yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ezterry:
Why is it with this phone every time I get closer to what I really want it to do I seem to end up with more and more of a brick..

So for radio 2.22.19.26I:

with jtag:

If you the word at 0x009038F0 to 0xea000013 you can see all the super cid commands as scholbert showed a little while back

if you set a breakpoint at 0x00902b30 and run the command 'cego'

you are paused after the SPL is loaded at 0x00000 and before the arm11 boots. thus here you can modify the data or potentially load the correct SPL.​

Radio 1.22.12.29

with jtag:

If you the word at 0x00902EB4 to 0xea000013 you can see all the super cid commands as scholbert showed a little while back

if you set a breakpoint at 0x00901A24 and run the command 'cego'

you are paused after the SPL is loaded at 0x00000 and before the arm11 boots. thus here you can modify the data or potentially load the correct SPL.​

Radio 3.22.26.17:

with jtag:

If you the word at 0x0090379C to 0xea000013 you can see all the super cid commands as scholbert showed a little while back

if you set a breakpoint at 0x009029DC and run the command 'cego'

you are paused after the SPL is loaded at 0x00000 and before the arm11 boots. thus here you can modify the data or potentially load the correct SPL.​

Given the rogers issue I attempted to just make a minor modification to the spl; and boot it.. this seemed to work correctly but afterwords the radio seems to no longer boot [including charging the battery]. (not sure if something is shorted or fried...) removed the board and all connections look correct and it almost acts like its trying to boot.. however jtag isn't seeing the processor anymore either.
[G1 Android Development] hause:
Hi ezterry,

maybe jtag has blown the chip's secure-boot fuses?
[G1 Android Development] ezterry:
fuses.. I think that count for both short and fry...

Not the large easy to access fuse, I can poke some but I need too see it to fix it.
[G1 Android Development] bart9984:
Hi terry,

I'm sorry for your damage. Neither the serial cable is working?
[G1 Android Development] marxmarv:
I think what they're trying to say is that some code failed a self-check somewhere and super-bricked your device, e.g. by blowing the EEPROM bits inside the chip that enable JTAG. If it were possible to set a write breakpoint on internal security registers, and we had a somewhat documented copy of all the code in the boot chain, we could know for sure. (I really need to take some time and learn ARM, sigh...)

That, or the bit of SPL you changed wasn't as non-critical as you thought it was :)
[G1 Android Development] ezterry:
Can't be 100% sure, but nothing I did to the radio was outside of ram, and was done prior to this, the spl edit.was new and may have triggered something unexpected, certantly didn't enter fastboot where I hoped to be.. but it looked like it was attempting .normal boot.which ought not have hurt the radio rom.

Also I ought to mention the jtag port did not seem dead [can probably run a boundary scan if I learn how to.. and re-attached the jtag leads]; just requests for the ARM9 failed. (maybe I just accidentally found code to erase the radio from flash but still a bad sign I can't poll the CPU at all..)
[G1 Android Development] anthonws:
Hey lbcoder,

I've tried several nbh files and no good.

Furthermore, there is no camera button on htc magic :S

Pressed all possible key combinations... the "arrow" down not move.

http://i.imagehost.org/0648/Image001.jpg

Thanks,

Anthon.
[G1 Android Development] sangeet.003:
Anthon -

First of all your Phone is not bricked...

& so you must not be posting regarding normal flash via recovery over here...

May be theres no camera button, try back + power my ADP1 used to support it...

Please read the Magic Forum as you are looking for help in the wrong section...

Correct me if I am wrong...

And to others,

My phone too is bricked No fastboot/recovery I had recently had opened my ADP1...

I need to know which kind of serial cable are you guys using i mean the Instructibles.com one or RS232

I am a NOOB at JTAG & all this Advance Mobile Hardware stuffs...

So If there are any links where I can know more please help...

Sangeet
[G1 Android Development] bart9984:
@sangeet.003,

the serial cable as described in this thread is the instructable's one.

if you want to know where to get documentation about jtag on the g1/dream read this 3d from the first page :) I think this is one of the first forum where this approach has been documented.

For others I'm searching some fallen in water/bricked magic's board to find the jtag pinout on this device too

At the moment thanks to ezterry idea we can unblock the blacklisted oemsbl's commands and then reflash via rwfactory command. I think this is already a good compromise... Then we can also try to skip out the jtag step.

Sya,

bart99
[G1 Android Development] ezterry:
hrmm.. Yes the blacklisted commands return.. but if you have jtag going I think the safest thing is to load ram with an SPL and use fastboot or an nbh/zip file to restore the rest of the phone.

but since I have no test phone atm (working on it) I'm taking a break from the jtag/unbrick hack to trying to break my way out of this android 1.5 rogers rom. (now with a hybrid USB/HTC Serial wire; note any other rogers users with luck you will only need the USB wire for breaking out of the 1.5 rom)
[G1 Android Development] keithsipa:
I have been waiting for someone in this thread to steer it to the rogers problem. I just wanted to say thanks to ezterry for all you strides forward, and look forward to seeing your progress.
[G1 Android Development] ALUNECOSU_HD:
Htc drea2000 dead boot

I have this phone dead.before the whole show just die logo G1.i have Omnia repair tool and tried to fix him but could not.I do not want to stress anyone. I need a bin 256M read and ok,or another option to repair this phone.I understand from Mr Hoang that my phone would be another cid , DREA2100.

HELP:confused:
[G1 Android Development] Seventeenth:
I have a bricked HTC Dream, if anyone wants to trade motherboards for a working one, I'm up for it. Sucks not having a phone to mod. :mad:
[G1 Android Development] xaueious:
1) More info for blacklisted commands

Just wanted to note that maybe the author of PSAS/QMAT expressed interest in getting 32A Magics to root. I don't know if you guys ever contacted him, but he might know more about these commands, as I've seen discussion of these commands on the forum:

http://xdaforums.com/showpost.php?p=5801435&postcount=77

He would might be able to give some input? See: http://xdaforums.com/showpost.php?p=5801435&postcount=77

2) Ideas of how to fix radio flash brick (flashing 2.x->3.x radio without recovery in place, causing phone to get stuck at first boot screen)

With these new commands can we do the following?

a:

Using the rwfactory if we figure out where the boot partition or recovery partition starts and ends can we reliable just wipe the partition? Would it be as simple as writing a bunch of zeros where the recovery partition would be, or would be more involved than that?

b:

Alternately we would use pdump to dump the nand from a working phone, then use rwfactory to flash it into our brick.

The reason I ask about clearing the recovery partition is because when I wipe the recovery partition, there seems to be a fall back fastboot mode. I was wondering if this can fix the radio flash soft bricks where the phone tries to boot to a recovery after a radio update and is unable to boot to it. The problem might be the phone trying to boot into an incompatible recovery and getting stuck in that mode, assuming that the radio flash is completed after the HTC screen finishes. If we clear the recovery would this work?

Ordinary HTC 32A RUUs have 2 zip files, the first containing the HBOOT, Radio and a 'special boot image'. From reading how people have flashed the Rogers update using the sd card method, the special boot image likely replaces the boot partition to get the phone to go to hboot mode (where it starts scanning for the second zip file to flash automatically). Not sure what the img does otherwise...

Maybe someone can unpack the special boot image and take a look if it actually does post radio flashing tasks we can replicate.

Here's my Rogers Dream after I run the command 'fastboot erase recovery', and then attempt to boot to recovery:

fastboot is functional in this mode just like hboot.

It says "fastboot usb"

3) Achieve root on all locked phones

Can we not achieve root back on all rooted phones with jtag now since we can use pdump to dump the nand of a rooted working identical phone, and then use rwfactory to copy everything over? Would this have implications on things like IMEI and serial numbers, if they are located in nand? If the are we need to avoid those areas as we flash? I am cautious because I ran into a problem where my HBOOT was locked in S-OFF mode, but reflashing a 1.33 series SPL didn't fix the problem until I went all the way back down to HardSPL. So there are things on the nand that we probably shouldn't touch.
[G1 Android Development] ezterry:
xaueious:

Yes with jtag you ought to be able to restore.. we have not found all the magic numbers yet however; and there are better ways than coping the data from a working phone.. as that is prone to copy errors.

basically before what I think was a massive grounding (and temporary lack their of) issue; I proved we can change/load the SPL into ram.. meaning you ought to be able load an engineering SPL into ram and likely boot it. Saving us needing to find how magic/dream differ for the same radio/SPL combination; and ensuring it works on all versions of the phones.

