GSM Shop GSM Shop
GSM-Forum  

Welcome to the GSM-Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features.
Only registered members may post questions, contact other members or search our database of over 8 million posts.

Registration is fast, simple and absolutely free so please - Click to REGISTER!

If you have any problems with the registration process or your account login, please contact contact us .

Go Back   GSM-Forum > Other Gsm/Mobile Related Forums > GSM Programming & Reverse Engineering


GSM Programming & Reverse Engineering Here you can post all Kind of GSM Programming and Reverse Engineering tools and Secrets.

Reply
 
LinkBack Thread Tools Display Modes
Old 06-07-2008, 15:31   #1 (permalink)
No Life Poster
 
aikonmani's Avatar
 
Join Date: Jul 2006
Location: INDIA,TAMILNADU,PATTUKKOTTAI
Posts: 1,082
Member: 304090
Status: Offline
Thanks Meter: 210
What Is Jtag?-joint Test Action Group-fag


This may be useful for our members.........

1.What is JTAG ?


1.1.Where can I get more info about JTAG?



Future JTAG reading:
Here is a download of a 77-page JTAG tutorial from ASSET InterTech. If you'd like a hardcopy of this book sent to you, go to this page and provide your mailing address. You can find more information on JTAG at the ASSET InterTech website

Link to pdf of tutorial
http://www.asset-intertech.com/pdfs/...orial_2007.pdf

Link to mailing address form
http://www.asset-intertech.com/regis...cfm?lnk=primer

Link from ASSET to more JTAG resources
http://www.asset-intertech.com/bound...leadership.cfm

Also:

http://www.inaccessnetworks.com/proj...tag-intro.html

http://www.engr.udayton.edu/faculty/...tag/jtag1.html

http://www.circuitcellar.com/library...99/c109r12.asp

AVR specific
http://www.circuitcellar.com/library...d143/index.htm

Boundary-Scan Tutorial
http://www.ezytech.com/asset/pdfs/bo...n_tutorial.pdf


Very good repository of JTAG references:
http://uclinux.home.at ( got to "JTAGS" directory)
1.2.May I use JTAG interface for remote debugging?

YES , of course – it is what JTAG for!

Sometimes different terms are used, as following:
  • OCD ( On Circuit Debugger)
  • ICE (In Circuit Emulator)
  • BDM (Background Debug Mode)

Future reading
http://www.ocdemon.net/zenofbdm.pdf
1.3.May I use JTAG interface for FLASH memory programming?

YES , of course – it is what JTAG for!

1.4.What part of JTAG standard is CPU agnostic?

JTAG specification is in Std IEEE 1149.1 (costs about $100). I don't
have it. Please search at internet for some JTAG related documents.
This is good: http://www-s.ti.com/sc/psheets/ssya002c/ssya002c.pdf

JTAG state machine [insert here]
JTAG standard signal [insert here]
That's all! You just have to write software to go through the states of JTAG FSM (here is the state diagram of this FSM: http://www.inaccessnetworks.com/proj...hine-large.png). TCK and TMS are used to go through the states of FSM. And TDI is used to serially send through this interface your commands and data to JTAG controller on the IC (in your case, to the ARM uC) and read back reply through the TDO pin. The only problem is that some companies do not open all details about available custom JTAG commands (JTAG standard defines only 2 necessary commands: EXTEST and SAMPLE and some optional commmands like INTEST, BIST and others). For example, Texas Instruments do not give an access to the description of commands that are used for In-Circuit Debugging of their TMS DSPs. Instead of, they sell this JTAG ICD with simple software for about 1000$!!! Nice business - such a price for 4 wires and some I/O ICs! ;-)

1.5.What CPUs architectures have a build-in JTAG support?

AVR060: JTAG ICE Communication Protocol for 8-bit AVR Microcontrolers
http://www.atmel.com/atmel/acrobat/doc2524.pdf
ATmega128:JTAG Interface and On-chip Debug System, Page 245 to 272
http://www.atmel.com/atmel/acrobat/doc2467.pdf
Schematics for High-Speed BDM Pod for the Coldfire CPU
http://www.fortunecity.com/campus/ps...93/bdm/bdm.htm

ARM7TDMI build in ICE (see Chapter 5 and Appendix B)
http://www.arm.com/pdfs/DDI0210B_7TDMI_R4.pdf

1.6.JTAG support for ARM architecture?


ARM7TDMI build in ICE (see Chapter 5 and Appendix B)
http://www.arm.com/pdfs/DDI0210B_7TDMI_R4.pdf


1.7.What is a usual JTAG header pin-out?


