How to enter radio bootloader (OEMSBL) - Touch Dual, MDA Touch Plus ROM Development

Most of you know how to enter the "normal" SPL bootloader where the famous tri-color screen is shown on the device display: if the device is powered off you press and hold the camera button and then press power on.
What most of you don't know is that there is also a radio bootloader aka OEMSBL. The OEMSBL is loaded just before the SPL. Just like the SPL it supports a interactive command mode with various commands. The command set available depends on the security state of your device. The most interesting command available in both states is "radata" which is normally used to flash a new radio rom. Perhaps it can be used for unbricking purposes. I will continue to research this.
Another nice command is "setboot". If for example after flashing Polaris radio roms you can't enter the normal SPL bootloader then try to enter the OEMSBL bootloader and enter "setboot 1", this will force the next boot into tri-color bootloader. To reset it you need to enter "setboot 0". NetrunnerAT this may be useful to you
(EDIT: unfortunately to enter radio bootloader by keypressing only works on security unlocked devices)
To enter radiobootloader mode:
if the device is powered off you press and hold the camera button *and* the send button and then press power on.
If it is the first time you enter this mode Windows will prompy you to install 3 drivers: a modem and 2 COM ports (diagnostics and NMEA). Use the attched drivers from the Motorola Q (it also has a qualcomm MSM7200 chipset). Look in device manager on which COM port the diagnostics port driver sits (usually COM4 or COM5). Then start MTTY and connect to that COM port. The commands you type are not echoed on your PC screen.
On a standard device (not security unlocked) following commands are supported:
Code:
radata
powerdown
setboot
GO2AMSS
rseed
pmic_vib_off
pmic_vreg
pmic_level
pmic_vib_on
rpass
On a security unlocked device (see here) there is much more:
Code:
For a help screen, use command ? or h
Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
setboot [0/1/2/3]
setatcmd [0:SIO/1:UART/2:USB/3:DPRAM]
setsmdloop [0:disable/1:enable]
setmpatch [0x1: CPU Freq/0x2: acoustic/0x4: simdoor/0x8: RTC]
setiot [0:Disable/1:Enable]
eraseall [erase all setting flags]
setdiag [0:USB/1:UART/2:DPRAM/3:SIO]
partition
checksum
format
setinfo
readadc
cego
setgpio
getgpio
gpio
version
powerdown
platformid
radata
showexplog [n]
usbdppulldown [n]
usbdmpulldown [n]
usbdppullup [n]
usbdmpullup [n]
Headsetpullhigh [n]
rfid
wpmic [PM_VREG] [0/1]

---

Where do you get the time to sleep?

---

I can't seem to get in either the normal bootloader nor the radio bootloader.
Holding the camera button while turning it on; nothing happens, it just boots as normal...
Is it me, or...?

---

Madman_nl said:
I can't seem to get in either the normal bootloader nor the radio bootloader.
Holding the camera button while turning it on; nothing happens, it just boots as normal...
Is it me, or...?
Click to expand...
Click to collapse
What HTC Nike you have? Is it a OEM like Amazon sells? What Roms have you flash before? What Device, Radio and OS Versions you have?

---

Only modelnumber i can find; NIKI200, not sure if that's what you mean, i bought it last thursday at a T-Mobile shop.
Haven't flashed anything yet
ROM version: 1.35.114.07
Radioversion: 1.58.16.27
OS; wm6, CE-controlsystem 5.2.1622 build 18128.0.4.4
I'm kinda new at this stuff, hope this is the info you need.
Thnx

---

Yes i think too ... i have the same Problem! Sorry for using German ... but i think this error is importent to fix for other Guys!!!
Sodala!
Ich hab den selben fehler! Möglich, das HTC ein neuen Security trick verwendet und ein gemoddeds OEMSPL etc verwendet! Da dein Gerät noch nie geflashed worden ist, kann man sozusagen ausgehen, dass dieser Fehler nicht von ein schlecht gemoddedn Radio ROM oder SPL kommt! Das ist für mich ein wichtige Info!!
Jetzt ein paar tips damits du kein Problem hast und nicht in diverse fallen tapst!!
Wennst du Flashst ... verwend bitte kein Vista!
Wennst du Flashst ... verwend nur das HardSPL und mach bitte keine Experimente rund ums SPL!!!
Wennst einmal im Bootloader fest hängst ... das Tool MTTY suchen dich via USB auf den Nike hin verbinden und den Befehl "boot" starten! Dann solltest du wieder im OS sein.
Wennst in den Bootloader kommen willst musst du diese Datei auf dein Nike starten!
Du kannst ohne Probleme nach dem HardSPL 1.16 ein unbranded Deutsches Rom von mir Installieren. Mach derzeit keine Radio Roms Updates, da unter umständen du den Bootloader Modus brauchst, ihn aber nicht erreichen kannst! Das ist der einzige Grund warumst derzeit nix in diese richtung machen solltest!
I will talk with jockyw or other guru too found some solution ... this is a new Problem!!

---

ok, i figured something out;
in another attempt to get into the bootloader, i pulled out my sim as well as the micro-SD, pressed and held the photo button, an turned it on.
the result; a 4 colored screen, from top to bottem; red, green, blue and white, the first three colors getting darker further down.
in the red surface, yellow letters say;
NIKI200
SPL-1.16.0000
CPLD-4
in the white surface it says;
Serial
now i've put my sim and SD back it, all of a sudden, this same trick now also works.
another thing; when i get this screen, it doesn't respond to any of the buttons on the phone.
does this mean anything to anyone?

---

no button work ... its normal ...

---

Entered the OemSbl
i could enter the OemSbl
version output:
Code:
OEMSBL VERSION: 1.58.21
OEMSBL Build Date: Dec 20 2007 12:11:48
PLATFORM: NIKE
PID: 30
PLATFORM ID: 4

---

isn't there a way to flash an SPL by using the RADATA command line, in an unlocked PDA?

---

...
why u want to do this?

---

Very Good!

---

Valvarin said:
why u want to do this?
Click to expand...
Click to collapse
Because my pda is stucked into OEMSBL: NO Os, No Radio and NO BOOTLOADER to load

---

what have you done?
Task a2? Are you shure that all partitions are deleted?

---

Yes, task 2a
If you look into kaiser,General section you'll find the log of mtty.
I hope all is deleted.
By the way, radata a part, i hope that also QSPT can do something.
Related topics: "Another dead Kaiser?" and "It's the true brick" (Kaiser,General section )
sorry, no links because i'm with mine old hermes

---

....
a unbricker will come in few days. no other things about this sorry

---

Valvarin said:
a unbricker will come in few days. no other things about this sorry
Click to expand...
Click to collapse
What time ?

---

Valvarin said:
a unbricker will come in few days. no other things about this sorry
Click to expand...
Click to collapse
Have u a unbricker?

---

My htc tytn2 dead or not? will try tonight need help to resolve this?
I install hard spl and unlock my tytn 2(i mean kaiser) then i go to flash full wwe rom after proces complete 100% my phone not boot ,can not go in tri-color bootloader and does not charge or any light ,hard reset also not work. Only i can see when put in usb cable detect in my compiuter data inteface driver i install Drivers MotoQ usb driver my compiuter now detecect qualcom chip and i see now com port 4 and com port 5 im mtty command what command i need first time to use to recover my tytn 2. I mean do i need first to enter setboot 1 and after setboot 0.
Please respond to know and sory for my bad english.

---

I also have this problem, but I do with my decision "Cruise". if anyone has found a solution please share it.
Thank you!