As for the rogers boot mode issue (that is what I tweaked.. I think I ought to have used a technique a bit more similar to the fudge I used to fake superCID. but atm am unable to validate due to lack of working jtag)

This still leaves the 3 big questions a) how to just use the serial wire as that is more user friendly b) how to recover if the radio is dead as well and c) can we make a SPL for the rogers phone that lets us get back into Fastboot when switching 2x/3x radios (as its the same SPL we use on both)

As for rooting.. until massive changes are made to the boot chain the SPL swap ought to work fine;

and pwrite is the inverse of pdump (however I did note some of those commands where just aliases)

(Note I am working on getting another phone I can hack with jtag.. and designing a better adapter.. I've just determined that I like having a working android phone with even the crappy rogers 1.5 firmware over the no android phone.. so mind if I wait for the backup)
[G1 Android Development] scholbert:
It's depressing...

Aaaaah...

Fiddling around with electronics is sometimes very heart attacking.

Did some experiments while i was connected with the USB port to my host.

Seems that the battery connection dropped at some point... the system had a breakdown and the mainboard got very hot.

Now i got a solid brick :eek:

Not even "blue led mode" is working anymore.

Damned *$#&()""!!!

Will check the components, but i suppose this was the end :(

Fortunately i got another broken mainboard with JTAG working O.K.

I must admit that right now i'm a bit tired/depressed to digg deeper in the bootcode to find something useful...

Maybe i should go to complete the BSDL software for pure JTAG access... :confused:

I'm at a loss...

So please could somebody join in to give some hope :rolleyes:

scholbert
[G1 Android Development] lbcoder:
Seeing as the USB-method ***WILL*** require some kind of working code to already exist on the device, a jtag solution will be ideal. Let us fix a totally dead phone.

I say that this is first priority.

Second priority is simple solutions to partial failures.
[G1 Android Development] bart9984:
Hi sholbert,

it's a shame for your working device. On the other board what type of brick do you have? Only jtag or either serial?

I'm still searching a bricked magic board to destroy to find jtag pinout. If someone has got one let me know :)

bart99
[G1 Android Development] scholbert:
Hi bart9984!

Yepp that's f***in true... i am really fed up :(

Though the device had a simlock.... i used it to learn about Android internals.

The other device is O.K. to hack on.

The only damage is an annoying trackball issue that causes malfunction on input and the battery is drained very quickly.

I suppose it's a damage on the GPIO unit of the SoC.

Already started thread about it some time ago ...

No luck these days.

See ya,

scholbert
[G1 Android Development] LeonardoFloripa:
Did anyone see this ?

Qualcomm Tool V1.13

Release notes :

* MSM7201A Read and Write Functions improved .

* MSM7225 Read and Write Functions improved .

* MSM6250 Read and Write Functions improved .

* Tested with following devices

o HTC Dream

o Google G1

http://www.srimeenakshimobiles.com/forums/front-page/20089-ort-jtag-unbrick-htc-dream-google-g1.html

:confused::confused::confused:
[G1 Android Development] scholbert:
Hi LeonardoFloripa!

Yepp, already discussed here:

http://xdaforums.com/showpost.php?p=5769336&postcount=240

It's a commercial solution at about ~200EUR. Obviously it's working.

So grab it if you like :p

Cheers,

scholbert
[G1 Android Development] snorkelsnorkel:
JTAG for Hero

Hello!

Stupid question, but would it be possible to use the same principles on a Hero ?

Mine has lost SD-card and USB and it seems that its not even possible

to use the UART to reflash it. The way I see it is finding a way in by

disassembling to radio firmware to find some secret code or bug OR

use JTAG and flash back the original.

I understand that its basically the same processor and such so unless anyone

says its a dead end I am thinking about tearing it open and start working.

/Snorkel
[G1 Android Development] ezterry:
Some minor updates of the G1 memory map.. looking at my memory dump from before bricking my brick.

As indicated the radio.img contains multiple sub images

In this post I link to a tool parsegsmv2.pl which while made for a different HTC device flawlessly splits the 3 main code sections of our radio.img

qcsbl.nb

Ram Base address: 0x8000E000

(entry point also seems to be 0x8000E000)

This contains initial boot hw setup code including:

Elf reading code (see subroutine at 0x8001B638 on 2.22.19.26I)

MMU setup

Nand code (at the very least to read)

oemsbl.nb

Ram Base address: 0x00900000

(not sure about exact entry point; file starts with pointers to many functions)

OEMSPL code includes 'radata' used by appspl (the SPL with hboot/fastboot) to write radio data. and many other debugging functions discussed in this thread

elf.nb

This is an actual elf file and is presumably loaded as per the elf's definition; Contains Qualcomm radio code.

see: http://android.pastebin.com/MwmytfGe

hboot.img AKA app spl

This is not part of the radio image but the SPL you are used to with HBOOT/Fastboot

Physical load address 0x00000000; Virtual address (arm11) 0x98000000

entry point appears to be 0x98000400

Boots linux

runs fastboot/ruu (ruu is really just an extension of fastboot)

oem command line - debugging tool on arm11; access via serial or 'fastboot oem <cmd>' (like oemspl has many commands mostly CID locked from us)
[G1 Android Development] allanwinckler:
Hi Guy,

I've finded the SPL memory region, do you know how can I use rwfactory to flash this region by ARM9 with a valid SPL?

