yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] bart9984:
@ezdyy:

hi I think I understood what you want to say.

In my case I don't know how to do it, because I can only write on addresses starting from 0xc0000000, so I can't put the nop sequence and the jump at 0x80000000. It seems the memory space usefull to do some hacking is protected. And without entering download mode which is a spl feature there is no way I know to execute code in an arbitrary memory place...

I can dump memory for at least 15MB, the very strange thing to me is that at every reboot the memory is initialized always at the same manner. The values are always the same... I'll try to investigate on this.

@G1hope:

tnaks to ezterry we know the best chance to debrick is radata oemsbl command. It seems to be used to write RUU commands to flash and seems to have other features/capabilities. ezterry is trying to understand how to use it in an emulated environment. If someone has documentation on this command pls tell us :)

Cheers,

bart99
[G1 Android Development] LeonardoFloripa:
WoW, nice!

The evolution of this thread is overwhelming...

I'd love to use my G1 again.

Googling the commands you're talking about, I've found this:

http://forum.modopo.com/diskussione...ol-universal-tool-for-qc-mobile-analysis.html

Hop this Helps.

;):D
[G1 Android Development] scholbert:
Amazing discoveries part II

Hey hackers,

i followed an advice of ezterry, entered "blue led mode" again, attached my JTAG debugger and modified RAM area @0x009038F0 to enter the hidden commands.

Here's what i got via mtty console:

Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
setboot [0/1/2/3]
setatcmd [0:SIO/1:UART/2:USB/3:DPRAM]
setsmdloop [0:disable/1:enable]
setmpatch [0x1: CPU Freq/0x2: acoustic/0x4: simdoor/0x8: RTC]
setiot [0:Disable/1:Enable]
setoffmode [0:Enable/1:Disable]
setfaketemp [1:Enable/0:Disable]
eraseall [erase all setting flags]
setdiag [0:USB/1:UART/2:DPRAM/3:SIO]
partition
checksum
format
setinfo
readadc
cego
setgpio
getgpio
gpio
version
powerdown
platformid
radata
oscchk
battchg
rtc
skuchk
wpmic [PM_VREG] [0/1]

My debug environment used a wrong mode, that's why i formerly wasn't able to use the serial debug port, during JTAG session :o

Everything works like a charm now... modding memory is an easy task!

Here's more geek food:

partition

MIBIB: 0
QCSBL: 10
OEMSBL1: 14
OEMSBL2: 20
HTC: 26
AMSS: 42
AMSSEFS2: 234
FOTA: 278
RESERVED: 286
APPSBL: 288
MISC_MFG: 294
SPLASH_1: 296
SPLASH_2: 298
DEBUG: 307
APP: 321
EXTENDED_ROM: 953

version

OEMSBL VERSION: 2.22.19.26I
OEMSBL Build Date: Mar 26 2009 01:13:35
PLATFORM: DREAM
PID: 31
PLATFORM ID: 0

skuchk

htc_smem_swfield_PCBA_PN: BE
htc_smem_swfield_SKU_NUM: 1
htc_smem_swfield_PCB_ID: 0
htc_smem_swfield_RF_SKU_ID_1: 12
htc_smem_swfield_RF_SKU_ID_2: 20000D4
htc_smem_swfield_RF_SKU_ID_3: FFFFFFFF
htc_smem_swfield_RF_SKU_ID_4: FFFFFFFF
htc_smem_swfield_RF_SKU_ID_5: FFFFFFFF
htc_smem_swfield_RF_SKU_ID_6: FFFFFFFF
htc_smem_swfield_RF_SKU_ID_7: FFFFFFFF
htc_smem_swfield_RF_SKU_ID_8: FFFFFFFF

setinfo

SetHTCRegionInfo: block=9, CID=T-MOB101, PID=00000031, IMEI=3582800xxxxxxxxx, SECU_FLAG=1

oemsbl 1

I will step a bit deeper into the code to get more info about the various commands.

