Hello,
I have found the solution to this problem that appears very frequently.
To pass this problem you have to:
1.- Push cam+conect usb and wait until usb is detected (clong sound in Windows)
2.- Execute mtty and execute ResetDevice. Wait until USB disconnects (clong sound in Windows) and close mtty.
3.- After some seconds USB reconnects, so execute again mtty normally. Select USB, etc.
4.- Flash normally with l c:\wm.bin
IT NEVER FAILS.
PHP:
Cmd>ResetDevice
The devide restarts.
PHP:
Cmd>l c:\wm61.bin
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImage "c:\wm61.bin"
:F=c:\wm61.bin
start download
SHAddress 82040000h Length 01B00000h
Format BINFS...
Format BINFS Completed. Continue to set BINFS type.
Set BINFS_TYPE success.
Before flashing new image , formatting old OS is completed!!
Start flashing new image!!!
*Image Download Finish
OEMFlashWrite(82040000h,8C080000h,01B00000h)
Update BINFS offset 0x00000000 length 0x01B00000 ...
Write BinFS Offset add=0x0 Length=0x1B00000 Checksum=0xCA7FDC36
Write to BINFS partition from sector 0, length 28311552, 55296 sectors...
Read from BINFS from sector 0, length 28311552, 55296 sectors
Read complete
Read back BinFS Offset add=0x0 Length=0x1B00000 Checksum=0xCA7FDC36
Update BINFS success.
Please reset the device to restart the program!!
DownloadImage success.
Cmd>ResetDevice
Related
Below are some commands for Artemis.
For the moment still did not find a command to backup existing ROM.
There are some interesting ones related to debug and use of TFTP.
Commands are case sensitive.
Looks like battery is charging while in bootloader mode. It was not a case with Prophet.
regards,
fdp24
*******************************************
Cmd>fm
Wrong parameters of FM Command!!
Usage:
fm [command] [frequency]
where:
if[command] = i Initialize FM.
if[command] = o Power on FM.
if[command] = f Power off FM.
if[command] = t Tune FM channel to [frequency].
if[command] = a FM auto seek test.
if[command] = m Mono(1) or Stereo(0).
if[command] = v Volume (0x00 - 0x0F).
if[command] = u Mute(0)
if[command] = g AGC(1)
if[command] = h Set seek threshold (0x00 - 0xFF).
if[command] = s Seek Up(1) or Down(0).
if[command] = r Get RSSI (0x00 - 0xFF).
if[command] = c Get current channel [frequency].
if[command] = d Get RDS data (1 - 10 groups of data).
*******************************************
Cmd>cpldver
xsvfExecute - CpldType=1
SUCCESS - Completed XSVF execution.
CPLD Ver[0]=1
CPLD Ver[1]=FC
CPLD Ver[2]=26
CPLD Ver[3]=5
Unknown yet.
*******************************************
Cmd>SetDsbDBGMSGT
Unknown yet.
*******************************************
Cmd>ReadExtROM
Dump Ext ROM to MTTY terminal
*******************************************
Cmd>WLANReset
Usage:
WLANReset 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>WLANReset 0
WLANReset(FALSE)
Cmd>WLANReset 1
WLANReset(TRUE)
*******************************************
Cmd>SDSelect
Usage:
SDSelect 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>SDSelect 1
Select SD Card
*******************************************
Cmd>emapiWlanMac
Notice: This MAC address takes effect only when your platform is EEPRON-less configuration. Please use (emapiTest) to verify it !
Copying GSM DATA image to SDRAM:00004000
Wlan data header ++++++++++++++++++++
Signature : 0xEE1250
UpdateStatus : 0x2
UpdateCount : 0xA
BodyLength : 0x1A1
BodyCRC : 0x4349311B
Wlan data header --------------------------
0x00000000
0x00000009
0x0000002D
0x000000D2
0x000000D5
0x000000FB
*******************************************
Cmd>emapiTest
+emapiTest
1. Power on WLAN
2. Reset WLAN
3. Switch MUX to WLAN
4. Enable WLAN clock
5. Init WLAN SDIO interface
6. DeviceID Test
DeviceID = 403xxxx
EEPROMless configuration!
-emapiTest
*******************************************
Cmd>emapiPwrDwn
*******************************************
Cmd>emapiRead
Parameter Wrong!!
*******************************************
Cmd>getdevinfo
Need password!
*******************************************
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
*******************************************
Cmd>password
Usage:
password [String]
Enter the password string to enable wdata, erase and rbmc functions.
*******************************************
Cmd>set
Usage:
set [Type Value]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Current flag settings:
Type 1(Operation mode flag): g_cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_dwFColor24bit=(0x0).
Type 5(Background color): g_dwBColor24bit=(0xFFFFFF).
Type 6(Set color of screen): None.
Type 32: Unlock Flash Command
Set control flags.
*******************************************
Cmd>SetDebugMethod
Copying GSM DATA image to SDRAM:00004000
Default DebugTransport Value =00000000
Current Usage:
0 No Debug
A UART MTTY Output Debug Message
B USB MTTY Output Debug Message
*******************************************
Cmd>checksum
Usage:
checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*******************************************
Cmd>ResetDevice
no comments
*******************************************
**When CID is locked.
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
**When CID is locked.
*******************************************
**When CID unlocked
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==
**When CID unlocked
*******************************************
Cmd>GPSRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
+GSM_Modem_Init : include DAGON
Copying GSM DATA image to SDRAM:00004000
GSM - dwSize = 3479D
GSM Page0
GSM - dwSize = 45457
GSM Page1
GSM - dwSize = 4B768
GSM Page2
GSM - dwSize = 4E0A9
GSM Page3
GSM - dwSize = 4B4C4
GSM Page4
GSM - dwSize = 4C71F
GSM Page5
GSM - dwSize = 2958E
GSM Page6
GSM - dwSize = E8D8
GSM Page7
Copying GSM CODE image to SDRAM:00000000
ARMBOOT = 1 --> boot from CS3
Reset ARM 7 -- ok
Please close MTTY USB connection and open BT Testing program...
