[JTAG] HTC Topaz JTAG pinouts (unbrick)

Search This thread

the-equinoxe

Retired Moderator
Jul 26, 2006
1,965
18
I purchased a drowned HTC Diamond 2 which I used to house my MDA V in.
Now I was in possession of a broken mainboard.
Since the JTAG pinouts are unknown till this date, I stripped the mainboard from all its components and traced the board in order to find the JTAG.
Had to make new probes from some needles in order to trace from the BGA-Grid..
The difficulty here was that the test-pins where on the other side as where the MPM 7200-A was, and with those tiny bga-vias it was real hard to trace.


Some pictures of the board (before stripping)
The front side of the Mainboard (it is a single board device, apart from speakers, LCD and antenna no further external parts, all on one board!)
attachment.php


Backside with foil still on it (this side is facing the front of the device)
attachment.php


Backside without Foil and here are the JTAG testpins:
attachment.php


The Pins I traced:
RTCK
TDO
TDI
TCK
TMS
TRST-N

*other pins:
Mode 0 (between TRST-N and TDI)
Will be checking for other pins on request (btw: sofar watchdog, mode 1,2,3 are not (yet) found)


These should suffice to JTAG the device.




For those in need of testpoints for reference voltage etc..:
attachment.php




Other info:
Memory module (on this board):
Hynix H8BES0UQ0MCA


More info Regarding JTAG as being used to debrick HTC Dream


Regards,

EqX
 

Attachments

  • back-comp.jpg
    back-comp.jpg
    63.6 KB · Views: 6,459
  • front-foil.jpg
    front-foil.jpg
    60.2 KB · Views: 6,320
  • front-jtag-01.jpg
    front-jtag-01.jpg
    98.8 KB · Views: 6,344
  • front-jtag-small.jpg
    front-jtag-small.jpg
    78 KB · Views: 6,065
Last edited:
  • Like
Reactions: яι¢αя∂σ

12aon

Retired Senior Moderator
Mar 24, 2008
2,437
483
Sounds interesting, could you explain what this could be used for?

12
 

Da_G

Inactive Senior RD / Moderator Emeritus
Aug 20, 2007
3,332
1,563
Riverside, CA
Samsung Galaxy S22 Ultra
one use for JTAG is to flash the device at a low level (i.e. lower than the bootloader) - one use for this method of flashing is that you can recover from a bad bootloader flash :)

There are plenty of other uses too, that's just one :)
 

ServError

Senior Member
May 29, 2007
374
92
Very good work, the first step to a device picking up momentum in a modding community is to find the JTAG pins, nice!
 

UnholyGod

Member
Oct 11, 2009
29
0
is this something awesomely awesome?
i mean does it enable us to do something cool which we couldnt do before?
 

the-equinoxe

Retired Moderator
Jul 26, 2006
1,965
18
You can eg. repair a hardbricked device.
Since you are entering the device on a lower level than the bootloader.
Lots of possibilities.


EqX
 

broman.m

Senior Member
Sep 5, 2009
110
12
so, could this be used to enable iSecretary to work as a genuine answeringmachine? To send audio directly and not through speaker? And record incomming, ofcourse.
 

Maikeu Locatelli

Senior Member
May 1, 2008
326
30
Rio Bananal
can you make a high resolution picture to me?, i need to see all the CIs, to help in android development?, to see the diferences of decoders and encoders from the other devices.
 

BeeGee_Tokyo

Inactive Recognized Developer
Nov 20, 2008
2,881
1,399
Paranaque
www.giesecke.tk
To use the JTAG, you need some equipment, it does not connect to a PC's USB or serial port. And you need knowledge and software to delete everything in flash and reprogram stuff like a bootloader, radio or ROM.

I think this information is very usefull for some Topaz cracks, but not very usefull for most users.

My proposal to the moderator: Unstick this thread and put a link for it into the [ROLLUP MUST READ]ROM resources: HardSPL, Unlocking, Custom RUU, Kitchens, Radios thread, that's where it belongs.
 

dna24

Member
Aug 27, 2009
15
0
can I ask for assistance in disassembling the td2 or could someone point me in the direction of a how to on the AT&T pure. I'm stuck getting the outer case of the back since the battery door is different than the original touch diamond 2. Thank you
 

the-equinoxe

Retired Moderator
Jul 26, 2006
1,965
18
can I ask for assistance in disassembling the td2 or could someone point me in the direction of a how to on the AT&T pure. I'm stuck getting the outer case of the back since the battery door is different than the original touch diamond 2. Thank you

attachment.php


Remove the plastic piece on the front (it is attached with only some double sided tape), beneath the plastic you can see the screws.

does that look like an external antenna connector I see on the main board?

Yes, there are 3 external connectors but tmk not accessible without disassembly.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I purchased a drowned HTC Diamond 2 which I used to house my MDA V in.
    Now I was in possession of a broken mainboard.
    Since the JTAG pinouts are unknown till this date, I stripped the mainboard from all its components and traced the board in order to find the JTAG.
    Had to make new probes from some needles in order to trace from the BGA-Grid..
    The difficulty here was that the test-pins where on the other side as where the MPM 7200-A was, and with those tiny bga-vias it was real hard to trace.


    Some pictures of the board (before stripping)
    The front side of the Mainboard (it is a single board device, apart from speakers, LCD and antenna no further external parts, all on one board!)
    attachment.php


    Backside with foil still on it (this side is facing the front of the device)
    attachment.php


    Backside without Foil and here are the JTAG testpins:
    attachment.php


    The Pins I traced:
    RTCK
    TDO
    TDI
    TCK
    TMS
    TRST-N

    *other pins:
    Mode 0 (between TRST-N and TDI)
    Will be checking for other pins on request (btw: sofar watchdog, mode 1,2,3 are not (yet) found)


    These should suffice to JTAG the device.




    For those in need of testpoints for reference voltage etc..:
    attachment.php




    Other info:
    Memory module (on this board):
    Hynix H8BES0UQ0MCA


    More info Regarding JTAG as being used to debrick HTC Dream


    Regards,

    EqX
    1
    So if I modded the case near the battery connector I could attach an antenna? If this proves to be possible I may be modding the case soon...... Thanks for your response!


    These connectors are not for continuously plugging and unplugging cables.
    For testing or constant attachment they are great, but as a daily used connector they suck.
    Next to that, they are behind the antennas which are stuck on the housing.
    So modding will prove to be difficult.
    1
    Hi

    I want to ask you to share your experience in this area. Explain how you found that and write a nice article or even a single post about how you was able to find those pin points. Is it possible for you?

    As I said a short paragraph would work also... I want to learn how people find JTAG pins in different phones.

    Thanks for your great share!

    Sure:

    I took a dead motherboard, took a whole bunch of photos from every possible angle, used a SMD reworkstation to strip the board from every component, and with help of the dtasheet of the processor I used a multimeter with needle probes to probe every possible via/testpoint to find the JTAG testpoints..
    Later I marked every testpoint on a suitable picture I took earlier..
    It is a destructive method, but when you have access to a dead mainboard, and an afternoon to spare.. why not ;)