yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ezterry:
as that is what is tested and openocd has changed the configuration format since say 0.1 to something not compatible.

This isn't to say you can't use 0.1 you just need to figure out the differences.. I however documented for current stable.

As I said a few posts back its just memory writes you ought to be able to map it to most all arm debuggers..

It's much more of a question of how much to debug your configuration vs. Using a configuration others have already used.

The thing is if you decide on an alternative path than the wiki indicates please do your homework and understand why the steps exist and what they actually do. Not just what steps to blindly follow.

There is no reson someone running this procedure ought to be unable to compile openocd 0.4 from source (using openocd documentation). Even they decide it's more comfortable for them to run the process with other software.
[G1 Android Development] lbcoder:
This appears to be a difficult concept to get across......

The flat green thing on the inside of the phone -- that is something called a printed circuit board. It has PADS where components are soldered on, and TRACES that connect various pads to each other to conduct electrons.

ONE of the components soldered onto the mainboard is the plug.

You do not solder onto the other side of the plug opposite the mainboard. You solder onto the mainboard's PADS -- sharing those pads with the plug itself or possibly finding nearby unused pads connected by traces. You do not solder onto the plug!

It makes no difference if you solder onto the pad of the mainboard or the pad of an extusb plug-board. There is no loss involved. You aren't damaging anything by soldering onto the mainboard. If you can't handle soldering onto the extusb pads on the mainboard, then you probably shouldn't be attempting disassembly of the phone in the first place.
[G1 Android Development] lbcoder:
Ubuntu 10.04? Seriously? Is that the only distro you know? Do you know anything about it?

10.04 is an LTS RELEASE (in dumbuntu talk). The literal translation for the dumbuntu talk is that it is comprised of OLD VERSIONS OF EVERYTHING. xserver 1.7 (when current is 1.8), kernel 2.6.31 (current at that time was 2.6.33), openocd 0.3 (when current is 0.4), etc.

F13 has 1.8, 2.6.33, and openocd 0.4. If you want the latest.... you need either to use a non-LTS-but-current 'buntu (there is none at the moment), or use a distro that does have a current version.

But as ezterry mentioned, recommended as being tested does NOT mean that the older version won't work!
[G1 Android Development] bestrafer:
I'm stuck in "Boot CE manually..."

Here are my steps and output:

1. h (halt)

2. loadbin c:\radio.img 0x103B5300

3. go (resume)

4. q (quit)

5. radata 103B5300 01500000

6. powerdown

7. turn on in serial mode

8. h (halt)

9. w4 0x0090379C 0xea000013 (write 4 bytes)

10. w1 0x9029d8 0x0 (write 1 byte)

11. loadbin c:\hboot.img 0x0

12. w4 0x00000c0c 0x98000C4C

13. w4 0x00000c08 0x98000C4C

14. w4 0x00000c04 0x98000C4C

15. w4 0x00000c00 0x98000C4C

16. go (resume)

17. q (quit)

18 ? (serial terminal)

19. version (serial terminal)

20. cego (serial line)

I do not get a

Any ideas what could be wrong in the steps above?
[G1 Android Development] ezterry:
Some phones are picky.. for lack of a better word.. after checking all the commands exist try unplugging the jtag adapter from the computer.. and/ensure no power to trst-n before running cego.

On my setup control-c (or the shutdown command) in the openocd process is usually enough.. about 1 in 3 phones wont softboot the spl while jtag is active.

Edit:

Didn't see this:

That is also a 4 byte word we are nulling out.. you only wrote one according to the output (w4 0x9029d8 0x00000000)?
[G1 Android Development] bestrafer:
okay, I'll make sure jtag is unplugged before sending 'cego'

yep, that was my doubt also.

Thanks, ezterry
[G1 Android Development] bart9984:
During my experiments on G2 after loading spl in memory and patching it I was not able to run cego. It returned

Boot CE manually...

and then nothing, and I was able to run ? again.

I had jtag attached while doing that so maybe unplugging jtag could help. I solved patching the current spl installed, without loading a new one in ram
[G1 Android Development] ezterry:
There occasionally seems some confusion when the processor starts arm11 if the JTAG is active.

In bestrafer's case however I'm fairly sure its the 1 byte null vs. 4 byte null. Since we are editing a 'BL loadHboot' call to 'ANDEQ r0,r0,r0' (effectively nop) as we are manually loading the SPL into ram.. With the low byte only nulled I will assume it was changed to 'BL randomaddr' thus got stuck without additional output.

