GSM Shop GSM Shop
GSM-Forum  

Welcome to the GSM-Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features.
Only registered members may post questions, contact other members or search our database of over 8 million posts.

Registration is fast, simple and absolutely free so please - Click to REGISTER!

If you have any problems with the registration process or your account login, please contact contact us .

Go Back   GSM-Forum > Product Support Sections > Hard/Software Products (official support) > Easy-Jtag

Reply
 
LinkBack Thread Tools Display Modes
Old 05-21-2013, 17:30   #1 (permalink)
Product Supporter
 
NoName®'s Avatar
 
Join Date: Mar 2005
Location: China
Posts: 3,165
Member: 129885
Status: Offline
Sonork: 100:1603514
Thanks Meter: 5,503
Smile JTAG Finder guide in pictures : HAIER C200


Hi all , we get an some CDMA device to our lab , and I want to share with you fresh tutorial of full JTAG discovery in 10 minutes:



Finding JTAG may need some steps before you solder any pins ;-)
You need some additional tools like multimeter

[IMG]http://4.bp.********.com/-GbDO8OqTJ8Y/UEyboG-xbUI/AAAAAAAAChY/HmedxGWOWbo/s1600/Multimeter.jpg[/IMG]

Before soldering we need to probe some important PINS:

GROUND ( Must be always connected to PIN20 )
BATTERY+ ( Must be excluded from search , because high currect may break box logic )
RESET ( Must be excluded from search , because powers off JTAG and finder may fail to detect JTAG. )

For this i've made more detailed photo of testpoint area


With MULTIMETER in diode probing mode I am detected ground pin (blue) and
reset pin ( violet) Every time if you touch this pin phone go in restart.
GND and BATTERY TPs are easy to detect by multimeter , they directly wired on battery terminals.
NRST are easy to detect while looking on phone screen and tapping all testpoints one by one. Phone will
restart every time you tap NRESET pin. Most powerful method are connect testpionts to GND via 1kOm resistor
but in most situation enough to tap by tweezers or multimeter probe.

I am marked them on picture :


Then I am numbered rest of test points on PCB and soldered them to EasyJTAG box header one by one:


Connected phone to power source and tried to search pin out - and it was succeseful All JTAG pins are detected , and we know position of GND and NRST before.



Next step to solder one of free pins ( ex. PIN1 ) to reset TP , define SRST to PIN1 in software and try to connect phone like nearest models with same MCU : QSC6010 For example as HAIER HC-C2030.



Now we got success connection from first try ;-)



And finally we get HAIER HC-C200 JTAG Pinout World First by Z3X TEAM :


Last edited by NoName®; 05-21-2013 at 20:09.
  Reply With Quote
The Following 8 Users Say Thank You to NoName® For This Useful Post:
Show/Hide list of the thanked
Old 05-21-2013, 19:05   #2 (permalink)
No Life Poster
 
mr.omphonx's Avatar
 
Join Date: Feb 2008
Posts: 2,064
Member: 714648
Status: Offline
Sonork: 1609640
Thanks Meter: 882
Donate money to this user
easy jtag is very easy and good box jtag of the year 2013


Br
  Reply With Quote
Old 05-21-2013, 19:51   #3 (permalink)
Insane Poster
 
Join Date: Oct 2012
Location: USA - 1st Comm
Posts: 75
Member: 1831560
Status: Offline
Sonork: 100.1638533
Thanks Meter: 65
Easy Guide, thanks !!
  Reply With Quote
Old 06-17-2013, 05:58   #4 (permalink)
Insane Poster
 
Join Date: May 2012
Location: USA
Posts: 61
Member: 1754897
Status: Offline
Sonork: 100.1622738
Thanks Meter: 2
Easy JTAG Finder Question

I am attempting to locate the pinout on an LG MS910. I was able to get Easy JTAG to identify the pins in Stage 1, but when looking for TRST in Stage 2, it identified Pin 2 as TRST, which was identified as TCK during Stage 1.

Here is the log:
Start Z3X Jtag Pin Finder...
Successefuly connected to box on COM39
Waiting for box reset...
Box S/N: 00000000BXXXX (it's valid)
Box Working Mode: JTAG Pin Finder.
Start Z3X Jtag Pin Finder...
Stage 1: Search TCK / TMS / TDI / TDO...
Get IDCODE...
JTAG Pinout Found: TCK: Pin 2 / TMS: Pin 7 / TDI: Pin 8 / TDO: Pin 6
CPU IDCODE : 0x27B360E1 Mfg.: 0x070, Part: 0x7b36, Ver.: 0x2
CPU Manufacturer: QUALCOMM , CPU Name: MSM8255 Scorpion Rev 2.0
Stage 2: Search TRST...
TRST Pin Found: TRST: Pin 2
Box S/N: 00000000BXXXX (it's valid), ,FW Ver.: 01.44
Box Working Mode: JTAG Box.

So is pin 2 TCK or TRST? if TCK, how do I find TRST. If pin 2 is TRST, how do I find TCK?

During this test, BAT. and NRST WERE NOT connected to the Easy-JTAG box. Pin 20 was set to GND.