More pin-outs see at http://www.ocdemon.net/pinouts.pdf
1.7.1.14-pin JTAG header

Usual pin-out for 14-pin JTAG header (often used for ARM)

1 -Vddh (+3.3v)
2 - Vss (ground)
3 - nTRST
4 - Vss (ground)
5 - TDI
6 -Vss (ground)
7 - TMS
8 -Vss (ground)
9 - TCK
10-Vss (ground)
11- TDO
12-nRESET (optional)
13- Vddh (+3.3v)
14-Vss (ground)

1.7.2.20-pin JTAG header

Usual pin-out for 20-pin JTAG header (sometimes used for ARM)
1 - Vddh (+3.3v)
2 - Vddh (+3.3v)
3 - nTRST
4-Vss (ground)
5 - TDI
6-Vss (ground)
7 - TMS
8-Vss (ground)
9 - TCK
10-Vss (ground)
11 --------
12-Vss (ground)
13 –TDO
14-Vss (ground)
15 – nRST
16-Vss (ground)
17---------
18-Vss (ground)
19---------
20-Vss (ground)

1.7.3.8-pin JTAG header

Usual pin-out for 8-pin JTAG header, often used for PLD programming
1 – vddh (+3.3v)
2 – TDO
3 – TDI
4 – nTRST
5
6 – TMS
7 – vss (ground)
8 – TCK

2.What hardware do I need to connect to the JTAG interface?

2.1.Where to buy JTAG adapter?

JTAG adapter can be purchased from multiple sources. Many embedded OS companies ( WindRiver and similar) are offering JTAG adapters with their debuggers and other testing software. Unfortunately, these packages are very expensive – usually a few thousand dollars.

Following companies have more or less reasonable product offerings

(Disclaimer: author(s) of this chapter have no direct commercial interest whatsoever in following companies.(Note: please do an appropriate disclaimer for new submissions if otherwise ))
2.1.1.Macraigor Systems LLS

Macraigor Systems (http://www.ocdemon.net/) is known as a vendor of reasonably inexpensive JTAG solutions. Their Wiggler ( $150) parallel port adapter became de-facto a standard for a simple buffered JTAG adapters. Due its simplicity , Macraigor Wiggler is easily cloned by home-made JTAGs ( see more in “How to build JTAG” section)

Macraigor Systems is offered a FLASH programming software ( $500), a free simple On-Chip-Debugger (OCD Commander - http://www.ocdemon.net/ocd_dbgr.exe ) and a free LibRemote daemon for interfacing GDB/Insight remote debuggers ( see CYGWIN version at http://www.ocdemon.com/Windows98NT/A...stallation.exe ).

2.1.2.AZ-Electronics

AZ_Electronics (http://az-electronics.com/item9.htm ) is offering a cheap ( $35) parallel port JTAG adapter.

2.1.3.JtagConnection

JtagConnection (http://www.jtagconnection.com/index.php) is offering a cheap ( $35-40) parallel port JTAG adapter.

2.1.4.Rowley Associates

Rowley Associates introduce its CrossConnect – USB 1.1 fast JTAG adapter with retail price of about £150.
http://www.rowley.co.uk/

2.1.5.Amontec

Amontec sells a very nice programmable JTAG dongle, the Chameleon POD.
It can be programmed as Macraigor Wiggler or Raven.
http://www.amontec.com/chameleon.shtml

2.2.How to build JTAG adapter?

http://www.lart.tudelft.nl/projects/..._schematic.pdf
http://www.lart.tudelft.nl/projects/jtag/

2.2.1.Macraigor Wiggler compatible JTAG adapters

http://jtag-arm9.sourceforge.net/circuit.txt

http://bh.udev.org/filez/wireless/sa...510-ver0.2.pdf

2.2.2.LART JTAG


http://www.lart.tudelft.nl/projects/..._schematic.pdf

http://www.lart.tudelft.nl/projects/..._Rev_X1.tar.gz (Gerber file )
2.2.3.Xilinx JTAG

http://www.plis.ru/pic/zip/JTAG_cable.pdf

A simplified non-buffered version may be found at http://axl.freeyellow.com/iPAQ/jtag.htm . Please note that not-buffered JTAG adapter has an increased posibility to damage your host’s parallel port circuit.

