Develop Bugs

How To Modify Security Level in Tornado?

Hi guys,
I'm new to the forum and not very savvy in the lingo and specifics of XDA development.
I have a Tornado smartphone and I'm trying to flash an image to it. Unfortunately the current image has a Security Level which does not allows to flash my image to the phone. This is the optput I get when connecting to the phone through USB (using mtty) in bootloader mode:
Code:
Cmd>set 32
set 32
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
rtask a
- SD Controller init
+StorageInit
CMD55 failed
g_cKeyCardSecurityLevel = FF [COLOR="Red"]<<<--- I guess this is the problem[/COLOR]
HTCE
Cmd>l gentorn.bin
l gentorn.bin
clean up the image temp buffer at 0x8C080000 Length 0x03B00000
MTTYDownloadImageNot allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>
I've been browsing all arround the forum and finding a lot of information and tools but since I'm not very familiar with the internals of these things I have not been able to clear this flag in order to flash my image.
I'll appreciate very much if somebody here kindly helps me to achieve this.
Thanks and Best Regards
Kalep.

Bump......

No answer? Bump...

Is your phone CID and application unlocked?

Flash ROM using SPL commands

In the Excalibur forum we are struggling to flash a file to a particular offset in NAND (samsung onedisk flash). The file is 4Mbyte and was dumped with bkondisk (by itsme). Deploying pof's ideas, I have patched Excalibur SPL which bypasses vendor/model and signature checking and raises security level to 0. Using this SPL the flash commands can be used w/o restrictions
A similar patched bootloader exists for Vox S710. That SPL includes same commands as the Excalibur SPL.
The SPL offers 2 commands to interactively flash files from MTTY: ls ("load signed"??) and lnbs ("load new binary signed"??)
Afaik the commands are invoked as:
Code:
lnbs [pathname [StartAddr [Length [SkipOffset ["cp"]]]]]
ls [pathname [StartAddr [Length [SkipOffset ["cp"]]]]]
The question is what format the files must have and how to figure out start address. I found some info in the Hermes Wiki. I also suggested Excalibur various tests:
1. The file test3.nbs in this case has a 0x20 byte header ("R000FF") which includes data blocksize and signature size and flag. But somehow it doesn't like the start address of which I also don't know how to figure it out for the various ROM parts. How was that done for Hermes? (reversing SPL or sniffing USB)
Code:
Cmd>lnbs test3.nbs 500a0000
clean up the image temp buffer at 0x8C080000 Length 0x03900000
MTTYDownloadImage "test3.nbs"
:F=test3.nbs
start download
S
HAddress A0000000h Length 0040034Dh
Start Address out of boundary
checking image header
2. The file test.nb w/o any header, just the 4MB binary file with no modifications
Code:
Cmd>ls test.nb 500a0000
clean up the image temp buffer at 0x8C080000 Length 0x03900000
MTTYDownloadImage "test.nb"
:F=test.nb
start download
S
HAddress A0000000h Length 00400000h
Start Address out of boundary
checking image header
3. The file test2.nbh with a full .nbh header and given type 0x300 (GSM Radio code, although the 4MB file also includes config and simlock data etc.). This was actually the most succesful since it passed mosts tests in the SPL. So it seems a valid file, but it couldn't be confirmed that anything was flashed at all.
Code:
Cmd>lnbs test2.nbh 500a0000
clean up the image temp buffer at 0x8C080000 Length 0x03900000
MTTYDownloadImage "test2.nbh"
:F=test2.nbh
start download
S
HAddress 00000000h Length 0040054Dh
Start Address out of boundary
checking image headerFirst MTTY record empty
Image Download Finish... please check your image
Please reset the device to restart the program!!
DownloadImage success.
Can anyone with more knowledge about this subject please drop some feedback? Thx!
Cheers
JockyW
Edit: I totally forgot about the wdata command which is used by the official RUU. It can not be used interactive from MTTY, but it is possible to use it from self written programs. I think the idea is that only signed .nbh files (which include ROM type information in the header) can use be flashed using this command:
Code:
wdata length checksum
Once all data and the last signature (flag == 2) has been sent to SDRAM and all CRC and sig checks are passed the flashing process starts. The funny thing is that the help text of wdata suggests that also unsigned data can be flashed or be dropped at any memory location. Is this intentional deceiving by HTC ??
Code:
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).

