yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] beav_35:
Yes, that should be just as good (and you will have a way to root without jtag just in case ;)). I believe that it is the exact same SPL and slightly different radio (might matter for jtag though). The only reason we were able to root this rom was because of the kernel exploit.
[G1 Android Development] SilentTweak:
I wonder why no one's responding to this thread. This is great news!
[G1 Android Development] ynothna:
I agree that this is good news. Just bought a slightly used Dream and it was. Just my luck that the previous owner ran the mandatory update shortly before selling it.

I am a little unsure about the process though. Does the jtag involve physically modifying the phone? If so, is there any chance that this method will lead to a non-jtag way of getting around the perfect SPL?
[G1 Android Development] kR105!:
Because most of newbies here doesn't have idea about what is talking ezterry with his method :rolleyes:
[G1 Android Development] xaueious:
I might be motivated to try this if I actually had a brick. If I buy a Dream I might look into this.

For now I am not motivated to get my own jtag working. ezterry and other fellow xdaers on the other thread seem to be trying to find a method that doesn't require soldering.
[G1 Android Development] raymar23:
Dreaming

I would be willing to try this on the $100 Dream i picked up, but the only thing is spending another $50-$100 on JTAG and serial cable equipment. which i might F#@CK the phone LOL :D

PS is it possible to use a cheap parallel port jtag to do this?, i think diffrent software would be required for the process though....any suggestions?

Thanks

Raymar23
[G1 Android Development] ezterry:
No reason a parport adapter won't work, and openocd supports many part port adapters.

Also if you are more comfortable with other arm compatable software it ought to be easy to port the steps.. its just ram writes.

I just don't own any computers I can plug in Part port devices anymore.

scholbert from the other jtag thread may be able to give more info.
[G1 Android Development] SilentTweak:
http://www.diygadget.com/universal-jtag-adapter-for-routers-modem-fta-and-more.html

Could I use this JTAG adapter? Or is there another adapter on this site I can purchase to do this process? I'm thinking of buying a couple bricked phones and trying this out lol
[G1 Android Development] lbcoder:
Looks like a 74HCT244....

I posted a link to a schematic for what is really the exact same thing -- should be in the other thread. It takes about 10 minutes to solder one of those up and you can make it for $2 in locally acquired parts.
[G1 Android Development] scholbert:
Hey,

ezterry opened up another hacker thread...

Nice work mate :D

Anyway here's a schematic and some comments i once posted at the original JTAG on Dream thread.

http://xdaforums.com/showpost.php?p=5110255&postcount=37

It's low cost LPT-adaptor and works very well with the MSM IO voltage of 2.6V.

Feel free to re-distribute :p

Maybe some soft tweaks are needed to integrate in openocd.

Once made a patch... but it's lost somewhere.

Cheers,

scholbert
[G1 Android Development] raymar23:
Thanks

Thank you very much for the insights and also for all your work and knowledge that has been shared with the community.

BTW. Anyone know where to buy a parallel port JTAG in Canada (i hate customs) lol

Thanks again to everyone who posts in these forums
[G1 Android Development] kR105!:
I was searching that schematic without luck, can you please post the link here?

thanks!
[G1 Android Development] scholbert:
:confused:

If you want a true wiggler clone, this isn't...

I'll prepare another schematic...

Regards,

scholbert
[G1 Android Development] rasperepodvipodvert:
how build device to reflash dead G1 ? electro scheme?
[G1 Android Development] Broncosis:
some buy exterry the solderless jtag adapter

mentioned in the other post

or he will end up with a huge collection of phones

I'll even chip in

my dream is fine and rooted but my magic was shipped the rogers ways

so I am waiting with great hopes for the jtagless option

and more than willing to help where I can
[G1 Android Development] ezterry:
Any jtag adapter compatible with open-ocd

*) The JTAG adapter I used was the ARM-USB-OCD I'm also using its power out and a LM317 but you can use the reference voltage point on the phones main board instead

*) A slightly cheaper USB adapter; missing some features is ARM-USB-TINY

*) A wiggler clone that will utilize a 2.6V+ /- 0.1V reference voltage ought to work (Link to scholbert's schematic)

All of these are fairly generic arm jtag adapters providing

The pins NTRST, TDI, TMS, TCK, TDO, Vref, GND

The primary 5 pins and ground are attached to the corresponding point on the main board

Last attach the 2.6V+ /- 0.1V Reference voltage source; this has two options:

