UART Location How-To - AT&T, Rogers, Bell, Telus Samsung Galaxy S III

As much as I despise Qualcomm's lock down practices, I must admit that the Qualcomm processor is pretty darn solid. There aren't too many problems with Qualcrapp . However, that's now and I've got some information which may help some of you out in the future.
I did some hacking last night on a live stream with a few other XDA members from this and other forums. The goal was to find the UART location on the AT&T Galaxy S3.
Why, you might ask, would this be useful? During kernel and bootloader development, sometimes the device won't boot to the point where you can obtain logs to determine the problem. UART can provide the realtime eyes-on that you need to troubleshoot such problems.
So the process was as follows... On a rooted device, pull the kernel. Extract it. Add command line parameters to enable UART.
Code:
console=ttyHSL0,115200n8 loglevel=9
Recompress into a boot.img. upload with Heimdall. Teardown the device. Adb shell into the device. Execute the following code so you push data through the UART port and know if the device has locked up.
Code:
su
while [ 0 ]; do date| tee /dev/ttyHSL0; busybox sleep .5; done
After that, you can locate the UART port by probing at 115200bps.
The TX from the board (your RX lead] is placed 2nd from the bottom on the battery side of the board. RX is either the one above that or middle on the other side.
Video:
In the video, at about 5 minutes in, I said I didn't know what the 31 value was... and the kmesg logs were pretty thin.. Well, turns out they are the kernel message levels. For full logging, change that to 987654321. Samsung usually uses the 9 identifier to represent shell access .
So, I hope this helps. UART provides eyes before any other method of debugging (aside from JTAG) begins to work. UART is the first thing to do in order to make a device into a development board.

Forgot to mention.. There is surely a switch in the PARAMS to enable early bootloader logging. This is yet to be found.

Thanks Adam, amazingly helpful as usual

Wow awesome dude, good work! You never dissappoint haha.
Sent from my SAMSUNG-SGH-I747 using xda premium

I haven't watched the video yet because the loading is soooo slow.
Is it possible to uart in to the headphone jack on this device?
We were able to do this on the Atrix 4G.

upndwn4par said:
I haven't watched the video yet because the loading is soooo slow.
Is it possible to uart in to the headphone jack on this device?
We were able to do this on the Atrix 4G.
Click to expand...
Click to collapse
No. If anything were possible it would be the USB port.

AdamOutler said:
As much as I despise Qualcomm's lock down practices, I must admit that the Qualcomm processor is pretty darn solid. There aren't too many problems with Qualcrapp .
Click to expand...
Click to collapse
Wasn't fully aware they had lock down practices. Could you say more about that? Like what is it? What did they do?
Thanks.
Aaron Swartz, Rest in Pixels.

I try to find the UART port on an APQ8064(Mi2 and Nexus4 are using it).
Just one question: how can I probe uart? just random connecting my RX to any pins on the board?
Can't this completely break the hardware?

Related

Attaching Portable harddrive

Hi been following XDA for quite a long time now (great forum)
Just had a thought would it be possible to connect a USB harddrive to your phone and get it to display the files on your phone?
Cheers Jake
AFAIK it's not possible for two reasons:
Main reason is that our phone isn't capable of USB Host which is what it would need to be able to negotiate a connection with the HDD. Both devices are effectively peripherals. I believe some phones are capable but not the Hero.
Secondly you would need to cable to go from your HDD which terminates in a mini usb connector (sure you'd be able to find on though).
Sorry,
Phil
Also, this question belongs in Q&A not Development but I'm sure a mod will be along shortly to sort that out.
http://adq.livejournal.com/95689.html
...but surprisingly nobody needs that.... pity...
Sort of stand corrected then I suppose. The usb chip does support Host but the support isn't in the standard kernel. He has made a go at porting it to the 2.1 kernel and is hoping to have it integrated into a villain rom. From what I read, I don't think he has got the USB port to be powered which severly limits the number of applications for this. Can get round by using a powered usb hub but this is pretty useless for mobile uses.
Is very interesting, still very much a work in progress though.
Thanks for the quick reply just thought could be quick useful.
When you think of it, if your phone battery would have to feed power to spin up a harddisk and keep it spinning, it would get depleted pretty quickly, so this feature would be of limited use anyway.
3.5 externals use their own power supplies
it would be cool, if this would be possible^^
an usb-memory-stick would be enough for beginning
docertabum said:
http://adq.livejournal.com/95689.html
...but surprisingly nobody needs that.... pity...
Click to expand...
Click to collapse
That guy developed a kernel patch with a driver to support usb host, maybe we could add it into the kernels that are being released, or even make it an optional patch that would be compatible with the kernels in this forum? I think keyboard support would be awesome, especially for those of us who like to flash roms often, it would make typing in all of our different account details in over and over again less of a hassle.

Why can't a bricked phone be revived?