Would be nice to know more about radata i suppose :rolleyes:

Cheers,

scholbert
[G1 Android Development] bart9984:
Hi sholbert,

you are telling me that before you had only access to the few securitu locked command as me and now after following the idea from ezterry you have the access to all the commands?

@ ezterry:

you genius :D

@sholbert:

thank you very much spending your time playing on your g1 ;) (i konw you have not a bricked device, so thank you)

? radata :eek:

oh guys this is really an happy day :)

Cheers,

bart99
[G1 Android Development] ezterry:
meh,

just seeded an idea to change

if(!SuperCID){
[validate command on whitelist]
if([not on whitelist]): [print Invalid command + return]
}
[process command]

To:

if([color=red]false[/color]){
[validate command on whitelist]
if([not on whitelist]): [print Invalid command + return]
}
[process command]
[G1 Android Development] ezterry:
Glad it worked out; thanks for the output as well

Just wish to add; there are various non-listed commands.

Some just accept HTCS..HTCE** encoded content to write to memory/(and maybe flash thus ought to be easier to use than the radata mess.. not that I'm not looking for such a solution)

Some investigation may still be required but here is what I see

GO2AMSS
USB_GO
DPRAM_GO
UART_GO
rversion
rpid
rcpldversion
rblinfo
pwrite
pdump
rwfactory
fdump
fwfactory
rninfo
rnwidth
rbchk
rmbad
rberase
rperase
eraseefs
echo_on[color=green] - echo to screen[/color]
smpl_on
smpl_off
smpl_timer
watchdog_on
watchdog_off[color=green] - if your hack requires the watchdog to not reboot[/color]
pm_hard_reset
wcpld
rcpld
cable_on[color=green] - 1 Cable on; 2 Cable off; 3 Cable dis permanently (what cable??)[/color]
rtc_get_status
pmic_status
pmic_all_status
mddi_on
mddi_off
vga_mddi_on
vga_mddi_off
pshold_down
pmic_level
pmic_mic_on
pmic_mic_off
pmic_mic_level
pmic_vib_vol
pmic_vib_on[color=green] - vibrate on[/color]
pmic_vib_off[color=green] - vibrate off[/color]
pmic_vreg
pmic_power_key
write_ram
ram_test
pin_test
outpw
inpw
outpdw
inpdw
dload
tp_init
adie_out
adie_in
rpmadc
radc
wadc_res
readCID
@CID:
rseed
rpass
rwdata

All the above in one never ending function of strcmp calls..

* The modified if condition may cause some commands to fail if they re-check SuperCID status..

** HTCS..HTCE encoding: 'HTCS' + 8bit binary data + 32bit CRC32 + 'HTCE'

***Please not I'm not responsible for any harm done by incorrectly using oemspl commands including but not limited to 1. further bricking the phone 2. battery going up in flames. 3. damage/injury due to fire caused by battery ect.
[G1 Android Development] hause:
Hi bart99,

Thank you for your reply and for trying out.

On my magic (32B) is a 32B vodafone hboot and a 32A htc radio.

The goldcard is no longer working.

When I try to flash a vodafone image I get "signature verify fail",

with a htc image I get "custom id check fail".

So it seems there is no way to flash something with fastboot.

When I boot a recovery image for 32A, nothing happens.

With a 32B image the magic tries to boot but then it hangs:

./fastboot boot recovery-RA-sapphire-v1.5.2G.img

boot reason: PM_USB_BUS_VALID_RT_ST

boot reason: PM_WDOG_TOUT_RT_ST

(PowerOn Status,Boot Reason)=(49,6)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Android
]©µ}¹…¹‘}ÁÉ½‰•
…µ•É…5ÿ[MDDI] Bitmap_Width = 480
[MDDI] Bitmap_Height = 640
[MDDI] RGB_Capability = 0x8888
[MDDI] Mfr_Name = 0xD263
[MDDI] Product_Code = 0x0
EEPROM: read 2032 bytes
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0x3
BodyLength : 0x2F0
BodyCRC : 0x3E3E8907
aDieId(0) : 0x0
aDieId(1) : 0x0
aDieId(2) : 0x0
aDieId(3) : 0x0
countryID : 0x30
Wlan data header --------------------------ARM11 Boot Mode: 3
Platform: HBOOT-7201A
[ERR] partition_read::Failed to read page 19072 or it is empty
[ERR] partition_read::Failed to read page 19840 or it is empty
[ERR] boot image does not exist!!!

