I want upgrade my C500 to WM5,but i have problem
in mtty 1.42.exe :
Cmd>l c:\myalias.bin
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImageNot allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
?????
I have
IPL 1.00
SPL 2.5.0102
I don't now to change SPL.
HELP ME!!!!!!!!
Need change SPL. No any ways!
OK
How doing this??
Related
Below are some commands for Artemis.
For the moment still did not find a command to backup existing ROM.
There are some interesting ones related to debug and use of TFTP.
Commands are case sensitive.
Looks like battery is charging while in bootloader mode. It was not a case with Prophet.
regards,
fdp24
*******************************************
Cmd>fm
Wrong parameters of FM Command!!
Usage:
fm [command] [frequency]
where:
if[command] = i Initialize FM.
if[command] = o Power on FM.
if[command] = f Power off FM.
if[command] = t Tune FM channel to [frequency].
if[command] = a FM auto seek test.
if[command] = m Mono(1) or Stereo(0).
if[command] = v Volume (0x00 - 0x0F).
if[command] = u Mute(0)
if[command] = g AGC(1)
if[command] = h Set seek threshold (0x00 - 0xFF).
if[command] = s Seek Up(1) or Down(0).
if[command] = r Get RSSI (0x00 - 0xFF).
if[command] = c Get current channel [frequency].
if[command] = d Get RDS data (1 - 10 groups of data).
*******************************************
Cmd>cpldver
xsvfExecute - CpldType=1
SUCCESS - Completed XSVF execution.
CPLD Ver[0]=1
CPLD Ver[1]=FC
CPLD Ver[2]=26
CPLD Ver[3]=5
Unknown yet.
*******************************************
Cmd>SetDsbDBGMSGT
Unknown yet.
*******************************************
Cmd>ReadExtROM
Dump Ext ROM to MTTY terminal
*******************************************
Cmd>WLANReset
Usage:
WLANReset 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>WLANReset 0
WLANReset(FALSE)
Cmd>WLANReset 1
WLANReset(TRUE)
*******************************************
Cmd>SDSelect
Usage:
SDSelect 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>SDSelect 1
Select SD Card
*******************************************
Cmd>emapiWlanMac
Notice: This MAC address takes effect only when your platform is EEPRON-less configuration. Please use (emapiTest) to verify it !
Copying GSM DATA image to SDRAM:00004000
Wlan data header ++++++++++++++++++++
Signature : 0xEE1250
UpdateStatus : 0x2
UpdateCount : 0xA
BodyLength : 0x1A1
BodyCRC : 0x4349311B
Wlan data header --------------------------
0x00000000
0x00000009
0x0000002D
0x000000D2
0x000000D5
0x000000FB
*******************************************
Cmd>emapiTest
+emapiTest
1. Power on WLAN
2. Reset WLAN
3. Switch MUX to WLAN
4. Enable WLAN clock
5. Init WLAN SDIO interface
6. DeviceID Test
DeviceID = 403xxxx
EEPROMless configuration!
-emapiTest
*******************************************
Cmd>emapiPwrDwn
*******************************************
Cmd>emapiRead
Parameter Wrong!!
*******************************************
Cmd>getdevinfo
Need password!
*******************************************
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
*******************************************
Cmd>password
Usage:
password [String]
Enter the password string to enable wdata, erase and rbmc functions.
*******************************************
Cmd>set
Usage:
set [Type Value]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Current flag settings:
Type 1(Operation mode flag): g_cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_dwFColor24bit=(0x0).
Type 5(Background color): g_dwBColor24bit=(0xFFFFFF).
Type 6(Set color of screen): None.
Type 32: Unlock Flash Command
Set control flags.
