Please remember to add a category to the bottom of each page that you create.
See categories help for further details, but most will probably be [[Category:HTC ModelName]].
Universal Technical
From XDA-Developers
Contents |
bootup key combinations
- bootloader : light* power + reset
- bootmenu : camera* reset
- coldboot : power* reset
the bootloader
- password: 'UNIVERSAL'
- extended rom password: SiRevInu
- use this with unlockextrom
- commands:
- eb eh ew mb mh mw string info password l lnb d2s set task shmsg rbmc erase wdata checksum prouter dbgtool emapi lw rtask rroute keypad touch bttask btrouter wifitest
- rtask 7 - talk to gsm at cmd interface
- rtask A - talk to gsm bootloader
bootloader dynamic passwords
For information on the dynamically generated passwords the official RUU utility uses, read this forum thread [1]
set command
the set command takes two arguments, the property and the new value, both are hexadecimal numbers. Possible properties are: (flags are either 1 or 0, values are numbers)
| property | internal name | internal description | description |
|---|---|---|---|
| 0 | cEchoFlag | Echo flag | Wether to echo all input. 1 to show what you type, 0 to stay quiet |
| 1 | cOpModeFlag | Operation mode flag | Set to 0 for friendlier return values, or 1 for easier to parse return values (0 for users, 1 for programs) |
| 2 | cBackColorShowFlag | Back color flag | Wether to draw a background with text. |
| 3 | cShowInverseFlag | Inverse flag | Wether to inverse fore and background colors (1 yes, 0 no)
|
| 4 | g_wFColor | Front color value | Foreground color, 16-bit number, 5-6-5 bit compression |
| 5 | g_wBColor | Background color value | Background color, see Foreground color |
| 6 | Unknown | Unknown | Sets complete screen to a specific color (see Foreground color) |
| 7 | Unknown | Unknown | Unknown |
| 8 | g_cCommQueueFlag | COMM queue flag | Unknown |
| 9 | Unknown | Unknown | Unknown |
| A | Unknown | Unknown | Unknown |
| B | Unknown | Unknown | Unknown |
| C | Unknown | Unknown | Unknown |
| D | Unknown | Unknown | Unknown |
| E | Unknown | Unknown | Unknown |
| F | Unknown | Unknown | Unknown |
| 10 | Unknown | Unknown | Unknown |
| 11 | Unknown | Unknown | Unknown |
| 12 | Unknown | Unknown | Unknown |
| 13 | Unknown | Unknown | Unknown |
| 14 | Unknown | Unknown | What to do after a reset. Set to 1 to go to bootloader after reset, set to 0 to start OS |
info command
The info command returns specific info from the device. it takes one hexadecimal argument. The possibilities that are known are listed below
| argument | example value | description |
|---|---|---|
| 0 | UNIVERSAL | Probably either the device type, or the bootloader password |
| 1 | 1.00 | Bootloader version |
| 2 | (too long) | SD Card information* HTCS + (some kind of CRC) + HTCE |
| 3 | (too long) | HTCS* All sorts of device information + CRC + HTCE |
| 4 | HTCSQTEK_001(crc)HTCE | HTCS* CID-lock + crc + HTCE |
| 5 | (nothing) | Unknown |
| 6 | HTCST (crc)HTCE | Unknown (same as radio rregion command?) |
| 7 | (too long) | Information about the bootloader |
task command
The task command takes one argument, and performs that 'task'.
| argument | action taken |
|---|---|
| 0 | Exits bootloader and turns screen completely black. |
| 8 | Resets |
| 1E | switches to eMapiMain+++ mode :S |
| 28 | Gives info on FAT partitions and does a hard-reset |
| 28 55aa | Restores DOC to its original layout |
| 32 | Returns Radio SecLevel |
| 37 | KITL output - requires task 32 first and for Level = 0 |
| 3C | sends "+SA_USB_Init" and seems to reset the USB connection |
rtask command
rtask seems to accept either just a type, or a value. (two hex arguments)
| type | possible values | description |
|---|---|---|
| 0 | ? | Resets radio |
| 1 | ? | tells you to use 3 or 4 instead |
| 2 | ? | Turn radio off |
| 3 | ? | Runs radio image |
| 4 | ? | Runs radio bootloader |
| 7 | ? | Allows you to debug AT commands. |
| a | ? | Talk to GSM bootloader. |
| b | ? | Radio AT Command Debug. Talk to GSM AT cmd interface. |
| ? | ? | (more follow, but not all documented) |
backing up the device with 'd2s'
Device needs to be SuperCID for this command to work, if it is CID locked you'll get an error from bootloader.
