another. IN FACT, it is actually in their best interests that advanced users would be able to repair these things at this level themselves since it WILL result in a reduction in warranty claims. My guess is that a solution that remains technically complex (i.e. beyond the scope of the average user), it will result in less wannabe hackers doing things to mess up their phones, and more advanced hackers being able to repair damage caused by morons, and ultimately fewer warranty claims.

The big thing that organizations like HTC do NOT want are things like 1-click root apps, which make it trivial for complete idiots to completely screw things up. And of course the BIGGEST stupid thing ever.... deathspl. I bet that whoever made it so that this could be screwed up this badly has been fired.

What we really need, I've said it before, is an open and configurable SPL and proper access to be able to rewrite the whole thing, even with a dead radio.
[G1 Android Development] bart9984:
this is amazing, radata should be the way to unlock bricked phone... I'm waiting for the usb to uart converter( http://www.futurashop.it/allegato/7.../NETWORKING&L3=&cd=7100%2DFT782M&nVt=&d=15,00 ),it could be delivered tomorrow so I can complete my serial cable. I've an Htc Magic, tomorrow I can tell you if on this device there is the same console...

lbcoder:

I've contacted HTC via mail this time and they've confirmed the device is not reparable, an option cuold be to get help from a consumer group, it's really strange they refuse to repair a phone even if for money, but really I don't think i want to bother with them.

bart99
[G1 Android Development] bart9984:
found this searching for radata command

http://xdaforums.com/showthread.php?t=369760

bart99
[G1 Android Development] bart9984:
reading here http://www.52dopod.net/archiver/tid-93068.html

maybe "radata 90000000 1" will put the phone in download mode?

or usbdmpullup stands for download mode?
[G1 Android Development] scholbert:
Hi lbcoder!

Maybe you're right :rolleyes:

Back on track:

I'll digg a bit deeper with my debugger the next days, because i'd like to know more about the boot chain. In debug mode it's no problem to read out parts of memory, e.g. OTP-PBL.

What i dislike most, is all this security checking inside boot-code.

I'm also looking for a way to rewrite NV items, e.g. WLAN calibration data.

So stay tuned ;)

This thread is getting more and more exiting...

...and i like it!!!

Regards,

scholbert
[G1 Android Development] DevPhone1337:
If it's under warranty, I'm not sure why you seem to think any "morons" would get it fixed by "advanced hackers"... Under warranty + broken = warranty claim, period. It's free, it makes more sense. The only things saved are the lives of many out of warranty devices, which HTC couldn't care less about (except, maybe, for the fact that it would lose them $ on repairs paid for by customers).
[G1 Android Development] bart9984:
Here again.

I've finished my serial cable, it works properly.

when i boot in normal mode i get an output similiar to ezterry:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : MICRON_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Android
ZºC…K[®[å+Ë‹ÖÉ½‰•5Rµ•É…šjÕ¤ø
[MDDI] Bitmap_Width = 480
[MDDI] Bitmap_Height = 640
[MDDI] RGB_Capability = 0x8888
[MDDI] Mfr_Name = 0xD263
[MDDI] Product_Code = 0x0
EEPROM: read 2032 bytes
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++
Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0x6
BodyLength : 0x2F0
BodyCRC : 0x29DC2C26
aDieId(0) : 0x0
aDieId(1) : 0x0
aDieId(2) : 0x0
aDieId(3) : 0x0
countryID : 0x30
Wlan data header --------------------------
ARM11 Boot Mode: 3
Platform: HBOOT-7201A

note how it says HBOOT-7201A while my magic according to package use a msm7200a :confused:

in blue led mode i've the same commands as ezterry, so no full commands avaible.

I confirm there is a setboot 5 too and it put the phone in off status charge.

rpass command blocks the terminal,also "rdata 90000000 1"

trying "radata" without arguments I get this:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : MICRON_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE1
[I][COLOR="Red"]here i type radata[/COLOR][/I]
Wrong parameter!HTCSF kEØ(HTCE

according to this post it seems a wrong response meaning bootloader is screwed up

http://xdaforums.com/showthread.php?t=387522

but it seems to be fixable...

