Related
Greetings,
About 2 months back i decide to root my phone, so i do, and i go Flash MIUI.
It's worked perfectly fine for 2 months now, with an exception of phone attemting to play with 2 music players and hanging and ultimately rebooting when volume controls were operated on the headset.
A minor glitch? Possibly, i didn't mind.
Yesterday though, while playing through bluetooth on my cars stereo, the hanging-rebooting kept happening quite often, ie. everytime i disconnected it to get out.
Still, didn't sense anything majorly wrong there, so moving on.
Yesterday night i kept my phone for charge, overnight,. In the morning the alarm rings, device vibrates, i put snooze it, and go back to sleep.
When i wake up in an hours tome, my phone wont boot.
It vibrates 3 times and led blinks in red.
My warranty got over yesterday though it was anyway void, since i put a custom ROM on it.
I did, search the threads but whoever bothered to reply, had their warranty on and were on stock ROM.
If there's anything i could do, please do help me out
Also, my computer wont detect my phone (Says USB device may have malfunctioned), is there anyway to revert to stock ROM with S-OFF so htc would fix it?
My phone was o/c'd to 1.2 GHz while i was on lordm0d's 8.6 Kernel. Any chances the o/c burn the processor or anything?
Hi Omairss,
can you enter bootloader ? (pressing vol down when powering up)
The red light means there is a power issue. Do you have access to another battery to try?
pudel211 said:
Hi Omairss,
can you enter bootloader ? (pressing vol down when powering up)
Click to expand...
Click to collapse
No, i can't enter the bootloader or recovery. If I try though, the phone vibrates 5 times and puts out a steady green light.
If i connect it to my laptop, it shows up as 'Unknown Device".
Gizmoe said:
The red light means there is a power issue. Do you have access to another battery to try?
Click to expand...
Click to collapse
Okay, i'll try that and let you know.
I went to htc's service center and they told me the phones been water damaged and that the whole motherboard needs replacement which would cost about 188$.
I haven't dropped the phone in water or let it anywhere near water as far as i know, and the void stickers are all black & white, except one in the motherboard, whose edges are slightly red.
Hi Omairss, i wish you a happy new year !!
Water damage can also happen because of sweat when carrying the phone near the body...
Perhaps worth trying before a 188$ repair:
Remove battery and cover, SD-card and cover and put the phone in a plastic bag together with lots of rice. Place the bag in a warm place for 3-4 days. The rice will bind the water.
Then try again also with another battery, Li-Ion batteries dont like water...
Let us know if it helped.
-Pudel
the unknown device, is it something to do with 'qload'. if so, its bricked, only fix is a mainboard swap out, or a jtag based flash and re-partitioning of the eMMC.
pudel211 said:
Hi Omairss, i wish you a happy new year !!
Water damage can also happen because of sweat when carrying the phone near the body...
Perhaps worth trying before a 188$ repair:
Remove battery and cover, SD-card and cover and put the phone in a plastic bag together with lots of rice. Place the bag in a warm place for 3-4 days. The rice will bind the water.
Then try again also with another battery, Li-Ion batteries dont like water...
Let us know if it helped.
-Pudel
Click to expand...
Click to collapse
Cool, i'll try that and let you know.
And happy new year to you too
JSLEnterprises said:
the unknown device, is it something to do with 'qload'. if so, its bricked, only fix is a mainboard swap out, or a jtag based flash and re-partitioning of the eMMC.
Click to expand...
Click to collapse
What's qload?
Well, the htc guys told me the same thing - a motherboard swap.
I don't know what a 'jtag based flash or re partitioning of emmc is, but it has got to be cheaper than a 188$ replacement? Anyway i can do it?
Also, what do you think would have caused it? Could overclocking have anything to do with it? I mean it could save other phone's heading towards a hardware failure, if it does, right?
Omairss said:
What's qload?
Well, the htc guys told me the same thing - a motherboard swap.