This is a question for those in the know when it comes to programming.Why isn't there a way to revive a bricked phone? Can't there be some method for a host computer to manually write the radio to the device? How does HTC fix a bricked phone for it to be a refurb?
I'm just very curious about this because I see a few people attempt to update the radio only to lose power and brick their EVO. I have no programming experience so don't know what goes on at the internal component level. Thanks in advance for your input.
It goes back to the old bootstrapping problem when computers were being developed. A computer (in this case, your cell phone) is pretty dumb at the hardware level. All it can do is run programs. That's ALL it can do. It can't even load a program, only run them. Thus the problem. It gets solved by injecting a "bootstrap" program at startup (from the phrase "pull yourself up by your bootstraps") which is a program that runs and gives access to all the I/O, and the computer can then load more programs.
When you update this bootstrapping program, it gets dicey, because if it isn't written right, or if there's a glitch during the update, this most basic of all functions gets corrupted. If the program that tells the phone how to load programs goes away, all the phone can do is... sit there. Like a brick.
Hope this helped!
That helped me, thanks.
Soylent Grin said:
It goes back to the old bootstrapping problem when computers were being developed. A computer (in this case, your cell phone) is pretty dumb at the hardware level. All it can do is run programs. That's ALL it can do. It can't even load a program, only run them. Thus the problem. It gets solved by injecting a "bootstrap" program at startup (from the phrase "pull yourself up by your bootstraps") which is a program that runs and gives access to all the I/O, and the computer can then load more programs.
When you update this bootstrapping program, it gets dicey, because if it isn't written right, or if there's a glitch during the update, this most basic of all functions gets corrupted. If the program that tells the phone how to load programs goes away, all the phone can do is... sit there. Like a brick.
Hope this helped!
Click to expand...
Click to collapse
Thanks for the info. That is interesting. So how does HTC initially put the bootstrap in and/or how do they handle a bricked phone?
Soylent Grin said:
It goes back to the old bootstrapping problem when computers were being developed. A computer (in this case, your cell phone) is pretty dumb at the hardware level. All it can do is run programs. That's ALL it can do. It can't even load a program, only run them. Thus the problem. It gets solved by injecting a "bootstrap" program at startup (from the phrase "pull yourself up by your bootstraps") which is a program that runs and gives access to all the I/O, and the computer can then load more programs.
When you update this bootstrapping program, it gets dicey, because if it isn't written right, or if there's a glitch during the update, this most basic of all functions gets corrupted. If the program that tells the phone how to load programs goes away, all the phone can do is... sit there. Like a brick.
Hope this helped!
Click to expand...
Click to collapse
Thanks good explanation appreciate that.
rafroehlich2 said:
Thanks for the info. That is interesting. So how does HTC initially put the bootstrap in and/or how do they handle a bricked phone?
Click to expand...
Click to collapse
There is probably a JTAG interface somewhere in there. In fact,that's how the original hack of the IPhone was done. (Better ways were since found) Most devices have a quasi standard interface for programming the flash and accessing and the hardware for diagnostics. For instance,linksys routers actually have a spot on the board to solder a header and you can make a cable that connects to the parralel port. Do a google search for "Hairy Dairy Maid Debrick" and you will find it. A similar thing is probobally possible with the Evo (Ive even seen them on Hard Drives and CD Rom drives) The problem is,its not entirely standardized,and it might not even be a connector or pads on the board. It might instead be a matter of knowing where you can connect the leads on the board to something that under the right circumstances BECOMES the JTAG connector. (For instance,a pin that controls something else might be a JTAG interface for the first few hundred milliseconds of start-up,or if a certain other pin of the chip is grounded when the power is applied. It might also be completely internal to the chip,and there be NO connectors on the board (it almost CERTAINLY has the capability,they need it during prototyping) and the chips might be programmed BEFORE they are soldered in. It might take replacing the rom chip to get it to go. There are lots of ifs
Chances are though,the factory has a special cable and a special software program that can reprogram the device. To replicate that might be relatively easy or could be next to impossible but requires a certain degree of knowledge about the hardware. What I suspect is,until someone who has the skills to make such a cable bricks their phone,they wont bother figuring out how to debrick one. In fact,when that person bricks their phone,they will probably take it back to sprint and say "I dont know what happens" In fact,even if its stuck looping in an obviously hacked boot loader he for some odd reason cant undo,hes probably going to send it back to sprint. I know someone who did exactly that to their brand new HP laptop. He found that 15kv from the flyback of an old B&W television applied to the memory slots took care of the looping and Best Buy gave him another one. As he put it "I dont know what happened,but it smells bad and wont boot up"
pflatlyne said:
There is probably a JTAG interface somewhere in there. In fact,that's how the original hack of the IPhone was done. (Better ways were since found) Most devices have a quasi standard interface for programming the flash and accessing and the hardware for diagnostics. For instance,linksys routers actually have a spot on the board to solder a header and you can make a cable that connects to the parralel port. Do a google search for "Hairy Dairy Maid Debrick" and you will find it. A similar thing is probobally possible with the Evo (Ive even seen them on Hard Drives and CD Rom drives) The problem is,its not entirely standardized,and it might not even be a connector or pads on the board. It might instead be a matter of knowing where you can connect the leads on the board to something that under the right circumstances BECOMES the JTAG connector. (For instance,a pin that controls something else might be a JTAG interface for the first few hundred milliseconds of start-up,or if a certain other pin of the chip is grounded when the power is applied. It might also be completely internal to the chip,and there be NO connectors on the board (it almost CERTAINLY has the capability,they need it during prototyping) and the chips might be programmed BEFORE they are soldered in. It might take replacing the rom chip to get it to go. There are lots of ifs
Chances are though,the factory has a special cable and a special software program that can reprogram the device. To replicate that might be relatively easy or could be next to impossible but requires a certain degree of knowledge about the hardware. What I suspect is,until someone who has the skills to make such a cable bricks their phone,they wont bother figuring out how to debrick one. In fact,when that person bricks their phone,they will probably take it back to sprint and say "I dont know what happens" In fact,even if its stuck looping in an obviously hacked boot loader he for some odd reason cant undo,hes probably going to send it back to sprint. I know someone who did exactly that to their brand new HP laptop. He found that 15kv from the flyback of an old B&W television applied to the memory slots took care of the looping and Best Buy gave him another one. As he put it "I dont know what happened,but it smells bad and wont boot up"
Click to expand...
Click to collapse
Wow. Thanks for the detailed answer. Too bad this isn't a standardized item. I hope eventually things progress enough where this isn't even a thought. Thanks again for the good response.
Sent from my PC36100
rafroehlich2 said:
Wow. Thanks for the detailed answer. Too bad this isn't a standardized item. I hope eventually things progress enough where this isn't even a thought. Thanks again for the good response.
Sent from my PC36100
Click to expand...
Click to collapse
Yea,it would be nice if it were. Its kinda sorta quasi standard,so it HAS been done in some cases where its necessary,but often there are easier ways around it. Personally, I have allways thought that its a pretty stupid thing to make a piece of equipment that can fail due to a bad flash. The people who designed many of the flash memory chips seemed to agree,and they added something called a "boot block" to many,but the way its implemented,when its implemented doesn't fully protect you from a bad flash. Its even worse now that everything is in ball grid array chips soldered down to the board.

