yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] scholbert:
Hi!

This method is supposed to work with Magic 32A

It should also work for Magic 32B which is even closer to the Dream hardware than the 32A.

I'm not sure what you trying to tell us...:o

The adaptor you pointed at is only matching the Dream mainboard.

For Omnia Repair Tool support ask the guys who sell it.

The pinout of JTAG testpoints were published, but i suppose you'll have to solder the wires manually.

If you like to follow ezterry's way, read the last postings in this thread.

There's also a lot of information about JTAG adaptors suitable to connect to Magic as well.

Do some nerd reading :D

@ulissescg:

Great stuff and well done!

Would be interesting if we could verify/find the position of the PS_HOLD testpoint. Sooner or later i'll try to access the device in BSDL mode and PS_HOLD would be definitely needed for this attempt.

Also if you need some further information about the chipset, you may write a PM.

You might know that the mainboard of these devices are multilayer technology, so the PCB consists of many layers (8-10 i suppose).

Would it be possible to adjust the X-ray to focus on every layer?

Awesome.... :rolleyes:

Regards,

scholbert
[G1 Android Development] mippen:
Is the 32b Jtag points located?

Can in this thread only see the Dream and 32a pinouts documented.
[G1 Android Development] scholbert:
Should be the same location.

As far as i remember our fellow bart9984 once posted some high-res pix of his Magic 32A in this thread.

Anyway, some detailed pics of the 32B mainboard would be helpful too.

Cheers,

scholbert
[G1 Android Development] uio88:
Hi scholbert,please can you describe all the processes for unbrick the g1??

Maria
[G1 Android Development] ulissescg:
You are right this PCB his Multilayer but also have Blind Vias, so it’s very hard to trace visually, yesterday I was trying to trace the jtag pin outs out there just to confirm and double check and also to found alternate Test points in case you get a lifted pads and see where they was going to, but just quickly I could not find where they was connected, I was looking in to the MSM7201A pinout (I’m not saying is not connected, I’m just mention that I did a quick test)… so, now I have a lot of exposed pads to look in, and I didn’t download the datasheet for each part to figured out how the system is made and where I have to look out, anyway if someone has information please share… with this Board I can help to trace out… just let me know what pin is the ps_hold on the device and I will trace it… bus as I mention I did not find the datasheet jet… do you have a bsdl file for some similar MCU?? Or your trying to get from there?? just let me know what pin of the mcu is the ps_hold and i will trace it...

Regarding the x-ray image, I was fighting with the machine and I was adjusting focus, intention and some other parameters and I did not find a way to separate the layers, the way that I normally do is to take out layer by layer with some tools but this time I did not want to damage this pcb…

I’m desperate to have one bricked phone :(
[G1 Android Development] lbcoder:
@NEWB: READ THE FRIKKIN THREAD!!!!

If you don't read it, you're too lazy to deserve it.

If you don't get it, you're too DUMB to USE it.
[G1 Android Development] ulissescg:
FYI....

http://furiousteam.com/2010/04/03/f...ion-released-for-htc-android-g1-google-phone/
[G1 Android Development] josevtome:
I think that it's very funny that the phone in the image of this link is not actually a G1! generates trusting issues! hehehe :)
[G1 Android Development] mippen:
Could this picture give any hint on the 32B JTAG pinout?

http://img31.imageshack.us/i/dsc04911eo.jpg/
[G1 Android Development] ulissescg:
There is more interesting information you can see there, like the jtag traces to the MCU, the connection to the pin1 (+ signal) and Pin2 + 3 (- signal) (Need to check if really need the temperature pin to be connected to gnd, also they mention that they turn on the phone and when the phone starts vibrating just connect it to the jtag and it will be connected, we need to check because the mode we were using it was un blue led mode... some information on the screen like device ID, Manufacturer, Arm Core Detected, also status of the Jtag ports TCK=1,TDI=0 ........... so please make constructive comments and put attention to the important information….. by the way normally when you are doing some investigation and creating a report, you take some images from internet or from some other sources, sometimes you did not want to waste time taking high quality pictures or maybe you don’t have high resolution camera, may be they just see this CAD image (3D Cad Data) from somewhere else to impress the customers…. Do you think the phone they use with the connections and jtag connector etc is not a G1??? Then?? That’s the important, isn’t??