I don't know what a 'jtag based flash or re partitioning of emmc is, but it has got to be cheaper than a 188$ replacement? Anyway i can do it?
Also, what do you think would have caused it? Could overclocking have anything to do with it? I mean it could save other phone's heading towards a hardware failure, if it does, right?
Click to expand...
Click to collapse
Well, Depends on how high you oc'd could have possibly caused a controller failure or something, but we dont know.
Usually its a failure of some sort with the emmc. In my case, the partition table was corrupted (either by cwm recovery, or some other random bug) My experience, and then found the driver, but were not able to go any further using qpst tools.
Google 'RIFF Box', thats the jtag based restoration I mentioned. There are a user or two on xda that offers riff box jtag services, I just cant remember which... and thats only if something corrupted the partition. But if its a hardware failure, then you'll have to get the mainboard replaced.
JSLEnterprises said:
Well, Depends on how high you oc'd could have possibly caused a controller failure or something, but we dont know.
Usually its a failure of some sort with the emmc. In my case, the partition table was corrupted (either by cwm recovery, or some other random bug) My experience, and then found the driver, but were not able to go any further using qpst tools.
Google 'RIFF Box', thats the jtag based restoration I mentioned. There are a user or two on xda that offers riff box jtag services, I just cant remember which... and thats only if something corrupted the partition. But if its a hardware failure, then you'll have to get the mainboard replaced.
Click to expand...
Click to collapse
Well, now even the usb connection stopped working. Guess it's the 180$ mainboard replacement for me.
Well, about the overclock, i had overclocked it to 1.5 Ghz and was using the conservative governer, so it would overclock only if it had to.
I had the battery widget installed as well, so it would write logs to my SD card. Couldn't find anything abnormal in the mA, mV, mW, or temp values, prior to the brick, So, clearly my processor wasn't running at full throttle or anything, else it would've reported a spike in either mA, or the temperature atleast.
Would sending pictures of my mainboard help you diagonise, after i replace it?
Hi All
I am so sad about this
Today one of my Arabian friends was trying to flash my custom rom
He had an error in the middle of Rc1 file
I wasn't online so he was on his own on this
He took out the battery and then his Wave is dead !!!
WTH would Rc1 file flashing kill the phone ?!!!!
does it appear that there is any damaged hardware ??
any ideas how to resolve this ???
Thanks in Advance
Best Regards
Did his battery go flat during the flash?
No
It was fully charged as he said
Also when he connects the phone to the charger it gets hot after a while
Best Regards
What happened bro ??
My first Wave 1...
Untouched, unmodified, never flashed...
If I press off...
After again press on. Battery shows empty...
Also I know that removing battery could empty battery...
This happens also to me with different handsets... since 2006 I know this.
For example SXG75, EF81 and few others... other manufacturer...
So be 100 % sure that battery is full...
RC1 alone is harmlos...
Only if maybe writing process are interrupt... and maybe wrong section erased...
Check battery of your friends handset.
Best Regards
1-2. ESD(Electrostatically Sensitive Devices) Precaution
Several semiconductor may be damaged easily by static electricity. Such parts are called by ESD
(Electrostatically Sensitive Devices), for example IC,BGA chip etc. Read Precaution below.
You can prevent from ESD damage by static electricity.
Click to expand...
Click to collapse
Taken from Service Manual...
As I am very paranoid.
I NEVER remove battery and put it back if USB cable is attached with PC/Notebook...
Maybe this could also reason for sideeffects...
Best Regards
Hi there,
my problem is as shortly described in the topic.
The device drains between 50-190mA in an OFF state depending on the voltage applied.
I used a lab power supply to check it.
The procedure to measure it is:
0) perform repair using PC Companion - the device is completely clean
Model: LT18i
Android version: 4.0.4
Kernel: 2.6.32.9-perf
Build: 4.1.B.0.587
It has been upgraded from its factory version quite some time ago.
The drain problem started long after the upgrade.
1) Installed (just for formality): Battery Widget, Battery Stats Plus, OsmAnd, GPS Test, Total Commander
- the rest is usual bloatware that installs itself
1) switch off all possible functions (plane mode, WiFi OFF, BT OFF, ...)
- no alarms, no calendar notifications
2) power down the phone
3) take out battery, SIM card and SD card
4) connect power supply directly to ± battery connectors on the phone
5) no other cables connected (neither the battery)
6) apply voltage 4.2V (190mA) -> 3.0V (33mA) in 0.1V steps
Let me stress it again - the phone is in OFF state - no power button pressed, no attempt to boot it.
At this state I would consider 10mA normal, but definitaly not 200mA.
I have done a bit more measurements, but I don't think it is of use now.
As I mentioned above, the problem started suddenly, long after I upgraded to a newer OS version.
I noticed it since the phone started heating, which I could feel in the pocket.
Now, a bit about the heating. It seems that the source of it is a chip that I have identified as a Flash memory.
It sits around the top left under a metal shield when looking from the back of the phone,
after unscrewing the plastic mid-part. It is worm even in OFF state (no charger, just battery).
It gets very warm when the phone is ON and "unpleasantly" warm when there is some activity
(I actually played with the camera).
Otherwise the phone is fine. I haven't noticed any problems with it.
I use it as a navigation, SD card and SIM inserted, but no service (I mean the SIM card is inactive).
Now the actual question - is there a SW way (I mean without desoldering anything) to possibly
correct this problem? Unfortunately my suspicion is that some power management component
must have failed and it keeps delivering power.
Any help will be appreciated. It is still quite a nice device.
Marcin
I had this problem with my device as well (not as specific as yours, i didnt do any diagnostics just noticed the battery was draining even when off and the same part remained warm) which was the main reason I upgraded to an N5. Brought it to a service centre they said motherboard damage (apparently caused by water but i can't think of any instant i exposed my phone to water unless its from the humid climate here). It's not the battery because i have 2 batteries and both has the same problem, and definitely can't be fixed with software.. From 1 month trying different ROMs kernels and mods trying to fix it.
Sent from my Nexus 5 using Tapatalk
Thanks tangosierra_, I have heard a lot of bad things about "authorised" service centers (of any kind).
I heard and read a lot of users complain about their lack of competence. They would always make sure
to void your warranty by showing you mechanical damage. If there is no damage, they would say
it was caused by water - why not? Everybody sweats - right?
Looking for some info about the flash chip (it is micron nw238) I came across this blog:
theelectronicfreak.blogspot.com/2011/08/sony-ericsson-xperia-arc-teardown-and.html
It seems to have a lot of interesting info in it.
For the moment I give up. It doesn't have to be this chip and I don't have enough experience
with such small devices. Resoldering a BGA of this size is beyond my capablities
**Just to be clear, I am not responsible for anything that goes wrong with your device but actually, your phone is pretty much useless with this issue if it isn't fixed so lets just give it a shot like I did**
So I bet a couple of you guys may heard of this issue, I'll be giving the link on what this issue is about (if i can find the link).
Do note that this fix will result in damaging the exterior of your phone if you don't do this carefully. Lastly before we begin, you'll lose a power button completely and switching it on requires your phone Charger and a few button combinations
Now in order to fix this, you'll need
• A plus-tipped screwdriver
• A flat head screwdriver (bigger ones are prefered)
• Your "unusable" Galaxy W
• A whole lot of patience
1st step is easy, just disassemble your phone till you have removed the Main Board. There is a guide you can follow to do this on YouTube by the Channel L355ON5 if im not mistaken
2ndly, when you get to the main board, flip over your board such that the main camera module is faced down.
3rdly, you're gonna find your power switch. When you found it, you can see that it is made of 2 colours orange and white.
4th, heres the tricky part, use your flathead screwdriver and apply pressure and scrape off the white part of the switch COMPLETELY. Its okay if you damaged your power switch because you won't need it anyways.