###[ Fastboot Mode ]###
fastboot_command:[download:003f4800]
CMD:download: download:003f4800

recv data addr=803B5000 size=3F4800
status: DATA003f4800

Prepare to download data[4147200 Bytes]...
fastboot_command:[boot]
[ERR] partition_read::Failed to read page 19072 or it is empty
setup_tag addr=0xA0000100 cmdline add=0x880713A4
TAG:Ramdisk OK
TAG:smi ok, size = 64
TAG:hwid 0x1
TAG:skuid 0x1E300
TAG:hero panel = 0x0
TAG:engineerid = 0x2
Device CID is not super CID
CID is VODAP102
setting.cid::VODAP102
serial number: HTxxxKFxxxxx
commandline from head: no_console_suspend=1 console=null
command line length =347
active commandline: board_sapphire.disable_uart3=0 board_sapphire.usb_h2w_sw=0 board_sapphire.disable_sdcard=0 smisize=64 androidboot.baseband=3.22.20.17 androidboot.cid=VODAP102 androidboot.carrier=VODA-Germany androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.serialno=HTxxxKFxxxxx androidboot.bootloader=1.33.0004 no_console_suspend=1 console=null

PARTITIOM_NUM_MAX ÿ
[G1 Android Development] FRSP:
I'm confused, how are you managing to change recovery images if you cant fastboot or boot to recovery?
[G1 Android Development] G1Hope:
Isn't rwfactory the command that runs the built-in flash routine?
[G1 Android Development] bart9984:
thanks to viperbjk for this documentation:

rwfactory [BaseAddr [StartAddr [Length]]]]

Write to Nand
Press Enter (send 0x0d)
After that, encapsulated data must be send.

Example : rwfactory 0 460000 20000
Write to address 0x460000 with size of 0x20000.

I've never used it because it's ablacklisted command on my phone so I don't know much more, but I think its important to not commit errors using this command

:)

@hause:

with a serial cable maybe you'll be able to debrick your phone, I think the fact that you can enter download mode opens more possibilities to you then me, at least we are also trying to use only oemsbl to recover the phone but I don't know when it will be possible :)

Cheers,

bart99
[G1 Android Development] G1Hope:
Sounds like we might be able to unbrick with rwfactory then. Use rwfactory to rewrite SPL with version compatible with the radio ROM and we're golden.

Should under no circumstances attempt to write radio with rwfactory though. It might kill itself if it's running live from those addresses (although rwfactory might be built to execute out of RAM so it doesn't depend on the NAND).
[G1 Android Development] olearyp:
You should be very, very sure of that before attempting it. A few days ago I flashed a VxWorks bootloader over the live running PPCBug on an MCP750. On top of that it wasn't even the right kind of bootrom ("bootloader" is not the same as "bootloader.bin"!) If it weren't for the dual jumper-selectable flash boot, I'd have been sunk.
[G1 Android Development] crazyknallchopf:
sry my bad english...

have anyone tryed this:

1. taking out battery

2. disconnect usb

3. put battery back

4. press trackball

5. reconnect usb

a red light wil go on... charging???

thx
[G1 Android Development] ezterry:
If your radio works; and you plug in a USB/Power to the device it will charge.. red light for charging green for charged.

Happens even on working devices if you plug in the phone while off. (however as these are cell phones usually people charge while android is running which uses different LED logic.)
[G1 Android Development] crazyknallchopf:
if my radio works...?

hmm... i cant get my g1 running/booting

only first splash and blue led mode

or can the radio work correctly and g1 wont boot anyway?

thx
[G1 Android Development] lbcoder:
You can have the situation where the radio and SPL are both "good", but it won't boot because they aren't ***COMPATIBLE***. That is what happens when you install the DEATHSPL.... it means that you have a RADIO image that isn't able to hand over to the SPL. The solution for this is to overwrite the deathspl with an spl that is actually COMPATIBLE (i.e. ADP1 original SPL). No need to write the radio image at all.

