HTC Evo 4G LTE jtag

Has anyone successfuly jtag repaired an evo lte? I dont mean a fake repair with 1g and no lte support which is the only type of service i've seen people claim to succeed with. I need to unlock, hopfully supercid, and flash a sprint evo lte (the esn is good so i dont need to touch it, but information on how i could get the esn onto metro-pcs's database would be great) to the metro-pcs carrier. If someone does have information on this, i would also need to attain the prl files for metro-pcs because the riff-box support doesw not offer it yet. thank you for any help you can provide.


Jeff's Cell Service ,
Anaheim, CA, USA

yes it is012417006765699012417006765699012417006765699012 41700676569901241700676569901241700676569901241700 6765699012417006765699

Thank you so much, that was so informative . You should apply for android head programmer you would be a shoe in!

i want to know this to!!!

Hello, are you able to find the jtag pads on this phone? I was able to identify the NRST jtag pad, below is the pic of the same.

http://img221.imageshack.us/img221/1503/cam00068.jpg

I also have riff box with me so might able to help you out :)

Thanks that's a great start, the NRST is enough for me to find the other jtags, now I just need the memory allocations for the prl and LTE key codes along with the esn location so I might be able to flash it to another network. If you succeed in unlocking it, or flashing the 4g and LTE parameters to a different carrier please post, I will do the same
Usually rocker products have lightning updates for new phones, I wonder why is taking so long for them to add the evo LTE pack, without it I'm a bit scared to wipe and rewrite the memory allocations.

Once again, great work! Thank you and please keep me posted with any new info you find, I will do the same ,

Hey thr, glad that u liked my post. Actually i have been using my phone in India prior to its non-bootable condition. Indian cdma carriers doesnt have lte or 4G yet so i have been using successfully with 3G(EVDO Rev-A) and 1x without any issues. 3G works and is not hard to configure. It would be really great if you help in finding the remaining jtag pads and can guide me how to find the others.

Kanishk, thank you for your posts, the LTE and 4G parameters for US is handled threw the carriers specified web address, inputted threw a combo of cdma workshop and dfs cdma tool. It's the same input areas were you would input your India carrier username/webmail address and password. The 4G and LTE support works off of that. Also, as far as adding the esn/meid to a carriers database, you can just call the service providers customer support and they will generate a keycode encryption on the evo that really boosts its performance. This encryption is not attainlble threw a manual route (ie CDMA workshop / dfs );,,,,,,,,,,,,;,,;,,,,;,;,,,,xxxxxxxxx The only real difference I can see in the flashing process between the different carriers that provide for the evo 4G LTE is that some carriers use the primary account holders webaccess login information in the PRL/SPC read/write parameters, were as others will use provided specified address and uses the company name for the password parameters. At least there is only two types, no carrier will ask for different inputs in these dfs parameters.

That should get you through pretty Much any carrier change, as far as j-tag pads,

I'm waiting for a part to the evo that should be arriving in the mail within the next few days, I will open the evo and start with the probing process then, I will post any pads as I find them.

Thank you for your help, hope to see more of your posts in the future.

Jeff's Cell Service
Anaheim, CA, USA

Can you advice me on how to start with the probing process? it seems i have been doing this wrong and hence unable to get any other possible pinouts. I'm trying it with riff box probing option however the only thing i see is TDO and RTCK in probing tab :(. I'm new to riff and hence know very less, however i have played alot with UFS/JAF/Tornado etc in Nokia days. That being said, the locations of RX TX GND VCC are easily idetified on those and thr cables are also available easily. It would be very much appreciated if you can guide me through the probing process :)

Kanishk, seems once i look over the pictures of the evo lte, i see the same type pinout system that htc uses in almost all of its expensive phones. It is very very easy, they have it sequenced in the j-tag cable style. , here is a picture of the motherboard with the pinout area highlighted.

