RIFF JTAG – Samsung Galaxy GIO (S5660) Unbrick – Boot repair supported

23.08.2011    Samsung Galaxy GIO (S5660) Unbrick – Boot repair supported

Samsung S5660 resurrection is simple. Phone is auto powered when USB Data Cable is inserted while battery is inside. If you don’t use USB cable, make sure to hold Power On button during JTAG connection establishing phase.

To resurrect Samsung S5660 do this:

  •  Solder JTAG cable to Samsung S5660 JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure Samsung S5660 is selected in the list of models;
  •  Click Resurrect button;
  •  Wait few seconds until software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Down’ and ‘OK’ keys and press Power-On to enter Download Mode;
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.35 released

04.08.2011   JTAG Manager v1.35 released

Whats new:

  • Added an arbitrary feature “Settings by Code” to the DCC Read/Write page.

Main purpose is to improve support quality for users: via “Settings Code” string a supporter person sees all settings which were set by user on the DCC Read/Write page.
Though, end-user may benefit from this too: Use “Settings Code” string for JTAG Manager to automatically setup all DCC Read/Write settings

  •  Fixed data loss during read and save operations in case there is not enough disk space available to store required amount of data.

(for example reading full on DCC Read/Write page, or saving read full, etc).
Now available disk space checks are performed prior disk write operations.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung Galaxy Tab M180s Unbrick – Boot Repair supported

03.08.2011     Samsung Galaxy Tab M180s Unbrick – Boot Repair supported

Samsung M180S is based on the S5PCxxx Processor (ARM core is Cortex-A8).
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on. But note, in some cases it is possible that you will have to hold Power On key during initial connection.
In case after resurrection (after you have tried with both boot versions) the download mode is not initiated (LCD remains blank) do repeat resurrection with ‘Clone Gremlin zone’ option checked.

To resurrect Samsung M180S:

  •  Solder JTAG cable to Samsung M180S JTAG pads;
  •  Connect USB cable to phone and PC;
  •  Attach battery connector;
  •  Make sure Samsung M180S is selected in the list of models;
  •  Make sure a fixed TCK frequency is selected;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On.
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Sony Ericsson Xperia X8a (SE Shakira) Unbrick – Boot repair supported

02.08.2011   Sony Ericsson Xperia X8a (SE Shakira) Unbrick – Boot repair supported

Resurrecting SE X8 is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is inserted.
During resurrection, you can select which areas to be repaired. So you can choose only those areas which you know are damaged thus saving flashing time.
To resurrect SE X8:

  •  Solder JTAG cable to SE X8 JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure SE X8 is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

 

 

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Sony Ericsson Xperia X10a mini / E10a (SE Robyn) Unbrick – Boot repair supported

02.08.2011    Sony Ericsson Xperia X10a mini / E10a (SE Robyn) Unbrick – Boot repair supported

Resurrecting SE X10 Mini is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is inserted.
During resurrection, you can select which areas to be repaired. So you can choose only those areas which you know are damaged thus saving flashing time.
To resurrect SE X10 Mini:

  •  Solder JTAG cable to SE X10 Mini JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure SE X10 Mini is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – SonyEricsson Xperia X10 Unbrick – Boot repair supported

30.07.2011     SonyEricsson Xperia X10 Unbrick – Boot repair supported

Resurrecting SE X10 is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is inserted. Be careful, JTAG pads are covered under blue mask covering, so you will need to scratch it off in order to be able to solder wires.
During resurrection, you can select which areas to be repaired. So you can choose only those areas which you know are damaged thus saving flashing time.

To resurrect SE X10:

  •  Solder JTAG cable to SE X10 JTAG pads;
  •  Insert USB Data cable into board and PC;
  •  Make sure SE X10 is selected in the list of models;
  •  If you use only battery, press Power On key;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

29.07.2011     Samsung I9100 Galaxy S II Unbrick – Boot repair supported, World First ! ! !

Samsung I9100 is based on the S5PV310 (Exynos 4210) Processor (Cortex-A9 Dual-Core).

JTAG pads are very small; professional experience in soldering is required to connect wires to the JTAG interface. There is a big variety of versions of Galaxy II devices: GT-I9100, GT-I9100G, GT-I9100L, GT-I9100M, GT-I9100T, GT-I9101, GT-I9103, GT-I9108, GT-I9188, and maybe more. Some of them are based on different hardware platform – the OMAP4430 (Cortex-A9 Dual-Core). Thus make sure first which exact hardware version you have on hands.
Note, one simple way to connect over JTAG – connect USB cable to PC and insert battery. In this case phone is automatically powered on.
Phone has such booting sequence: ROM → FBL → IBL → PBL → SBL. Current resurrector will resurrect Partition Table (PIT) and SBL zones which are located in the iNAND (eMMC) memory. Write access to memory which contains FBL, IBL and PBL loaders is not supported currently, but in case your phone has these loaders damaged, you can choose “Initiate Download Mode” way of resurrection in order to directly put the phone into the Download Mode.

