yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] lbcoder:
I seem to have hit edit instead of reply....

Experiment for you ezterry (since you have the jtag and serial set up and working):

fastboot flash 1.33.2005-SPL.img

fastboot flash 1.something-RADIO.img

fastboot reboot-bootloader

Theory: This should work since it is being forced into fastboot.

Still poses some risk in case of power failure or crash BETWEEN flashing the radio and rebooting.

More:

Memory mapping, partitions, etc.:

So we know that at the beginning of the memory lies the radio and SPL, following that, are the splash1, recovery, boot, system, data, and cache partitions (in no particular order).

What we know about yaffs2 filesystem is that a freshly formatted yaffs2 filesystem is essentially a bunch of zeros.

We also know that with a BLANK boot and recovery partition, that the device *should* just automatically boot into fastboot.

With a brick, it doesn't. Theory: because it isn't blank -- but being remapped, it isn't "right", so it won't boot.

SO....

Step 1: zero out ALL partitions, obviously with the exception of radio and SPL. This is for security -- to hopefully force the thing into fastboot *no matter what*...

Step 2: fastboot in preferred radio and spl

Step 3: reboot -- by red-home-green, power loss, fastboot reboot (not fastboot reboot-bootloader).

Hopefully the thing will, whichever reboot mechanism is selected, go into fastboot.

Step 4: fastboot flash preferred recovery.img

Does it work?
[G1 Android Development] lbcoder:
I would like to suggest a serious design flaw in all SPL versions; that the device can be put into boot mode 3 via non-volatile code. It obviously should be allowed to enter recovery through boot-time "home+power", but by NO OTHER MECHANISM. The problem with this boot mode is the possibility of being stuck in boot mode 3 with an unbootable recovery. I believe that solving this design flaw should be the first priority. I believe that any "fixed" SPL without this flaw will be virtually unbrickable (aside from the obvious unsuccessful flash possibility).
[G1 Android Development] ezterry:
the 1.33.2005 SPL + 1.22.12.29 radio seems fine (can't say I've made it boot a system.. but was able to switch too it and back w/o resorting to the jtag adapter

Its not that simple.. here is what is happening (just spotted the code I thought might exist:

recovery zip files flash as follows:

1) user space flash (anything in system/boot/recovery/userdata/cache)

2) hboot/radio flash; here it saves the boot mode to either "update-radio";"update-hboot"; and the radio/hboot to flash to the Cache partition

3) saves result to the Misc partition; and updates it to "boot-recovery"

"boot-recovery" is what sets boot mode 3.. via reading misc (so if we break boot mode 3 we break "reboot recovery")

I just think we need to update Misc to something other than "boot-recovery" before actually booting recovery... so that if recovery fails we return to a working state..
[G1 Android Development] scholbert:
Hey ezterry,

nice experiment ...

Seems we're getting closer everyday to prevent bricks :D.

Apart from that, there's something that i'm still confused about:

Everyone is speaking about different ROM layouts, i've also searched the forum for a while.

It's obvious that there's basically two kind of firmware layouts:

EBI0 (G1,MT3G)

EBI1 (G1Rogers,Magic)

Who ever created this naming conventions, i can't find useful information what's really behind it.

Maybe it's time to clear things up, from a more technical point of view.

So what do we really know about EBI0/1 ROMs ?

Could be missleading or completely irrelevant, but this is what i know about EBI's from the hardware point of view:

- on an ARM SoC EBI stands for External Bus Interface

- EBI port is used to connect to memory and/or bus peripherals

- MSM chipset got two EBI ports (EBI1 & EBI2)

- SDRAM is connected to EBI1, NAND is connected to EBI2

- Dream hardware is capable to use 8Bit I/O or 16bit I/O NAND devices

- EBI setup (timing, offset, etc.) should be done in bootcode

I don't want to mix things up, but i wonder if there's any relation to this.

I also wonder if there are different mainboard revisions e.g. Rogers Dream vs. T-MOB G1.

Anyone got some more information about the different ROM layouts?

Would be nice to lift the secret behind EBI0/1 ROMs :rolleyes:

Regards,

scholbert
[G1 Android Development] lbcoder:
Awesome. Theory confirmed!

What would be the problem caused by breaking "reboot recovery"? (edit: nevermind... failure to flash stage 2).

