RIFF JTAG – JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04 Released

Posted on July 29, 2011 by admin

29.07.2011 JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04

Whats new :

RIFF JTAG Manager v1.34:

JTAG Manager Project has been migrated into UNICODE.

Main advantage of this – GUI (captions of buttons, labels, etc) can now support all international characters, for example chinese
WARNING!!! Due to UNICODE migration old plugin DLLs are not compatible with JTAG Manager 1.34
Simply download new set of plugins which are unicode compatible now.

Multilanguage GUI is implemented (and due to migration to UNICODE even chinese language can be fully supported)

You need to download language pack dll, for example Russian.dll. After installation go to BOX SERVICE page and there will
be available language selection.
Following items are translated into selected language by the language DLL:
1. JTAG Manager interface – labels, captions, etc.
2. JTAG Manager messages which are shown during active operation.
3. Most of messages shown by resurrector DLLs
4. Some of Resurrection Manuals (if current version of language pack does not have translated version of Resurrection Manual, then an original, English version will be shown)

A dded warning window which will appear on DCC Read/Write page in case user tries to flash full dump with wrong settings.

So user can check what he does wrong and thus avoid losing time and making mistakes.

ARM Core Cortex-A9 (Single and MPCore) and Chipset OMAP4430 (Dual-core Cortex-A9) are addred to the supported cores list;
Cortex-A9 core added to the CMM Script Engine: Example: SYSTEM.CPU CORTEXA9
OMAP4430 core added to the CMM Script Engine: Example: SYSTEM.CPU OMAP4430
Multicore control is added to the CMM Script Engine (Use CORE.SELECT instructions to switch between cores in multicore targets)

For example CORE.SELECT 0 will select core0, CORE.SELECT 3 will select core3

Added access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)

through the CMM Script Engine (‘APB’ segment specifier added)
Thus, for example instruction: &Resp=data.long(APB:0x12345678) – will read dword from APB bus at address 0x12345678

Added SYSTEM.CONFIG.RESETTIMEOUT variable to the CMM Script Engine, thus it’s now possible to customise reset type and timeout

by setting this variable prior SYSTEM.UP command.

Fixed bug which caused saving trash after read operaions on DCC Read/Write page in these cases:

a) reading was stopped by user
b) after JTAG Manager exe restart

DCC Read/Write Page operations now allow 64-bit addressing, thus user can have full access to memory devices which size exceeds 0xFFFFFFFF bytes range.

For this, the Address and Length fields have now 10 digits instead of old 8 digits. Be carefull entering values there.
UNEXPERIENED USERS PLEASE NOTE: For example 8 digit hex value 0x12345678 entered into 10 digit field IS NOT 0x1234567800 (!!!!!) CORRECT IS 0x0012345678

TGauge64 component was implemented in order to support full 64-bit range of progress indications (while old progress bars were limited to 31-bit maximum value)
Fixed bug with incorrect display of scrollbars during scroling through Model and Manufacturer Lists
Fixed bug during erase:
If bad block happened, and user choosed Ignore method and checked ‘Remember selection’ – software would again popup selection dialog on next bad block.

JTAG I/O Voltage (for Custom Target Settings) now has voltages from 1.6V upto 3.30V with resolution 0.05V
Just for convenience added button “Target Continue” to the JTAG Read/Write page.
This just allows to resume target running from current PC value without need to enter it explicitly into “Address” field as is needed for the “Target GO” button

RIFF Box firmware v1.26 :

Added support for Cortex-A9 single processor core;
Added support for Cortex-A9 multiprocessor cores. Multicore handling rules are following:1. After target reset (NRST=1-0-1) the Core0 is automatically selected;
2. HALT operation halts only currently selected core (by default core0 is selected); Thus in order to halt other core user has to select required core and then execute halt operation.

3. Reset operation can accept different strategies of reset and halt:

– Reset, then halt all cores at the very first instruction (for now only for OMAP MCUs)
– Reset, than halt only core0 at the very first instruction (for now only for OMAP MCUs)
– Reset, pause, then halt all cores
– Reset, pause, than halt only core0

4. RUN operation starts only currently selected core.

Thus in order to start other core user has to select required core and then execute run operation.

