yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] lbcoder:
You didn't get what I mean. In the standard unbrick, the JTAG is used to bypass the security check -- the actual unbrick process is done over serial wire (which can be done externally). So if the security was disabled at the flash level, you would be free to brick it and then would be able to repair it from bluelight mode with JUST a serial wire.... take the scary out of SPL. :D
[G1 Android Development] sangeet.003:
Even what i think is when the hardware is made, It won't actually have even the radio, so how do they put the Radio in it ? that's what then may be used to put the other softwares in d hardware like the SPL...

So isn't there a way to write/change the radio/spl in the way its been done on the plain hardware ?

If thats what happens, there are various HTC Devices running Similar CPU/Boards

which if we can, we will be able to load other OS like WM on our Android OS Devices..
[G1 Android Development] ezterry:
They have many tools to test and flash the phone every step of the way..

chip can be partly flashed before assembly; JTAG can write [directly] to flash; there may be another direct interface as well; once a radio is installed (assuming the device is security unlocked initially) flash can be read/write from blue light mode and other tests performed from the serial console; once a SPL is installed either SPL debug functions or diagnostic programs can be executed. and a system flashed.

All boards I've worked on seem to have pin marks on all test points (including the jtag ones) indicating they do use them to test the board and ensure everything works.. Also I've seen boards that seem to have some rework done (swapped flash chips and the like)

As for similar devices.. if we look at the SPL 1.33.2003 we can see it knows about:

board_trout/DREAM

board_sapphire/SAPPHIRE

board_hero/HERO

board_blackstone/BLACKSTONE

board_hero/TOPAZ

(odd TOPAZ and HERO both called board_hero??)

I can't promise you what radios will boot on which board for 1.33.2003.. so I'd not experiment flashing without JTAG.. I do know 1.76.2007 (the 6.x hero/sapphire SPL) knows about the Dream.. but my JTAGed T-Mobile dream failed to load any SPL with the 6.x radio without prodding; I was able to soft boot the SPL.. but it failed to boot the SPL normally .. despite loading it into ram.. must be some failed validation in that loader function I nop out for the soft boot.

In addition this is only asking what the radio/SPL runs on.. it fails to take in account the smart phone's firmware's comparability with the actual hardware. (ie can you actually boot the operating system and will it have access to all the hardware)
[G1 Android Development] scholbert:
Sure i got you... you just were two steps ahead :p

For the mass product it is most likely that the NAND chips got pre-programmed with some kind of gang programmer, get some marking (colored dot) and then are soldered on the mainboard. This is a usual procedure in mass market.

Further i guess that the final setup (setting SN, IMEI, calibration data etc.) is done during end test of the whole unit.

If the software is capable to drive all components, this is it :rolleyes:

Nothing to add, nice description as always... :D

Yupp, seems that most of the SPL floating around are multi platform.

I also realized some debug information in the binary files that mentioned other devices of the HTC family.

AFAIK there are some ID's stored in hidden flash sectors which are requested by the SPL to basically identify the platform. Some parts of hardware are detected during runtime (probing display chip, read CPLD id, ....), because they might change during lifetime of the product.

Best regards,

scholbert
[G1 Android Development] drutort:
im using the driver http://www.freddiechopin.info/index.php/en/download/category/4-openocd running this on old xp box

i can get serial to show ?

but the wiggler isnt working right :/

if i do openocd -f wiggler.cfg ill get

C:\Program Files\OpenOCD\0.4.0\interface>openocd -f wiggler.cfg
Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
parport port = 0x378
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
Error: missing privileges for direct i/o
Command handler execution failed

so i run the bat install_giveio.bat so running same openocd -f wiggler.cfg i get:

C:\Program Files\OpenOCD\0.4.0\interface>openocd -f wiggler.cfg
Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
parport port = 0x378
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
Info : clock speed 500 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Command handler execution failed
Warn : jtag initialization failed; try 'jtag init' again.

and i checked its on LPT1
[G1 Android Development] scholbert:
...says it all.

1. Is the LPT adaptor connected to your device?

2. Did you power up your device?

....

Please read the *** thread..... even if it's long....

Good luck!

scholbert
[G1 Android Development] sangeet.003:
So From this what I Think U want to say that a Device/Board made is generic over some Phones N even the SPL is generic...