On a adventure with the 6.x radio on a dream (please don't try it): the loadHBoot function somehow flagged the arm11 to not be allowed to start. So HBOOT never booted and even with the 1.76.2007 SPL installed to flash (yes it did load it into ram)... I could softboot it however.. but only if I didn't try a normal boot yet.. if I did I'd get stuck back at the oemspl commandline.
[G1 Android Development] scholbert:
Hey!

i don't want to mix things up here, but.....

...reading about the detailed steps, i wonder if it also could be possible to recovery my device that stuck in the 0x8000.... region (QCT_BOOT).

HTC_BOOT is not present in RAM due to some unknown error.

Maybe i should try to load a complete radio to RAM like bestrafer did.

But where to set the PC in this case and give the ARM a kick afterwards???

Would be hard to load/enter HTC_BOOT without exeptions, i guess...

Anyway the RAM is perfectly usable on this device.

@bestrafer:

Keep on hacking... you've gone that far!

Regards,

scholbert
[G1 Android Development] gymmy:
does anyone know if there are any other JTAG points on a Magic as i tore 2 off :( pissed me off ;(
[G1 Android Development] scholbert:
No i don't know... have a look in the region nearby, maybe there's some connection.

Are you guys working at the railroads :confused:

Please choose a silent place and use thin wires if you fiddle around with tiny electronics.

Regards,

scholbert
[G1 Android Development] gymmy:
hahaha, no mine had an accident with a cat !! and been away so havent had time to have another look at it. I might have to get the mmeter out and so come tracing .
[G1 Android Development] lbcoder:
Dat wuz no axxedint.
[G1 Android Development] rynosaur:
LOLz.

Pardon my butting in--is there a specific set of tools good for this JTAG work? For North American haxx0rs here, does Radio sHack have a good soldering iron/magnifying glass/micro-tools set appropriate for this board-level work? And then I need a 'Wiggler' and a serial JTAG adapter, then some PC-side software? I have no DB9 or DB25 on my PC, so I assume I need a serial or parallel card of some sort.
[G1 Android Development] bestrafer:
Another one de-bricked.

Used JTAG: http://www.bravekit.com/usb_arm_arm7_arm9_cortex-M3_jtag_jlink_j-link_v7_programmer_debugger

ezterry and all guys here thanks for your support )
[G1 Android Development] bart9984:
:) it's a good news

my compliments

Cheers,

bart99
[G1 Android Development] bestrafer:
I'm trying to de-brick another G1.

Here the last steps and output after unplugging the JTag .

- version

- sending 'cego' over the serial cable:

Htc serial cable removed and USB cable attached, but the fastboot mode is not recognized - I'm getting "USB device not recognized". If I attach a working HTC G1 (same PC, same cable) loaded in the fastboot mode - system recognizes the phone.

Maybe the system can't recognize the fastboot mode because of "ARM11 Boot Mode: 3" ?
[G1 Android Development] ezterry:
no.. you are in fastboot unless you inadvertently reset the phone when swapping serial/USB wires.

the boot mode is because I didn't bother to stop it from setting boot mode number in the SPL hack.. we just re-point the logic of boot modes 0-3 inclusive to fastboot.

I'd ensure the daughter board is properly hooked up (I've had the tape decide to cover some of the connector pins in the past)
[G1 Android Development] heavenlydemonic:
I have a bricked G1, I was wondering if anyone was unbricking these in the US as a service?
[G1 Android Development] ear0wax:
I would pay also, Im not really in the mood to make another jtag cable. And those solder points look tricky (esp considering all i have is a radioshack iron)
[G1 Android Development] bestrafer:
replugged the daughter board - and the system recognized the phone, so one more de-bricked :)
[G1 Android Development] wraith3:
To survive the interminable wait in getting prepared to jtag my phone, I picked up another G1 to with a broken screen. I was wondering, if I just swap the mainboard of the working phone with the bricked one, will that unbrick it? Or would it just brick both mainboards?
[G1 Android Development] lbcoder:
Rat shak isn't much of an electronics store. I know that in the US, they're a little bit more into components than they were in the last days in canada, but its still somewhat basic.

Regarding the soldering iron, you don't need a $300 soldering iron. Rat shak *probably* has something suitable. The two basic characteristics you're looking for are these; 1) GROUNDED -- make sure that the plug has the third prong, and (2) FINE TIPPED. The point really needs to be small enough to work on the components you are dealing with.
[G1 Android Development] :
you'll be fine if you just switch the boards. most people prefer to do this as it doesn't require jtag. you're pretty much just changing out the housing and screen is what it boils down when swapping boards. of course, i'm illiterate when it comes to hardware on phones so i couldn't help you do this at all.
[G1 Android Development] ezterry:
Assuming your brick is just due to a bad flash the new main board will work fine.

Only recommendation is to also swap the regulation sticker (sticker/card that is the back of the battery compartment containing the devices serial/imei) since the ids are saved on the main board and I think it's best that and the printed version match.
[G1 Android Development] scholbert:
Hi wraith3!

There's an extensive thread about this "unbricking" method... including an anoying discussing about the fact that this is not a true unbricking, but a mainboard swap.

Anyway, if the screen is physically damaged, this normally won't harm the mainboard electronics in any way.

If the whole device is physically in a real bad shape, please make sure that the mainboard itself is not affected by physical damage.

Another thing to mention is, that if you swap the mainboard you'll have to swap the daughter board as well.

The daughter board is the one attached to the hardware buttons and micro-SD socket. This is also the part of Dream hardware where the WIFI-module is mounted.

If the ID of the WIFI-module onn the daughter board and the ID stored on the mainboard's NAND flash do not match, you definitely will get trouble with your WIFI subset.

Please be very careful during the operation and take care not to harm any circuits on the mainboard and the sub-PCB with a screwdriver or something.

So it would be absolutely recommended to have a review on the Dream service manual.

Good luck doctor ;)

@bestrafer: Congratulations for your successful de-bricking!!

Regards,

scholbert
[G1 Android Development] bestrafer:
Are you sure about this? Because I have swapped main and daughter boards several times - no issues with WiFi so far.
[G1 Android Development] scholbert:
Yeah i'm sure!

So you're in luck and the calibration lives with the module in harmony.

Instead of...

you definitely will get trouble with your WIFI subset.

i should have written...

you might get trouble with your WIFI subset.

Anyway try and check your kernel output with dmesg on one of these swapping devices.

I twice did a swap and got a complete fail in one case and very strange behaviour while powering up wifi in the other combination.

So i made intensive tests with dreadiag.nbh (Dream diagostic image). If the ID's do not match... WIFI test fails.

We're getting of topic :rolleyes:

Cheers,

scholbert
[G1 Android Development] LeonardoFloripa:
bestrafer, dude, wanna make some bucks ?

Say the price!

:)
[G1 Android Development] hypocrat37:
Motherboard Swap

Hey just wanted to add my input to this thread. about two weeks ago I bricked my phone - sucked, bad. (yes full on brick, no recovery no fastboot, nothing just the G1 screen.) I bought a broken G1 on ebay for about 45 bucks. I pulled the motherboard and put it in my bricked G1. I only replaced the motherboard, no daughter board or anything else. After putting it back together I fired it up and it worked perfect. Rotted and installed CM 5.0.8 T1 it is now running test3 like a champ. No wifi problems. Everything runs great!
[G1 Android Development] d0m1n0:
I did the same exact thing, works like a charm. But I'd still like my old one de-bricked. Anyone have this method down, and would like to give a quote to have it done? If so, PM me please.
[G1 Android Development] heavenlydemonic:
Add me to that list.
[G1 Android Development] scholbert:
Hi,

it's nice to realize that most devices would work :D

I don't need to convince anyone of any thesis about the ID missmatch... it's a fact that if the ID's don't match the WLAN test of dreadiag will fail.

Please refer to the service manual (Pages 72..74).

As reported this got no influence on linux booting up and as you pointed out might have no effect on most devices in practice.

Anyway from a technical point of view the mainboard and the daughter board should be treated as a couple.

They'd been married during factory setup.

Parameters are stored on the WIFI module and inside hidden sectors of the NAND on the mainboard as well.

If it works out the way you assembled your device it's O.K.

If it does not, remember my words :rolleyes:

Best regards,

scholbert
[G1 Android Development] ezterry:
To everyone asking for someone to "JTag their dream/magic ect" in the forms..

Please take note: Selling services on XDA is against the forum rules. We are here to share in an open format how to do the task not to sell services.

Also in my opinion; its not related to this topic; And for those posting in general sections is starting to get on the nerves of other viewers of the boards.

