OK guys, here it is... Hard-SPL for all of you that want to **** around with your devices a little bit more than everyone else.
It's 2.60 and has an unrestricted rbmc as well as allowing you to lnb files and once again access the AT interpreter/Bootloader via rtask, although I should point out that the command for the AT interpreter is now "rtask 7" - "rtask b" performs a security check that wastes time... I put this in for completeness more than anything to have a similarity to the newer MFG bootloaders.
and yes... I can count, I know I've gone from V7 to V9, but there was a previous build I made internally.
and finally... when it flashes, it will go to 100% then your device will restart; the RUU will throw an error but just click the exit button, all is well.
This bootloader will also allow you to overwrite it... but this requires especially modifying the NBH to do so... otherwise it's just skipped
Code:
[b]CURRENT FEATURES[/b]
-SuperCID
-no file signing required
-no password required to authenticate with bootloader
-bad NAND can be recovered with "task 2a"
-bad NAND can be recovered by flashing an OS
-SPL protected from all HTC retail SPLs being flashed by accident (to bypass, use SSPL)
-IPL protected from all flashes; protection against bogus NBH's
-bad NAND can again be checked for with "info 8"
-version displays 2.60.Olipro
-no longer tries to read bad NAND - should fix whitescreen issue
-lnbs command converted to lnb
-rtask command ported back; "rtask 7" replaces "rtask b"
-can be overwritten with a special NBH
[b]ChangeLog[/b]
[b]Hard-SPL-2.60[/b]
-ported rtask back into the bootloader
-special NBH can be made to overwrite SPL
-lnbs now converted to lnb
-special credits in info 7 command :)
[b]Hard-SPL-2.30[/b]
-Unlocked RBMC command; internal release only
[b]Hard-SPL-2.10[/b]
-based on a newer SPL base; bugfixes.
-IPL flashing disabled to prevent bogus NBHs bricking your device.
[b]Hard-SPL-1.40[/b]
-repairs a bug that affected SPL being replaced by retail ones.
[b]Hard-SPL-1.35[/b]
-addresses an issue for those with Real Bad Blocks to prevent whitescreens.
[b]Hard-SPL-1.30[/b]
- removed password for wdata commands and rbmc etc.
- activated "task 2a" to allow recovering bad blocks as well as flashing valid OS.
- Disabled SPL flashing; this SPL protects you from writing over it by accident.
- Bad Blocks "info 8" command works now allowing you to check for bad blocks.
[b]Hard-SPL-1.13[/b]
- Patched NAND check; bad NAND ignored, valid OS can be flashed to recover bad blocks.
[b]Hard-SPL-1.11[/b]
- Flashing Radio BL 0108 now supported
- Downgrading SPL no longer allowed.
- rtask command removed.
- new RUU interface required to flash ROM files.
[b]Hard-SPL-1.10[/b]
-Initial release; SuperCID and no signing required
-Compatible only with Radio BL 0107
-has rtask commands for accessing radio facilities.
2-3 times I try to flash, but without success. Always have a error 262 or 260 and progress bar stay on 0%....After 20 min I tried again and some thinks happened very fast that I can't explain, but latter I see ipl 1.10 olines, or similar, and see spl 2.60. After soft reset I see my "old" spl 2.30Olipro. One more time I start and now is ok. IPL -1.03 SPL-2.60.Olipro
10x Oli.
Great works
well... I was pretty chuffed myself
Great one buddy!
太棒了。
Good job，thanks
Necessity to replace v7 with v9?
Hi Olipro,
Congratulations on the new version of Hard-SPL.
One quick question though, is it advisable to replace the v7 with this new v9 on our phones at present?
I mean is the level of protection more or less the same for the average person who does not want to piss around with phone flashing as much as the pro's do.
Regards.
Trezona said:
Hi Olipro,
Congratulations on the new version of Hard-SPL.
One quick question though, is it advisable to replace the v7 with this new v9 on our phones at present?
I mean is the level of protection more or less the same for the average person who does not want to piss around with phone flashing as much as the pro's do.
Regards.
Click to expand...
Click to collapse
why don't you read the feature list and figure it out for yourself
Olipro said:
OK guys, here it is... Hard-SPL for all of you that want to **** around with your devices a little bit more than everyone else.
It's 2.60 and has an unrestricted rbmc as well as allowing you to lnb files and once again access the AT interpreter/Bootloader via rtask, although I should point out that the command for the AT interpreter is now "rtask 7" - "rtask b" performs a security check that wastes time... I put this in for completeness more than anything to have a similarity to the newer MFG bootloaders.
and yes... I can count, I know I've gone from V7 to V9, but there was a previous build I made internally.
and finally... when it flashes, it will go to 100% then your device will restart; the RUU will throw an error but just click the exit button, all is well.
