|
The Treo 650 Bootloader9 f2 {* u+ a4 L6 a1 v* t* \
From ShadoWiki
G, \! N7 j+ ~) h( O7 uContents/ c j, A" c5 p/ U5 k5 w
[hide]
1 ~4 k* d5 o+ G" w4 z
; ^, q( P/ g% f$ V7 t * 1 The Treo 650 Bootloader$ O5 T: Y1 o, T1 s+ b+ a
* 2 Running the Bootloader and Using Commands
; s, E5 h! ?$ `8 O * 3 Hidden Commands' }+ K) J% Q& R- Y. E9 }3 \; X
* 4 IPL and SPL6 s4 P4 z9 ~: P& E1 O5 E) r7 I4 B& |, a; S
* 5 Potential Applications of the Bootloader& [& `/ L0 q" F
9 h: @% k/ |" P! o/ U* g[edit]
, i# _% e2 F; V# _ S+ z; uThe Treo 650 Bootloader
/ Z6 i; N3 x! F. D7 ~+ C& z
8 Z! W) B, q( R4 a. GA bootloader is a program that is located at a certian part of the Treo 650's memory that is designated as the default boot point. Its function is to control various functions of PXA270 processor, such as loading sectors of memory to start the palm OS and write protecting vital memory sections called the rom. More information on the rom can be found in Custom Roms And Rom Hacking. The bootloader itself appears to be one formerly used with PPC phones. Palm seems to have modified it slightly to suit the palm OS needs.
3 \5 q ?. C; j. T* B6 B. J0 y3 s5 V8 A3 h7 T! X
usb bluetooth adapter, {- C9 H0 u; B# `4 E
[edit]
- u* p; q! z0 `1 d) F& {. l" DRunning the Bootloader and Using Commands
7 @1 X8 F0 L* H( x) Y: }% a
. o( W$ W x* a" M4 M; mThis information was taken from the bootloader. In it we find the exact name of the bootloader and the valid commands with a brief description. A word of caution: The command flashtest writes over every address in the flash memory, overwriting the bootloader and rom. This can be fatal to the phone if the test becomes interrupted. Unless you are trying to diagnose a dead memory adress fault in the flash memory, then the good folks at www.shadowmite.com higly recommend against ever using this command.2 Z4 d5 B! P, {# H
) M: U! m0 G: K( v( o
Bootload Start0 p1 I' @/ N4 p+ s
" \2 |4 m6 ?% I. |: A" K/ w
pmsys =0xA171A8089 G1 B' K1 B' i/ k7 Y- b
& u" C K+ U+ z+ T) u8 U- O3 mHTC Sausalito Bootloader Version : BOOTLOAD V0.24 Built on Apr 14 2005 at 15: Copyright (c) 2003 High Tech Computer Corporation
( W$ }9 x( Y9 V" @+ J: j# R( Q ]2 {$ o
++Check BT Router# P+ X) c/ E5 R
0 R/ J: _+ X+ x>>? Available monitor commands are: ? [command]
: X# Z8 Q) M6 G4 b( Z3 w4 V0 ?/ o# E: M& E! F
h [command]
; _# i; L, s$ Y! A) {+ n
% _3 S* D, T1 Y7 c* k2 Jmb [StartAddr [Count [Filler]]] --- Display/Set memory( f" U+ F0 C4 \. k2 E
* B2 W6 N/ h7 x% @1 s7 |
mh [StartAddr [Count [Filler]]] --- Display/Set memory }5 t" @: U+ k5 ^
0 ~6 G' d' j5 [: R: P6 I0 ]
mw [StartAddr [Count [Filler]]] --- Display/Set memory1 I5 Y) V/ l( U1 q. y% ? Y. N6 I
8 ?' d! o" @# Y+ U5 j# p0 r7 D
l [pathname] --- Start a BIN file download via MTTY
& T9 h- M# Y, p1 k& M7 Z2 m8 o* J k6 k1 a$ U; Y
lr [pathname] --- Same as above, but run it when complete
. K: k) _& E) A$ u6 p7 O4 i$ t
/ J8 i! X+ j. @. dtftp --- Start a BIN file download via tFtp
/ g) q3 w# V, S; Q. J0 P8 n- j" J
" x" p U, `# Q& g0 P5 |0 Hflashtest --- This appears to try writing to every byte of memory, it will kill a phone!
% P2 b7 ^) A# a' M ]: A. x4 Z' C
8 k1 C0 O3 J' @" l7 Xjump [addr] --- Jump to a memory address7 a& r$ L5 m7 Z m5 Q' r, P
5 A% I' N" y5 m3 z' C" f% M3 H/ ]touch --- Touch Screen Test
* J F( u" H0 n4 l* V9 D9 M! p* K; f" }* ?0 ~! T
touchssp --- Touch SSPx panel test??
9 v7 T/ v6 c$ S
9 g, G% w* i: jidle --- Put the CPU into idle state: L$ o+ p1 p, E0 V5 R
) e# B2 D7 O9 b8 [* v
sense --- Put the CPU into sense state; X* Y$ r0 P9 j! [
O; e: ?" W% @, z: V0 F4 [. [. r
standby --- Put the CPU into standby state9 _3 ~3 O. c- Z+ h& J4 e b
2 ?$ m$ J% m1 Y9 P9 ksleep --- Put the CPU into sleep state/ ^1 _7 o$ _% y# c% S/ H$ d- N8 }0 }
! W: s+ k7 @! E D* J7 \, M. a( Q" v
deepsleep --- Put the CPU into deepsleep state( {6 @/ a0 G3 X# [% W6 D. c
* v9 n6 L" w$ Y/ k/ S) o8 q. B' ~
fcs [CLKCFG] --- Alter the CPU freq.