while flashing test2.nbh, wlan data doesn't be modified.
jockyw2001's question is very important to find our wi-fi back. plz help us!Thanks!
details about our problem and what we have done can be seen at http://forum.xda-developers.com/showthread.php?t=328690

jockyw2001
You may use method imei-check - they for flash of the area CID have changed address of the flash splash screen - hereinafter they form file nbh (consists only of splash screen) with necessary area CID.

arc said:
jockyw2001
You may use method imei-check - they for flash of the area CID have changed address of the flash splash screen - hereinafter they form file nbh (consists only of splash screen) with necessary area CID.
Click to expand...
Click to collapse
Ah great! You've got a link as well? Thx!

Hi jocky,
interesting thing..
why don;t u try its utils for the above and check..
issue pdcocread -l command and get the header and rom address.
then try with lnbs or ls command to flash back.From whatever I know, lnb and lnbs/ls command can b used when yr device is Super CID.
While flahing ROM, RUU issues set le 1 command and write the ROM using wdata command.You can check these things, with USB monitor

hdubli
The commands lnb and lnbs different -
lnb - load the unsigned code.
lnbs- load signed code -have other structure and headline

hdubli said:
issue pdcocread -l command and get the header and rom address.
then try with lnbs or ls command to flash back.From whatever I know, lnb and lnbs/ls command can b used when yr device is Super CID.
Click to expand...
Click to collapse
hi,
pdocread -l returns:
Code:
>pdocread.exe -l
58.82M (0x3ad1000) DSK1:
| 2.09M (0x217400) Part00
| 3.20M (0x333000) Part01
| 53.53M (0x3586800) Part02
59.31M (0x3b4f000) DSK2:
| 59.06M (0x3b0e800) Part00
...
You mean the values in parantheses?
On excalibur only signed data is accepted by ls or lnbs (dunno the difference between the two. Anyone?).
I disassembled spl and found the startaddress boundary check routine. In it I see the hardcoded nand address boundaries which have no resemblance whatsoever with pdocread.
I'm now checking arc's hint to patch splash screen flashroutine in same way as imei-check does it. I just hope I can use ls and lnbs (with USPL of course), since that would be far more comfortable

Unable to flash S620 with signed .nb0 file

Hello guys!
I've got S620 unlocked by imei-check.co.uk. Currently with official HTC WM6 English rom onboard.
I have a signed .nb0 file (49mb).
Trying to flash -> get multiply errors.
I press 'camera' button, connect USB cable. USB is disabled in activesync.
MTTY screen is the following:
Cmd>set 32
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
***** user area size = 0x7940000 Bytes
SDInit---
SDInit OK
g_cKeyCardSecurityLevel = 0
Cmd>lnbs flash.nb0
clean up the image temp buffer at 0x8C080000 Length 0x03900000
MTTYDownloadImage "flash.nb0"
:F=flash.nb0
start download

S
HAddress A0000000h Length 0310659Eh
Start Address out of boundary
checking image header
---------------------
It seems i should enter 'right' bootloader start address after "lnbs flash.nb0" command - any clues, how to find it?
And one more question: why when i enter "lnbms" command i receive unknown command in return?
Thanks,
Alexey

modified/pached hpRUU.exe for ipaq hw6915.

modified/pached hpRUU.exe?
--------------------------------------------------------------------------------
i would like to know if somebody here already have patched or modified the original hpRUU.exe for the ipaq hw69xx series in order to allow uploading a different ROM-image(e.g different language etc.) to the device.
as far as i know it would be enough to disable the pre-check and jump directly to the start of the flashing routine itself.
i tried In each method this already by myself, but it seems it isn't as easy as i thought.
any help is appreciated...
In the appendix has HP iPAQ hw6900 Mobile Messenger Series ROM Update
BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...18&mode=2&taskId=135&swItem=PSG_I23843-109104
1.download GSM BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...sId=1822489&swLang=8&taskId=135&swEnvOID=2067
2.download all ROM BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...18&mode=2&taskId=135&swItem=PSG_I23843-109104
my icq:381-821-742
my msn:[email protected]
Now,my ipaq hw6915 reatar On demonstrates NO GSM underneath the screen !
Under the picture was I has attempted a method, is not all good .
best regards,
Caoxt

