|
|
The Treo 650 Bootloader7 m6 N# z- N7 s& r& \$ l; P/ R
From ShadoWiki
5 U3 I. F* b) Y) a9 C; r, n0 yContents
+ }& M6 a9 U2 L$ y+ b& {[hide]! z2 q9 S } E/ B
e9 v% L; V. o3 m! ?7 `4 Q% o
* 1 The Treo 650 Bootloader- j. P2 B* ~0 ^* `; h& J* y
* 2 Running the Bootloader and Using Commands2 Y. z! P2 o, S" F7 ]4 p" O+ E
* 3 Hidden Commands: M% E# o1 C M( m# I
* 4 IPL and SPL
! D! X+ Z! n- j5 _/ d * 5 Potential Applications of the Bootloader
1 `" i8 h2 n3 G- V1 l9 C
( T0 Y" a( I6 K, z9 n. \[edit]
, W! Z) M- A; F y3 t5 OThe Treo 650 Bootloader
4 o" B" s8 l: E# R- F8 Z+ k, _$ T+ B) v' c( ~
A bootloader is a program that is located at a certian part of the Treo 650's memory that is designated as the default boot point. Its function is to control various functions of PXA270 processor, such as loading sectors of memory to start the palm OS and write protecting vital memory sections called the rom. More information on the rom can be found in Custom Roms And Rom Hacking. The bootloader itself appears to be one formerly used with PPC phones. Palm seems to have modified it slightly to suit the palm OS needs.5 K( v7 R7 x: A$ s
, n8 ?2 M7 S6 u4 b Z5 g4 k" V' Lusb bluetooth adapter
9 o2 O/ P) |! ^ m8 L+ w: ~2 |2 j[edit]
3 z' @$ O$ P' k# Z6 G0 KRunning the Bootloader and Using Commands
% x6 d0 v. i8 Q; F" `+ K7 t
8 R- j+ f0 G, S6 x3 K m2 G0 RThis information was taken from the bootloader. In it we find the exact name of the bootloader and the valid commands with a brief description. A word of caution: The command flashtest writes over every address in the flash memory, overwriting the bootloader and rom. This can be fatal to the phone if the test becomes interrupted. Unless you are trying to diagnose a dead memory adress fault in the flash memory, then the good folks at www.shadowmite.com higly recommend against ever using this command.1 @7 U' x" h" s( p& `
6 O/ E7 D+ x" }: B, r N. \Bootload Start# [# j7 N% Y6 g! }& y
7 ^$ s: o# c3 v, r5 P8 Cpmsys =0xA171A808
% O2 q- b+ F8 B
! S; d$ T+ g# N' [& ]# fHTC Sausalito Bootloader Version : BOOTLOAD V0.24 Built on Apr 14 2005 at 15: Copyright (c) 2003 High Tech Computer Corporation) [9 j$ C' |) L! g3 C
3 o7 G3 V' x. {7 K2 ?5 B++Check BT Router! W# C& O g1 p4 d
6 q$ ^2 @ `) _8 @3 m9 l' w
>>? Available monitor commands are: ? [command]
/ s3 g" [! T3 O# A2 r; L9 T" k
$ {, r. x! j* j9 C" xh [command]
$ ]! E+ i- ^5 [7 H* Z4 _, f5 j1 Z, {. V
mb [StartAddr [Count [Filler]]] --- Display/Set memory
7 } w* f/ H5 M4 p$ R% g5 R E3 ~9 g/ ]' e: ]+ Y0 T5 `
mh [StartAddr [Count [Filler]]] --- Display/Set memory
& e; ?# J' X& ?6 }% _2 n8 H) N) e, W# P E1 n" }$ B
mw [StartAddr [Count [Filler]]] --- Display/Set memory# S6 X: K% R" l" p1 q: @2 b
+ I9 u7 {# l+ E& Hl [pathname] --- Start a BIN file download via MTTY
7 [% `" C( u3 t6 U' Z
% R- }5 o$ r6 J5 Qlr [pathname] --- Same as above, but run it when complete
! y3 _" R6 I9 S% d. Z4 B3 A% t4 H* @
tftp --- Start a BIN file download via tFtp# }" F4 Y( z% s5 b
' @$ H' t/ m1 T+ `flashtest --- This appears to try writing to every byte of memory, it will kill a phone!
& C$ ]4 s/ l% \* ~: G) ^7 q7 N4 ?
9 E# k; h1 b& z$ ^jump [addr] --- Jump to a memory address2 h% i, s3 g/ ~) J* \0 D8 g4 ]
( N" p1 _9 X0 A5 x. y3 X/ K
touch --- Touch Screen Test
. ?0 L1 M% l! N+ A
, p" |2 P& {* v, E, P! z* ?touchssp --- Touch SSPx panel test??* `) j5 i8 Y& T5 i# u
, h4 ~1 a6 t+ ?4 j1 O" T% L; s3 ]# \
idle --- Put the CPU into idle state) |0 P: F; I- k- j* I% h) o1 T) L
: Q# I% F* B3 S! Z6 ssense --- Put the CPU into sense state! z0 h6 R& K1 i* o
% ]: H# H5 N& f& [standby --- Put the CPU into standby state }( m- ~( \0 S( Z/ D$ y
9 T8 e' f' ]* S' Lsleep --- Put the CPU into sleep state& D) u4 I5 i7 U" P6 T
4 l& D( f7 b7 ]( @! J7 r) Z- Sdeepsleep --- Put the CPU into deepsleep state
I# x3 m" u U) N y8 o* e5 M* l3 c" ~
fcs [CLKCFG] --- Alter the CPU freq.6 w3 j( A/ d2 J. f8 h8 x% Y1 Y$ B; D1 h y
' d* U, ?7 d) M% c$ W. p M1 ikeytest --- Keypad test
$ @% k( Q; J( F h' v" u- k3 n H% z1 A/ J3 R
pi2ctest --- Power I2C bus tests
2 {: W% Y) _. S, ^: m$ y, R) \6 a; k
$ e* i, X9 B a' T9 M7 z1 Fdebug
/ x# m, H8 A& e! n! C. W5 F2 p/ y \; G* A) b
flashtype 0 (or 1): S4 o, W1 C$ ~; Z
8 C5 p; j9 d, u* K+ F& ?
rdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)2 C/ F) @# |/ n2 `8 I4 k, O M8 F0 }
, S* \; r' V: ~6 k: X
os
1 l- j5 }$ ^2 _% f' S$ @( ~3 S- Q8 p q
upload [addr] [size] --- Upload memory to terminal - writes binary to your connection!