Wave S8500/S8530 Development Platform Mod AKA UnBrickable Mod

This modification will go like this:
http://forum.xda-developers.com/showthread.php?t=1206216
note: this modification seems to look slighty different on S8500 than S8530 (slighty different board layout) - please check this post - http://forum.xda-developers.com/showthread.php?p=17724584#post17724584 (still needs testing)
This can be applied to a bricked phone and unbrick it without JTAG.
After that, unbricking your Wave will be almost as easy like this is (need kinda different soft, as following movie been made with SGS series phone):
See here for more info about unbricking Captivate:
http://forum.xda-developers.com/showthread.php?t=1242466
(Unbricking Wave tools are on its way)
I haven't tested it by myself but it will work. I did teardown of mine S8530 damaged mainboard.
Introduction
I'm not kidding when I say UnBrickable. Modifying the OM pins means you
can boot from USB, UART or MMC. This makes the phone quite UNBRICKABLE.
There is nothing you can do software wise to prevent the device from
booting into this mode. We are communicating with the unrewritable,
efused IROM on the processor. It's the thing that makes the system on a
chip into a "system on a chip".I am here now to tell you how to turn
your Samsung Wave into a KIT-S5PC110 development board. The
KIT-S5PC110 development board is the platform used to develop our
phones. There are some differences between this mod and the official
development platform. The S5PC110 has a removable internal SDCard and
no touchscreen.
Why would you want to do this? When you plug in the battery and
connect it to the computer in "off" mode, it will become an S5PC110
board awaiting download of a program to run. This occurs long before
anything like software or firmware enters the processor. This is the
IROM of the device awaiting commands or a power on signal.
Because it is accepting a memory flash, anything may be put onto the
device to perform a boot sequence..... Apple iOS (iPhone4 has the same
processor) WP7 (mango supports this processor).
This will be a replacement for JTAG once we are able to make some
firmware. How could it possibly be better then JTAG? Let's count the
ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the
computer via USB and await commands. Otherwise it will pretty much act
like a Droid Charge. See the Special Instructions section.
Modification
You will need:
1. Get someone who knows what they're doing with a soldering
iron. If they don't know what flux is, then they don't know what
they're doing. You can speak to AdamOutler or
Connexion2005(aka MobileTechVideos.com). I don't know who from Europe region is able to perform this mod, I still need some more soldering practice, probably in month or two I will be also able to perform this.
2. soldering iron - make sure it's sharp, if it's not sharp, then
sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (possibly- for the wire within to use as a bridge)
Performing the modification:
1. tear apart your phone... Make sure to take out your SIM and external
SDCard before you do this.
1A. Remove the mainboard (you can see on the movie how to do it)
S8500 disassembly movie (S8530 looks basically the same):
Mainboard picture:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Closer picture:
xOM resistors mapping:
2. Perform the mod by removing the xOM5 resistor and connecting its active (CPU) side to the active side of xOM0 or xOM3 resistor (so it become pull-up instead of pull-down).
3. Reassemble the phone.
Special Instructions
This may change battery charging sequency, or even disable it when the phone is turned off (it may be needed to turn on the phone first) <-- needs some tests
To turn on the device, and operate in normal mode, you must hold the
power button for 5 seconds.
3 button Download mode works as usual, however you must not have the
S5PC110 drivers installed on the computer. 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 iROM dload mode.
Conclusion
Congratulations. You now have a device which works like a KIT-S5PC110
with an OM Value of 29. Now get to developing some serious custom
software. See here for setting up the UART output
http://forum.xda-developers.com/showthread.php?t=1235219
Reading material
Creating your own Samsung Bootloaders:
http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW:
http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example:
http://www.boardset.com/products/mv6410.php
ODroid dev center:
http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Drivers and utilities
This will be an ever expanding list
Windows Drivers
http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW:
http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line Download Tool:
http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility:
http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Firmware
One-Click Resurrector (made for SGS series):
http://forum.xda-developers.com/attachment.php?attachmentid=705515&d=1314762609
Bootloader Hello World by Rebellos
http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
Please note that we are not yet able to rebuild Wave's NV_Data, so if you damage your IMEI (by trying to flash SGS stuff before dumping your oneNAND through Badadroid) you have to deal with it on your own.
Thanks to Adam Outler.
Please message me or simply make post here if you perform this mod and need any additional info.
Already done MODs:
Captivate (the first one): http://forum.xda-developers.com/showthread.php?t=1206216
Droid Charge: http://forum.xda-developers.com/showthread.php?t=1245391
It is important to note that this modification has never been performed on a S8500 before. Rebellos is very competent and will work out the details of the firmware portion. His HIBL allows insecure code to be loaded to the device and it is extremely likely that this modification will lead to easy development of alternate firmwares for your device. This mod enables a special download mode which will allow you to experiment freely as long as you have a backup of your EFS and critical data.
Once Rebellos is able to get the firmware operational, and he will likely work with you directly and remotely if you're willing, recovery of the S8500 will be this easy:
We are fully confident in this modification and if you have a bricked S85**, please send a PM to Rebellos. He will develop a firmware rather quickly to resurrect the device and then everyone will have an UnBrickable Wave!
Bonus - have you been ever wondering how does PoP BGAs or S8530 mainboard without CPU does look?
http://i53.tinypic.com/xlf8rt.jpg
From the left to right:
- oneNAND+oneDRAM+DRAM package
- Hummingbird CPU
- S8530 Mainboard