I can't get the phone to be recognized by qmat or qpst... any ideas?

ezterry:

Any news from your tryies? :)

Cheers,

bart99
[G1 Android Development] ezterry:
Slowly it goes slowly; but not stuck at a dead end. But time is needed to do this safely; As I'd rather not brick my brick :p

But a long weekend is coming up.. we will see
[G1 Android Development] bart9984:
ok,

tell me if i can do something to help.

do you have also the string "HTCSF kEØ(HTCE"?

edit: Sorry jus now I've realized it means false in HTCS HTCE block... :)

so how does radata works ? anyone has command usage?

ezterry: what are you working on?
[G1 Android Development] SilentTweak:
I had this happen to me earlier. I found this on Cyanogenmod Wiki - eg: you currently have an EBI1 system and recovery image. If you flash an EBI0 radio image you will no longer be able to boot your phone. In this situation it is fixable if you know how but there are other situations that are not.

What does it mean by fixable? I'd like to know so I can get out of this brick please!
[G1 Android Development] lbcoder:
It means that the Radio, SPL, and Kernel need to be compatible with each other. If any one of them is incompatible with the rest, then it won't boot.

The "fixable" thing means that the Radio and SPL are still compatible with each other, but the KERNEL is not. Theoretically, the only thing you ALWAYS MUST have, is a radio and SPL that are compatible with each other. As long as you have these, then you can still work the device.

A *brick* is where the Radio and SPL are not compatible with each other.
[G1 Android Development] SilentTweak:
Well I didn't flash any other SPL, only the radio which was EBI1 got flashed over by an EBI0, because of the OTA that you flash before flashing CM, assuming you're on EBI0, I guess. But the Radio being flashed from the OTA should be compatible with the SPL (Danger). Everything was fine until I loaded the CM Rom. I know it's my fault, but is there anyway way out of this now? Or am I doomed? lol All I get is the Blue LED from Trackball+Power. Everything else gets stuck at the Rogers logo.
[G1 Android Development] lbcoder:
Please start your own thread or join an appropriate thread in the appropriate section, i.e. Q&A. This is the development section and this question is off topic for this thread.
[G1 Android Development] bart9984:
Hi all,

somthing new here.

When I enter GO2AMSS command then close mtty and start qpst server QPST recognizes my phone... see attachment (in red oval is written SURF7600-7200 (DEADD00D)). With some of the qpst tools I can access the phone and see internal informations.

But when I try the "Memory debug" tool it says the phone is in diag mode and ask to switch it in dload mode,so it reboots the phone and at that point nothing happens...

Alredy tryeid radata 90000000 1 command before of GO2AMSS but it freezes my phone.

There is a way to put phone in dload mode via amss interface?

Or there is something it's possible to do in diagmode?

Via at commands I've been able to receive an incoming call and I was able to hear the caller voice, no luck at the moment to make a call maybe I'm wrong in some command (no carrier).
[G1 Android Development] scholbert:
Woooow...

Hey bart9984!

That's awesome news!

QPST is nice stuff to play with :D

I once tried to connect using USB, but that didi not work!

Need some soldering though to make a serial adaptor...

Slight update concerning JTAG:

Yesterday i played around for a while with JTAG using ARM9 debug mode.

Very interesting insights of the systems behaviour :rolleyes:

The most comfortable way is to enter "blue led mode", because it's most stable and there's no mmu involved.

I also was able to dump the OTP-PBL.

Entering SPL bootloader is also working but sometimes debug session crashes or debug mode may not be entered, because CPU can not halt for some reason.

Regards,

scholbert
[G1 Android Development] bart9984:
I hope it will be really a chance to access the phone via software and unbrick it :)

Now I post some thoughts after reading other forums and documentations.

1) radata command: jockyw2001 told me that it can flash a radio image, but the problem is that we must preload some ram buffer first... so in a security locked device as mine it's not easy I think due to the few commands avaible.

so there is a way to unllock?

2) QPST could flash the phone but I think I first need to put the phone in download mode. I need to find a way to do it via AT interface or radata command. In actual dialog mode i can restore and buckup NVItems and acces ESF. I'll try psas tool too...

Any suggestion will be really appreciated :)

bart99
[G1 Android Development] bart9984:
Using PSAS/QMAT I've been able to get the phone recognized too.

