Bring your bricked TyTN back to live - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

This is how I brought my TyTN and one from a colleague back to live. We both we’re victim of a defective radio-ROM and never got past the splashscreen. Both were original HTC TyTNs, but any Hermes with any CID should work.
If you try to do this on your own Hermes, please follow these directions to the letter as connection-problems may arise otherwise.
- Take the battery out of your TyTN and leave it out several minutes
- Disable USB-connection in Active-Sync
- Reboot your Computer
- Replace the battery and put your TyTN in the bootloader
- Try to load the ROM found here:
ftp://xda:[email protected]/RUU120_172125_Qtek_WWE_R11400_Shipping.exe
- Keep trying till you get just past the erasing part, then you will get an error-message and are asked to reset your device with the stylus
- Reset your phone and put it back in the bootloader mode
- Install any Hermes ROM you like, no matter what CID if you have bootloader 1.04

---

Great discovery!
It may also work for people who cannot change they rom because of 1.06 bootloader I guess? If my tytn wasnt working so well at the moment with my cingular rom, I would give a try.
Can you please give us your bootloader version, the result of the "info 2" (CID) cmd in bootloader and the result of "info 8"; I am just curious.
I also would be interested in feedbacks from people downgrading from 1.06 bootloader with this trick

---

fun_key said:
Can you please give us your bootloader version, the result of the "info 2" (CID) cmd in bootloader and the result of "info 8"; I am just curious.
Click to expand...
Click to collapse
Both TyTN's had bootloader 1.04. Had 1.06 on mine one time but managed to downgrade with original HTC-ROM. Don't think downgrading from bootloader 1.06 will work with this Himalaya-method , but you're results may vary. Then again, I didn’t check whether or not I got another bootloader after the erase by the Himalaya ROM
Info 2 gave QTEK_001 and info 8:
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Block 0x3A8(936) is BAD block !!!
Block 0x3A9(937) is BAD block !!!
Block 0x3AA(938) is BAD block !!!
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x19800
Partition[3], type=0x4, start=0x1C800, total=0x1E000
CE Total Length(with sector info) = 0x39E4000
CE CheckSum Length(without sector info) = 0x3900000

---

mmm this is very interesting...
Can someone do a full usb dump using HHD USB monitor when flashing the Himalaya ROM?
1) Disable activesync on your computer by right click on activesync icon -> connection settings -> uncheck "allow USB connections".
2) Put your device in BootLoader mode
3) Connect device to computer using USB cable.
4) Start USBMonitor.
5) File -> New session -> USB Monitor -> Select USB device where your phone is connected -> Check "request view" -> Finish
6) In the upper part there are two tabs: basic and complete. Click on "Complete".
7) start the Himalaya upgrade, you should see all the USB traffic output on USB monitor window.
8 ) when finished, click on Edit -> Export and Save as type "ANSI Text files".
9) Save the file and zip it.
10) attach it on a comment here or put it on the ftp if it's too big.
If we have the full USB dump, then we might be able to write a tool to fix the bricked units.

---

Thanks for all thos infos.
You may be right, in fact I don't think that himalaya flash the bootloader. I had a false good idea. It may in fact be very very dangerous; if the himalaya clean the phone without changing the bootloader it would be impossible to update the empty rom without a rom matching the CID !!

---

The only part that can be afected is radio, because radio bootloader commadns are the same in the hermes and in the Himalaya.
For other parts (extom, os, ipl, spl, splash1, splash2....) himalaya bootloader uses 'wdata' command to flash them which is not available on the hermes, the hermes uses wdatah instead. So it should be "safe" for these parts to use the himalaya upgrade utility.
I don't know if the cid is checked before the radio upgrade or not, that's why i want a usb dump of the process. Probably the easyest would be to take only Radio_.nbf from the Himalaya rom upgrade and upgrade it on a Hermes using MaUpgrade_NoID.exe...

---

The radio-part was defective in my TytN, and no flashing method worked. USB and SD-card flashing both with matching CID didn't start. Never got past the Windows Bootscreen.

---

it does not work on 1.06 as i don't have an original rom, so i have to wait.

---

tried so many times
I was going through your method, I tried maybe 10 times already but this Radio actually makes my boot screen turn white and with USBmonitor, it does go pretty far. Farther than the other radio's I have tried. I have Spl-1.04 but it doesn't seem to work. Is there anything that I'm missing?

---

This is what I have, but I have no idea what to do next...

---

onj said:
This is what I have, but I have no idea what to do next...
Click to expand...
Click to collapse
@onj: hangs on rbmc... you need to do the erase commands manually from mtty. Look at the wiki problems page.

---

pof: I did that prior to updating, I think I did that 10 times already. everything comes back "T"
that's with MTTY.exe
sorry for the double post, thought that this thread was dead.
one thing is that when I reboot my htc the usbmonitor reads out other things, like ....................................00
and it keeps repeating. I was just talking to my Gf and I accidentally deleted the USBmonitor log. If you would like for me to get it for you I can do it again. But basically it just loops 3 or 4 different lines redundantly.

---

onj: seems quite dead then... can u send it to service centre? warranty?