| d2s 60000000 00800000 | 8M | radio rom (First 8M, where the code is) |
| d2s 60000000 01000000 | 16M | Full radio NAND chip backup (filled with FF) |
| d2s 70000000 00100000 | 1M | SPL |
| d2s 70100000 04000000 | 64.00 M | OS TrueFFS |
| d2s 74100000 00a00000 | 10.00 M | extrom DSK2:PART00 fatfsd |
| d2s 74b00000 02c40000 | 44.25 M | root filesystem TRUEFFS |
the radio bootloader
- commands:
- rchecksum rregion rinfo rversion rpass rerase rwdata rrbmc rrom rwfactory
memory map
sorted by virtual address
| virtual nocached | virtual cached | physical | description |
|---|---|---|---|
| 0x88000000-88100000 | 0xa8000000-a8100000 | 0x44000000-44100000 | PXA270 LCD |
| 0x88200000-88300000 | 0xa8200000-a8300000 | 0x48000000-48100000 | PXA270 memory controller |
| 0x88300000-88400000 | 0xa8300000-a8400000 | 0x4c000000-4c100000 | PXA270 USB host |
| 0x88400000-88500000 | 0xa8400000-a8500000 | 0x58000000-58100000 | PXA270 internal memory control |
| 0x88600000-88700000 | 0xa8600000-a8700000 | 0x50000000-50100000 | PXA270 CIF capture interface |
| 0x88700000-88800000 | 0xa8700000-a8800000 | 0xa3f00000-a4000000 | top 1MB SDRAM (pxafb) |
| 0x88800000-88900000 | 0xa8800000-a8900000 | 0x5c000000-5c100000 | PXA270 Internal memory (256K) |
| 0x88f00000-89000000 | 0xa8f00000-a9000000 | 0xe0000000-e0100000 | |
| 0x89000000-89100000 | 0xa9000000-a9100000 | 0x16000000-16100000 | |
| 0x89100000-89200000 | 0xa9100000-a9200000 | 0x00000000-00100000 | IPL |
| 0x89200000-89300000 | 0xa9200000-a9300000 | 0x10000000-10100000 | |
| 0x89300000-89400000 | 0xa9300000-a9400000 | 0x0c000000-0c100000 | |
| 0x8a100000-8a300000 | 0xaa100000-aa300000 | 0x15000000-15200000 | |
| 0x8a300000-8a400000 | 0xaa300000-aa400000 | 0x14000000-14100000 | |
| 0x8b000000-8b100000 | 0xab000000-ab100000 | 0x08000000-08100000 | ? |
| 0x8b100000-8b200000 | 0xab100000-ab200000 | 0x0a000000-0a100000 | |
| 0x8c000000-8c100000 | 0xac000000-ac100000 | 0x20000000-20100000 | PCMCIA0 IO |
| 0x8c100000-8c200000 | 0xac100000-ac200000 | 0x28000000-28100000 | PCMCIA0 attrib |
| 0x8c200000-8d000000 | 0xac200000-ad000000 | 0x2c000000-2ce00000 | PCMCIA0 memory |
| 0x8d000000-8d100000 | 0xad000000-ad100000 | 0x30000000-30100000 | PCMCIA1 IO |
| 0x8d100000-8d200000 | 0xad100000-ad200000 | 0x38000000-38100000 | PCMCIA1 attrib |
| 0x8d200000-8e000000 | 0xad200000-ae000000 | 0x3c000000-3ce00000 | PCMCIA1 memory |
| 0x8e000000-90000000 | 0xae000000-b0000000 | 0x40000000-42000000 | PXA270 periferals |
| 0x90000000-93f00000 | 0xb0000000-b3f00000 | 0xa0000000-a3f00000 | 63MB SDRAM |
| 0x93f00000-97f00000 | 0xb3f00000-b7f00000 | 0xa4000000-a8000000 | (64MB SDRAM) |
| 0xf0000000-f0100000 | 0x00000000-00100000 | IPL |
sorted by physical address
| p00000000-00100000 | v89100000-89200000 | va9100000-a9200000 | IPL |
