Post Reply

JTAG recovery and UART debugging

OP krystianp

15th April 2014, 10:35 PM   |  #1  
krystianp's Avatar
OP Senior Member
Rzeszow
Thanks Meter: 11,735
 
668 posts
Join Date:Joined: May 2012
Donate to Me
Hi,

So I recently bought RAZR MAXX HD (locked) and while I was fighting with tz kernel I bricked my phone. It's currently in QHSUSB_DLOAD mode (when you connect usb cable) and black screen. So I decided to look for JTAG connector. Anyway, I found one place that looks like jtag connector (maybe it's jtag, maybe it has uart on it). I hope it's similar to Moto X jtag and I'll be able to get uart out of pins 13/15. Will be testing tommorow.

Regards,
Krystian
Attached Thumbnails
Click image for larger version

Name:	razrhd_jtag.jpg
Views:	303
Size:	139.7 KB
ID:	2688585  
15th April 2014, 11:29 PM   |  #2  
Senior Member
Thanks Meter: 198
 
141 posts
Join Date:Joined: Feb 2013
More
I tried to warn you, krystian!!! :/

Quote:
Originally Posted by progrockguy

Beware of downgrading since you're locked. I remember a few bricking on the Atrix hd.

Best wishes on finding UART and JTAG -- hopefully you'll have better luck than Hashcode did. He spent 3 days looking and a few months working on kexec with no success. See here for more info.

Also found this:

Quote:
Originally Posted by mattlgroff

MobileTechVideos.com fixed mine us with JTAG repair.

Last edited by progrockguy; 16th April 2014 at 04:47 AM.
16th April 2014, 03:16 PM   |  #3  
krystianp's Avatar
OP Senior Member
Rzeszow
Thanks Meter: 11,735
 
668 posts
Join Date:Joined: May 2012
Donate to Me
Quote:
Originally Posted by progrockguy

I tried to warn you, krystian!!! :/

I was more than aware of possible risk. But you won't find if you won't search.
Quote:

Best wishes on finding UART and JTAG -- hopefully you'll have better luck than Hashcode did. He spent 3 days looking and a few months working on kexec with no success. See here for more info.

I'm familiar with Hashcode work. I was talking with epinter about it when I started thinking about unlocking bootloader. I hope it's there and we'll be able to continue work on kexec.

Quote:

Also found this...

Unfortunatelly I live in Europe, so I won't be able to use their service. On the other hand flashing service and shipping costs will be almost the same (or even higher) as used mb or 2/3 of riff box costs. But it's good to know someone did it, that gives me clear message that it's possible.
17th April 2014, 03:35 PM   |  #4  
krystianp's Avatar
OP Senior Member
Rzeszow
Thanks Meter: 11,735
 
668 posts
Join Date:Joined: May 2012
Donate to Me
Wires are connected.
Attached Thumbnails
Click image for larger version

Name:	razrhd_jtag2.jpg
Views:	261
Size:	235.9 KB
ID:	2692036  
The Following User Says Thank You to krystianp For This Useful Post: [ View ]
17th April 2014, 06:47 PM   |  #5  
Senior Member
Thanks Meter: 519
 
2,551 posts
Join Date:Joined: Sep 2012
OK.
But where are you going to find the proprietary restore files? Did you find?
20th April 2014, 05:09 PM   |  #6  
Semseddin's Avatar
Senior Member
Flag Istanbul
Thanks Meter: 329
 
1,265 posts
Join Date:Joined: Feb 2010
More
So cool that you already found the ports. I wish you could find JTAG fix for hardbricked mb860,too.

XT1033 cihazımdan Tapatalk kullanılarak gönderildi
21st April 2014, 08:11 PM   |  #7  
Member
Thanks Meter: 4
 
59 posts
Join Date:Joined: Jul 2013
Thumbs up
Very interesting thread. Maybe you can even find a way to unlock it the "hard" way
22nd April 2014, 08:33 PM   |  #8  
krystianp's Avatar
OP Senior Member
Rzeszow
Thanks Meter: 11,735
 
668 posts
Join Date:Joined: May 2012
Donate to Me
Quote:
Originally Posted by xknobi

Very interesting thread. Maybe you can even find a way to unlock it the "hard" way

Would be nice but first I'd like to just bring it back to life

Quote:
Originally Posted by Semseddin

So cool that you already found the ports. I wish you could find JTAG fix for hardbricked mb860,too.

XT1033 cihazımdan Tapatalk kullanılarak gönderildi

I think I found it, but more important is if I'm gonna find correct pin functions... If I buy riff box I could try with Atrix 4G.

Quote:
Originally Posted by aviwdoowks

OK.
But where are you going to find the proprietary restore files? Did you find?

Don't have them. I will try to use memory dump or just flash mmcblk5 and 7. I'm not sure what can be done with that SoC via jtag.
Last edited by krystianp; 22nd April 2014 at 08:48 PM.
22nd April 2014, 09:11 PM   |  #9  
krystianp's Avatar
OP Senior Member
Rzeszow
Thanks Meter: 11,735
 
668 posts
Join Date:Joined: May 2012
Donate to Me
here are voltages read from the pins (with usb cable connected)

Code:
9	        10	11	12	13	14	15	16
1770-1440	50	50	40	60	1620	1810	GND
							
1	        2	3	4	5	6	7	8
1630	        1230	2	1800	12	1620	1620	680
with only battery most of those below 100mV are 0mV.

I'm assuming that pin 1 is at the bottom-left because of the text orientation on the motherboard.
Last edited by krystianp; 22nd April 2014 at 09:29 PM.
28th April 2014, 05:25 AM   |  #10  
londere's Avatar
Senior Member
Flag D.F
Thanks Meter: 6
 
310 posts
Join Date:Joined: Nov 2006
More
Hi mates, there is any way to use QPST to flash the bootloader extracted of a zip?

Greetings!!

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Top Threads in RAZR HD General by ThreadRank