For example, if target has 4 cores (Quad-core MCU), then after HALT operation only Core0 is halted.
To halt Core2 user has to write script:
CORE.SELECT 2
BREAK

For example, to run Core3 user has to write script:
CORE.SELECT 3
GO

Added H/W script (*.has) instruction which enables selection of core for multiprocessor targets;
Added script (CMM/HAS) access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)
Added support for OMAP4430 Dual-core Cortex-A9 MCU

RIFF GDB Server v1.04 :

Fixed bug with reset timeout – erroneously value in Edit field was taken as HEX not decimal, Now is ok
Added few more GDB commands for compatibility with IDA 6.1 remote debugging.
Added Thumb2 instruction TBB and TBW for single stepping
Fixed bug in Thumb/Thumb2 when stepping out of sub when POP {RegList, PC} is used (In Thumb mode return PC address is 0x01 ORed)

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

Posted on June 22, 2011 by admin

22.06.2011 Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

Samsung T959V is based on the S5PCxxx Processor (ARM core is Cortex-A8).
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on. But note, in very rare cases it is possible that you will have to hold Power On key during initial connection.
In case after resurrection (after you have tried with both boot versions) the download mode is not initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung T959V:

Solder JTAG cable to Samsung T959V JTAG pads;
Connect microUSB cable to phone and PC;
Insert battery;
Make sure Samsung T959V is selected in the list of models;
Make sure a fixed TCK frequency is selected;
Click Resurrect button;
Wait till software signals a successful operation completion;
Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

Disconnect PC cable;
Insert battery;
Hold both ‘Volume Down’ and ‘Volume Up’ keys and press Power-On.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Nexus S (i9023) Unbrick Boot repair supported

Posted on May 4, 2011 by admin

04.05.2011 Samsung Nexus S (i9023) Unbrick Boot repair supported

Samsung I9023 is based on the S5PCxxx Processor (ARM core is Cortex-A8).
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on. But note, in very rare cases it is possible that you will have to hold Power On key during initial connection.
Current resurrector has two different versions of primary boot loaders (PBL) embedded. This depends on hardware version of your phone which boot to use, thus in case of failure (cannot enter download mode after resurrection) of first loader try selecting another.
In case after resurrection (after you have tried with both boot versions) the download mode is not initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung I9023:

Solder JTAG cable to Samsung I9023 JTAG pads;
Connect microUSB cable to phone and PC;
Insert battery;
Make sure Samsung I9023 is selected in the list of models;
Make sure a fixed TCK frequency is selected;
Click Resurrect button;
Wait till software signals a successful operation completion;
Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

Disconnect PC cable;
Insert battery;
Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – RIFF JTAG Manager v1.28, RIFF Box firmware v1.20 released

Posted on March 14, 2011 by admin

14.03.2011 RIFF JTAG Manager v1.28, RIFF Box firmware v1.20 released

Whats new :

Firmware 1.20

Optimised connection to the PXA270 core
Added DCC TX channel (host-to-debugger) cleanup (flushing) feature (happens now during DCC Read with 0 timeout parameter) for Cortex-A8
Optimized Cortex-A8 connection establishment after coming out of reset (after NRST signal assertion)
Added emergency script processing for Cortex-A8 core (h/w script which is executed immediately after core was halted)

JTAG Manager 1.28

Added RAM selft-test right before uploading DCC loader.
Added functionality to handle complex memory devices (like MDOC H3) with lengths not necessary to be alighned to MBs;
Added DCC TX channel flushing command before starting DCC Loader – thus it is guaranteed that next first DCC read will get DCC Loader’s packet and not some residual trash data.
Added 1GB and 2GB OneNAND chips to the size autodetection list.
Added progress indication during saving files which were read on the DCC Read/Write page

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – CDMA Samsung SPH-D700 Galaxy S Epic 4G Unbrick, Dead Boot repair supported

Posted on March 14, 2011 by admin

14.03.2011 CDMA Samsung SPH-D700 Galaxy S Epic 4G Unbrick, Dead Boot repair supported

Samsung SPH-D700 is based on the S5PC110 Processor (ARM core is Cortex-A8). Depending on firmware state resurrection can be a bit confusing: for successful connection you will require charged battery. Please note – no matter whether you have USB cable or not – it must not be connected to phone. This is important.
Resurrector will reflash IBL, PBL, SPL and PARAM areas. Additionally you can select KERNEL and RECOVERY partitions to be reflashed too. Though them are required only for recovery mode and not needed for following USB firmware update by Odin software. So if you don’t need recovery mode don’t select these 2 partitions – otherwise you will just waste time waiting for them to be reflashed.
If after resurrection the download mode still cannot be initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung SPH-D700:

Solder JTAG cable to Samsung SPH-D700 JTAG pads;
Make sure USB cable or charger is not connected;
Make sure Samsung SPH-D700 is selected in the list of models;
Make sure a fixed TCK frequency is selected;
Insert battery;
Click Resurrect button;
Press Power On key; when you will see “Establish communication with the phone…” message – press Power On ey again (and hold it pressed for 1-2 seconds);
Wait till software signals a successful operation completion;
Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download or recovery mode:

Disconnect PC cable;
Insert battery;
Hold ‘1’ key on the keypad and press Power-On to enter download mode;
Hold both ‘Volume Down’ and ‘Camera’ keys and press Power-On to enter recovery mode.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.15, RIFF Box firmware v1.14 released