This bootloader will also allow you to overwrite it... but this requires especially modifying the NBH to do so... otherwise it's just skipped
Code:
[b]CURRENT FEATURES[/b]
-SuperCID
-no file signing required
-no password required to authenticate with bootloader
-bad NAND can be recovered with "task 2a"
-bad NAND can be recovered by flashing an OS
-SPL protected from all HTC retail SPLs being flashed by accident (to bypass, use SSPL)
-IPL protected from all flashes; protection against bogus NBH's
-bad NAND can again be checked for with "info 8"
-version displays 2.60.Olipro
-no longer tries to read bad NAND - should fix whitescreen issue
-lnbs command converted to lnb
-rtask command ported back; "rtask 7" replaces "rtask b"
-can be overwritten with a special NBH
[b]ChangeLog[/b]
[b]Hard-SPL-2.60[/b]
-ported rtask back into the bootloader
-special NBH can be made to overwrite SPL
-lnbs now converted to lnb
-special credits in info 7 command :)
[b]Hard-SPL-2.30[/b]
-Unlocked RBMC command; internal release only
[b]Hard-SPL-2.10[/b]
-based on a newer SPL base; bugfixes.
-IPL flashing disabled to prevent bogus NBHs bricking your device.
[b]Hard-SPL-1.40[/b]
-repairs a bug that affected SPL being replaced by retail ones.
[b]Hard-SPL-1.35[/b]
-addresses an issue for those with Real Bad Blocks to prevent whitescreens.
[b]Hard-SPL-1.30[/b]
- removed password for wdata commands and rbmc etc.
- activated "task 2a" to allow recovering bad blocks as well as flashing valid OS.
- Disabled SPL flashing; this SPL protects you from writing over it by accident.
- Bad Blocks "info 8" command works now allowing you to check for bad blocks.
[b]Hard-SPL-1.13[/b]
- Patched NAND check; bad NAND ignored, valid OS can be flashed to recover bad blocks.
[b]Hard-SPL-1.11[/b]
- Flashing Radio BL 0108 now supported
- Downgrading SPL no longer allowed.
- rtask command removed.
- new RUU interface required to flash ROM files.
[b]Hard-SPL-1.10[/b]
-Initial release; SuperCID and no signing required
-Compatible only with Radio BL 0107
-has rtask commands for accessing radio facilities.
Click to expand...
Click to collapse
I stuck in Tri-Color Screen, how can restore !?
Please help
cm1437 said:
I stuck in Tri-Color Screen, how can restore !?
Please help
Click to expand...
Click to collapse
Kill yourself.
Dear Oilpro,
I mean during flashing 2.60, it shown error msg,
then i try to recovery, but it can't.
Now i reboot it, it stuck in Tri-Color Screen,
What can i do!?
Please comment
cm1437 said:
Dear Oilpro,
I mean during flashing 2.60, it shown error msg,
then i try to recovery, but it can't.
Now i reboot it, it stuck in Tri-Color Screen,
What can i do!?
Please comment
Click to expand...
Click to collapse
run the rtask command for completing the flash
What's meaning of rtask?
Where can i found it?
pasan said:
run the rtask command for completing the flash
Click to expand...
Click to collapse
err... no, don't... that's not what it's for at all
Olipro said:
Kill yourself.
Click to expand...
Click to collapse
You are right... there is no stupid question... just offensive answers...
Olipro said:
Kill yourself.
Click to expand...
Click to collapse
Thats funny
cm1437 said:
Dear Oilpro,
I mean during flashing 2.60, it shown error msg,
then i try to recovery, but it can't.
Now i reboot it, it stuck in Tri-Color Screen,
What can i do!?
Please comment
Click to expand...
Click to collapse
Exactly the same problem. I was using 2.30.Olipro.
Stuck in bootloader.
Tried set 14 0 without success...
Please, ¿any idea?.
I've talked with Olipro in the chat and he kindly help me to manage the problem:
- Disconnect Active Sync USB connection.
- Start MTTY
- Push Enter to saw CMD> or USB>
- Type
set 16 0
and pres ENTER
and it's solved....
My error was a noobs error; I started the bootloader manually but the RUU starts a SoftSPL so it doesn't runs. Now, I've upgraded to 2.60.olipro without problems. I recognized that I'm stupid
Thanks Olipro!!!!!
Got error 282 and prompted with view documentation or recovery. Used mtty and set 16 0 to recover back.
Tried a couple of times but with same error.
