Originally Posted by rachelm700
Not sure which Himalaya ROM you meant so have posted the results from these two for now. Please advise which Himalaya ROM should be run.
The Himalaya ROMs you used are OK, both files show the same output. These are the commands sent to bootloader and my explanation of the process:
Command error !!!
This should be Himalay specific, not working on the Hermes bootloader, so it says "command error".
USB> info 0
USB> info 1
On the Himalaya, "info 0" returns platfrom name (16 bytes) and "info 1" returns bootloader version (16 bytes). On the Hermes these commands return nothing (no output).
USB> password 0000000000000000
Himalaya RUU sends "password 0000000000000000", on the hermes this password is dynamic and the RUU should issue "info 3" command first to calculate the password, but as "info 3" has not been issued yet the Hermes bootloader returns Pass1
encapsulated in HTCS/HTCE block, which is the output when the password is valid!!!
USB> set 1 0
USB> set 6 ffff
USB> set 2 1
USB> set 5 F800
These commands are the same in the Himalaya and in the Hermes:
- "set 1 0" sets the operation mode to user which makes the other commands return more friendly values
- "set 6 ffff" changes the screen color to FFFF
- "set 2 1" change back color on
- "set 5 f800" changes background color to F800
This should return the CID on the Hermes, but it does not ... I don't know what it does on Himalaya. As I see no output from your Hermes here, I guess the proces has already stopped, so the following commands sent by the RUU will not work.
This unlocks the read/write flag, should be always done before flashing. (when the flash process ends, it should be done the oposite: "set 1e 0").
USB> rbmc Temp.txt 70010000 28
This reads 28 bytes of memory starting from addres 0x70010000 and saves the read data to Temp.txt file.
I don't know what there is on this memory address (anyone?), but I guess it's himalaya's specific.
The "juicy" commands will come after this one, but your hermes doesn't seem to pass from here. Luckily I found on buzzdev.net the Himalaya upgrading process
, which shows exactly the same process as I can see in your attached files, so the following that should come here if your Hermes was still alive is this:
USB> erase a0040000 c80000
USB> erase a0cc0000 c80000
USB> erase a1940000 640000
USB> set 1e 1
USB> wdata a0040000 20000
The last 'wdata' command will not work on the hermes (it uses 'wdatah' instead) so nothing is written on the rom, just erased.
If you feel brave, and always at your own risk, what you should do to fix your bricked hermes with screwed radio is this:
1) Put your Hermes in bootloader mode
2) Disable USB connections in ActiveSync
3) Open mtty.exe
and select USB port, then connect.
4) Hit enter twice, you will see the "USB>" prompt.
5) Type the following commands (do not copy paste!!!):
set 1e 1
erase a0040000 c80000
erase a0cc0000 c80000
erase a1940000 640000
set 1e 0
6) Reset your phone and put it back in bootloader mode
7) Flash the Hermes rom of your choice (if your bootloader is 1.06 it MUST match your CID, if it's 1.04 it isn't important)
Good luck and let us know how it goes!