: s+ Q+ F/ M+ v8 h7 p- ?% }% K
# g, {7 B1 G( k5 M: a: q6 }2 Rpwr [0:normal; 1:idle; 2:standby; 3 ; 5:sense;- }* K3 Q+ ]( n4 t7 c2 n3 p& \
: \+ B1 M3 a9 d! J u5 _" `0 _# _: ^# M
wpdoc [0/1] KEY
) p6 R+ k4 H: o$ m* ~ V- L/ q" m1 \1 \* H4 O% N+ M+ }5 I
usb --- USB debug mode enable
2 }( h* [& P# c+ x
6 I& M8 V* U7 n' R7 Zled [1:LED1; 2:LED2; 3:LED3 ]. E# I" u6 v+ r+ m- t
+ k" L$ [& I, b
r2sd [command]& n" b4 q6 `$ q8 \6 T: {
) l/ v' P# ?# U3 h3 S' W) B" a
sd2r4 b$ Z2 C0 Q) W4 v; N
2 P T' Z/ n7 E) e0 P% Q F* u( W
rtask [Type[Value]]' j* U8 y/ X g. C+ G7 {7 F
8 W' c: X0 l& r+ E l0 _$ D( crroute, ^5 X- c. c I. Z. Y* [5 T
! [" [$ z* U: [rtest
0 [9 g6 v6 I$ K0 o9 ?
" J- S }$ I6 _rimgdata. i- W; t7 l/ _: l% e
. V2 a+ e* n; X# g
jmptoos
8 U3 i4 Q6 z( M# v ~: v, w' l) u& L/ x! h4 J5 v/ L$ j9 V6 c
pwm! L. v$ U- T+ J* s' h6 k
" q; r. J+ `7 y+ Baudio6 L" ^2 M! j, Z, Y. K# X
+ Y, ^% }. Z; m3 a& s/ E8 V" q
btrouter, t$ J. o7 x% L" q
1 K1 P) j7 S/ A2 \( P i$ j
vibratortest
0 |8 p$ H! Y5 G0 D4 H! Z. ? l" G& r+ q0 g6 r: o4 x& r# [
audiogsm
- v7 L2 E q. m
2 Y f* m) P- D: z% {, T; Z3 ^' \audiocdma, G& R8 K" C. k$ j
! ]* e$ {5 ~2 U6 Z4 Z4 _& G2 Y
dsdoc 1 or 09 J6 n5 A$ L+ P, \) k
2 @0 `+ ]( ~ Z" O
gsm460
) {. x$ w( |( f
0 Z" W, O) w& R( f5 Ghwt
' H$ a6 x6 n8 [/ v4 ~
% G) F# G- \5 e1 }) }8 E: jgsmdl' n; I7 ^3 S6 {3 w
[edit]& K _: R) `" R& g$ V9 n- c7 s
Hidden Commands3 d: G/ f/ u0 r2 `
* ~8 U1 Q5 A3 u; }( C& RThe HTC Sausalito Bootloader bootloader was originally meant for use with PPC's and seems to be hacked by palm employee's for the Treo 650. Some commands have been found to be invalid, some functions look for a PPC rom file format. There are some commands that have been added that arent in the list of commands specified by the bootloader.
" s* O) I7 @; p# f% n& }
/ j: | J& ?$ d1 B1 G7 ANew Commands:
4 K6 a* G+ E N% i+ w! ]0 z' _. {) o
/ j! B& ` e6 \2 g4 u+ N7 Aruu( j& I) Q4 \* @# O% J
- _+ v" y, b& h+ l5 Wgettoken
* K; `3 Q* h& M9 g3 n2 b. y: j1 Q
1 l* n0 @, Y# [+ k& V+ R9 |settoken9 t/ d+ O* {- `$ [' x$ i
[edit]. b0 b7 K, p; h# q/ J+ D/ w1 P
IPL and SPL
' g5 n9 p S* g g$ u9 |, g3 \2 x" u9 _8 ]- m% `
The Bootloader references two programs, the IPL (The Sausalito Bootloader) and the SPL (The Palm Loader). The IPL is the Initial Program Loader, the part of the bootloader that resides on the phones internal memory. It is what allows the bootloader to function on the phone, and establish an interface protocol with a pc. The IPL loads the SPL, the Secondary Program Loader, in the case of the Treo 650 it is the palm OS 5.4 Loader.. n7 j1 B/ h7 p* q- w
[edit]4 ~8 M4 d0 X: t. c* r' B
Potential Applications of the Bootloader2 x! O: c$ f# h: z5 l6 d( o
. O0 P6 B# R5 R) F* q5 |2 ?
By understanding the bootloader, we hope to be able to repair phones with improperly flashed roms. Another application would be to port a linux based OS on the Treo 650 |
|
|Archiver|手机版|小黑屋|吹友吧
( 京ICP备05078561号 )
狗仔卡
发表于 2007-2-24 21:39
提升卡
变色卡
显身卡
: