Please remember to add a category to the bottom of each page that you create.
See categories help for further details, but most will probably be [[Category:HTC ModelName]].


From XDA-Developers
Jump to: navigation, search


This**tool can hard reset your device. Make sure you back up all data before you attempt to use it!

News: HaRET seems stable now (with the T-Mobile 1.60.00WWE ROM version) after changing some of the physical memory mapping code around. But it will crash on exit with a hard reset (possible solution of this problem: to exit from linux booter without a hard-reset you need to press four buttons: power button+reset button+recorder button+camera button. In menu which will appear after that select (with camera and recorder buttons) KITTL=NO FORMAT STORAGE=NO CLEAN REGISTRY HIVE=NO and than press action button. After this manipulations Windows will starts). A new version was uploaded.patches will follow later.

The Handheld Reverse Engineering Tool was written to discover internals of XScale devices. Specifically the Dell Axim. However, it will also be very useful for the Himalaya. Details such as documentation and a mailinglist can be found at the HTC Linux project

Description of HARet is in CVS

More info at

Linux Kernel

HaRET can also be used to boot a linux kernel. For this it just needs a special startup.txt. An example of the contents of such a file is given below. It is important that the path to the initrd file is the absolute path. The machine type is already correctly specified for the Himalaya device:

set KERNEL zImage set MTYPE 448 set INITRD "\Storage Card\initrd26.gz" set CMDLINE "root=/dev/ram0 init=/linuxrc ramdisk_size=14336 keepinitrd" bootlinux

The current version lives in CVS at HandHelds:

This version was compiled with EVC++ 4.2 with the following project files (place them in the root of haret):

A modification was added to HaRET that will open a serial port (COM1:) and use that for output when the bootlinux command is given. This allowed debugging of the boot process. At some point these mods will appear in our CVS ( haret-0.3.6-com1.diff| ), but for the moment a new binary copy is here HaRETDownloadSite: And this is the output from the first session that was achieved with SynCE:

SynCE Output

telnet 9999
Connected to
Escape character is '^]'.
Welcome, this is HaRET running on WindowsCE v4.20
CPU is Intel XScale ARM arch 5TE revision 3 product 16 stepping 6
Running in system mode; minimal virtual address: 00010000, maximal: 7fffffff
Enter 'HELP' for a short command summary.

HaRET(1)# help

----=====****** A summary of HaRET commands: ******=====----

Notations used below:

 [A|B] denotes either A or B
 <ABC> denotes a mandatory argument
 Any command name can be shortened to minimal unambiguous length,
 e.g. you can use 'p' for 'priint' but not 'vd' for 'vdump'
 Start booting linux kernel. See HELP VARS for variables affecting boot.
DUMP <hardware>[(args...)] [filename]
 Dump the state of given hardware to given file (or to connection if
 no filename specified). Use HELP DUMP to see available dumpers.
 Display a description of either commands, variables or dumpers.
MESSAGE <strformat> [<numarg1> [<numarg2> ... [<numarg4>]]]
 Display a message (if run from a script, displays a message box).
 <strformat> is a standard C format string (like in printf).
 Note that to type a string you will have to use '%hs'.
BWMEM <size> <rd|wr|rdwr|cp|fwr|frd|fcp|bzero|bcopy>
 Perform a memory benchmark similar to lmbench, but the numbers should
 not be directly compared to those of lmbench.
PRINT <strformat> [<numarg1> [<numarg2> ... [<numarg4>]]]
 Same as MESSAGE except that it outputs the text without decorations
 directly to the network pipe.
 Quit the remote session.
SET <variable> <value>
 Assign a value to a variable. Use HELP VARS for a list of variables.
SLEEP <milliseconds>
 Sleep for given amount of milliseconds.
[V|P]DUMP <filename> <addr> <size>
  Dump an area of memory in hexadecimal/char format from given [V]irtual
  or [P]hysical address to specified file.
[V|P]D <addr> <size>
  Same as [V|P]DUMP but outputs to screen rather than to file.
[V|P]F[B|H|W] <addr> <count> <value>
  Fill memory at given [V]irtual or [P]hysical address with a value.
  The [B]yte/[H]alfword/[W]ord suffixes selects the size of
  <value> and in which units the <count> is measured.
[V|P]WF <filename> <addr> <size>
  Write a portion of [V]irtual or [P]hysical memory to given file.
WGPIO <seconds>
  Watch GPIO pins for given period of time and report changes.
Error: line 2: Expected <seconds>
HaRET(3)# WGPIO 10
GPLR[7] changed to 0
GPLR[7] changed to 1
GPLR[8] changed to 1
GPLR[8] changed to 0

Working With HaRET

I will describe here, how you can analyse the bits of the GPIO-Lines of a Port with help of HaRET:
Lets find out your [[HimalayaBoardIDs]]:
Conneted to Haret via TCP/IP connection, we got the HaRET-Prompt at PC side to insert some commands
We order 4 Bytes at Address 0xD800000 Plus Offset of Port C (GPIOC) Status register which makes 0xD800230.
Command therefore is "PD 0xD800230 4" ;
A result would look like (for example):  3e 64 fe 64   where the lowest bytes are at the right side.
Now, we translate the last 2 bytes from Hex (fe64) to Binary (1111111001100100).
Now, looking at bits 5, 4 and 3 (remember, binary bits are arranged high to low: 9876543210)
The result from these bits is (100), which is (4) in decimal.
(from right to left: 0 times a 1; 0 times a 2; 1 times a 4), which is this Board-ID of [[HimalayaBoardIDs]].

See also

External links