HTC Hermes JTAG pins

[sundar]

Hi,

it's done!!!
Today i discovered the JTAG pins of HTC hermes.
My device got bricked and was not able to boot anymore. Not even the bootlader came up.
Anyway i decided to do some investigation, there was nothing to loose

Thanks to Lt.Cmdr.Ivan who discovered the JTAG pins on the universal hardware.
(It made the step successful!!!)

See the attachment!
(had to make a zip because high-resolution pix )
These are the testpoints to access Hermes main system Samsung MPU and recover OS bootloader!
To get access to the GSM chipset please have a look in the second post!

see attachment (backup package form samsung site, source code included)
See the documentation in the archive for information how to build a LPT adaptor, to use this software!

The software tool has been modified to handle the /WP issue.
See attachment MSP_HERM.zip!
What ever happens to IPL/SPL on your device, it can be recovered quite easily now, using the JTAG method!

Added Olipro's 2.10 (Hard-SPL V7) for completeness.
This is a pure binary file, ready to flash via JTAG. Thanks again to olipro for this beautiful bunch of bits!!

Thanks again to scholbert,pof, cmonex, cr2, the_dipe and the others who gave useful hints or helped testing.

[sundar]

Hi again,

after a lot of wicked things had been done with my device, i decided to lift another secret.
Anyway i spent some time to do some investigation and managed to trace the JTAG testpins of the GSM chipset on the hermes!

So it's done!
To be 100% secure, this has again to be verified with some software.
Work is in progress!

To solve the "noGSM" issue we need a bullet proof flash tool to rewrite the radio bootloader.

Hopefully we could get the necessary information to do so!
Maybe someday all these "no GSM" devices could be brought to life again...
at least if it's software related issue (e.g. broken Radio bootloader)!!!

See the attachment for the pin location!
(had to make a zip because high-resolution pix)

These are the testpoints to get access to the Qualcomm GSM chipset and possibly fix broken radio bootloader!

Information about missing signals
TRST_N = could not be found (seems to be N.C.)
RTCK = could not be found (will only be needed for special debugger)
Mode0 = N.C.

We need your help!
If anyone got information about the JTAG chain of MSM6275 (BSDL file) or similar info, please PM me!

[sundar]

at last i succeed very very thank to MR SCHOLBERT am realy happy to see my mobile alive again once again thx here is the screen shot

[cellsolution]

Ince info good work keep it up...........

[kernelguy]

Wow!  This is some great info...

I have a bricked Hermes (imate jasjam). The GSM stopped working sometime after the phone was dropped. The PDA part works just fine. I can connect with activesync, go to bootloader mode, flash OS, etc.  Flashing a radio ROM fails. The phone shows no IMEI number.

I would like to try the JTAG pins poke or some other hardware tweak to see if the GSM can be brought back to life. However, I have fat fingers and didn't quite disntiguish myself with a solder iron.

Is there a hobbyist who can help (may be for a fee). I don't have much to lose as I need a PDA phone and would have to buy another if I can't solve the no GSM error.

Regards