Alternatively, making it ACCEPT the camera-power into fastboot DESPITE being stuck in "boot-recovery" would also be acceptable. Is there any way we can just add a check-camera-button while it is trying to go into "reboot recovery"?

where find

if (misc/boot3){

...

}

change to

if (misc/boot3 && !cameraButtonPressed){

...

}
[G1 Android Development] lbcoder:
I believe that we now have a more-or-less PROVEN method of preventing bricks with DeathSPL -- write it using fastboot, and fastboot reboot-bootloader following writing the SPL. By ezterry's results, we know that the radio/spl combination is NOT the cause of bricks. At least not directly. As long as it doesn't get stuck in a boot mode that can't boot, we're good.

Also, from what I can tell, it does NOT appear that there is a fastboot command with the potential to get the thing into boot-recovery mode... which means that it is unlikely that a brick can be created accidentally with fastboot.
[G1 Android Development] ezterry:
Hopefully; its much nicer to have working devices.

As for your confusion, its not that complicated; however there is much confusion out there

EBI0 = 2x radio max 128MB OS addressable ram? (196 total)

EBI1 = 3x radio max 256MB OS addressable ram? (288 total)

The G1 has (both rogers and tmobile) of course has only about 100MB of actual ram for linux so the extra support doesn't mean much. The 32a? Magics however have the additional ram thus need the 3x radio.

I think rogers is on the 3x radio for the dream to simplify the rom customization for the initial release of both phones. Also they may have tweaked the radio to work smoother on the network; however the 2x radio will work with 3g on the rogers network when they are not trying to lock down phones..

As for the ebi1 name its simply the build variable required to change the kernel from one for a 2x radio to a 3x radio:

CONFIG_MSM_AMSS_SUPPORT_256MB_EBI1=y

There are physical differences in the rogers/tmobile phones mostly related to the flash chip is a different brand, and most important is using different 3g frequencies.. but this seems abstracted away in the firmware such that both tmobile g1s and rogers g1s run both the ebi1/ebi2 software stacks so long as you avoid getting stuck at boot mode 3 :)
[G1 Android Development] scholbert:
Thanks for clearing the confusion....

O.K. nice hint...

Seems that setting this variable changes the memory mapping in any way.

I will have a look into the kernel ;)

BTW, see attachment for default mapping, maybe helpful for someone (though it's a MSM7200)

Cheers,

scholbert
[G1 Android Development] ezterry:
even easier since its "update-hboot" and "update-radio" boot modes that set the boot recovery model, not the fastboot flash of a radio. So while no harm in rebooting to the bootloader if forgotten camera+power will work

Let's just leave it at not quite that simple.. in part since I have not found readkeyboard()
[G1 Android Development] lbcoder:
Yeah, figured.

Yeah, that would be a useful function....

But wouldn't it be more like getgpio()?
[G1 Android Development] ezterry:
whatever the correct library name.. it's the function at 0x980xxxxx

(I've never used getgpio.. but yes prob is what it is.. still have not found it quite yet)
[G1 Android Development] captinamerica:
Would this JTAG hook up work for this unbrick procedure? If so do you know where he bought these boards from?

http://www.youtube.com/watch?v=eITMEEF_AIc
[G1 Android Development] elektrownik:
This shop is in Poland (http://www.multi-com.pl/), you need: http://www.multi-com.pl/index.php/pl_PL,browse,id_gr,1307,menu_mode,categories.html and this http://www.multi-com.pl/index.php/pl_PL,details,id_pr,6503,menu_mode,categories.html but it is around 300$ :p
[G1 Android Development] lbcoder:
$300 is a little overboard.... especially when you can do the job for about $2.
[G1 Android Development] elektrownik:
I know, but it is not for single user it is for service centers..., good thing is that there is one expensive tool and cheap adapters for other phones...
[G1 Android Development] ezterry:
Also the ort seems not to be a good tool for general purpose hacking.. or a good adapter if you just want a generic arm jtag adapter tomorrow. (or with a bit of poking other processors) thus really only useful if you have a {small} mountain of bricked cell phones.
[G1 Android Development] scholbert:
YAWC - yet another wiggler clone

Hi!

Just finished a slightly modded schematic to fit the wiggler LPT pinout.

This one is also capable of handling the low voltage levels of HTC Dream JTAG port.

Have fun!