*******************************************
Cmd>SetDebugMethod
Copying GSM DATA image to SDRAM:00004000
Default DebugTransport Value =00000000
Current Usage:
0 No Debug
A UART MTTY Output Debug Message
B USB MTTY Output Debug Message
*******************************************
Cmd>checksum
Usage:
checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*******************************************
Cmd>ResetDevice
no comments
*******************************************
**When CID is locked.
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
**When CID is locked.
*******************************************
**When CID unlocked
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==
**When CID unlocked
*******************************************
Cmd>GPSRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
+GSM_Modem_Init : include DAGON
Copying GSM DATA image to SDRAM:00004000
GSM - dwSize = 3479D
GSM Page0
GSM - dwSize = 45457
GSM Page1
GSM - dwSize = 4B768
GSM Page2
GSM - dwSize = 4E0A9
GSM Page3
GSM - dwSize = 4B4C4
GSM Page4
GSM - dwSize = 4C71F
GSM Page5
GSM - dwSize = 2958E
GSM Page6
GSM - dwSize = E8D8
GSM Page7
Copying GSM CODE image to SDRAM:00000000
ARMBOOT = 1 --> boot from CS3
Reset ARM 7 -- ok
Please close MTTY USB connection and open BT Testing program...
*******************************************
Wow.. Very VERY nice!
Wow fdp24
Please how did you found out all those comands ?
I'm curious and in the need of unbricking some.
can we use any of therse comands to make the SimLockTool_Artemis_Excalibur tool work
Hello,
I have a type1brick.
I corrupt the radio after failed rom flash, now If i do a classic rom update, the process stuck at 0,1%.
I modify the hpruu.ini to reinstall the ceos and can reboot.
My device is a Ipaq 6515, but all i read here look very close and bootloader command are the same and a lot work for my device...and my questions general & not specific to this device.
Now I have a working os but no Gsm and the asset info blank (stack, imei ,etc..) just Radio present = Yes (The Gps & Bluetooth is ok.
With all i read on this forum i think or i have or :
1/ a CID problem
The command i try in bootloader :
Info 0 = Beetles
Info 1 = Bootloader
info 2 = NOTHING !!!
Just USB>
2/ A Corrupted OS of the radio that i have to manually erase (cf pof solution) and rewrite.
We have the password 0000000000000000 and erase and wdata work.
Rtask test :
Rtask 1 & 2 = radio on/off = ok
Rtask 3 = Radio image loaded
Rtask 4 = radio bootloader loaded
ernal bootloader & Stuck
Rtask 0 = Reset radio ok
Rtask a = stuck
rtask b : go to external bootloader & stuck
I successfully launch the radio booloader and the Radio Rom ??
So it's the Radio OS ??
We have do a dump rom of a working device on SD card,
of this adress : 60000000 with a length of 800000.
But the sd dump to our device fail to flash (via sd card)
If in the bricked device we do :
USB>Checksum
number is ok
but with the specified adress range d2s & checksum fail.
The device show "Cal.Checksum" and nothing happen.
I was very happy to have conclusions,
and if i can believe and spend time to investigate to solve my problem,
or if it's dead. My warranty is over and HP ask for 350$ motherboard replement.
So i really ready to try everything.
Thanks in advance for your analyse and suggestions.
Dimitri
Info log when trying to update the radio rom :
LOG of a Beetle P10504_BT_HP_Radio_Patch.EXE.
It hangs at 0% when trying to upgrade and the log looks like that:
09:20:18:137 [msg] : Client_Logging() !
09:20:18:137 [msg] : =============================================
09:20:18:137 [msg] : START Client_Initialize() !
09:20:18:137 [msg] : Call CheckActiveSyncVersion() !
09:20:18:137 [msg] : Call CheckCEMode() !
09:20:21:923 [msg] : Currecnt Not in CE Mode or in CE Mode but ActiveSync Not Connected.
09:20:21:923 [msg] : Call DisconnectActiveSync() !
09:20:26:149 [msg] : Start Get Connect Port !
09:20:26:379 [msg] : Currecnt in BL Mode. Open Port : [\\.\WCEUSBSH001] OK.
09:20:26:409 [msg] : Device CE Start Address : [80000000].
09:20:26:419 [msg] : Device Radio Start Address : [0].
09:20:26:419 [msg] : END Client_Initialize() !
