Crashed update: Hermes in tri-color mode

[Hans Jansen]

Hi everybody,

A friend of mine (who claims his English is not good enough to write here in forum) crashed his Hermes (T-Mobile Vario II, preproduction version). He tried to upgrade its ROM (from T-Mobile 1.4.110.1 to HERMIMG_Dopod_1.23.707.1_SHIP.nbh ) with a help of the following link: ftp://xda:xda@xda-developers.com/Uploads/Hermes/CHT9000_ENG.exe

He followed the instructions:
Please note the existing ROM is English ROM from Dopod for the SE Asia market. I tried this ROM with my Chinese version of Dopod CHT9000 (Traditional Chinese version from Taiwan). If you try to flash it directly you will get a vendor error. Try the following steps:
1. Extract CHT9000_ENG.exe by right click (I use Winrar)
2. Make sure you are connected through ActiveSync.
3. Open ROMUpgradeUT.exe
4. Go through all steps. Eventually you will see your device reset and go into a ROM Flash screen at 0%. You should get an error from the Flash software stating wrong Vendor ID code.
5. Don’t disconnect the device or reset it. Close the Flash software.
6. Click on ROMUpgradeUT.exe again and go through all steps. This time it should start flashing the ROM.
7. That’s it.

Till the step 6 was everything OK. However after re-starting of ROMUpgradeUT.exe everything started again from the beginning. He got the error 262 saying:
ERROR [262"> : UPDATE ERROR
This error occurs during the CE ROM code upgrade process.
Solution: If this happens, you can just soft-reset the device and run RUU again. The update process will then continue.
Note: At this stage, the Wince is destroyed; instead, it is in upgrade mode.

After trying hard reset he lands in so called tri-color mode, he can see “herm100 IPL-0.16 a herm100 mfg spl-0.95”. That’s it. No hard reset possible. No other upgade (downgrade) possible.

My guess is he has to do something like here: http://www.spv-developers.com/forum/archive/index.php?t-455.html
Am I right?

We thought about upgrading to ftp://xda:xda@xda-developers.com/Uploads/Hermes/Hermes_Dumped_ROMs/HTC_TyTN_1.18.255.3_WWE_Dumped_ROM.zip
I found the instructions how to create these raw files, http://wiki.xda-developers.com/index.php?pagename=Hermes_HowtoDumpRom but I have no idea, how to use the created ones!!!

Could you explain it to me shortly???

Thanks a lot!
Hans Jansen

[bernhard74]

Hard reset will not help.
Go into Bootloader:
Bootloader mode: Hold side OK and POWER buttons together and reset with stylus.(from Wiki!) (http://wiki.xda-developers.com/index.php?pagename=Hermes_Resets)
If the Tytn is in bootloader mode, you can retry the flashing with the same or another update.

Good luck!
Bernhard

[Hans Jansen]

Hi Bernhard,

Thanks a lot for your reply! However I am not sure if it helps. My friend says that "tri-color" and "bootloader" modes are one and the same mode.
He actually is able to start the flashing process again but is stops working by 0%... If he tries to repeat it - it is the same.

How is the situation with the raw files which I described in my first message?

Cheers
Hans

[pof]

How is the situation with the raw files which I described in my first message?


I am investigating on this, but havent found a reliable method to restore "raw" rom images into Hermes yet. I'll put it in the wiki if I find something, any help is appreciated too :)

[pof]

@Hans Jansen:

Are you able to find anohter HERM100 preproduction version (300Mhz) where you can extract the rom using the method descibed on the wiki?

When you are in the bootloader, you should be able to run RUU and flash the rom, but I guess the preproduction version has something different that is incompatible with the shipped or extracted roms from production versions, so the way to revive your firend's hermes should be by flashing another preproduction rom on it.

Follow this thread if you are interested in the process of making a valid .nbh file, but we don't know how to do it yet, you'll have to wait until we find the right way for hermes:

http://forum.xda-developers.com/viewtopic.php?t=58656

[vapor]

are you sayin that the only reason for this happening is because his unit is a preproduction unit?

[pof]

are you sayin that the only reason for this happening is because his unit is a preproduction unit?

I don't know it for sure, but I've heared of two people who are stuck in bootloader after upgrade and both have preproduction models, so I guess it's a common problem on these units.

[pof]

Hans Jansen:

Have u tried to connect through USB in bootloader mode using mtty (http://forum.xda-developers.com/download.php?id=9864)?

1) Disable ActiveSync: connections -- settings -- uncheck "Allow USB Connections"
2) Open mtty.exe and select "USB" from the dialog box, then hit OK.
3) On the white screen hit enter and you should see a prompt like this:

USB>

Let me know if that works, probably we can do a full rom backup to microSD and you can load the rom from it.

[holywood63a]

So far many of you have been right on with suggestions regarding the pre-production units stuck in the boot loader are just that--- the 300mhz cpu, pre=prod Hermes 100 units. I was FINALLY able to use MTTY 1.42 I got from the buzzdev.net/downloads site. I used it by removing my battery, putting it back in, and powering on the unit which allowed the USB port to be opened again. I had to wait a minute or two for activesync to try to connect and say it couldn't recognize the device, then cancelled out of that and MTTY was able to see the USB port as an option. I connected, hit ENTER to get USB> prompt. Then typed SET 14 0 and then soft-reset the PPC and WALA!!! Original OS ROM 1.5 and radio version 0.92 back and OS functional. Not fully functional as it errors trying to load some MSN .cpl files, but I say no to opening them and I have a functioning phone! I've tried to reflash the device NUMEROUS times with the CHT9000 and other ROMs posted here, but they still return me to the stuck at boot loader and won't flash. Each time, I removed the battery, waited, used MTTY to set 14 0, and soft reset and back to a functioning OS. I guess I may have to wait for other roms to try. But at least the unit isn't a BRICK anymore! Even if the ROM sucks, just gotta be patient. I even tried using NoID RUU's and MA ruu. Neither worked.

[pof]

glad you have revived it :)

HTC makes things easy for us ;)

I'll update the wiki, as this could be useful to someone else :D

EDIT:
http://wiki.xda-developers.com/index.php?pagename=Hermes_PreproductionVersions
http://wiki.xda-developers.com/index.php?pagename=Hermes_UpgradeProblems
wiki updated!

[Hans Jansen]

Hi pof, hi others!

Great job!!! I am sorry I could not react during the week. I should "meet" my friend via internet soon - so we will report our progress.

Cheers
Hans

[xxjohn]

hi everybody,

it´s me, hans jensen´s friend, who had the problem with flashing. i am sorry, my englisch knowledge is poor, however i hope, that you will understand me. very much thank to all, who have engaged in my problem. espetially thanks go to holywood63a, because he sorted out my problem.

but attention, the command "SET" may not be typed with upper case, as noted above, but with lower-case letters - "set", then!

holywood63a, pof, i invite you to beer, when you are going to prague 8) ...

[pof]

but attention, the command "SET" may not be typed with upper case, as noted above, but with lower-case letters - "set", then!

holywood63a, pof, i invite you to beer, when you are going to prague 8) ...

Glad it is working, updated the wiki with lowecase "set".

thanks for the beer!! :wink:

[Hans Jansen]

F..k, xxjohn told me he speaks no English! I believe he had to be sooo happy that he has forced himself to write his contribution here ;-)

[holywood63a]

You're very welcome as for the set command restoring your OS. Mine still has some glitches but runs until I can find a flashable ROM for the 300mhz version.

If you ever find a ROM that will flash to it, can you post to this thread?

Thanks!

And not sure I'll ever make my way to Prague or not, but would love to! I could if you sent me pre-paid flight vouchers for two adults and a child though! *smiling*

[pof]

Hello,

Can you enter into the bootloader of the preproduction version of the Hermes, issue these commands and post the output here?


info 2
info ?
checkimage
info 3


Hopefully this will give us a clue on how to modify the Hermes roms to make them possible to flash into preproduction versions.

Also check if your bootloader has any of these commands, not present in the production versions: d2s, s2d, help

And tell me the IPL / SPL versions you see when your device boots.

If you want more info check this page, you can compare with the production Hermes bootloader:

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader

Note: "info 3" could hang the mtty console sometimes, do it the latest.

cheers!

[omaqsood]

Hi Guys,

I'm in the same boat as I've just been given a pre-production model of the Dopod 838 Pro but my main problem is that the ROM language is in Chinese! No problem if I could understand it but I'm trying to install a WWE ROM but have been put off by holywood63a experiences. Has anybody found a solution to this or is there another way I can change the language?

@pof: Anyway, here is the info you requested

USB>info 2
HTCS00000000jR*¥HTCE

USB>info ?
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block

Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x1B300

CE Total Length(with sector info) = 0x3D51800
CE CheckSum Length(without sector info) = 0x3C60000

USB>checkimage
Command error !!!

USB>info 3
HTCSH

USB>info 6
HTCST ÚÈÒHTCE

USB>info 7

HTC Integrated Re-Flash Utility, Common Base Version : 0.05
Device Name: H, Bootloader Version : 0.94
Built at: Feb 21 2006 14:11:43
Copyright (c) 1998-2005 High Tech Computer Corporation

CPU ID = 0x41129200

USB>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block

Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x1B300

CE Total Length(with sector info) = 0x3D51800
CE CheckSum Length(without sector info) = 0x3C60000

Hope all this helps someone to come up with a solution.