Just the difference might be some ID Set into the Hardware which would tell the SPL weather to accept Android / WinMO

Using that ID the SPL would verify the given firmware...

Accessing that ID would open new doors to OS Changing techniques...
[G1 Android Development] scholbert:
Hi sangeet.003!

Perhaps this was a little bit missleading...

The SPL is somewhat generic, just follow ezterry's explanation.

The hardware differs more or less within the series of devices.

For example the Dream and the Magic have many parts in common.

So some basics might be very similar, e.g. the core system with memory interface, power management, GSM part.... and so on.

The most obvious parts that differ are the GPIO usage/assignments and connection to peripherals (e.g. backlight driver, battery charger, wifi, display).

Of course there's alot more, it really depends on what you trying to compare :rolleyes:

Don't think too much about this magic ID.... it's obviously the OS image itself, you'll need.

If you like it and we speak about WinMO, you'll need an OS image that suits well to your platform, e.g. someone needs to create a BSP for Dream and compile the kernel and drivers to fit the peripheral interfaces (very simple spoken).

Many parts from within your OS filesystem maybe multi platform.

This is what most ROM cookers do, they take higher level libs and apps form one device image and put it into another.

Cooking with ingredients :D

The ID itself would not bring up the OS...

Regards,

scholbert
[G1 Android Development] drutort:
got it fixed... i think the g1 jtag adapter was getting lose OR my other worry was that the pins are very close to the shielding, so what i did was put clear tape to cover the shield/ground area

but now im getting stuck after running that and it said it loaded after like 3000 sec :/ when i return to do the "radata 103B5300 01500000" in the terminal (hyperterminal windows) i get no reply, and if i do the ? i get nothing too :/ is that normal?

all the keys on the front (home, back call end etc..) are on...

update =

i think my bat might have gone low, or something else happened in the process after the download... but i checked i still have serial connection to the mobo, though it shows that the radio i think is gone, as i had this mobo before go into hardspl just that it was the strange one as i stated before in one of my threads, no way as it kept refusing the img (discussed in other thread) anyway will try again though switching to linux distro, i cant stand this box with winXP and OpenOCD for some reason took like 1.6g of vm/swap O_o while doing the downloading of the radio...
[G1 Android Development] robuser007:
Maybe a silly question: do I have to connect my main board to the battery (jtag/lm317 gives the power to the phone?)?

I'm using lm317.

I have received my jtag adapter for the g1 today, so I'm going to test if I can have a connection with my jtag.
[G1 Android Development] robuser007:
Can't get it to blue led mode: no respons.

It's because of those 2 little black com1-com2 wires that need to be connected (but how do I attach the adapter with those connected :s )

Suggestions?
[G1 Android Development] robuser007:
Never ever buy the adapter: it's crap: it doesn't fit well, it doesn't give a decent connection.
[G1 Android Development] ezterry:
You don't need those com wires to enter blue light mode (well you won't see the blue light but it will boot oemsbl w/o the screen attatched)

If you have the serial wire watch the phones output it will clearly show you when the radio boots.

The battery is always required to boot the phone however..
[G1 Android Development] robuser007:
I don't have the serial wire yet, I want to test the connection of the jtag first.

I can't get the battery between the adapter, How do I let the battery stay connected (tape?)? which tape should I use?
[G1 Android Development] robuser007:
another guess:

openocd -f where is it, must be compiled first (doesn't work on windows)?

now start open ocd: from the directory with the cfg file run:

openocd -f <dream|magic>.cfg
[G1 Android Development] drutort:
you shouldnt have to much if you got a wiggler clone for example... cause they have a config for that already in openOCD

TBH windows ver of openOCD i think might be buggy... im going with a linux distro today and see how things go... the windows terminal is crap and was not responding one time after i had downloaded (or i should say uploaded the radio to the phones ram) so i had to start over... and it takes about 1h with the wiggler clone that i got so its very long process :/

all the q that you have can be found by searching though cause i found those answers here in this thread and in the wiki....
[G1 Android Development] bestrafer:
Does anyone have a Schematics Diagram for G1?