Suggestions?
  Reply With Quote
Old 06-17-2013, 08:54   #5 (permalink)
Product Supporter
 
NoName®'s Avatar
 
Join Date: Mar 2005
Location: China
Posts: 3,165
Member: 129885
Status: Offline
Sonork: 100:1603514
Thanks Meter: 5,503
Hi , offcource PIN2 are TCK and TRST has been detected wrong. At this moment you can try to select TRST pin on different position manyally. This CPU are multicore and detecting pinout on such CPUs will be improved in next box firmware.
  Reply With Quote
The Following User Says Thank You to NoName® For This Useful Post:
Old 06-28-2013, 19:24   #6 (permalink)
Freak Poster
 
alfin5557's Avatar
 
Join Date: Sep 2005
Location: R474 5VS
Posts: 320
Member: 176999
Status: Offline
Thanks Meter: 30
very simple for repair dead boot
  Reply With Quote
Old 07-21-2013, 12:17   #7 (permalink)
Junior Member
 
Join Date: Jan 2012
Posts: 23
Member: 1713721
Status: Offline
Thanks Meter: 4
It could be used to find the port jtag or EJTAG, MIPS based systems?.
As many cable modems, satellite box, etc. ..?
  Reply With Quote
Old 07-22-2013, 00:04   #8 (permalink)
Product Supporter
 
NoName®'s Avatar
 
Join Date: Mar 2005
Location: China
Posts: 3,165
Member: 129885
Status: Offline
Sonork: 100:1603514
Thanks Meter: 5,503
Quote:
Originally Posted by haute View Post
It could be used to find the port jtag or EJTAG, MIPS based systems?.
As many cable modems, satellite box, etc. ..?
Hi , EJTAG are just extension on IEEE JTAG - finder function must work on MIPS
  Reply With Quote
The Following User Says Thank You to NoName® For This Useful Post:
Old 07-29-2013, 19:47   #9 (permalink)
Junior Member
 
Join Date: Jan 2012
Posts: 23
Member: 1713721
Status: Offline
Thanks Meter: 4
is there any manual or pdf that talks about debugging features easy-jtag box?
  Reply With Quote
Old 08-04-2013, 22:20   #10 (permalink)
Product Supporter
 
NoName®'s Avatar
 
Join Date: Mar 2005
Location: China
Posts: 3,165
Member: 129885
Status: Offline
Sonork: 100:1603514
Thanks Meter: 5,503
Quote:
Originally Posted by haute View Post
is there any manual or pdf that talks about debugging features easy-jtag box?
Hi what function you need , we can implement basically functions , gdb server etc.
  Reply With Quote
Old 08-05-2013, 10:07   #11 (permalink)
Junior Member
 
Join Date: Jan 2012
Posts: 23
Member: 1713721
Status: Offline
Thanks Meter: 4
Hello, primarily seek support for Garmin GPS.
I think there is a very similar jtag port on all Garmin gps.
Do not know if it would be possible to get a shematic of some garmin gps model to verify. The phones are many schematics, but no gps.
To debrick and support debug, like functions (breakpoints, step, read registers etc. ..)

thx for your interest.
  Reply With Quote
Old 08-07-2013, 05:57   #12 (permalink)
Freak Poster
 
viniicell's Avatar
 
Join Date: Feb 2009
Location: lake
Posts: 318
Member: 983215
Status: Offline
Thanks Meter: 47
Quote:
Originally Posted by NoName® View Post
Hi , offcource PIN2 are TCK and TRST has been detected wrong. At this moment you can try to select TRST pin on different position manyally. This CPU are multicore and detecting pinout on such CPUs will be improved in next box firmware.

Hello,

the cable for Jtag header[ gpgcable=10pins] if you take out v+ and Gnd pins you are left with 8pins to work with for searching pinouts. Now my question is, in the above Haier c200 example you have numbered the pin pads on the phone board from 1 to 14 and they are all possible pinouts and we are having only 8pins from the header cable which if we solder there will be still six tp on pcb left empty which might be part of the correct pinouts. How do you solve that? how do you have all the tpoints wired if they are 14....12...0r 15 so you avoid pin search failed and many endless trials?

the header has 20 pins in total but you have numerous GND and NC its like you can not expand it to increase the number of pins for searching to atleast 12 or 18? or is it possible?

b.r viniicell
  Reply With Quote
Old 08-31-2013, 02:41   #13 (permalink)
Freak Poster
 
diyong's Avatar
 
Join Date: Feb 2013
Posts: 139
Member: 1883757
Status: Offline
Thanks Meter: 36
wow complete thread thanks
  Reply With Quote
Old 09-02-2013, 03:15   #14 (permalink)
Freak Poster
 
Join Date: Dec 2012
Location: Brazil
Posts: 216
Member: 1859706
Status: Offline
Sonork: 100.1648492
Thanks Meter: 24
Can I use this guide to make full dump of chinese cell phones?
  Reply With Quote
Old 11-02-2013, 08:56   #15 (permalink)
Freak Poster
 
Join Date: Nov 2010
Age: 29
Posts: 379
Member: 1442627
Status: Offline
Thanks Meter: 108
plz anyone add karbon a5 pinout plz
  Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


 



All times are GMT +1. The time now is 12:55.



Powered by Searchlight © 2017 Axivo Inc.
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
- GSM Hosting Ltd. - 1999-2015 -
Page generated in 0.41169 seconds with 7 queries

SEO by vBSEO