Posted on October 5, 2010 by admin

05.10.2010 JTAG Manager v1.15, RIFF Box firmware v1.14 released

Whats new:

Firmware 1.14
———————
– code is optimized to avoid deadlocks in Cortex-A8 handling routines (deadlocks appear due to communication errors);
– Cortex-A8 debug is now available in ARM/Thumb modes (use the GDBServer for this);
– ARM946E core support is added (which is mostly a debug access to the CP15 coprocessor);
– added new RESET type for ARM9xxx cores: HW_RESET – targets which have dedicated TRST can be halted
at the very first instruction core executes after the system reset signal (NRST) was applied.
Importance of this: if some harmfull/”unlucky” code is written to a boot zone of a device, which (code)
on the device startup results in h/w blocking, jtag disabling, core resetting, etc., then connecting via JTAG to such target
becomes an impossible task, since JTAG host has not enough time to halt the target before it becomes unusable by a harmfull code.
Using HW_RESET type ensures the target’s core does not execute even a single instruction after the reset signal (NRST) was applied.
– removed bug which could cause deadlocks of box during a h/w script execution.
____________
JTAG Manager 1.15
———————
– added extended flash chip info handling for example for NOR memories support by DCC Loaders;
– added Resume feature for interrupted writes (which could be performed by WriteMemory button (DCC Page) or by Resurrector DLL):
if target loses power, connection is broken or any other malfuntion happens during write operation, software will store current
write context; you can reconnect target and start write/resurrection again – software will prompt you whether to start again or to continue write from the
interrupted point. This feature is applicable to all write conditions (writes by resurrectors, or manual writes through the DCC Read/Write page features).
– added 3 buttons on Box Service page for quick access to the RIFF’s manual PDFs;
– fixed a not harmfull bug inside of the core reset (when NRST is applied) command sequence;
– added feature: if write error appears and ‘Ignore’ is choosen, user can order software to apply ‘Ignore’ for further write errors automatically;
– added standalone setup dialog for automatic write errors handling;
– added BAD Blocks Handling feature using the following algo:
If there are data chunks A B C & D to be written into blocks 1 2 3 & 4 respectively, and for example block 3 is found to be BAD, then software will write:
data A -> into block 1
data B -> into block 2
——–> block 3 is bypassed (and marked as bad)
data C -> into block 4
data D -> into block 5
It’s clear that block 5 was not intended to accept the data D. Thus:
– if block 5 had some other info then this info will be lost and will be overwritten with the data D.
– if block 5 was free for use, then nothing bad happens.

So, main conclusions:
———————
1. BAD Blocks Handling is IMPOSSIBLE (POINTLESS) for writting FULL images (user can chose only ‘Ignore’ option)
2. When writting data chunks of length less than full flash size user is prompted to select 2 options:
a) Overlap (in example above this would mean to write data D into block 5)
b) Cut Excess (in example above this would mean to not touch original 5th block’s contents and just discard data D to be written)

************************************************** ************************************************** *********************************
NOTE: Bad block handling is allowed by default only through the DCC Read/Write page write.
—– Old Resurrector DLLs were not adapted for this feature, thus Bad Block handling will be implemented only in new DLLs.
If you meet a Bad Block Error during resurrection contact support in order to update DLL to a Bad Blocks adapted version.
************************************************** ************************************************** *********************************

– solved problem which caused update module to display files for download which were already up-to-date for cases
when JTAG Manager was installed on FAT (FAT/FAT32) file systems.
– very dangerous bug fixed: “Irnored” word misspelling is corrected to the valid “Ignored” one

RIFF JTAG – JTAG Manager v1.12

Posted on August 6, 2010 by admin

JTAG Manager 1.12
——————
– Added mutlichain options support for CMM scripts
– Added advanced multichain setup (“Advanced…” in the TAP# field)
– Added Cortex-A8 processor selection
– Added BOX pinout button (which is placed on Resurrection page)

Firmware 1.12
——————
– Addedd Cortex-A8 core 16-bit and 8-bit bus read/writes (which are be used in scripts mostly)
– Addedd CoreSight DAP ROM Table processing for automatic ARM core search.
– Addedd advanced MultiChain selection (IRPRE, IRPOST, DRPRE, DRPOST) in case simple TAP number is impossible to select (like in OMAP850)
– Addedd feature to set custom timeout after NRST is asserted back to high level
(for backward compatibility default timeout for ARM9 is set to 10ms, for other cores – 0ms)

Please start the JTAG Manager and click “Check for updates” button. You’ll be notified about new updates. Download everything and restart the software.
Box firmware will be updated automatically, but in case box stucks in bootcore mode, update firmware manually. Make sure to select v1.12 firmware.