Hardware to read/write DOC on your PC - Windows Mobile Development and Hacking General

Hello,
I have a HTC Wizard without bootloader. So that device cant not come up. I've searched on the net, m-system give many tool to dump from another then write it again.
But i dont know how to plug DOC into PC? What hardware did you use? How many $ for this? And are there another way to fix that?
THanx for your help

I think this might require jtag.
Not my field
V

i'm thinking the same thing

well, anyone here tried it yet?

pmquan said:
Hello,
I have a HTC Wizard without bootloader. So that device cant not come up. I've searched on the net, m-system give many tool to dump from another then write it again.
But i dont know how to plug DOC into PC? What hardware did you use? How many $ for this? And are there another way to fix that?
THanx for your help
Click to expand...
Click to collapse
VJ is right, you need Jtag programmer to reprogram a IPL/SPL erased DOC, but Jtag can not be connected to DOC directly, so you need to know abut test points to connect Jtag probes to it...
I wonder if HTC has embedded ON-Board DOC programming interface in its devices, because this technique makes DOC reprogramming more easy by connecting some testpoints to initiate on board DOC programming mechanism for onboard mini USB connector...

Related

trying to put my backpack cf to work in 2005

ok so i get all the info i think from 2003se and try to put in 2005
but it doenst do anything
also replaced a htcbpdsl.dll form a BA cab with a 2003se himalaya and it didnt work also
my register files are in the rar lol
any input will be great
talking alone here lol
ok found that here isnt any pcmcia or in HKLM/drivers/builtin
maybe thats why no disk drive for cf card
dont have any pcmcia.dll file to use
missing a file pcmcia.dll
none of the win2005 have pcmcia.dll
so that means that unless someone get a diferent aproach there will be no backpack cf card working in BUZZMOBILE2005
hope never dies i will hope
for the time will use 1.50g thats the one who worked best for me
will keep on trying lol
I also want it badly. I can't use my CF wifi card.........
progress so far litle but steady
ok so it seems that backup.dll is ok it as the primary function working is working a shortcut muste be in windows/startup for it to play a double sound after a reset
the rest is pcmcia and there is nothing on it about pcmcia not pcmcia.dll or anything pcmcia in rom files
backpack-pcmcia goes in 3 directions serial ----atadisk ----- Sramdisk
my cf memory cards are all atadisk dont know why but they are
atadisk is there but relating it to backpack its the problem for now
no more news i dont yet know how to create a disk partion based on the atadisk device based on pcmcia and dont know if its fat fastfat ou ntfs yet
help from a god is so wellcome and toenailed as been great
thank to BUZZ for giving me this lol BUZMOBILE is great
and thanks to toenailed for the time taken to help and continue to help me
be back for sure with news
found some info
here
http://www.eggheadcafe.com/ng/microsoft.public.windowsce.platbuilder/post22009803.asp
hum what next
1. Is the PCMCIA.dll on 5.0 same as in 4.2?
NO.
2.Where I can find the source codes of pcc_serv.dll
in PB.
public\common\oak\drivers\pccard\mdd
3. What the difference of the PCMCIA that exist in the drivers\PCCARD\PCMCIA
and drivers\PCMCIA?
drivers\PCMCIA is deperacate. It should not be used.
the drivers\PCCARD\PCMCIA is compatiable driver that make old (pre-4.2
PCMCIA driver works) on new system (after 5.0).
4.Does the ATADisk driver is follow the new Architecture? If this answer is
not, how to verify the driver that follow the newr architecture?
The ATADisk still works as legacy mode.
all tests made in
BUZZMOBILE 1.50g that was what god toenailed told me was best
and i strongly beleave in him
some more tests
after reading that i tryed to put all register entrys in hklm\drivers\pccard\pcmcia
but it dint work also so i revert back
pcmcia.dll problably must be recompiled with magneto i raly dont know how
find out how register setng are layout in pccard\pcmcia......
hope never dies just me eventualy
and the monolog continues
well still digging as toenailed told me to i found one more thing
it apears that i need the Buzzmobile g version of pcmcia.dll cos they changed
the way that works and there isnt one for this version
i did realyze that for me to have one i have to be a developper and have the package to write software for a xcale arm cpu lol
