FORUMS
Remove All Ads from XDA

 View Poll Results: Was this thread helpful to you?

Yes, after some reading I managed to unbrick my device!
 
181 Vote(s)
34.41%
Yes, but unfortunately my brick can't be fixed
 
212 Vote(s)
40.30%
No, this is too long and I don't want to waste my time reading!
 
50 Vote(s)
9.51%
WTF is a brick?
 
83 Vote(s)
15.78%

dead hermes? corrupted radio? Post comments here

3,571 posts
Thanks Meter: 72
 
Post Reply Email Thread
This is becoming a common issue and there are a lot of people with a bricked Hermes devices, usually because of a WinXP crash, bad USB port, USB hub or pulled USB cable while flashing.

This thread is in the aim of finding a solution to all these common problems: if you are the owner of a bricked hermes, please post your comments here instead of opening a new thread.

There seems to be 3 types of bricked (or dead) hermes devices:

Type 1 bricks: Corrupted radio area: No GSM, No CID, no IMEI

Usual reason for that is flashing whent wrong when RUU was flashing the radio stack (GSM.nb). Other reason can be that you flashed radio from another device (universal unlocker run on hermes, for example).

Within the type 1 bricks, there seem to be two variants:
Type 1a:devices which can boot windows mobile but can't use the phone functions.
Type 1b: devices which can't boot windows mobile and are stuck while booting, see also type 2 bricks below.

Type 2 bricks: Stuck in boot process

Usual reason for that is that flashing went wrong when the RUU was flashing any rom part different than IPL and SPL. Symptoms can vary depending on which is the ROM part affected. The most common is OS because it is the bigger part. Radio is the second most common.

Type 2a: When the phone boots, it goes directly to bootloader mode (tri-color screen)
Type 2b: When the phone boots, it stays in subslpash screen (htc or operator logo)
Type 2c: When the phone boots, it doesn't pass the windows mobile logo


Hybrid Bricks: combinations of both type 1 and type 2 bricks

These usually have a corrupted radio and are stuck in bootloader, unfortunately these are very common too, and the most dificult to repair.
We made a wiki page long time ago whith the solutions that have worked for some people to fix bricks, unfotunately these solutions do not work for everyone, some devices are more bricked than others

First thing you have to do is visit this wiki page and follow the process explained: Common upgrade problems

If you can't repair your brick after following the process, please provide a USB monitor capture in ANSI text format (this is explained on the wiki page too) as this is the only thing that can give us a real idea on what your exact problem is. Please don't come crying and say "help me" because we can't help you if you don't provide useful information, you are in front of a big problem and you will have to loose some hours reading and experimenting before repairing your brick. If you are not willing to loose some hours reading, go and send the device to the service centre for a repair as it is the only valid solution most of the times.

Hopefully after research of everyone in this thread we can find new solutions for some of the bricks

EDIT: Please use axiom's comment below as a template for your comment and attach USB monitor capture: If your bootloader is 1.04 attach capture when trying to flash an extracted radio ROM and when trying to flash a shipped rom update. If your bootloader is 1.06 or 1.09 only attach the usb monitor capture of the shipped update.


EDIT (2007-03-22):

After more than 3 months since this thread started and more than 660 comments, we have now solutions for some bricks, so I compiled the most common on this unbricking guide:



Please spend some time reading through the wiki and thread comments before posting desesperately, otherwise you'll get no answer.
 
 
17th December 2006, 01:19 AM |#2  
Senior Member
Flag Toronto
Thanks Meter: 33
 
More
The following info may help in isolating the problem and keeping the clutter down.:

I'm including my info.

Model: O2 XDA Trion
ROM Before Flash: Dopod 1.23.707.4
Radio Before Flash: 1.16
Bootloader Before Flash: 1.04
Flash failed at: 6%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable
17th December 2006, 01:32 AM |#3  
Junior Member
Thanks Meter: 0
 
More
Hi, I've managed to brick my Hermes as well.. First time on any of my HTC Devices....

Model: Vodafone v1605
ROM Before Flash: Voda Launch ROM
Radio Before Flash: Not sure
Bootloader Before Flash: 1.04
Flash failed at: 8%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Assume Yes
No GSM Error: Not got that far
Stuck In Bootloader: Yes
Stuck On Windows Mobile Splash: Not got that far
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable
Attached Files
File Type: zip hermesupgradefailureJRF.zip - [Click for QR Code] (275.3 KB, 4867 views)
17th December 2006, 04:23 AM |#4  
pof's Avatar
OP Retired Moderator
Barcelona
Thanks Meter: 72
 
Donate to Me
More
You may already know this, as I posted it in all over the other threads of people with bricked hermes, but I'm posting again to make sure every piece of information is concentrated on this thread, and see if finally this can get us somewhere

HTC bootloader returns data encapsulated in a block between HTCS (start) and HTCE (end), before the HTCE there's always a 4-byte checksum of the data. You're getting a timeout when you query the bootloader for the device's CID, so the output you see is "F" which means failure (T means success) encapsulated in this HTCS/HTCE block, plus the checksum. The CID is read from the security area of the device, found on radio, but the wrong flash corrupted the radio area.