Yes, get the same tri color Bootloader screen.
I reflash a new OS, problem solved for me att least.
Related
here is what I've done and what happened:
my ROM was HTC 1.18.255.3 07/22/06 with bootloader 1.04 then I ran "HERM_Unlock_v2a.exe" on the device but I didn't use "HTC_Hermes_Radio_for_SIMunlock_v1.16.00.69" to save time and i wanted a CID unlock only.
after "SUCCESS!" message from "HERM_Unlock_v2a.exe", I connected my device via USB to PC and started to upgrade to Cingular 1.31.502.1 08/30/06 with aku 2.6 and bootloader 1.06 but when I get the "ID ERROR",without disconnecting the USB, I switched back to ugrading to previous ROM HTC 1.18.255.3 and the Processe started with no problem untill 98%, then suddenly upgading interrupted a message came saying connection error or somting like that!
since then my device is stuck on windows mobile screen and I've tested solutions in the "Hermes_Upgrade Problems" page and tried using the "Hermes SD Card flashing" method, But It seems impossible to flash my phone agian.
Help me PLEASE,HELP
someone help me please!
POF can't you help me please
I think Pof is away until 3rd december, I have the similiar problems with my second hermes, if you have then use mtty to see if you have an corrupted cid using info 2.
Do you have the original rom to go back on if so that will fix your problem.
I've used mtty to send some commands to my device and it answers to some of them but It just stop responding when I type "info 2" or "info 3".
and i tried this in mtty:
"
USB>checkimage
IPL CRC checksum = 0x9FCC6BEB
SPL CRC checksum = 0x3BF03635
CE CRC checksum = 0xC0E1751A
ExtROM CRC checksum = Total Block= 1024
dwBlockIndex= 1024
Address Error1!!!
Get checksum ERROR!!!
0x0
Radio Image CRC checksum =
"
again It stop responding
also tried upgrading, no matter which ROM I try, it just can't connect to device.
and thanx for your relpy.
hi, since there is NO htc service center available around me I have to do something about it myself but my phone is still dead and I'm using a nokia 1101. PLEASE someone help me, pof are you back? can you help me?
I've tried all in this page:
"http://wiki.xda-developers.com/index.php?pagename=Hermes_UpgradeProblems"
and this one too:
"http://forum.xda-developers.com/showthread.php?t=280733"
and tested qtek 2020 rom but no use.
from what I've found out my device hang up and stop responding when it gets the "INFO 2" or "INFO 3" or "TASK 32" or perhaps any thing involving CID so no upgrading utility is able to connect to it, the only thing is to connect to it using "mtty.exe" which I've tried any command found here, but no use again.
and my SPL is 1.04
can anyone help me?
mht220 said:
I ran "HERM_Unlock_v2a.exe" on the device but I didn't use "HTC_Hermes_Radio_for_SIMunlock_v1.16.00.69" to save time and i wanted a CID unlock only.
Click to expand...
Click to collapse
Wrong, you also need a patched radio to CID unlock. Running only the exe file without the patched radio has no effect on the unit.
mht220 said:
from what I've found out my device hang up and stop responding when it gets the "INFO 2" or "INFO 3" or "TASK 32" or perhaps any thing involving CID so no upgrading utility is able to connect to it, the only thing is to connect to it using "mtty.exe" which I've tried any command found here, but no use again.
and my SPL is 1.04
Click to expand...
Click to collapse
Please attach usb monitor capture when trying to flash a ROM and a radio ROM. Otherwise can't help you.
here is exported files from usb-monitor:
and tanx for your reply
uuh... there must be something really wrong with it, no response to bootloader commands. If no sd card flashing is possible, I would suggest you to send it to service centre too.
pof said:
...I would suggest you to send it to service centre too.
Click to expand...
Click to collapse
It's a difficult option for me, as I should send it to a foreign country to service center,so are you sure there is no way like erasing somewhere using mtty?
pof said:
... no response to bootloader commands...
Click to expand...
Click to collapse
but it respond to some of them in mtty.exe e.g. "erase", "set" and some other.
pof said:
...If no sd card flashing is possible...
Click to expand...
Click to collapse
no it would stuck in "checking..." forever
tanx
HI,
I have same exactly problem on my spv m3100: since sept06 I've tried every kind of Unlock software,upgrade ROM and method found in xda..In mtty bootloader (spl 1.04) respond at every command but not "info 2","info 3" and "task 32".Sd card method works but if you try to upgrade other ROM,in your screen "loading..." and then "checking..." hangs on because the ROM upgrade must to match CID (I suppose..).I'll wait the next ROM Upgrade and ORANGE won't release it until gen07..
warrio said:
I'll wait the next ROM Upgrade and ORANGE won't release it until gen07.