thats not the case and waiting is in order ....
i will put a file i found that demostrate the problem lol
hope never dies.........
got a lot of reading to do
well who said that god things doent take a lot of work?
its true it does so i have a lot of reading to do if i find something i will definetly post here
after i read a lot more i tryed the hardway lol
and so i dismantle it to see what it was made of lol chips etc
there are two zones compitly cover by a metal case and :-( didnt see anything
one thing i notice the batery is replaceble i removed it so if that goes i can put another one there is almost the same size of a nokia batery with 4 pins on it
didnt wont to remove the metal cases 2 of them cos i dont have the required equiment with me but who knows....later i will
so my saga continues lol
hope never dies.......
Hi 'great guy',
I wish i could help in your continuing saga but, don't know how since I don't own a backpack.
I found a driver file from source O2 related to the backpack. It's intended for the presentation software & not for the CF but who knows there's something new inside :?:
- rhmartin -
This file is for VGA output to monitor or other display unit.
The VGA output is great for WM5 but not the CF drive.
I thought I've said so ... :?
you guys are great
trying to help and everything thankyou
its true that cab file deals only with a bug in 1.72 O2 rom
it doent do anything to CF becouse CF ists a diferent area of the drivers
the guys on m$ did change the way pcmcia drivers works on 2k5 so now
we have agnostic drivers made explicity to 2k5 or something called legacy drivers made for compatibility to previous CE
i have two choices none of them at this time
one is i wait that CF card makers make a 2005 driver for there CF that must be agnostic ones
or
i wait that someone release a version with pcc_serv.dll driver there most unlikly cos it gets renamed at compile time to pcmcia.dll
i have a question for you guys anyone with a GPS system in CF works in 2005?
many thanks to rhmartin that one i could have missed so thank you aggain for alerting me .
desperate action
so i cant get it to work yet what i did
i get another one this with 2003se taped the two and use bluetoof to transfer files
now my backpack is working in 2005 ))
a nice brick i have made
hope never dies .........
CF card on Backpack
Hi Rectrc
I am going through same problem of cf card, tried with cf wifi drivers still nothing :!:. Searched MSDN Library & Technical Resources no results. Can u help.
Regards
Ravi
hi rave
if you read the rest of the post here you will found out that i still cant put it to work :-(
just the last one glueing two of them (its a joke lol)
but i still have hope when the first CF 2005 drivers start to apear.....
hope never dies.....
my findings so far
so i did get the pcmcia.dll form 2003 and
a pcmcia.dll from 2003se
i found out that they both call functions inside coredll.dll and not backpack.dll so this mean that it was realy nothing in backup.dll about pcmicia or the drive itself
those funtions are in coredll.dll 2003 and in coredll 2003se and i dont know if they exist in 2005 so
for now i will stop my quest until some of this guys here get a rom dump of 2005 that i can check
i have learned alot about this gismo in the past two weeks that i need to rest and put my thinking in order
i found out also that its not easy to replace a file inside a rom.....:-(
my device did go to even or limbo for a while when i tried that :-S
post new info when i get it

WM2005 messed up my Audiovox SMT 5600. Help!

So i installed WM2005 on my phone and now i get
device authenification failure....
please contact the product manufacturer. For reference please provide your device ID.
3546110002736801
68000050bf3f5173 8un
(yeah i know it's all my fault)
now i don't know how to get back. the only thing i can get to is the bootloader screen and i have a couple of roms but the only one will work with the mtty program that communicates with the phone are .bin files which i ddon't have. Any ideas guys? I kinda just want my phone back.
i am really confused as to why it doesn't work. maybe it's because its for the c500 only. but looking at this link
http://msmobiles.com/news.php/3848.html
there is one for the audiovox.
did you try to run the normal upgrade when the phone is connected via usb in BL?
i've tried the uk update but it says i need to be connected to activesync. boing to go buy a card reader today to try backing up from the sd card.