09:20:26:419 [msg] : =============================================
09:20:26:419 [msg] : START Client_FlashRadioOS() ! FileName : [RADIOOS.nbf] ; HeaderLen : [1260].
09:20:26:439 [msg] : END Client_FlashRadioOS() !
09:20:26:439 [msg] : =============================================
09:20:46:508 [err] : Check Radio Status Error.
Attached you find a usbmonitor of a classic Hp rom update failed :
Thank for your help ! and sorry for the long post
dim920 said:
Hello,
I have a type1brick.
I corrupt the radio after failed rom flash, now If i do a classic rom update, the process stuck at 0,1%.
I modify the hpruu.ini to reinstall the ceos and can reboot.
My device is a Ipaq 6515, but all i read here look very close and bootloader command are the same and a lot work for my device...and my questions general & not specific to this device.
Now I have a working os but no Gsm and the asset info blank (stack, imei ,etc..) just Radio present = Yes (The Gps & Bluetooth is ok.
With all i read on this forum i think or i have or :
1/ a CID problem
The command i try in bootloader :
Info 0 = Beetles
Info 1 = Bootloader
info 2 = NOTHING !!!
Just USB>
2/ A Corrupted OS of the radio that i have to manually erase (cf pof solution) and rewrite.
We have the password 0000000000000000 and erase and wdata work.
Rtask test :
Rtask 1 & 2 = radio on/off = ok
Rtask 3 = Radio image loaded
Rtask 4 = radio bootloader loaded
ernal bootloader & Stuck
Rtask 0 = Reset radio ok
Rtask a = stuck
rtask b : go to external bootloader & stuck
I successfully launch the radio booloader and the Radio Rom ??
So it's the Radio OS ??
We have do a dump rom of a working device on SD card,
of this adress : 60000000 with a length of 800000.
But the sd dump to our device fail to flash (via sd card)
If in the bricked device we do :
USB>Checksum
number is ok
but with the specified adress range d2s & checksum fail.
The device show "Cal.Checksum" and nothing happen.
I was very happy to have conclusions,
and if i can believe and spend time to investigate to solve my problem,
or if it's dead. My warranty is over and HP ask for 350$ motherboard replement.
So i really ready to try everything.
Thanks in advance for your analyse and suggestions.
Dimitri
Info log when trying to update the radio rom :
LOG of a Beetle P10504_BT_HP_Radio_Patch.EXE.
It hangs at 0% when trying to upgrade and the log looks like that:
09:20:18:137 [msg] : Client_Logging() !
09:20:18:137 [msg] : =============================================
09:20:18:137 [msg] : START Client_Initialize() !
09:20:18:137 [msg] : Call CheckActiveSyncVersion() !
09:20:18:137 [msg] : Call CheckCEMode() !
09:20:21:923 [msg] : Currecnt Not in CE Mode or in CE Mode but ActiveSync Not Connected.
09:20:21:923 [msg] : Call DisconnectActiveSync() !
09:20:26:149 [msg] : Start Get Connect Port !
09:20:26:379 [msg] : Currecnt in BL Mode. Open Port : [\\.\WCEUSBSH001] OK.
09:20:26:409 [msg] : Device CE Start Address : [80000000].
09:20:26:419 [msg] : Device Radio Start Address : [0].
09:20:26:419 [msg] : END Client_Initialize() !
09:20:26:419 [msg] : =============================================
09:20:26:419 [msg] : START Client_FlashRadioOS() ! FileName : [RADIOOS.nbf] ; HeaderLen : [1260].
09:20:26:439 [msg] : END Client_FlashRadioOS() !
09:20:26:439 [msg] : =============================================
09:20:46:508 [err] : Check Radio Status Error.
Attached you find a usbmonitor of a classic Hp rom update failed :
Thank for your help ! and sorry for the long post
Click to expand...
Click to collapse
Humm... that is quite a mouthful. Have you got the correct version of Radio_.nbf ? Not really sure how things work in ipaq. If you have not tried this already, please remove all the .nbf files (in a full rom upgrade package there are 3) except the radio_.nbf and execute the upgrade with the original cable while in the bootloader mode. The original cable is particularly recomended for radio roms. Out of the three .nbf files radio_.nbf takes the maximum time so be patient. Hope this works....and yes please do search an ipaq fora as you will get more specific help.
