RIFF JTAG – HTC Wizard 200 Unbrick – Boot repair supported

25.08.2011  HTC Wizard 200 Unbrick – Boot repair supported

Resurrection of HTC Wizard 200 is simple. Battery must be connected in order to establish JTAG connection.
Current resurrector works with devices based on G4 MDOC chip.
Resurrector can repair IPL and SPL areas (which areas to repair you can select in popup window).
Please note: DiskOnChip G4 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL area. Thus be very carefull not to interrupt IPL repair process (in case you have selected IPL area to be repaired).
In case your device has permanently blocked MDOC memory you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0400/0xFBFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
This can happen due to unknown protection keys used or due to permanently blocked MDOC chip. If latter is true we advise you to solder a new flash memory chip or throw this phone away to the trash bin.
To resurrect HTC Wizard:

  •  Solder JTAG cable to HTC Wizard JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure HTC Wizard is selected in the list of models;
  •  Press Power On key
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Camera’ key and press ‘Power ON’ button.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

15.07.2011  Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

Current resurrector works with Qtek 9000 with MDOC G3 memory version. In order to establish JTAG connection charged battery is required. In some cases you will need to press power on key during initiating connection.
Please note, in case the Download Mode Initiation resurrection way is selected in the resurrector popup settings window, battery must be charged enough in order for phone to enter download mode.

Current resurrector offers 2 ways to resurrect the phone:

  •  WAY1: Writing SPL code directly into the MDOC memory (there are 2 hardware versions of the Qtek 9000 exist: boards with G4-type MDOC memory and boards with G3-type MDOC memory; current resurrector contains DCC Loader for G3 MDOC memory; thus for G4 version you need to use other resurrector)

 

  •  WAY2: Initiating DOWNLOAD MODE without touching MDOC contents;

MDOC G3 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL loader. Current resurrector will not touch the IPL zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0200/0xFDFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
In this case resurrection of your device is not possible. We advise you to solder a new flash memory chip and then use resurrector with IPL re-flash enabled.
To resurrect Qtek 9000 G3:

  •  Solder JTAG cable to Qtek 9000 G3 JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure Qtek 9000 G3 is selected in the list of models;
  •  Click Resurrect button;
  •  In popup window select desired way of resurrection;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Light’ key (the one near to the volume slider) and ‘Power On’ key and press with stylus the reset hole-button.

Additional info:

  •  The DiskOnChip G3 memory type has security features. Access to both protected partitions (as IPL loader area) is done using password 00000000.
  •  IPL re-flash is intentionally switched off in this resurrector. While re-flashing the IPL area there is a risk of permanently blocking the memory chip.
  •  Memory is two DiskOnChip (MDOC) G3 cascaded chips, IDs are 0x0200; capacity is 64Mb+64Mb); though current DCC Loader was tested to read/write correctly only the SPL zones.

 

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – HTC Advantage X7510 (HTC Athena) Unbrick – Boot Repair supported

04.04.2011  HTC Advantage X7510 (HTC Athena) Unbrick – Boot Repair supported

Resurrection of HTC Athena is easy. Most convenient is to have USB cable connected and battery inserted.
If during connection progress bar in JTAG Manager keeps running from 0 to 100% press with stylus the reset button on the phone (reset button is near to the JTAG pads).
Resurrector will reflash IPL and SPL areas. You can select SPL version to be flashed in the settings window which popups before resurrection. IPL which is flashed: “ATHENA IPL DVT 2.02 H3” version.
Current resurrector works only with HTC Athena hardware revisions which have DiskOnChip H3 memory chip installed. If you have hardware revision with DiskOnChip G4 memory chip used then select different resurrector.

To resurrect HTC Athena with DiskOnChip H3:

  • Solder JTAG cable to HTC Athena JTAG pads;
  • Insert battery and connect USB cable to phone and PC;
  • Make sure HTC Athena is selected in the list of models;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘Camera’ key and press ‘Power ON’ key or use stylus to press ‘Reset’ button. In few seconds you should see TriColor picture.

