RIFF JTAG – Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

29.07.2011     Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

Samsung I9100 is based on the S5PV310 (Exynos 4210) Processor (Cortex-A9 Dual-Core).

JTAG pads are very small; professional experience in soldering is required to connect wires to the JTAG interface. There is a big variety of versions of Galaxy II devices: GT-I9100, GT-I9100G, GT-I9100L, GT-I9100M, GT-I9100T, GT-I9101, GT-I9103, GT-I9108, GT-I9188, and maybe more. Some of them are based on different hardware platform – the OMAP4430 (Cortex-A9 Dual-Core). Thus make sure first which exact hardware version you have on hands.
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on.
Phone has such booting sequence: ROM → FBL → IBL → PBL → SBL. Current resurrector will resurrect Partition Table (PIT) and SBL zones which are located in the iNAND (eMMC) memory. Write access to memory which contains FBL, IBL and PBL loaders is not supported currently, but in case your phone has these loaders damaged, you can choose “Initiate Download Mode” way of resurrection in order to directly put the phone into the Download Mode.

To resurrect Samsung I9100:

  •  Solder JTAG cable to Samsung I9100 JTAG pads;
  •  Connect USB cable to phone and PC;
  •  Insert battery;
  •  Make sure Samsung I9100 is selected in the list of models;
  •  Make sure a fixed TCK frequency is selected;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On.
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04 Released

29.07.2011  JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04

Whats new :

RIFF JTAG Manager v1.34:

  •  JTAG Manager Project has been migrated into UNICODE.

Main advantage of this – GUI (captions of buttons, labels, etc) can now support all international characters, for example chinese
WARNING!!! Due to UNICODE migration old plugin DLLs are not compatible with JTAG Manager 1.34
Simply download new set of plugins which are unicode compatible now.

  •  Multilanguage GUI is implemented (and due to migration to UNICODE even chinese language can be fully supported)

You need to download language pack dll, for example Russian.dll. After installation go to BOX SERVICE page and there will
be available language selection.
Following items are translated into selected language by the language DLL:
1. JTAG Manager interface – labels, captions, etc.
2. JTAG Manager messages which are shown during active operation.
3. Most of messages shown by resurrector DLLs
4. Some of Resurrection Manuals (if current version of language pack does not have translated version of Resurrection Manual, then an original, English version will be shown)

  • A dded warning window which will appear on DCC Read/Write page in case user tries to flash full dump with wrong settings.

So user can check what he does wrong and thus avoid losing time and making mistakes.

  •  ARM Core Cortex-A9 (Single and MPCore) and Chipset OMAP4430 (Dual-core Cortex-A9) are addred to the supported cores list;
  •  Cortex-A9 core added to the CMM Script Engine: Example: SYSTEM.CPU CORTEXA9
  •  OMAP4430 core added to the CMM Script Engine: Example: SYSTEM.CPU OMAP4430
  •  Multicore control is added to the CMM Script Engine (Use CORE.SELECT instructions to switch between cores in multicore targets)

For example CORE.SELECT 0 will select core0, CORE.SELECT 3 will select core3

  •  Added access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)

through the CMM Script Engine (‘APB’ segment specifier added)
Thus, for example instruction: &Resp=data.long(APB:0x12345678) – will read dword from APB bus at address 0x12345678

  • Added SYSTEM.CONFIG.RESETTIMEOUT variable to the CMM Script Engine, thus it’s now possible to customise reset type and timeout

by setting this variable prior SYSTEM.UP command.

  •  Fixed bug which caused saving trash after read operaions on DCC Read/Write page in these cases:

a) reading was stopped by user
b) after JTAG Manager exe restart

  •  DCC Read/Write Page operations now allow 64-bit addressing, thus user can have full access to memory devices which size exceeds 0xFFFFFFFF bytes range.

