yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] th0br0:
Actually,

if you've got a unlocked radio rom and access the device via serial port, you can indeed debrick it.

IIRC there was a commandlist on the xda wiki for that but i've lost the link.

anyway, once you've hooked it up and, say, got a dev phone, you can connect via serial ... if i only remembered knew that goddamn command, it allowed you to write to the flash via serial

i'm not sure if you can use "help" in that serial console anymore. it's been too long.
[G1 Android Development] he3r0:
that does look like poor copy, though did you try to put it together without mobo? does pins line up? in mine multi-com adapter, one of the pins goes through the mobo, rest is around it...

http://www.multi-com.pl/index.php?itlskel_lang=en_US&itlskel_pgid=details&id_pr=7183
[G1 Android Development] akivlin:
On my multi-com adapter, the bottom PCB (JTAG pins on it) has four small tubes and the top PCB has four pins which slot into the bottom PCB's small tubes.

Are you saying the tubes and pins don't line up so you can't carefully snap it together?

EDIT: Forgot to hit submit post earlier when I typed this. :)
[G1 Android Development] drutort:
the problem is that the large pins are that pins on both pcbs there are no tubes on the the other, they are in the right place, and all i can see the connector pins make contract with points just that i cant close it together

I think my only choice is to desolder those pins on one pcb completely and let the holes be as guides, hopefully that can work?

i am going to contact them and see but seeing as im in usa and this is uk it might take some time :/ but this is unacceptable for an online company to be selling such shabby work
[G1 Android Development] he3r0:
Indeed, if there were little pipes instead or rods, that would work... as for letting holes work as a guides, i think them pins also work as a ground - i may be wrong on this one though. also before you start doing anything check if the jtag pins are actually connected to 20pin.

and on that note, since i successfully unbricked mine, does anyone wants to buy my set? usb->serial with HTC plug, wiggler clone, and G1 JTAG adapter (from multi-com.pl) for $50 shipped to lower 48 states?

I don't see in my future anymore, playing with it.
[G1 Android Development] drutort:
you should have let me know i could have waited, since i bought some locally phones that were like stuck or bricked or water dmg, im trying to get few phones and give to family members as they are stuck on ancient phones LOL and would like a full keyboard

anyway the only thing i could use is probably the serial cable, as i do have this adapter but its not 100% from examining it it seems that all is good and right but the tubes that are on the main board, they are even the right thickness but they are not tubes as the supporting board with that 1 contract point has thinner roads.

My guess is this is a clone made in china and they havent even tested it or someone seriously was lost/drunk and put rods and not tubes on the main pcb

as far as ground there is one or 2 that is made to touch ground others are isolated and only are guides

==update==

here are 2 more pics

http://i26.tinypic.com/2upbbm0.jpg

http://i26.tinypic.com/28urz8.jpg
[G1 Android Development] drutort:
i ran into a topic or a thread were they were advertising even changing imei changing/repair

so if these guys have there software that can do it its possible, and im sure its possible to unlock the phone with jtag as well (i could be wrong :P)

http://forum.gsmhosting.com/vbb/f47...qualcomms-such-g1-g2-g3-15-06-2010-a-1024972/
[G1 Android Development] ezterry:
I did see that.. yes if they can change the IMEI they can update the security flag while in there.. however there be thin ice in the first operation.

Still a JTAG not a serial only solution.
[G1 Android Development] radiano:
Can someone help de-brick my G1?

Hi everyone,

I believe I bricked my phone after trying to 're-root' it. I did apply the latest radio before applying the death spl. But after applying the death spl, am stuck at the G1 screen. Can't boot into recovery or fastboot.

From reading several posts on this thread, I know that its possible to de-brick the G1. My question is:

Is there anyone who wants to help out de-bricking my phone? I don't have the necessary tools right now.

Apologies if this is the wrong question for this thread but I would appreciate a helping hand.
[G1 Android Development] afoster1003:
I believe I bricked my mytouch 3g 32b updated spl without radio Im willing to send my phone and pay to have someone that is experienced with this jtag process unbrick it for me. Pm me
[G1 Android Development] drutort:
very interesting, but i wouldn't be surprised if its just regular jtag and there 6 months of work is all in coding a nice GUI and R&D as far as testing with devices etc... would be very interesting for someone to get that and take it apart and see just what chip is running on there jtag

though i just browsed at the manuals and it looks like there jtag is prob some generic jtag solution that is just with Ethernet and usb support, but just looking that that jtag has those ports u know it will cost an arm and a leg for the hardware... this will def not be for a DIY type of person... though would be nice to see if its possible to hmm mod or have the software recognize other cheaper jtag hardware solutions...