As the CID is not returned, the error you get when flashing the ROM is "CID Not allow (255)". The security level depends on CID, as the device has CID corrupted, the security level returned is FF (255), which means you can't bypass CID check in bootloader.

You both have bootloader 1.09 which does enforce CID checking (as opposite to bootloader 1.04 which has a known bug to circumvent this). This bootloader also only allows updates with bootloader version > 1.09 (and no such bootloader exists yet).

Bootloader 1.04 allows to flash unsigned code in radio with radio bootloader command 'rwdata', but radio bootloader is accessed through command 'rtask' and this command has been removed in following bootloader versions.

All the commands to flash code in bootloader 1.06 and above require the code to be signed (the commands are 'wdatah' and 'lnbs'), and bootloader checks the signature before the code is actually flashed on the device. So modifying a 1.04 bootloader to show itself as 1.10 is not possible because it will return a certificate error and will not be possible to flash.

Command 'lnbs' doesn't check CID, but it is only enabled if device has security level=0, and as your radio is corrupted and your seclevel=FF it will not be possible to use this command to fix it even if you had a signed bootloader, so 'wdatah' is the only command that would allow you flashing code, but 'wdatah' requires a NBH header to be sent, which contains the CID of the update and is checked against the missing CID on your device and will never match (even if you could modify the NBH header and have a valid signature after).

In conclusion, my recommendation to you is that you send the device to service centre to get it repaired and don't try to fix this by yourselves, as you will go nowhere.
17th December 2006, 09:58 AM |#5  
Junior Member
Thanks Meter: 0
 
More
Many thanks for explaining it so succinctly Pof, much appreciated. With this error I've learnt a heck of a lot more about the ROM flashing process... I guess it may be time to send the unit for repair!
17th December 2006, 03:18 PM |#6  
Member
Flag Chiba-ken
Thanks Meter: 0
 
More
This is the full report after I soft rest my phone while the USB is still connected. Would any one know what the rest of the data means? I did it in the morning then just left it for the day to see what would happen, I just got back from work.
Attached Files
File Type: zip radioerror.zip - [Click for QR Code] (10.4 KB, 1598 views)
17th December 2006, 03:43 PM |#7  
pof's Avatar
OP Retired Moderator
Barcelona
Thanks Meter: 72
 
Donate to Me
More
onj: can you use axiom comment as a template to provide information?

radioerror.txt: I see you're using the Himalaya upgrade utility there... rbmc reads data from memory, but I don't know what is at 0x70010000. It would be better if you can provide a log of hermes RUU.
17th December 2006, 05:06 PM |#8  
Member
Flag Chiba-ken
Thanks Meter: 0
 
More
Model: x01ht
ROM Before Flash: i-mate
Radio Before Flash: 1.07.03.10
Bootloader Before Flash: 1.04
Flash failed at: 0%
Flashing ROM: JASJAR_WWE_19096_19505_11300_AKU_3_2_ship
Flashing Radio: 1.13.00
Bootloader After Failure: 1.04
CID Before Failure Super CID: success
CID Corrupt: don't know
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: stalls
Current Device Status: unusable

I will upload the usbmonitor with using
RUU_HERMES_HTC_WWE_1[1].35.255.2_1.35.255.102_1.08.00.10_SHIP

the upgrading dies after info 3
computer says ERROR [222] Device not responding

that's with all the RUU's that I use and even the full upgrade ROM
Attached Files
File Type: txt radioerror2.txt - [Click for QR Code] (12.8 KB, 781 views)
17th December 2006, 10:13 PM |#9  
Junior Member
Thanks Meter: 0
 
More
Hi, I have a herm 200 an i have a Type 2a bricks (it goes directly to bootloader mode tri-color screen).
But i upgrade with the rom (ME_DT_WWE_1182553_106_10303_Ship) and all run good. but 3 moths later i have the type 2a bricks.
I try with that solution (http://wiki.xda-developers.com/index...pgradeProblems) and others and NOthing.
In screnn say herm200 ILP-1.00 and Her200 SPL-1.04.


ps: sorry my english is very bad.
17th December 2006, 10:23 PM |#10  
pof's Avatar
OP Retired Moderator
Barcelona
Thanks Meter: 72
 
Donate to Me
More
@onj: Oh ****! You where trying to flash an HTC Universal ROM in your HTC Hermes!! These are different devices, most probably that's what screwed it.
From your attached file I see bootloader does not answer to any command.

@landtd5: please use axiom comment as a template, and attach USB monitor capture when tryng to flash a shipped rom and a radio rom.
18th December 2006, 02:21 AM |#11  
Member
Flag Chiba-ken
Thanks Meter: 0
 
More
Yup, I upgraded with the wrong Rom. After going through the forum for the past 2 weeks I realized what I did. I guess it's time for me to send it to the shop
thanks for you help pof
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes