RIFF JTAG – SonyEricsson Xperia X10 Unbrick – Boot repair supported

30.07.2011     SonyEricsson Xperia X10 Unbrick – Boot repair supported

Resurrecting SE X10 is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is inserted. Be careful, JTAG pads are covered under blue mask covering, so you will need to scratch it off in order to be able to solder wires.
During resurrection, you can select which areas to be repaired. So you can choose only those areas which you know are damaged thus saving flashing time.

To resurrect SE X10:

  •  Solder JTAG cable to SE X10 JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure SE X10 is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

29.07.2011     Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

Samsung I9100 is based on the S5PV310 (Exynos 4210) Processor (Cortex-A9 Dual-Core).

JTAG pads are very small; professional experience in soldering is required to connect wires to the JTAG interface. There is a big variety of versions of Galaxy II devices: GT-I9100, GT-I9100G, GT-I9100L, GT-I9100M, GT-I9100T, GT-I9101, GT-I9103, GT-I9108, GT-I9188, and maybe more. Some of them are based on different hardware platform – the OMAP4430 (Cortex-A9 Dual-Core). Thus make sure first which exact hardware version you have on hands.
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on.
Phone has such booting sequence: ROM → FBL → IBL → PBL → SBL. Current resurrector will resurrect Partition Table (PIT) and SBL zones which are located in the iNAND (eMMC) memory. Write access to memory which contains FBL, IBL and PBL loaders is not supported currently, but in case your phone has these loaders damaged, you can choose “Initiate Download Mode” way of resurrection in order to directly put the phone into the Download Mode.

To resurrect Samsung I9100:

  •  Solder JTAG cable to Samsung I9100 JTAG pads;
  •  Connect USB cable to phone and PC;
  •  Insert battery;
  •  Make sure Samsung I9100 is selected in the list of models;
  •  Make sure a fixed TCK frequency is selected;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On.
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04 Released

29.07.2011  JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04

Whats new :

RIFF JTAG Manager v1.34:

  •  JTAG Manager Project has been migrated into UNICODE.

Main advantage of this – GUI (captions of buttons, labels, etc) can now support all international characters, for example chinese
WARNING!!! Due to UNICODE migration old plugin DLLs are not compatible with JTAG Manager 1.34
Simply download new set of plugins which are unicode compatible now.

  •  Multilanguage GUI is implemented (and due to migration to UNICODE even chinese language can be fully supported)

You need to download language pack dll, for example Russian.dll. After installation go to BOX SERVICE page and there will
be available language selection.
Following items are translated into selected language by the language DLL:
1. JTAG Manager interface – labels, captions, etc.
2. JTAG Manager messages which are shown during active operation.
3. Most of messages shown by resurrector DLLs
4. Some of Resurrection Manuals (if current version of language pack does not have translated version of Resurrection Manual, then an original, English version will be shown)

  • A dded warning window which will appear on DCC Read/Write page in case user tries to flash full dump with wrong settings.

So user can check what he does wrong and thus avoid losing time and making mistakes.

  •  ARM Core Cortex-A9 (Single and MPCore) and Chipset OMAP4430 (Dual-core Cortex-A9) are addred to the supported cores list;
  •  Cortex-A9 core added to the CMM Script Engine: Example: SYSTEM.CPU CORTEXA9
  •  OMAP4430 core added to the CMM Script Engine: Example: SYSTEM.CPU OMAP4430
  •  Multicore control is added to the CMM Script Engine (Use CORE.SELECT instructions to switch between cores in multicore targets)

For example CORE.SELECT 0 will select core0, CORE.SELECT 3 will select core3

  •  Added access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)

through the CMM Script Engine (‘APB’ segment specifier added)
Thus, for example instruction: &Resp=data.long(APB:0x12345678) – will read dword from APB bus at address 0x12345678

  • Added SYSTEM.CONFIG.RESETTIMEOUT variable to the CMM Script Engine, thus it’s now possible to customise reset type and timeout

by setting this variable prior SYSTEM.UP command.

  •  Fixed bug which caused saving trash after read operaions on DCC Read/Write page in these cases:

a) reading was stopped by user
b) after JTAG Manager exe restart

  •  DCC Read/Write Page operations now allow 64-bit addressing, thus user can have full access to memory devices which size exceeds 0xFFFFFFFF bytes range.

For this, the Address and Length fields have now 10 digits instead of old 8 digits. Be carefull entering values there.
UNEXPERIENED USERS PLEASE NOTE: For example 8 digit hex value 0x12345678 entered into 10 digit field IS NOT 0x1234567800 (!!!!!) CORRECT IS 0x0012345678

  •  TGauge64 component was implemented in order to support full 64-bit range of progress indications (while old progress bars were limited to 31-bit maximum value)
  •  Fixed bug with incorrect display of scrollbars during scroling through Model and Manufacturer Lists
  • Fixed bug during erase:
    If bad block happened, and user choosed Ignore method and checked ‘Remember selection’ – software  would again popup selection dialog on next bad block.
  •  JTAG I/O Voltage (for Custom Target Settings) now has voltages from 1.6V upto 3.30V with resolution 0.05V
  •  Just for convenience added button “Target Continue” to the JTAG Read/Write page.
    This just allows to resume target running from current PC value without need to enter it explicitly into “Address” field as is needed for the “Target GO” button
RIFF Box firmware v1.26 :
  • Added support for Cortex-A9 single processor core;
  • Added support for Cortex-A9 multiprocessor cores. Multicore handling rules are following:1. After target reset (NRST=1-0-1) the Core0 is automatically selected;

    2. HALT operation halts only currently selected core (by default core0 is selected); Thus in order to halt other core user has to select required core and then execute halt operation.

    3. Reset operation can accept different strategies of reset and halt:

    – Reset, then halt all cores at the very first instruction (for now only for OMAP MCUs)
    – Reset, than halt only core0 at the very first instruction (for now only for OMAP MCUs)
    – Reset, pause, then halt all cores
    – Reset, pause, than halt only core0

    4. RUN operation starts only currently selected core.

Thus in order to start other core user has to select required core and then execute run operation.

For example, if target has 4 cores (Quad-core MCU), then after HALT operation only Core0 is halted.
To halt Core2 user has to write script:
CORE.SELECT 2
BREAK

For example, to run Core3 user has to write script:
CORE.SELECT 3
GO

  • Added H/W script (*.has) instruction which enables selection of core for multiprocessor targets;
  • Added script (CMM/HAS) access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)
  • Added support for OMAP4430 Dual-core Cortex-A9 MCU
RIFF GDB Server v1.04 :
  • Fixed bug with reset timeout – erroneously value in Edit field was taken as HEX not decimal, Now is ok
  • Added few more GDB commands for compatibility with IDA 6.1 remote debugging.
  • Added Thumb2 instruction TBB and TBW for single stepping
  • Fixed bug in Thumb/Thumb2 when stepping out of sub when POP {RegList, PC} is used (In Thumb mode return PC address is 0x01 ORed)
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung GT-i8700 Omnia 7 , Samsung W299 Duos Unbrick – Boot repair supported

29.07.2011   Samsung GT-i8700 Omnia 7 , Samsung W299 Duos Unbrick – Boot repair supported
Resurrecting Samsung I8700 is simple. Phone is auto powered on with USB Data Cable connected to the PC while battery is inside. In case you use the battery only please note you will have to press Power On key once.
To resurrect Samsung I8700:

  •  Solder JTAG cable to Samsung I8700 JTAG pads;
  •  Make sure Samsung I8700 is selected in the list of models;
  •  Insert Battery into phone and connect USB cable (in case you not use USB cable, press once the Power ON key on the phone)
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Up’ and ‘Camera’ keys and press ‘Power ON’ button. In few seconds phone enters download mode.

 

Resurrecting Samsung W299 is simple. Phone is auto powered on with USB Data Cable connected to the PC while battery is inside. In case you use the battery only please note you will have to press Power On key once.
To resurrect Samsung W299:

  •  Solder JTAG cable to Samsung W299 JTAG pads;
  •  Make sure Samsung W299 is selected in the list of models;
  •  Insert Battery into phone and connect USB cable (in case you not use USB cable, press once the Power ON key on the phone)
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

15.07.2011  Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

Current resurrector works with Qtek 9000 with MDOC G3 memory version. In order to establish JTAG connection charged battery is required. In some cases you will need to press power on key during initiating connection.
Please note, in case the Download Mode Initiation resurrection way is selected in the resurrector popup settings window, battery must be charged enough in order for phone to enter download mode.

Current resurrector offers 2 ways to resurrect the phone:

  •  WAY1: Writing SPL code directly into the MDOC memory (there are 2 hardware versions of the Qtek 9000 exist: boards with G4-type MDOC memory and boards with G3-type MDOC memory; current resurrector contains DCC Loader for G3 MDOC memory; thus for G4 version you need to use other resurrector)

 

  •  WAY2: Initiating DOWNLOAD MODE without touching MDOC contents;

MDOC G3 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL loader. Current resurrector will not touch the IPL zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0200/0xFDFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
In this case resurrection of your device is not possible. We advise you to solder a new flash memory chip and then use resurrector with IPL re-flash enabled.
To resurrect Qtek 9000 G3:

  •  Solder JTAG cable to Qtek 9000 G3 JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure Qtek 9000 G3 is selected in the list of models;
  •  Click Resurrect button;
  •  In popup window select desired way of resurrection;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Light’ key (the one near to the volume slider) and ‘Power On’ key and press with stylus the reset hole-button.