(which could be used as a guide in troubleshooting or fault finding in hardware problem Issues)
[G1 Android Development] lbcoder:
No official schematics are available. There is an xray image buried in this thread though....
[G1 Android Development] drutort:
would it help you if you had a G1 mobo at your disposal? i have one mobo that i couldnt save well it was partially working but then after i did a clean up some of the components were too dmged from water/minerals and they came off or corroded some of the contacts

there are 3 areas (by the jtag vref area, and on other side of the mobo, then there is one cap/resister that is by the vibration motor) on this mobo that i have that i seen with a microscope but i dont know that much on the components and sms soldering is a pain... so i dont wish to do it, besides looks like one of the components if not more chips are power related hence why the corrosion took place IMO

so far I have debricked all physical working mobo's and some that seemed dead (and were water dmged, did a good cleaning processes simply with 91% rubbing alcohol) no led not even blue mode led, and that strange one that had its parameters wiped some how, now i have to hunt for the sticker and put the right serial on it as it was like set 123456789 by someone... ( i have a whole thread on the process and what took place that evt1 which was i guess nothing special and i got it changed to pvt)

anyway the mobo did work until those points went bad, the vref reads all wacky so no jtag ability unless maybe supply the mobo with your own external 2.6v? and the jtag?

you could use a board like this to take off components and trace i would assume... to a degree
[G1 Android Development] stewdk:
So far we've only been able to debug the ARM9 core on the G1/Magic via JTAG.

OpenOCD only reports the ARM9 TAP on the scan chain. Is there any information on how to debug the ARM11 core? Perhaps another pin(s) is needed for this?

If it's not possible to find the ARM11 core on the JTAG scan chain, then how does HTC debug the bootloader? The only way I can think of would be that HTC has some proprietary debug solution that relies on the radio firmware (ARM9) in order to debug the ARM11 core...
[G1 Android Development] ezterry:
The jtag points are correct; you just need to in addition attatch a small resister matrix to some of the mode pins on the CPU to see other TAPs.

OP post has in theory traced some of the mode pins and some additional documentation exists on the processor that tries to describe what pins to be attached and how..

Otherwise for debugging there is always printf to serial and you can still see the SPLs ram from the ARM9 (not as easy to halt/resume I admit)..
[G1 Android Development] marchard:
Another successfull debrick of Magic 32B

A big THANK YOU to all who helped to make this possible!

I would like to report another successfull debrick of a Magic 32B, done with the information provided in the jtag wiki and this thread.

I would like to give a hint for people having problems establishing jtag connection with a wiggler clone (like i had with a "anvilex" wiggler clone): Play around with TRST. In my case i had to

tie TRST to 2.6V

and everything worked like a charm like described in wiki.

Thanks again! And good luck to a of you an your way to a debricked Dream/Magic.

Bye, Marc.
[G1 Android Development] Nuxil:
I've also bricked my HTC Magic. I would like to use a JTAG, but they are so expensive. Is there a way to get a JTAG cheaper?

I dont know what to do, maybe i'll try to sell it on ebay as broken.
[G1 Android Development] scholbert:
Hi Nuxil!

Perhaps you should get familiar with the search function ;)

If you search this thread for keyword "wiggler" you'll find a lot of information about cheap and useful adaptors for LPT port.

BTW, i once posted a schematic for a DIY buffered adaptor compatible with OpenOCD:

http://xdaforums.com/showpost.php?p=6055979&postcount=412

Maybe this would be a good idea if you're a complete noob in electronics...

Aynway good luck and best regards,

scholbert
[G1 Android Development] scholbert:
Thanks for appreciation in general.

If you have enough time, step through the thread and try to understand how things work out. I would recommend to use a linux host to start working with JTAG ...

To make it short... start here:

http://xdaforums.com/wiki/index.php?title=JTAG_Softboot_for_Magic_and_Dream

Regards,

scholbert
[G1 Android Development] stewdk:
I used Cygwin to compile and run OpenOCD on windows. See hxxp://claymore.engineer.gvsu.edu/egr326/LM3S6965

for instructions (replace hxxp with http, scroll down to the "Debugging" section).
[G1 Android Development] marchard:
I used precompiled version of OpenOCD for windows - also worked out (http://freddiechopin.info/index.php/en/download/category/4-openocd

Bye, Marc.
[G1 Android Development] Alfbox:
This question has already been asked, but the answer seems not.