Regards,

scholbert
[G1 Android Development] xaueious:
The solderless board he used seemed like a reasonable investment if it works with other JTAG devices. 15 euros

http://www.multi-com.pl/index.php/pl_PL,browse,id_gr,1307,menu_mode,categories.html

Maybe something similar can be found.

I noticed that the video shows some sort of power connection to the JTAG board as well?
[G1 Android Development] igord:
Yes, jtag needs external power supply. Usually 3.3v-5v
[G1 Android Development] ezterry:
The video is powering the device with an external power supply instead of the battery; not the jtag..

the jtag is pulling vref 2.6V +/- 0.1V from the phone.

I don't seem to have a power source strong enough for the initial boot of the phone; thus always power via the battery; adding USB occasionally.. (however blue light mode does not like when the device is charging...)

(On a side note that board in the video would be much more useful if it had the gold pins on the other side of the main board .... use a ribbon cable or something to allow them to go from the side with the test points to the other side of the board)

xaueious:

Check the shipping price.. it was less this last week than the week before.. but it significantly changes the value of what you are investing in.
[G1 Android Development] igord:
I used wiggler(diy version) on htc hurricane, and it wont work without external power

Off:

Anyone had luck finding pinouts for magic?
[G1 Android Development] xaueious:
That sounds like an investment of no more than $70 total, which seems reasonable for someone who doesn't have soldering experience. The circuit does seem quite a bit more simple than the wiggler posted though...

So if I buy the ARM-USB-TINY with the Jtag board, I shouldn't need anything more hardware to complete my jtag provided that use the battery as my source of power? Plus it would be reusable?

Sorry for being a complete noob about this stuff.
[G1 Android Development] ezterry:
I power the Dream Jtag externally myself.. but we do know of a 2.6v test pin that can be used

$20.32US for the board

$59.76US to ship to canada

USD->CAD is nearly at par at the moment

I don't know.. given how picky the phone with jtag+blue light mode sometimes is you may need someone else to hold the battery in place and the phone nearly fully attached in pieces all over a table..

I'm a bit scared that they had the camera on the computer screen not the board while turning on the phone... I'm sure it can be made to work but it may turn out easier to solder to the board with a crappy $30 soldering iron..

As for reusable .. probably if you don't break it along with a motherboard in frustration of it not working :p
[G1 Android Development] G1Hope:
Duct/electrical tape? You should be able to send the CPU a reset so no need to pull the battery in and out.
[G1 Android Development] ezterry:
The problem with electrical tape was the battery is a bit spring loaded ... you need some force pressing towards the main board.. I've sorta succeeded with a rubber band and some tape on my day to day phone.

Also you do need battery pulls.. particularly after the CPU kicks us out of jtag when AMSS starts. And if you know a way around the blackout (maybe a transistor we can remove) I'm all ears..

But for the rogers rom (SPL soft load) hack its actually best to terminate (control-c) openocd after the resume and before sending cego on the serial line..

if everything was done right..fastboot mode will be entered (as indicated on the likely unplugged screen and the serial output); swap the serial cable for the USB cable and flash the SPL permanent.. at which point you are effectively free.
[G1 Android Development] Daemonic79:
Hiya,

I have a UK T-Mobile G1, which has the rootable RC7 firmware (and its associated radio) installed, due to my tiredness i flashed the haykuro/danger spl before i flashed the updated radio (ive flashed many times before, so this was a stupid mistake on my part). The phone will obviously not boot now, but i can still get to blue led mode.

So im curently on HBOOT 1.33.2005 and RADIO 1.22.12.29 from what i have figured out?

After reading through all 42 pages, id just like to confirm the procedure, so can someone give me a cpl of pointers on what software/hardware i will need?

From what i can make out, i need;

Software

OpenOCD (I have downloaded the 0.4.0 snapshot)

Andriod SDK for fastboot (I have this also)

fastboot (I have this also)

radio.img, hboot.img, recovery.img (Where do i find these, and what versions would i want?)

Hardware

G1 Serial (Ill need to wait for stock of the HTC EXTUSB breakout)

JTAG (I intend to use the ORT adaptor to save soldering to the board, but what else do i need for this?)

Once i have the eqiupment is it as simple as following exterry's abbreviated instructions?
[G1 Android Development] ezterry:
SPL (hboot.img)

most of my instructions assume danger spl..