Click to expand...
Click to collapse
it seems your problem is like mine if so, I don't think ANY normal upgrade can solve your prolem 'cause it can't connect to it.
so don't wait and send your device to service center, if you can.
I'm in your same conditions:there's no repair center here so I have to wait Orange who release a upgrade Rom (I hope asap..).
Hi,
I spent 6-7 hours of reading all kind of suggestions and etc, how to bring a brick to life. the only closest to my situation is http://forum.xda-developers.com/showthread.php?t=295623
I flashed my phone several times and i hadnt much of problems until i tried to put wm6 update.
The last time I tried to downgrade to CUSTOM__RUU_Wizard_1050412_WWE_101_11210_WWE and the phone freezed to the start screen (that picture with the beer). I restarted it several times but it never went beyond it.
Then I tried to put the previous ROM that worked. I entered bootload mode and started the upgrade wizard. I waited it to finish, but it didnt! When it reached 98% it suddenly got back to 95%(!?) and after few seconds a message for connecition interupted appeared on the computer. The phone stayed on 95% for some time more and nothing happened. Then i clicked on the "how to restore" button of the upgrade wizard. I followed the instructions which stated on step 3 "remove the battery of the phone".
After I did that, my phone died and since then i cant do anything with it. The screen is all black. Of course I tried hard reset, bootloader mode and etc - all failed. It doesnt go into bootloader mode or do hard reset. The computer does not detect any USB connections. The charger doesnt appear to be detected by the phone (LED doesnt light up). There should be 50-60% battery power left. It was working perfectly before flashing.
I think the main problem now is how to enter the Bootloader.
Im not quite familiar with SD flashing, but i think i have the necessary hardware, just please advise is it possible and how I can do it.
Edit: Now I found that my SD card is unreadable too
Please help
Sorry
Greetings,
Sorry for your situation, but do you have G4 or G3 wizard.
If G4 was it CID locked or unlocked.
samy.3660 said:
Greetings,
Sorry for your situation, but do you have G4 or G3 wizard.
If G4 was it CID locked or unlocked.
Click to expand...
Click to collapse
it is g4 cid locked
edit: i now remember that IPL & SPL had different versions like 1.x & 2.x after downgrading. I didnt know that I have to reflash in that case i found it in the forum too late
You should have read more before trying to flash your phone...
That downgrade that you made bricked your phone. That ROM was intended for G3 ONLY. If you have a G4 you should flash only G4-ROMS (or read how to extract ipl & spl from a G3 ROM) ... I am afraid there are no known solutions, because IPL and SPL on a G4 can`t be succesfully upgraded/reflashed (the hardware doesn`t allow that)
(the hardware doesn`t allow that)
Click to expand...
Click to collapse
so how i did broke them in the first place?
anyway i'm trying to cook a SD card image, but the typhoon 5 tool doesnt convert the files to sd image format
Code:
C:\work>typho5.exe -r ipl=nk.nbf -d az.img
read 04741800 for ipl from nk.nbf
no IPL at 4 in IPL image
my idea is to either get a packeded file with all the modules or put them to the SD card one by one at the appropriate offset as it is described in the Wiki (using the winhex disk editor). Is the *.nb format the same as the modules in the SD card image? I mean can i directly paste the contents of the .nb files into the apropriate offset to the empty SD card?
Your only solutions are to get a new board or to get a JTAG device and discover the JTAG pins on the board since it's the only way you can access the flash chip without a bootloader. Problem is until now no one has managed to find the JTAG pins (or bothered).
What you have done was flashing an IPL (Initial Program Loader) that is for G3 DOC chips only (with a 130 nm manufacturing process) ; and since you have a G4 DOC chip (90 nm manufacturing process) the process fails.
This is the IPL:
A small XIP memory (ROM, NOR flash or DiskOnChip boot block) that contains code to
perform minimal system initialization: It must at least initialize the chip-select unit so that
the ROM (if any), RAM, and DiskOnChip can be accessed.
Click to expand...
Click to collapse
3.2. The Boot Process
• Power up and initialization: After system power up, the IPL code that resides on the XIP
block of the DiskOnChip is executed. The IPL code initializes the DiskOnChip controller
and the RAM.
• Copying the SPL code from DiskOnChip to RAM: After initialization, the IPL reads and
loads the SPL code from the DiskOnChip binary partition to RAM. It then jumps to the SPL
start address in RAM and executes the SPL.