If you want I can take better macro photos of these. Also if someone want to try reballing of memory package (CPU has got burned core) I can donate it to him. However it has got like 0.1mmx0.1mm size balls. Maybe if I ever get rich and smart and I get bionic hand, I'll make a board under this package.
So Adam Did you try this with the Wave S8500/S8530 ??? or you still need a Wave for donation ???
I am very interested in this but i won't do it because i heard about some stability problems after removing the resistor
Also i have a question...Can i put the resistor back after unbricking my device or it will be totally fried??
Best Regards
You can put the resistor back if you manage to. SMD elements are usually high-temp resistable.
There is no stability problems if you connect it to some other pullup or pulldown resistor.
CPU will become unstable only if you remove resistor and leave xOM5 line unconnected to anything as it'll take electrostatic charges and induce voltage from other elements and electromagnetic field causing noise inside of CPU when not grounded or HIGHed.
you mean it will act like a really tiny capacitor (i am electrical engineering student)
Do you think that mod will reach the mobile repairing shops?
i mean if you could write a good bootloader that will dual boot android and bada (yes i think you are genius enough) then this can go to mobile shops to get it done by experts hands that will be awsome(i've never opened up my Wave and don't have much experience to do this)
You will get donations for this for sure
Best Regards
mylove90 said:
So Adam Did you try this with the Wave S8500/S8530 ??? or you still need a Wave for donation ???
I am very interested in this but i won't do it because i heard about some stability problems after removing the resistor
Also i have a question...Can i put the resistor back after unbricking my device or it will be totally fried??
Best Regards
Click to expand...
Click to collapse
Rebellos performed the destructive inspection on his own device. The work is complete, you may modify your device according to the specs above. This will allow you to boot from USB.
You may be able to put it back, but it's not likely, and you will never need to.
MobileTechVideos.com is already offering this service for Captivates as the mod is finished and we have it working fully on Linux platform. All thats left for Wave is for Rebellos to work with someone who has a working Wave (maybe 1 hour via google talk). Modify your device and PM Rebellos.
If your device is broke this will resurrect it. If your device is not broken, this will allow you to flash Android ROMs without fear of permanent damage.
I think Rebellos already has worked out the changes needed to the bootloaders to run Android on Bada with the BadaDroid project.
mylove90 said:
you mean it will act like a really tiny capacitor (i am electrical engineering student)
Click to expand...
Click to collapse
No. Rather like tiny not-grounded antenna or induction coil, which transforms all magnetic field jitters into small, noisy voltage current, which are very annyoing for CPU.
(thats why in electronic chips all pins should be connected to something which can provide stable LOW or HIGH state, if they doesn't support internal PUD mechanism)
mylove90 said:
Do you think that mod will reach the mobile repairing shops?
Click to expand...
Click to collapse
That would be awesome. Writing dual-boot bootloader isn't a huge deal, but needs some work and designing, for example problem is that oneNAND (the fastest flash memory we can use) size is only 512MB, so it can hold only like 150% of 1 OS files. That could be solved by moviNAND repartitioning and modifying bada kernel properly to not wipe Android partitions.
AdamOutler said:
I think Rebellos already has worked out the changes needed to the bootloaders to run Android on Bada with the BadaDroid project.
Click to expand...
Click to collapse
Yup, got these files ready. But I don't want to release something completely untested.
//edit:
Here you have links to modified S8530 and S8500 BL3 images.
Original, decrypted and extracted and ones can be used aswell, but needs dload-mode key combination to be hold. The modified ones does enter DLoad mode immediately.
Entrypoint for both is 0x42480000
http://hummingbird-hibl.googlecode.com/svn/trunk/HummingBirdInterceptorBootloader/S8500_BL3.bin
http://hummingbird-hibl.googlecode.com/svn/trunk/HummingBirdInterceptorBootloader/S8530_BL3.bin
I'm not seeing any action here. If you bricked your device, this will resurrect it.
Rebellos, you want me to start working on the Ultimate One-click resurrector? I don't feel motivated since Boone has put your work of proper pin identification to work... maybe the Bada guys don't DIY, or they just rather pay for JTAG?
Using this mod you can get Android on your device. You can load other device's firmware. Its very powerful and allows you to revert all changes.
AdamOutler said:
I'm not seeing any action here. If you bricked your device, this will resurrect it.
Rebellos, you want me to start working on the Ultimate One-click resurrector? I don't feel motivated since Boone has put your work of proper pin identification to work... maybe the Bada guys don't DIY, or they just rather pay for JTAG?
Using this mod you can get Android on your device. You can load other device's firmware. Its very powerful and allows you to revert all changes.
Click to expand...
Click to collapse
Maybe it's just because Wave users groups is much smaller than Cappy, also it isn't Android device, so people aren't flashing it so often as Cappy. Or they are just scared the crap out of DIY. ;d
it is not like that
Wave is not easily bricked (thank Samsung for that)
Until now i saw people with out knowledge who bricked it
Rebellos , you know bootloader is flashed in nearly 2 seconds and the phone will be bricked only if you did something wrong in these 2 seconds
i promise if my Wave bricked i'll try that method but where is the software stuff ?!
Please complete what you started Adam , Rebellos
Best Regards
mylove90 said:
it is not like that
Wave is not easily bricked (thank Samsung for that)
Until now i saw people with out knowledge who bricked it
Rebellos , you know bootloader is flashed in nearly 2 seconds and the phone will be bricked only if you did something wrong in these 2 seconds
i promise if my Wave bricked i'll try that method but where is the software stuff ?!
Please complete what you started Adam , Rebellos
Best Regards
Click to expand...
Click to collapse
Under Linux-- The HIBL gets loaded with this command:
Code:
sudo smdk-usbdl -f ./HIBL.bin -a D0020000
the SBL gets loaded very similarly
Code:
sudo smdk-usbdl -f ./S8500_BL3.bin -a 42480000
You should boot at this point. The HIBL is standard, the BL3 is provided in post 8 http://forum.xda-developers.com/showpost.php?p=17311448&postcount=8