To resurrect Samsung I9100:

  •  Solder JTAG cable to Samsung I9100 JTAG pads;
  •  Connect USB cable to phone and PC;
  •  Insert battery;
  •  Make sure Samsung I9100 is selected in the list of models;
  •  Make sure a fixed TCK frequency is selected;
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Down’ and ‘Home’ keys and press Power-On.
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04 Released

29.07.2011  JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04

Whats new :

RIFF JTAG Manager v1.34:

  •  JTAG Manager Project has been migrated into UNICODE.

Main advantage of this – GUI (captions of buttons, labels, etc) can now support all international characters, for example chinese
WARNING!!! Due to UNICODE migration old plugin DLLs are not compatible with JTAG Manager 1.34
Simply download new set of plugins which are unicode compatible now.

  •  Multilanguage GUI is implemented (and due to migration to UNICODE even chinese language can be fully supported)

You need to download language pack dll, for example Russian.dll. After installation go to BOX SERVICE page and there will
be available language selection.
Following items are translated into selected language by the language DLL:
1. JTAG Manager interface – labels, captions, etc.
2. JTAG Manager messages which are shown during active operation.
3. Most of messages shown by resurrector DLLs
4. Some of Resurrection Manuals (if current version of language pack does not have translated version of Resurrection Manual, then an original, English version will be shown)

  • A dded warning window which will appear on DCC Read/Write page in case user tries to flash full dump with wrong settings.

So user can check what he does wrong and thus avoid losing time and making mistakes.

  •  ARM Core Cortex-A9 (Single and MPCore) and Chipset OMAP4430 (Dual-core Cortex-A9) are addred to the supported cores list;
  •  Cortex-A9 core added to the CMM Script Engine: Example: SYSTEM.CPU CORTEXA9
  •  OMAP4430 core added to the CMM Script Engine: Example: SYSTEM.CPU OMAP4430
  •  Multicore control is added to the CMM Script Engine (Use CORE.SELECT instructions to switch between cores in multicore targets)

For example CORE.SELECT 0 will select core0, CORE.SELECT 3 will select core3

  •  Added access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)

through the CMM Script Engine (‘APB’ segment specifier added)
Thus, for example instruction: &Resp=data.long(APB:0x12345678) – will read dword from APB bus at address 0x12345678

  • Added SYSTEM.CONFIG.RESETTIMEOUT variable to the CMM Script Engine, thus it’s now possible to customise reset type and timeout

by setting this variable prior SYSTEM.UP command.

  •  Fixed bug which caused saving trash after read operaions on DCC Read/Write page in these cases:

a) reading was stopped by user
b) after JTAG Manager exe restart

  •  DCC Read/Write Page operations now allow 64-bit addressing, thus user can have full access to memory devices which size exceeds 0xFFFFFFFF bytes range.

For this, the Address and Length fields have now 10 digits instead of old 8 digits. Be carefull entering values there.
UNEXPERIENED USERS PLEASE NOTE: For example 8 digit hex value 0x12345678 entered into 10 digit field IS NOT 0x1234567800 (!!!!!) CORRECT IS 0x0012345678

  •  TGauge64 component was implemented in order to support full 64-bit range of progress indications (while old progress bars were limited to 31-bit maximum value)
  •  Fixed bug with incorrect display of scrollbars during scroling through Model and Manufacturer Lists
  • Fixed bug during erase:
    If bad block happened, and user choosed Ignore method and checked ‘Remember selection’ – software  would again popup selection dialog on next bad block.
  •  JTAG I/O Voltage (for Custom Target Settings) now has voltages from 1.6V upto 3.30V with resolution 0.05V
  •  Just for convenience added button “Target Continue” to the JTAG Read/Write page.
    This just allows to resume target running from current PC value without need to enter it explicitly into “Address” field as is needed for the “Target GO” button
RIFF Box firmware v1.26 :
  • Added support for Cortex-A9 single processor core;
  • Added support for Cortex-A9 multiprocessor cores. Multicore handling rules are following:1. After target reset (NRST=1-0-1) the Core0 is automatically selected;

    2. HALT operation halts only currently selected core (by default core0 is selected); Thus in order to halt other core user has to select required core and then execute halt operation.

    3. Reset operation can accept different strategies of reset and halt:

    – Reset, then halt all cores at the very first instruction (for now only for OMAP MCUs)
    – Reset, than halt only core0 at the very first instruction (for now only for OMAP MCUs)
    – Reset, pause, then halt all cores
    – Reset, pause, than halt only core0

    4. RUN operation starts only currently selected core.

Thus in order to start other core user has to select required core and then execute run operation.

