yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ulissescg:
Hi Guys,

is there a scientific explanation why do i have damage the Board??

Or what parts will be sensitive to this frequency-Power????

This machine is specially designed to make inspection on Boards or on Chip package, I usually do to inspect defects or see soldering condition on a BGAs and you can use it on C-MOS, TTL, SiGe, GaAS, NMOS, etc.. or some others… general speaking from Spectrum point of view there are many wavelength where you can work on an x-ray spectrum, from soft x-ray, hard x-ray and y-xray, also how many photons you induce in to it (total energy)…. Then I’m sure I did not damage my board, mi only concern it was just on the compass Chip….

Then ,this just was to show you a way to do because I have the resources , also just for fun…. and also if someone have a board that I can take it and remove the parts I can easily trace almost all the traces and do a Reverse engineering quickly….. I have experience on PCB Designs and will be easy for me…. Anyway, i will continue working on the jtag programming ….

By the way, im using the YTX-3000 Series X-RAY Machine

Regarding the debricked phone, it just mention that they succeed on some versions, for me, this is not debricked yet, because this not apply to all the phone versions, I’m I correct???

Thanks

Ulisses
[G1 Android Development] scholbert:
Hi twoscoops!

I personally have not verified it... got no device right now :o

Please take care, VTref has to be connected to 2.6V.

MSM I/O logic operates at 2.6V.

Leaving nSRST open should be O.K. for first try.

Regards,

scholbert
[G1 Android Development] BinaryDroid:
Great, Lemme know if you find anything. its gonna be such a let down when i kill my phone lol ah well its for the best in the end.

@twoscoops

I havnt gotten a successful connection going because my simple wiggler didnt supply the proper connections. just built another last night with 2 buffers and complete connection setup at proper voltage w/status led. QMAT has the pinouts known and they make no mention of mode pins so i'm still wondering if their needed. Another thing I noticed, on a JTAG resource I read they said sometimes ARM will pull RTCK low to get the target into Debug mode....well remember I told you theirs a hidden point under the trackball for RTCK? could be coincidence but we do get a blue light similar to bricking if we hold trackball so that might be correct. thats just an observation I made might be totally off.
[G1 Android Development] scholbert:
Hi BinaryDroid!

Do not mix the modes of JTAG interface, pretty sure QMAT uses ETM mode.

ETM gives access on ARM register set.

QMAT doesn't mention, because the platform will support ETM by default.

Many debugging solutions use this mode.

The mode pins, especially MODE_2, only need to be touched, if true boundary scan is needed.

E.g. the software package i left here is using boundary scan on S3C6400.

The idea was to adopt this piece of software to work on a MSM7201 in boundary scan mode.

Would you be so kind and tell me about the position of testpoints for PS_HOLD and MODE_2 ?

What's up with the pin description of primary port in your first post:

RTCK is already there....:confused:

ARM will need RTCK if highspeed debugging via ETM is used.

No need for this in slow boundary scan mode.

If yould help out in any way, tell me :rolleyes:

scholbert
[G1 Android Development] twoscoops:
For what it's worth, I tried again with 2.6V VTref with no success. Also, I tried when entering "blue LED" mode first, but that did not work either... More ideas?
[G1 Android Development] BinaryDroid:
Man i was up till 6am last night/dayish working on this, built 3 wigglers and the last one specifically for arm, did not work. what I meant about the RTCK was for the AUX JTAG port which I have not even touched yet due to how hard the pins are to get too and scattered they are to run wires out. theirs a hidden test point for RTCK thats used for the AUX_JTAG connector directly above and to the right of the trackball, thats what i referred to in last post. i left all my notes at home this morning so cant get a diagram until sometime tonight. the primary was going to be the main focus for me, gonna test my wiggler on another known PDA and make sure it works, if it does i'll attach wires to the AUX_JTAG and post the pinout, I just suck at taking pictures hehe. Sorry for my spelling i'm kinda sleep deprived. i'm not one to give up on things like this and basically have an entire lab at home so its hard NOT to want to do this stuff all night, i'm not gonna leave anyone hanging i just get out of work, just get right to it then get caught up till morning. Crap If I had a scanner I would just scan my notes. I'll at least post up the contol pin, PS_HOLD and MODE2 pin tonight.