Being able to write this is the first step in actually being able to repair bricks!

It would also be good to be able to identify the installed RADIO image (done by reading) in order to select a compatible SPL.
[G1 Android Development] hause:
Producing failures

Hi,

when I repeatedly remove and insert the battery this happens:

[MDDI] Product_Code = 0x0
i2c_72xx_wait_bus_not_active(): 500000us timeout [2100]
i2c_72xx_wait_bus_not_active(): 500000us timeout [2100]
EEPROM: unable to access!
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++

On normal power-on it looks this:

[MDDI] Product_Code = 0x0
EEPROM: read 2032 bytes
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++

I discovered something similar, when I tried blocking and unblocking the battery-pin in the middle between (+) and (-).

The device asked me something like "Reset the charger?"

(Can't remember exactly and can't reproduce it.)

Maybe a stupid question:

Can it be possible to bring the the device in a state that is useful for unbricking

by producing failures the industry has not considered?
[G1 Android Development] lbcoder:
So you want to break in by glitching the radio?

lol. definitely a fun idea, but probably as a last resort. Better to exhaust the standard approach before trying something really weird.

FYI: an approach used by some smartcard hackers back about a decade ago... you alter the input conditions to cause known failures in the circuit through specfically timed bursts of out-of-bounds voltages and clock signals. The result is that you can trick the thing into running your own code and thereby bypass the security checks.
[G1 Android Development] Sleeepy2:
Long live DTV P3. LOL

oh wait they already died. Down with P4's
[G1 Android Development] XBrav:
Interesting about that battery issue... it may relate to other devices...

For instance, the PSP boots into a service mode if a battery is inserted with a serial number of 0xFFFFFFFF. Could this be possible on an HTC phone too? It'd explain how a phone could be reflashed without opening...
[G1 Android Development] ezterry:
Particularly as I think oemspl via serial will let us fix many bricks without much hacking.. just need to find some info inside the black box that is the G1 memory..

Got a jtag adapter over the weekend.. last night my hand proved not stable enough to attach wires to the jtag header but I'll have another stab at it tonight.
[G1 Android Development] hause:
For HTC there is the so called: goldcard.

The goldcard ist a sdcard with some special stuff in the first 0x180 bytes of the first sector.

With a goldcard you can bypass some security.

The goldcard is no longer working for me after I flashed the latest htc-vodafone-generic rom.

What you say sounds very interesting for me... the goldcard-method is well known in the web.

Maybe they have a new backdoor like a special sim or a battery with a special serial# or a key-press-combi like in some games.

(Or my phone is messed in such a way that it isn't able to recognize the goldcard anymore.)
[G1 Android Development] XBrav:
The goldcard stopped functioning on this new SPL included in the Rogers 911 Update.

On the PSP, their magic memory stick was the equivalent to our gold card. The concept was:

Power down the device, remove all charging devices.

Insert the "jigkick" battery. This battery will power up the device, and look for the magic card in the memory slot. Basically, the battery's serial number tells the PSP to boot a certain sector from the memory stick. It then allows the user to run any code needed.

Now, I am not sure how deep developers in this group have gotten into the internal workings of the hardware and software, however, this method would allow HTC to drop a battery in the phone, alongside a special memory card, and reflash phones cheaply and effectively.

Now, here's the great part about this method. If this is true, then the bootloader will never be affected. If you screw up, or "brick" a phone, then you can simply run this method and unbrick, even if you bricked it running the same procedure!

If you all wish to test this out (I am a full time college student, I do not have such flexibility), try preparing a goldcard, and use a battery with a serial number 0xffffffff, and boot the phone.

The only downside to this method is as follows:

We need a means to either produce a "dummy" battery with this serial, or permanently modify a battery, which does not allow it to function as a normal battery anymore.

Now, it may be possible to use an old PSP battery on this phone, as the pins should be the same, and the serial commands sent via the 3rd pin should be the same. These are hefty should's though. I have not been able to look at my battery and see if the PSP also has a 3.7v battery.
[G1 Android Development] IanVaughan:
Not had time to read all replys, but bloody good work people!

I work with JTAG devices, but from just plug the JTAG in and program, no cleaver stuff!

Keep up the good work.
[G1 Android Development] hause:
When my magic bricked I was not able to read the cid of the sdcard without it.

I have only usb card readers that won't read the cid register.

So I took an TINI DS80C400 development board and used it to

read out the cid with a piece of software over the tini's spi interface.

(Dallas provides this software (java source) as example-code for the tini.)

I had the idea to built a sdcard fake (ramdisk over ethernet) with the tini to

check out what is going on during android-boot on the sdcard.

But when my goldcard worked I didn't follow this plan.
[G1 Android Development] scholbert:
Hi,

you should forget about this battery thing...

AFAIK, the battery used on Dream is quite dumb. Once i was able to use a lithium cell form an older cell phone to start the device without any trouble.

The eeprom data could be part of some subsystem located on the mainboard itself. For thoose who are interested, see attachment for the datasheet of the charging circuit on the mainboard. The battery is directly connected to this chip.

I did a lot of hacking on the bootcode and i'm sure it's possible.

Unfortunately i there's still nothing useful to report.

Right know my eyes begin to flicker, because i stepped through thousand lines of assembler code :eek:

Happy soldering :D

What kind of adaptor did you get?

Best regards,

scholbert
[G1 Android Development] XBrav:
I am not arguing over the debacle of an intelligent battery. I do however guarantee that there is bidirectional communication. If there was no 2 way comms, then it would be difficult to poll the status of the battery. As well, they wouldn't throw in the 3rd pin for no reason.

Usually, generic batteries will work, but won't indicate the battery level if the 3rd pin is not working. You require a certain bit of information to boot these service modes usually, not just shorting or tie-ing high the middle pin. The PSP was able to give that serial number by chopping off of a pin on the output, which was tied high. It did not tie high the whole bus, but just the output of the serial number.

Now, if you mean dumb as in it's not reprogrammable, then I can probably agree. However, we won't know until somebody is willing to crack one open and take a pic of either a generic eBay special or an OEM battery.

Here's hoping!
[G1 Android Development] crazyknallchopf:
much thanks for declaration...

its not easy for me to read a lot of sites and understand them all
[G1 Android Development] ezterry:
Well at least looking at microscopic points on the dream is a break from swimming (drowning?) in asm.

ARM-USB-OCD ... was looking at it online for a bit.. ran out to get it this weekend as my other hacks where going nowhere fast.

http://creatroninc.com/product.php?ProductID=574

Whats more a physical store in traveling distance!
[G1 Android Development] anthonws:
Hey,

I was looking online and stumble on this:

http://www.gsm-technology.com/index.php/en_US,browse,id_gr,1307,menu_mode,categories.html

Any good?

Hope it helps/provides some more info if possible.

Best of luck,

Anthon.
[G1 Android Development] lbcoder:
LMAO!!!

That is truly funny.

They are obviously watching this thread.
[G1 Android Development] anthonws:
That's what I thought...

http://www.gsm-technology.com/index.php/en_US,details,id_pr,6503,menu_mode,categories.html

But still, for 200 euros I would buy a new Magic...

I have a friend with a bricked Magic, would like to see a cheaper solution to unbrick his device.

Best regards,

Anthon.
[G1 Android Development] scholbert:
Commercials...

Yeah, already left a comment on this...

http://xdaforums.com/showpost.php?p=5657024&postcount=178

Obviously these guys are much faster in developing a solution.

Though accessing the platform and unbrick the device are two pair of shoes :p

Another guess while looking at the adaptor they made...