Notes: 1. In general, the IPL is limited in size to several KB (the size limitation varies,
depending on the device type), so it is not possible to include both the system
initialization code and the error correction code. The absence of the error correction
code in the IPL is the reason why the boot process is divided into the IPL stage and
SPL stage. The actual loading of the OS image to RAM is done by the SPL code.
Since the SPL runs in the system RAM, there is no limit on code size and it can
include the error correction code.
Click to expand...
Click to collapse
As you can see on step 2 the IPL can't load SPL since they are for different chip versions.
cheers
mestrini said:
Your only solutions are to get a new board or to get a JTAG device and discover the JTAG pins on the board since it's the only way you can access the flash chip without a bootloader. Problem is until now no one has managed to find the JTAG pins (or bothered).
What you have done was flashing an IPL (Initial Program Loader) that is for G3 DOC chips only (with a 130 nm manufacturing process) ; and since you have a G4 DOC chip (90 nm manufacturing process) the process fails.
This is the IPL:
As you can see on step 2 the IPL can't load SPL since they are for different chip versions.
cheers
Click to expand...
Click to collapse
yes, it seems that happened, but after flashing the g3 version, the phone still enters the bootloader. It died completely AFTER i tried to return the g4 version, and may be all happened because it didnt finish the instalation (which interupted for no reason) and stayed with messed up versions.
Anyway seems I need a new mobo, but i'm not sure i could find it here (i'm from Bulgaria) the closest vodafone store is in Romania. The phone is from Germany, a friend of mine bought it there.
I flashed HardSPL 2.30olipro and it wont boot the OS when I reset, the screen stays black like its still off and the green light at the top stays on, I can still access the bootloader and use MTTY, I have tried flashing various ROMs and the "set 14 0" but nothing works, At the moment I have :
IPL-1.00
SPL-2.30.Olipro
Anyone have any ideas?
Well, it appears you can get to mtty...
Try Task 28 (this usually works when stuck in boot screen - not sure exactly where you are stuck)
or...
Try flashing a new ROM.
todd_jg said:
Well, it appears you can get to mtty...
Click to expand...
Click to collapse
Yea no problems getting into the bootloader and using MTTY
todd_jg said:
not sure exactly where you are stuck
Click to expand...
Click to collapse
I'm stuck as soon as I turn it on, blank screen like its still off and green light at the top is on the whole time, but not when i go to the bootloader.
Thanks for the help
My problem of noot being able to see any splashes and not being able to turn on for that matter is weird, Who knows a way that I can erase all of the phone totally except for the bits that cant be likle the SPL and IPL, Is there any way possible to flash someones dumped rom, and use the wlan fixing method to set yourself a new Mac adress etc.
In the memory map it says the Radio and bootloader are at "0x????????" does anyone know whats under the mysterious question marks?
deleted post
Korpse said:
My problem of noot being able to see any splashes and not being able to turn on for that matter is weird, Who knows a way that I can erase all of the phone totally except for the bits that cant be likle the SPL and IPL, Is there any way possible to flash someones dumped rom, and use the wlan fixing method to set yourself a new Mac adress etc.
In the memory map it says the Radio and bootloader are at "0x????????" does anyone know whats under the mysterious question marks?
Click to expand...
Click to collapse
Have you tried to reflash the HARDSPL?
binky11 said:
Have you tried to reflash the HARDSPL?
Click to expand...
Click to collapse
Thanks for helping me
It wont actually let me write over it because it has that protection on it to stop roms overwriting it with an older version, would it work (and be safe) to delete the SPL using the erase command then reset the hermes and write the SPL again?
Hi! i also got same problem, can still access bootloader and mtty only
Any solution that i can do? the mtty command " erase [StartAddr [Len]] " can it?
Cmd>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 610
Storage Total block: 326
Total Bad Block in CE: 0
NeedToEraseBlockStart: 623
NeedToEraseBlockEnd: 936
Storage format success
Cmd>checkimage
IPL CRC checksum = 0x856C952E
SPL CRC checksum = 0x738D6562
CE CRC checksum = 0x92C76E00
ExtROM CRC checksum = 0x2F8830F2
Radio Image CRC checksum = 0xB3F22A62
Thanks first.....
Korpse said:
Thanks for helping me
It wont actually let me write over it because it has that protection on it to stop roms overwriting it with an older version, would it work (and be safe) to delete the SPL using the erase command then reset the hermes and write the SPL again?
Click to expand...
Click to collapse
The SPL area is touchy. If you were to erase the Bootloader, I am not sure you would ever be able to flash anything, since it uses bootloader commands to do it. Check the MrVanx downgrade guides. There are instructions for overwriting the latest HardSPL. It is a two step process, first using SSPL. Give it a shot.
