Tag Archives: Flashing

RIFF JTAG – HTC Flyer WiFi (PG41400) Unbrick, S-off, CID update supported

Posted on by

RIFF JTAG – HTC Flyer WiFi (PG41400) Unbrick, S-off, CID update supported

Repairing bricked HTC Flyer WiFi (PG41400) is easy with the RIFF Box. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected. Please note, battery presense is required.
Some (or all) revisions of HTC Flyer boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM8255 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the DBL loader, so writing to DBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into DBL zone and will respond with success code as if flashing succeeded. In this way DBL zone is protected while user still can flash full image files seamlessly.
Resurrector will reflash radio’s boot zone (except DBL area) and will re-write PDA’s SPL to 1.11.0011 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PG4140000’.
There is option to reflash android BOOT and RECOVERY zones. Recovery zone is flashed with ClockworkMod Recovery 4.0.1.4. In addition, you can set S-OFF (unlock HBOOT so you will be able to flash any ROM) by selecting S-OFF HBOOT version in the resurrector settings.
Sometimes (for example after rooting attempts) phone has a modified DBL loader (which may not accept official HTC boot files). To restore phone functionality you need to reflash DBL loader. There is option to reflash DBL code (DBL area will be temporary unlocked for reflashing). But please note, reflashing DBL area is very dangerous, since in case flashing stops in the middle, you will have briked phone with permanently disabled JTAG interface.
Please note, if your phone has the DBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Flyer WiFi:

  •  Solder JTAG cable to HTC Flyer JTAG pads;
  •  Insert battery and connect USB Data cable;
  •  Make sure HTC Flyer (PG41400) is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;


 Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods. You can use CWM recovery to flash any ZIP file – for this during resurrection add BOOT & RECOVERY zones to be resurrected too.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Volume Down’ key and press ‘Power ON’ button.

.

RIFF JTAG – HTC Flyer (PG41100) Unbrick, Unlock, IMEI, S-off, update supported

Posted on by

06.04.2012  RIFF JTAG – HTC Flyer (PG41100) Unbrick, Unlock, IMEI, S-off, update supported

Repairing bricked HTC Flyer (PG41100) is easy with the RIFF Box. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected. Please note, battery presense is required.
Some (or all) revisions of HTC Flyer boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM8255 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the DBL loader, so writing to DBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into DBL zone and will respond with success code as if flashing succeeded. In this way DBL zone is protected while user still can flash full image files seamlessly.
Resurrector will reflash radio’s boot zone (except DBL area) and will re-write PDA’s SPL to 1.11.0003 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PG4110000’.
There is option to reflash android BOOT and RECOVERY zones. Recovery zone is flashed with ClockworkMod Recovery 4.0.1.4. In addition, you can set S-OFF (unlock HBOOT so you will be able to flash any ROM) by clicking “Make S-OFF” checkbox in the resurrector settings.
Sometimes (for example after rooting attempts) phone has a modified DBL loader (which may not accept official HTC boot files). To restore phone functionality you need to reflash DBL loader. There is option to reflash DBL code (DBL area will be temporary unlocked for reflashing). But please note, reflashing DBL area is very dangerous, since in case flashing stops in the middle, you will have briked phone with permanently disabled JTAG interface.
Please note, if your phone has the DBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Flyer:

  •  Solder JTAG cable to HTC Flyer JTAG pads;
  •  Insert battery and connect USB Data cable;
  •  Make sure HTC Flyer is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods. You can use CWM recovery to flash any ZIP file – for this during resurrection add BOOT & RECOVERY zones to be resurrected too.
.

RIFF JTAG – HTC ThunderBolt 4G ADR6400 (HTC Mecha) Unbrick – Boot repair supported

Posted on by

14.02.2012     HTC ThunderBolt 4G ADR6400 (HTC Mecha) Unbrick – Boot repair supported

Resurrecting HTC Thunderbolt CP (Modem Part) part is easy.
Phone is auto powered on with USB Data Cable connected to the PC while battery is inside; sometimes during connection pressing Power On key may be required.
Please note, CP Part’s power is controlled by the AP Part, thus you may experience constant connection loses after definite ammounts of time (1-2-5-x seconds). If this keeps interferring the resurrection process, solder additionall JTAG interface cable to the AP pads, select AP resurrector DLL, go to the JTAG Read/Write page and halt AP core, then switch back to the CP JTAG interface.

To resurrect HTC Thunderbolt CP (Modem Part) Part:

  •  Solder JTAG cable to HTC Thunderbolt CP JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure HTC Thunderbolt CP is selected in the list of models;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Resurrecting HTC Thunderbolt AP (PDA Part) is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Resurrector will reflash radio’s boot zone and will re-write PDA’s SPL to 1.04.0000 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PG0510000’.
There is option to reflash BOOT and RECOVERY zones.