For this, the Address and Length fields have now 10 digits instead of old 8 digits. Be carefull entering values there.
UNEXPERIENED USERS PLEASE NOTE: For example 8 digit hex value 0x12345678 entered into 10 digit field IS NOT 0x1234567800 (!!!!!) CORRECT IS 0x0012345678

  •  TGauge64 component was implemented in order to support full 64-bit range of progress indications (while old progress bars were limited to 31-bit maximum value)
  •  Fixed bug with incorrect display of scrollbars during scroling through Model and Manufacturer Lists
  • Fixed bug during erase:
    If bad block happened, and user choosed Ignore method and checked ‘Remember selection’ – software  would again popup selection dialog on next bad block.
  •  JTAG I/O Voltage (for Custom Target Settings) now has voltages from 1.6V upto 3.30V with resolution 0.05V
  •  Just for convenience added button “Target Continue” to the JTAG Read/Write page.
    This just allows to resume target running from current PC value without need to enter it explicitly into “Address” field as is needed for the “Target GO” button
RIFF Box firmware v1.26 :
  • Added support for Cortex-A9 single processor core;
  • Added support for Cortex-A9 multiprocessor cores. Multicore handling rules are following:1. After target reset (NRST=1-0-1) the Core0 is automatically selected;

    2. HALT operation halts only currently selected core (by default core0 is selected); Thus in order to halt other core user has to select required core and then execute halt operation.

    3. Reset operation can accept different strategies of reset and halt:

    – Reset, then halt all cores at the very first instruction (for now only for OMAP MCUs)
    – Reset, than halt only core0 at the very first instruction (for now only for OMAP MCUs)
    – Reset, pause, then halt all cores
    – Reset, pause, than halt only core0

    4. RUN operation starts only currently selected core.

Thus in order to start other core user has to select required core and then execute run operation.

For example, if target has 4 cores (Quad-core MCU), then after HALT operation only Core0 is halted.
To halt Core2 user has to write script:
CORE.SELECT 2
BREAK

For example, to run Core3 user has to write script:
CORE.SELECT 3
GO

  • Added H/W script (*.has) instruction which enables selection of core for multiprocessor targets;
  • Added script (CMM/HAS) access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)
  • Added support for OMAP4430 Dual-core Cortex-A9 MCU
RIFF GDB Server v1.04 :
  • Fixed bug with reset timeout – erroneously value in Edit field was taken as HEX not decimal, Now is ok
  • Added few more GDB commands for compatibility with IDA 6.1 remote debugging.
  • Added Thumb2 instruction TBB and TBW for single stepping
  • Fixed bug in Thumb/Thumb2 when stepping out of sub when POP {RegList, PC} is used (In Thumb mode return PC address is 0x01 ORed)
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

15.07.2011  Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

Current resurrector works with Qtek 9000 with MDOC G3 memory version. In order to establish JTAG connection charged battery is required. In some cases you will need to press power on key during initiating connection.
Please note, in case the Download Mode Initiation resurrection way is selected in the resurrector popup settings window, battery must be charged enough in order for phone to enter download mode.

Current resurrector offers 2 ways to resurrect the phone:

  •  WAY1: Writing SPL code directly into the MDOC memory (there are 2 hardware versions of the Qtek 9000 exist: boards with G4-type MDOC memory and boards with G3-type MDOC memory; current resurrector contains DCC Loader for G3 MDOC memory; thus for G4 version you need to use other resurrector)

 

  •  WAY2: Initiating DOWNLOAD MODE without touching MDOC contents;

MDOC G3 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL loader. Current resurrector will not touch the IPL zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0200/0xFDFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
In this case resurrection of your device is not possible. We advise you to solder a new flash memory chip and then use resurrector with IPL re-flash enabled.
To resurrect Qtek 9000 G3:

  •  Solder JTAG cable to Qtek 9000 G3 JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure Qtek 9000 G3 is selected in the list of models;
  •  Click Resurrect button;
  •  In popup window select desired way of resurrection;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Light’ key (the one near to the volume slider) and ‘Power On’ key and press with stylus the reset hole-button.

Additional info:

  •  The DiskOnChip G3 memory type has security features. Access to both protected partitions (as IPL loader area) is done using password 00000000.
  •  IPL re-flash is intentionally switched off in this resurrector. While re-flashing the IPL area there is a risk of permanently blocking the memory chip.
  •  Memory is two DiskOnChip (MDOC) G3 cascaded chips, IDs are 0x0200; capacity is 64Mb+64Mb); though current DCC Loader was tested to read/write correctly only the SPL zones.

 

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – HTC Wildfire S A510E (HTC Marvel), More CDMA models supported

07.07.2011  HTC Wildfire S A510E (HTC Marvel), More CDMA models supported.

Resurrecting HTC WildFireS is easy. Phone is auto powered on with USB Data Cable connected to the PC. Battery presence is not required; connection can be established with detached board.
In case you have no USB cable near, make sure battery is charged enough and hold Power On button during initiation of JTAG connection.
Resurrector will reflash radio’s boot zone and will re-write PDA’s SPL to 1.01.0002 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PC4910000’. Additionally, you can check ‘Repair RECOVERY zones’ to reflash android BOOT and RECOVERY code.

To resurrect HTC WildFireS:

  •  Solder JTAG cable to HTC WildFireS JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure HTC WildFireS is selected in the list of models;
  •  If you use battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold ‘Volume Down’ key and press ‘Power ON’ button. In few seconds you should see usual android boot mode screen.
 

Following CDMA models are supported from today :
  • Samsung B139 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B259 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B309 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B319 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B379 Repair/Unbrick, Read/Write NOR Flash
  • Samsung B619 Repair/Unbrick, Read/Write NOR Flash
  • Huawei C31 Repair, Read/Write NOR flash
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

22.06.2011  Samsung Galaxy S 4G (T959v 1GB) Unbrick – Boot repair supported

Samsung T959V is based on the S5PCxxx Processor (ARM core is Cortex-A8).
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on. But note, in very rare cases it is possible that you will have to hold Power On key during initial connection.
In case after resurrection (after you have tried with both boot versions) the download mode is not initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung T959V:

  • Solder JTAG cable to Samsung T959V JTAG pads;
  • Connect microUSB cable to phone and PC;
  • Insert battery;
  • Make sure Samsung T959V is selected in the list of models;
  • Make sure a fixed TCK frequency is selected;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold both ‘Volume Down’ and ‘Volume Up’ keys and press Power-On.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – HTC Desire HD A9191 (HTC Ace) Unbrick, IMEI, CID, ModelID, Simlock repair

16.06.2011   RIFF JTAG – HTC Desire HD A9191 (HTC Ace) Unbrick, IMEI, CID, ModelID, Simlock repair

Resurrecting HTC Desire HD is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Some (or all) revisions of HTC Desire HD boards have JTAG interface disabled (that is enable MARM JTAG Fuse is blown in the MSM8255 chip). In this case the JTAG may be enabled only by firmware itself. This is done by the FSBL loader, so writing to FSBL area is artificially disabled in the DCC Loader code. DCC Loader will discard all flashing attempts into FSBL zone and will respond with success code as if flashing succeeded. In this way FSBL zone is protected while user still can flash full image files seamlessly.
Resurrector will reflash radio’s boot zone (except FSBL area) and will re-write PDA’s SPL to 0.85.0007 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘PD9810000’.
There is option to reflash BOOT and RECOVERY zones. If selected, then ClockworkMod Recovery v3.0.2.8 will be flashed.

Please note, if your phone has the FSBL loader damaged and MCU has JTAG FUSE blown then there is no way to resurrect your phone via JTAG interface.

To resurrect HTC Desire HD:

  • Solder JTAG cable to HTC Desire HD JTAG pads;
  • Insert batter and connect USB Data cable;
  • Make sure HTC Desire HD is selected in the list of models;
  • If you use only battery, press Power On key;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘Volume Down’ key and press ‘Power ON’ button

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.33, RIFF Box firmware v1.25 released

RIFF Box Firmware 1.25
—————————

  • Added 5.0V USB Power On/Off controlling feature
  • Changed sequence for 32-bit write accesses for ARM11 core (MSM8xxx support)