What means do some people know to be possible backup GSM RADIO?
What means do some people know to be possible backup GSM RADIO?
caoxt said:
modified/pached hpRUU.exe?
--------------------------------------------------------------------------------
i would like to know if somebody here already have patched or modified the original hpRUU.exe for the ipaq hw69xx series in order to allow uploading a different ROM-image(e.g different language etc.) to the device.
as far as i know it would be enough to disable the pre-check and jump directly to the start of the flashing routine itself.
i tried In each method this already by myself, but it seems it isn't as easy as i thought.
any help is appreciated...
In the appendix has HP iPAQ hw6900 Mobile Messenger Series ROM Update
BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...18&mode=2&taskId=135&swItem=PSG_I23843-109104
1.download GSM BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...sId=1822489&swLang=8&taskId=135&swEnvOID=2067
2.download all ROM BIOS from that link:
http://h20000.www2.hp.com/bizsuppor...18&mode=2&taskId=135&swItem=PSG_I23843-109104
my icq:381-821-742
my msn:[email protected]
Now,my ipaq hw6915 reatar On demonstrates NO GSM underneath the screen !
Under the picture was I has attempted a method, is not all good .
best regards,
Caoxt
Click to expand...
Click to collapse

Continuation ......................
Continuation ...............

same here
I had same problem with sable_ruu.exe and even though I had
*correct* radio rom, it could not re-flash it after previous flash
failure

Has the warm-hearted person to solve the problem again .
Hi,Please look at here:
http://forum.xda-developers.com/showthread.php?t=353414