Im having to same problem,
IPL 1.04
SPL 2.30 Olipro
Cmd>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 462
Storage Total block: 474
Total Bad Block in CE: 0
NeedToEraseBlockStart: 475
Storage format success
Cmd>checkimage
IPL CRC checksum = 0xC1AC9D2F
SPL CRC checksum = 0x327DEB48
CE CRC checksum = 0x4E705577
ExtROM CRC checksum = 0x85083D45
Radio Image CRC checksum = Checksum: Wait interpreter timeout
0x0
Cmd>
when I try to reflash any rom I get an error, usually hangs around 12%
Hey guys,
Anyone got a resolution to this problem yet?
Heres whats happening:
When I turn on the device I get the green led light but nothing shows on the screen at all, I can still access the boot loader the normal way.
- Tried Task 28
- Can flash any ROM but doesn't fix issue at all
- Happened after i updated to HardSPL 2.30, but cant downgrade because I need access to the OS to use SSPL.
Thank you for any help
Same problem.
Hi,
don't know if this will work for you, but it did for me. the difference is that mine wasn't hardspl.
I had the same problem when i was trying to upgrade to WM6 a friends JasJam (i had a USB connection problem). i tried alot of flashing, and the only one that seemed to work for me was the Official I-Mate ROM i got from this thread:
http://forum.xda-developers.com/showthread.php?t=348436
and flashed it after going into the bootloader.
after flashing this, i loaded the hardspl v7 from this one.
http://forum.xda-developers.com/showthread.php?t=296722
and after that, flashing any ROM works perfectly.
Hope this helps.
I'm going to try that but I'm not sure if it will work.
I am already running:
IPL-1.00
SPL-2.30.Olipro
so it will not let me override it with HardSPLv7
Not sure if I can be of much help but I had the exact same problem after a flash, then just booted into the bootloader and loaded a ROM from my MiniSD card (CRCs Rom) and that seemed to fix my problem. I also have HardSPL 2.30 installed
try
cmd>set 16 0
Hope it works, normally when i get stuck in the bootloader its what i do, soft reset, plug it to usb run mty and do that comand. after it says write nand soft reset the device, it should load the os with no problems ^^
I have the same problem too. I ran the hermes unlocker v3a and after 100% it won't boot, but the green light turns on at the top. I can get into bootloader and MMTY. IPL 1.01 and SPL 1.4 Olipro
I'm a total noob so please somebody help!
This is becoming a common issue and there are a lot of people with a bricked Hermes devices, usually because of a WinXP crash, bad USB port, USB hub or pulled USB cable while flashing.
This thread is in the aim of finding a solution to all these common problems: if you are the owner of a bricked hermes, please post your comments here instead of opening a new thread.
There seems to be 3 types of bricked (or dead) hermes devices:
Type 1 bricks: Corrupted radio area: No GSM, No CID, no IMEI
Usual reason for that is flashing whent wrong when RUU was flashing the radio stack (GSM.nb). Other reason can be that you flashed radio from another device (universal unlocker run on hermes, for example).
Within the type 1 bricks, there seem to be two variants:
Type 1a:devices which can boot windows mobile but can't use the phone functions.
Type 1b: devices which can't boot windows mobile and are stuck while booting, see also type 2 bricks below.
Type 2 bricks: Stuck in boot process
Usual reason for that is that flashing went wrong when the RUU was flashing any rom part different than IPL and SPL. Symptoms can vary depending on which is the ROM part affected. The most common is OS because it is the bigger part. Radio is the second most common.
Type 2a: When the phone boots, it goes directly to bootloader mode (tri-color screen)
Type 2b: When the phone boots, it stays in subslpash screen (htc or operator logo)
Type 2c: When the phone boots, it doesn't pass the windows mobile logo
Hybrid Bricks: combinations of both type 1 and type 2 bricks
These usually have a corrupted radio and are stuck in bootloader, unfortunately these are very common too, and the most dificult to repair.
We made a wiki page long time ago whith the solutions that have worked for some people to fix bricks, unfotunately these solutions do not work for everyone, some devices are more bricked than others
First thing you have to do is visit this wiki page and follow the process explained: Common upgrade problems
If you can't repair your brick after following the process, please provide a USB monitor capture in ANSI text format (this is explained on the wiki page too) as this is the only thing that can give us a real idea on what your exact problem is. Please don't come crying and say "help me" because we can't help you if you don't provide useful information, you are in front of a big problem and you will have to loose some hours reading and experimenting before repairing your brick. If you are not willing to loose some hours reading, go and send the device to the service centre for a repair as it is the only valid solution most of the times.