JTAG Manager 1.33
—————————

  • Improved connection policy:
  • Resurrection/DCC connection to device is implemented in such way that JTAG speed changes have 2 stages – booting stage and working stage.
    Booting stage is the one from the connection start and until the DCC Loader upload is complete. Booting TCK/RTCK speed are setup by JTAG Manager no matter what are the TCK settings by user (JTAG TCK Speed field in the JTAG Manager). Booting speed is hardcoded in the DLL.
    After “booting” stage is complete, the “working” speed is set – the one which is selected by user in the JTAG TCK Speed field.
    If Booting Speed in resurrector DLL is hardcoded as ‘RTCK’ the JTAG Manager would always use RTCK mode during booting stage.
  • Now policy is changed that is when user selects a fixed TCK frequency the JTAG Manager will automatically change booting speed to the fixed TCK too.
  • Fixed bug: if “Use End Address” and “AutoFull Flash Size” were checked there was error setting valid length to read.
  • For Advanced Users: advanced settings are now moved from the DCC Read/Write page (“Notifications…”) into separate button on Box Service page (Advanced Settings button)
  • Added 5.0V USB Power On/Off controlling feature
  • For this go to Box Service page, click Advanced Settings: the Notifications dialog will be displayed, go to “Advanced Settings” page and set desired mode for “Enable 5.0V output” checkbox.
  • When enabled, 5.0V power will be on after any “JTAG” operation executed and will remain “ON” until box restart or until “Enable 5.0V output” checkbox is unchecked and any “JTAG” operation is executed.
  • Added optimization for flashing memory devices which are sector-based (like MDOC H3 or MMC/SD memory cards) if error code 0x3C (write-protect) is received no recover attempts are made.

RIFF JTAG – Dopod Magic A6188 (HTC Sapp400) Unbrick, Unlock, IMEI and CID repair supported

Dopod Magic A6188 (HTC Sapp400) Unbrick, Unlock, IMEI and CID repair supported

The HTC Magic (SAPP400) is based on ESM7206A chipset. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
In case you have no USB cable near, make sure battery is charged enough and hold Power On button during initiation of JTAG connection.
Resurrector will reflash radio’s boot zone and will re-write PDA’s SPL to 1.53.02000 version. Additionally to SPL and Radio zones, the zone which contains Model ID is re-flashed too. Thus after resurrection phone will have Model ID = ‘SAPP*****’. Additionally, you can check ‘Repair RECOVERY zones’ to reflash android BOOT and RECOVERY code.

To resurrect HTC Magic (SAPP400):

  • Solder JTAG cable to HTC Magic (SAPP400) JTAG pads;
  • Insert USB Data cable into board and PC;
  • Make sure HTC Magic (SAPP400) is selected in the list of models;
  • If you use battery, press Power On key;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘Back (←)’ key and press ‘Power ON’ button. In few seconds you should see download mode saying Fastboot USB.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Z630 Unbrick – Boot repair supported

13.05.2011  Samsung Z630 Unbrick – Boot repair supported

Resurrection of Samsung Z630 requires battery or external power supply. Most convenient way is to use additionally an USB cable: in this case power is auto powered on and there will be no need to hold power on key during connection startup.
Please note, phone will be detected even with only USB cable connected, but stable connection and stable data exchange will be achieved only when battery (or external power supply) is connected too.

To resurrect Samsung Z630:

  • Solder JTAG cable to Samsung Z630 JTAG pads;
  • Insert battery (or connect external power supply to the battery pads) and connect USB cable;
  • Make sure Samsung Z630 is selected in the list of models;
  • Click Resurrect button;
  • Wait till software signals a successful operation completion;
  • Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold ‘4’ key and press ‘Power ON’ button. In few seconds you should see light-blue screen.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Galaxy Ace S5830 Unbrick – Boot repair supported

12.05.2011 Samsung Galaxy Ace S5830 Unbrick – Boot repair supported

Samsung S5830 resurrection is simple. Phone is auto powered when USB Data Cable is inserted while battery is inside. If you don’t use USB cable, make sure to hold Power On button during JTAG connection establishing phase.

To resurrect Samsung S5830 do this:

  • Solder JTAG cable to Samsung S5830 JTAG pads;
  • Insert battery and connect USB cable to phone and PC;
  • Make sure Samsung S5830 is selected in the list of models;
  • Click Resurrect button;
  • Wait few seconds until software signals a successful operation completion;
  • Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  • Disconnect PC cable;
  • Insert battery;
  • Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On to enter Download Mode;

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.