| p00000000-00100000 | vf0000000-f0100000 | ||
| p08000000-08100000 | v8b000000-8b100000 | vab000000-ab100000 | |
| p0a000000-0a100000 | v8b100000-8b200000 | vab100000-ab200000 | |
| p0c000000-0c100000 | v89300000-89400000 | va9300000-a9400000 | |
| p10000000-10100000 | v89200000-89300000 | va9200000-a9300000 | |
| p14000000-14100000 | v8a300000-8a400000 | vaa300000-aa400000 | |
| p15000000-15200000 | v8a100000-8a300000 | vaa100000-aa300000 | |
| p16000000-16100000 | v89000000-89100000 | va9000000-a9100000 | |
| p20000000-20100000 | v8c000000-8c100000 | vac000000-ac100000 | |
| p28000000-28100000 | v8c100000-8c200000 | vac100000-ac200000 | |
| p2c000000-2ce00000 | v8c200000-8d000000 | vac200000-ad000000 | |
| p30000000-30100000 | v8d000000-8d100000 | vad000000-ad100000 | |
| p38000000-38100000 | v8d100000-8d200000 | vad100000-ad200000 | |
| p3c000000-3ce00000 | v8d200000-8e000000 | vad200000-ae000000 | |
| p40000000-42000000 | v8e000000-90000000 | vae000000-b0000000 | |
| p44000000-44100000 | v88000000-88100000 | va8000000-a8100000 | |
| p48000000-48100000 | v88200000-88300000 | va8200000-a8300000 | |
| p4c000000-4c100000 | v88300000-88400000 | va8300000-a8400000 | |
| p50000000-50100000 | v88600000-88700000 | va8600000-a8700000 | |
| p58000000-58100000 | v88400000-88500000 | va8400000-a8500000 | |
| p5c000000-5c100000 | v88800000-88900000 | va8800000-a8900000 | |
| pa0000000-a3f00000 | v90000000-93f00000 | vb0000000-b3f00000 | |
| pa3f00000-a4000000 | v88700000-88800000 | va8700000-a8800000 | |
| pa4000000-a8000000 | v93f00000-97f00000 | vb3f00000-b7f00000 | |
| pe0000000-e0100000 | v88f00000-89000000 | va8f00000-a9000000 |
rom layout
the 64M partition starting at 70100000 in the disk on chip, contains the main os.
| 00000000 | 00000400 | MSFLSH50 rom header |
| 00000400 | 001d2100 | first XIP block |
| 001d2500 | 0012df00 | empty - filled with 0x00 |
| 00300400 | 0000fc00 | empty - filled with 0xff |
| 00310000 | 002d0000 | second XIP block |
| 005e0000 | 02000000 | MSFLSH rom filesystem |
| 025e0000 | 01920000 | empty - filled with 0xff |
| 03f00000 | 00100000 | Splash Screen (First 32 bit header?) |
versions
| IPL | 0.36 |
| OS | 0.82.10 WWE |
| radio | 0.80.00 |
| radioboot | 1.0106 |
| SPL | 0.51 1.40e |
Audio Codec EK4641 datasheet: http://www.asahi-kasei.co.jp/akm/en/product/ak4641/ek4641.pdf
Maxim Max2820 datasheet: http://pdfserv.maxim-ic.com/en/ds/MAX2820-MAX2821A.pdf also present in the ipaq 4100 - http://www.handhelds.org/moin/moin.cgi/HpIpaqH4100Hardware
Xilinx 2C128s: also present in the Dell Axim X50s: http://www.handhelds.org/moin/moin.cgi/DellAximX50Hardware
Apparently, the similar hardware is used by Motorola A780 - see http://sourceforge.net/projects/e680. hurrah!