Seems obvious that they use default ARM9 debug mode to attach to the device. 6xJTAG signals, 1xVio and GND of course, Mode 2 testpoint is left unconnected.

This means they transfer ARM9 flashloader to the platform to handle NAND access (debugging mode).

EDIT:

Maybe this would give us an opensource solution...

http://android.git.kernel.org/?p=pl...refs/heads/donut-plus-aosp;hb=donut-plus-aosp

Also true, we're all looking forward to this...

Regards,

scholbert
[G1 Android Development] bart9984:
Hi Anthon,

I've got a magic bricked. May be it's possible to unbrick only using serial cable. To do this ezterry has bought a jtag adpater to investigate on G1's memory and sholbert is able to do it too, in my case my magic 32A has a brick that's similiar with the one of terry's g1. Theese two devices are quite similiar in hardware and some radio/spl could work on both the devices. So for your friend you should see what model of magic he has got (32A-32B) and which type of brick has occurred.

Today I've completely disassembled my magic, tonight I'll see if i can post some picture. At a first look there are not so many pins, but atm I have no idea of which are the jtag's pin.

Sya,

bart99
[G1 Android Development] anthonws:
I know we all are :) But hope is the last one dying...

Thanks for the reply bart99. I've been reading the thread, although I did not read scholbert post about the same produtc (Sorry about that).

My friend has a Magic 32B if I'm not mistaken (White Vodafone, UK probably).

When he boots up the phone it goes directly to the recovery option, the box with the exclamation mark.

Does not respond to fastboot or adb and when booting with trackball pressed it lits the blue led.

Thanks,

Anthon.
[G1 Android Development] lbcoder:
Not bricked.

Would only respond to fastboot if in fastboot mode (assuming that it even has one), and won't respond to adb unless it has loaded a kernel with adb.

Sounds like the /boot partition is just corrupt/empty. Just need to write a system image and all should be well. Recovery mode will do this, or if recovery mode is broken, use the applicable NBH file.

You put the nbh file in the root of the sdcard and boot with camera+power.
[G1 Android Development] anthonws:
It cannot boot to fastboot mode.

Well, I think that I tried the NBH method. I also created a goldcard and placed the nbh file (sappimg.nbh).

But well, it doesn't hurt trying again.

Thanks lbcoder!

Best regards,

Anthon.
[G1 Android Development] lbcoder:
As I said... ASSUMING THAT IT HAS fastboot mode.

Not all SPLs have fastboot!!!!
[G1 Android Development] anthonws:
I understood you, I was just confirming that it could not access to fastboot mode.

Do you mean the perfect SPL's? Yes, I'm aware of that. That's why I tried to flash with the goldcard (http://xdaforums.com/showthread.php?t=548218).

Either way, thanks for the replies and the provided info.

Sorry for the off-topic people :)

Best regards,

Anthon.
[G1 Android Development] lbcoder:
How about 0.95.0000 on tmobile branded dream...
[G1 Android Development] anthonws:
You're right :)
[G1 Android Development] bart9984:
Htc magic board

Hi guys,

as promised I attach two pictures of my htc Magic 32a board.

Someone interested on finding JTAG connection here? :D

I'm new in jtagging so any suggestion is appreciated. Atm I'm still hoping to debrick using only the serial cable, but can't resist to full disassemble the phone.

Processor side:

Other side:

I have not seen any points group that seems the one on the g1...

Sya,

bart99
[G1 Android Development] ezterry:
No obviously moved.. many test points still maybe its as easy to get at but it may be hard to find the traces w/o destroying the phone.

I'm more of a software person than a hardware person .. (not completely lost but need a bit of a map)

The jtag on my rogers dream is working for me thanks to BinaryDroid/scholbert and others of this thread for the wonderful "map" on this thread.

Now back to trying to get software to do what we want...

While in progress (since the JTAG has been completed)

​
[G1 Android Development] bart9984:
Found this

http://deadhacker.com/2010/02/03/jtag-enumeration/

to find jtag piouts. It's based on arduino duemilanove...