Cheers
Oz

[pof]

omaqsood, thanks for the info, but to see exactly WHY and WHERE it fails, we need a full USB capture of the ROM Upgrade process, to do it download HHD USB Monitor (http://www.hhdsoftware.com/usbmon.html), install it and start a new capture, click on the second tab where it says "full decode" and then upgrade the rom until it fails, then stop the capture and export it as TEXT (no unicode), zip it and post the results here.
After that, connect using mtty and type "set 14 0" and "task 8" to return to your previous rom.
Hopefully this will show where the problem is and would give us a clue on how to "adapt" a rom or modify the RomUpgradeUt for flashing preproduction units.

[omaqsood]

I followed your instructions as well as I could but couldn't find the "full decode" option. I've attached the output as you asked.
I hope it helps.

[pof]

oops, i'm sorry but the log only contains activesync info, GetDeviceData.exe and EnterBL.exe, and when device enters into BootLoader USB is disconnected and LOG stopped, so it's unuseful :(

Instructions again, I hope this time will be more useful:

1) Disable activesync on your computer by right click on activesync icon -> connection settings -> uncheck "allow USB connections".
2) Put your device in BootLoader mode (http://wiki.xda-developers.com/index.php?pagename=Hermes_Resets)
3) Connect device to computer using USB cable.
4) Start USBMonitor.
5) File -> New session -> USB Monitor -> Select USB device where your phone is connected -> Check "request view" -> Finish
6) In the upper part there are two tabs: basic and complete. Click on "Complete".
7) click on RomUpgradeUt.exe and start the Rom Update Process, if everything went fine you should see all the USB traffic output on USB monitor window.
8 ) when rom upgrade fails, click on Edit -> Export and Save as type "ANSI Text files".
9) Save the file and zip it.
10) Go to mtty and issue the bootloader commands "set 14 0" and "task 8".
11) Upload the zipped file here again or put it on xda-dev FTP if it is too big.

[omaqsood]

Thanks, buddy. Followed instructions to the letter. Here are the results. I hope somebody can decipher!

[pof]

Interesting thing is that your device is SuperCID (see the output of "info 2" and "info3" commands).

The upgrade process runs as on a production model until it reaches the first wdatah command, this is the process and the differences betwen production version:

USB> task 32
- preproduction version returns Level=0x300d0a
- production version returns Level=0x46460d0a

USB> info 2
- preproduction version returns SuperCID
- production versions are CID Locked, they return the CID-Lock, for example QTEK_001

Same output in both versions for: info 3, info 6, password, initial set and shmsg commands

USB> wdatah 8000 3e4b60af
- prep ver returns "Command error !!!"
- prod version writes data to memory

So the problem is that the preproduction version lacks the wdatah command, in the bootloader.

With this info we can do some progress... probably your bootloader has different commands, it is possible that also you can flash code without signing, first step would be try some commadns using mtty and paste the output here:

USB> d2s --- if this command exist it will backup your existing rom to SD and erase the SD contents (be careful!)
USB> s2d --- if this command exists it will backup from SD to ROM (make sure your SD has a backup made with d2s first!)
USB> wdata -- this can probably be the same as wdatah but with slight differences which I dont know.

My guess is that wdatah flashes signed code to the Hermes and that's why hermes updates take so long, code is sent "as it is" in the NBH file, so the Hermes "decrypts" it and flashes it decrypted on the rom. wdata command probably will take unsigned code and flash it without decrypting, so if my guess is right we can probably make a rom for you out of a decoded NBH file using itsme tools, but there's a lot of research to do first, and probably I am wrong :P

[omaqsood]

Hey pof,

Thanks for the reply, buddy.

Here's the output of th commands you requested:

USB>d2s
Command error !!!
USB>s2d
Command error !!!
USB>wdata
Command is Locked!


Doesn't look good.

[pof]

doesn't look bad either, you have "wdata" command on the preproduction version... the production versions have "wdatah" and "wdatas" which I guess is because they verify the data you are flashing is signed. Probably you can flash unsigned data using a Rom upgrade utility (exe and dll) from another device (wizard, universal..).

Probably itsme, buzz_lightyear or TheBlasphemer can help you more than I now, because they have more knowledge with rom formats and tools. I will PM them and let's see if we get someting out of this, stay tunned ;)

[omaqsood]

Thanks a lot, pof. You've been a great help, mate. I'm going to try to password unlock the bootloader.

Let me know if anything occurs, buddy.

BTW - I've added you to my MSN list.

[pof]

@omaqsood:
Try to flash the image directly from microSD card as described in this post:

http://forum.xda-developers.com/viewtopic.php?t=62596