2.2.4.ALTERA JTAG

ALTERA ByteBlast Parallel Port Adaptor
http://www.altera.com/literature/ds/dsbyte.pdf

2.2.5.ColdFire BDM Pod

I've made by myself an High-Speed BDM Pod for the Coldfire CPU, i've
found the schematics at
http://www.fortunecity.com/campus/ps...93/bdm/bdm.htm

2.2.6.Serial Jtag

http://mspgcc.sourceforge.net/jtagF14x.pdf
http://cvs.sourceforge.net/viewcvs.py/mspgcc/jtag/


http://mspgcc.sourceforge.net/manual...html#pyserjtag


3.What software do I need to use JTAG for remote debugging?

3.1.OCD Commander

OCD Commander - http://www.ocdemon.net/ocd_dbgr.exe
3.2.LibRemote for GDB

CYGWIN version at http://www.ocdemon.com/Windows98NT/A...stallation.exe

How to use LibRemote for ARM under CYGWIN environment:
  • TBD
  • TBD
  • TBD
  • TBD

4.What software do I need for FLASH memory programming?


4.1.Intel JFlash

Original Intel program for memory flash for SA1110 dev board. Contains source for Windows utility JFlash.
http://www.intel.com/design/strong/s...ashKit_V12.exe

Works with LART JTAG parallel port adapter (see above).
4.2.JFlash for linux

As a part of LART project, this is a Linux port of Intel JFlash utility.
http://www.lart.tudelft.nl/projects/...h-linux.tar.gz

Some modifications and corrections from TuxScreen hacking project
http://cvs.sourceforge.net/viewcvs.py/tuxscreen/jflash/

Works with LART JTAG parallel port adapter (see above).
5.Open Source JTAG Software Projects

5.1.ARMTOOL from MIDORI distribution

Erwin Authried <eauth at softsys.co.at> is maintaining Embedded Linux & uClinux distribution (MIDORI distribution - http://cvs.home.at/midori/ ) . ARMTOOL is a small, but important utility in this distribution (some part of the source).

ARMTOOL (http://cvs.home.at/midori/sources/armtool/) is a very simple JTAG monitor that supports upload and download a binary image into memory and its execution. ARMTOOL is ARM7TDMI specific (some part of code is derived from GDBICE project), but may work with some of ARM9 cores (to be tested). Current version supports JTAG adapters compatible with Macgraigor Wiggler, Altera ByteBlasterMV and Xilinx Parallel port JTAG adapter.

In addition to ARMTOOL, MIDORI distribution includes patch for GDB/Insight debugger to use JTAG interface for remote debugging.

Also, BOOTLOADER module contain a simple ARM program which maybe used for flashing a new image into FLASH memory ( FLASHPROG).

5.1.1.HOWTO compile ARMTOOL

(outside of full MIDORI source tree)
http://hri.sourceforge.net/tools/armtool.html
Petr Novak wrote a patch that extends armtool capabilities: patch README (updated 20/Jan/2004)

5.1.2.HOWTO compile FLASHPROG

(outside of full MIDORI source tree)

5.1.3.HOWTO compile GDB/Insight

(outside of full MIDORI source tree)

5.2.GDBICE

GDBICE (http://sourceforge.net/projects/gdbice/) is and open source SW/HW project by Ramon Longo <rlongo at users.sourceforge.net>. It is an attempt to design JTAG remote debugging for ARM7TDMI cores. Unfortunately, this project was not pass above an initial “proof-of-concept” implementation and not supported anymore.
However, this project’s source code maybe useful for someone who need a crash introduction into JTAG and its ARM specifics.

5.3.JTAG from OpenWinCE

http://openwince.sourceforge.net/jtag/
by Marcel Telka <[email protected]>



5.4.JTAG-ARM9

http://jtag-arm9.sourceforge.net/
by Simon Wood <[email protected]>



5.5.FreeICE

http://savannah.nongnu.org/projects/freeice
by Armand ten Doesschate [email protected]

5.6.Ascensit JTAG for ARM7TDMI

http://www.ascensit.com/developers/atmel_eb55/main.php3
by Ascensit
by Christian Pellegrin <[email protected]>

5.7.JTAGER

http://jtager.sourceforge.net/

5.8.IANJTAG

http://www.inaccessnetworks.com/projects/ianjtag
May be related to the FreeIce
  Reply With Quote
The Following 69 Users Say Thank You to aikonmani For This Useful Post:
Show/Hide list of the thanked
Old 06-07-2008, 17:55   #2 (permalink)
No Life Poster
 
.::skybird::.'s Avatar
 
Join Date: Sep 2007
Location: Chinese Section
Age: 37
Posts: 830
Member: 594884
Status: Offline
Thanks Meter: 1,553
thanks allot bro its really useful post
keep it up












br
.::skybird::.
  Reply With Quote
The Following User Says Thank You to .::skybird::. For This Useful Post:
Old 06-10-2008, 13:04   #3 (permalink)
No Life Poster
 
aikonmani's Avatar
 
Join Date: Jul 2006
Location: INDIA,TAMILNADU,PATTUKKOTTAI
Posts: 1,082
Member: 304090
Status: Offline
Thanks Meter: 210
Somthing About Firmware ,flash,flash Memory

FIRMWARE>

n. Executable software that is stored within a ROM.

USAGE: This term is interchangeable with embedded software and sometimes is used even when the executable is not stored in ROM.

FLASH>

1. v. To download new firmware into a flash memory. A bootloader typically facilitates this process by communicating with a program on the host, erasing the flash memory, and writing the new code. The sector of the flash memory that contains the bootloader's code must not be overwritten in the process.

FLASH MEMORY>

n. A RAM-ROM hybrid that can be erased and rewritten under software control. Abbreviated flash. Flash is an in-circuit programmable nonvolatile memory segmented into blocks called sectors. Each sector can be individually erased, then the data within it rewritten. Flash memory is common in systems that require nonvolatile data storage at very low cost. In some cases, a large flash device can be used instead of a disk drive. Although there is a theoretical limit to the number of times a flash memory can be erased and rewritten successfully, this limit is seldom reached in practice.
  Reply With Quote
The Following 5 Users Say Thank You to aikonmani For This Useful Post:
Show/Hide list of the thanked
Old 06-24-2008, 14:27   #4 (permalink)
Crazy Poster
 
Join Date: Jun 2005
Posts: 54
Member: 152989
Status: Offline
Thanks Meter: 11
Check out OpebOCD for those interested in open source free JTAG debugging tools

http://openocd.berlios.de/web/
  Reply With Quote
The Following 2 Users Say Thank You to ben_whiteus For This Useful Post:
Old 08-14-2008, 17:48   #5 (permalink)
No Life Poster
 
g-gabber's Avatar
 
Join Date: Oct 2005
Location: Yes
Posts: 521
Member: 192652
Status: Offline
Sonork: No
Thanks Meter: 121
You forgot something ,
Here is the Original Post http://hri.sourceforge.net/tools/jtag_faq_org.html
By Stas Khirman < staskh at users.sourceforge.net>
  Reply With Quote
The Following User Says Thank You to g-gabber For This Useful Post:
Old 09-04-2008, 20:10   #6 (permalink)
No Life Poster
 
aikonmani's Avatar
 
Join Date: Jul 2006
Location: INDIA,TAMILNADU,PATTUKKOTTAI
Posts: 1,082
Member: 304090
Status: Offline
Thanks Meter: 210
Microcontroller Tutorial

Here is a very useful link ...You should Read It....

Microcontroller Tutorial
  Reply With Quote
The Following User Says Thank You to aikonmani For This Useful Post:
Old 09-04-2008, 20:24   #7 (permalink)
No Life Poster
 
aikonmani's Avatar
 
Join Date: Jul 2006
Location: INDIA,TAMILNADU,PATTUKKOTTAI
Posts: 1,082
Member: 304090
Status: Offline
Thanks Meter: 210
Quote:
Originally Posted by aikonmani View Post
Here is a very useful link ...You should Read It....

Microcontroller Tutorial


A microcontroller is an IC that runs program code that you write, to do what you want it to. This can be based upon inputs, or simply do a task only. It will have inputs and outputs at your disposal, and maybe a few neat features you can take advantage of.
The basic idea of a microcontroller is that it’s a mini computer. It has a CPU that decodes instructions and carries them out. Some come with memory that you use like a clipboard. They also come with an ALU (Arithmetic Logic Unit) to do basic math functions and logic functions. Each microcontroller will have its own set of instructions to create your code with.
  Reply With Quote
The Following 3 Users Say Thank You to aikonmani For This Useful Post:
Show/Hide list of the thanked
Old 11-14-2008, 09:47   #8 (permalink)
Junior Member
 
Join Date: Nov 2008
Posts: 1
Member: 900367
Status: Offline
Thanks Meter: 1
Additional JTAG and debugging information and tools: http://www.xverve.com

Hope you'll find it useful.
  Reply With Quote
The Following User Says Thank You to xverve For This Useful Post:
Old 11-14-2008, 20:03   #9 (permalink)
Freak Poster
 