Hi, first of all, sorry for my bad english, i'm spanish.
I bricked my wave more than one month ago. I have disassembled the phone but the xOMS mapping isn't the same. I have tried to modify the xoms but no results. Here are one photo of the xoms mapping, if you know who is the mod than i must to do, i'll try to do.
Here are the photo: h**p://i51.tinypic.com/wk1x52.jpg
This is my first post, i cant post links, change ** for tt.
jomadeto said:
Hi, first of all, sorry for my bad english, i'm spanish.
I bricked my wave more than one month ago. I have disassembled the phone but the xOMS mapping isn't the same. I have tried to modify the xoms but no results. Here are one photo of the xoms mapping, if you know who is the mod than i must to do, i'll try to do.
Here are the photo: h**p://i51.tinypic.com/wk1x52.jpg
This is my first post, i cant post links, change ** for tt.
Click to expand...
Click to collapse
Sorry. I assumed that S8500 board is the same, because schema in service manual is the same. However, it seems that there are differences.
Also see your mistake.
You connected some pulled up line straight to GND, you just made some resistor (I haven't traced it, it doesn't seem to be xOM, if order is the same) pull-down.
I'm sure the upper-left row of 3 are pull-ups, the bottom-right row of 3 are pull-downs. So resistors order should be the same.
All X resistors are pull-ups, with VCC on the upper side.
VCC line is marked purple
part of GND is marked by red spray - you can see it is big baseline, going through whole board.
second and third X resistors counting from the left should be xOM0 and xOM3.
1, 5, 2, 4 correspond to the xOM lines, they have CPU and GND sides arranged the same as on my picture from S8530 - 1,5,2 has GND on the downside, 4 has got GND on the upside.
The easiest way is connecting some VCC side of any X resistor with CPU side of xOM5 resistor, IF xOM5 resistor is 100kOhm or higher (should be around 100kOhm). If it is not - you should unsolder xOM5 resistor.
You can also connect CPU side of any X resistor with CPU side of any xOM5 resistor (theoretically the safest way, however mentioned above - short circuiting VCC with GND through 100kOhm resistor - is used on Samsung's dev board) IF you can find X resistor with resistance few times smaller than xOM5.
I'm sure this will work if done properly.
Remember to remove the soldering you've done already. Also remember to not leave xOM5 line not-connected to GND nor VCC - this will cause CPU to hang often.
Your board:
My board:
Can you see similiarities? I hope so.
After that just try ModeDetect by AdamOutler http://forum.xda-developers.com/showthread.php?t=1257434
And you should see UnBrickable Debug.
Thanks for the info Rebellos, later i'll try and post the results.
I can't unbrick my phone, after disassemble the phone and mod another time, obtain the same result, no answer on the phone and can't find the device in linux. Probably the reason is that the mod that i have done are incorrect (i haven't the tools necesary). For more info, i used Ubuntu 11.04 under virtualbox and under livecd. Thanks for all, and sorry but my experience can't help you in the development of this tool.
jomadeto said:
I can't unbrick my phone, after disassemble the phone and mod another time, obtain the same result, no answer on the phone and can't find the device in linux. Probably the reason is that the mod that i have done are incorrect (i haven't the tools necesary). For more info, i used Ubuntu 11.04 under virtualbox and under livecd. Thanks for all, and sorry but my experience can't help you in the development of this tool.
Click to expand...
Click to collapse
If you simply remove the resistor, about 1/2 of the time it should enumerate properly with the battery removed from the device. Once you have unbricked, jumper the xOM5 to something (high or low) so that it's not free floating.
hmmm Port Android easier, i see, but i am always asking myself why putting so much energy in a device that is after 2 years surely gone from market? (Only a question)
The energy could be put in other directions but everyone has his special hobby...
Seeying this android port will be maybe finished when everyone gets new device, for personal it has no sense to put the free time in such projects.
I know what i am talking about, i developed slyfer 3 months, hacked their server got for 9 months all firmwares, but what i have now from this? Nothing, i am very sad that i put so much time in such a project with no future, maybe you guys understand what i mean. So much skills can be on other site usefuller.
@Rebellos, why you dont try a "jailbrake" like for bada? You have the skills for that, but it seems that all of your energy will go in the bootloader for android, so around more than 50% (cause a lot arent on forums) will not have benefits from it. But anyway its your work and decision. And as we all know a not possible for bada doesnt exists.
Everything is possible.
But think about it the life is short, maybe things that helps all would make you also happy as me, but if you already know that your work will be in nearly a year for nothing it would be better to search another thing to kill time. Slyfer now is a dead program with no sense, it only shows me that i made it some day but uselesser it cannot be like this:
http://www.youtube.com/watch?v=UkgoSOSGrx4
Only my thinking.
You have the skills for that, but it seems that all of your energy will go in the bootloader for ...
Click to expand...
Click to collapse
Why not improve Reversing skills...
Bootloader knowledge is mandatory for deeper research/develop of Hardware or Software solutions...
Not everyone need it or understand it.
Anyway.
Its free decision.
@ larioteo
You are interested in Software ...
Others are interested in Hardware... like me...
Rebellos for instance like to learn more about Hardware + Software.
@Rebellos, why you dont try a "jailbrake" like for bada?
Click to expand...
Click to collapse
You know the answer...
Compression Algo of apps_compressed.bin (same for RC1 and CSC Languages... aka QMD compressed stuff) is not complete hacked...
Bootloader contains Algo for QMD...
Best Regards
Jomadeto, sorry for that it didn't worked
Larioteo, that movie is awesome. Thank you.
Excuse me little offtopic, but... maybe someone can PM me this
What exactly is jailbreak?
According to first phrase of this definition:
http://en.wikipedia.org/wiki/IOS_jailbreaking
We do already have jailbreak. Through modified FOTA we can force BL to load any ARM binary, any modified bada apps and so on. Just gimme practic target and I can try to achieve it someway. (I hope I'll have dev board soon )
But, beggining studies in 3 days, so ain't sure how much time I'll have for various hobby R&D.

Phone life after death. Breaking the Jtag taboo.

I had some research yesterday, yet I still can't find a proper answer to most of my questions about the following subject. Hoping some of the experts here can contribute some of their knowledge and hopefully I will edit this thread to a guide, or at least spare others the need for wondering around the web as I did.
Well, Few days ago I turned off my phone, and it wont turn on or response to any physical key combination, usb connection (Except for charging the battery) or even that famous Samsung jig (301KΩ Between pin 4 and 5 on the usb connection). It is not recognizable by any device while connected through usb interface. It is permabricked. The worst thing that can happen to a phone while the hardware is intact.
Although the name indicates otherwise, some things can be done in order to get the device working again.
It is a process in which the phone's main bored is exposed, than a special device (e.g riff box) is connected to certain areas on the pcb that were made that way for the initial configuration of the phone back in the factory. The pinout of the connection varies in each model, but the interface is the same and called "Jtag". Than, that device connects to a pc through usb interface.
So the first step would be to get that device and to connect it to both pc and phone's motherboard through a certain pinout that is mostly hard to get. You'll need a driver for that jtag flashing device and a compiled file which you would like to flash in to your phone. I don't know if that file is specific to each model or to the certain chip the phone is using (Can different models with the same chip be flashed the same way? Reply if you know and I'll edit it here).
By what I know, after flashing that file the phone will be accessible through usb interface for further flashing of the rom.
Alternatively, There are some companies that offer that kind of service. I couldn't find any who work with T989, and prices for that kind of service.
I would like to have as much information as possible and maybe eventually I'll be able to get my phone fixed. In that case I'll add some photos and document the process.
Michael.fri said:
I had some research yesterday, yet I still can't find a proper answer to most of my questions about the following subject. Hoping some of the experts here can contribute some of their knowledge and hopefully I will edit this thread to a guide, or at least spare others the need for wondering around the web as I did.
Well, Few days ago I turned off my phone, and it wont turn on or response to any physical key combination, usb connection (Except for charging the battery) or even that famous Samsung jig (301KΩ Between pin 4 and 5 on the usb connection). It is not recognizable by any device while connected through usb interface. It is permabricked. The worst thing that can happen to a phone while the hardware is intact.
Although the name indicates otherwise, some things can be done in order to get the device working again.
It is a process in which the phone's main bored is exposed, than a special device (e.g riff box) is connected to certain areas on the pcb that were made that way for the initial configuration of the phone back in the factory. The pinout of the connection varies in each model, but the interface is the same and called "Jtag". Than, that device connects to a pc through usb interface.
So the first step would be to get that device and to connect it to both pc and phone's motherboard through a certain pinout that is mostly hard to get. You'll need a driver for that jtag flashing device and a compiled file which you would like to flash in to your phone. I don't know if that file is specific to each model or to the certain chip the phone is using (Can different models with the same chip be flashed the same way? Reply if you know and I'll edit it here).
By what I know, after flashing that file the phone will be accessible through usb interface for further flashing of the rom.
Alternatively, There are some companies that offer that kind of service. I couldn't find any who work with T989, and prices for that kind of service.
I would like to have as much information as possible and maybe eventually I'll be able to get my phone fixed. In that case I'll add some photos and document the process.
Click to expand...
Click to collapse
1st off, it's "taboo" not tabu. Secondly there is already a pretty good amount of threads that have covered this in detail, I'm certain because I have posted in them. Lastly, please SEARCH the existing threads before creating a new one; the answers to all your questions are already there.
1. Thanks, Changed to "Taboo".
2. I searched, I really did. I went all over google with many key words and covered up this forum as well. All I got is some articles about the jtag protocol, which is good for knowledge but too general for the application I need, and some threads in which people writing that their phone is bricked and asks what to do about it. Not a single post is about how to fix that independently, and what does it require. If you could give me link to these threads you say that covers up the subject, I'll delete this thread at once.
Michael.fri said:
1. Thanks, Changed to "Taboo".
2. I searched, I really did. I went all over google with many key words and covered up this forum as well. All I got is some articles about the jtag protocol, which is good for knowledge but too general for the application I need, and some threads in which people writing that their phone is bricked and asks what to do about it. Not a single post is about how to fix that independently, and what does it require. If you could give me link to these threads you say that covers up the subject, I'll delete this thread at once.
Click to expand...
Click to collapse
don't pay attention to that guy he like to troll every where he goes. Try to google search for mobile tech or Adam Outler, and check if he get the Jtag service for our phone. If I'm not wrong the charge for the Vibrant was $50.00 plus shipping and handling. I hope you can fix your phone.
Sent from my SGH-T989 using xda premium
Do you know what caused the brick?
Sent from my SGH-T989 using xda premium
Searched, and yet no result. Sending the phone to the U.S is quite risky. I have no idea how they're intended to pack it before sending it back. I would rather doing this in Israel.
I saw on ebay several devices associated with Jtag. the price starts from 10$ for a simple usb dongle, through 30$ devices, which is the price of most of the jtag devices I found, to the 150$ riff box that is associated with phone unbricking.
By what I know Jtag is a simple serial protocol. I just need sort of "bridge" to translate the logic 1's and 0's with the right voltage level and certain clock speed to a usb interface or even RS232. How expensive can that be?
I also contacted several ebay sellers which offer a jtag repair service. they all answered this model is not supported.
I would go to Samsung labs in Israel and see what they can do to get it working.
I just thought to invest 20$, get that sort of device and to get it done by my own.
Another issue is the pinout. The pinoput of the Jtag connection is not shown in any website, so I have no way of knowing how to connect on this specific PCB.