HTC Hermes JTAG pins

Hi,
it's done!!!
Today i discovered the JTAG pins of HTC hermes.
My device got bricked and was not able to boot anymore. Not even the bootlader came up.
Anyway i decided to do some investigation, there was nothing to loose
Thanks to Lt.Cmdr.Ivan who discovered the JTAG pins on the universal hardware.
(It made the step successful!!!)
See the attachment!
(had to make a zip because high-resolution pix )
These are the testpoints to access Hermes main system Samsung MPU and recover OS bootloader!
To get access to the GSM chipset please have a look in the second post!
You may use this package to access the platform.
http://210.118.57.197/Products/Semi...or/ARM9Series/SC32442/JtagFlash_Prog_Code.zip
EDIT: If the link is not working, see attachment (backup package form samsung site, source code included)
See the documentation in the archive for information how to build a LPT adaptor, to use this software!
EDIT: The software tool has been modified to handle the /WP issue.
See attachment MSP_HERM.zip!
What ever happens to IPL/SPL on your device, it can be recovered quite easily now, using the JTAG method!
EDIT: Added Olipro's 2.10 (Hard-SPL V7) for completeness.
This is a pure binary file, ready to flash via JTAG. Thanks again to olipro for this beautiful bunch of bits!!
EDIT: Due to the numerous questions of some users how to go through this, here's what has already been written down all over the thread.
Follow these steps:
1. Disassemble your device (link to the Hermes Service-Manual is in the wiki).
2. Locate the JTAG pins on PCB (download/extract htc_hermes_jtag.zip -> look at the picture)
3. Use a very small soldering iron and attach some wires to the testpoints (only experienced users should do this!)
4. Use one of the wiggler clones (LPT-adaptor) to built up a connection to the JTAG pins using LPT port of your host pc.
Please have a look in the software documentation for the schematics (JtagFlash_Prog_Code.zip -> Source files and doc included).
Whatever your adaptor would look like, follow the pin assignment, that is used in the schematic (e.g. LPT pin 2 -> TCK, LPT pin 3 -> TDI, LPT pin 4 -> TMS, LPT pin 11 -> TDO)
5. Partly assemble your device and insert fully charged battery. Check all connections and press and hold power button on hermes (min 2sec.).
Though the device won't start if your bootloader is bricked, this step is necessary to activate internal power supply.
To check if power is O.K. measure the VCC pad (VCC ~ 3.15V).
6. Use the modifed samsung software on your host (download/extract MSP_HERM.zip -> MSP_HERM.exe is a command line tool)
Please make sure that the processor is recognized. If not check all connections again!
7. Grab IPLSPL210_OLIPRO.zip, extract it and put the file the directory where flashing software is located.
8. Use flashing software (MSP_HERM.exe) and try to reflash your NAND.
type: MSP_HERM.exe /f:IPLSPL210_OLIPRO.bin
type: 1 to choose the flash type
NAND flash type on hermes is k9f1g08 and should be recognized
type: 0 K9f1g08 Program
Start page and block must be set to 0
9. Be patient and cross fingers while flash is programmed.
Alternatively you may grab some coffee or beer and relax!
10. Enjoy the rebirth of your device.
Credits:
A warm and healthy "Thank you!" goes out to pof, cmonex, cr2, the_dipe and the others who gave useful hints or helped testing.
Regards,
scholbert
HTC Hermes GSM JTAG pins
Hi again,
after a lot of wicked things had been done with my device, i decided to lift another secret.
Anyway i spent some time to do some investigation and managed to trace the JTAG testpins of the GSM chipset on the hermes!
So it's done!
To be 100% secure, this has again to be verified with some software.
Work is in progress!
To solve the "noGSM" issue we need a bullet proof flash tool to rewrite the radio bootloader.
Hopefully we could get the necessary information to do so!
Maybe someday all these "no GSM" devices could be brought to life again...
at least if it's software related issue (e.g. broken Radio bootloader)!!!
See the attachment for the pin location!
(had to make a zip because high-resolution pix)
