HTC Evo 4G LTE jtag

[jeffghazaleh]

Has anyone successfuly jtag repaired an evo lte? I dont mean a fake repair with 1g and no lte support which is the only type of service i've seen people claim to succeed with. I need to unlock, hopfully supercid, and flash a sprint evo lte (the esn is good so i dont need to touch it, but information on how i could get the esn onto metro-pcs's database would be great) to the metro-pcs carrier. If someone does have information on this, i would also need to attain the prl files for metro-pcs because the riff-box support doesw not offer it yet. thank you for any help you can provide.


Jeff's Cell Service ,
Anaheim, CA, USA

[Riadon]

yes it is012417006765699012417006765699012417006765699012 41700676569901241700676569901241700676569901241700 6765699012417006765699

[jeffghazaleh]

Thank you so much, that was so informative . You should apply for android head programmer you would be a shoe in!

[mackdcurtis]

i want to know this to!!!

[Kanishk]

Hello, are you able to find the jtag pads on this phone? I was able to identify the NRST jtag pad, below is the pic of the same.

http://img221.imageshack.us/img221/1503/cam00068.jpg

I also have riff box with me so might able to help you out

[jeffghazaleh]

Thanks that's a great start, the NRST is enough for me to find the other jtags, now I just need the memory allocations for the prl and LTE key codes along with the esn location so I might be able to flash it to another network. If you succeed in unlocking it, or flashing the 4g and LTE parameters to a different carrier please post, I will do the same
Usually rocker products have lightning updates for new phones, I wonder why is taking so long for them to add the evo LTE pack, without it I'm a bit scared to wipe and rewrite the memory allocations.

Once again, great work! Thank you and please keep me posted with any new info you find, I will do the same ,

[Kanishk]

Hey thr, glad that u liked my post. Actually i have been using my phone in India prior to its non-bootable condition. Indian cdma carriers doesnt have lte or 4G yet so i have been using successfully with 3G(EVDO Rev-A) and 1x without any issues. 3G works and is not hard to configure. It would be really great if you help in finding the remaining jtag pads and can guide me how to find the others.

[jeffghazaleh]

Kanishk, thank you for your posts, the LTE and 4G parameters for US is handled threw the carriers specified web address, inputted threw a combo of cdma workshop and dfs cdma tool. It's the same input areas were you would input your India carrier username/webmail address and password. The 4G and LTE support works off of that. Also, as far as adding the esn/meid to a carriers database, you can just call the service providers customer support and they will generate a keycode encryption on the evo that really boosts its performance. This encryption is not attainlble threw a manual route (ie CDMA workshop / dfs );,,,,,,,,,,,,;,,;,,,,;,;,,,,xxxxxxxxx The only real difference I can see in the flashing process between the different carriers that provide for the evo 4G LTE is that some carriers use the primary account holders webaccess login information in the PRL/SPC read/write parameters, were as others will use provided specified address and uses the company name for the password parameters. At least there is only two types, no carrier will ask for different inputs in these dfs parameters.

That should get you through pretty Much any carrier change, as far as j-tag pads,

I'm waiting for a part to the evo that should be arriving in the mail within the next few days, I will open the evo and start with the probing process then, I will post any pads as I find them.

Thank you for your help, hope to see more of your posts in the future.

Jeff's Cell Service
Anaheim, CA, USA

[Kanishk]

Can you advice me on how to start with the probing process? it seems i have been doing this wrong and hence unable to get any other possible pinouts. I'm trying it with riff box probing option however the only thing i see is TDO and RTCK in probing tab . I'm new to riff and hence know very less, however i have played alot with UFS/JAF/Tornado etc in Nokia days. That being said, the locations of RX TX GND VCC are easily idetified on those and thr cables are also available easily. It would be very much appreciated if you can guide me through the probing process

[jeffghazaleh]

Kanishk, seems once i look over the pictures of the evo lte, i see the same type pinout system that htc uses in almost all of its expensive phones. It is very very easy, they have it sequenced in the j-tag cable style. , here is a picture of the motherboard with the pinout area highlighted.

Attachment 31426

as you can see, they are all inline, but look closer and you will find that they are also in the same sequence as the j-tag cable, hense, the first pad (far left pad) will always be the VCC, from there htc always plays it the same, from the VCC pad, each following pad on its right will continue with the j-tag cable style sequence. So the full sequence will look like this --

Attachment 31429

Usually, as with phones like the original Evo 4g and the incredible, ect, HTC would always have a total of 10 pads inline, were as here they have only six pads. This is due to the upgrade in boxes to were not all 10 are needed,. Most of the time you only need 4-6 to get a proper read/write. Since you had found the NRST, that one is no problem, the only one left to find is the TDO which im pretty sure you can use on the VCC pad since most boxes provide power to devices now. Other than that, just make sure you have a ground going to a metal source on the board (I use the batterys negative side connector as my ground)

hope this helps you

Jeff's Cell Service
Anaheim, CA, USA

[Kanishk]

Hey thanks, unable to view attachments however :S

[jeffghazaleh]

I believe it's because you are viewing it from a smartphone, so you would need to get a program to view .png files, or, just check the post from a computer. I'll repost the files in jpg format when I get to my desktop.

Also, when I get to my computer I'll post a guide on the probing process .

Jeff's Cell Service
Anaheim, CA, USA

[Kanishk]

Ty very much for all the info. I had a talk with riff makers and they said if i get the pinouts, they can start testing process and can resurrect the phone . So it will be very much usefull if we both keep our info gathered here

[jeffghazaleh]

That would be great, actually I am wondering if rocker team would provide the source code for the resurrect files, if I could get source for some random resurrect files I could start working on coding my own resurrects, but manufacturers usually don't provide the boot sequence source, or the packet allocations and content, but then again I haven't asked them yet. If the do offer them I will post.

Jeff's Cell Service
Anaheim, CA, USA

[Kanishk]

Hello, below are some of the pad readings which my multimeter observed. All readings are taken with the board connected to USB with battery removed and GND taken as mentioned in the pic. Please let me know if i m doing anything wrong.

https://www.dropbox.com/s/reipjimu8toola4/CAM00068.jpg

Readings
http://pastebin.com/sb1BPSKP