my guess for price was from $100-250 guess i was close.. $150

http://www.narrygsm.com/narrygsm/node/95

for "small orders"
[G1 Android Development] stewdk:
Mytouch 3G 1.2 (3.5mm jack) unbrick attempt

I have two Mytouch 3G 1.2 (3.5mm jack) phones. Both of them show (SAPP31000) and CPLD-13 at the hboot screen, but JTAG reveals that one has _CPUTAPID 0x201700e1, and the other has _CPUTAPID 0x301700e1. Does anyone else think this is odd? Anyway, I successfully unbricked both of them using ezterry's de-brick procedure. Thanks to ezterry and everybody who helped for their hard work.

Somehow I ended up with the stock rom on the one with _CPUTAPID 0x301700e1, and I'm too cheap for the T-Mobile data plan. In a gold card root attempt I flashed something bad (i don't remember how), and I kept getting INFOsignature checking... FAILED (remote: signature verify fail) when trying to fastboot anything.

So, I went down the JTAG route again. The radio flashed fine, and the hboot image loaded into memory just fine. In other words, everything seemed to work just fine up until I typed the cego command, I got the following:

ARM11 Boot Mode: 0

Platform: HBOOT-7201A

[ERR] partition_read::Failed to read page 19072 or it is empty

###[ Fastboot Mode ]###

The phone goes into fastboot USB mode (with three androids on skateboards), but I still get the FAILED (remote: signature verify fail) message.

The detailed results can be seen at pastebin.com/Mk7HJMJy

It blows my mind that the exact same procedure worked on the exact same phone before, but now I just keep getting the dreaded signature verify fail message.

Any ideas?

Thanks.
[G1 Android Development] ezterry:
Odd, well two things come to mind:

1) you accidentally softbooted the fender spl: 1.33.0013G instead of 1.33.2009, you will need to return to 1.33.0013g when flashing a rom to keep everything working but for now we need fastboot on 1.33.2009

2) you have 1.33.2009 but somehow s=on .. I have not seen this personally but have heard of it happening on these engineering spls.. if this is the case fastboot boot may still work and we can clean up your internal flash via recovery + adb..
[G1 Android Development] bestrafer:
I'm de-bricking another one G1.

- loaded radio radio-3.22.26.17

- set security flags and got into fastboot mode after 'cego'

- but it turned into G1 black screen, I was able to do all fastboot commands though.

- after applying "fastboot oem powerdown" command I'm unable to boot into fastboot or hboot mode - stuck in G1 screen.

Any ideas?
[G1 Android Development] ezterry:
When we softboot 1.33.2005 (dream) 1.33.2009 (magic) it's common to see the splash screen and fastboot, this is because I'm forcing the logic into fastboot after the misc partition is read and the phone decided the background to display.

As for being stuck after the fastboot flash, are you sure you flashed 1.33.2005 spl and -R recovery?

Also what is the output to the serial line when trying to boot (debugging and validation things worked correctly is why you needed to build it)
[G1 Android Development] bestrafer:
somehow there was a recovery-RA-dream-v1.6.2-green.img, instead of recovery-RA-dream-v1.6.2R-green.img

Thanks again ezterry )
[G1 Android Development] afoster1003:
anyone with success willing to give mine a shot if I send it??
[G1 Android Development] stewdk:
MT3G 1.2 (3.5mm jack)

I was definitely softbooting spl 1.33.2009. I also tried spl 1.33.2010 and 1.33.2004 by Crios with same results.

You made me curious, so I did try softbooting spl 1.33.0013, but in this case 'fastboot devices' didn't even recognize the phone.

I tried both 'fastboot boot recovery-RA-sapphire-v1.7.0G-cyan.img' and 'fastboot boot recovery-RA-sapphire-v1.7.0H-cyan.img', but the phone only vibrated once and the screen still showed three androids on skateboards, nothing more happened.

I heard rumors that this phone won't boot kernels unless it has the stock radio firmware and/or SPL...

So after spending some time (actually a lot of time) with gdb and a hex editor, I found the offsets for the security flag check, and the NOP in the cego command for radio version 2.22.23.02:

mww 0x0090398C 0xea000013

mww 0x00902B2C 0x00000000

I lost USB sometime along the way... It may have been after I flashed radio 2.22.23.02 with radata, or it may sometime earlier.