Recent clue, Similarly passes on 6915
Recent clue, Similarly passes on 6915
Specially orders reads to flash RADIO has the help:
password
set
erase
task
lw
rtask
The HP IPAQ 6515 uses the boot loader2 password to unlock the full help menu in the serial console interface. It does not allow access to more commands than before and simply shows help for more commands.
If you are interested in viewing the commands there are a couple of passwords that would unlock it depending on your exact 6515 model.
• BOOTLOADER
• BEETLES
• 0000000000000000 - (16 x 0s) password for level 1 which unlocks additional RUU functions
Personally, both BOOTLOADER and 0000000000000000 worked fine for me on a HP IPAQ 6515e and you can enter level 1 directly with 0000000000000000
USB>password BOOTLOADER
HTCSPass.<Y-HTCEUSB>password 0000000000000000
HTCSPass1.CM^EHTCEUSB>
If you typed the wrong password, you will get
USB>password 0000000000000000
HTCSInvalid password
Similarly passes on 6915 !
This is a use MTTY Connection of me exploring the IPAQ 6515e’s bootloader firmware
USB>? full
Available monitor commands are:
? [command] [full]
h [command] [full]
r [[register] [[=] [hex_value]]]
eb Addr
eh Addr
ew Addr
mb [StartAddr [Count [Filler]]]
mh [StartAddr [Count [Filler]]]
mw [StartAddr [Count [Filler]]]
string [Type [String]]
info [Type [Value]]
password [string]
l [path_name [startAddr offset ["cp"]]]
lnb nb-file [StartAddr [Length [SkipOffset ["cp"]]]]
ppdl [startAddr offset["cp"]]
s StartAddr Count Pattern...
map
cp reg# OPC_2 CRm [value]
stress [Type [Count(Hex)]]
d2s [StartAddr [Len [Type [Append[SkipStartAddr SkipLen]]]]]
s2d
set [Type [Value]]
task [Type [Value [Value1]]]
shmsg [Row [Col ["String"]]]
rbmc [FileName [StartAddr [Len]]]
erase [StartAddr [Len]]
wdata [StartAddr [Len]]
checksum [StartAddr [Len]]
prouter [PortID1[Baud1[PortID2[Baud2]]]]
lw [path_name [startAddr offset ["cp"]]]
rtask [Type [Value]]
rroute [UART Path1[Baud Rate1[UART Path2[Baud Rate2]]]]
USB>? set
Usage:
set [Type [Value]]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
If value is not given, default is 0.
Type 0(Echo on/off): 1(on) and 0(off).
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 3(Inverse on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Type 8(COMM queue flag): 0(TX_RX disable),1(RX enable),2(TX enable) and 3(TX_RX enable).
Type 1E(RUU command read/write flag): 1(unlock) and 0(lock).
Current flag settings:
Type 0(Echo flag): cEchoFlag=(0x1).
Type 1(Operation mode flag): cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x1).
Type 3(Inverse flag): cShowInverseFlag=(0x0).
Type 4(Front color): g_wFColor=(0x0).
Type 5(Background color): g_wBColor=(0xFFFF).
Type 6(Set color of screen): None.
Type 8(COMM queue flag): g_cCommQueueFlag=(0x0).
Type 1E(RUU command read/write flag): g_cRUUCommandRWFlag=(0x0).
USB>? info
Usage:
info [Type [Value]]
Type(hex) 0: Get platform name(16 bytes) and [value](hex) is ignore.
Type(hex) 1: Get bootloader version(16 bytes) and [value](hex) is ignore.
Type(hex) 2: Get device CID(8 bytes CID with 8 bytes dummy data(0x20)) and [value](hex) is ignore.
USB>info 4
HTCS L?3?HTCE
USB>info 5
USB>info 0
BEETLES
USB>info 1
0.21
USB>info 2
USB>info 8
USB>? rtask
Usage:
rtask [Type [Value]]
Type(hex) 0: Reset radio and [value](hex) is ignore.
Type(hex) 1: Turn on radio, lease use type 3 and 4 instead.
Type(hex) 2: Turn off radio and [value](hex) is ignore.
Type(hex) 3: Run radio image and [value](hex) is ignore.
Type(hex) 4: Run radio bootloader and [value](hex) is ignore.
Type(hex) 7: Radio AT Command Debug.
Type(hex) 8: GSM trace route.
Type(hex) 9: Run radio external bootloader and [value](hex) is ignore.
Type(hex) A: Radio image flash by external bootloader and [value](hex) is ignore.
Type(hex) C: Select debug path.
Type(hex) D: Radio AT Command with GSM trace route.
Type(hex) 10: Set radio external boot UART mode(fast(1)/normal(0)).
USB>? task
Usage:
task [Type [Value [Value1]]]
Type,Value and Value1 are both DWORD(hex).
Value and Value1 are ignore in some case.
Type(hex) 0: Do hardware clear boot with delay time and [value](hex) is a delay time(unit is ms).
Type(hex) 7: Do flash ROM lock/unlock and [value]: 1(lock) and 0(unlock).
Type(hex) 8: Software reset with delay time and [value](hex) is a delay time(unit is ms).
Type(hex) 3C: Set terminal COM port baud rate.
Type(hex) 46: Force BT enter test mode.
USB>? lnbs
Usage:
lnbs nb-file [StartAddr [Length [SkipOffset ["cp"]]]]
Download nb file to ROM.
StartAddr : Start address for downloading(default=80000000).
Length : Length for downloading(default=FFFFFFFF).
SkipOffset : SkipOffset for downloading(default=00040000).
cp : Compare image with file data only.
USB>? d2s
Usage:
d2s [StartAddr [Len [Type [Append[SkipStartAddr SkipLen]]]]]
Backup memory to storage.
StartAddr : Start address for backup(0xA0040000).
Len : Length of memory will be backup. And if not given value, it will be
Total ROM size on board - ((StartAddress & 0x0FFFFFFF) - (ROM base address(0) & 0x0FFFFFFF)).
Type : Which storage(cf/sd) type will be selected(cf).
Append : Backup methods(a/).
SkipStartAddr : Start address of skip area(0x0).
SkipLen : Skip length(0x0).
Skip area must be less than or equal to one block size of flash.
Skip area must not over two blocks, must inside one block.
Nand flash: Skip area size need be page boundary.
Nor flash: Skip area size need be DWORD boundary.
DOC flash: Skip area size need equal to MBLOCKLEN(32kB).
USB>? s2d
Usage:
s2d
Restore memory from storage.
USB>? lw
The same as "l" command, but download to radio flash memory.
Usage:
lw [path_name [startAddr offset ["cp"]]]
Download BIN file across from serial/USB port.
Startaddr offset(MSB bit is a sign bit): Start address offset of every packet in bin file.
When 'cp' is given, it will just compare data of file with ROM image.
When path_name is not given, the file to be downloaded is determined
by ppfs on the host.
Otherwise, path_name on the host is downloaded regardless the ppfs setting.
The file must be in the format of BIN (preprocessed SRE).
USB>? password
Usage:
password [string]
Enter the password string to enable full help and command functions.
Enter the password string1 to enable some command functions related to RUU.
USB>rtask 8
GSM Trace Route.
Wait 2413 ms
USB>rtask 1
Please use type 3 and 4 instead.
USB>? task 32
Syntax error!
Usage:
? [command] [full]
Helps on command.
When no command is given, output a list of normal commands.
If "full" option used, display all commands(need password enable).
But if one command is given, It will show the command usage method.
USB>? erase
Usage:
erase [StartAddr [Len]]
Erase the contain of flash ROM.
StartAddr : Start address of ROM(default(hex)=A0040000).
Len : How many bytes will be erased(default(hex)=40000).
USB>rtask a
Radio image flash by external bootloader.
HTCS??6ú??HTCE
The IPAQ froze and I had to reboot the IPAQ before I could reconnect.
USB>password 0000000000000000
HTCSPass1.CM??HTCEUSB>? rtask
Usage:
rtask [Type [Value]]
Type(hex) 0: Reset radio and [value](hex) is ignore.
Type(hex) 1: Turn on radio, lease use type 3 and 4 instead.
Type(hex) 2: Turn off radio and [value](hex) is ignore.
Type(hex) 3: Run radio image and [value](hex) is ignore.
Type(hex) 4: Run radio bootloader and [value](hex) is ignore.
Type(hex) 7: Radio AT Command Debug.
Type(hex) 8: GSM trace route.
Type(hex) 9: Run radio external bootloader and [value](hex) is ignore.
Type(hex) A: Radio image flash by external bootloader and [value](hex) is ignore.
Type(hex) C: Select debug path.
Type(hex) D: Radio AT Command with GSM trace route.
Type(hex) 10: Set radio external boot UART mode(fast(1)/normal(0)).
USB>rtask a
Radio image flash by external bootloader.
2.12.00484830000EF23CB887AC20E08199E335&HTCE
Links
• HOWTO: Change serial number and model number for HP IPAQ 6515
• HP IPAQ 6515 Bootloader password
• HP IPAQ 6510 / 6515 dead GSM after failed Firmware upgrade
http://blogs.unbolt.net/index.php/brinley/2007/07/09/howto_change_serial_number_and_model_num_6515
http://blogs.unbolt.net/index.php/brinley/2007/08/12/hp_ipaq_6515_bootloader_password
http://blogs.unbolt.net/index.php/brinley/2007/07/31/ipaq_6515_dead_gsm_after_failed_firmware