Attachment 31426

as you can see, they are all inline, but look closer and you will find that they are also in the same sequence as the j-tag cable, hense, the first pad (far left pad) will always be the VCC, from there htc always plays it the same, from the VCC pad, each following pad on its right will continue with the j-tag cable style sequence. So the full sequence will look like this --

Attachment 31429

Usually, as with phones like the original Evo 4g and the incredible, ect, HTC would always have a total of 10 pads inline, were as here they have only six pads. This is due to the upgrade in boxes to were not all 10 are needed,. Most of the time you only need 4-6 to get a proper read/write. Since you had found the NRST, that one is no problem, the only one left to find is the TDO which im pretty sure you can use on the VCC pad since most boxes provide power to devices now. Other than that, just make sure you have a ground going to a metal source on the board (I use the batterys negative side connector as my ground)

hope this helps you :)

Jeff's Cell Service
Anaheim, CA, USA

Hey thanks, unable to view attachments however :S

I believe it's because you are viewing it from a smartphone, so you would need to get a program to view .png files, or, just check the post from a computer. I'll repost the files in jpg format when I get to my desktop.

Also, when I get to my computer I'll post a guide on the probing process .

Jeff's Cell Service
Anaheim, CA, USA

Ty very much for all the info. I had a talk with riff makers and they said if i get the pinouts, they can start testing process and can resurrect the phone :). So it will be very much usefull if we both keep our info gathered here :D

That would be great, actually I am wondering if rocker team would provide the source code for the resurrect files, if I could get source for some random resurrect files I could start working on coding my own resurrects, but manufacturers usually don't provide the boot sequence source, or the packet allocations and content, but then again I haven't asked them yet. If the do offer them I will post.

Jeff's Cell Service
Anaheim, CA, USA

Hello, below are some of the pad readings which my multimeter observed. All readings are taken with the board connected to USB with battery removed and GND taken as mentioned in the pic. Please let me know if i m doing anything wrong.

https://www.dropbox.com/s/reipjimu8toola4/CAM00068.jpg

Readings
http://pastebin.com/sb1BPSKP

So you tried the pinout in my post and it didn't recognize them? Did you get riff to recognize the jumpers in your pic? i could of sworn that htc would of used trhat set in my pic. If you still are having problems viewing my pics, let me know i'll repost them in jpg format.

Jeff's Cell Service
Anaheim, CA, USA

yes, m still having probs in viewing attachments, must be wrong format ?

im so sorry i thought you found a way to view it, here it is, good luck and tell me if it doesn't work so i can probe with riff.

Attachment 31459

Jeff's Cell Service
Anaheim, CA, USA

Hi, thanks for the detailed picture.
I have tried with riffbox voltage probe feature. The readings m getting are
VCC & TRST = 1.82v
TDI & TMS = 0.00v
TCk & RTCK = 3.02v

All these values are taken with USB and battery connected. These values doesn't correspond according to the drawn pads i think :)

So riff box did not give you the message "could be tdi or tdo, etc." On the pads in my picture? I am almost positive that is the right pads. They may have changed the order. I'll try probing today and see what happens. I haven't taken the evo apart yet so I'm not sure what the other side of the board looks like, but of you see a series of square pads like the one in my picture that number 10, those are for sure the jtag pads. Good luck , I will start probing today myself but I have a few clients phones I still need to ready before I can start the evo .

Jeff's Cell Service
Anaheim, CA, USA

Thanks for your input Jeff. There are not consecutive pads on the back side of the board just like other htc phones(evo 3d/sensation etc). Yes riff did not gave any probing on these points :(. I will be waiting for your results

Kanishk, sorry for my delay, I had many parts come this week but I have not received the evo parts though, so I've had to work on other phones, as soon as it comes in , I will start on the jtag chain.

I'll keep you posted but I will probably be very busy until then, so I might not post until I have had at least one attempt at the probing. Once again, sorry for the delay, I've been to busy to even describe my probing process.

Good luck, I'll be back soon as I get the evo part.


Jeff's Cell Service
Anaheim, CA, USA

I will be waiting eagerly for that Jeff. If till then i get any update, i will post it here itself

Below are some of the voltage readings which are observed with Riff Box Voltage probe.

https://www.dropbox.com/s/reipjimu8toola4/CAM00068.jpg

http://pastebin.com/ZBw8TFcg

+C= Cable attached.
+B= Battery attached.

Enjoy Jeff :)

Attachment 31508

Hi, thanks for posting JTAG images.

Thank you i was looking everywhere for this

Thanks for the detailed images!