Softbooting spl 1.33.2009 still gives s-on, but I was able to load a sappimg.zip from the sd card. It didn't load all the way (Fail-PU), but at least it loaded the stock bootloader, radio, recovery, and splash image, so I could possibly continue from here without jtag... I'm going to give it a rest for now though cuz my brain hurts.
[G1 Android Development] scap2000:
De-bricking G1

Hi all, I'm trying to de-brick my G1 and I have a couple of questions

Scenario: I'm trying to connect the miniUSB Serial via the HTC original wire (from headset) because I have no way to get an "HTC ExtUSB Breakout board" (I'm in Argentina) so I connected the wires to a MAX232 Serial Level Converter (following the schema found on Cyanogen's JTAG page, MAX232 Serial Level Converter) to a DB-9 serial port COM1 on a PC.

Question #1: Do I need to attach JTAG Interface for the Serial Connection to work or it should be working also without JTAG? (I tried over HyperTerminal on Windows WITHOUT JTAG and have no response from the device in Blue Light Mode)

Question #2: Can I replace the DB-9 connector and use a DKU-5 (from nokia, following this instructions from "Serial COM port in HTC proprietary USB") to get the "Serial Over USB" connection to work?

And the final question #3: I have

another

G1 mainboard with no response (can't recharge battery, can't get the "Blue Light Mode"), is this just trash or can I fix the mainboard?

Thanks in advance.
[G1 Android Development] he3r0:
ad1-> should work without JTAG

ad2-> you can try, i think there is somebody on this thread that actually did used DKU5 form Nokia.

ad3-> i would say trash, unless you can plug JTAG and get response from there, than there still may be a chance..
[G1 Android Development] ezterry:
@he3r0 beat me to most of this but:

Ordered online from sparkfun like everyone else (even if you do have a local electronics store that is willing to sell it to you its likely they will order it from sparkfun..) Their shipping (to Argentina) is even more reasonable than multi-com [provider of that solderless pcb].

However don't take this as a recommendation not to modify parts you have on hand for free just that its not impossible.

The serial doesn't need the JTAG to work (on non bricked devices you can even access the serial port form linux and do with it as you will.. ra-recovery sends debug messages to the serial; The SPLs has its own debug + command line; and oemspl [blue light mode] has the cli interface.. )

oemspl however will not echo; so you have to press enter to get any responce; 'checksum oemsbl' + <enter> usually responds with the CRC32 of the current oemsbl image in flash. '?' and other random input will usually say 'Invalid Command' Of course many commands and the ones we need are locked so we do need to use JTAG to access them.

... if it outputs 2.8 or 3.3v TTY serial and you attach it correctly; and can get your computer to consider it a serial device.. it will work.. if you can't get all of that you either need to "convert" it or use a different solution.

hrmm.. well oemsbl seems dead at least .. if the processor responds to JTAG there may be hope.. but there is as of yet no open solution for you. (and the closed solutions cost more than its worth unless you have a stack of them in this state)
[G1 Android Development] scap2000:
he3r0, ezztery, thank you very much for your time.

I'll give a re-try with te DB-9/MAX232 interface, if you want to I can post pictures or schematics from my (poor) work. Could be enough +3V for the Max232 or mandatory +5V?

I can't get a 74VLC245 for Wigger Clone, but I got the 74HC245, is this the same or will I need to use Zener diodes to reduce voltage?

Thanks again
[G1 Android Development] he3r0:
hey, i`ve used (succesfully) this one ->

http://cgi.ebay.com/Low-cost-Wiggle...-Debugger-/350348768870?pt=LH_DefaultDomain_0
[G1 Android Development] scap2000:
I can't get that here, that's why I'm trying with the 74HC245. Which is the maximum voltage level the HTC Dream JTAG port supports (or tolerate)?

UPDATE:

As it is so damn hard to solder and make the JTAG works, I'll give up with JTAG, soldering on this tiny-micro-mini points is too hard for me, I got the wires soldered for a moment, but then I was unable to connect the flex plus the serial port plus the battery plus powering-on in blue-light-mode. But I have to say, I got some achievements:

I get connected to the serial interface but after making slightly modifications to the MAX232 Circuit, because it was wrong (it made

short circuit

to my friend's adjustable power source), just using the original headset wiring, without cutting (I opened the commands and figured the pinout with a tester, just three wires needed). I executed some commands succesfully but can't de-brick as you can imagine. So if someone has it's own "magic" to de-brick a phone with Haykuro's DangerSPL via the Serial Port just gotta let me know :-)

Well people, thanks for your time and for reading this, I have a friend in USA, so I will try him to get me a broken G1 or a brand new mainboard. Do you have some addresses to get this? I think it's hard to get this too, isn't it?

Thanks again
[G1 Android Development] scholbert:
Recover corrupt radio images

Hey,

still got two mainboards with bricked radio image (stuck in qct_boot).

Anyone else thought about this already:

http://xdaforums.com/showpost.php?p=6447478&postcount=611

To make it short... a GPL'ed debugger with MSM NAND support would be very nice.

I must admit that right now there's a lack of time to do it myself.

Maybe during winter times :p

Any suggestions are welcome!

Regards,

scholbert
[G1 Android Development] DrVladson:
Hello

I have killed by radio HD2.

Is it possible for him to make a JTAG adapter, through which the right to flash a bootloader?

I apologize for what I write is not quite in that theme, just not anywhere else is not discussed.
[G1 Android Development] scholbert:
That's right we're talking about HTC Dream (G1) and stuff.

So the solution discussed here are very specific to this device.

HTC Leo (HD2) is a completely different hardware.

So it is out of focus here :rolleyes:

For using JTAG on that device you'll first need the dedicated testpoints.

Depending on the kind of brick, it might be possible to find some solution with a working debug environment.

Anyway you might tweak and/or debug+reverse engineer parts of bootcode.

I would recommend to open a new thread in the HD2 section and start some discussion. There might be also some commercial solutions.

Search the web for ORT forum!

Regards,

scholbert
[G1 Android Development] lbcoder:
I think it is DEFINITELY time to start looking at that approach now. With the Vision coming out soon, it may be time for an upgrade for a lot of people.

I have some ideas about disabling the integrated radio altogether in favor of a USB device. This would allow us to reclaim the RAM that is lost to the radio. You know, slapping redboot on that sucker and an external modem? 192 MB of real ram! But we'll need a way to manipulate the nand more directly to make this viable.
[G1 Android Development] glorp:
I just spent hours soldering together a nice tiny JTAG adapter that fits inside a DB-25 shell.... and then I went and lifted one of the solder pads off my 32A Magic mainboard. Specifically, the TDI pad. Does anyone know of an alternate location for TDI on the Magic? I looked at the board and I can't see the corresponding trace at all so I can't follow it visually to another pad. I think it's either covered by more epoxy or on an internal board layer.
[G1 Android Development] marchard:
To me it looks like, that TDI goes directly below the cpu package (i have a 32b in front of me, but i think this part equals to the 32a - but no guarantee! Someone can confirm?).

this means, the track is not in one of the inner layer, but on the surface. and that means, there is a tiny little chance, that you can connect to that trace. Take a razorblade or something tiny and sharp and try to remove the upper protection "paint" (sorry, don't know the right word). Be very carefull and very gentle! Don't scratch the surrounded area. Don't scratch too deep - you could loose the last bit of yout TDI-track!

Good luck!

Tip: try to fix your cables after soldering with some tape or whatever to minimize the forces of the pads
[G1 Android Development] scap2000:
HTC DREAM Service Addresses

Hi again, I have a friend who's going to New York next week, anyone has addresses for HTC G1 "Dream" service/repairing/parts?

I have two G1 Dreams: one with a BRICKED mainboard and other with a MELTED mainboard.

Here's the trick: My friend is gonna stay just for four days in New York, near Manhattan - Times Square.

I think I'll need to get two brand new mainboards at low price at best ETA

Anyone could help me either with Lat/Longs or addresses?

Tank you very very much.​
[G1 Android Development] ezterry:
Xda has an entire forum for you called the market place... this thread here for DIY jtag debricking and related hacking..

Also most of us here are more likely to have extras of everything but a working main board..
[G1 Android Development] sensimila:
I have an extra board recently bricked. I am willing to donate it to anybody who wants it. Just pay for the shipping. PM me if you want it.
[G1 Android Development] marchard:
Magic 32B 2.6V ref voltage test point

Question (perhaps i read it over): is a confirmed 2.6V reference voltage test point at the Magic 32B board known?

Thanks in advance!
[G1 Android Development] marchard:
Question: Headset for serial cable

Sorry, another Question: Has somebody already used a shipped htc headset as "adaptor" / breakout for extusb?