(1) Using the 9V source of the ARM-USB-OCD device and a LM317 to generate the 2.6V;

(Certainly replacing a 9V source with a square battery sounds simple enough for adapters which won't provide power via USB; just ensure the negative terminal is on the common ground)

(2) attaching to one of the 2.6v test point on the main board
[G1 Android Development] Turague:
hey if anyone can do root the phone in the gta ill be willing to pay. Tired of running this slow stock dream
[G1 Android Development] jinxhyped:
Its not so much that I dont have any idea I just lack the tools and "sense of adventure" terry speaks of in the prerequisites! Besides...I'm one of the few that might actually be ahead of the game on this one...after getting out of having to update with the waiver on my original Dream, I "accidentally" bricked the magic I got out of the promo with the 911 fix and got a 2nd Dream out of the deal, which in my mind is a much better phone (but is currently stuck with Stock rogers SPL & 1.5 , as well as a 3g referb Iphone for my troubles!

@ OP - when I mentioned we might be local on your twitter, I was offering to gunea pig any potential "Jtag-less" options that you might uncover as a result of this success! Or, if you're willing to help me get mine setup with Jtag I'd be happy to donate for your time and materials!
[G1 Android Development] raymar23:
schematics

Any luck with the schematic for a wiggler or ARM Debugger. Thanks in advance
[G1 Android Development] sucka:
So, still got no answer, can i do this with a simple USB to SERIAL RS232 converter in blue light mode? :-S thank you.
[G1 Android Development] ezterry:
If your phone is Security/CID unlocked (Note this is nothing to do with sim unlocked) Yes..

But as that is highly unlikely No you can't

If the status of this changes I'm sure it will be well announced.
[G1 Android Development] sucka:
Thank you very much :)
[G1 Android Development] xaueious:
Too bad I'm still confused about how exactly I need to do this. Maybe an instructables will help.

Don't have time to play with this yet so...

As of right now I am confident in building the serial cable and using the commands for that. However the JTAG is confusing for me and is a much more significant time investment.

I would like to know how to restore fastboot mode from bootmode 3 (boot loop into non-functional recovery) via serial cable, if I had 1.33.2005 S-OFF previously installed and was switching radios.
[G1 Android Development] ezterry:
In short.. JTAG

The engineering SPLs are coded to ignore the security flag on the phone and always be S-OFF;

The CID/Security Flag are in a secure area of flash and like the SIM Lock always remain unlocked when it is unlocked (regardless of the radio/SPL installed)

What this means is despite having access to all the unlocked bootloader functionality while in 1.33.2005; the oemspl (part of the radio) is still locked; Further uses that installed the new rogers rom are no longer on 1.33.2005 thus have the SPL locked as well.

Blue light mode and the serial wire provide access to the oemspl only. If you can (without JTAG) run the command '?' and get something other than invalid command; then you are security unlocked.. and we can look into migrating this hack to the serial line via some script.. But this is highly unlikely and you would have needed to do something to security unlock the device.. And I don't hear reports of CID/Security unlocked devices on the G1/Magic.

(and no none of my phones are security unlocked.. including the newly rooted rogers one running 1.33.2005)
[G1 Android Development] scholbert:
low voltage wiggler clone

Here it is...

http://xdaforums.com/showpost.php?p=6055979&postcount=412

Cheers,

scholbert
[G1 Android Development] sucka:
So without jtag adapter and only connected directly to the serial gives that error of invalid command?
[G1 Android Development] lbcoder:
Have you checked if ADP1's are security locked? I'll accept that it could just be that they come with the different SPL, but seems to me that if ANY devices were to ship security unlocked, that these would be the ones.

Note: the so-called "holiday" phone SPL was version number 0.95.0000 with the same rainbow screen as the one shipping with tmobile devices, but I do specifically remember that ADP1's with this SPL installed were still able to fastboot without any kind of restrictions. I wonder if MAYBE the holiday SPL actually *was* the regular (non-engineering) SPL, and perhaps the ADP1's don't get stuck when loaded with that SPL on account of being security unlocked....??

If that is the case, then it seems like it may be TRIVIAL to unbrick, at least, ADP1's (and I know for certain that there are some that are bricked....)
[G1 Android Development] n64_ali:
Hey all,

First off I'd just like to thank ezterry and others who are putting in all this time and effort into an admittedly older device.