We need people how really wants to help and wants to work, I have seeing here so many users just make a critics of the work or make bad comments about the job or post, or some ones just ask for information even did not search before ask, life is not easy guys, crossing harms?? Wait until someone shows you how to do?? Just my personal opinion and is not again somebody just a reflection and everyone is free to do whatever he want, I agree with that….

regards
[G1 Android Development] ezterry:
**For the power pins... phone does not like the center pin to be floating... but beyond that I don't know.

**As for starting the jtag: you don't need to be in blue light mode to use jtag.. you just need to start jtag before AMSS kicks in and blocks the jtag port.

They are racing the clock; and entering while the system is still loading; if its a working phone anyway.. (bricked phones I have no issue using jtag while stuck on the boot screen)

Presumably once connected they immediately halt the CPU thus stopping the phone from booting too far on the ARM9.

Then load some code to read/write directly to flash themselves.

FYI: You can also connect to jtag while in the SPL; or while the battery is charging w/o racing the AMSS blackout.

**The hacks I have described thus far cheat and use the radio boot loader its self to aid me in fixing the phone. This requires blue light mode since in that mode the serial port is the radio bootloaders command line interface (oemspl) (this is what the serial interface is talking to when we enter serial commands such as 'cego' and 'radata' a large list of these is earlier in this thread (some have help.. some don't)

There is another "oem" or "hboot" command line provided by the SPL while on the spl screen over serial (for non bricked devices) and the linux kernel can make use of the serial port when the system boots.

(RA recovery sends syslog and boot messages here)
[G1 Android Development] raymar23:
Hi sorry bout the noobish question but I wanted to kow if it would be the same thing using an actual serial port on the computer rather then using a USB-SERIAL adapter, and if so which pins to use for the TX and RX of the serial port.

Thanks again for helping me understand how to complete this whole procedure, in hopes of unlocking my rogers dream
[G1 Android Development] igord:
Serial cable for HTC, use this one or older nokia serial cable like 7210 easiest way to build.

http://xdaforums.com/showthread.php?t=595791
[G1 Android Development] ezterry:
The PC serial port's voltage is too high to attach directly to the phone:

See:

http://sodoityourself.com/max232-serial-level-converter/

http://www.sparkfun.com/commerce/product_info.php?products_id=589

On the HTC Breakout (Unless I'm mis-reading something)

Pin 4 = Vcc **

Pin 7 = Ground

Pin 8 = tx

Pin 9 = rx

** This is not connected in the tty level 3.3v serial wire using the USB adapters but has been indicated to work where a level conversion is requires.. and seems to have 2.8v supplied to it (there was some how to with controlling a robot via G1 I can't seem to find the link to again)

I have not done this so please verify everything (I whuld have done it with the serial port on the ARM-USB-OCD but got the usb serial first)
[G1 Android Development] ulissescg:
6 pin jtag
[G1 Android Development] eleazar6:
USB-Serial converter

The development of this thread couldn't have come at a better time... bricked my sister-in-law's G1! :(

Anyway... I have a USB-Serial cable from an old Palm pilot... USB232-3N is the model. It has a 9 pin connector on the end, but when testing voltages per the thread about the nokia cable, i don't get any power outout on any of the 9 pins. Would i need to install a driver first? It's a PL2303 based usb-serial. I guess I need a pinout.
[G1 Android Development] scholbert:
oh boys....

Hi!

If this is a 32B device you should turn it around and make another photo of the processor side.

Then compare the layout of the board and the location of testpoints on with a 32A.

32A device pix:

http://xdaforums.com/showpost.php?p=5772756&postcount=249

http://xdaforums.com/showpost.php?p=5937764&postcount=348

I'm pretty sure the layout of 32B is the same, only some components differ.

So the JTAG pinout would be the same also.

@ulissescg:

:confused::confused:

O.K. Now that you confirmed it is really the processor we connected to,

what next....

...seriously i know that you try to find alternative testpoints... search for the land pattern of some resistor network or similar. Maybe there's some other connection. These pads are worthless, because it really is the area beneath the processor. These are simple not accessible :rolleyes:

Regards,

scholbert
[G1 Android Development] ulissescg:
Well, i did not have a bricked phone and i cannot continue doing my research...

What I can do now is to trace the test points on the boards, as mentioned before we can try to access to the device in BSDL mode but needs to know the PS_HOLD pin, because I did not have the pin configuration will be hard to find it but I can help in to find traces, test points, etc…

I would like to continue also looking for alternate soldering areas for the USB port (to make in house connection without the USB adapter) … before I was starting working with the psas and the segger j-link but now what I can do is just trace pins :(

Let’s do a plan, summarize, what is done, what is missing and what is next...
[G1 Android Development] scholbert:
O.K. i'll prepare a map of signals based on your pix.

Need some time though....

Once traced the signals on the sub-PCB to connect to the serial port (UART3).

USB is also available on the sub-PCB of course... on the main PCB the USB port should be attached to SMSC USB PHY. I may look for these pins also.

The rest had been published here already, i guess.

Regards,

scholbert
[G1 Android Development] ulissescg:
Could someone take high resolution pictures of the Main board and the USB Board??
[G1 Android Development] scholbert:
Are you kidding :confused:

Look at the first post, what resolution do you require?

I really recommend to step through the whole thread.

You will realize that there in fact are several posts with high-res pix (though the sub-PCB is missing yet).

Regards,

scholbert
[G1 Android Development] ulissescg:
i have read all pages so many times, also some other forums as good as this .... OK, if you can indicate Silk Screen on each IC it will be fine for me, i just want to see the part number for some IC's, also for the USB Board we don't have submit pictures get, isn't ? I just want to indicated and locate the IC with Part number and we can easily figured out the system, then we can trace the lines easily and have a map of the system. If we don’t have that we are not in the proper way, if we want to do a good reverse engineering we need to know what is there and how is connected or working ( from software point of view we can guess and guess) but hardware point of with is what your eyes see… I understand your point scholbert but we can work as a team…

By the way, often I did not make questions before I make a research and before I know what I want and what is out there…

Regards

ulisses
[G1 Android Development] gymmy:
i posted some hi-res pics a while back its of the 32b board.

G
[G1 Android Development] bart9984:
What sholbert said to you is that to see if the pin-out is the same of the 32a we need the picture of the other side of the board.

bart99
[G1 Android Development] mippen:
cpu side of the 32B hardware

http://img58.imageshack.us/i/dsc04921.jpg/

Looks like the same as the 32A board.

I guess that I need 32B memory map to get the jtag to work?

Ore might the 32A solution work on the 32B HW?

Have been following most of the posts but is a little bit confuse.

Connection with jtag on the 32A has been done but

have anyone managed, with the 32A (or even better the 32B) to get a SPL loaded?

Would love a summery on what is working and what is left to investigate.

I have no problem with using a jtag method as long as it works :rolleyes:
[G1 Android Development] ulissescg:
Sholbert, please confirm if the PS-Hold will be at the AB18 pin "PS_HOLD"....
[G1 Android Development] scholbert:
Appreciated...

Hey ulissescg!

O.K. agreed... i didn't want to flame you ;)

Indeed your help is welcome to lift some open issues. As i said i will prepare a map with some helpful signals.

If we would spend some more time/work on this, it would no big deal to reverse engineer some of main parts to get full detailed schematic...

I got proper understanding of the hardware so let's see how far wer push it :D

Unfortunately my time is bit limited to spent so much on reversing.

Real life and stuff... you know :p

O.K. back on track:

Yeah confirmed!

