Read/Write SC3 control registry?

[crepatas]

I have a bricked Hermes due to Pocket HAck MAster. I'm trying to read the control registry and load the correct values for the CPU frequency (hopefully this is the only thing that PHM changed). Anyway I was able to get the password and read something from the bootloader but I need help to understand the output for rmdr command. This is what I get:


USB>password B~~00~~0e1u7~000
HTCSPass1.CMˆËHTCEUSB>set 1e 1
USB>
USB>rbmc tmp.txt 0x4C000004 F
GetExtRomData+(): *pszPathName=tmp.txt, dwStartAddress=57600000, dwLength=F
:F=tmp.txt
:A=57600000
:L=0000000F
:rbmc=
HTCSÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿÿÿ

In this case I"m trying to read the MPLLCON control register at address 0x4C00004 to test if the loaded value is the correct 0x00096030.
Any help on understand the rbmc output? How can I read and write in 0x4C00004? After the rmdr command the bootloader is stuck with the long sequence of "ÿ".

Thanks
Crepatas

[crepatas]

I need to use wdatah, too. But it is not clear where I put the value I want to be stored in memory.

From the wiki help I should use the following sintax (I attached the help below):

wdatah 4 0x4C00004

But where do I put the value that I want to be loaded? e.g. 0x00096030
Thanks
Crepatas
PS: do I need to worry about checksum/signatures?


wdatah

Seems to replace / extend the old wdata command which writes data to memory

Usage: wdata [Len [StartAddr]]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x80000 bytes(buffer limitation).

Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.After command execute, then send out the data to terminal. Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).

Password is needed to use this command:

USB>wdatah
Command is Locked!
Example commands issued by ROMUpgradeUt:

wdatah 80000 33d5115e
wdatah 80000 723a520b