Here the procedure that's a little strange form me, enter GO2AMSS on the phone (I use setboot 2 as a shortcut to boot directly in amss mode) go to hardware forensics in psas/qmat and click use "Mobile ports", so I select the correct com port and i click on "QC Generic" in port setup tab. Psas at this point crashes, I restart it and under mobile ports now it recognizes the phone as:

com1 (QCDM: SDCAALMZM) USB serial port (com1)

Now in "Diag port (qc)" tab i can use the commands avaible, no luck with the 3a command to switch the phone in download mode, it causes the phone to reboot but no dload mode for me.

here a post of what the "get hw details" plots:

Compile Date Apr 22 2009
Compile Time 22:13:12
Rel. Date Dec 29 2008
Rel. Time 24:00:00
Dir. Version SDCAALZM
Station Class Mark 0
CAI rev 0
Mobile model 74
Firmware Rev. 0
Slot Cycle Index 0
HW Maj. Version 1
HW Min. Version 70
ESN DEADD00D
Diag Version 8
Mobile Model ID 00000074
MSM Hardware Version 301700E1
MSM Hardware Version Format 2
Version Strings M7201J-DCAALM-6220
IMEI : here there is the imei :)
IMSI: 000000000000000
EFS SubSys Browser is supported.
EFS Standard Browser is supported.
Memory Dump supported, starting at : C0000000
EFS Raw Read is NOT supported.
EFS Raw Read Alternative is NOT supported.
NV Item Read is supported.

I've noted the memory dump supported line. Which memory is refered to? I think its the nand, i will dump it now

bart99
[G1 Android Development] SilentTweak:
Go Bart Go! Moral support is all I can offer :(
[G1 Android Development] bart9984:
tnx,

I'm not an expert too. I'm doing what i can, learning step by step.

I've tryied to dump the memory, from addr c0000000 to addr c1000000, I have errors on upper addrs. time to finish this dump: about 1h 1/2 :eek: for only 13mb...

now the strangest thing, its always the same block of data that repeats every

00040000 offset.... so only 256k....

any ideas?

I attach the data...

edit:

ok after a new check i discovered that from addr 00800000 starts a new data block that seems to repatfor a while, than there is something like this

B9 66 AD 33 C7 AF 99 E4 58 31 1F 02 C7 A1 2F 3D

that repeat untill the end...
[G1 Android Development] lbcoder:
Can't imagine why it would repeat like that unless it is actually the same memory you are reading over and over again. Might be something to do with addressing.

Have you checked if this 256k matches against any known data? I.e. from the radio or SPL?
[G1 Android Development] bart9984:
Hi,

I agree with you, its strange. I'm looking to find a radio image to check similarity...

I really don't know. may be the method used to dump doesn't work properly, or may be who flashed this phone screwd up everything (I didn't do it :) ) and there it's supposed to be part of the spl... I'll let you know if I'll discover something, for anyone who wants: feel free to do some research :P
[G1 Android Development] myst777:
First one here i go!

Alright so first post: What can i do! I have a bricked Dream (first method developed by ezterry eb10 eb11 missmatch blah blah blah) it doesnt worry me (mainly cause i can just grab another one out of the demo pool :P) however there's jsut a certain charm about your own device XD. PLUS! i want to learn about how all this works, and the more and more i watch you guys the more and more im awestruck! my diamond my tytn and my G1 have all done amazing things because of your work. I wont deny i once ripped apart a .jpg with a hex editor and put it back together again (just wanted to learn how hex headers worked and what made them recognizable) but thats about as far as my experience goes :( So i come with my hex editor and some mighty determination in hand and ask what can i do :) point away!
[G1 Android Development] myst777:
Interesting

Alright sorry for the double post however just for giggles i pulled downt he rogers radio that had its way with my device from Cyano's wiki and ran it through my hexomaticly awesome editor. Alot of blank emptyness however i found some interesting strings pertaining to nand in all those lines of nonsense. reading what i can (as im not a hex pro) i can see a few radio commands and what looks like some jibberish refrencing the flashing of the radio and the first/second splash screens.....hmmm after flashing the mismatched radio/spl from my nandroid backup i noticed a htc screen with a ! mark before going back to my regular old rogers screen during the post. i wonder if that has something to do with this and if so if i can find it within all this madness. ill keep digging (work is a bit boring right now :P)

Ugh holy cow the radio controls so much :S i noticed a few things about ruu checks and if they fail to reject the upload a while back haha.
[G1 Android Development] SilentTweak:
If you see a !, that means you don't have a real brick then. The ! is the default recovery working.
[G1 Android Development] ezterry:
Apparently a good day for others to be busy.

bart9984:

Yes i can imagine its slow.. the serial line is 2x faster than a 56k modem.. Thus I hope to fix this by flipping that silly boot mode or only flashing something small like the SPL.. not the 20MB radio.