These are the testpoints to get access to the Qualcomm GSM chipset and possibly fix broken radio bootloader!
Information about missing signals
TRST_N = could not be found (seems to be N.C.)
RTCK = could not be found (will only be needed for special debugger)
Mode0 = N.C.
We need your help!
If anyone got information about the JTAG chain of MSM6275 (BSDL file) or similar info, please PM me!
scholbert
I have used JTAG on my linksys router when I bricked it.
It's actually pretty easy to make a cable for JTAG and uploading a ROM.
Did you actually manage to revive your tytn?
Flash access
Hi,
it seems to work fine with the program from the samsung site.
I just flashed IPL & SPL to my device.
See the screenshot
scholbert
thanks for this ill look into this. im still trying to figure out which part messed up on my phone. no power anymore not even charge light. dead. hardware? i think i burnt a capacitor coz it died while charging/connected to usb. Also i just flashed a radio rom but it was successful... before it died out. is yours the same case that it did not even show life of accepting power? thanks.
i was looking at the schematics and i think i need a technician for that but if i can revive my dead phone using that since im going to try and find the messed up capacitor anyway, ill learn and research.
Congratulations!! this is a great and useful finding
Thanks
Hi again,
thank you for adding a link to this thread in the wiki!
Unfortunately my device still won't start
There maybe anything else broken.
Anyway, the JTAG thing worked very smart, programming is quite slow though.
O.K. but that's the bit banging (i just remember, once flashed an image to the skeyepad and it took nearly half a day using an LPT adaptor).
sphynx88 said:
i was looking at the schematics and i think i need a technician for that but if i can revive my dead phone using that since im going to try and find the messed up capacitor anyway, ill learn and research.
Click to expand...
Click to collapse
@sphynx88:
What schematic are you talking about???
Do you got a schematic for hermes???
Regards,
scholbert
Scematic
Hello sphynx88,
do you have a scematic of Hermes? I'm an technican and I'm used to JTAG programming. So if you have the scematic and I can have a look at it, perhaps I can help you bringing your hermes up again.
Greetings Pudl
More info
Hi,
first i'll have to quote myself:
scholbert said:
it seems to work fine with the program from the samsung site.
I just flashed IPL & SPL to my device.
Click to expand...
Click to collapse
There are some problems with rewriting flash on my device.
After some more investigation, i found out that my device still got OLIPRO'S IPL (version 1.04) but SPL is not HARD-SPL anymore (version 2.10 "Hard-SPL")
SPL was rewritten to original bootlader (version 1.04).
I made some memory dumps using the JTAG tools and compared the output with the binary files.
IPL and SPL do not match, that's why my device is not booting anymore.
For some reason i am not able to rewrite IPL with the samsung programmer.
There are no errors, everythings seems nice, but IPL remains unchanged after programming. No idea why
Maybe there's something special on hermes hardware, that protects NAND to be rewritten per default.
O.K., now that i found out what's wrong with my device, i'll have a look in the programmers source code, to understand what's going on.
I'll keep you informed about my progress
scholbert
...after having a look around, i'm quite sure that my flash is kind of blocked.
This maybe caused by damaged hardware .
If anyone would try to flash some bits to his damaged hermes, please let me know.
This would clear up if the the software provided by Samsung may be used to flash the hermes hardware and fix broken bootloaders.
At least flash content can be read out via JTAG, that's proven .
scholbert
I have bricked my hermes too.
I will try to flash IPL and SPL with the JTAG programmer.
How can I build a bin file for the programmer from an official RUU_signed.nbh or from the extracted 00_IPL.nb and 01_SPL.nb?
Hi,
bauner said:
I have bricked my hermes too.
I will try to flash IPL and SPL with the JTAG programmer.