& o" L- O" `7 Q# Y' v
3 |& ~0 B$ [0 T2 U+ [$ E& \) pkeytest --- Keypad test
, G% w, e9 T, [2 i9 R6 c3 D/ S# r* u, ^
pi2ctest --- Power I2C bus tests" i8 X' V- @8 A) L; X$ q
) R; o/ s, [% {( o* U
debug1 i/ O9 o% v1 W; f' L
- }) N: t& J9 l# J
flashtype 0 (or 1)
6 z0 c1 n# V9 Z
" Y0 V0 ]* r& q5 u% drdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)
/ {, ?) H, n' n/ N _% g% k3 r- [' r. i5 u, B
os
+ D+ r; n5 L0 g0 c
$ \4 v' ]/ N4 y3 vupload [addr] [size] --- Upload memory to terminal - writes binary to your connection!7 h4 ?, W: n, _/ [0 q) H
0 G, A" B. ~' O, A! A5 x9 z+ Y' F
pwr [0:normal; 1:idle; 2:standby; 3; 5:sense;+ ]7 S6 @7 p7 w! \* a8 ^$ X
# e' Z7 V: O7 b' b# ~wpdoc [0/1] KEY' t% r8 n$ d; }+ y% u( r
2 t F2 l! Y6 n: U5 Gusb --- USB debug mode enable* o/ ]& c- q- x" w
, P9 w7 H. b1 ]( x9 U7 g6 k# Z
led [1:LED1; 2:LED2; 3:LED3 ]
/ K5 r. o& v6 M1 j0 E5 W
5 Q7 ~9 o! c: T% Pr2sd [command]
* T5 l5 C3 t( f1 M4 b% P! e
+ F0 v6 V; ?5 a' `& O- wsd2r
9 |; w) U1 ^0 B3 C: f% \% Y8 I0 L% d# Y0 y g, \5 s) d
rtask [Type[Value]]
( _$ C; T ~* N T# N, _: T N/ i! ]% ^" j, z: J4 j
rroute k* Z, E% ~2 H# a
% q# \1 v3 c7 y: K
rtest
, \9 X7 s' s/ v. e: T4 `) C$ i. L7 `. U1 V* `3 w
rimgdata+ _$ L7 _' }3 a1 n
$ y2 v9 J0 L, {% [' I, y r
jmptoos
# U0 h, o0 U# h7 x
+ i# s6 m3 t8 [& {$ m# a( kpwm
7 M E2 N( e' L% ^ X' o5 x3 n' J( S/ }
audio
- {& B, v, Z, a+ h0 n
3 [+ m+ i0 P* o- O T. n1 pbtrouter. u, U3 B, v/ q. w0 t6 C7 j
9 ?; A: k+ q( ?5 W$ Z3 \0 a1 ^9 {, ^vibratortest
# b' `3 k% u. n) \
% b) j: Z0 V* _0 w; [% s/ |6 b' paudiogsm8 x, y6 Z6 x J8 c$ P
) u* S3 y( z- N4 Uaudiocdma5 C2 k9 j+ V& f# G4 [
0 l8 M# ?0 w5 j. [( u6 Mdsdoc 1 or 0
6 N2 _) X$ r" i2 R$ U
+ S. m4 Q1 {$ W: D3 Ggsm460
; u7 S' E. ~6 b' f2 C3 a3 d6 {; l9 \( O- ]; f: L# L! X
hwt
4 U- _" q+ R; r0 E5 T O' Z
! \9 J7 W; \) [' L% f6 O2 }gsmdl: p$ B) M W- r4 K. ]/ ]6 H
[edit]
. c9 }9 k; G2 c* g' WHidden Commands( B( ^* H' t# k( B
. @9 ?+ R2 ?7 g( C* @$ c" a! s
The HTC Sausalito Bootloader bootloader was originally meant for use with PPC's and seems to be hacked by palm employee's for the Treo 650. Some commands have been found to be invalid, some functions look for a PPC rom file format. There are some commands that have been added that arent in the list of commands specified by the bootloader.
/ w) x) t0 D6 P5 i1 i( ]! w4 `, l+ D
1 C0 |! P5 ?6 Q8 }$ g) D: pNew Commands:8 _. p3 F, Z7 d; F7 u1 d' s
& D5 _" P( @8 R3 {, R6 S9 zruu4 ]# k# {4 `* h$ ~/ X. e' I5 a9 I; v
' N" b' D% A8 v, W7 c6 ~; i
gettoken1 i) {) k& v1 O u; ]/ v8 k( `
" }4 O* i* g* X4 W9 E( p- Jsettoken
/ A- q# z5 x$ L, F& c! c8 G[edit]
, l j/ h- V9 v1 w% }IPL and SPL8 a5 h5 W+ Y- [! _7 g
. k3 i- g1 v8 a. q) i6 _/ P" m' V) \
The Bootloader references two programs, the IPL (The Sausalito Bootloader) and the SPL (The Palm Loader). The IPL is the Initial Program Loader, the part of the bootloader that resides on the phones internal memory. It is what allows the bootloader to function on the phone, and establish an interface protocol with a pc. The IPL loads the SPL, the Secondary Program Loader, in the case of the Treo 650 it is the palm OS 5.4 Loader.
0 g9 g( P4 e d" X0 E3 \1 i6 P% }[edit]
8 v/ Z Y7 Q/ m7 ]1 V: g5 \( s4 ~: p* UPotential Applications of the Bootloader
c8 { A5 ]7 ~9 s, m2 Y- c- k- ^8 L- m h% m1 y
By understanding the bootloader, we hope to be able to repair phones with improperly flashed roms. Another application would be to port a linux based OS on the Treo 650 |
|