Thank you very much to try to help me !
The Beetles device work very close to yours.
Excuse me to come in this forum, but i look around the world forums,
but i think helpfull persons are on device like yours.
The Rom upgrade beetles from Hp come with Hpruu.exe and 4 files :
RadioOS.nbf
RadioFS.nbf
CEOS.nbf
Extrom.nbf
If i do only a selected upgrade as you say, i can reinstall the Os,
but never the Radio, always stuck at 1%.
(after os reinstall, gps & bluetooth ok, but gsm asset blank)
It's very similar problem to a lot of bricked Universal device who was
successfully unbricked here.
I spend a lot of time in the Bootloader,
I Know now that my CID is ok, but my Radio Os dead.
All success story i see here manually erase some adress range,
and manually rewrite the radio part.
I can do that in the bootloader with commande "erase" and "wdata".
But i don't know how in the other device you have successfully
find the good adress range to erase and rewrite.
How i can investigate this ?
I have all install of rom from Hp, unofficial, dump rom of a working device of a selected adress range who normally include the radio part, etc..
Thank you
Dim
Hello,
I have a type1brick.
I corrupt the radio after failed rom flash, now If i do a classic rom update, the process stuck at 0,1%.
I modify the hpruu.ini to reinstall the ceos and can reboot.
My device is a Ipaq 6515, but all i read here look very close and bootloader command are the same and a lot work for my device...and my questions general & not specific to this device.
Now I have a working os but no Gsm and the asset info blank (stack, imei ,etc..) just Radio present = Yes (The Gps & Bluetooth is ok.
With all i read on this forum i think or i have or :
1/ a CID problem
The command i try in bootloader :
Info 0 = Beetles
Info 1 = Bootloader
info 2 = NOTHING !!!
Just USB>
2/ A Corrupted OS of the radio that i have to manually erase (cf pof solution) and rewrite.
We have the password 0000000000000000 and erase and wdata work.
Rtask test :
Rtask 1 & 2 = radio on/off = ok
Rtask 3 = Radio image loaded
Rtask 4 = radio bootloader loaded
ernal bootloader & Stuck
Rtask 0 = Reset radio ok
Rtask a = stuck
rtask b : go to external bootloader & stuck
I successfully launch the radio booloader and the Radio Rom ??
So it's the Radio OS ??
We have do a dump rom of a working device on SD card,
of this adress : 60000000 with a length of 800000.
But the sd dump to our device fail to flash (via sd card)
If in the bricked device we do :
USB>Checksum
number is ok
but with the specified adress range d2s & checksum fail.
The device show "Cal.Checksum" and nothing happen.
I was very happy to have conclusions,
and if i can believe and spend time to investigate to solve my problem,
or if it's dead. My warranty is over and HP ask for 350$ motherboard replement.
So i really ready to try everything.
Thanks in advance for your analyse and suggestions.
Dimitri
Info log when trying to update the radio rom :
LOG of a Beetle P10504_BT_HP_Radio_Patch.EXE.
It hangs at 0% when trying to upgrade and the log looks like that:
09:20:18:137 [msg] : Client_Logging() !
09:20:18:137 [msg] : =============================================
09:20:18:137 [msg] : START Client_Initialize() !
09:20:18:137 [msg] : Call CheckActiveSyncVersion() !
09:20:18:137 [msg] : Call CheckCEMode() !
09:20:21:923 [msg] : Currecnt Not in CE Mode or in CE Mode but ActiveSync Not Connected.
09:20:21:923 [msg] : Call DisconnectActiveSync() !
09:20:26:149 [msg] : Start Get Connect Port !
09:20:26:379 [msg] : Currecnt in BL Mode. Open Port : [\\.\WCEUSBSH001] OK.
09:20:26:409 [msg] : Device CE Start Address : [80000000].
