SUCCESS! De-Bricking Dreams - Complete JTAG Testpoints! UPDATE! 04/07/10

---

I figured this should be in its own thread so those working on a solution can now focus on the software side of things.



These are the JTAG connection points I traced from the CPU to their test points. i'm almost 90% sure the Primary is still usable. Auxilary JTAG port is Very very hard to get too and i'd imagine even for the technicians that reprogram them at the repair center. I didnt have much luck getting a connection made due to mu lack of JTAG knowledge and incorrect type of JTAG circuit(working on another though). i'm posting up the complete testpoints I spent MANY MANY countless hours and sleepless nights tracing so someone who has done this before can get a recovery procedure made to fix all bricked HTC-dreams. The reason I am doing all of this is not specifically for the Dream but because in the field of work im in, and the type of work I do I could benefit from it both for my personal phones and at work. I did research over the years but could never quite understand how JTAG is used until now. I took my spare fully working beater G1 and unsoldered the CPU with an IR Rework Station(T-870A) at home with the intentions of placing the CPU back on when done. took ALOT longer than I hoped and because of the fact that i had to hold test probes on the contact pads tight so I could flip the board and trace their also, it killed a couple of the pads so thats when I decided to say screw it, still have all the spares for my main Dream, now I can REALLY find the rest of the pins....and a few extras that might be used in the future to add features.

********Technical Notes*******

Their are 4 Mode control pins listed in the pictures.
Mode 3 is under the SIM slot, accessing requires de-soldering 4 points holding the SIM carrier to the board.
Mode 0 is NOT a testpoint, but a solder point were a resistor could go to ground. it is VERY hard to solder too directly.
Watchdog pin can simply be grounded with a resistor in place or with a needle through the shielding which would be ground. its a single solder point.
Primary JTAG is next to the LCD connector.


When you see were the pins for AUX are located you will see why I think thats not were the focus should be...their scattered in odd places, also have to remove the sim slot to access the last one which took forever to find.
Trackball has a hidden test point for the return clock as well, otherwise you need to solder directly to the connector on the main board.

Note: Return Clock is missing in the Picture for the AUX_JTAG connector...it is located at the top right testpoint just above the trackball pad, otherwise you will need to solder directly to the connector on main board.

if you need any more just let me know, if anyone wants to add to this please feel free.
Images are NOT MINE, they are the property of whomever took them, I only traced and added the labels, if their is a problem with using them let me know!





IF anyone wants to donate a bricked G1 board for experimenting or donate in general please feel welcome! email@ irenep@binarytechzone.com

Great job, I hope someone with the knowledge can jump on this because even if my phone isn't bricked (which its not) there's always a chance it could get bricked. This is a pretty good find in my opinion.
A clearer picture might be needed though if its possible.

nice find!

---

I'll be watching this as it "develops".

Hey BinaryDroid,

that's great stuff!!
Excellent finding, now we need some software
Maybe someone should check out accessing the phone with QMAT!

BTW, here's a picture stolen from the Phonewreck team.
I just inserted the testpoints you found. Hope it's O.K.!
If not tell me and i will delete the picture immediately

EDIT: Deleted attachment, because of copyright issues

Very nice work!

Cheers,
scholbert

Originally Posted by BinaryDroid

...their scattered in odd places, also have to remove the sim slot to access the last one which took forever to find.
Trackball has a hidden test point for the return clock as well, otherwise you need to solder directly to the connector on the main board.

If necessary, removing the sim slot and trackball is a small price to pay to bring one of these back from the dead.

But wow, I gotta say.... I wasnt expecting those primary points to be *SO EASY* to get at.

Yea they were easy to trace, also over this past weekend I did manage to find the mode control pins and Watchdog pin, NAND write protection enable pin..basicallly searching for anything that might be helpful. I got the wires all soldered to the board also and the phone does recognize theirs something connected to the port but the data its returning dont seem like its correct. with nothing plugged in I get "no cable connected", after plugging the cable in i'm getting "Phone did not enter debug mode, reset?" This was before I found the mode pins using only what is posted so far and on a perfectly working phone in blue light mode which I dont think matter because it does the same thing with the phone off so long as a battery is in, does not work at all with no battery. I just went out and purchased a new camera for clearer pictures so pointing out the remaining pins is easier. I believe we may see a solution!

BTW i'm using OCD commander, plan on purchasing QMAT with JTAG this week since it tailors to HTC phones, once everything is figured out i'm sure we can use whats available free with a little modding.

@Scholbert, I thought about using those picures myself but didnt want to cause any copyright issues, I am going to put up a better picture anyhow. once thats up can you please remove the image so no one complains?

OpenOCD, OpenOCD, OpenOCD.

Did I mention OpenOCD?

http://openocd.berlios.de/web/

Would be great...

Originally Posted by lbcoder

OpenOCD, OpenOCD, OpenOCD.

Did I mention OpenOCD?

http://openocd.berlios.de/web/

Would be great...

Hehe yea I didnt try that one yet since my Ubuntu install was killed by the latest update so I had to install windows first, gonna install Ubuntu sometime this week and try the tools available their.

Originally Posted by BinaryDroid

my Ubuntu install was killed by the latest update

You're not the only one 9.10 is a car crash.

off topic: 9.10 wrecked my mouse on my laptop, my wifi, my screen doesn't function properly, and sound is messed up.

On-topic: great job on this, i'm glad we might have a way to fix the bricked phones soon, my phone works fine but there is always that chance, and i have been meaning to get off the stock SPL