If you have requests of such nature of individuals send a private message..

If you want to ask the greater population you can see if the Moderators/Admins are willing for a "HTC G1 Jtag" thread in the Marketplace.

If you are looking for some help due to some issue with the JTAG process as On the CM wiki page or future JTag hacks to the G1 by all means ask here.. we will probably humor Magic (and maybe hero if you find the jtag test points) here.
[G1 Android Development] sorenjul:
Still not getting anywhere :-(

Hi

Now I have tried resoldering everything, using the LM317 LDO solution instead of the lab supply and tried every jtag frequency in the world and I still read the wrong ID:

Info : JTAG tap: arm9.cpu tap/device found: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)

Since I have tried almost anything could this be related to radio ver. 6.35?

Eventhough I get the error I can load radio ver. 3.22 to memory but when I get to the serial console and write radata 103b5300 01500000 I get the following response:

HTCSF kE�(HTCE

And I can still enter commands after that so the phone is still running. If I write radata I get the following response:

Wrong parameter!HTCSF kE�(HTCE(HTCE

Can anyone try to see if its possible on a 32A device to downgrade the radio image from 6.35 to 3.22?

Is there any way to read back what I'm writing to memory to verify that it's not there the problem is.

It's killing me that I cannot fix this and now I'm just getting stubborn.

Edit: If I keep running my head into a wall with this setup I might as well pass on my jtag kit to someone else who need it.

\Best regards

\Soren Jul
[G1 Android Development] ezterry:
It ought to be.. but if you have the 6.x image the radio needs to be uploaded to a diffrent memory offset:

(thus why I added this seciton to the wiki)

http://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC#Magic_32A_users_with_6.x_radio

Just use: 19500000 instead of 103b5300 for both the load_image and radata calls

--

Just I'm not sure you properly loaded the radio... most people who load the radio to the "wrong" 6.x radata location are stuck since radata never returns. (thus reports of soft bricks with the downgrading a magic 6.x radio where HBOOT-1.33.2010 was used instead of HBOOT-1.76.2007.. and the radio was flashed from recovery)

You may wish to use dump_image to re-extract the radio after loading it and verify the md5 sum hasn't changed..
[G1 Android Development] akivlin:
Can I have a close up picture of the G1 motherboard with the JTAG wires soldered to it?

I'm new to intricate soldering so I'd appreciate seeing it completed.

I already made the serial using the extUSB breakout and a CP2102 so I've had some practice. I did a good job with the serial soldering so I'm hoping I will be able to do the same with the JTAG soldering.
[G1 Android Development] ezterry:
The scale is different.. also the JTAG points are test points (copper pads).

http://twitpic.com/1sboiz
[G1 Android Development] sorenjul:
Another one De-bricked ;-)

Hi ezterry

The address for the radio did the trick - yeah.

Thanks go out to ezterry, Bart, Sholbert and all the other guys who helped me out.

pm me if you are interested in my jtag kit since I have one in spare now.
[G1 Android Development] ezterry:
Glad it worked out.

btw, did you run into any issues with softbooting the 1.33.2009 spl? Or was that not required for your type of brick?

(Just want to listen for any gotchas in the process to help clarify it for future users.)
[G1 Android Development] sorenjul:
Hi

My de-bricking was by the book and output was exactly like you description on the wiki. So no hickups with the 2009spl.

I did though forget to run all the erase commands at first so I han an error when trying to flash a new hboot from fastboot.

My brick was caused by flashing a hboot not downloaded properly so it had a file size of 236kB - it took me days to figure this out. At first I thought the phone died from some other case since all the fastboot flashes showed 'OK' - but apparently fastboot can flash anything to hboot. I don't think I will do this again :cool:

Best regards

Soren Jul
[G1 Android Development] ezterry:
A bit odd.. the invalid spl/hboot image must have left something in an odd state. Note that in general, unless the JTAG is attached, I never recommend running 'fastboot erase hboot'.. because if you then can't re-flash hboot before restarting you will require the JTAG connection to fix the phone.

Of course in the generic JTAG instructions I recommend erase all user flashable data to ensure nothing is leftover from the previous install that forced you to resort to JTAG in the first place.

Well congratulations on the revived phone. May it be a useful smart phone again.
[G1 Android Development] akivlin:
Thanks for the picture. That is very intricate soldering!