How can I build a bin file for the programmer from an official RUU_signed.nbh or from the extracted 00_IPL.nb and 01_SPL.nb?
Click to expand...
Click to collapse
It's sad that your Hermes got bricked .
Maybe it will be the first device revived by JTAG flashing.
Here we go:
00_IPL.nb and 01_SPL.nb are already binaries.
Refer to the memory map in the wiki to know where the contents have to be placed.
So you might flash them seperately or build one file to flash (see attachment).
To make it easier have a look in this slightly modified table, it shows the block numbers of NAND flash ( :
Code:
------------------------------------------
0x50000000 Page0
Block0 IPL
0x5001ffff Page63
------------------------------------------
0x50020000 Page0
Block1 SPL
0x5003ffff Page63
------------------------------------------
0x50040000 Page0
Block2 SPL
0x5005ffff Page63
------------------------------------------
0x50060000
... not used
0x5009ffff
------------------------------------------
0x500a0000 Page0
Block5 CID, S/N
0x500bffff Page63
------------------------------------------
0x500c0000 Page0
Block6 WLAN
0x500dffff Page63
------------------------------------------
0x500e0000 Page0
Block7 MainSplash
0x500fffff Page63
------------------------------------------
0x50100000 Page0
Block8 MainSplash
0x5011ffff Page63
------------------------------------------
0x50120000
...
Good luck !!!!
scholbert
Thanks a lot for your help I flashed my IPL/SPL an now my hermes is working again
Hey
bauner said:
Thanks a lot for your help I flashed my IPL/SPL an now my hermes is working again
Click to expand...
Click to collapse
Congratulations!!!!
So everything went fine using the provided tools?
Did you use a wiggler (clone) for the job?
Best regards,
scholbert
yes everything worked fine with this tools.
I used this Interface:
Holly Gates' Schematics for the JTAG Dongle
Im sorry to have replied for so long but i gave up on my hermes and have not been checking. ill subscribe to this thread. After crazy searching and one site leading to another i did find what i think was schematics for the hermes. a service manual. it was in chinese and i couldnt understand it but i saw one for my samsung one which was in english and i think it really is the service manual with schematics. ill try and retrace my tracks. cross fingers.
anyway, in my case, the phone died. not bricked. something inside short circuited. it was on and charging via usb then the next thing when it reached 100 coz i was pretty sure it was 90 the time i started installing apps, it just died. no turning on, no nothing not even the rlod. i opened the case and i think there might be a fuse to the left of the charger entry, maybe changing it would simply fix the whole problem. i dont know but hopefully my cpu isnt broken so i may even have two phones.
JTAG flashing proven, my device definitely broken
Hi,
...anyway, in my case, the phone died. not bricked. something inside short circuited.
Click to expand...
Click to collapse
same with my second device, sphynx88.
Something hardware related is damaged.
I may use the flash tool a 1000 times, the flash seems unaccessable for programming. Maybe the WP-pin stucks to GND on my device
Anyway it's nice to access the device via JTAG, also debuggers may be used
Have fun!
scholbert
I know what's wrong
Hi again,
can't stop my investigation and like to bring my dead hermes to life!
I started to look around and i found the WP testpoint
So i made sure what i assumed, the WP pin of flash is tied to ground.
This prevents NAND flash to be rewritten -> write protection!
I made some further measurements and found out, that there must be a general purpose pin responsible for this function. Obviously this pin is set low during basic setup, maybe it's done in IPL (after reset all pins are tied low by internal resistors).
The only way to find out which pin is responsible for write protection, is to set some of the GP output pins to high level and and measure the voltage level at the testpoint (maybe it's GPC4 because it's very close to WP).
So this goes out to pof or olipro who already done a lot reverse engineering on this platform
Any idea which pin is used for NAND write protection on hermes????
Regards,
scholbert