Download the zip.. unzip it.. and you have hboot.img:

http://sapphire-port-dream.googlecode.com/files/spl-signed.zip

Radio.. whatever radio you wish to use..

but for 2.22.19.26I go to http://sapphire-port-dream.googlecode.com/files/ota-radio-2_22_19_26I.zip

Download the zip, unzip it, and you will find radio.img

for 3.22.26.17 get it from http://briancrook.ca/magic/rogers/dream_update/radio-3.22.26.17_dream.img

(T-Mobile phones usually use the 2x radio.. if you use the 3x you get to pretend you have a rooted rogers phone when following future instuctions.. or risk bricking again :p both ought to work fine)

Recovery

... RA recovery as usual?

http://xdaforums.com/showthread.php?t=566669

Use the -R versions if you use the 3x radio.. otherwise pick a color and download it

This just a standard unlocked stack you have probably seen all these file mentioned before.

If you are purcahsing the actual ORT.. my solution wont help you.. if you are just getting the JTAG adapter board which is intended for ORT.. that is just something that might help you do this w/o soldering.. but you will still need the jtag adapter.

I have the config file for ARM-USB-OCD linked to in the SPL softboot instructions:

http://xdaforums.com/showpost.php?p=5934885&postcount=6

If you are using another adapter just remove the first 10lines (the ARM-USB-OCD inteface settings) and replace with the interface settings for your openocd compatible Jtag adapter (see share/openocd/scripts/interface/ from your openocd installation)

You can follow those you just will need to cross reference my other de-brick post for the correct offsets for your current radio

(That way you don't have to worry about what spl is in flash.. if the offsets don't work you can also flash the radio via jtag.. I posted a valid offset and radata command to send to the phone a few pages back...)

for extra credit you can also start a wiki page in http://wiki.xda-developers.com/

PS..

you may be interested in this discussion for future flashing of SPLs: http://xdaforums.com/showthread.php?t=655097

(I strongly recommend never to flash the SPL/Radio via recovery unless there is no other way.. ie. needing to remove a perfected SPL)
[G1 Android Development] sucka:
So, did anyone try this method using just a serial adapter on usb? wow, if it works i'l build one right now :D
[G1 Android Development] ezterry:
What method please let us know, and how does it work?
[G1 Android Development] sucka:
Well i hear some it doesn't work, some that it works, or some that can make a fusebit hack for security and using a normal extusb to serial, or to rs232adapter and doing all this like on jtag pins method. But don't know, i wanna try things to flash it, don't want to give 30% of its price on a silly thing like this.
[G1 Android Development] lbcoder:
What part of "you can build a jtag adapter for $2" don't you understand?
[G1 Android Development] 3izz:
my bricked magic is detected !

hi after i lost hope i tried to connect my magic 32a with completely empty battery in win XP and it's detected as unknown device and not accepting the htc driver that comes with the sync tool !! we should force flashing dead usb when it's first detected ?? is there anyway ? Please help me XDATERRY :eek::eek::eek::eek::eek::eek::eek:
[G1 Android Development] crackmunky:
I’m sorry for my unknowing but I’ve been following this thread for a few weeks, daily now and I’m confused. Has anyone actually compiled a 'shopping list' of the items required for ezterry's method of de-bricking? Is it a shopping list that in total would cost more, or equal to a new phone?

Once again sorry if my question has previously been answered.
[G1 Android Development] lbcoder:
Again, for all the newbs.

$2.

Is that more or equal to the cost of a new phone?

READ THE THREAD.

Everything you need IS HERE.
[G1 Android Development] LeonardoFloripa:
lbcoder...

.. answer the question or shut up. If you've born a all-knowing demigod, lucky you.

I would like to get a shopping list too to make this magic (pun intended :D ).
[G1 Android Development] goldenarmZ:
I wish it were that simple.. In the US and Canada you seem to have really good electronic suppliers, but over here I have an absolute nightmare just trying to get hold of a certain type of transistor. If I walked into my local "component supplier" and asked for an N-Channel JFET, they would look at me like I'd strolled in and slapped my balls out on the desk.
[G1 Android Development] Sleeepy2:
Ahh the dreaded ball slap. It'll get you every time.
[G1 Android Development] lbcoder:
Why should I spend my time writing up a list for YOU when all you need to do is ditch the LAZY and read the thread for ALL the info you need?
[G1 Android Development] lbcoder:
No weird transistors. Just need a 74x244.