Additional info:

  •  The DiskOnChip G3 memory type has security features. Access to both protected partitions (as IPL loader area) is done using password 00000000.
  •  IPL re-flash is intentionally switched off in this resurrector. While re-flashing the IPL area there is a risk of permanently blocking the memory chip.
  •  Memory is two DiskOnChip (MDOC) G3 cascaded chips, IDs are 0x0200; capacity is 64Mb+64Mb); though current DCC Loader was tested to read/write correctly only the SPL zones.

 

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung T749, Samsung E189 Unbrick – Boot repair supported

12.07.2011 Samsung T749, Samsung E189 Unbrick – Boot repair supported

The Samsung T749 board is auto powered on with USB Data Cable connected to the PC. Battery presence is not required; connection can be established with detached board.
To resurrect Samsung T749:

  •  Solder JTAG cable to Samsung T749 JTAG pads;
  •  Connect USB cable;
  •  Make sure Samsung T749 is selected in the list of models;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
In case you cannot find firmware files use Global RIFF Link & Data Exchange plugin – at the moment of resurrector release there was shared full dump from alive Samsung T749 phone.
To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Up’ and ‘Camera’ keys and press ‘Power ON’ button.

 

 

 

Resurrecting Samsung E189 is simple.
Phone is auto powered on with USB Cable connected to the PC. Battery presence is not required; connection can be established with detached board.
Current resurrector contains Firmware and EEPROM zones for memory chip with ID 0x00EC/0x2256
To resurrect Samsung E189:

  •  Solder JTAG cable to Samsung E189 JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure Samsung E189 is selected in the list of models;
  •  Click Resurrect button;
  •  Choose which areas to flash;
  •  Wait till software signals a successful operation completion;
  •  De-solder JTAG wires;


Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – HTC Wildfire S A510E (HTC Marvel), More CDMA models supported

07.07.2011  HTC Wildfire S A510E (HTC Marvel), More CDMA models supported.

Resurrecting HTC WildFireS is easy. Phone is auto powered on with USB Data Cable connected to the PC. Battery presence is not required; connection can be established with detached board.
In case you have no USB cable near, make sure battery is charged enough and hold Power On button during initiation of JTAG connection.
Resurrector will reflash radio’s boot zone and will re-write PDA’s SPL to 1.01.0002 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PC4910000’. Additionally, you can check ‘Repair RECOVERY zones’ to reflash android BOOT and RECOVERY code.

To resurrect HTC WildFireS:

  •  Solder JTAG cable to HTC WildFireS JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure HTC WildFireS is selected in the list of models;
  •  If you use battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Volume Down’ key and press ‘Power ON’ button. In few seconds you should see usual android boot mode screen.
 

Following CDMA models are supported from today :
  • Samsung B139 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B259 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B309 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B319 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B379 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B619 Repair/Unbrick, Read/Write NOR Flash
  • Huawei C31 Repair, Read/Write NOR flash
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

22.06.2011  Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

Samsung T959V is based on the S5PCxxx Processor (ARM core is Cortex-A8).
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on. But note, in very rare cases it is possible that you will have to hold Power On key during initial connection.
In case after resurrection (after you have tried with both boot versions) the download mode is not initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung T959V:

  • Solder JTAG cable to Samsung T959V JTAG pads;
  • Connect microUSB cable to phone and PC;
  • Insert battery;
  • Make sure Samsung T959V is selected in the list of models;
  • Make sure a fixed TCK frequency is selected;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold both ‘Volume Down’ and ‘Volume Up’ keys and press Power-On.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – CDMA day again, 3 new models supported

22.06.2011  CDMA day again, 3 new models supported

Whats new:

  • Motorola W200 full support
  • Huawei C2801 full support
  • Nokia 1006   full support

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – HTC Desire HD A9191 (HTC Ace) Unbrick, IMEI, CID, ModelID, Simlock repair

16.06.2011   RIFF JTAG – HTC Desire HD A9191 (HTC Ace) Unbrick, IMEI, CID, ModelID, Simlock repair

Resurrecting HTC Desire HD is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Some (or all) revisions of HTC Desire HD boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM8255 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the FSBL loader, so writing to FSBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into FSBL zone and will respond with success code as if flashing succeeded. In this way FSBL zone is protected while user still can flash full image files seamlessly.
Resurrector will reflash radio’s boot zone (except FSBL area) and will re-write PDA’s SPL to 0.85.0007 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PD9810000’.
There is option to reflash BOOT and RECOVERY zones. If selected, then ClockworkMod Recovery v3.0.2.8 will be flashed.

Please note, if your phone has the FSBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Desire HD:

  • Solder JTAG cable to HTC Desire HD JTAG pads;
  • Insert batter and connect USB Data cable;
  • Make sure HTC Desire HD is selected in the list of models;
  • If you use only battery, press Power On key;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘Volume Down’ key and press ‘Power ON’ button

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.