Fixing dead WLAN by reflashing EEPROM

Hi there,
i guess i messed up my EEPROM, as i can't connect to any (secured AND unsecured) WLAN. I flashed many roms, so i can't say when it happened. I read about fixing WLAN by flashing EEPROM / fixing MAC in it. There's a walkthrough for Hermes, Prophet and Athena, but nothing for the Wizard It would be great if someone could provide some infos on how to fix WLAN on a Wizard device. I'm familiar with mtty and such. Any help is much appreciated!
Best regards,
SpeedCore
I tried to find out, if i accidently erased the EEPROM by doing the procedure mentioned here: http://forum.xda-developers.com/showthread.php?t=299451
But it doesn't recognize the command "task 32" Maybe there are other commands for the wizard? How can i find out if i have the "no EEPROM no WLAN" issue?

[Q] HP IPAQ 614c PC activesync, connection problem

Hello all,
I have HP IPAQ 614c and i can't connect this phone with any pc or any USB cable. I get message unknown drivers... Maybe someone knows what the problem it is ? I wana install normaly ROM and firmware, but i can't connect my phone to pc... Thanks a lot who will help me to fix it...
I have the same problem with my iPAQ 914c... But, i can intall a new ROM with a external SD Card.
You can install ? I can install too ROM from HP web. But how to update Firmware without USB ? So i need connect my phone to update it... Ehh... Bored of seaches...
Yes, I can install it
Instructions for flashing (extrated from: http://forum.xda-developers.com/showthread.php?t=800558):
Download de firmware. Decompress it and you have the .dio file. Put this file into a less than 2 gb sd (sdhc won't work) and put your device in sdloader mode. This happens pressing together volumeup + ok and pressing reset releasing the two vol and ok buttons. After doing this, the device checks the file integrity, flash to your device rom and do a clean reboot. When is finished, it ahould autoreset, but if not, it will show a black screen for a long time. Is then when it has finished, so then make a reset and your device will have installed the ROM
How to update flash.dio i know. I Need english version. I have updated OS. But how to update FW ? Becouse now mine is 0.81 version. And then i upload original flash.dio from HP hexeded file. Phone installing one this file from 6 files. Like i see on screen phone, missing 5 files to install... Sorry for bad english, but i think you will understand me what i mean...
On phone i have some bugs, like xt9 in SMS mode. And bug in contacts. Can't seach contact by name, i can put only numbers there to seach. GPS not work. And other little bugs.
But main problem is how to activesync this phone ? Why PC can't find phone ( device ). Tryed anything. Different PC, different windows. Different cables. Can't find solution for it... I think must be way to find problem. HP agents can't help me, becouse warranty ended, heh. They just told me what phone port for cable can be out of working. But phone charging working well...
So who gona help me ?...
Is it possible upgrade and activesync by bluetooth ?
DeFuSeGM said:
Is it possible upgrade and activesync by bluetooth ?
Click to expand...
Click to collapse
DeFuSeGM, you are able to activesync by bluetooth, just follow the activesync help topic under connection using bluetooth. Starting i got a lot problem to setup and took me quite a while to get it solve out. U can try it.
BTW, anyone can share how fast is your bluetooth phone to phone transfer rate. Mine is only 50kb/s, seem like quite slow compare to other phone i used to use.
Thanks
And how about if i can't open bluetooth meniu in phone ? USB dont work, bluetooth dont work, with SDLOADER can't upgrade... Phone dead ? Or any way to delete wrong ROM from phone without connecting it to pc ? I need faster help...
I had the same problem on my 614c, I opened the device and re soldered the usb connector. Haven't had any problem since that.
But it requires good soldering skills.
DeFuSeGM said:
And how about if i can't open bluetooth meniu in phone ? USB dont work, bluetooth dont work, with SDLOADER can't upgrade... Phone dead ? Or any way to delete wrong ROM from phone without connecting it to pc ? I need faster help...
Click to expand...
Click to collapse
if you want to Automatically connect through ActiveSync bluetooth , you'd better learn it at http://forum.xda-developers.com/showthread.php?t=530327
Lasker1 said:
I had the same problem on my 614c, I opened the device and re soldered the usb connector. Haven't had any problem since that.
But it requires good soldering skills.
Click to expand...
Click to collapse
Okey, ill try to resold connectors.
Hakim Rahman said:
if you want to Automatically connect through ActiveSync bluetooth , you'd better learn it at http://forum.xda-developers.com/showthread.php?t=530327
Click to expand...
Click to collapse
In phone installed wrong OS. So i can't turn on bluetooth... Screen just blinking, thats all...
Can someone make picture of sync cable ? Maybe i have wrong usb cable. Becouse repairman sayd what anything with phone okey. Seems i need get corect cable. Thanks
Have changed main board and anything was okey with phone. Seems if USB dont work, you need change main board or try load ROM by SD card. But in my way i was stuck on that.
DeFuSeGM said:
Can someone make picture of sync cable ? Maybe i have wrong usb cable. Becouse repairman sayd what anything with phone okey. Seems i need get corect cable. Thanks
Click to expand...
Click to collapse
you just look at http://pinouts.ru/CellularPhonesCables/cellphone-usb-cable_pinout.shtml

Categories

Resources