Hopefully after research of everyone in this thread we can find new solutions for some of the bricks
EDIT: Please use axiom's comment below as a template for your comment and attach USB monitor capture: If your bootloader is 1.04 attach capture when trying to flash an extracted radio ROM and when trying to flash a shipped rom update. If your bootloader is 1.06 or 1.09 only attach the usb monitor capture of the shipped update.
EDIT (2007-03-22):
After more than 3 months since this thread started and more than 660 comments, we have now solutions for some bricks, so I compiled the most common on this unbricking guide:
How to unbrick your bricked hermes
Please spend some time reading through the wiki and thread comments before posting desesperately, otherwise you'll get no answer.
The following info may help in isolating the problem and keeping the clutter down.:
I'm including my info.
Model: O2 XDA Trion
ROM Before Flash: Dopod 1.23.707.4
Radio Before Flash: 1.16
Bootloader Before Flash: 1.04
Flash failed at: 6%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable
Hi, I've managed to brick my Hermes as well.. First time on any of my HTC Devices....
Model: Vodafone v1605
ROM Before Flash: Voda Launch ROM
Radio Before Flash: Not sure
Bootloader Before Flash: 1.04
Flash failed at: 8%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Assume Yes
No GSM Error: Not got that far
Stuck In Bootloader: Yes
Stuck On Windows Mobile Splash: Not got that far
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable
You may already know this, as I posted it in all over the other threads of people with bricked hermes, but I'm posting again to make sure every piece of information is concentrated on this thread, and see if finally this can get us somewhere
HTC bootloader returns data encapsulated in a block between HTCS (start) and HTCE (end), before the HTCE there's always a 4-byte checksum of the data. You're getting a timeout when you query the bootloader for the device's CID, so the output you see is "F" which means failure (T means success) encapsulated in this HTCS/HTCE block, plus the checksum. The CID is read from the security area of the device, found on radio, but the wrong flash corrupted the radio area.
As the CID is not returned, the error you get when flashing the ROM is "CID Not allow (255)". The security level depends on CID, as the device has CID corrupted, the security level returned is FF (255), which means you can't bypass CID check in bootloader.
You both have bootloader 1.09 which does enforce CID checking (as opposite to bootloader 1.04 which has a known bug to circumvent this). This bootloader also only allows updates with bootloader version > 1.09 (and no such bootloader exists yet).
Bootloader 1.04 allows to flash unsigned code in radio with radio bootloader command 'rwdata', but radio bootloader is accessed through command 'rtask' and this command has been removed in following bootloader versions.
All the commands to flash code in bootloader 1.06 and above require the code to be signed (the commands are 'wdatah' and 'lnbs'), and bootloader checks the signature before the code is actually flashed on the device. So modifying a 1.04 bootloader to show itself as 1.10 is not possible because it will return a certificate error and will not be possible to flash.
Command 'lnbs' doesn't check CID, but it is only enabled if device has security level=0, and as your radio is corrupted and your seclevel=FF it will not be possible to use this command to fix it even if you had a signed bootloader, so 'wdatah' is the only command that would allow you flashing code, but 'wdatah' requires a NBH header to be sent, which contains the CID of the update and is checked against the missing CID on your device and will never match (even if you could modify the NBH header and have a valid signature after).
In conclusion, my recommendation to you is that you send the device to service centre to get it repaired and don't try to fix this by yourselves, as you will go nowhere.
Many thanks for explaining it so succinctly Pof, much appreciated. With this error I've learnt a heck of a lot more about the ROM flashing process... I guess it may be time to send the unit for repair!
This is the full report after I soft rest my phone while the USB is still connected. Would any one know what the rest of the data means? I did it in the morning then just left it for the day to see what would happen, I just got back from work.
onj: can you use axiom comment as a template to provide information?
radioerror.txt: I see you're using the Himalaya upgrade utility there... rbmc reads data from memory, but I don't know what is at 0x70010000. It would be better if you can provide a log of hermes RUU.
Model: x01ht
ROM Before Flash: i-mate
Radio Before Flash: 1.07.03.10
Bootloader Before Flash: 1.04
Flash failed at: 0%
Flashing ROM: JASJAR_WWE_19096_19505_11300_AKU_3_2_ship
Flashing Radio: 1.13.00
Bootloader After Failure: 1.04
CID Before Failure Super CID: success
CID Corrupt: don't know
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: stalls
Current Device Status: unusable
I will upload the usbmonitor with using
RUU_HERMES_HTC_WWE_1[1].35.255.2_1.35.255.102_1.08.00.10_SHIP
the upgrading dies after info 3
computer says ERROR [222] Device not responding
that's with all the RUU's that I use and even the full upgrade ROM
Hi, I have a herm 200 an i have a Type 2a bricks (it goes directly to bootloader mode tri-color screen).