I was just wondering as to how far you have come into finding a software solution (via JTAG or otherwise) for rooting post-911 update Rogers Dreams. I know that this was one of the original goals of all this so was curious to know where it stands at the moment. In any case, thanks for all the hard work and any info you could provide.
[G1 Android Development] lbcoder:
Did you not bother to read this thread? Its done and working.
[G1 Android Development] n64_ali:
Sorry if I was unclear, but I meant software as in not requiring JTAG adaptors and/or soldering cables to my phone's board. Thanks.
[G1 Android Development] lbcoder:
Then there is a serious disconnect somewhere in your brain because you specifically asked if there was a solution VIA JTAG.

There is and will NEVER be a completely hardwareless solution since you MUST interface with the device in SOME MANNER.

It may be possible to unbrick an ADP1 using serial-only (not yet confirmed if these are security unlocked), otherwise you'll either have to wait for a security bypass or just jump in to the jtag solution.
[G1 Android Development] ezterry:
Without the device security unlocked it will return Invalid Command for all but a very small subset of white listed commands

'?' is the help command and notably not white listed.

JTAG has more direct control of the processor and ram; thus allowing us to force the phone to do what we wish.

see commentary in green
[G1 Android Development] scholbert:
Hi ezterry,

i'm still in the process to clear some things in my mind and get the difference between the Roger's Dream and the T-MOB G1 (i wonder at least if there physically is one).

I also took a glimpse at all that postings about 1.33.2005 on G1.

Would be nice to tell me if my conclusions are correct:

1. Basically EBI0 phones could be converted to EBI1 phones

2. To live in harmony radio ROM, SPL and recovery kernel/img must match

3. Assuming a EBI0 phone got Engineering SPL 0/1.95.3000 and a 2.22.19.26I Radio, it should be safe to:

a) Use fastboot to flash 1.33.2005

b) Use fastboot to install EBI1 recovery image (e.g. Amon-RA's http://xdaforums.com/showthread.php?t=566669)

c) Use any EBI1 ROM available and flash it to the phone

4. With EBI1 recovery image it should be safe to use recovery to flash anything that matches this layout

5. The phone is now using EBI1 mapping and will work as safe as it did with EBI0 layout.

If this is correct, 1.33.2005 should be renamed from Death-SPL to... NFN-SPL (Not-for-Noobs-SPL) or DKABWAB-SPL (Don't-know-anything-but-want-a-brick-SPL)

Regards,

scholbert
[G1 Android Development] ezterry:
The big important difference between the physical rogers phone and t-mobile phone is:

HSDPA/UMTS dual-band (850/1900 MHZ),GSM/GPRS/EDGE Quad-band (850/900/1800/1900 MHz)

t-mobile phone is HSDPA 1700/2100 MHz (also quad band GSM/GPRS/EDGE)

Otherwise at a hardware level the Rogers G1 identifies as DREA21000

the T-Mobile one as DREA10000

EBI0 = 2x Radio EBI1 = 3x radio

both DREA21000, and DREA10000 phones can run both;

From what I've seen

2.22.19.26I and 3.22.20.17 are extremely similar (to the point the same offsets in the jtag hack ought to work) but some values have changed.

This means the 2005 SPL is stable on both with correct recovery.

um.. you forgot to flash the 3x radio in the steps; but hes if we add step a2: use fastboot to flash 3.22.20.17 or 3.22.26.17 radio; I'm at least sure all steps after the installation of 1.33.2005 work.

The EBI1/EBI0 roms don't change the partition layout; the SPL partition table does. That said the memory layout is diffrent so your kernel must match the radio.. once this is done yes its stable.

The only problem is when a user then flashes a 2x radio via recovery

as this breaks the stack and causes a boot mode 3 loop

The 1.33.2005 SPL is just originally a Magic eng. SPL.. nothing special

The 1.33.2009/1.33.2010 SPLs also work on the dream with the same boot mode 3 trap. Just a slightly different partition layout on the other 2. (little more cache little less data)

Photo is a T-Mobile G1 on the left, and a Rogers Dream on the right

Both running EBI1 radio 3.22.26.17; and SPL 1.33.2005
[G1 Android Development] scholbert:
Hi ezterry!

O.k. obviously it's a north american vs european device.

So it seems there are different filter chips and slightly different setup (NVM items).

Interesting fact... AFAIK the device ID is stored in a hidden block of NAND.

Thanks for clearing that up again...

BTW do you know anything about the performance of those two main versions?

Good to know ;)

O.K. sure this refers to EBI1...

I knew about the partitioning inside SPL, but again this fits the puzzle.

