Archive

Archive for May, 2007

Interior of the Treo 680

Just the interesting side of the main board in the 680.

M-Systems MD8832-d1G-V3-X-P – 128MB DiskOnChip
Spansion S71PL064JB0BFW – 32Mbit pSRAM, 64Mbit Flash
Broadcom BCM2133KFBG – Baseband EDGE/GPRS/GSM chip
Intel 8270C5C312 CPU
SEC 634 BF75 ?

I suspected the sixteen pads (two rows of eight, though the upper row is occluded by the RF shielding) to the upper left of the PXA in the photo contain the JTAG points. This has been confirmed by Alex and Chris at Hack&Dev.

1 3.3 VDC   ; 16 TDO
2 NC        ; 15 NC
3 NC        ; 14 TCK
4 NC        ; 13 NTRST
5 NC        ; 12 NRESET
6 TDI       ; 11 TMS
7 GPIO 118  ; 10 GND
8 GPIO 39   ; 9 GND
Tags: ,

Treo 680 ROM hacking 2

Palms ROM updates :

Palm have released several different methods of updating flash ROMs and firmware and recently they seem to have settled on using a method of splitting the large PalmOS ROM into small 2MB chunks to allow easy hotsyncing. These ‘hacksplit’ chunks are then combined during the flashing of the ROM image.

Fortunately for us, Matt at grack.com and a few others created RomTool for the Treo650. This was aware of hacksplit and could perform the somewhat trivial concatenation to allow us to extract and then edit the whole ROM image. It can also talk to the 650’s bootloader, which the 680 doesn’t have.

The only way so far to flash a custom ROM to the 680 is to use the release for updating AT&T branded phones, which included the ROM image in hacksplit format. We therefore need a method of converting our large monolithic ROM into hacksplit format and producing a valid MD5 checksum for it.

There is existing code to perform at least part of this work for the Tungsten TX, and I have modified it to work for the somewhat larger 680 ROM. [TXupdate original] [TXupdate_modified_for_680].

How to build a custom ROM :

1) Take apart the AT&T Rom with Romtool.

Extract it to a directory and replace the files you want. I listed files suitable for removing here.

2) Compress that same directory with Romtool to create low-palmos.zip and accompanying .md5 checksum.

3) Use the TXupdate REXX code I updated to split the large low-palmos.zip file into the HACKSPLIT sections that the ROM Updater expects (a.zip.pdb, b.zip.pdb, etc). i.e.

Put the large low-palmos.zip, and rexx32.exe and zip2pdb.rex into c:\scratch.

   cd c:\scratch
    c:\scratch\rexx32.exe zip2pdb.rex
    Write file low-palmos.zip.a.pdb
    ................................................................................
    Write file low-palmos.zip.b.pdb
    ................................................................................
    Write file low-palmos.zip.c.pdb
    ................................................................................
    Write file low-palmos.zip.d.pdb
    ................................................................................
    Write file low-palmos.zip.e.pdb
    ................................................................................
    Write file low-palmos.zip.f.pdb
    ................................................................................

4) Place those newly created ROM sections into the Rom Updater directory.

5) Recreate the MD5 checksum to match.

Do this with a hex editor, open the md5 checksum file you got from RomTool, copy the 32 character string and replace it for the one in low-palmos.zip.md5.pdb in the Rom Updater directory.

6) You can now copy the RomUpdater.prc and all the ROM files to the launcher directory on your SD card and run from there.

If you are after custom ROM’s and don’t want to make one yourself, there’s a thread on TreoCentral.

Tags: , ,

Treo 680 ROM hacking

May 29, 2007 1 comment

Tuesday, 29 May 2007

Palm released the AT&T update ROM under pressure to clean up Cingular branding.

http://www.palm.com/us/support/downloads/treo680update/att.html

Here is a content listing of the unpacked ROM :

Treo680ATTSDUpdater.zip

Tools you need :

http://palmtx.da.ru/system/TXUpdate.zip

md5

http://www.grack.com/programming/misc/TreoROMTool.html

ROM  Updater
Welcome  to the device updater...
ROM  Build: 3406
Built  Jun 22 2006  15:51:12
SD  Card VolRefNum: 0x0002
Board  ID: LOW
HS  Rev: cvt
?
list -  List the ROM images.
ace  [filename] - Update Ace. (Ace is the  Treo650)
angus  [force] [filename] - Update Angus. (Angus  is the T5)
low
Low  MaxOS Size: 0x2100000
Low  BinFS Size: 0x2400000
Checking  os file size (/ROM/low-palmos.zip) ...
OS  size on SD: 0x00BC5652
MaxOS  >= 0x00BC5800
>>  You can flash your device
Preparing  to update Low.
Verifying  the image files...
Validating  /ROM/low-ipl-cvt ...OK!
Validating  /ROM/low-spl ...OK!
Validating  /ROM/low-htc-tpl.zip ...OK!
Validating  /ROM/low-palmos-tpl.zip ...OK!
Validating  /ROM/low-palmos.zip ...OK!
Updating  the Low Part...
Turning  off Phone...DONE!
Turning  off Bluetooth...DONE!
Turning  off IR...DONE!
Updating  the IPL...
Updating from device... Comparing image with flash...OK.
Skipping section.
Updating  the SPL...
Updating from device... Comparing image with flash...OK.
Skipping section.
Updating  the TPL...
Updating from device... Comparing image with flash...OK.
Skipping section.
Updating  the TPL...
Updating from device... Comparing image with flash...OK.
Skipping section.
Updating  the OS...
Updating from device... Comparing image with flash...
File  size different:
file: 0x00F43F07
flash: 0x00BC5652
...diff
Flashing section...Done!
Verifying section...Done!
Token:  HRST
DeleteToken  Success!
Token:  Nohr
DeleteToken  Success!
Language  token is set to enUS!
SUCCESS:  PLEASE HARD-RESET THE DEVICE!!

If you proceed this way, your CarrierDB will be 292, not 355 as per the ATT update.

**update**

I’ve tooled around with some REXX code to recreate the a.zip.pdb files from a custom ROM I created to remove PocketTunes, Addit and some other junk, and I’ve manually edited the MD5 checksum to match the new custom ROM. I just need to finish copying them to RAM and I’ll try what I believe to be the first custom ROM created for an unlocked GSM Treo 680 !

Yes, I have a custom ROM working, next on the list is recovery methods should anything go wrong.

Tags: , ,

Mimosa Pudica

A plant grown from seed collected in Goa. The leaves of the Mimosa Pudica (pudica is Latin for shy) will contract when disturbed by movement or rapid changes in temperature. Only one seed germinated from a collection of about 30. The growth in the photo above has taken about four months, with most of the new foliage appearing within the last month.

MacBook expresscard sleep issue

I have a Macbook Pro 15” and a 34 Expresscard ‘30in1 Adapter’ made by Hama for reading my Memorysticks and SD cards. Sadly, even having applied the Apple supplied fix, the Macbook simply wouldn’t sleep. A little browsing and some .plist editing, and a build in Xcode later, and it’s fixed.

One just needs to create a kernel extension to tell it to use its existing workaround for badly implemented Expresscards for a particular VendorID/ProductID pair.

http://wiki.osx86project.org/wiki/index.php/Hardware_.kext_Patching_List

http://developer.apple.com/qa/qa2007/qa1517.html

Tags: ,