But i upgrade with the rom (ME_DT_WWE_1182553_106_10303_Ship) and all run good. but 3 moths later i have the type 2a bricks.
I try with that solution (http://wiki.xda-developers.com/index.php?pagename=Hermes_UpgradeProblems) and others and NOthing.
In screnn say herm200 ILP-1.00 and Her200 SPL-1.04.
ps: sorry my english is very bad.
@onj: Oh ****! You where trying to flash an HTC Universal ROM in your HTC Hermes!! These are different devices, most probably that's what screwed it.
From your attached file I see bootloader does not answer to any command.
@landtd5: please use axiom comment as a template, and attach USB monitor capture when tryng to flash a shipped rom and a radio rom.
Yup, I upgraded with the wrong Rom. After going through the forum for the past 2 weeks I realized what I did. I guess it's time for me to send it to the shop
thanks for you help pof
jash431 Dead Tytn
I had tytn with this rom
"TYTN_me_dt_wwe_1182553_106_10303_ship" which has bootloader 1.04
And I upgraded with
"RUU_HERMES_HTC_WWE_1.35.255.2_1.35.255.102_1.08.00.10_SHIP"
during upgrade stopped and after that I cannot do anything with it
It never answer to any solutions .
Please help me .
USB monitore is attached here .
jash431 said:
USB monitore is attached here .
Click to expand...
Click to collapse
This is not useful: You saved LGS file, please follow instructions in wiki, you need to EXPORT as ANSI TEXT file. Also please use the 1st comment as a template to provide useful information.
Jash431
I exported in ansi text
@jash431: doesn't return anything... when you connect to bootloader on mtty, do you see the USB prompt? does it answer any commands?
Jash431
I'm sorry . this is complete one .
yes I can work with mtty.exe and my info 2 is "HTCSF kEØ(HTCEUSB>"
jash431: hybrid brick with corrupted radio and bootloader 1.09. Send it to repair centre.
jash431
is it theorically possible to fix my tytn . I mean maybe in future someone make a downgrade or SuperCID rom !! .
Because in my country doesn't exist repair center (Iran) . So what can I do ???
then keep it until something is found to fix this, creative solutions to the problem will come to your mind after looking everyday at a $500 brick.
Jash431
Thanks pof for your answer . I'll check my private message every day , for your solution and I remember you whenever I see a 500$ . ( Of course 500$ doesn't exist but you do ).
Hi, does anyone know how to enter the radio bootloader with mtty? I found some instructions on the net but they dont work, is there any special issue on the nike?
My nike has HardSPL 1.22, radio 1.65.xx and super cid unloked.
You need a MFG SPL which includes the command "rtask"
Do a "rtask a" and you can talk to radio (no echo), to return to SPL type "retuoR".
You can also security unlock your device and enter bootloader directly by pressing send and power on at the same time, or do "rtask a" followed by "setboot 1". Next time device boots up in radio bootloader.
You can then use my FrankenKaiser SPL bootloader for fast loading and booting a ram image. In my opinion a nice way to test Android
jockyw2001 said:
You need a MFG SPL which includes the command "rtask"
Do a "rtask a" and you can talk to radio (no echo), to return to SPL type "retuoR".
You can also security unlock your device and enter bootloader directly by pressing send and power on at the same time, or do "rtask a" followed by "setboot 1". Next time device boots up in radio bootloader.
You can then use my FrankenKaiser SPL bootloader for fast loading and booting a ram image. In my opinion a nice way to test Android
Click to expand...
Click to collapse
Thanks, now i have installed Hard-SPL1.15 MFG, the rtask a is now accepted, and like you said i have no echo... setboot works, but when i type in other commands like help, h, ?, gpio, version i get no outputs... What am i doing wrong? is it still the wrong SPL???
m0rph3us said:
Thanks, now i have installed Hard-SPL1.15 MFG, the rtask a is now accepted, and like you said i have no echo... setboot works, but when i type in other commands like help, h, ?, gpio, version i get no outputs... What am i doing wrong? is it still the wrong SPL???
Click to expand...
Click to collapse
You have a very limted command set if your device is not security unlocked. You find my security unlocker in one of the stickies ..
(then you have echo_on etc, enter a ? for more cmds)
Thank you, finally i get it to work... I have one last question, is there any command to get debugging log or something like that, to see whats going on when wm boots, just like the commands for the diamond?i tried set 1a 0, but it does not work, on the diamond it enables debugging information