This**tool can hard reset your device. Make sure you back up all data before you attempt to use it!
News: HaRET seems stable now (with the T-Mobile 1.60.00WWE ROM version) after changing some of the physical memory mapping code around. But it will crash on exit with a hard reset (possible solution of this problem: to exit from linux booter without a hard-reset you need to press four buttons: power button+reset button+recorder button+camera button. In menu which will appear after that select (with camera and recorder buttons) KITTL=NO FORMAT STORAGE=NO CLEAN REGISTRY HIVE=NO and than press action button. After this manipulations Windows will starts). A new version was uploaded.patches will follow later.
The Handheld Reverse Engineering Tool was written to discover internals of XScale devices. Specifically the Dell Axim. However, it will also be very useful for the Himalaya. Details such as documentation and a mailinglist can be found at the HTC Linux project
Description of HARet is in CVS http://handhelds.org/cgi-bin/cvsweb.cgi/haret/docs/haret.html?rev=1.5&content-type=text/x-cvsweb-markup
More info at http://cs.ozerki.net/zap/pub/axim-x5/haret.html
HaRET can also be used to boot a linux kernel. For this it just needs a special
startup.txt. An example of the contents of such a file is given below. It is important that the path to the initrd file is the absolute path. The machine type is already correctly specified for the Himalaya device:
set KERNEL zImage
set MTYPE 448
set INITRD "\Storage Card\initrd26.gz"
set CMDLINE "root=/dev/ram0 init=/linuxrc ramdisk_size=14336 keepinitrd"
The current version lives in CVS at HandHelds: http://cvs.handhelds.org/cgi-bin/viewcvs.cgi/haret/
This version was compiled with EVC++ 4.2 with the following project files (place them in the root of haret):
A modification was added to HaRET that will open a serial port (COM1:) and use that for output when the bootlinux command is given. This allowed debugging of the boot process. At some point these mods will appear in our CVS ( haret-0.3.6-com1.diff| ), but for the moment a new binary copy is here HaRETDownloadSite: And this is the output from the first session that was achieved with SynCE:
telnet 192.168.131.201 9999 Trying 192.168.131.201... Connected to 192.168.131.201. Escape character is '^]'. Welcome, this is HaRET running on WindowsCE v4.20 CPU is Intel XScale ARM arch 5TE revision 3 product 16 stepping 6 Running in system mode; minimal virtual address: 00010000, maximal: 7fffffff Enter 'HELP' for a short command summary. HaRET(1)# help ----=====****** A summary of HaRET commands: ******=====---- Notations used below: [A|B] denotes either A or B <ABC> denotes a mandatory argument Any command name can be shortened to minimal unambiguous length, e.g. you can use 'p' for 'priint' but not 'vd' for 'vdump' BOOTLINUX Start booting linux kernel. See HELP VARS for variables affecting boot. DUMP <hardware>[(args...)] [filename] Dump the state of given hardware to given file (or to connection if no filename specified). Use HELP DUMP to see available dumpers. HELP [VARS|DUMP] Display a description of either commands, variables or dumpers. MESSAGE <strformat> [<numarg1> [<numarg2> ... [<numarg4>]]] Display a message (if run from a script, displays a message box). <strformat> is a standard C format string (like in printf). Note that to type a string you will have to use '%hs'. BWMEM <size> <rd|wr|rdwr|cp|fwr|frd|fcp|bzero|bcopy> Perform a memory benchmark similar to lmbench, but the numbers should not be directly compared to those of lmbench. PRINT <strformat> [<numarg1> [<numarg2> ... [<numarg4>]]] Same as MESSAGE except that it outputs the text without decorations directly to the network pipe. QUIT Quit the remote session. SET <variable> <value> Assign a value to a variable. Use HELP VARS for a list of variables. SLEEP <milliseconds> Sleep for given amount of milliseconds. [V|P]DUMP <filename> <addr> <size> Dump an area of memory in hexadecimal/char format from given [V]irtual or [P]hysical address to specified file. [V|P]D <addr> <size> Same as [V|P]DUMP but outputs to screen rather than to file. [V|P]F[B|H|W] <addr> <count> <value> Fill memory at given [V]irtual or [P]hysical address with a value. The [B]yte/[H]alfword/[W]ord suffixes selects the size of <value> and in which units the <count> is measured. [V|P]WF <filename> <addr> <size> Write a portion of [V]irtual or [P]hysical memory to given file. WGPIO <seconds> Watch GPIO pins for given period of time and report changes. HaRET(2)# WGPIO Error: line 2: Expected <seconds> HaRET(3)# WGPIO 10 GPLR changed to 0 GPLR changed to 1 GPLR changed to 1 GPLR changed to 0 HaRET(4)#
Working With HaRET
I will describe here, how you can analyse the bits of the GPIO-Lines of a Port with help of HaRET: Lets find out your [[HimalayaBoardIDs]]: Conneted to Haret via TCP/IP connection, we got the HaRET-Prompt at PC side to insert some commands We order 4 Bytes at Address 0xD800000 Plus Offset of Port C (GPIOC) Status register which makes 0xD800230. Command therefore is "PD 0xD800230 4" ; A result would look like (for example): 3e 64 fe 64 where the lowest bytes are at the right side. Now, we translate the last 2 bytes from Hex (fe64) to Binary (1111111001100100). Now, looking at bits 5, 4 and 3 (remember, binary bits are arranged high to low: 9876543210) The result from these bits is (100), which is (4) in decimal. (from right to left: 0 times a 1; 0 times a 2; 1 times a 4), which is this Board-ID of [[HimalayaBoardIDs]].