[G1 Android Development] ezterry:
Its Alive

Hi All;

So a successful un-brick

To continue/confirm my post

http://xdaforums.com/showpost.php?p=5795214&postcount=252

I've recently got a Tmobile G1 bricked by the previous owner installing HBOOT 1.33.2005 on top of radio 1.22.12.29.

This like when rogers phones install the ota zip file causes the SPL to get stuck in "ARM11 Boot Mode: 3"; without a recovery to flash (thus stuck on boot screen)

The following ought to allow you to correct any phone with 1.33.2005 SPL stuck in this mode. However will require some adjustments depending on the current running radio. (And I've only succeeded on radio 1.22.12.29)

(Rogers Dream users if you installed the OTA radio 2.22.19.26I did already overwrite the EBI1 radio)

Instructions obviously preliminary I am still trying to see if we can avoid jtag for this.

---

Note I've copied and simplified the process, see the wiki page:

http://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC

---

Prerequisites

A) a phone working with jtag (I will provide commands for "Open On-Chip Debugger 0.4.0" translate to your setup):

mww ['phys'] address value [count]

write memory word

resume [address]

resume target execution from current PC or address

halt [milliseconds]

request target to halt, then wait up to the specifiednumber of

milliseconds (default 5) for it to complete

bp [address length ['hw']]

list or set hardware or software breakpoint

rbp address

remove breakpoint
​

B) A working stack for your phone in fastboot *.img format (you will want radio.img hboot.img recovery.img

C) HTC Serial wire or serial/USB hybrid wire; please ensure you can disconnect the USB/Power separate from the serial if need be

Procedure

1) Enter blue light mode and attach both serial wire/console + jtag

2) Halt CPU

halt​

3) enable the CID bypass for your version of the radio

1.22.12.29: mww 0x00902EB4 0xea000013

2.22.19.26I: mww 0x009038F0 0xea000013

3.22.20.17: mww 0x009038F0 0xea000013

3.22.26.17: mww 0x0090379C 0xea000013
​

4) set the cego breakpoint for your radio

1.22.12.29: bp 0x00901A24 0x4

2.22.19.26I: bp 0x00902b30 0x4

3.22.20.17: bp 0x00902b30 0x4

3.22.26.17: bp 0x009029DC 0x4
​

5) resume CPU

resume​

6) run 'cego' on the serial oemspl console

7) if all is well the CPU halted due to the breakpoint.. if its failing to boot android you didn't set the breakpoint correctly.. if its gave an error about an unknown command you didn't apply the CID bypass correctly please pull battery and try again

8) Clear breakpoint that you set earlier

1.22.12.29: rbp 0x00901A24

2.22.19.26I: rbp 0x00902b30

3.22.20.17: rbp 0x00902b30

3.22.26.17: rbp 0x009029DC
​

9) change BOOT Mode 3 to "FASTBOOT" mode :) (address only for 1.33.2005 SPL and 1.33.2009 SPL)

mww 0x00000c0c 0x98000C4C​

10) resume CPU

resume​

11) now if your video wire is attached (the wire right over the jtag port..) you will see the boot screen with "FASTBOOT" at the top.. if its not attached.. lets hope that is what you would see and attempt to continue anyway

12) attach USB wire to phone and on PC run "fastboot devices" to see if we are correctly in fastboot mode

13) fastboot yourself a working stack

fastboot flash radio radio.img

fastboot flash hboot hboot.img

fastboot flash recovery recovery.img
​

14) once all the above complete successfully pull battery/serial/dissable jtag (we need a very cold reboot and it gets confused)

15) boot phone it will boot in boot mode 3 to recovery; clear cache; and with luck behave... use recovery to flash your desired system as usual.

If you wish to load an alternate SPL rather then only modify the existing one or avoid the breakpoint; see my rogers solution: http://xdaforums.com/showpost.php?p=5934885&postcount=6

BTW If this did get you out of a bind I do accept donations to cover costs of phones that can no longer get recovered

(Now that I have a working jtaged phone there was some other things I wanted to look at)