Continuation.....................................

caoxt said:
Continuation.....................................
Click to expand...
Click to collapse
Here:http://forum.xda-developers.com/showthread.php?t=337975&page=10#91
http://forum.xda-developers.com/showthread.php?t=337975&page=10#99

i downloaded ipaq hw 69xx english_update_unit.zip into my ipaq hw6915 and the phone just went of showing just the hp logo, serial/usb and v g 39. pls what can i do to revive my phone. i will appreciate any assistaance. my mail box is [email protected]

Artemis stuck at bootloader - help to recover please

Hi
I've picked up a second hand Artemis. Unlocked it from T mobile and run USPL. When flashing the Andrew82 WM6.1 ROM, it has rebooted, but now sits at the white TMobile start screen displaying:
IPL 1.13.0001
SPL 1.13.0000
GSM 02.49.90
OS 3.15.0.0
It won't see activsync so I can't reflash the rom.
It will load to bootloader but I don't know what to do next to recover it.
A hard reset only returns to the T mobile start screen.
I have copies of mtty, terratty available, and have downloaded the T Mobile rom ART_TMOUK_11311001_024990_WWE_Ship_R3.exe.
How do I get the rom onto the phone?
Help would be appreciated.
Thanks

...
Cmd>password BsaD5SeoA
Cmd>runruu 1
this should flash..
flash original rom, uspl did ot work!
spl = 1.11.cmon
or
spl = 1.11.0000
click uspl on my sig to download spl 1.11.cmon.. this flashes no matter the rom size..
pm me if you get stuck..