For example, if target has 4 cores (Quad-core MCU), then after HALT operation only Core0 is halted.
To halt Core2 user has to write script:
CORE.SELECT 2
BREAK

For example, to run Core3 user has to write script:
CORE.SELECT 3
GO

  • Added H/W script (*.has) instruction which enables selection of core for multiprocessor targets;
  • Added script (CMM/HAS) access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)
  • Added support for OMAP4430 Dual-core Cortex-A9 MCU
RIFF GDB Server v1.04 :
  • Fixed bug with reset timeout – erroneously value in Edit field was taken as HEX not decimal, Now is ok
  • Added few more GDB commands for compatibility with IDA 6.1 remote debugging.
  • Added Thumb2 instruction TBB and TBW for single stepping
  • Fixed bug in Thumb/Thumb2 when stepping out of sub when POP {RegList, PC} is used (In Thumb mode return PC address is 0x01 ORed)
Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Samsung GT-i8700 Omnia 7 , Samsung W299 Duos Unbrick – Boot repair supported

29.07.2011   Samsung GT-i8700 Omnia 7 , Samsung W299 Duos Unbrick – Boot repair supported
Resurrecting Samsung I8700 is simple. Phone is auto powered on with USB Data Cable connected to the PC while battery is inside. In case you use the battery only please note you will have to press Power On key once.
To resurrect Samsung I8700:

  •  Solder JTAG cable to Samsung I8700 JTAG pads;
  •  Make sure Samsung I8700 is selected in the list of models;
  •  Insert Battery into phone and connect USB cable (in case you not use USB cable, press once the Power ON key on the phone)
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.
To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Volume Up’ and ‘Camera’ keys and press ‘Power ON’ button. In few seconds phone enters download mode.

 

Resurrecting Samsung W299 is simple. Phone is auto powered on with USB Data Cable connected to the PC while battery is inside. In case you use the battery only please note you will have to press Power On key once.
To resurrect Samsung W299:

  •  Solder JTAG cable to Samsung W299 JTAG pads;
  •  Make sure Samsung W299 is selected in the list of models;
  •  Insert Battery into phone and connect USB cable (in case you not use USB cable, press once the Power ON key on the phone)
  •  Click Resurrect button;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using known flashing methods.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

RIFF JTAG – Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

15.07.2011  Qtek 9000 (HTC Universal) Unbrick – Boot repair supported

Current resurrector works with Qtek 9000 with MDOC G3 memory version. In order to establish JTAG connection charged battery is required. In some cases you will need to press power on key during initiating connection.
Please note, in case the Download Mode Initiation resurrection way is selected in the resurrector popup settings window, battery must be charged enough in order for phone to enter download mode.

Current resurrector offers 2 ways to resurrect the phone:

  •  WAY1: Writing SPL code directly into the MDOC memory (there are 2 hardware versions of the Qtek 9000 exist: boards with G4-type MDOC memory and boards with G3-type MDOC memory; current resurrector contains DCC Loader for G3 MDOC memory; thus for G4 version you need to use other resurrector)

 

  •  WAY2: Initiating DOWNLOAD MODE without touching MDOC contents;

MDOC G3 memory has security features, due to which there is a risk of permanently blocking the access to the flash memory while re-flashing the IPL loader. Current resurrector will not touch the IPL zone, but it is possible you’re already holding such killed device in hands. If it is so you will see this error:

****************************************************************
Detected a Not Initialized FLASH1 Chip ID: 0x0200/0xFDFF
ERROR: Selected FLASH Chip was not initialized by the DCC Loader
****************************************************************
In this case resurrection of your device is not possible. We advise you to solder a new flash memory chip and then use resurrector with IPL re-flash enabled.
To resurrect Qtek 9000 G3:

  •  Solder JTAG cable to Qtek 9000 G3 JTAG pads;
  •  Insert battery and connect USB cable to phone and PC;
  •  Make sure Qtek 9000 G3 is selected in the list of models;
  •  Click Resurrect button;
  •  In popup window select desired way of resurrection;
  •  Wait till software signals a successful operation completion;
  •  Disconnect USB cable, de-solder JTAG wires;

To enter download mode:

  •  Disconnect PC cable;
  •  Insert battery;
  •  Hold both ‘Light’ key (the one near to the volume slider) and ‘Power On’ key and press with stylus the reset hole-button.

Additional info:

  •  The DiskOnChip G3 memory type has security features. Access to both protected partitions (as IPL loader area) is done using password 00000000.
  •  IPL re-flash is intentionally switched off in this resurrector. While re-flashing the IPL area there is a risk of permanently blocking the memory chip.
  •  Memory is two DiskOnChip (MDOC) G3 cascaded chips, IDs are 0x0200; capacity is 64Mb+64Mb); though current DCC Loader was tested to read/write correctly only the SPL zones.

 

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.