EDIT: This is what i've been doing as a test, no power, then run scan Chain Analyzer which fails. blue led mode, scan chain, etc. All the Jtag tutorials i've read said to do that first, if that fails then something is wrong. is that a valid test to be doing in this situation? i'm still learning how JTAG works so I'm gonna get that info up asap so anyone with more knowledge can test also.
[G1 Android Development] tamerlan311:
Photo in high quality:
[G1 Android Development] BinaryDroid:
Can someone please get me a picture of both sides of the main PCB in as high quality as possible so I can label the pins like this one? I just got a new cam but have no idea how to use it to take clear pictures.
[G1 Android Development] freedroid:
I can see the arm9 (radio) cpu on the jtag chain :cool:

Programming the nand controller directly would probably kill my brain :D So my idea now is to load the kernel into the ram and somehow try to boot the usual way. But that needs to get the application arm11 cpu also on the chain.

@BinaryDroid If the images (zip) are not good enough, just say what you need. Waiting for the other pins now ;)

@scholbert you are absolutely right, the Vref must be 2.6V (+/-0.1). The standard wiggler likely wrecks the cpu. But with busdrivers like this http://focus.ti.com/docs/prod/folders/print/sn74avc4t245.html

or a couple of transistors it would certainly work (even without rtck if I use slow speed.)
[G1 Android Development] BinaryDroid:
What are you using as a JTAG interface? can you point me to a schematic that would work for this? also what software did you use? i would like to get my system jtag dongle going lol its driving me nuts,.
[G1 Android Development] scholbert:
Ups and downs

Hi!

That's great news!

Congratulation freedroid !!!

@BinaryDroid:

You may build a buffered adaptor from the schematic in the SFJ6400 package.

To verify the access you may try this software:

http://www.hjtag.com/

Works perfect for ARM9, though MSM7201 support is missing,it should read the ID-code.

Yesterday my device arrived :D

I had to take it apart imediately and also made some high-res pics from the main PCB. So far i did not include the testpoints we already know....

@ALL

!!! Need your help !!!

This is a bit of topic, but i got a serious problem with my hardware :(.

The device refuses to load the battery. All other functions look O.K.

After disassemble the device i noticed some tiny SMD parts were broken.

Maybe this could be the reason for the malfunction. Not sure though.

Anyway would be awesome if someone could do some measurements on the mainboard to identify the part that got totally ripped.

Please, if you're doing further experiments take out your multimeter and measure the voltage levels at the marked points in the picture attached.

Perhaps there's also some number code on this tiny part.....

Would be really awesome if someone could help me out on this issue!!!

Feel free to modify the pix!

Cheers,

scholbert
[G1 Android Development] twoscoops:
Can you elaborate on how you acheived this? I have the segger jflash-arm and the QMAT-JTAG software. I can't even get the IDCODE response when I hook up to the six pins that have been identified (with 2.6V supplied to VTref).

Did you reconnect the PCB to the rest of the phone hardware? did you connect the battery?
[G1 Android Development] BinaryDroid:
Not sure about him but i've tried it both ways, from what i've been reading it can be done with the board alone in a simple jig.

i'm powering it with an adjustable power supply at 2.6v to Vref but nothing works for me.

i built the buffered jtag(number 4) and still get nothing, i'm starting to think the cable I purchased from ebay is bad. it was a male-male cable but i made an adapter for it but still no go, possible its inverted or not all connections are their. thats my next test, its driving me nuts not having a working jtag board considering how simple they are to make. going to be a pain to test with no cable. checked my Bios settings, 4 different JTAG shematics and still nothing, openocd does not work, jtag tools. both windows and linux and nothing, Even tried getting ID from a WRT router but that also failed. i am not giving up, just really frustrated.

I got some high res pictures in PM(thanks Temp) and am labeling them right now. should have them up soon.
[G1 Android Development] freedroid:
Let's Begin

IMO you can forget qmat. What ever the author claims, I tested many versions, updates, revorks, redesigns, ... unfortunately It was always broken.

OMG, are you serious?

@BinaryDroid we made 2 sets of excelent motherboard pictures for you, what's now stoping you labeling the pins for us?

@scholbert The schematic is not designed for 2.6V logic levels, that won't work ...

I don't have much time. A friend of mine brought me his bricked device (so I am at least a bit more motivated :) and I can compare his bricked and my nonbricked G1.

