RIFF Box – JTAG Revolution

10.01.2012   Samsung GT-i8150 Galaxy W (Samsung Ancora) Unbrick – Boot repair supported

Resurrecting Samsung I8150 is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Please note, MSM8255T is dual core chipset – it has ARM11 and Qualcomm Scorpion cores. During power on sequence only ARM11 core is visible on the JTAG chain. If boots are not completely damaged and it comes up to initializing of the Scorpion core then Scorpion core appears on the JTAG chain too. This will shift ARM11 from TAP0 into TAP1 position on the chain, while current resurrector has the ARM11 core hardcoded at TAP0 position. Thus make sure to establish JTAG connection in the time range while Scorpion core is not visible yet.
To resurrect Samsung I8150:

•  Solder JTAG cable to Samsung I8150 JTAG pads;
•  Make sure Samsung I8150 is selected in the list of models;
•  Insert battery and connect USB Data cable;
•  If you use only battery, press Power On key;
•  Click Resurrect button;
•  Wait till software signals a successful operation completion;
•  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

•  Disconnect PC cable;
•  Insert battery;
•  Hold ‘Volume Down’ key and press ‘Power ON’ button.

_

16.12.2011 Direct JTAG Access to Flash Memory Plugin v1.00

Release info:

This plugin performs direct access to a flash memory used in the selected target. No DCC Loader is used here, thus it is completely independent of target hardware implementation (RAM memory availability, visibility, addressing and layout, core clocking, etc.). Main disadvantage is a noticeable data exchange speed decrease comparing to the DCC Loader’s data exchange speeds (approximately 10…20 times slower).

With the help of this plugin you can do:

• Read selected flash memory range;
• Write selected flash memory range;
• Erase selected flash memory range.

Currently supported memory controllers are:

• OneNAND Memory (connected directly to the MCU’s address space);
• CFI Compliant NOR Memory with CFI Command sets 0×0001, 0×0002, 0×0200 and 0×0003;
• NAND Controller in MSM6250, MSM6250A;
• NAND Controller in QSC6055, QSC6085, QSC6240, QSC6270;
• NAND Controller in MDM6085, MDM6200, MDM6600;
• NAND Controller in MSM6245, MSM6246, MSM6270, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6290, MSM6800A, MSM6801A;
• NAND Controller and OneNAND Controller in MSM7225, MSM7227, MSM7625, MSM7627;
• NAND Controller in MSM7200, MSM7200A, MSM7201A, MSM7500, MSM7500A, MSM7501A, MSM7600;
• NAND Controller in QSD8250, QSD8650;
• eMMC Controller #2 in MSM7230, MSM8255, MSM8255T;
• eMMC Controller #0 in S5PV310;

Currently supported chipsets and cores for JTAG I/O operations:

• Generic ARM Cores: ARM7, ARM9 (ARM920, ARM926, ARM946), ARM11, CORTEX-A8,CORTEX-A9;
• Qualcomm QSC Family: QSC1100, QSC1110, QSC6010, QSC6020, QSC6030, QSC6055, QSC6085, QSC6240, QSC6270;
• Qualcomm MSM Family: MSM6000, MSM6150, MSM6245, MSM6246, MSM6250, MSM6250A, MSM6260, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6800A, MSM6801A, MSM6290, MSM7225, MSM7227, MSM7625, MSM7627, MSM7230, MSM8255, MSM8255T, MSM8260;
• Qualcomm QSD Family: QSD8250, QSD8650;
• Qualcomm ESM Family: ESM7602A;
• Qualcomm MDM Family: MDM6085 MDM6200, MDM6600;
• OMAP Family: OMAP1710, OMAP3430, OMAP3630, OMAP4430;
• NVIDIA Family: TEGRA2;
• Marvell/XScale Family: PXA270, PXA271, PXA272, PXA310, PXA312, PXA320.
• Samsung Processors: S5P6422, S5PV310.

Memory reading/programming logic is almost same as is performed on the DCC Read/Write page in the JTAG Manager – Main and Spare fields, Auto FullFlash size detection, ability to flash image files (for NAND)., etc. Users familiar with the DCC Read/Write page features will not be required to learn almost anything new in order to be able to use this plugin. Thus it means data files read from memory by this plugin (partial or full flash image) can be flashed back through the DCC Read/Write page, and vice versa.
Here, it is user’s task now to know such info about target as what exact MCU is used in current device, what memory is used (NAND, OneNAND, NOR, eMMC/SD, MDOC or other), which component of target system can see this memory (for example NAND memory is usually visible to MCU’s Embedded Memory Controller, while NOR is directly accessible by the MCU itself; OneNAND memory in most cases is directly accessible by MCU but sometimes it can be visible via MCU’s Embedded Memory Controller).

Please note main differences with the DCC Read/Write methods:

• Exact chipset (MCU) name selection is required;
• Memory type selection is required (for example: NAND or NOR memory);
• Which component of target system can see this memory (for example: MCU itself or MCU’s Embedded Memory Controller): the ‘Memory Type & Host’ setting;
• Memory Controller Mode is introduced here (while on DCC Read/Write page in the JTAG Manger the Memory Controller Mode was automatically chosen depending on ROMi Address Space selected). Many Qualcomm NAND Controllers are widely configurable, for example they allow for firmware to select any desired position of bad block marker byte inside of NAND page’s main or spare area, and upon reads/writes this byte will be handled by controller itself, making it ‘invisible’ in the NAND page data. Thus reading NAND with configuration different to the one used by the manufacturer for writing data into this NAND memory (firmware for example) will result in 1 byte to be erroneously read or lost. In many cases (by many manufacturers) the default bad block marker position is configured to be at offset 0x01D1 in the page’s main area (abbreviated Memory Controller Mode you will see in the list as this: “M:0200/S:10/BM:01D1” – meaning NAND controller to be configured for main area 0×0200 bytes, spare area 0×0010 bytes, bad block marker position in main area (BM) at offset 0x01D1 (BM:01D1)); other most common case is for bad block marker to be at position 0×0006 in spare area (such abbreviated Memory Controller Mode you will see in the list as this: “M:0200/S:10/BS:0006” – meaning NAND controller to be configured for main area 0×0200 bytes, spare area 0×0010 bytes, bad block marker position in spare area (BS) at offset 0×0006 (BS:0006));

• During NAND read operations, if ECC Module Enable is checked, the ECC status is checked too. Thus make sure to disable ECC checks during reads unless you’re in need for an advanced operation.

Short Manual how to Read/Write/Erase memory:

• Select chipset (MCU) used in the current target (for example MSM6280);
• Select memory type and it’s host (MCU or MCU’s Embedded Memory Controller);
• Setup TCK/RTCK frequencies, JTAG I/O Voltage levels, target’s core position on the JTAG scan chain (TAP#);
• Connect target device to the RIFF BOX, make sure it has power, and click Connect & Flash ID button to ensure target device is connected and selected memory is initialized and visible;
• All further actions are completely same as is done when using DCC Read/Write page features.

Most common errors which can happen during direct read/write operations:

• The NRST signal is neglected by user. Please take into account that NRST signal is the most important one. Making system reset helps debugger (RIFF BOX) to establish device into 100% pre-known hardware state, which guarantees that a MCU’s memory controller selected by user will be configured as it should be and successful memory access will be established;
• Cannot connect to selected memory (Connect & Flash ID): check NRST signal; check Reset Method in settings; make sure proper MCU, memory type and controller is selected in settings; in case NOR or directly accessible OneNAND memory is selected make sure valid memory base is set;
• “Resetting and Halting Target…” fails: make sure device is powered and power on key (if present) is pressed during this stage; some devices like HTCs based on the MSM8255 chipsets are fused, and JTAG may be enabled only by started firmware – thus you may need to vary the Reset Method settings: disable reset at all (which is not desirable though) or adjust higher waiting time after system is reset by the NRST signal assertion to the moment when an attempt to HALT core is made (for fused HTCs based on MSM8255 this is 670 ms and more);

19.11.2011  – QUALCOMM MDM6600 NAND Generic DLL released

Whats new:

• QUALCOMM MDM6600 NAND DLL

Use this for phones which have MDM6600 in baseband – eg LG P999, iPhone 4s, and many other phones which use TEGRA2 AP CPU.

• QUALCOMM MSM7227 OneNAND DLL (2kb page)
• QUALCOMM MSM7227 OneNAND DLL (4kb page)
• QUALCOMM QSC6xxx OneNAND DLL

All other QUALCOMM Generic DLL-s are now under same branch, so here is full revised list :

• ESM7xxx L41 D04 NAND
• MDM6600 NAND
• MSM6xxx L06 D02 NAND
• MSM7227 L41 D08 OneNAND
• MSM7227 L41 D08 OneNAND 4k
• MSM7xxx L41 D04 NAND
• MSM7xxx L41 D08 NAND
• QSC1100 x14 NOR
• QSC60xx L18 D08 NOR
• QSC6xx L20 D08 NOR
• QSC60xx L24 D08 NOR
• QSC6xxx L32 D08 NAND
• QSC6xxx L36 D08 NAND
• QSC6xxx L36 D08 OneNAND
• QSD8xxx L41 D04 NAND

26.10.2011  Samsung Galaxy S Plus (i9001) Unbrick, boot repair supported

Resurrecting Samsung I9001 is easy. Phone is auto powered on with USB Data Cable connected to the PC while battery is connected.
Please note, MSM8255T is dual core chipset – it has ARM11 and Qualcomm Scorpion cores. During power on sequence only ARM11 core is visible on the JTAG chain. If boots are not completely damaged and it comes up to initializing of the Scorpion core then Scorpion core appears on the JTAG chain too. This will shift ARM11 from TAP0 into TAP1 position on the chain, while current resurrector has the ARM11 core hardcoded at TAP0 position. Thus make sure to establish JTAG connection in the time range while Scorpion core is not visible yet.