Thanks for the prompt reply.
I've set the phone to bootloader, started Mtty (with activesync set to no usb), and opened the mtty process.
Entering password BsaD5SeoA
I get
Pass.
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
CMD55 failed
g_cKeyCardSecurityLevel = 0
HTCEType (0x1)(Operation mode flag): cOpModeFlag=(0x0).
Type (0x2)(Back color flag): cBackColorShowFlag=(0x1).
Type (0x5)(Background color value): g_wBColor=(0xC618) (0xC0C0C0).
HTCST
When I enter runruu 1
I get
Invalid command : runruu 1
Any Ideas ?
Thanks

...
shubbie said:
Thanks for the prompt reply.
I've set the phone to bootloader, started Mtty (with activesync set to no usb), and opened the mtty process.
Entering password BsaD5SeoA
I get
Pass.
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
SDCmd55 Command response time-out. MMC_STAT = 80
CMD55 failed
g_cKeyCardSecurityLevel = 0
HTCEType (0x1)(Operation mode flag): cOpModeFlag=(0x0).
Type (0x2)(Back color flag): cBackColorShowFlag=(0x1).
Type (0x5)(Background color value): g_wBColor=(0xC618) (0xC0C0C0).
HTCST
When I enter runruu 1
I get
Invalid command : runruu 1
Any Ideas ?
Thanks
Click to expand...
Click to collapse
Cmd>runruu 1

Sorry, no joy.
but at Cmd>runrru1
mtty returned, invalid command.
The phone is now a grey screen with a loading bar showing, but stuck at 0%.
PM me if will make things quicker, from my end XDA is running very slow at the moment. (probelbly decause I'm in darkest Lincolnshire !)

Sorry, no joy.
but at Cmd>runrru1
mtty returned, invalid command.
The phone is now a grey screen with a loading bar showing, but stuck at 0%.
PM me if will make things quicker, from my end XDA is running very slow at the moment. (probebly because I'm in darkest Lincolnshire !)

...
shubbie said:
Sorry, no joy.
but at Cmd>runrru1
mtty returned, invalid command.
The phone is now a grey screen with a loading bar showing, but stuck at 0%.
PM me if will make things quicker, from my end XDA is running very slow at the moment. (probebly because I'm in darkest Lincolnshire !)
Click to expand...
Click to collapse
try
Cmd>runnruu0
Cmd>ResetDevice

...
shubbie said:
Sorry, no joy.
but at Cmd>runrru1
mtty returned, invalid command.
The phone is now a grey screen with a loading bar showing, but stuck at 0%.
PM me if will make things quicker, from my end XDA is running very slow at the moment. (probebly because I'm in darkest Lincolnshire !)
Click to expand...
Click to collapse
run the ruu

Thanks
runruu0 reported as invalid command as well.
DeviceReset rebooted the phone, and it now boots to the bootloader screen, and nothing else.
when you say "run ruu" do you mean the rom update utility? As this doesn't work as it says the phone is not connected.

All fixed !
Great thanks to raving_nanza - he really helped me out with great advice.
Finally solved by flashed the t mobile original rom via the RUU with activesync set to no usb. Flashing from SD card not successful, but back up and running now.
Now I can get back to the reall target, flashing to WM 6.1 !!

...
glad to help dude..
when you do uspl make sure you spl is
1.11.cmon
if it aint that then you might brick again..
click uspl 1.11.cmon on my signature to download
i suggest the rom too
good luck

...
im gona do a dump of all my stuff (cabs, roms etc) for artemis on 4shared.. ill send you the link when its done dude..