This was pulled directly from the XDA-Developers forums. Member Binary Droid gets 1000 hardcore points for this milestone discovery and has put us another step closer to resurrecting the Death SPL affected HTC Dreams!!!
Thread post from Binary Droid:
One Step Closer to De-Bricking Dreams – Long Awaited JTAG Testpoints!
JTAG Primary Pinout
These are the JTAG connection points I traced from the CPU to their test points. i’m almost 90% sure the Primary is still usable. Auxilary JTAG port is litterally impossible to get too even for the technicians that reprogram them at the factory. I didnt have much luck getting it to work but i’m posting up the pinouts so someone who has done this before can get a recovery procedure made to fix all bricked HTC-dreams.
Mode control pins are NC, cannot be traced anywere, i’m thinking they are done via software after the connection is made?
1 – to be posted
2 – to be posted
3 – to be posted
4 – to be posted
5 – to be posted
6 – to be posted
When you see were the pins for AUX are located you will see why I think thats not were the focus should be…their scattered in odd places, also have to remove the sim slot to access the last one which took forever to find.
Trackball has a hidden test point for the return clock as well, otherwise you need to solder directly to the connector on the main board.
AUX JTAG PORT WILL BE POSTED SOON AS I AM DONE WORK, it’s too busy here to be taking pictures and verifying everything.
I figured this should be in its own thread so those working on a solution can now focus on the software side of things.
Follow the action here: http://forum.xda-developers.com/showthread.php?t=591048
I received this message along with a debug application. I’ve began work and have confirmed the same results occur on my end. I’ll update again if any further progress is made.
David,
Uploaded that file for you… I’ve done some experimenting and found that the “blue light mode” is the serial port command interface. Connected to a fully booted working phone it responds to all the normal debugging commands. A list of these commands is attached for your reference. The bad news is that on a bricked phone the command interpreter dosen’t recognize any of the commands. It does however respond with “Invalid Command:”, so something is working there. I was never able to get QPST to recognize either a working or bricked phone, but I didn’t have much time to debug why. Maybe you’ll have more luck.
Keep me updated on your progress. I’d really love to revive this dead G1…
As some may know I spent most of my 20’s working heavily on sound design and engineering. I ended up selling off a lot of my studio equipment in order to make a substantial move from my home in Kansas City, MO to Dallas, TX. Lately I’ve been trying to get back into the grove of sound design and decided to throw together a few quick ringtones as a practice run with the leftovers from my previous studio setup. If I see some downloads and some comments of people liking them and wanting more, I’ll do some more. Otherwise, who knows what’s next.
As many of us experiment with out Android powered devices some have become infatuated with the abilities of the newer device and the abilities that they are starting to display. Those of us who were early adopters of this fantastic new platform are at the mercy of our MSM7201a chipsets on our HTC Dreams, T-Mobile G1’s or HTC Android Dev phones. We have become overly zealous and done terrible things by forcing bad SPL’s onto devices or simple reversing instructions when applying the Radio/SPL to mimic the hardware of the bigger Android cousins. This comes at a big price when something goes wrong and many of use have used the Haykuro “Death” SPL in order to run the Hero ROM or Sense UI on our G1’s and have ultimately and fully bricked our devices. Several of us on the Xda-Developers forum have been working on a fix for this over the last 6 months and are just now getting to a point of figuring out the delicate procedure of attaching a DIY JTAG interface to the main board of the device. This procedure requires extreme technical knowledge and precision execution in order to make it work correctly as we usually only have one chance per board attempted upon. This is the point where we are looking back to the community for help. We are on the hunt for a specific document as mentioned in the MSM7200A chipset training manual covering baseband topics.
This is the document we need:
JTAG Setup Procedure on MSM7500/MSM7200
(80-V9038-13)
File Format: .pdf
This document holds the final keys to executing a successful JTAG solution for the bricked devices. Please, all you master Google searchers and crazy hacker kids… if you suffer from the bricked G1 or just want something to do to pass the time, hunt for this document. We will love you long time! :p
Follow the conversation @ forum.xda-developers.com
Further evidence that Android is catching the attention of the younger crowds. Even babies are getting in on the action. This young’n is sporting the Android Dev Phone with Cyanogen’s 4.1.99 ROM and a panda bear onesie from Target.
**Update**
A few people have contacted me about this and we might have a way to continue to work on locating the pinout connection points. I’ll update in a new post and as always by Twitter and XDA-Developers once I have more information to share. Thanks for the continued support on this project.
After several attempts and painstaking hours trying to analyze this board I’m giving up trying to find a hardwire JTAG interface solution to the MSM7201a chipset. I am posting the recent photos of the board, please notice that the metal bracing that surrounds the critical IC’s of the board. This metal framework EMI shielding frame is a pain the a$$ to remove from the board. Once the frame was removed, forcefully with pliers and a mini-hacksaw I attempted to heat the board which led to a horrible aftermath. The board was essentially ruined once the framework was pulled off because it tore some of the circuit print off the board. err.
The rest of the gallery will be loaded to our Picasa web album. Please check the right sidebar under “Project Pics”.
Tony Hillerson is a mobile developer at Brightkite. He codes on the run, and on any given day he may be working with Objective-C, Java, Rails, Scala, and/or Ruby. In addition to his day job, Tony has contributed to many community projects, such as Brightkite and Twitter API libraries, and RubyAMF. He’s also been a featured speaker at 360|iDev, RailsConf, and local user groups. Tony is interested in usability and experience design at all levels, from the database to the server to the glass.
Remember, with any DIY project you run the risk of error and can cause permanent damage to your device, to yourself or to the planet. In any event I’m not responsible. Enjoy!
We got the wiki up and running at . Please keep it in your bookmarks as we will be busy updating as much content as we can about whatever we find useful. Right now there is a bit of information about emulating a hosts file entry for Windows Mobile by modifying the registry on device. Old info but still useful, especially with some new things I found while using Wireshark.
JTAG Tools2009/06/12 JTAG Tools is a software package which enables working with JTAG-aware (IEEE 1149.1) hardware devices (parts) and boards through JTAG adapter.
This package has open and modular architecture with ability to write miscellaneous extensions (like board testers, flash memory programmers, and so on).
I received this message along with a debug application. I’ve began work and have confirmed the same results occur on my end. I’ll update again if any further progress is made.
It does however respond with “Invalid Command:”, so something is working there. I was never able to get QPST to recognize either a working or bricked phone, but I didn’t have much time to debug why. Maybe you’ll have more luck.
Fed51