That's the pad of the processor.

There's another one in the area of the PMIC (PM7450) that is connected to the PS_HOLD signal. Please be a little patient i will prepare a map soon.

Best regards,

scholbert
[G1 Android Development] scholbert:
Yes it's the same layout... testpoints at the same location.

So i supppose the signals should be identical.

... and it's definitely a 32B:

Memory component identified... H8BCS0UJ0MCP is a 4GBit NAND / 2GBit DDR SDRAM MCP (512MB/256MB).

BTW, we should create a mainboard gallery :D

scholbert
[G1 Android Development] gymmy:
I did 2 hi res pics of both sides of the boards showing the tag points
[G1 Android Development] ezterry:
HTC Dream (main + daughter boards)

If anyone requires high rez of both boards (the pre-existing main board photos may be a bit cleaner however)

FYI feel free [from my point of view] to use these images under: Creative Commons Attribution-Noncommercial
[G1 Android Development] 3izz:
Solution Center for Android

Hi all

i just want to share this website with YOU

http://www.arm.com/community/software-enablement/google/solution-center-android.php

Visit the ARM Solution Center for SDKs, NDKs and source code

maybe it would help us
[G1 Android Development] sigo2oo9:
Excellent work guys, had my "bricked" Magic 32B in pieces earlier and confirmed the same points exist as on the 32A board - Cannot for the life of me remember how I bricked it now but I think it was flashing SPL via recovery so now I just get boot screen or blue led.

Honestly have no idea with most of the info in this thread but it has been very interesting reading and I think if I can work out the "JTAG for $2" device i should be right to do the rest thanks to ezterry's exception testing and informative posts.

Cheers
[G1 Android Development] ezterry:
lbcoder's "$2" jtag device (and if you are good to go with soldering to the phone it really ought to be fairly cheap) requires a Parallel port

Then:

> Build scholbert's jtag circuit http://xdaforums.com/showpost.php?p=6055979&postcount=412

> And create a 2.6 volt reference voltage http://i43.tinypic.com/124k7sk.png

remember you will also wish to have a HTC serial wire.. either via usb adapter or with voltage adjustment from your computers serial port.
[G1 Android Development] scholbert:
I already wanted to add this some time ago.... just for completeness.

There's a testpoint for the 2.6V on the G1 mainboard.

TRSTn could alternatively be pulled high to VRef = 2.6V

Also left RTCK unconnected/unmarked.

You won't need it for these kind of adaptors.

Unfortunately i got no Magic to do some measurements...

The 2.6V should be anywhere on the board also :p
[G1 Android Development] ezterry:
Thanks, much better than the 2.6v testpoint I knew of on the other side of the main board.. it was too close to a ground solder pad and higher voltage test points for my comfort.
[G1 Android Development] sigo2oo9:
I had a feeling that was the case, thanks for pointing it out for me (after ready 40+ pages things got a bit blurred!!)

I've got the Nokia DKU-5 cable and a HTC ExtUSB breakout connector on order at the moment.

I was going to try to make my own solderless type connector for the JTAG points on the magic, i don't think it will be too hard to attach something and have it held on by rubber bands or similar.

Thanks again mate, fantastic help
[G1 Android Development] shaji007:
so how do we restore the phones lol?
[G1 Android Development] ultma75:
they are trying to figure that out. read the thread before posting
[G1 Android Development] pjcforpres:
The title of the thread is now "Success! De-Bricking Dreams..." which is a little mis-leading considering they haven't actually de-bricked any yet. And come on, at least the post was in the correct thread, on topic, and so forth.
[G1 Android Development] ezterry:
...

The "Original unbrick bad danger SPL flash" is in this thread..

we have not unbricked a magic yet.. but this thread is under HTC G1/Dream Development not Magic/My touch..
[G1 Android Development] pjcforpres:
So I stand corrected, obviously not a fervent follower of this thread, was just popping in, saw the title had changed, decided to take a look, saw a post asking how to de-brick, another saying you can't and too search... figured I would stand up for the little guy.