To resurrect Samsung I9001:

•  Solder JTAG cable to Samsung I9001 JTAG pads;
•  Make sure Samsung I9001 is selected in the list of models;
•  Insert battery and connect USB Data cable;
•  If you use only battery, press Power On key;
•  Click Resurrect button;
•  Wait till software signals a successful operation completion;
•  Disconnect power supply, de-solder JTAG wires;

Now phone is in bootable condition, that is, even if it does not start up normally you can flash it using known flashing methods.

To enter download mode:

•  Disconnect PC cable;
•  Insert battery;
•  Hold ‘Volume Down’ key and press ‘Power ON’ button.

24.10.2011  Samsung i520 PDA and Modem parts supported

The Samsung i520 has PDA and Modem modules. The PDA Module is based on the OMAP2430 Processor, and Modem Module is based on the MSM6275 Processor. Both modules are working independently and thus firmware (boot zones) may be damaged either in one of them or in both.
Please note, if alive PDA Module always stays at splash screen upon power up then firmware of the Modem Module is damaged.
Charged battery is required for successful JTAG connection. Do not use an external power supply.

To resurrect Samsung i520 PDA Module please do:

•  Solder JTAG cable to the Samsung i520 PDA pads;
•  Insert battery;
•  Make sure Samsung i520 is selected in the list of models,
•  Click Resurrect button;
•  Press ‘Power ON’ key;
•  Wait till software signals a successful operation completion;
•  Disconnect USB cable, de-solder JTAG wires;

Below are the steps which we do ourselves to resurrect a dead i550 modem:

•  Solder two JTAG cables to PDA and Qualcomm pads;
•  Connect USB data cable to phone and PC;
•  Insert battery. LCD shows Samsung logo;
•  Make sure Samsung i550 Modem is selected in the list of models, then click Resurrect button. The resurrection module will ask first to attach RIFF JTAG connector to PDA JTAG;
•  Step finished successfully, now the module asks to attach RIFF JTAG connector to MSM (modem) JTAG;
•  Resurrection sequence started, modem is being flashed;
•  Software signaled a successful operation completion;
•  Remove battery and put it back again;
•  Now phone starts booting, no more permanent Samsung logo.
•  De-solder JTAG wires.

Now phone is in bootable condition, that is, even if it does not start up normally, you can flash it using original Samsung downloader software to restore it to the working state.

To different download modes:

•  Disconnect PC cable and insert battery;
•  Hold both ‘1’ and ‘4’ keys and press ‘Power ON’ button: do not release keys until phone will enter PDA Download Mode.
•  Hold both ‘4 and ‘7’ keys and press ‘Power ON’ button: do not release keys until phone will enter All Download Mode.
•  Hold both ‘7 and ‘*’ keys and press ‘Power ON’ button: do not release keys until phone will enter Modem Download Mode.

For firmware re-flash we used Apollo 2.80 software – the original Samsung Apollo flasher. Please note, if modem part is damaged you will need to use Modem Module resurrector before starting all firmware reflash.

06.04.2011    CDMA QUALCOMM QSC1100 Generic DLL released

Resurrector QSC1100 X14 contains only DCC Loader, thus it is to be used only for operations on DCC Read/Write page in the JTAG Manager.
Embedded DCC Loader is designed to work inside of MCU’s internal RAM memory, thus it is not sensitive to external SDRAM configuration or availability or its physical state.

Initial H/W init sequence will setup MCU’s PLL with these parameters:

• Clock Multiplier = 0×14

Since few different versions of QSC1100 resurrector may exist (with different multiplier values) you may select the one which suits best to your device.

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

06.04.2011  CDMA Micromax C111 Boot repair supported

Resurrecting Micromax C111 is simple. Board is auto powered on when battery is inserted and USB cable is connected.
There are 2 different hardware revisions of this phone – one is based on Qualcomm QSC1100 MCU and other – is Qualcomm QSC6010 MCU. Current resurrector shall be selected if you have QSC1100 revision.
Resurrector re-flashes only firmware zone of the phone (0×000000 to 0x6FFFFF).

To resurrect Micromax C111:

• Solder JTAG cable to Micromax C111 JTAG pads;
• Connect ignition cable for auto power on or use battery;
• Make sure Micromax C111 is selected in the list of models;
• Click Resurrect button;
• Wait till software signals a successful operation completion;
• De-solder JTAG wires;

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

Resurrector QSC60XX L24 D08 contains only DCC Loader, thus it is to be used only for operations on DCC Read/Write page in the JTAG Manager.
Embedded DCC Loader is designed to work inside of MCU’s internal RAM memory, thus it is not sensitive to external SDRAM configuration or availability or its physical state.