edit: you might even have a suitable one -- just look at all the chips on all your used worthless junk. Admit it, we ALL have a few boxes of this kind of stuff... ;)
[G1 Android Development] 3izz:
finally they have found the magic's pinout

good news for all of the owners of bricked magic devices 32a

in the official omnia repair tool (ort-JTAG_)

http://www.omnia-repair.com/forum/topic/htc-g2-32a-jtag-pinout

Now C'mon Xdaterry show us the real MAGIc to revive this phone
[G1 Android Development] anthonws:
+ 1 :)

Thanks
[G1 Android Development] bart9984:
that's amazing,

finally also the magic pin-outs are know.

My only problem is that 5 of 6 pins are under a piece of transparent glue, they have used it to avoid jtag use? I need a safe way to remove it or I'll try to use an hot needle to pass trough it and reach the contacts... But atm I'm away from home, so until next week I can't do nothing.

bart99
[G1 Android Development] scholbert:
Wow, that's great news...

It's nice to see some knowledge reflow ;)

AFAIK it should be the same procedure for the G2 models.

The most important thing would be to use the correct offset address for the patch.

These depend on the radio version flashed on the device.

@bart9984:

Yeah i see, seems that they scrapped it away very carefully.

I guess the easiest way would be using a thin soldering iron to do so. From my experience this glue is getting weak, if heated.

Regards,

scholbert
[G1 Android Development] ezterry:
Same process.. I even have some compatible radios listed; only magic I see is getting something soldered to those points...

Otherwise I don't have a magic.

The 3x radio works on the Magic:

Just flash it first as per my post

in openocd:

load_image <path_to/[URL=http://briancrook.ca/magic/rogers/dream_update/radio-3.22.26.17_dream.img]radio-3.22.26.17_dream.img[/URL] 0x103B5300

Then over serial call 'radata 103B5300 01500000'

ought to flash 3.22.26.17 (dream/magic radio) from any current radio.

Then after powerdown/reboot you can follow my softload SPL instructions offsets will be correct.

Note I think you need a different ra recovery

http://xdaforums.com/showpost.php?p=4029315&postcount=1

H version I believe..
[G1 Android Development] anthonws:
@ezterry

Thanks for the info!

Anthon.
[G1 Android Development] igord:
Glue can be removed with WD40, small amount...
[G1 Android Development] lbcoder:
That is an extremely inaccurate statement.

wd40 (or any other organic solvent like gasoline or paint thinner) will NOT remove glue. It'll remove the GOO from something like tape, but not any kind of glue.
[G1 Android Development] igord:
It helped me with resin around cpu, when reworking, so it should help. Or just use hot air station
[G1 Android Development] Aaron!:
Is anybody working on this idea? Resetting the flag via just a serial connection?
[G1 Android Development] ulissescg:
pcb for tracking traces

Guys, i have being working with the jtag and serial usb for a time and i have connected successfully with the Segger jtag but unfortunately I have damage my Board, I have connected directly to the USB RX/TX without using the USB type Connector, then yesterday I was looking in to the Auxiliar jtag pinout but I just found that not all of the pins were located yet, then I desided to unmount all the parts from my board and start looking in to the PCB traces but I did not have the Datasheet for the Main IC, then I’m attaching a picture of the Board for you and if somebody can use it for trace the lines of also to use alternate PAD areas or components where you can also connect to the same nets, if you have lifted the test point pads this will help you, now if someone need to find some trace routes please let me know and I will check where are they connected. If someone can let me know to what pins the jtag traces will go I will try to find the proper area to connect it….. if someone wants to donate a bricked phone I will appreciate it because I have all the tools ready….

Later I will upload some x-ray pictures of the board and also for the USB PCB…

http://www.box.net/shared/eevzbv0xps

http://www.box.net/shared/0fru3jq77t

http://www.box.net/shared/ocivmzn7li

http://www.box.net/shared/af1flp97c5

Thanks

Ulisses
[G1 Android Development] ulissescg:
USB Board.....
[G1 Android Development] shawe_ewahs:
Anyone knows if this methods works on HTC Magic 32b?

Or use this board for JTAG http://www.multi-com.pl/index.php/pl_PL,browse,id_gr,1307,menu_mode,categories.html to solder in this board and not in the board of the phone and don't need the Omnia Repair Tool?