Join Date: Jun 2006
Location: MACHINE CITY
Posts: 219
Member: 288615
Status: Offline
Thanks Meter: 31
many thanks friend.... also do u have any good information about nokia dct4 upp ..like datasheets,bootloader and external command code ???
  Reply With Quote
The Following User Says Thank You to Alfaromio For This Useful Post:
Old 02-24-2009, 16:45   #10 (permalink)
Insane Poster
 
Join Date: Aug 2008
Location: IRAN
Age: 40
Posts: 91
Member: 838770
Status: Offline
Thanks Meter: 7
Need new help

I'VE F500 SAMSUNG AND I FLASH IT WITH "[VISTA]U-Medic_v1[1].3.3.exe" PROGRAM .AT FIRST PHONE WAS ON AND WITH SIMCARD RESTARTED.BUT I CHANGE BOOT AREA MISTAKE AND ERORR HAPENING AND THEN NEVER PHONE BE BOOT WITH(4KEY +POWER KEY)AND NOT CONNECTED FOR FLASH AND PHONE COMPLATLY OFF.I HEAR JUST "JTAG"CAN HELP ME .CAN U SIR HELP ME OR GUID ME OR ANY THING.... .WITH TNX MASTER.
  Reply With Quote
The Following User Says Thank You to mehdi1978 For This Useful Post:
Old 10-23-2009, 22:23   #11 (permalink)
Crazy Poster
 
Join Date: Oct 2009
Posts: 54
Member: 1147468
Status: Offline
Thanks Meter: 4
tnx guys For this Nice topic
  Reply With Quote
Old 01-17-2010, 07:09   #12 (permalink)
No Life Poster
 
king_of_rajasthan's Avatar
 
Join Date: Feb 2006
Location: Rajasthan
Age: 41
Posts: 563
Member: 227647
Status: Offline
Sonork: 100.1603662
Thanks Meter: 311
thanks Mr.aikonmani

but 1 thing i wanna know is how to calculate the on borad pinout for jatag


1 – vddh (+3.3v)
2 – TDO
3 – TDI
4 – nTRST
5
6 – TMS
7 – vss (ground)
8 – TCK

how to calculae these pinout

only 1 thing vss ( ground ) is every new bie knows but how to calculate other pinouts on phones pcb
  Reply With Quote
Old 01-17-2010, 11:18   #13 (permalink)
No Life Poster
 
Dave.W's Avatar
 
Join Date: Nov 2001
Location: England
Age: 41
Posts: 2,821
Member: 7653
Status: Offline
Thanks Meter: 823
Find the data sheet for your processor, inside there will be JTAG pinout.
  Reply With Quote
Old 01-20-2010, 04:22   #14 (permalink)
Crazy Poster
 
Join Date: Jun 2005
Posts: 54
Member: 152989
Status: Offline
Thanks Meter: 11
And if you don't have the datasheet for the processor, you can try jtag finder. Have a look at http://www.elinux.org/JTAG_Finder for more info.
  Reply With Quote
The Following 2 Users Say Thank You to ben_whiteus For This Useful Post:
Old 01-22-2010, 11:36   #15 (permalink)
No Life Poster
 
king_of_rajasthan's Avatar
 
Join Date: Feb 2006
Location: Rajasthan
Age: 41
Posts: 563
Member: 227647
Status: Offline
Sonork: 100.1603662
Thanks Meter: 311
Quote:
Originally Posted by ben_whiteus View Post
And if you don't have the datasheet for the processor, you can try jtag finder. Have a look at http://www.elinux.org/JTAG_Finder for more info.


dear thanks for reply but the most important thing is " i dont wanna buy jtagfinder "

i wanna kno the way by which the jtag finder is working

i wanna know how to calculate by multi-meter
  Reply With Quote
The Following 2 Users Say Thank You to king_of_rajasthan For This Useful Post:
Reply

Bookmarks


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
What is the Self Test waqasmalik HWK 2 06-16-2007 16:22
What is version new Test Point SX1? controllerz E-Gold Based Phones 1 07-14-2005 22:46
Reflowing - what it is? (dry joints?) slider27 Hardware Repair by brands 4 06-26-2003 08:25
What is JTAG ??? Mitya Hardware Equipments for GSM 1 01-31-2003 23:52
What is the DSP test for on the B-phreaks stuff? Lonegunman Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) 4 03-11-2002 00:41

 



All times are GMT +1. The time now is 01:13.



Powered by Searchlight © 2024 Axivo Inc.
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.
- GSM Hosting Ltd. - 1999-2023 -
Page generated in 0.44972 seconds with 10 queries

SEO by vBSEO