:cool: I started tweaking the arm9 support in openocd. For now I am trying to make the famous "hello register". Some setup infos can be found by openmoko http://wiki.openmoko.org/wiki/OpenOCD

stay tuned :p
[G1 Android Development] freedroid:
Sure, it must be conected and the batrery must be in. Elsewhere you won't be able to switch the phone on ...

Take a look at my pictures. I marked the Vref on the Board. That and GND must be connected to the jtag device.

You need osciloscope or alt least voltmeter to check the wires. afaik WRT have 3.3V, that theoreticaly could work.

That would be great. I see on the serial terminal, that the phone is crashing just before it tries to start the linux kernel. Maybe it could help if the arm11 core could be jtag-accesible. Thanks.
[G1 Android Development] scholbert:
Hi freedroid!

Uuuups, you're right.... i'm sorry :o

We need true level converters like you already pointed at.

Though my time is very limited right now, i will modify the schematic to build a simple LPT adaptor and post it as soon as possible. Maybe external 5V supply is necessary to push the levels for LPT.

Perhaps a USB adaptor would be a better choice.

Concerning H-JTAG:

The latest version does not support LPT anymore.

E.g. H-JTAG V0.9.2 could be set up to work with nearly any LPT-configuration.

BTW, i'll get another damaged device the next days.

Hopefully the SMD parts are o.k. on this board.

If that's the case i will resolder them to get a fully working device.

The rest of this hardware will be used for academic research :D

In the meantime i was able to identify the charging circuit as well... if someone is interested, look here:

http://datasheets.maxim-ic.com/en/ds/MAX8600A.pdf

EDIT:

Just found a datasheet of a Samsung MCP.

The device's capacity is just a bit smaller, but it is very similar to the one that is used on Dream.

I thought it could be useful to give a better understanding of the NAND addressing scheme.

Enjoy!

Best regards,

scholbert
[G1 Android Development] halfsight:
Hey Binarydroid. I bricked my first g1 one today. Fully bricked. won't even turn on. it's yours if you want it. just pm me you addy. had to give up mine to make up for it. getting a different one tonite. it is sad. out of about 15 androids this is the only one i have bricked. Not sure what happened. It is likely that the MoBo is fried. But I am no hardware guy. So. i will send you this bricked phone if you want it. no battery, i want to keep that. But you can have the phone.:o
[G1 Android Development] scholbert:
Hi!

I did short review of the TTL families and had a look into IEEE-1284 (LPT-specs) again.

The minimum high level at LPT should be 2.4V (it's true TTL) so operating with the logik at 2.6V should be O.K.

The driver itself, a LVC type, operates down to 1.65V.

The limit of the supply voltage is high level at LPT though.

So 2.6V Vref is just the limit for these kind of adaptors i suppose.

I made a schematic for a simple LPT adaptor some time ago.

This one was used for JTAG on HTC Hermes.

To test the connection to ARM9 you may use the H-JTAG software.

As already mentioned the interface is fully configurable.

See the attached picture for the LPT settings according to the schematic.

Check it out :D

EDIT:

@BinaryDroid:

Any news on tracing one of the mode pins?

Would be very intersting to activate the boundary scan mode for some experiments!!

In the meantime i started to modify the SJF package to work for MSM720x.

BTW i think freedroid is absolutely right...

Why don't you grab the pix we already posted. It's no big deal.

scholbert
[G1 Android Development] skweints:
Hey Guys, definitely not trying to hijack this thread. I'm excited for you all being this close to getting the JTAG set up to work on the G1. Congrats! However, I've been looking and looking for the same kind of thread for the MyTouch 3G, and haven't found crap. Unless you know something I don't, let me know.

Anyways, I managed to semi-brick my device (MyTouch 3G), and have had no success at all trying to get it to boot/flash/do SOMETHING other than turn on. I've spent close to 30 minutes with fastboot at <waiting for device> and plugging and unplugging the USB cable. I took the thing apart to see if there was an easily identifiable pin layout like on the G1 for JTAG inputs, so the warrenty is void. I can't find any busted up MyTouch 3G's at all.