Last thing I need is that new bootloader I can flash, and a software to flash it through. Where can I download it?
About the reason for bricking the phone, I have no Idea. As I said, last time I've installed new rom was more than a week prior to the incident. I've used some overclocking app mostly to underclock my phone, cause it drained the battery like hell before, even while it was running on stock and after changing the rom several times.
I also used some usb otg device which worked normally, but was not plugged to the device even few hours before it was bricked.
Hopefully we can figure out the cause of these permabricks so we can prevent it from happening to more people.
Sent from my SGH-T989 using xda premium
I gotta say, this is quite alarming. That the phone can just hard brick itself like this spontaneously.
I've had some scary experiences with the phone myself. Like a couple of random reboots that required the long power press for the phone to power back on. At least it always came back on.
I'm also from Israel myself so a similar scenario can bring me to the same situation as you.
Good luck with getting any kind of solution.
Sent from my SGH-T989 using xda premium
parusia said:
don't pay attention to that guy he like to troll every where he goes. Try to google search for mobile tech or Adam Outler, and check if he get the Jtag service for our phone. If I'm not wrong the charge for the Vibrant was $50.00 plus shipping and handling. I hope you can fix your phone.
Sent from my SGH-T989 using xda premium
Click to expand...
Click to collapse
Troll for advising to follow the posted rules of membership ? WOW
I just contacted Adam and still no jtag for this device .
Sent from my Galaxy Nexus using XDA App
did you look for a service manual?
- the manual may cover schematics for jtag device.
Been flashing phones since the Razr and never bricked a phone I couldn't repair myself. That is until I tried to flash my GSII back to stock through odin. Sent it to Samsung and they had to replace motherboard. Now I'm a little nervous about using odin.
reocej said:
Been flashing phones since the Razr and never bricked a phone I couldn't repair myself. That is until I tried to flash my GSII back to stock through odin. Sent it to Samsung and they had to replace motherboard. Now I'm a little nervous about using odin.
Click to expand...
Click to collapse
I recommend splurging on the $2-3 for a jig, I have had moments where I thought I was SOL & the jig saved my arse.
Michael.fri said:
Last thing I need is that new bootloader I can flash, and a software to flash it through. Where can I download it?
Click to expand...
Click to collapse
Did you solve your problem?
I was looking at using QPST
QPST is a program often frowned upon here at xda. It is commonly used to flash phones, and has little to do with android coding. The software is made for Qualcomm (or by them) and this device has a chip from them in it. This has tools for building and installing bootloaders and partition tables. Our device after a hard brick (and still serviceable by JTAGing) has a com port open still and if you load the driver in windows you will see a port number as others here on XDA have said. The driver allows ODIN to see the device but not connect. QPST does connect, but I have not attempted to flash anything to it since I have not built any files to load. I'm kind of stuck creating the needed xml that makes the partition table and headers and file that are to be loaded to partitions. This is really a softbrick, in my opion, but nobody has the knowledge for this level of building and coding, with this tool, here at XDA. If somebody does, it may make those selling JTAG services mad, but that would mean we could fix our phones on our own. On my own, I'm a few weeks away from this solution, with some help from people here that know how to write xml for partition tables and can help me locate files for a build, I can generate the files, test them, make a write up and post the solution in just a few days.
By the way, this is a multi-device solution in the long run. We get one fixed and we can start on the others with this same issue, where the only life left in the device is the Qualcomm download mode driver showing in windows device manager.
Michael.fri said:
I had some research yesterday, yet I still can't find a proper answer to most of my questions about the following subject. Hoping some of the experts here can contribute some of their knowledge and hopefully I will edit this thread to a guide, or at least spare others the need for wondering around the web as I did.
Well, Few days ago I turned off my phone, and it wont turn on or response to any physical key combination, usb connection (Except for charging the battery) or even that famous Samsung jig (301KΩ Between pin 4 and 5 on the usb connection). It is not recognizable by any device while connected through usb interface. It is permabricked. The worst thing that can happen to a phone while the hardware is intact.
Although the name indicates otherwise, some things can be done in order to get the device working again.
It is a process in which the phone's main bored is exposed, than a special device (e.g riff box) is connected to certain areas on the pcb that were made that way for the initial configuration of the phone back in the factory. The pinout of the connection varies in each model, but the interface is the same and called "Jtag". Than, that device connects to a pc through usb interface.
So the first step would be to get that device and to connect it to both pc and phone's motherboard through a certain pinout that is mostly hard to get. You'll need a driver for that jtag flashing device and a compiled file which you would like to flash in to your phone. I don't know if that file is specific to each model or to the certain chip the phone is using (Can different models with the same chip be flashed the same way? Reply if you know and I'll edit it here).
By what I know, after flashing that file the phone will be accessible through usb interface for further flashing of the rom.
Alternatively, There are some companies that offer that kind of service. I couldn't find any who work with T989, and prices for that kind of service.
I would like to have as much information as possible and maybe eventually I'll be able to get my phone fixed. In that case I'll add some photos and document the process.
Click to expand...
Click to collapse
Mobile Tech offers the JTag service. There is even a discount for XDA members. They offer the service for all variants of the S2
Here you go!
http://mobiletechvideos.mybigcommerce.com/samsung-galaxy-s-ii-jtag-brick-repair/
daxxone said:
QPST is a program often frowned upon here at xda. It is commonly used to flash phones, and has little to do with android coding. The software is made for Qualcomm (or by them) and this device has a chip from them in it.*snip* On my own, I'm a few weeks away from this solution, with some help from people here that know how to write xml for partition tables and can help me locate files for a build, I can generate the files, test them, make a write up and post the solution in just a few days..
Click to expand...
Click to collapse
Any word on a fix using QPST?

[Q] A100 w/3.2 does not work in USB Accessory Mode

I have an Acer Iconia A100 Tablet with Adroid Honeycomb 3.2. I also have an Arduino-compatible board with USB Shield. (Arduino is an open source hardware platform that enables Android tablets/phones to do things like machine control over the Universal Serial Bus.)
My A100 won't communicate through the USB port to the board. I know it's not designed to work in USB Host mode, but this setup is designed for tablets with USB Accessory mode. Other posts say that Android 3.2 devices are supposed to work in USB Accessory Mode and with the Android ADK. (Note that I did enable "USB Debugging" in Settings - Applications - Development.)
Here is a picture of what I am trying to do:
www(Dot)seeedstudio(Dot)com/wiki/File:SeeeduinoADK_Setup.jpg
The Android phone can toggle an LED and receive input from a variable resistor. USB Power is provided by the board, not the phone.
I'm trying to troubleshoot why the A100 does not recognize anything connected to its USB port. Yes, I can transfer files to a PC over the USB, but that's about it.
I downloaded a terminal emulator app to my A100. When I put "USB devices" into the terminal emualtor, it never sees any devices connected -- not even my PC when I transfer files.
Another post talks about installing "Taboonay" on an Acer A500 unit to allow it to work in USB Accessory mode, but I could find nothing equivalent for the A100.
Can something be done to get the Acer A100/3.2 to work in USB Accessory mode?
This is a very interesting post.
First let me say I'm a noob but I will do the best I can with what I know.
I'm not sure if we will get full USB host or at least accessory mode. I think it will always be a multi-part issue. I think the micro USB port the A100 comes with doesn't the correct pins to provide power to ANY USB device. So what ever device is connected has to supply its own power. If this is correct I don't a way around having to supply any USB device external power(this doesn't seem like a major issue just a limitation).
At first I figured we could just use a powered USB hub and we would be good to go I guess not... at least not yet.
However on other devices developers here have been able to rewrite a USB driver to enable other modes and features. Right now the hope is that this can eventually be done. I don't think a solution is currently available. It does sound like you might of assistance in furthering that cause however and would encourage you join us all in seeing what we can get our A100s to do.
I hope this information was helpful for you.
NoSudo said:
the micro USB port the A100 comes with doesn't the correct pins to provide power to ANY USB device. So what ever device is connected has to supply its own power. If this is correct I don't a way around having to supply any USB device external power(this doesn't seem like a major issue just a limitation).
Click to expand...
Click to collapse
You are correct, the micro USB port will not supply power to devices connected to it, even if it did it would drain the battery even quicker than what it does.
In order to get USB host / accessory mode to work the most we can do at the moment is compile a kernel module for it and try to load it in the current running kernel via insmod. Right now such a thing does not exist, but hopefully if I ever get some free time and if no one else has done it I'll be able to do it.
Sent from my MB860 using XDA App
Thanks to crossix and NoSudo for the replies. I have been beating my head against the wall for weeks trying to understand my problem. Apparently, some Honeycomb 3.2 devices can operate in USB Accessory Mode and some cannot. I could not find anything in the Acer A100 specs that addressed this, and Acer Tech Support has not been helpful.
One question: If the unit can somehow get upgraded to "Ice Cream Sandwich," would that solve the USB Accessory Mode problem?
roc524 said:
Thanks to crossix and NoSudo for the replies. I have been beating my head against the wall for weeks trying to understand my problem. Apparently, some Honeycomb 3.2 devices can operate in USB Accessory Mode and some cannot. I could not find anything in the Acer A100 specs that addressed this, and Acer Tech Support has not been helpful.
One question: If the unit can somehow get upgraded to "Ice Cream Sandwich," would that solve the USB Accessory Mode problem?
Click to expand...
Click to collapse
No, ICS will not.. but if they enable the functions at the time they build the kernel that might do it.
Sent from my moto atrix running jokersax CM9 (ICS)!
crossix said:
No, ICS will not.. but if they enable the functions at the time they build the kernel that might do it.
Sent from my moto atrix running jokersax CM9 (ICS)!
Click to expand...
Click to collapse
That is right... assuming they have a driver for such a thing. Since it seems they are basing their kernel on the Ventana board, I don't see why not.
crossix said:
No, ICS will not.. but if they enable the functions at the time they build the kernel that might do it.
Sent from my moto atrix running jokersax CM9 (ICS)!
Click to expand...
Click to collapse
Off subject, but geez dude, how many devices do you have? I find your posts all over xda with a different "sent from my ________" all the time! Lol
ummmmm............ could you repeat that?
6stringandy said:
Off subject, but geez dude, how many devices do you have? I find your posts all over xda with a different "sent from my ________" all the time! Lol
ummmmm............ could you repeat that?
Click to expand...
Click to collapse
The MB860 is the Atrix. I should know, I'm running Joker's CM9 on it too
lol, I've been on these forums for a few years, so I've got a few different phones I've gone through including a palm treo 750, htc kaiser, the g1, nokia e75, htc aria, iphone 3gs, lg quantium and now the atrix.. I think my next phone is gonna be a tegra3
Sent from my moto atrix running jokersax CM9 (ICS)!
Ripped off by USB Capabilities
Recall that I have an Acer A100 with Android 3.2 and micro USB port that will not work in "USB Accessory" mode as the operating system would have me believe. How can I avoid a similar problem with my next tablet purchase? Could I have checked the tablet's specs more thoroughly? I feel ripped off and would like to know how to buy more intelligently in the future. Acer tech support does not have a clue about this and does not care.
Thanks to the respondents of this post.
yeah, as they said, the micro-usb port on board won't supply power to devices connected through it.
I tried THIS but didn't work, so, maybe if we could make an usb to micro-usb cable with its own power supply it could work (not sure at all)
USB Accessory Mode not Host Mode
Thanks, but the USB power is not an issue here. The board I am using (www(dot)seeedstudio(dot)com/depot/seeeduino-adk-main-board-p-846.html) receives external power. My tablet is supposed to operate in USB accessory mode in which it can send out USB information to this board which provides power.
I am trying to find out, before I buy my next one, whether the phone/tablet can handle this "USB Accessory mode." Some devices can handle it as per this picture: www(dot)seeedstudio(dot)com/wiki/File:SeeeduinoADK_Setup.jpg. The Acer A100 cannot. How could I have determined this before I bought it??
roc524 said:
Thanks, but the USB power is not an issue here. The board I am using (www(dot)seeedstudio(dot)com/depot/seeeduino-adk-main-board-p-846.html) receives external power. My tablet is supposed to operate in USB accessory mode in which it can send out USB information to this board which provides power.
I am trying to find out, before I buy my next one, whether the phone/tablet can handle this "USB Accessory mode." Some devices can handle it as per this picture: www(dot)seeedstudio(dot)com/wiki/File:SeeeduinoADK_Setup.jpg. The Acer A100 cannot. How could I have determined this before I bought it??
Click to expand...
Click to collapse
The best way to test something like that out is to bring something that requires being plugged into a usb to operate (like your keyboard) or you could Google "<device name> tech specs".
Sent from my ADR6400L using xda premium
Any news on this ...?
Has a usb driver been developed or something (will it be on ics )?
crossix said:
You are correct, the micro USB port will not supply power to devices connected to it, even if it did it would drain the battery even quicker than what it does.
In order to get USB host / accessory mode to work the most we can do at the moment is compile a kernel module for it and try to load it in the current running kernel via insmod. Right now such a thing does not exist, but hopefully if I ever get some free time and if no one else has done it I'll be able to do it.
Sent from my MB860 using XDA App
Click to expand...
Click to collapse
Crossix did you have time to check this...?
Thanx...
Sent from my A100 using Tapatalk
Thanks for all the work, would love this on my tablet as well.
In the service manual I have found the scheme of our motherboard. Our device's HARDWARE doesn't support USB host at all.
New here, I just bought an Acer A100 specifically for using it with the android ADK based off this (apparently I can't post links? ok just google "Tablets and the Android Open Accessory Development Kit (ADK)" and click on the first result) website's recommendation. And now I find that it doesn't work at all? Nothing I can do about this?

Categories

Resources