09:20:26:419 [msg] : Device Radio Start Address : [0].
09:20:26:419 [msg] : END Client_Initialize() !
09:20:26:419 [msg] : =============================================
09:20:26:419 [msg] : START Client_FlashRadioOS() ! FileName : [RADIOOS.nbf] ; HeaderLen : [1260].
09:20:26:439 [msg] : END Client_FlashRadioOS() !
09:20:26:439 [msg] : =============================================
09:20:46:508 [err] : Check Radio Status Error.
Attached you find a usbmonitor of a classic Hp rom update failed :
Thank for your help ! and sorry for the long post
Hello. How edit WM6 rom in bin (BB000FF)? WM5 ROM editing tool works badly (files are unpacked not all). The size of firmware 39 mb. Firmware upload in 2 stages:
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImage "c:\wm6.bin"
:F=c:\wm6.bin
start download
SAddress 82040000Hh Length 02700000h
Format BINFS...
Format BINFS Completed. Continue to set BINFS type.
Set BINFS_TYPE success.
Before flashing new image , formatting old OS is completed!!
Start flashing new image!!!
*checksum = 0, skip checking
OEMFlashWrite(82040000h,8C080000h,01B00000h)
Update BINFS offset 0x00000000 length 0x01B00000 ...
Write BinFS Offset add=0x0 Length=0x1B00000 Checksum=0x8F6C825D
Write to BINFS partition from sector 0, length 28311552, 55296 sectors...
Read from BINFS from sector 0, length 28311552, 55296 sectors
Read complete
Read back BinFS Offset add=0x0 Length=0x1B00000 Checksum=0x8F6C825D
Update BINFS success.
*checksum = 0, skip checking
Image Download Finish
OEMFlashWrite(83B40000h,8C080000h,00C00000h)
Update BINFS offset 0x01B00000 length 0x00C00000 ...
Write BinFS Offset add=0x1B00000 Length=0xC00000 Checksum=0x5402F0E8
Write to BINFS partition from sector 55296, length 12582912, 24576 sectors...
Read from BINFS from sector 55296, length 12582912, 24576 sectors
Read complete
Read back BinFS Offset add=0x1B00000 Length=0xC00000 Checksum=0x5402F0E8
Update BINFS success.
Please reset the device to restart the program!!
DownloadImage success.
hello ? Thanks ? Please ? Good Bye ?
Anyway, tools works relatively great for cooking WM6 Romz...
Look for Artemis kitchen, all is include except htcrt for translating nb to nbh.
Hello,
I have found the solution to this problem that appears very frequently.
To pass this problem you have to:
1.- Push cam+conect usb and wait until usb is detected (clong sound in Windows)
2.- Execute mtty and execute ResetDevice. Wait until USB disconnects (clong sound in Windows) and close mtty.
3.- After some seconds USB reconnects, so execute again mtty normally. Select USB, etc.
4.- Flash normally with l c:\wm.bin
IT NEVER FAILS.
PHP:
Cmd>ResetDevice
The devide restarts.
PHP:
Cmd>l c:\wm61.bin
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImage "c:\wm61.bin"
:F=c:\wm61.bin
start download
SHAddress 82040000h Length 01B00000h
Format BINFS...
Format BINFS Completed. Continue to set BINFS type.
Set BINFS_TYPE success.
Before flashing new image , formatting old OS is completed!!
Start flashing new image!!!
*Image Download Finish
OEMFlashWrite(82040000h,8C080000h,01B00000h)
Update BINFS offset 0x00000000 length 0x01B00000 ...
Write BinFS Offset add=0x0 Length=0x1B00000 Checksum=0xCA7FDC36
Write to BINFS partition from sector 0, length 28311552, 55296 sectors...
Read from BINFS from sector 0, length 28311552, 55296 sectors
Read complete
Read back BinFS Offset add=0x0 Length=0x1B00000 Checksum=0xCA7FDC36
Update BINFS success.
Please reset the device to restart the program!!
DownloadImage success.
Cmd>ResetDevice