Magician/BootloaderCommands

---

To get in Bootloader Mode press and hold
(Camera button)+(Power/Suspend button)
and use stylus pen to reset device (do not release other buttons until you see number 1.0x on bottom on the screen)!

Known Versions of Bootloader are v1.00 and v1.02 (differences and upgrade method still unknown)

---

Note: All commands are case sensitive

Contents 1 1. set 2 2. info 3 3. task 4 4. shmsg 5 5. lnb 6 6. password

1. set

Usage: set [Type [Value]]

    Set control flags.
    Type(hex) : Control function types.
    Value(hex) : Setting values for types.
    If value is not given, default is 0.

    Type 0(Echo on/off): 1(on) and 0(off).
    Type 1(Operation mode): 1(auto) and 0(user).
    Type 2(Back color on/off): 1(on) and 0(off).
    Type 3(Inverse on/off): 1(on) and 0(off).
    Type 4(Front color value): 16 bits data
    Type 5(Background color value): 16 bits data
    Type 6(Set color of screen): Fill color to whole screen one time.
    Type 8(COMM queue flag): 0(TX_RX disable),1(RX enable),2(TX enable) and 3(TX_RX enable).

    Current flag settings:
    Type 0(Echo flag): cEchoFlag=(0x1).
    Type 1(Operation mode flag): cOpModeFlag=(0x0).
    Type 2(Back color flag): cBackColorShowFlag=(0x1).
    Type 3(Inverse flag): cShowInverseFlag=(0x0).
    Type 4(Front color): g_wFColor=(0x0).
    Type 5(Background color): g_wBColor=(0xFFFF).
    Type 6(Set color of screen): None.
    Type 8(COMM queue flag): g_cCommQueueFlag=(0x0).

2. info

Usage: info [Type [Value]]

     Type(hex) 0: Displays the Model
     Type(hex) 1: Displays the Bootloader Version
     Type(hex) 2: Get info for RUU software autentify for the PPC(16 bytes) and [value] (hex) is ignored.
     Type(hex) 3: Get bynary information for RUU sofware, about the ROM and versions of this parts (This action could hang the console)(2,10Kbytes)and [value](hex) is ignored.
     Type(hex) 4: Returns "HTCS" + CID + (4-byte checksum) + "HTCE"
     Type(hex) 6: Get the information, for password crypt. (16 bytes) and [value] (hex) is ignored.

3. task

Usage: task [Type [Value [Value1]]]

     Type(hex) 7: Do flash ROM lock/unlock and [value]: 1(lock) and 0(unlock)
     function not confirmed, for me it only returns something like:
        "USB>task 7
        Flash ID = 89,8810
        INTEL StrataFlash 256 Mbit Wireless MEMORY (L30/L18 Bottom type) found"
     Type(hex) 32: Returns "Level = FF" if your device is CID locked, or "Level = 0" if your device is SuperCID
     Type(hex) 3c: Sends "+SA_USB_Init" - Used for eMapi

4. shmsg

Usage: shmsg [Row [Col ["String"]]]

     Show texts on display.
     Row(hex) : 0 - 17(11).
     Col(hex) : 0 - 12(C).
     Text String : The string which will be show on display.

5. lnb

Usage: lnb nb-file [StartAddr [Length [SkipOffset ["cp"]]]]

     Download nb file to ROM.
     StartAddr : Start address for downloading(default=80000000).
     Length : Length for downloading(default=FFFFFFFF).
     SkipOffset : SkipOffset for downloading(default=00040000).
     cp : Compare image with file data only.

6. password

Usage:  password [string]

    Enter the password string to enable full help and command functions (wdata, erase and rbmc and more).
    For Magician password is BOOTLOADER
    Oh and i found another password 0000000000000000 (16 zeroes) wich allow even more commands
    If entered wrong it displays [HTCSInvalid password.R¿ËPHTCEUSB>]
    If entered correct it shows  [HTCSPass.<Y#HTCEUSB>]

there are more commands, feel free to add :-)