O.k. EBI0 radio bootcode seems to jump at a wrong location.

Nice information.

Thanks a lot!

May the force be with you... :D

Best regards,

scholbert
[G1 Android Development] xaueious:
As far as I know the button layout on the DREA21000 and DREA10000 is different. If you look at ezterry's screenshot, you will see that the call-home button and back-off buttons are joined on the white phone. On the DREA10000 the buttons are separated

It seems to me that it is just a version code for a higher revision.
[G1 Android Development] d3v14n7:
To ezterry

So from what I understand, you tested this on a Tmobile G1 flashed with the new Rogers rom correct? It is completely untested on an actual Rogers Dream?

Long story short, I have 3 fully working (with e911 update applied) Rogers Dreams in my possession (2 unused), and would be willing to send one to you to test this method... I'd do it myself, but I have horrible soldering skills and don't have the hardware necessary to pull it off.

If this is something you'd be interested in, send me a PM and we can work out the details.

Thanks for not giving up on the Dream, your work is very much appreciated.
[G1 Android Development] xaueious:
In terms of paying someone to get the phone rooted, I think you can easily net $50-80 per phone with all that's involved.

It would be nice to have someone in Toronto who can do this for us who don't have the expertise.

Someone on RFD is trying to sell me a rooted Dream for $225 when the going price is more like $180. He initially asked for $260.
[G1 Android Development] ezterry:
I've re-rooted 2 actual rogers dreams to date.

One is the one im using right now to write this message was done about 3 days after I did the tmobile test.

The other you can ask Sleeepy2 about
[G1 Android Development] rzak:
Sorry, complete noob here :o

Is this the only way to root/re-root Rogers Dreams after the latest Rogers update has been applied?

If so, anyone in Toronto want to hook me up (for a fee of course)?
[G1 Android Development] Sleeepy2:
This is the only way to get root/re-rooted after the latest update.

ezterry did a great job. Everything is up and running with no issues.

I love my sweet delicious root :D

Thanks again ezterry
[G1 Android Development] Suminderji:
Would someone in the Mississauga / GTA region be willing to do this for a fee?

Thank you again ezterry. If I get the guts I might try this... but I rather someone who is versed do it for me :)
[G1 Android Development] d3v14n7:
Oh, my mistake, I guess I misunderstood. :)

Although now that people are mentioning it, if you do ever offer to jtag and root Dreams for people, please let me know, I'd be interested in getting at least one of them rooted so I can have my apps2sd back.

Thanks again, and keep up the good work!
[G1 Android Development] HAK Devil:
Wow this is great though I wish I had the expertise to do it. I hate the fact that I do not have root anymore due to the 911 update :(. If someone in either the Mississauga or Hamilton area can do this for me I would gladly pay for the service
[G1 Android Development] jerboyd:
jtag hardware found

for those of us who can solder but are a little wary of soldering anything to such small circuit board.

multi-com.pl/index.php/en_US,details,id_pr,7183,menu_mode,categories.html

and a video of a person using it on youtube

the main youtube address /watch?v=eITMEEF_AIc&feature=youtube_gdata

sorry for the messy links but i haven't posted enough messages yet.

Jeremy Boyd
[G1 Android Development] steve1326:
In ezterry's article, it is said that "If you are stuck on a splash screen on boot.. both the SPL and radio are working.. they are just usually stuck in an invalid mode"

This seems to describe the situation that I am in. No combination of keypresses will allow the phone to proceed. I cannot even get into the "skateboarding android" menu. The only thing I can seem to do is get into "blue icon mode" (power + trackball)

If I am not bricked, but simply stuck in an invalid mode, then what steps can I take to get the phone working again, without performing a JTAG mod (which is probably way out of my league)?
[G1 Android Development] jerboyd:
thinkin' of jtaggin' my dream

trying to get an idea of what hardware i'll need to do this root. will these products do the job?

shop.ngxtechnologies. com/product_info.php?products_id=30

multi-com. pl/index.php/en_US,details,id_pr,7183,menu_mode,categories.html

i had to put spaces in the links because im a new member. so if you get 404 not found that's why.

i will be doing the root from fedora linux. will openocd and a terminal be the only programs i'll be using for this? if this jtag adapter is putting out 5v can i just make a voltage divider to drop it down to 2.6v?

thanks for the help

jeremy boyd
[G1 Android Development] tylik:
This is likely old news, but -

So I just bricked my adp1.* I'm in the process of trying to work out all of what's involved in the jtag process.**

Meanwhile, anything diagnostically useful I can do with this beast? Any questions I might be able to answer (especially with specific directions where to look?) If avoiding soldering is an option, I'd be all for it, as much as I love the iron on my hot-air rework station. (I really do, it is a joy to use.)

* I installed danger.spl without checking... Stupidity. And complacency. And being really, really busy. Anyhow, I haven't been following things here, so I have a lot of catch up. This is why not being careful because you don't have time is ultimately wasteful... It was a gift from a friend, too.

** Which, if it comes to it, sounds pretty doable. I do surface mount, I've done some embedded programming, and hey, I just happen to have a jtag usb dongle sitting on my hardware shelf not doing anything because I haven't had the time to play with the arm chips.
[G1 Android Development] ezterry:
I'm nearly certain your phone is also security locked, but if its not when you attache a serial adapter and enter blue light mode:

If you send '?\r' (? Followed by enter) it ought to reply with one of two things:

Invalid command indicating you are security locked and must do the jtag procedure as on the cm wiki.

Or a list of commands meaning we can debrick without jtag (just need to poke my process some)
[G1 Android Development] -Maverick-:
I just need these things and I should be ready to go??

http://www.sparkfun.com/commerce/product_info.php?products_id=7834

http://www.sparkfun.com/commerce/product_info.php?products_id=9167

http://www.multi-com.pl/index.php/en_US,details,id_pr,7183,menu_mode,categories.html

I'm trying to avoid soldering as much as possible. It looks like I have everything I need to get my HTC Deam from Roggers rooted from that 1.89.631.1 build and preform a soft load of the 1.33.2005 SPL.
[G1 Android Development] ezterry:
I think you still need something to convert the RS232 port of the ARM-USB-OCD to tty level (2.8v or 3.3v on the phone side)
[G1 Android Development] -Maverick-:
OH right, what would you recommend I get?

I know some soldering has to be done, but I'd figured I avoided the HARD part by getting the jtag adapter from multi-com. The serial cable doesn't look that hard to make so I'm up for that challenge.
[G1 Android Development] ezterry:
Well I'm using this: http://xdaforums.com/showpost.php?p=5556576&postcount=111

but made it before I get the JTAG adapter (thus why I don't use the included serial port)

But since you have a RS232 port on the JTAG adapter (if not also on your computer):

You can build a MAX232 level converter: http://www.sparkfun.com/commerce/product_info.php?products_id=316 (remember to also get the other components the circuit requires)

Instructions are linked to here: http://xdaforums.com/showpost.php?p=6144383&postcount=461

(http://www.sparkfun.com/commerce/product_info.php?products_id=526 will convert a 5v/9v output from the ARM-USB-OCD "power" port to 3.3v for vcc if pin4 fails to work as hoped)

If you don't want to use much solder on this buy a breadbaord
[G1 Android Development] -Maverick-:
I just remembered I have an old laptop with windows xp that has a RS232 port. I'm hoping pin4 works out.

It's too bad I can't just use the home made serial to usb cable to directly communicate with the phone without using all this extra equipment. Maybe someday...

Thanks for helping me out ezterry, this setup process is a little tricky for me and I want to make sure I get it right.
[G1 Android Development] tylik:
And indeed, sir, you are correct. (Had to wait to get the extUSB connector.)

Okay, I should have everything I need to go after it with JTAG, anyway. Hopefully sometime this week, if not, probably next weekend.

Thank you for working this out.
[G1 Android Development] quinting:
Hire someone to ROOT my Dream!

I will be willing to pay someone to root my post 911 Rogers Dream....if anyone can do this, and can give examples of successful roots, I would be prepared to pay someone to have this done.

Thanks!
[G1 Android Development] lbcoder:
How about this?

(ask a stupid question without reading/researching, etc.)

Note: This is an example of a successful rooting.... so pay up.
[G1 Android Development] mitzoku:
help

I am trying to debrick an htc magic. I have the ARM-USB-OCD, working on the usb-serial cable.

I am confused about one thing: this cable is used to connect to the ARM-USB-OCD? or the computer? are the phone and ARM-USB-OCD both connected to the computer? I guess the ARM-USB-OCD is connected to the phone through the 20pin plug, and I know which pin to connect where, but I am confused about how this device communicates with my computer. Please, enlighten me.
[G1 Android Development] bloodman376:
can someone here please help me unbrick my phone? i live nearby toronto and i dont feel like paying 80 bucks to buy everything when someone else could do it for me cheaper.