To check if your phone is fixed, you can clip the Display's flex cable into the main board, and then use your battery and connect it to the 3 pin contacts. If your phone did not boot, thats good news because from Keith's post (if you can find it) we know that if you try to insert the battery in the phone, it will automatically switch on by itself and that means that you haven't fix the issue nor solve anything really.
So lets say everything went correctly as mentioned above, you can now screw the parts back together.
So to turn your phone ON, connect your Phone to youe wall plug and then quickly press the button combination keys for going to Recovery Mode upon switching on you your wall plug switch. You shld then be able to go to Recovery Mode and reboot your device
Now all of this may sound scary to you but I've done all of these steps and I got my Wonder back exactly a year after I broke it. :sly:
Galaxy W 8150 Disassembly & Assembly: http://youtu.be/ZjcucJDzfmk
How to Easily Fix Defective Power Switch/Button for the Galaxy S3: http://youtu.be/3Glllc7bEJs
These 2 videos are where you should be watching before trying in case gd luck
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Just in case
Just in case
yakovpol said:
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
now??
yakovpol said:
Hi folks,
<snip>
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
Shorting either side to GND via a 1k resistor should not cause any harm.
I am going to take a stab in the dark and the say 0_1_6 of the boot config is bit 0/1/6 of the boot chart, E:V:A's documentation into bootloaders should allow you to match the boot order chosen.
EDIT My PDF viewer didnt show the chart at first, displayed here for speed
Code:
Config 1 Config 0
0 0 EMER. BOOT(SDC3 FOLLOWED BY USB HS)
0 1 SDC3 FOLLOWED BY SDC1
1 0 SDC3 FOLLOWED BYSDC2
1 1 SDC1 (eMMC, DEFAULT)
Config 6
0 Secure Boot
1 Fast Boot
Secure boot can be controlled via GPIO or QFUSE, if QFUSE is used then gpio options wont matter even if stilll present on the board. Early models may have not had the qfuse blown until the device had been proven which may mean some devices will load a hex file no problem and others wont. (educated assumption)
if you are using a oscilloscope then you should watch these GPIO's at power up and also record your DMESG for changes in the PID/VID of the device,
use this code to see a live view of DMESG when devices are sending their PID/VID
Code:
sudo tail -f /proc/kmsg
use CTRL+C to stop.
I've looked into some of the sources that would have been supplied to the manufacturer for them to develop with and there is options for them to alter the fail to boot behavior except the CPU PBL, this is why having no bootloader at all might work where having a failed bootloader wont.
I suggest also try other HEX files, not all are made equal.
darkspr1te
darkspr1te said:
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
......
I suggest also try other HEX files, not all are made equal.
Click to expand...
Click to collapse
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
yakovpol said:
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
Click to expand...
Click to collapse
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot. This could still be controlled by a qfuse or they may have shorted to gnd this point making it secure, removing the resistor to gnd and replacing with one to 1.8v/3.3v would always force fastboot.
you should find this on the diagram and board (sorry , time my side is limited)
measure this resistor to ground with device powered . The same for the others once you have found them.
EDIT:- Manual says they are powered from Q6000, so check for the actual precence of R6007, if it's missing then that gpio does not get power and boots in secure mode not fastboot.
darkspr1te
darkspr1te said:
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot.
...
Manual says they are powered from Q6000, so check for the actual precence of R6007
Click to expand...
Click to collapse
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
yakovpol said:
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
Click to expand...
Click to collapse
For most of the repair nothing will show on the screen, all the interaction is done via USB, the device will function without it for your purpose.
As we know that Q6000 drain is connected to our GPIO we can assume that on power up before the cpu is taken out of reset then power will be applied.
darkspr1te
FM Radio
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
yakovpol said:
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
Click to expand...
Click to collapse
VSS often means ground on IC's, VDD is power for IC's
PLL is Phase Locked Loop, this often refers to a antenna tunner,
at a Guess B2,B3,A2 goto ground, A1, A3 to power.