---

I'm not sure if my warranty will cover this but what option do I have I guess... so sad =( thx for your help pof

---

Houz74 said:
This is how I brought my TyTN and one from a colleague back to live. We both we’re victim of a defective radio-ROM and never got past the splashscreen. Both were original HTC TyTNs, but any Hermes with any CID should work.
If you try to do this on your own Hermes, please follow these directions to the letter as connection-problems may arise otherwise.
- Take the battery out of your TyTN and leave it out several minutes
- Disable USB-connection in Active-Sync
- Reboot your Computer
- Replace the battery and put your TyTN in the bootloader
- Try to load the ROM found here:
ftp://xda:[email protected]/RUU120_172125_Qtek_WWE_R11400_Shipping.exe
- Keep trying till you get just past the erasing part, then you will get an error-message and are asked to reset your device with the stylus
- Reset your phone and put it back in the bootloader mode
- Install any Hermes ROM you like, no matter what CID if you have bootloader 1.04
Click to expand...
Click to collapse
It works! Thank you... you rescued my TyTN...
I followed the procedure and everything is fine now...

---

Rom type?
When you say any ROM, do you mean the RUU rom's or a just a Radio-ONLY rom?
Thanks.
Houz74 said:
This is how I brought my TyTN and one from a colleague back to live. We both we’re victim of a defective radio-ROM and never got past the splashscreen. Both were original HTC TyTNs, but any Hermes with any CID should work.
If you try to do this on your own Hermes, please follow these directions to the letter as connection-problems may arise otherwise.
- Take the battery out of your TyTN and leave it out several minutes
- Disable USB-connection in Active-Sync
- Reboot your Computer
- Replace the battery and put your TyTN in the bootloader
- Try to load the ROM found here:
ftp://xda:[email protected]/RUU120_172125_Qtek_WWE_R11400_Shipping.exe
- Keep trying till you get just past the erasing part, then you will get an error-message and are asked to reset your device with the stylus
- Reset your phone and put it back in the bootloader mode
- Install any Hermes ROM you like, no matter what CID if you have bootloader 1.04
Click to expand...
Click to collapse

---

I tried the above, in bootloader mode ok, but when I try running the ROM I get "Error 101: Connection Error" - this is happening regardless of what ROM I try..
Please help, I've got a brick

---

Any idea how to get Trinity alive after update failure?
After failure during ROM update, every other updates stop after 1% and the device restets itself to bootloader (1.07).
I tried what you didi with your Hermes, I followed the steps and I got that error message, I reset with the stylus,
tried to install the Trinity ROM and unfortunately it didnt work.
Now my trinity became a piece of black plastic

---

masters i bricked mine too
000001: Class-Specific Request (DOWN), 09.02.2007 19:40:50.4375000 +76.8593750
Destination: Inrterface, Index 0
Reserved Bits: 0
Request: 0x22
Value: 0x2
Send 0x0 bytes to the device
000002: Control Transfer (UP), 09.02.2007 19:40:50.4375000 +0.0
Pipe Handle: 0x82d544d0
Setup Packet
21 22 02 00 00 00 00 00 !"......
Recipient: Inrterface
Request Type: Class
Direction: Host->Device
Request: 0x22 (Unknown)
Value: 0x2
Index: 0x0
Length: 0x0
000003: Class-Specific Request (DOWN), 09.02.2007 19:40:50.4375000 +0.0
Destination: Inrterface, Index 0
Reserved Bits: 0
Request: 0x22
Value: 0x3
Send 0x0 bytes to the device
000004: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.4375000 +0.0
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x4 bytes from the device:
55 53 42 3E USB>
000005: Control Transfer (UP), 09.02.2007 19:40:50.4375000 +0.0
Pipe Handle: 0x82d544d0
Setup Packet
21 22 03 00 00 00 00 00 !"......
Recipient: Inrterface
Request Type: Class
Direction: Host->Device
Request: 0x22 (Unknown)
Value: 0x3
Index: 0x0
Length: 0x0
000006: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.4375000 +0.0
Pipe Handle: 0x82b03ac4 (Endpoint Address: 0x4)
Send 0x1 bytes to the device:
0D .
000007: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.4375000 +0.0
Pipe Handle: 0x82b03ac4 (Endpoint Address: 0x4)
Send 0xc bytes to the device:
55 53 42 50 6F 72 74 54 65 73 74 0D USBPortTest.
000008: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.5781250 +0.1406250
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x2 bytes from the device:
0D 0A ..
000009: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.7031250 +0.1250000
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x4 bytes from the device:
55 53 42 3E USB>
000010: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.8906250 +0.1875000
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
55 U
000011: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.9375000 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
53 S
000012: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:50.9843750 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
42 B
000013: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:51.0312500 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
50 P
000014: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:51.0781250 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
6F o
000015: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:51.1250000 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
72 r
000016: Bulk or Interrupt Transfer (UP), 09.02.2007 19:40:51.1718750 +0.0468750
Pipe Handle: 0x82b03aa4 (Endpoint Address: 0x81)
Get 0x1 bytes from the device:
74 t
000017: Class-Specific Request (DOWN), 09.02.2007 19:41:56.1250000 +64.9531250
Destination: Inrterface, Index 0
Reserved Bits: 0
Request: 0x22
Value: 0x0
Send 0x0 bytes to the device
000018: Control Transfer (UP), 09.02.2007 19:41:56.1406250 +0.0156250
Pipe Handle: 0x82d544d0
Setup Packet
21 22 00 00 00 00 00 00 !"......
Recipient: Inrterface
Request Type: Class
Direction: Host->Device
Request: 0x22 (Unknown)
Value: 0x0
Index: 0x0
Length: 0x0

---

Missing File
crazyut said:
When you say any ROM, do you mean the RUU rom's or a just a Radio-ONLY rom?
Thanks.
Click to expand...
Click to collapse
Hi there, i thinks i'll need the RUU120_172125_Qtek_WWE_R11400_Shipping.exe but it's no longer online.
Could someone help me pleeeeeaaaaaaaaaaaaaaaaaaaaaasssssseeee !