24000000-24c0000 is SPL Region.

Thanks,

I'm trying to recover my Magic from a wrong SPL update (i don't have recover mode, fastboot, or hboot. I only have ARM9 Radio Boot)
[G1 Android Development] bart9984:
Hi allanwinckler,

how do you found the spl entry? The addresses are referred to nand?

I knew spl size is 0x80000 while your offset is 3/2 of it.

About the use of rwfactory tnx to viperbjk:

rwfactory [BaseAddr [StartAddr [Length]]]]

Write to Nand
Press Enter (send 0x0d)
After that, encapsulated data must be send.

Example : rwfactory 0 460000 20000
Write to address 0x460000 with size of 0x20000.

Be sure you always write a factor of 0x20000 as it is one block and for each write one block gets erased.

Its counterpart is of course command "pdump" which will dump nand.

be carefull with that command :)

What type of magic have you got? 32a or b?

sya,

bart99
[G1 Android Development] 3izz:
Please help !

hi all

please who can explain what should we do

i bricked my magic 32a with access only to radio boot loader (blue led-mode)

what cable should i use and what application to use (psas\qmat __ qpst)
[G1 Android Development] bart9984:
Hi terry,

I used the perl script on my radio image,

oemspl's lenghts differ for 6 bytes only, the output says that it is loaded at 0x00900000 too.

qcsbl.nb is the same of your radio image, also loaded at 0x8000E000 according to diff, but the script says that tehy differs for the QCT_BOOT that should be V622019 for you and is V622020 for me.

elf.nb has the same size of yours but the content differs, I used linux diff command to see that, seems to be loaded to 0x00a00000.

@3izz:

on this thread you'll find the link to instructable.com to built your cable, at the moment there is no way for magic devices to recover after such brick, we are looking to find a solution.

Cheers,

bart99
[G1 Android Development] ezterry:
Are we saying that they are nearly identical in terms of binary content. (I suspect all Dream/Magic/ and many other HTC Devices use the same load points since much code seems shared; but I also expect them modified for the device. But if it is an equivalent binary it may make it easier for switching between current versions of the radio.

Um.. according to readelf 0x00a00000 is the self defined entry point (not surprised the same entry point is on different versions) But it is loaded in many locations not as one block. The pastebin link was my readelf output.. run the same commands on yours if you wish to validate any differences.

Happy hacking,

Terry
[G1 Android Development] allanwinckler:
Hi Bart,

I have a Brazilian edition of the Magic, is:

32B ENG SEC-OFF H (i think this is the problem when I updated SPL, this is the first device i see with 32B H)

sorry, but i'm so stupid with codes, can you explain me what application I need to use to rewrite SPL from Serial, and How to?

Tks Again,

Allan
[G1 Android Development] bart9984:
Hi,

at the moment I can't say you how to do it, I don't know if there is an application to do it but I don't think it. I think you, or someone for you should write a specific application towrite a new spl. I don't know how data is encapsulated, maybe viperbjk knows. However how did you find the spl address 24000000? Are you sure it is correct?

As we are looking for a solution to de-brick magic/g1 devices you should consider to wait untill someone finds the way to do it and write a detailed tutorial

Cheers,

bart99
[G1 Android Development] gymmy:
is there any way to turn security off on a magic if you have a bricked phone ? eg through the AT command set ? Iave made up serial ttl device and it all works very well, now to do some real damage :)

A.
[G1 Android Development] tadico:
hi guys! I'm new to this. I've successfully bricked my htc magic 32a by updating bad radio image. :) I can't get in any of regular modes. Just trackball+power when the blue light appears. I understand you are working to find the solution for this problem. I would like to help. What kind of cables or equipment I need ?
[G1 Android Development] ezterry:
Sure.. using rpass in oemspl and passing it a HTCS..HTCE encoded block with the magic value it expects I believe it will security unlock your phone.

In theory this value can be calculated from rseed's 32hex byte response.

Let us know if you succeed; including how you calculated said magic value..

(If the magic/dream match other HTC phones it is a 32byte string; however the calculation leaked for the other phones used a value from a SPL [hboot oem] command that seems to have been a. disabled on the Dream/Magic and b. requires a working SPL to let you into HBOOT mode)

Otherwise you will need to also have jtag.. You can let people know (maybe in a here as well as create a thread in the magic section) if you find out what the jtag points are on the Magic. (Dream uses see first post of this thread)

(now if you where just trying to sim unlock the device.. I think I did see the AT command to enter your code you can buy online.. not that I see a reason to sim unlock your brick)

Needless to say no one at this point in time no one has succeeded.. or if they did they have not written about it.
[G1 Android Development] allanwinckler:
Hi Bart,

I finded this address on that IRC tread:

ibot.rikers.org/%23htc-linux/20090601.html.gz

Aprox. at 10:06.56

If you can, i will meet with you guys to help to find that solution, i have aprox. 6 magic bricked with the same diagnostic.

Tks,

Allan
[G1 Android Development] bart9984:
hi Allan,

after some investigation we have find out that your values are correct, but seems that only the first 4 bloks contains necessary spl data, so from 0 to 80000 of your offset.

6 magic are many :) if you have one with an irreparable damage (like fried in water) you could consider to use it to find jtag pinout.

@ezterry

i've tried the rpass command, qmat can calculate correct value, but the blacklisted commands didn't been usable the same...
[G1 Android Development] 3izz:
hi all

could this be my magic's jtag pinout ?? 32a !!

I somehow found it somewhere
[G1 Android Development] ezterry:
I promise you that is a dream (now brick)

http://xdaforums.com/showpost.php?p=5774331&postcount=250
[G1 Android Development] gymmy:
perhaps its a good sign that there arent any jtag point, perhaps you dont need it and you can do everything though the serial :) thats what im hoping anyhow :)
[G1 Android Development] scholbert:
Hi!

This is obviously just a wish :p

I'm quite sure that there are also some JTAG testpoints on the Magic mainboard.

Of course the location are completely different, because this is a different piece of hardware. Someone has to trace them....

Back on track:

Here's the NAND layout for Dream which had been sampled during my research.

The addresses relate to the NAND offset, so this is the addressing scheme inside NAND flash...

Take these information without any warranty though :rolleyes:

RadioROM PartitionTableAddress=0x00040800 (NAND PartitionTable)

BlockSize: 0x20000 (128K)
TotalBlocks: 0x800 (2048)
TotalSize: 0x10000000 (256M)

MIBIB: 0
BeginBlock: 0x00000000 Number of Blocks:0x0000000a
BeginAddress:0x00000000 Size of the Part:0x00140000

QCSBL: 10 (QCT_BOOT)
BeginBlock: 0x0000000a Number of Blocks:0x00000004
BeginAddress:0x00140000 Size of the Part:0x00080000

OEMSBL1: 14 (HTC_BOOT)
BeginBlock: 0x0000000e Number of Blocks:0x00000006
BeginAddress:0x001c0000 Size of the Part:0x000c0000

OEMSBL2: 20
BeginBlock: 0x00000014 Number of Blocks:0x00000006
BeginAddress:0x00280000 Size of the Part:0x000c0000

HTC: 26
BeginBlock: 0x0000001a Number of Blocks:0x00000010
BeginAddress:0x00340000 Size of the Part:0x00200000

AMSS: 42
BeginBlock: 0x0000002a Number of Blocks:0x000000c0
BeginAddress:0x00540000 Size of the Part:0x01800000

AMSSEFS2: 234
BeginBlock: 0x000000ea Number of Blocks:0x0000002c
BeginAddress:0x01d40000 Size of the Part:0x00580000

FOTA: 278
BeginBlock: 0x00000116 Number of Blocks:0x00000008
BeginAddress:0x022c0000 Size of the Part:0x00100000

RESERVED: 286
BeginBlock: 0x0000011E Number of Blocks:0x00000002
BeginAddress:0x023c0000 Size of the Part:0x00040000

APPSBL: 288 (SPL_EVT)
BeginBlock: 0x00000120 Number of Blocks:0x00000004 (??? minimum size must be 4)
BeginAddress:0x02400000 Size of the Part:0x00080000

MISC_MFG: 294

SPLASH_1: 296

SPLASH_2: 298

DEBUG: 307

APP: 321

EXTENDED_ROM: 953

I did not calculate the high addresses because they are not relevant.

SPL offset is in fact at 0x02400000 (take care of the all the zero's..)

Cheers,

scholbert