I just opened up a shipped htc headset. from: http://groups.google.com/group/andr...88a09/10a80eb835e8dbcc?lnk=gst&q=serial&pli=1

| A B C D E |

\1 2 3 4 5 6|

A: GND (headset: thick blue?)

B: NC

C: +DATA

D: -DATA

E: +5v

1: +Mic (headset: white)

2: +Right (headset: red)

3: Switch / Rx / CABLE_IN2 (headset: green)

4: GND / Tx / CABLE_IN1 (headset: copper?)

5: GND (headset: shield of 1?)

6: +Left (headset: blue)

Pins A, 4 and 5 are all tied together : /

So i guess this means i can't use the headset as a extusb breakout :mad:

Am i right?

Ciao, Marc.
[G1 Android Development] bart9984:
Hi,

I used an headset cable as breakout, so you can do it. What i did was to physically disconnect the usb's gnd pin (because as you said it is in corto with tx) to do that i removed the contact from the ext-usb. The connection between

rx and usb's gnd in not accessible on the headset circuit, so to solve the problem you must remove the usb's gnd contact (The contact A accordind to your schema). In this way when you plug the cable to the phone the A pin of the phone don't find any pin and there is no contact to the tx pin via the corto.

In my case there was no cortos between pin 4 and 5.

As ground for the serial cable i used the pin 5 (according to your schema - I've not the cable here so I can't check it to confirm which is the pin, but I used the gnd from the pins 1-6)

here there is the original post where I wrote how i made my cable

http://xdaforums.com/showpost.php?p=5556303&postcount=109

Here the pins are enumerated in a different way, to see how check this link:

http://shop.kineteka.com/Products/93-htc-extusb-male-11-pin-usb-connector-style-1.aspx

Cheers,

bart99
[G1 Android Development] marchard:
unidirectional htc serial link :/

Thanks for the help bart!

I build up a levelshifter, but somehow its working just halfway...

Powering up in blue led mode i get:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE1

Looks ok to me, but it seems, that i can't send anything... no respond to anything, no "invalid command"... :confused:

Any suggenstions, except: check your serial cable? (i will!)

OK, enough for today... seems, that i'm not that fast than you were...

(my respect to the crew who developed that hack step by step! (somehow i wish, i bricked my magic a little earlier ; ))

Ciao, Marc.
[G1 Android Development] bestrafer:
This might help
[G1 Android Development] marchard:
Thanks bestrafer, but how did you get rid of the hot glue or what ever covers this little pcb? I assume the pics you posted show the ExtUSB of a headset?
[G1 Android Development] bestrafer:
yes, you're right - there was some kind of glue, removed it with knife and soldering-iron.
[G1 Android Development] robuser007:
Does an Amontec JTAGkey-Tiny (works fine with OpenOCD) also work? (it's pretty cheap, around 25-30€). What's are the needed config lines for it?

edit: Is there any jtag that I can get here in Europe? (Belgium?), amontec asks 25€ transport (Swiss).

edit2: I'll buy something else
[G1 Android Development] robuser007:
Anyone had any luck with an Low-cost Wiggler ARM JTAG adapter (ocd compatible) ? (around 15€)

http://cgi.benl.ebay.be/Low-cost-Wi...149?pt=LH_DefaultDomain_0&hash=item255aaf55c5

Do I need a parallel port on my pc (I think I have an PCI card for that) ? Is it difficult (in comparisation with usb jtag)?

Do I need to lower voltage too?

The HTC wire: connection between the microusb connector and the jtag itself(or microusb-PC?)?

I hope anyone could give me the answers (I'm not that familiar with jtag).
[G1 Android Development] scholbert:
Someone already pointed at this adaptor... and i gave some comments on this.

Just can't find it right now please do a search in this thread :o

So.... yes this should do it!

What do you think could be connected to 25-pin SUB-D...

LPT port

No basically it the same... you'll need a config for LPT of course.

The adaptor will be powered with Vreg=2.6V from the mainboard.

:confused:

Bit limited in time right now.... what do you mean?

Regards,

scholbert
[G1 Android Development] Flandro:
Wow, all you guys are incredible smart. I would never be able to do this even if I followed the steps exactly. (I don't even understand what half the steps mean). I have a bricked G1. I flashed a bad radio or something. It happened months ago. Cannot enter recovery. Get the blue light. If anybody that has done this and has the equipment, you feel like making a few bucks? I'm willing to fork out 20 bucks to somebody that I can ship my G1 to for fixin. I will pay all shipping and everything. Please shoot me a PM or email me at mikefsimmons at gmail dot com. Thanks in advance.