In other words, after your success with the G1, if you wanna attack the MyTouch 3G, I would gladly donate my phone to anyone who A) knows what they're doing and B) would actually want to try achieve the same with the MyTouch. Feel free to PM me if you're interested. :-)

Good luck!
[G1 Android Development] lbcoder:
Being an extremely similar device, it [should] be [almost] exactly the same procedure -- just need to trace the board for the contact points.
[G1 Android Development] BinaryDroid:
Yep Its based on the same chipsets so it should be similar except the memory layouts and position of contact points. I wouldnt mind yanking the CPU and tracing the pinout to the right places, but that would be the extent of what I'd be able to do since i'm just learning JTAG after years of trouble understanding.

Sorry about taking so long guys, i've been busy with work and tackling why none of my JTAG adapters have worked on anything at all. can someone tell me if the ground connection is required for doing the ID code scan test on a WRT router, FTA box, Netgear router, G1, or basically anything? My Parport Extension cable is Male-Male with all pins straight through, male-female converter, then to my JTAG adapter, I built a bunch and none seem to work no matter what I try or what I try on. Do you think the Ground connection that screws into the pc tower and JTAG port is causing the issue? after testing all pins that is the only one not going straight through the cable.

Also lbcoder, i have many many ic chips here but not exact one you are using like I did for other schematics i followed. Would the LCX245(SMD package) work as a substitute for your LVC? datasheet says it has similar specs but can you just verify it before I get home to build the one you have listed? Also have LCX244, 74hc244 and a few other line drivers that most of the diagrams called for.

I have most of the mode pins except for mode 3 which i'm still tracing. PS_HOLD, Watchdog, Resin_N, VDD_P4(only traced since it was listed under the JTAG diagram in datasheet in case it was needed)

Here is something I just found this morning, the ribbon cable leading up to the LED is connected to VDD_Efuse_Prog pin of CPU, not sure if it means anything just posting my findings.

EDIT: I meant is the Outer shell ground required for operation, not the ground pin in the DB9 connector
[G1 Android Development] ezterry:
?? The method ought to work on any G1/Magic; (particularly soft-loading an SPL) and I already provided memory offsets to common radios.. (of course the Magic users are still searching for the jtag points)

Also based off jockyw2001's post I've tested flashing a radio in a locked oemspl via the following:

just load a G1/dream radio.img to 0x103B5300

then in oemspl run: 'radata 103B5300 01500000'

(0x01500000 ought to be the size of the radio image .. but if the image file you loaded is a different size update accordingly)

Now if you have another complication such as oemspl is not even running.. or can't enter blue light mode.. or jtag is not responding [while in blue light mode]... this indicates something more significant happened to your hardware. And yes we may not be able to de-brick.

So if you are looking for help debricking.. we may be able to help but need details of what you are debricking.. If you want to find me alternative points to attach jtag adapters when a testpoint has been broken by a clumsy person with a soldering iron.. I'd be happy to accept such information as well.
[G1 Android Development] ulissescg:
Hi Ezterry

Thanks for your comments... at this time I did not worked on my bricked phone yet , i will make the Serial Cable and solder the jtag wires to the Main board ( i hope during this week), then i will see if what you did, i can do on my phone... by the way, on my Phone, the Blue light mode is working, then i hope i can connect it.... the reason i get a bricked phone it was because i updated the SPL and not the Radio ( i don’t remember what version, anyway I have bricked one )...

And i have a T-Mobile (Bricked) and a DEV1

Originally I get these two phones because I’m working to develop a MANET on those ones but now I have just one, anyway….

Thanks
[G1 Android Development] jockyw2001:
ezterry: good work doing the radata test :)

Please give me a link to the radio.img you flashed. I will then determine which sdram areas can be written to and make a few modifications and ask you to flash it on your jtagged device. There is still a small chance unbricking by sw.
[G1 Android Development] ezterry:
The radio I'm working with is: http://briancrook.ca/magic/rogers/dream_update/radio-3.22.26.17_dream.img

my modifications 1st gave checksum error.. when that was fixed gave a signature error.. so good luck

(Also the 0x103B5300 region is a large block according to the SPL; meaing it is likely the main ram.. this can hold the full 100MB nbh for the dream; and the radio was loaded via jtag)
[G1 Android Development] igord:
One question jocky, do you want to write some kind of sspl to ram?
[G1 Android Development] keithsipa:
Someone send this man a dead Magic...
[G1 Android Development] igord:
And maybe someone can try this,

http://xdaforums.com/showthread.php?p=5169318
[G1 Android Development] bart9984:
About NVitems.

I was looking at a backup of nvitems of the magic I have using QPST tool.