Initial H/W init sequence will setup MCU’s PLL with these parameters:

• L/M/N = 0x2A/0×00/0×01;
• Global Clock Divisor = DIV8

Resurrector QSC60XX L24 D08 contains only DCC Loader, thus it is to be used only for operations on DCC Read/Write page in the JTAG Manager.
Embedded DCC Loader is designed to work inside of MCU’s internal RAM memory, thus it is not sensitive to external SDRAM configuration or availability or its physical state.

Initial H/W init sequence will setup MCU’s PLL with these parameters:

• L/M/N = 0x2A/0×00/0×01;
• Global Clock Divisor = DIV8

You can use these two DLL-s with all QSC6xxx CPU devices with NOR flash.
(Any CDMA phones with Qualcomm QSC60xx CPU, with NOR flash chip)

10.02.2011 RIFF JTAG Manager v1.24, RIFF Box Firmware v1.18

Firmware 1.18
—————————
- PXA270 debug is now available in ARM/Thumb modes (use the GDBServer for this);

JTAG Manager 1.24
—————————
- In case when Resurrector has no DCC Loader the JTAG Manager will now report it correctly and will not allow DCC Read/Write features
- (SDK): more functions are now available (exported) for future Resurrector DLLs;
- Usefull Plugins Enabled
—————————

Qualcom FullFlash Image Processing Tool:

This plugin works with NAND image files which have generic Qualcomm layout

With help of this plugin you can do:
- Disassemble a full NAND image file previously obtained with JTAG Manager (DCC Read/Write Page);
- Inspect each partition contents (main zone and spare zone) simultaneously;
- Save separate partitions to HDD (only main zone, only spare zone, or both zones);
- Write a chosen partition directly into phone;
- Read a chosen partition directly from the phone and substitute old partition contents to new ones;

Please note, direct read/write operations from/to the phone will require proper resurrector to be set (Resurrector Settings: thus before clicking the Activate Plugin button make sure compatible model is selected as well as other settings like TCK/RTCK frequencies).

You can access it from “Usefull Plugins” TAB :

RIFF JTAG firmware supports following features at the moment:

This is result of six months hard work. And we just started -;)
Stay tuned for more !

This is list of supported memory controllers and chipsets and CPU cores using Direct Memory Access :

Currently supported memory controllers are:

• OneNAND Memory (connected directly to the MCU’s address space);
• CFI Compliant NOR Memory with CFI Command sets 0×0001, 0×0002, 0×0200 and 0×0003;
• NAND Controller in MSM6250, MSM6250A;
• NAND Controller in QSC6055, QSC6085, QSC6240, QSC6270;
• NAND Controller in MDM6085, MDM6200, MDM6600;
• NAND Controller in MSM6245, MSM6246, MSM6270, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6290, MSM6800A, MSM6801A;
• NAND Controller and OneNAND Controller in MSM7225, MSM7227, MSM7625, MSM7627;
• NAND Controller in MSM7200, MSM7200A, MSM7201A, MSM7500, MSM7500A, MSM7501A, MSM7600;
• NAND Controller in QSD8250, QSD8650;
• eMMC Controller #2 in MSM7230, MSM8255, MSM8255T;
• eMMC Controller #0 in S5PV310;

Currently supported chipsets and cores for JTAG I/O operations:

• Generic ARM Cores: ARM7, ARM9 (ARM920, ARM926, ARM946), ARM11, CORTEX-A8,CORTEX-A9;
• Qualcomm QSC Family: QSC1100, QSC1110, QSC6010, QSC6020, QSC6030, QSC6055, QSC6085, QSC6240, QSC6270;
• Qualcomm MSM Family: MSM6000, MSM6150, MSM6245, MSM6246, MSM6250, MSM6250A, MSM6260, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6800A, MSM6801A, MSM6290, MSM7225, MSM7227, MSM7625, MSM7627, MSM7230, MSM8255, MSM8255T, MSM8260;
• Qualcomm QSD Family: QSD8250, QSD8650;
• Qualcomm ESM Family: ESM7602A;
• Qualcomm MDM Family: MDM6085 MDM6200, MDM6600;
• OMAP Family: OMAP1710, OMAP3430, OMAP3630, OMAP4430;
• NVIDIA Family: TEGRA2;
• Marvell/XScale Family: PXA270, PXA271, PXA272, PXA310, PXA312, PXA320.
• Samsung Processors: S5P6422, S5PV310.

This is the list of available RIFF JTAG Resurrectors  DLL-s , which You can use for one click dead boot repair.
List will be updated with new releases, and this is only small part of models we will add.