Anyways, that is hella cool! I bet you are buying up bricked G1's but the bucket load, unbricking, and reselling them for a tiddy profit, or at least I would be.
[G1 Android Development] scholbert:
Detailed floorplan...

Hey dudes,

i must have gone completely mad, but i just finished a more or less detailed overview with all testpoints of the bare main PCB.

In fact i'm refering to this post....

... so we once more act like a team :cool:

I would like to thank ulissescg for the excellent high resolution pics.

So these were the base for my editing....

EDIT:

You may wonder why some of the testpoints are not assigned like it is shown in the first post.

The answer is easy... i only marked the ones that are confirmed as correct during extensive experiments/measurements on the board.

Should be easy to check the remaining for functionality too.

EDIT:

Maybe it's not the best idea to put it all here for public access....

So i just decided to remove the files, because they contain confidential data that were collected from different sources in the web.

Some are not easy to find and maybe it's better to keep some secrets.

Best regards to Qualcomm and HTC

EDIT:

Changed my mind...:p

Maybe it's the best idea to put it all here for public access....

Have fun!

scholbert
[G1 Android Development] Aaron!:
I just had an idea in regards to de-bricking Magics using a serial cable...

IF the security can be bypassed using a goldcard, would that make it possible to run the necessary commands via serial/usb to reflash a Magic without attaching a JTAG?
[G1 Android Development] ezterry:
Thus far I see no indication that the radio reads the sd card.. so sounds unlikely to solve bricks.

The gold card as we know today in the most recent perfected spls only seems to bypass the cid id (provider) check.. not any signatures or version checks. If some other type of bypass based on the sd card exists I do not know.

However if you see the unlocked commands in oemspl while using a goldcard do let us know.
[G1 Android Development] gymmy:
Why remove them ? if they are available on the internet, its pretty much in the public domain? unless the information was disclosed under agreement or obtained though channels which were perhaps not totally legit ?
[G1 Android Development] scholbert:
To make a long story short:

I'm little afraid and maybe something like paranoid, that some of the guys building the phones come along and have a look what happens here.

Apart from that there's google that's make searching easy....

Now what we are doing here is reverse engineering.... these pics are the detailed result of it. So it's as simple as: i don't want them to know what i know

There's even more behind it... but i promised a short story.

Send me PM :rolleyes:

scholbert
[G1 Android Development] gymmy:
Well RevENG isnt new but i do understand where your coming from.

These company's all RevENG , this is how they produce clones to the "iphone" so quickly ... Well from a hardware perspective.

But really, there isnt anything on here that is how should we put it.... non standard or using methods which are "new" ... difference is is that we do it for free and release it to the general public... i know Qualcom doesn't particularly want all of the AT commands and what they do released publicly as people will be able to misuse their phones on the networks , but its like people who find vulnerabilities in OS, if they are found and corrected its makes everything more safe !

G
[G1 Android Development] lbcoder:
Actually, fruit clones do NOT involve any kind of reverse engineering AT ALL. They are actually NOT clones. They're just look-alikes. They use entirely different hardware, which they package into a physical form that physically appears the same as that fruity junk. They also use a totally different operating system that is SKINNED TO LOOK LIKE fruit.
[G1 Android Development] :
Yup.

You should go watch some of these "clones" in action. Some of the OS look almost just like android and lack touch screen support. Much less, a notification bar that even pulls down. That's just OS side, though. As for the looks, yea. Its just pretty plastic. Metal if you're lucky. I mean, honestly, you can probably find one that blows the g1 out of the water, but most are just horrible and a laughable experience for anyone who's ever actually owned one of the phones its cloning.
[G1 Android Development] lbcoder:
...interesting thing about android.... the "clones" are actually becoming *not*-clones. Why use incompatible trash when you can load the REAL ANDROID onto your device? CECT for example "sciphone","hiphone" -- probably the biggest cloner -- now uses GENUINE ANDROID on several models including n12, n16, n17, n19, n21.