_

RIFF JTAG – HTC Incredible S Unbrick, Unlock, CID, IMEI repair supported

Posted on by

30.12.2011    HTC Incredible S Unbrick, Unlock, CID, IMEI repair supported

 

Resurrecting HTC Incredible S is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Some (or all) revisions of HTC Incredible S boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM7230 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the FSBL loader, so writing to FSBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into FSBL zone and will respond with success code as if flashing succeeded. In this way FSBL zone is protected while user still can flash full image files seamlessly.
Resurrector will reflash radio’s boot zone (except FSBL area) and will re-write PDA’s SPL version 1.13.0000. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PG3213000’.
There is option to reflash BOOT and RECOVERY zones.
Please note, if your phone has the FSBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Incredible S:

  •  Solder JTAG cable to HTC Incredible S JTAG pads;
  •  Insert batter and connect USB Data cable;
  •  Make sure HTC Incredible S is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Volume Down’ key and press ‘Power ON’ button.

_

RIFF JTAG – HTC Desire Z (HTC Vision) Unbrick, Unlock, IMEI&CID repair supported

Posted on by

12.10.2011    HTC Desire Z (HTC Vision) Unbrick, Unlock, IMEI&CID repair supported

Resurrecting HTC Desire Z is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Some (or all) revisions of HTC Desire Z boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM7230 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the FSBL loader, so writing to FSBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into FSBL zone and will respond with success code as if flashing succeeded. In this way FSBL zone is protected while user still can flash full image files seamlessly.

Resurrector will reflash radio’s boot zone (except FSBL area) and will re-write one of selected PDA’s SPL versions (0.76.2000 or 0.85.0005). Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PC1010000’.
There is option to reflash BOOT and RECOVERY zones.

Please note, if your phone has the FSBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Desire Z:

  •  Solder JTAG cable to HTC Desire Z JTAG pads;
  •  Insert batter and connect USB Data cable;
  •  Make sure HTC Desire Z is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Volume Down’ key and press ‘Power ON’ button.

RIFF JTAG – HTC Wizard 200 Unbrick – Boot repair supported

Posted on by

25.08.2011  HTC Wizard 200 Unbrick – Boot repair supported

Resurrection of HTC Wizard 200 is simple. Battery must be connected in order to establish JTAG connection.
Current resurrector works with devices based on G4 MDOC chip.
Resurrector can repair IPL and SPL areas (which areas to repair you can select in popup window).
Please note: DiskOnChip G4 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL area. Thus be very carefull not to interrupt IPL repair process (in case you have selected IPL area to be repaired).
In case your device has permanently blocked MDOC memory you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0400/0xFBFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
This can happen due to unknown protection keys used or due to permanently blocked MDOC chip. If latter is true we advise you to solder a new flash memory chip or throw this phone away to the trash bin.
To resurrect HTC Wizard:

  •  Solder JTAG cable to HTC Wizard JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure HTC Wizard is selected in the list of models;
  •  Press Power On key
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Camera’ key and press ‘Power ON’ button.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.33, RIFF Box firmware v1.25 released

Posted on by

RIFF Box Firmware 1.25
—————————

  • Added 5.0V USB Power On/Off controlling feature
  • Changed sequence for 32-bit write accesses for ARM11 core (MSM8xxx support)

JTAG Manager 1.33
—————————

  • Improved connection policy:
  • Resurrection/DCC connection to device is implemented in such way that JTAG speed changes have 2 stages – booting stage and working stage.
    Booting stage is the one from the connection start and until the DCC Loader upload is complete. Booting TCK/RTCK speed are setup by JTAG Manager no matter what are the TCK settings by user (JTAG TCK Speed field in the JTAG Manager). Booting speed is hardcoded in the DLL.
    After “booting” stage is complete, the “working” speed is set – the one which is selected by user in the JTAG TCK Speed field.
    If Booting Speed in resurrector DLL is hardcoded as ‘RTCK’ the JTAG Manager would always use RTCK mode during booting stage.
  • Now policy is changed that is when user selects a fixed TCK frequency the JTAG Manager will automatically change booting speed to the fixed TCK too.
  • Fixed bug: if “Use End Address” and “AutoFull Flash Size” were checked there was error setting valid length to read.
  • For Advanced Users: advanced settings are now moved from the DCC Read/Write page (“Notifications…”) into separate button on Box Service page (Advanced Settings button)
  • Added 5.0V USB Power On/Off controlling feature
  • For this go to Box Service page, click Advanced Settings: the Notifications dialog will be displayed, go to “Advanced Settings” page and set desired mode for “Enable 5.0V output” checkbox.
  • When enabled, 5.0V power will be on after any “JTAG” operation executed and will remain “ON” until box restart or until “Enable 5.0V output” checkbox is unchecked and any “JTAG” operation is executed.
  • Added optimization for flashing memory devices which are sector-based (like MDOC H3 or MMC/SD memory cards) if error code 0x3C (write-protect) is received no recover attempts are made.

RIFF JTAG – HTC Tattoo A3232 (HTC Click 1100) Unlock, Unbrick, IMEI repair, CID Update

Posted on by

10.03.2011 HTC Tattoo A3232 (HTC Click 1100) Unlock, Unbrick, IMEI repair, CID Update supported

Resurrecting HTC Click is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is inside.
There are two different hardware versions exist – one based on the MSM7225 chipset (CLIC10000) and other – on the ESM7225 chipset (CLIC11000). In resurrector settings you can select a desired version.
Resurrector will reflash radio’s boot zone and will re-write PDA’s SPL to 0.52.0001 SPL version.
As well, you can change CID – for this make sure ‘Repair Custom ID’ field is checked in the Resurrection Guide dialog.

To resurrect HTC Click:

  • Solder JTAG cable to HTC Click JTAG pads;
  • Make sure HTC Click is selected in the list of models;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To Unlock HTC Click :

  • Solder JTAG cable to HTC Click JTAG pads;
  • Make sure HTC Click is selected in the list of models;
  • Click Resurrect button;
  • Select “Unlock Settings” TAB
  • Select Unlock method
  • Click “Unlock”

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – ASUS P526 Unbrick, Dead Boot repair supported

Posted on by

10.03.2011   ASUS P526 Unbrick, Dead Boot repair supported

Resurrection of ASUS P526 is slightly complicated. JTAG pads are very small and sensitive thus extreme care must be taken when soldering wires to the board. Battery must be connected in order to establish JTAG connection.
Current resurrector re-flashes only the IPL area, and will not re-write MDOC XLOADER area (though write of this area is supported too).
Please note: DiskOnChip G4 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the XLOADER areas. Current resurrector will not touch the XLOADER zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:
****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0400/0xFBFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************

This can happen due to unknown protection keys used or due to permanently blocked MDOC chip. If latter is true we advise you to solder a new flash memory chip or throw this phone away to the trash bin.

To resurrect ASUS P526:

  • Solder JTAG cable to ASUS P526 JTAG pads;
  • Insert battery and connect USB cable to phone and PC;
  • Make sure ASUS P526 is selected in the list of models;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
If phone not enters download mode after resurrection then it means XLOADER was damaged too but memory chip is still usable. In this case repeat resurrection using RAM Downloader Mode and when USB connection is established reflash the phone with official firmware.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Move ‘Lock’ slider down, hold ‘OK’ key (on the left) and press ‘Power ON’ button. In few seconds you should see TriColor picture.

Additional info:

  • Phone has DiskOnChip G4 memory type, which has security features. It has two password protected partitions (Password1 = 12345678, Password2 = 00000000);
  • XLOADER re-flash is not performed in this resurrector on purpose. While re-flashing the XLOADER area there is a risk of permanently blocking the memory chip.
  • Any write access (Erase or Write) on MDOC NAND memory range 0x00000000 to 0x0017FFFF is rejected by the DCC Loader

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF Box JTAG Manager v1.23, RIFF Box Firmware v1.17 released

Posted on by

07.02.2011 RIFF Box JTAG Manager v1.23, RIFF Box firmware v1.17

Firmware 1.17
—————————

* Optimized DCC transfers (debugger-to-target) for ARM9 cores (~64,3% speed increase)
* Added RX-polling feature (debugger-to-target) for ARM9 DCC transfers.

RIFF BOX firmware is able now to wait (if resurrector DLL will request so) for ARM9 target to be ready to accept next packet over DCC: this feature slows down a little the JTAG-to-ARM9 DCC transfers but guaranties no packets loss for slow clocked targets;

JTAG Manager 1.23
—————————

* Improved DCC flashing functionality (for DCC Loaders that work in targets with a small RAM capacity);
* Added 4 very low RTCK Sampling frequencies (20kHz, 40kHz, 60kHz and 80kHz) for some extreme cases
* Fixed another bug in the optimized DLL loading scheme;
* Increased ERASE waiting timeout (for slow NOR flash chips) so now erase operation for such chips will go successully and will not result in erase timeout
* Added “Usefull plugins” page;

“Usefull Plugins” will be new feature, we hope to release first one during this week. So stay tuned.

As usually, click the “Check for Updates” button to obtain latest files.