|
The Treo 650 Bootloader( _0 D5 N" L) ~- ]3 g2 @" R
From ShadoWiki" t4 G$ h/ f \& B
Contents2 R0 B8 T! G5 X3 L. R$ G, F9 \5 ~6 T8 ^( u
[hide]
0 a5 M4 Y+ w/ K/ O) x* M2 b' X" Y' W. n1 j* {, v$ M- a
* 1 The Treo 650 Bootloader
, _! f" s0 a& m- T+ V- S * 2 Running the Bootloader and Using Commands8 U- c5 x/ M0 e7 ^5 h) h- H
* 3 Hidden Commands% Q5 \0 M& `& k& ^# E; J
* 4 IPL and SPL
: F: @5 J$ d/ Q; G0 k * 5 Potential Applications of the Bootloader
6 e0 c$ z7 }0 p2 i3 k+ q7 {; X' f/ @9 V
1 D5 J, A9 r% a[edit]
/ J2 M' k- J l* C( P9 C+ `" nThe Treo 650 Bootloader# @! f# S1 `: M( k8 Z i
9 D6 Y1 r* e1 i4 H' g2 j% c
A bootloader is a program that is located at a certian part of the Treo 650's memory that is designated as the default boot point. Its function is to control various functions of PXA270 processor, such as loading sectors of memory to start the palm OS and write protecting vital memory sections called the rom. More information on the rom can be found in Custom Roms And Rom Hacking. The bootloader itself appears to be one formerly used with PPC phones. Palm seems to have modified it slightly to suit the palm OS needs.4 ]2 e0 W3 Y' M4 H2 |
5 R y! e+ u/ `; S% b; Z
usb bluetooth adapter
3 G+ r+ J& V3 C {% y6 Z[edit]/ C3 I! k) D' F; Z
Running the Bootloader and Using Commands
2 d/ @7 j2 ]0 p* S4 d3 Z! r* y0 O4 b$ r2 [
This information was taken from the bootloader. In it we find the exact name of the bootloader and the valid commands with a brief description. A word of caution: The command flashtest writes over every address in the flash memory, overwriting the bootloader and rom. This can be fatal to the phone if the test becomes interrupted. Unless you are trying to diagnose a dead memory adress fault in the flash memory, then the good folks at www.shadowmite.com higly recommend against ever using this command.# g8 }; b5 c' ]
" C N# L8 k L6 }. {( `Bootload Start$ K* |! {; k) U8 G* N
. c3 W8 \8 H3 l8 n6 s* e
pmsys =0xA171A8085 O7 C2 ^- C ~7 ~5 P, J, U
0 p6 r8 G7 f/ `3 P% H$ d; z% G/ f: {! ` X
HTC Sausalito Bootloader Version : BOOTLOAD V0.24 Built on Apr 14 2005 at 15: Copyright (c) 2003 High Tech Computer Corporation
: j' |7 |# B7 u+ a% v+ F. K' q" V: G: J6 \6 k
++Check BT Router
, z+ H3 G( a/ [# g2 K
$ J1 M7 N( ?( |$ h& i# A1 c% M4 w>>? Available monitor commands are: ? [command]/ I+ _8 C, P0 R2 V
: y. Q) f1 v) N" d; m; r% A
h [command]4 w6 K: M& c7 u* j& F! P
: s6 y5 O; P3 |& h$ l' b
mb [StartAddr [Count [Filler]]] --- Display/Set memory- S" Q7 I( j4 G6 H1 g+ U
# p/ _2 k1 G* N/ b! ?& g: ~% a [
mh [StartAddr [Count [Filler]]] --- Display/Set memory
) `0 S6 t% ~8 R! L# w( `$ p+ a* V4 Q' Q4 J
mw [StartAddr [Count [Filler]]] --- Display/Set memory4 I/ r' y/ j" S* i n$ P8 {8 B; j: q- f9 [
" u: \2 g; H: y) _4 z/ ~l [pathname] --- Start a BIN file download via MTTY
0 p5 M8 U, M3 x3 k' A( {" c- j2 v. n. E; h% L
lr [pathname] --- Same as above, but run it when complete8 P+ w, h4 S1 U- q8 R0 k
- t! q: X* A; \8 e$ L/ wtftp --- Start a BIN file download via tFtp
7 h0 P7 a& F% j& D& X1 Z# g1 n' P0 V+ ^* T
flashtest --- This appears to try writing to every byte of memory, it will kill a phone!1 g0 j3 I3 ~, o: p- s5 l) x5 z) v
7 ]) U. ~* F1 _' ^" d4 Ajump [addr] --- Jump to a memory address8 ~; [) z H4 @, w( |( i3 _
0 g. y7 K" E* _# Q+ {touch --- Touch Screen Test
$ E6 m* L8 r7 x. E5 b! m$ _; N k- j- ]2 P) d/ ~/ f
touchssp --- Touch SSPx panel test??