Additional info:

  • DiskOnChip H3’s full NAND memory chip is divided into partitions by the internal memory controller. Thus DCC Loader creates virtual FLASH chip for each partition – you can read/write these partitions by selecting proper ROM index (“Access ROMi Address Space”) on the JTAG Manager’s DCC Read/Write page;
  • DiskOnChip H3 has no spare zones, thus only Main field must be used during write operations. ECC Enable checkbox has no meaning here.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Toshiba Portege G900 Unbrick, Dead Boot repair supported

14.03.2011 Toshiba Portege G900 Unbrick, Dead Boot repair supported

Resurrection of Toshiba Portégé G900 PDA part is not hard. Battery is required for successful HALT operation. If USB Data Cable is connected phone is auto powered on when battery is inserted.
If during connect operation (“Establish communication with the phone…”) after 2-3 passes there is still no success (progress bar keeps running from 0 to 100% and so on) then remove battery and insert it again. If USB cable is not connected then press and hold Power On key.
Current resurrector re-flashes only the EBOOT and secondary EBOOT area, and will not re-write IPL area (though write of this area is supported too).
Please note: DiskOnChip G4 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL areas. Current resurrector will not touch the IPL zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:
****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0400/0xFBFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************

This can happen due to unknown protection keys used or due to permanently blocked MDOC chip. If latter is true we advise you to solder a new flash memory chip or throw this phone away to the trash bin.

To resurrect Toshiba G900 PDA part:

  • Solder JTAG wires to the Toshiba G900 PDA pads;
  • Connect USB cable to phone and PC;
  • Make sure Toshiba G900 PDA is selected in the list of models;
  • Insert battery and click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To enter USB download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘Left soft’ key (which is exactly above the Dial key) and press ‘Power ON’ button. In few seconds you should see red download screen.

To enter SD-card download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘D’ key and press ‘Power ON’ button.

Additional info:

  • Phone has DiskOnChip G4 memory type, which has security features. It has two password protected partitions (Password1 = 12345678, Password2 = 00000000);
  • IPL re-flash is not performed in this resurrector on purpose. While re-flashing the IPL area there is a risk of permanently blocking the memory chip.
  • Any write access (Erase or Write) on MDOC NAND memory range 0x00000000 to 0x0017FFFF is rejected by the DCC Loader. For full image writing convenience access to that range will not rise any error, data will just be ignored and reported as if it was written successfully, thus you still can write full image files using ‘Auto FullFlash Size’ checked.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – ASUS P526 Unbrick, Dead Boot repair supported

10.03.2011   ASUS P526 Unbrick, Dead Boot repair supported

Resurrection of ASUS P526 is slightly complicated. JTAG pads are very small and sensitive thus extreme care must be taken when soldering wires to the board. Battery must be connected in order to establish JTAG connection.
Current resurrector re-flashes only the IPL area, and will not re-write MDOC XLOADER area (though write of this area is supported too).
Please note: DiskOnChip G4 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the XLOADER areas. Current resurrector will not touch the XLOADER zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:
****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0400/0xFBFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************

This can happen due to unknown protection keys used or due to permanently blocked MDOC chip. If latter is true we advise you to solder a new flash memory chip or throw this phone away to the trash bin.

To resurrect ASUS P526:

  • Solder JTAG cable to ASUS P526 JTAG pads;
  • Insert battery and connect USB cable to phone and PC;
  • Make sure ASUS P526 is selected in the list of models;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
If phone not enters download mode after resurrection then it means XLOADER was damaged too but memory chip is still usable. In this case repeat resurrection using RAM Downloader Mode and when USB connection is established reflash the phone with official firmware.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Move ‘Lock’ slider down, hold ‘OK’ key (on the left) and press ‘Power ON’ button. In few seconds you should see TriColor picture.

Additional info:

  • Phone has DiskOnChip G4 memory type, which has security features. It has two password protected partitions (Password1 = 12345678, Password2 = 00000000);
  • XLOADER re-flash is not performed in this resurrector on purpose. While re-flashing the XLOADER area there is a risk of permanently blocking the memory chip.
  • Any write access (Erase or Write) on MDOC NAND memory range 0x00000000 to 0x0017FFFF is rejected by the DCC Loader

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.15, RIFF Box firmware v1.14 released

05.10.2010 JTAG Manager v1.15, RIFF Box firmware v1.14 released

Whats new:

Firmware 1.14
———————
– code is optimized to avoid deadlocks in Cortex-A8 handling routines (deadlocks appear due to communication errors);
– Cortex-A8 debug is now available in ARM/Thumb modes (use the GDBServer for this);
– ARM946E core support is added (which is mostly a debug access to the CP15 coprocessor);
– added new RESET type for ARM9xxx cores: HW_RESET – targets which have dedicated TRST can be halted
at the very first instruction core executes after the system reset signal (NRST) was applied.
Importance of this: if some harmfull/”unlucky” code is written to a boot zone of a device, which (code)
on the device startup results in h/w blocking, jtag disabling, core resetting, etc., then connecting via JTAG to such target
becomes an impossible task, since JTAG host has not enough time to halt the target before it becomes unusable by a harmfull code.
Using HW_RESET type ensures the target’s core does not execute even a single instruction after the reset signal (NRST) was applied.
– removed bug which could cause deadlocks of box during a h/w script execution.
____________
JTAG Manager 1.15
———————
– added extended flash chip info handling for example for NOR memories support by DCC Loaders;
– added Resume feature for interrupted writes (which could be performed by WriteMemory button (DCC Page) or by Resurrector DLL):
if target loses power, connection is broken or any other malfuntion happens during write operation, software will store current
write context; you can reconnect target and start write/resurrection again – software will prompt you whether to start again or to continue write from the
interrupted point. This feature is applicable to all write conditions (writes by resurrectors, or manual writes through the DCC Read/Write page features).
– added 3 buttons on Box Service page for quick access to the RIFF’s manual PDFs;
– fixed a not harmfull bug inside of the core reset (when NRST is applied) command sequence;
– added feature: if write error appears and ‘Ignore’ is choosen, user can order software to apply ‘Ignore’ for further write errors automatically;
– added standalone setup dialog for automatic write errors handling;
– added BAD Blocks Handling feature using the following algo:
If there are data chunks A B C & D to be written into blocks 1 2 3 & 4 respectively, and for example block 3 is found to be BAD, then software will write:
data A -> into block 1
data B -> into block 2
——–> block 3 is bypassed (and marked as bad)
data C -> into block 4
data D -> into block 5
It’s clear that block 5 was not intended to accept the data D. Thus:
– if block 5 had some other info then this info will be lost and will be overwritten with the data D.
– if block 5 was free for use, then nothing bad happens.

So, main conclusions:
———————
1. BAD Blocks Handling is IMPOSSIBLE (POINTLESS) for writting FULL images (user can chose only ‘Ignore’ option)
2. When writting data chunks of length less than full flash size user is prompted to select 2 options:
a) Overlap (in example above this would mean to write data D into block 5)
b) Cut Excess (in example above this would mean to not touch original 5th block’s contents and just discard data D to be written)

************************************************** ************************************************** *********************************
NOTE: Bad block handling is allowed by default only through the DCC Read/Write page write.
—– Old Resurrector DLLs were not adapted for this feature, thus Bad Block handling will be implemented only in new DLLs.
If you meet a Bad Block Error during resurrection contact support in order to update DLL to a Bad Blocks adapted version.
************************************************** ************************************************** *********************************

– solved problem which caused update module to display files for download which were already up-to-date for cases
when JTAG Manager was installed on FAT (FAT/FAT32) file systems.
– very dangerous bug fixed: “Irnored” word misspelling is corrected to the valid “Ignored” one

RIFF JTAG – JTAG Manager v1.13, JTAG Firmware v1.13 released

27.08.2010 JTAG Manager v1.13, JTAG Firmware v1.13 released

Whats new:

JTAG Manger 1.13
———————
– Added feature to display FLASH chip capacity information
– Added feature ‘Auto FullFlash size’ to DCC Read/Write page for simplified Full Images reading/writting
– Fixed DCC Loader Settings dialog
– Added resurrector interface function ‘GetChipSize’ which now enables resurrector DLL to receive target’s memory size
for proper data selection for flashing (like in Huawei Modem E1550 64/128MB versions);

Firmware 1.13
———————
– fixed ARM9 core debug capabilities when core is in Thumb mode
(when ARM9 core was entering debug from Thumb state some CPSR register’s flags were lost, same was when core was leaving debug into Thumb mode);
– FFFFFFEE instruction was added into HAS scripts processing module;

Click “Check for Updates” button to download new JTAG Manager and JTAG firmware.