I unfortunately don't recognize the data from any part of the phone I've poked thus far; seems very random, compressed and/or encrypted.

If you have some time it may be interesting to see if anything is of use in that upper memory space; rather than attempting to DL every thing, just get 1 or 2 k at the beginning of each section ie (C0000000-C0000800; C1000000-C1000800; C2000000-C2000800 ... ect to FF000000-FF000800 ...) some will likely fail.

All

If someone has a working phone and a serial wire I'd be interested in the SPL debug output when flashing a radio/SPL/recovery; I was hoping my replacement phone would arrive today; but Canada post has never exactly been known for speed...
[G1 Android Development] myst777:
Haha nope

Haha nope i mean i cant boot into recovery with home and power button. its really strange it only happened once directly after i restored the nandroid backup and it was before the rogers post screen. also it wasnt the regular recovery screen (i had ra's recovery anyway) it had a htc logo on it :S. No im sure i'v got a brick :( no fastboot/recovery for me :S. haha alright so before i left work i went skimming through a bunch of that hex. what is it we need to look for to get the radio/spl to the right place? a memory adress orrr? if so is there a way i can start looking? sorry to burden you guys but i think i can be a real asset if i know how to get the stone rolling :)
[G1 Android Development] bart9984:
Ok,

Im still trying...

when i try to switch into download mode the phone reboot, the phone answers to the command and seems to accepts it, I'm spoofing the serial cable with this software: Free Serial Port Monitor, and i can't catch errors to the replay, but when I send some data after it reboots.

For the memory dump:

the data dumped is still unintelligible, I've tryied to write in a portion that was empty, I can write but... here comes the gibe again, when I reboot the phone the data returns to the original values... is it possible that data is Ram? :confused: If so, we can try to write it and use radata to write radio, or maybe its just a portion of the memory written at every reboot.who knows? the first address avaible is c0000000

edit:

another strange thing, when i enter bootmode 4 (ARM9_BOOT_MODE4, Stay in OEMSBL) and i type the command GO2AMSS to access the diagnostic interface the backlight of the screen powers on and nothing else happens, the phone seems to be freezed...

bart99
[G1 Android Development] ezterry:
Ok..

Well nothing of general use yet, but two interesting things:

1) when poking a determined fairly safe spot to flash I was able to get radata to do something via the Kaiser SPL loader program [very small 4byte file].. in its self thats not very useful as it wont encode a dream SPL. But it did cause my next boot attempt to wine that the WLAN settings whre currupt and needed to be restored :)

before getting stuck on in ARM11 boot mode 3 + rogers logo as usual :(

2) Also it may be possible to stack smash the serial command line if we can't get radata to behave. ('shutdown + <large binary blob>\r' has had some interesting results)

what I'm particularly interested in is a good memory map.. where all of the G1 partitions are and where the radio (particularly the part with the boot loader command line) is loaded to..

For reference the the SPL is loaded into ram at 0x98000000; and code entry 0x98000400.. and has the diagnostic commands to answer my questions.. if the phone was working.. maybe security unlocked.
[G1 Android Development] bart9984:
hi ezterry :),

theese are very good news, what steps have you done to get kaiser spl to work? So I can try to see if I can obtain a similiar result.

To poke bytes are you using the qc diag interfeces? wich addresses did you use?

Keep going on :)

Cheers,

bart99
[G1 Android Development] ezterry:
um.. lets be very clear; the actual kaiser SPL is half the size of the dreams.. and expects to be loaded in a different position in ram thus will certainly fail. And probably make the phone even more of a brick than it is now..

Thus far I'm just using serial tty .. and some python to help out with my communication with the phone.