[G1 Android Development] bart9984:
another SUCCESS magic 32a debricked using jtag

Hi all,

finally I was able to debrick my magic 32A using jtag and ezterry's method :D

so here is a detailed list of what I did:

with a needle i carefully removed some glue on jtag pins

I soldered the wires to the board according to the site posted some time ago by 3izz (http://www.omnia-repair.com/forum/topic/htc-g2-32a-jtag-pinout)

Since I used Olimex ARM-USB-OCD which works by default to 6MHz I didn't attached the rtck pin. Pins are really closed one to another and I had some problems loosing also a little capacitors near TDO :eek: (I'm not a solder freak)

I've used the LM317 voltage regulator scheme posted by ezterry (http://i43.tinypic.com/124k7sk.png) and a usb cable to grab 5v to obtain vref=2.6V

Installed on my ubuntu 9.10 openOCD 0.4.0 with libftdi support enabled

Attached the serial cable and entered blue light mode (trackball+power)

Now to let openocd to detect target I had to connect also the serial +5v voltage, if not I had a "FAILED: all ones" error by openocd. After openocd started i removed the +5v connection because with it attached I can't write to serial console (maybe is only a problem of mine and not general)

So I connected with two terminals to serial console and to openocd via telnet

.

then the list of commands I used to restore spl+recovery. On my phone there was installed the radio version 3.22.20.17 so this offset works with this radio for sure, for other radio versions see ezterry posts

in openocd:

[COLOR="DimGray"]bart99@bart99-laptop:~/workspace/Prova$ telnet 127.0.0.1 4444
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> [COLOR="RoyalBlue"]halt[/COLOR]
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600000d3 pc: 0x0090d1fc
MMU: disabled, D-Cache: disabled, I-Cache: disabled
[/COLOR]
>[COLOR="RoyalBlue"]mww 0x9038f0 0xea000013[/COLOR]
> [COLOR="RoyalBlue"]bp 0x902b30 0x4[/COLOR]
[COLOR="DimGray"]breakpoint set at 0x00902b30[/COLOR]
> [COLOR="RoyalBlue"]resume[/COLOR]

mww 0x9038f0 0xea000013 is to bypass CID restriction and gain access to other oeamsbl commands

bp 0x902b30 0x4 sets a breakpoint to cego command in oemsbl

then in serial console ( typing "?" now returned a list of supported commands)

typed cego to load and start spl manually

again in openocd

[COLOR="DimGray"]
target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
cpsr: 0x400000d3 pc: 0x00902b30
MMU: disabled, D-Cache: disabled, I-Cache: disabled
[/COLOR]
> [COLOR="RoyalBlue"]rbp 0x902b30[/COLOR]
> [COLOR="RoyalBlue"]mww 0x00000c0c 0x98000c4c[/COLOR]
> [COLOR="RoyalBlue"]resume[/COLOR]

rbp 0x902b30 remove bp setted before

mww 0x00000c0c 0x98000c4c force spl to enter fastboot mode. This commands work only for some spl like 2005SPL, for others the offset table could change as saied before by ezterry.

Then I disconnected serial and connected usb, the screen showed fastboot message so I used fastboot to flash spl 1.33.2009e (compatible with my radio) and recovery recovery-RA-sapphire-v1.6.2H

The method used by ezterry to load via jtag a new spl at 0x0 didn't worked for me. After cego resume the screen was still black and the phone was still in oemsbl (I was able to type other commands)

That's all

I post some pictures like wires and final results

Cheers,

bart99