The diagram confirms this, A1,A3 get power from VDD_LN,
B1 is labled FM_RFIN, at a guess FM antenna IN, this normal is connected to headphones via some components(not sure exactly what parts)
You would need to not only check to see if the rquired hardware is there but also have access to the API/chip to switch on the FM input then decode it via the I2C audio channel which will mean changes to the kernel (trust me there, i had same issue with a Rockchip device with FM chip)
NOTE: the page 235 shows the BGA pinouts, not all may be connected on the board.
darkspr1te
QFUSE is not used!
Some good news here.
After some preparations I finally tried to boot the motherboard with putting BOOT_CONFIG_6 to TRUE. And I could get
USB HID v1.11 Device [HID 05c6:f006]
as a result. But it doesn't stay such, it enumerates once again to 05c6:f006, then switches to 05c6:f008 and remains so.
What I did is:
Unfortunately, I do not have soldering iron tidy and small enough for putting a wire on a resistor which provides BOOT_CONFIG_6 for the CPU. So I simply took a piece of wire sodered to a resistor 1K and connected two pins on sides. While I was holding pins connected to + and CPU side of the resistor, my wife connected a USB. At the same time I was watching
watch -n1 "lsusb | grep 05c6"
and
tail -f /var/log/kern.log
What I found: 1) the battery should be attached in order to get 05c6:f006; 2) pins are not sharp enough, needles should be used; 3) I should probably change the signal on other BOOT_CONFIG_0 and BOOT_CONFIG_1 to have it booting from external SD-card.
The questions: should I hold BOOT_CONFIG_6 on TRUE during all process long, or it will be enough for a few seconds? Or should I press some buttons during the moment when I have 05c6:f006?
As for the Antenna input of U29001 MDM9215M (FM_RFIN, B1), it is next to the edge/side of chip. Theoretically it is possible to connect there a wire, because there's a gap in between motherboard and the chip. But I'm sure special tools needed here and sides are covered by glaze.
Seems to be no profit in f006
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
yakovpol said:
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
Click to expand...
Click to collapse
That TP could be the DAT0 test point which stop the device from actually detecting a EMMC flash and will cause it to only follow the PBL. can you give me some timings on when the device switches USB VID/PID, like 1 sec on 9006, two on 9006.
The boot happens the moment the device see's power, normally for just getting the cpu up the usb power is enough although a few times i found that was not enough and had to use battery but that may have been usb port (front are poor for power) or the desktop itself.
as the boot path is emmc - sdcard - pbl in that order, if you notice that only changing one of the boot_0/1 skips the first boot option which is emmc so only one need to be targeted, see captive dev thread on unbrickable mod to get the basic idea of that , i think i posted that link a few posts back.
darkspr1te
To be continued
Long story short: I was very busy because of my work/obligations and did not write here in April.
I needed the phone much, so I tried to find an appropriate technician where I live now. I gave the phone to him, and he requested US$80 for repair. I refused and took the phone back. Then I realized that that technician used JTAG and phone became hard hard brick (100% dead, no 9008 state or any other sign of life). Removing lot of fluxing material I discovered short circuit between two JTAG contacts. I removed it and the phone came back to the hard brick state. Meanwhile I purchased Medusa Box (along with shipping and taxes it cost me US$128) and used it for so called USB repaire (the software knows HEX and all other things needed to work with e980's APQ8064T QDL mode, no JTAG needed). The phone came back to life.
I would sniff USB bus during communication with the phone in QDL mode and continue finding a way to boot it from sdcard. And I want to get FM radio working.
A chance to get HEX file
Recently I had to use testpoint on the motherboard to enter QDL mode again. I took the opportunity to sniff USB traffic while using Medusa box for restoring the bootloader, so I hope in the PCAP files I have HEX file is present. If someone wants to help me to extract it, please let me know with a private message or give me a hint how to do it.