dead hermes? corrupted radio? Post comments here

This is becoming a common issue and there are a lot of people with a bricked Hermes devices, usually because of a WinXP crash, bad USB port, USB hub or pulled USB cable while flashing.

This thread is in the aim of finding a solution to all these common problems: if you are the owner of a bricked hermes, please post your comments here instead of opening a new thread.

There seems to be 3 types of bricked (or dead) hermes devices:


We made a wiki page long time ago whith the solutions that have worked for some people to fix bricks, unfotunately these solutions do not work for everyone, some devices are more bricked than others

First thing you have to do is visit this wiki page and follow the process explained: Common upgrade problems

If you can't repair your brick after following the process, please provide a USB monitor capture in ANSI text format (this is explained on the wiki page too) as this is the only thing that can give us a real idea on what your exact problem is. Please don't come crying and say "help me" because we can't help you if you don't provide useful information, you are in front of a big problem and you will have to loose some hours reading and experimenting before repairing your brick. If you are not willing to loose some hours reading, go and send the device to the service centre for a repair as it is the only valid solution most of the times.

Hopefully after research of everyone in this thread we can find new solutions for some of the bricks

EDIT: Please use axiom's comment below as a template for your comment and attach USB monitor capture: If your bootloader is 1.04 attach capture when trying to flash an extracted radio ROM and when trying to flash a shipped rom update. If your bootloader is 1.06 or 1.09 only attach the usb monitor capture of the shipped update.


EDIT (2007-03-22):

After more than 3 months since this thread started and more than 660 comments, we have now solutions for some bricks, so I compiled the most common on this unbricking guide:

How to unbrick your bricked hermes​

Please spend some time reading through the wiki and thread comments before posting desesperately, otherwise you'll get no answer.​

You may already know this, as I posted it in all over the other threads of people with bricked hermes, but I'm posting again to make sure every piece of information is concentrated on this thread, and see if finally this can get us somewhere

HTC bootloader returns data encapsulated in a block between HTCS (start) and HTCE (end), before the HTCE there's always a 4-byte checksum of the data. You're getting a timeout when you query the bootloader for the device's CID, so the output you see is "F" which means failure (T means success) encapsulated in this HTCS/HTCE block, plus the checksum. The CID is read from the security area of the device, found on radio, but the wrong flash corrupted the radio area.

As the CID is not returned, the error you get when flashing the ROM is "CID Not allow (255)". The security level depends on CID, as the device has CID corrupted, the security level returned is FF (255), which means you can't bypass CID check in bootloader.

You both have bootloader 1.09 which does enforce CID checking (as opposite to bootloader 1.04 which has a known bug to circumvent this). This bootloader also only allows updates with bootloader version > 1.09 (and no such bootloader exists yet).

Bootloader 1.04 allows to flash unsigned code in radio with radio bootloader command 'rwdata', but radio bootloader is accessed through command 'rtask' and this command has been removed in following bootloader versions.

All the commands to flash code in bootloader 1.06 and above require the code to be signed (the commands are 'wdatah' and 'lnbs'), and bootloader checks the signature before the code is actually flashed on the device. So modifying a 1.04 bootloader to show itself as 1.10 is not possible because it will return a certificate error and will not be possible to flash.

Command 'lnbs' doesn't check CID, but it is only enabled if device has security level=0, and as your radio is corrupted and your seclevel=FF it will not be possible to use this command to fix it even if you had a signed bootloader, so 'wdatah' is the only command that would allow you flashing code, but 'wdatah' requires a NBH header to be sent, which contains the CID of the update and is checked against the missing CID on your device and will never match (even if you could modify the NBH header and have a valid signature after).

In conclusion, my recommendation to you is that you send the device to service centre to get it repaired and don't try to fix this by yourselves, as you will go nowhere.

onj: can you use axiom comment as a template to provide information?

radioerror.txt: I see you're using the Himalaya upgrade utility there... rbmc reads data from memory, but I don't know what is at 0x70010000. It would be better if you can provide a log of hermes RUU.

@onj: Oh ****! You where trying to flash an HTC Universal ROM in your HTC Hermes!! These are different devices, most probably that's what screwed it.
From your attached file I see bootloader does not answer to any command.

@landtd5: please use axiom comment as a template, and attach USB monitor capture when tryng to flash a shipped rom and a radio rom.

jash431 said:

USB monitore is attached here .

Click to expand...

Click to collapse

This is not useful: You saved LGS file, please follow instructions in wiki, you need to EXPORT as ANSI TEXT file. Also please use the 1st comment as a template to provide useful information.

@jash431: doesn't return anything... when you connect to bootloader on mtty, do you see the USB prompt? does it answer any commands?

jash431: hybrid brick with corrupted radio and bootloader 1.09. Send it to repair centre.

then keep it until something is found to fix this, creative solutions to the problem will come to your mind after looking everyday at a $500 brick.