I opened my G1 and have removed the motherboard to have a look and I'm now thinking there is almost no chance of my being able to successfully solder wires to those test points. I even researched how to do it and have a basic understanding of what is required but it's just such a daunting task lol.

Most likely I will have to buy multi-com's JTAG adaptor or else give up on the idea of recovering my phone. :(
[G1 Android Development] -Maverick-:
I ended up buying the jtag adapter for the same reason. It's not worth destroying the mobo.
[G1 Android Development] kingkurry:
I just bricked my G1. SPL related issue. Any chance of a noob proof guide for JTAG debricking?
[G1 Android Development] he3r0:
that's what i have to do too :/ i tried to solder to the points, but my eyesight is too bad, and they are waaay to small :/
[G1 Android Development] akivlin:
I used the following to successfully debrick my G1:

ExtUSB breakout

CP2102 USB to Serial breakout

Multi-com JTAG adapter

Olimex ARM-USB-TINY JTAG debugger

Spare G1 battery and 3 wires with crocodile clips on the other end

I used the G1 Serial instructable to connect up the extUSB breakout to the CP2102 breakout.

I soldered the 3 wires to the contact points on the battery after charging it up. I insulated the middle crocodile clip with insulating tape which is very important as otherwise it's very likely a short circuit will occur.

The multi-com adaptor is reasonably easy to fit but it has very delicate push pins which are easily broken. I had to solder the 2.6v push pin after it snapped off when I was fitting the adapter to the G1 motherboard.

I used Ubuntu Desktop 10.4 and OpenOCD 0.4.0 and I modified the ARM-USB-OCD config on the JTAG wiki so it worked for the ARM-USB-TINY. I changed the pid to 0004 and I removed the line containing 'ft2232_device_desc "Olimex OpenOCD JTAG"' otherwise it wasn't able to find the device.

I plugged in the serial and JTAG debugger and connected the crocodile clips attached to the spare battery.

I followed the "DeathSPL Flashed on 1.x Radio" section of the JTAG wiki and 10 minutes later my G1 was unbricked and I was able to boot into fastmode.

Thanks to everyone who made this possible.

:D

EDIT: I had forgotten to include the steps for powering the G1 with the spare battery.
[G1 Android Development] fulhamc:
Well done akivlin
[G1 Android Development] fulhamc:
Are you interested in selling on your gear so as I can unbrick mine ?
[G1 Android Development] shaji007:
what was the total cost for all the connectors etc?
[G1 Android Development] akivlin:
It was ~£105 for the ExtUSB breakout, CP2102 breakout, Multi-com G1 adapter and ARM-USB-TINY. Other bits cost ~£30.

I had my G1 for one day before bricking it so I was determined to fix it. I wasn't concerned about the cost but also it wasn't that noticable because I built the serial first then a couple of weeks later I bought the Multi-com G1 adapter (came from Poland) and finally I was confident of it being successful so I bought the ARM-USB-TINY.
[G1 Android Development] akivlin:
I've successfully de-bricked another G1. It was much easier to do the second time around.

If anyone in the UK/Eire is looking for de-bricking help I am happy to help out free of charge.
[G1 Android Development] drutort:
can you make a thread and post a howto im sure a lot of ppl could donate some bricked main boards or you can buy them cheap on ebay and resell as fixed :o

but this info would be awesome, as small investment is worth it IMO
[G1 Android Development] drutort:
i was just searching for products anyway similar model?

http://www.aliexpress.com/product-g...ped-with-mini2440-TQ2440-713-wholesalers.html

there is v8 but it costs 40-50

http://www.aliexpress.com/product-g...ssing-with-adapter-plate-720-wholesalers.html

anyway what else would be needed besides

http://www.fonefunshop.co.uk/cable_picker/94800_JTAG_Adapter_for_Google_G1_Dream.html

(http://www.multi-com.pl/index.php/en_US,details,id_pr,7183,menu_mode,categories.html)
[G1 Android Development] ezterry:
You are on the thread

Instructions: http://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC

And very few main boards where donated when the process was being designed.. why would they be donated now when there is a process??
[G1 Android Development] drutort:
:)

can you tell if this jtag will work?

its same jlink as was posted by a user? (im assuming) there are v7 and v8's about on the net for almost half the price

http://www.aliexpress.com/product-f...RM-USB-JTAG-Adapter-emulator-wholesalers.html

http://www.aliexpress.com/product-g...ped-with-mini2440-TQ2440-713-wholesalers.html

would both or one of them work?