*******************************************
Wow.. Very VERY nice!
Wow fdp24
Please how did you found out all those comands ?
I'm curious and in the need of unbricking some.
can we use any of therse comands to make the SimLockTool_Artemis_Excalibur tool work
Hello. How edit WM6 rom in bin (BB000FF)? WM5 ROM editing tool works badly (files are unpacked not all). The size of firmware 39 mb. Firmware upload in 2 stages:
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImage "c:\wm6.bin"
:F=c:\wm6.bin
start download
SAddress 82040000Hh Length 02700000h
Format BINFS...
Format BINFS Completed. Continue to set BINFS type.
Set BINFS_TYPE success.
Before flashing new image , formatting old OS is completed!!
Start flashing new image!!!
*checksum = 0, skip checking
OEMFlashWrite(82040000h,8C080000h,01B00000h)
Update BINFS offset 0x00000000 length 0x01B00000 ...
Write BinFS Offset add=0x0 Length=0x1B00000 Checksum=0x8F6C825D
Write to BINFS partition from sector 0, length 28311552, 55296 sectors...
Read from BINFS from sector 0, length 28311552, 55296 sectors
Read complete
Read back BinFS Offset add=0x0 Length=0x1B00000 Checksum=0x8F6C825D
Update BINFS success.
*checksum = 0, skip checking
Image Download Finish
OEMFlashWrite(83B40000h,8C080000h,00C00000h)
Update BINFS offset 0x01B00000 length 0x00C00000 ...
Write BinFS Offset add=0x1B00000 Length=0xC00000 Checksum=0x5402F0E8
Write to BINFS partition from sector 55296, length 12582912, 24576 sectors...
Read from BINFS from sector 55296, length 12582912, 24576 sectors
Read complete
Read back BinFS Offset add=0x1B00000 Length=0xC00000 Checksum=0x5402F0E8
Update BINFS success.
Please reset the device to restart the program!!
DownloadImage success.
hello ? Thanks ? Please ? Good Bye ?
Anyway, tools works relatively great for cooking WM6 Romz...
Look for Artemis kitchen, all is include except htcrt for translating nb to nbh.
Hello,
I'm New here....
This is my first T-mobile sda1(Germany) without camera to upgrade/downgrade
I want downgrade back WM2003, and now this mistake!!!
What should I do?
l c:/os.bin
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImageNot allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>info 2
GetDeviceInfo=0x00000002
Load Binary NORMAL partition: data from DiskOnChip to RAM
Start to read bianry partition.
Read binary partition successfully.
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
Load Binary NORMAL partition: data from DiskOnChip to RAM
Start to read bianry partition.
Read binary partition successfully.
HTCST-MOB001 1Å›™HTCE
Cmd>
Hi. This is a message to experts.
Loiking at bootloader in my broken ELFIN, well lets better say death, because even with GOLD CARD couldnt get alive, i found a commnad called wdata. This this the screen result:
==========================================================
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
==========================================================
So the question is. Is there any way of using that command to access the F****** g_cKeyCardSecurityLevel = FF register and modify it?.
Anyone knows whats the memory position of that register?, if so, How can i change it?
Hopping anwsers.
Thanks
QFLASH Problem
What the hell .. squint emoticon
"No data read from USB. This may not be an error. Trying again..."
if anyone knw about it so Guide me .i am very close :|
D:\Downloads\Compressed\Moto.X.Unbrick\Python27>python 8960_blankflash.py
Emergency download enumeration detected on port - com3
Starting qflash!
Executing command qflash.exe -com3 -ramload MPRG8960.hex -mbn 33 MSM8960_bootloa
der_singleimage.bin -v -o
Motorola qflash Utility version 1.3
COMPORT :COM3
RAMLOADER :MPRG8960.hex
type is 0x21
7 mbn file name MSM8960_bootloader_singleimage.bin type 33
verbose mode on
Motorola qflash dll version 1.6
RAMLOADER VERSION: PBL_DloadVER2.0
------------------------------------------------------
DEVICE INFORMATION:
------------------------------------------------------
Version : 0x8
Min Version : 0x1
Max Write Size: 0x600
Model : 0x90
Device Size : 0
Description : Intel 28F400BX-TL or Intel 28F400BV-TL
------------------------------------------------------
Using passed in packet size, changing from 0x600 -> 0x600
EXTENDED_LINEAR_ADDRESS_REC @ 0x2a000000
Write 65536 bytes @ 0x2a000000
100EXTENDED_LINEAR_ADDRESS_REC @ 0x2a010000
Write 11840 bytes @ 0x2a010000
100START_LINEAR_ADDRESS_REC @ 0x2a000000
No data read from USB. This may not be an error. Trying again...
No data read from USB. This may not be an error. Trying again...
No data read from USB. This may not be an error. Trying again...
No data read from USB. This may not be an error. Trying again...
No data read from USB. This may not be an error. Trying again...
Still no data, giving up!
dmss_go : failed to receive ACK
Error loading MPRG8960.hex into device
Blank flashing successful
Device will now enumerate in fastboot mode
D:\Downloads\Compressed\Moto.X.Unbrick\Python27>pause
Press any key to continue . .