* ? Q& h5 U. T! y3 ?+ L1 b
2 ?& S- D' d, r' p7 e. i( l. z' ?2 Eidle --- Put the CPU into idle state
) r$ U4 p' p$ D5 h( | j2 A
* ?; |% [4 J! Q T9 a$ S, ]7 B7 Fsense --- Put the CPU into sense state1 H5 {% `% `. u1 i6 s6 E' n
' w& W# @: b; _( {. s& v
standby --- Put the CPU into standby state
" p. X, Y& `* B6 v9 o# R: @; G( P& |- m
sleep --- Put the CPU into sleep state7 }9 y3 D3 j H2 X
$ n' d3 [( d$ j5 a
deepsleep --- Put the CPU into deepsleep state9 o: g" _4 v, d2 X0 Y: m* S& f
& \9 ]+ `- }) T1 x! @fcs [CLKCFG] --- Alter the CPU freq.2 u1 n- S! {! E' u: p o
6 U# {( K5 i6 o' h% L H) R- C( |
keytest --- Keypad test
& H% O# z" n/ x; [! J8 r
) B* A9 `& l* Z% Z, tpi2ctest --- Power I2C bus tests3 t9 G" t* L5 _/ s/ Z" M8 n
( S P* v- [8 b
debug
+ [9 [7 |$ j3 V- P! ~# D z$ U4 g5 U6 Z% ^+ x- a+ @
flashtype 0 (or 1)
. e4 @- k, R: q- W1 Q( J4 y% ^4 b7 B( r N0 H7 N
rdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)
- }5 L8 ]& m+ g) _' M" z7 \1 T5 b6 d _% {
os
4 u' P$ F2 q4 w2 b a/ ?0 f1 F; q3 w6 }+ {& A8 z H
upload [addr] [size] --- Upload memory to terminal - writes binary to your connection!1 Q' ]+ Q1 C* {& ]" o% O) N/ a
1 H! x' D+ X p8 }/ U$ G7 K' u+ Npwr [0:normal; 1:idle; 2:standby; 3; 5:sense;* e' d0 v1 B: M1 u
. M, M; I; I9 h0 r0 fwpdoc [0/1] KEY0 G4 N+ L. V! `/ C8 h% Y6 e+ W8 y$ P
+ y4 b- d! I, j y- t2 L
usb --- USB debug mode enable
+ G l. s2 [" o2 I' |% s0 s6 V6 { b0 J$ p
led [1:LED1; 2:LED2; 3:LED3 ]
8 n. Z2 ?2 {6 l0 i# a! e/ H- s. A5 M, J% h' [% o1 ~' c
r2sd [command]
p9 Q+ v1 ?; _8 b& m: L; S- g+ z4 R: r" ?2 I3 j, G
sd2r- B* ?: j4 v4 B6 u3 `, d, | E n
& m% N% B/ Q7 F5 S2 zrtask [Type[Value]]
+ |, l- r3 }/ t) E Y# {" `: `: ?4 @( \) K4 [; i6 [
rroute1 i$ b1 ] B6 A+ C' p5 i3 c
$ n2 d& M( X, `) M* r% }rtest6 n4 B( m. _2 A; L" Z
4 c- H" ^2 e( C9 X, N
rimgdata6 i* j2 A2 A8 o9 W6 j( c
3 j0 i+ i# A2 W7 d5 E9 Y: k S& c
jmptoos9 |' h7 }9 ?0 a1 g
; H5 X2 {% F3 x( q% _# z+ dpwm3 \! @, `3 B7 D% w0 {! v
; r; y4 F* g/ i0 F9 ^" [5 S1 k) ~" {( i
audio( n7 A+ \: p$ Z1 D# B1 _
, G" ~& C8 y5 ^+ Z9 B! ^btrouter
% t, n" U# @ g; O! w, L
5 M4 C1 X. l; }) J- h$ Yvibratortest9 q2 c4 c" h" X0 l
9 }- e2 e' p* K/ t' ?
audiogsm8 V( l. ]/ ]5 K1 X q
) k" v2 Y7 w) l8 k' B
audiocdma9 {7 `9 ^$ c' x/ r* N
! B4 W* E8 [( L6 y1 J; h- a/ m' ~dsdoc 1 or 0
3 | S3 r, u; I+ P4 z% I5 _# }( t0 |6 J6 c# J, B D
gsm460
7 Y/ o( Y' [% N% T& B
$ W/ d, r* K2 a T6 G: a u3 w% ohwt0 B( r) `& C V! O8 w; |
0 l6 [) O4 `& r( ]1 Bgsmdl& D3 N' J l& m% ]& F$ R. E* r5 d& h! k
[edit] Z6 G; D/ P+ n6 O2 h
Hidden Commands" t. b+ i- ]) K/ m
" F2 R$ n. d; fThe HTC Sausalito Bootloader bootloader was originally meant for use with PPC's and seems to be hacked by palm employee's for the Treo 650. Some commands have been found to be invalid, some functions look for a PPC rom file format. There are some commands that have been added that arent in the list of commands specified by the bootloader.
( \5 d% j- a9 O+ l, B2 e6 U2 E i) z1 q; _
New Commands:7 y: K) ~# V; B! P8 O
* ?9 o* ~1 `# H5 x- Q
ruu
2 v' N6 h, _1 K, V/ Y
& x! }9 |5 O, E2 Z1 P. Igettoken# o G y$ }. Y8 ^+ D+ e8 P
9 p" a6 W5 H- |& H- B
settoken) l5 f6 K8 J2 ]( t8 n* E+ x
[edit]
! a0 B m( S1 Q: s; W$ q: LIPL and SPL% _3 g3 @* W: h& x1 k5 f
' a# _* U$ S2 l; j/ eThe Bootloader references two programs, the IPL (The Sausalito Bootloader) and the SPL (The Palm Loader). The IPL is the Initial Program Loader, the part of the bootloader that resides on the phones internal memory. It is what allows the bootloader to function on the phone, and establish an interface protocol with a pc. The IPL loads the SPL, the Secondary Program Loader, in the case of the Treo 650 it is the palm OS 5.4 Loader.; w+ Q2 v: H; e/ }
[edit]
& f& ~4 C# L5 A. KPotential Applications of the Bootloader
9 F! C4 Z7 |% M3 R
% y1 }# l9 `9 c' w( D6 }By understanding the bootloader, we hope to be able to repair phones with improperly flashed roms. Another application would be to port a linux based OS on the Treo 650 |
|