Is it possible to unbrick (DangerSPL on 1x radio) my Dream using TRST-N and TDI from AUX_JTAG and TMS,TCK,TDO from JTAG on other side of board?

Unfortunately there is no non-AUX TRST-N and TDI joints anymore :(

Thanks.
[G1 Android Development] scholbert:
I guess this won't be possible, you can not mix the signals to get access.

The primary and the auxiliary JTAG port are seperate interfaces connected to different logical units.

E.g. with all mode pins set to low (which seems the default setup) primary JTAG connects to ARM9 core and auxiliary connects to ARM11 core.

Some more details on this:

On the Dream the ARM9 (baseband) core acts as the master core of the MSM7200, which is able to block access of certain memory regions for ARM11 (application).

So in fact ARM9 is controlling the memory system from the very start.

As a result, even with access to ARM11 core over auxiliary JTAG, it might be impossible to re-write SPL or certain regions of NAND.

The solution we are using here, makes use of ARM9 code areas.

...right now, no de-bricking without ARM9 access through primary JTAG.

Regards,

scholbert
[G1 Android Development] fsl13:
After JTAG Halts at G1

Hello Guys

I took this G1 DREA210 from rogers to a friend finally and he managed to JTAG it using

His Furious BOX and UFC attached and managed to JTAG it. But unfortunately when

he pressed the power button the Handset started at G1 Halted and as soon as he

released the power button, it went dead again. And so... we repeated the procedure

but same problem....

I mean i am so fed up!!!.....

What tH3 *#&@^$@*#&$)(*&

Please tell me whats happening???
[G1 Android Development] alexbrickwedde:
Determine Radio version

Hi,

i found that in AT-Mode (going there with "GO2AMSS") on "AT@V" my magic replies with "2.22.23.02". Isn't that the version of the radio? If so should i update the wiki so that others can find out their radio version?

BTW: RTCK is shown on the picture, but the wiki doesn't mention it. Do i need it? (It was really hard to solder this wire! I had to remove part of the shield to get there and the "glue" wasn't melted by the iron. With 450°C it started to dissolve into "crumbs")

...Alex
[G1 Android Development] marchard:
You don't need RTCK, even if its shown in the picture. Just connect, what the wiki says. In some cases TRST-N has to be inverted/tied high (depends on your JTAG adaptor).

Bye, Marc.
[G1 Android Development] sabo2000:
Hard brick

Anyone want to try this, I have a hard bricked G1, Cannot get to recovery, bootloader, or fastboot! I do not have the knowledge to try, would love to try, but, I am sure I would do more harm then good. I also do not have the resources.

Anyone want to just PM me.

Thanks,
[G1 Android Development] alexbrickwedde:
cable length experience

Hi,

just wanted to report: i had a similar error. I started with nearly 1,5m of ribbon cable (parallel port was too far away) and 0,15m of 0,1mm magnet wire (is it correct word for "lackdraht"? google told me so, i would say coated wire). now i've attached the magnet wire directly to the 0,5m long ribbon cable of my anvilex adapter. JTAG is working now and in this moment radio is being loaded to ram...

...Alex
[G1 Android Development] alexbrickwedde:
success!

last night at 2:00 am i got fastboot running again (loading the radio into ram via wiggler took slightly over 1h), just now i have a running EBI0 recovery. i will decide which rom i want to use and then be back online...

big thanks to all the supporters on this thread!

...alex
[G1 Android Development] doktorx:
Hello, I have Brick the T-Mobile G1 UK 32B and I made a JTAG wiggler clone ,I turn blue light, but not write any commands to something happening .Only when I press the power and everything is connected, that lists my Mtty write.

ARM9_BOOT_MODE0, Boot Linux

flash 16 bit

-msm_nand_probe

[MDDI_HW_ERR] mddi_send_rtd fail!!

[MDDI_EID] mddi_eid_probe enter.

[EID_HW_ERR] mddi_eid_probe: Unknown panel type!!

Board_PID : 0x1F

Wlan data header ++++++++++++++++++++Signature : 0xEE1251

UpdateStatus : 0x2

UpdateCount : 0x2C89

BodyLength : 0x2F0

BodyCRC : 0x5FEED6A0

aDieId(0) : 0xB8014008

aDieId(1) : 0x24100A84

aDieId(2) : 0x20000000

aDieId(3) : 0x623A

countryID : 0x30

Wlan data header --------------------------ARM11 Boot Mode: 3

Platform: HBOOT-7201A

I do not know what I'm doing wrong, can someone help me please?!
[G1 Android Development] jax318:
Brick G1

Hi All,

I have a brick G1 (UK Based)and would like someone to fix it for me as i don't have the resources to do so. Please PM me if anyone could do so

Thank you
[G1 Android Development] marchard:
Do you get an "invalid command" when sending something with a terminal over serial cable? If not, something is wrong with your serial cable (independent from wiggler).

What kind of serial cable/level shifting do you use?
[G1 Android Development] doktorx:
Yes "invalid command" when i sending something(?,n,C, h,....) with a terminal over serial cable, but if i sending C:\Program Files\OpenOCD\0.4.0\interface\openocd -f wiggler.cfg nothing will happen and nothing does not write :-(

Data cable is DCA 110 - USB for BenQ Siemens E71 with rs232 converter, .........next side is MINI USB for headphones HTC- pins 3-RX 4-TX, 5-GND -

ABCD pins not connected.
[G1 Android Development] alexbrickwedde:
gps not working after de-bricking

Hi,

last weekend i de-bricked my sapphire 32B. but now i noticed that gps is not working. i get no errors in the ui, but also no values. in "gps status" app i see 0 satellites, not even a single level on the channel overview.

after debricking i flashed Official AOSP 2.2 by ezterry, but then i read that gps may not work, so changed to SuperF, but there may also be a gps bug, then i flashed cm6.1 RC1 and finally cm 4.2.6

is it caused by the radio or can it be a physical error? i double checked all connections.

...Alex
[G1 Android Development] ezterry:
Gps is fine.. agps maybe not so much.

Sounds like the antenna.. but make sure you have a clear view of the sky and agps dissabled .. then test after checking the antenna wires/pads again and that everything is tightly connected.
[G1 Android Development] alexbrickwedde:
already checked connection twice. i only remember a single coax cable, or have i overseen one more?

i just looked at the raw nmea, it gives me many lines "$GPGSA,A,3,,,1,1,1*2D" and nothing more. so at least the chip should be working...

tomorrow i recheck connections again (why are there two pads connecting to the gps-antenna ?).

...Alex
[G1 Android Development] Difool80:
Hi,

I'm trying ton un-brick my Magic 32B with Olimex ARM-USB-OCD

So I follow instructions on cyanogenmod wiki (I can't post url ...) but when loading radio 3.22.26.17 nothing seems to be downloaded :

# telnet localhost 4444
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x0090da78
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> load_image /home/loic/Android_JTAG/radio-3.22.26.17_dream.img 0x19500000
No working memory available. Specify -work-area-phys to target.
no working area available, falling back to memory writes

I waited about one hour but nothing happened.

What's wrong ? Are these instructions works for Magic 32B ?

Thanks
[G1 Android Development] marchard:
GPS problem after debrick

I also have a GPS problem after debricking my 32B. Unfortunately i realized it just a few days ago, so i can't tell, if gps was ever working after debrick or not.

symptoms are the same like alexbrickwedde.

Any ideas? Anything more we could test?

Is it possible, that radio is not working proper?

Question: Has anyone figured out, wich one is exactly the GPS antenna?

Update: i just cleaned all antenna contacts and bend them carefully a bit up. cleared all agps data, disabled agps download. no effect : (

What i forget to mention: yesterday i played around a lot with "gps status" and i got several reboots somehow connected with resetting/downloading/changing donwload cycle for agps data... but these reboots came up rondomly, not reproducible...
[G1 Android Development] marchard:
You have a Magic32B?

Than you load the image to wrong address.

Read again the wiki.

And be patient. For me it took more than 50mins!

Good luck.
[G1 Android Development] Difool80:
I've also tried with 0x103B5300 offset first but same result.

I'll try to flash by being more patient.

Thanks !
[G1 Android Development] ezterry:
What speed is the adapter running at? You said your are using arm-usb-ocd keep an eye on the led.

Unless you have a 6.x radio the 0x10... address is correct but the load ought to end in success or failure.

Last maybe verify the output of openocd its self not just the tellnet session.