I found two interesting items:

item 4191 named NV_LOCK_CODE_EXT_DIGITS_I value:

0x31 0x31 0x31 0x31 0x31 0x31 0x31 0x31 0x00 0x00 ....0x00

0x31..0x31=11111111 that seems to be the cid value needed to have a security unlocked device

Second item is number 4160: NV_LOCK_CODE_EXT value:

0x10 0x00 0x7e(?) 0x00 ... 0x00

I've tried to change theese items in two ways:

Editing the backup and using the "restore" function of QPST but with no success, it seems to write only the items concerning RF.

Using qmat/psas instead I'm able to change thoose values, but when rebooting the device they change back to original values.... also after a warm reboot. Maybe it's a blind alley...

Sya,

bart99
[G1 Android Development] LeonardoFloripa:
One question to ezterry

How would one apply the knowledge in this thread in the case of the death SPL (haykuro) generated brick?
[G1 Android Development] ezterry:
I'm not so sure its as much the fault of the haykuro SPL as the method radios and spls are flashed from the update zip files.

A death spl type brick is where the SPL thinks it needs to boot in boot mode 3 (boot to recovery..)

The problem happens when the change in the SPL or Radio makes the recovery unable to boot (for example Rogers phones this is usually happens when switching between ebi1 to ebi0 radios that map the linux boot offset to different locations)

Unfortunately there is no exit from this as it ignores the fact you are holding the camera key to enter the spl hboot screen. So the classic symptom is the phone being stuck on the splash screen unable to enter boot/recovery/fastboot/hboot

However if you look at the way I broke out of the Rogers SPL by softbooting the 2005 spl.. you can use that to get out of any brick where blue light mode works. (As it does not require anything from the SPL in flash.. in fact that process modifies the rom not to load the spl.
[G1 Android Development] LeonardoFloripa:
Well...

... in my case the Blue Led mode works.

I was using the The Dude's ROM and tried Haykuro's SPL...

So, there's hope for me, right ?

:rolleyes:
[G1 Android Development] lbcoder:
THAT'S THE MISSING LINK!!!! :eek:

It explains (partially) the deathSPL bricks that happened from ***compatible*** radios!

Get it stuck in boot mode 3 with CHANGED PARTITION MAPPING (and/or incompatible recovery kernel) == brick!

It also introduces the possibility that *maybe* 1.x radios **ARE** or **CAN BE** compatible...

Is there any way to trigger an spl boot from bluelight mode with just a serial connection? Is there any way to ensure that the *next* reboot will go straight to FASTBOOT rather than recovery? I.e. there is the "reboot bootloader" command, which ensures that next reboot will be to fastboot... whereas "reboot recovery" puts it in boot mode 3....

Could the solution to never bricking on deathspl be as simple as using a "reboot bootloader" right after writing it?
[G1 Android Development] ngtfr:
no more news about this subject?
[G1 Android Development] ezterry:
... yes (glares at his original phone's main board..)

Very likely as my first restored brick was on the 1.x radio as I ran fastboot to re-flash a working system

yes if your phone is CID unlocked... All the work to jtag the phone to flip temporarily a silly flag so the phone can reflash its self; Even the softboot of the SPL is possible with the unlocked commands; just needs a simple loader script (unless you like manually entering binary files into a serial line :p )

hrm.. not sure exactly how recovery flashes SPLs/Radios..

certantly it is much less likely to brick using 'fastboot flash hboot hboot.img' and 'fastboot flash radio radio.img' instead of the SPLs...

Two things on my hack todo list:

1) create [unsigned] nbh files to switch between radio/spl stacks since that works via fastboot *or* dreaimg.nbh thus by flashing one nbh you can safely switch between 2x, 3x, ect then you can just run 'fastboot flash nbh danger2x.nbh' or 'fastboot flash nbh danger3x.nbh' and have the correct radio+spl+ra recovery

(of course this requires you to already have an S-Off SPL)

2) tweek the 2005 spl to have an exit on boot mode 3... a good thing to try with jtag on the ready ;)

What sub-subject are you interested in?
[G1 Android Development] gymmy:
well i can write a python or C script/code if someone tells me what commands to use on the phone ?

It would be cool to find a way to do this. I Have a bricked magic stuck in mode 3. I can also reveng if needed I currently reveng ATT and x86 , where is a good resource for the ARM9 ?

G