About JTAG on LT18i 12w21

[smos]

Hello.
I found pinouts for this phone, but can not connect it propertly. First of all,I'm not sure wich CPU pin to use for NRST point.First was the AD5 pin named RESOUT_1P8_N and it goes nowhere on JTAG pin area, next was AK32 WC_RESET_N with same result, so i use SRST on NRST line and tried several cpu-suitable dll's.

Here some logs:

[05.05.2018 13:57:18] [START OPERATION_ID = JTAG_ANALIZE]
[05.05.2018 13:57:18] Open serial port...OK
[05.05.2018 13:57:18] Connecting to the RIFF Box...OK
[05.05.2018 13:57:18] Firmware Version: 1.49 (RIFFBOX1), JTAG Manager Version: 1.77
[05.05.2018 13:57:18] Selected Resurrector: [Huawei U8860 V1.0.5067.53207]
[05.05.2018 13:57:18] 
[05.05.2018 13:57:18] Connecting to the target...OK
[05.05.2018 13:57:18] Set I/O Voltage reads as 1.80V, TCK Frequency is RTCK
[05.05.2018 13:57:18] 
[05.05.2018 13:57:18] Following devices are found on the JTAG chain:
[05.05.2018 13:57:18]   Device on TAP #0: ID = 0x27B360E1, IR Length = 0x05 bits
[05.05.2018 13:57:18] Total IR length: 0x0005 bits
[05.05.2018 13:57:18] 
[05.05.2018 13:57:18] Analizing IDCODE(s) of the JTAG scan chain:
[05.05.2018 13:57:18] 1. 0x27B360E1: Qualcomm MSM8255, H/W Rev. #2
[05.05.2018 13:57:18] 2. 0x27B360E1: Qualcomm MSM8255T, H/W Rev. #2
[05.05.2018 13:57:18] 3. 0x27B360E1: Qualcomm MDM6600, H/W Rev. #2
[05.05.2018 13:57:18] [FINISH OPERATION_ID = JTAG_ANALIZE]

[05.05.2018 13:58:16] [START OPERATION_ID = DCC_READ_MEMORY]
[05.05.2018 13:58:16] 
[05.05.2018 13:58:16] Current Settings:
[05.05.2018 13:58:16] -----------------
[05.05.2018 13:58:16] Address: 			000000000000
[05.05.2018 13:58:16] Length: 			000020000000
[05.05.2018 13:58:16] Address Space: 		ROM1
[05.05.2018 13:58:16] AutoFullFlash: 		CHECKED
[05.05.2018 13:58:16] Use End Address: 		UNCHECKED
[05.05.2018 13:58:16] ECC Module Enabled: 	UNCHECKED
[05.05.2018 13:58:16] Image File is Used: 	UNCHECKED
[05.05.2018 13:58:16] Use Address as Offset: 	UNCHECKED
[05.05.2018 13:58:16] Main (UNCHECKED): 
[05.05.2018 13:58:16] Redu (UNCHECKED): 
[05.05.2018 13:58:16] 
[05.05.2018 13:58:26] Open serial port...OK
[05.05.2018 13:58:26] Connecting to the RIFF Box...OK
[05.05.2018 13:58:26] Firmware Version: 1.49 (RIFFBOX1), JTAG Manager Version: 1.77
[05.05.2018 13:58:26] Selected Resurrector: [Huawei U8860 V1.0.5067.53207]
[05.05.2018 13:58:26] 
[05.05.2018 13:58:26] Connecting to the dead body...OK
[05.05.2018 13:58:26] Detected dead body ID: 0x27B360E1 - IGNORED!
[05.05.2018 13:58:26] Set I/O Voltage reads as 1.80V, TCK Frequency is RTCK
[05.05.2018 13:58:26] Adaptive Clocking RTCK Sampling is: [Sample at MAX]
[05.05.2018 13:58:26] Settings Code: 0x04010000000000000000000020000000
[05.05.2018 13:58:26] 
[05.05.2018 13:58:26] Resurrection sequence started.
[05.05.2018 13:58:26] Establish communication with the phone...FAILED
[05.05.2018 13:58:26] ERROR: No response from the RIFF Box.
[05.05.2018 13:58:26] [FINISH OPERATION_ID = DCC_READ_MEMORY]

[05.05.2018 14:35:40] [START OPERATION_ID = JTAG_ANALIZE]
[05.05.2018 14:35:41] Open serial port...OK
[05.05.2018 14:35:41] Connecting to the RIFF Box...OK
[05.05.2018 14:35:41] Firmware Version: 1.49 (RIFFBOX1), JTAG Manager Version: 1.77
[05.05.2018 14:35:41] Selected Resurrector: [Samsung I8150 V1.00]
[05.05.2018 14:35:41] 
[05.05.2018 14:35:41] Connecting to the target...OK
[05.05.2018 14:35:41] Set I/O Voltage reads as 1.80V, TCK Frequency is RTCK
[05.05.2018 14:35:41] 
[05.05.2018 14:35:41] Following devices are found on the JTAG chain:
[05.05.2018 14:35:41]   Device on TAP #0: ID = 0x27B360E1, IR Length = 0x05 bits
[05.05.2018 14:35:41] Total IR length: 0x0005 bits
[05.05.2018 14:35:41] 
[05.05.2018 14:35:41] Analizing IDCODE(s) of the JTAG scan chain:
[05.05.2018 14:35:41] 1. 0x27B360E1: Qualcomm MSM8255, H/W Rev. #2
[05.05.2018 14:35:41] 2. 0x27B360E1: Qualcomm MSM8255T, H/W Rev. #2
[05.05.2018 14:35:41] 3. 0x27B360E1: Qualcomm MDM6600, H/W Rev. #2
[05.05.2018 14:35:41] [FINISH OPERATION_ID = JTAG_ANALIZE]

[05.05.2018 14:36:10] [START OPERATION_ID = DCC_READ_MEMORY]
[05.05.2018 14:36:10] 
[05.05.2018 14:36:10] Current Settings:
[05.05.2018 14:36:10] -----------------
[05.05.2018 14:36:10] Address: 			000000000000
[05.05.2018 14:36:10] Length: 			000020000000
[05.05.2018 14:36:10] Address Space: 		ROM1
[05.05.2018 14:36:10] AutoFullFlash: 		UNCHECKED
[05.05.2018 14:36:10] Use End Address: 		UNCHECKED
[05.05.2018 14:36:10] ECC Module Enabled: 	UNCHECKED
[05.05.2018 14:36:10] Image File is Used: 	UNCHECKED
[05.05.2018 14:36:10] Use Address as Offset: 	UNCHECKED
[05.05.2018 14:36:10] Main (UNCHECKED): 
[05.05.2018 14:36:10] Redu (UNCHECKED): 
[05.05.2018 14:36:10] 
[05.05.2018 14:37:28] Open serial port...OK
[05.05.2018 14:37:28] Connecting to the RIFF Box...OK
[05.05.2018 14:37:28] Firmware Version: 1.49 (RIFFBOX1), JTAG Manager Version: 1.77
[05.05.2018 14:37:28] Selected Resurrector: [Samsung I8150 V1.00]
[05.05.2018 14:37:28] 
[05.05.2018 14:37:28] Connecting to the dead body...OK
[05.05.2018 14:37:28] Detected dead body ID: 0x27B360E1 - IGNORED!
[05.05.2018 14:37:28] Set I/O Voltage reads as 1.80V, TCK Frequency is RTCK
[05.05.2018 14:37:28] Adaptive Clocking RTCK Sampling is: [Sample at MAX]
[05.05.2018 14:37:28] Settings Code: 0x00010000000000000000000020000000
[05.05.2018 14:37:28] 
[05.05.2018 14:37:28] Resurrection sequence started.
[05.05.2018 14:37:28] Establish communication with the phone...FAILED
[05.05.2018 14:37:28] ERROR(0x44): Communication is not established. Terminating.
[05.05.2018 14:37:28] [FINISH OPERATION_ID = DCC_READ_MEMORY]

Looked in FAQ about 0X44 error i see CPU Fuses. Legija, share some info about this and MSM8255 JTAG Modes if you can. Attached a part of scheme with this modes, micron NAND datasheet and pcb top. Thank you.
P.S.Do not share pinout because of incomplete.

[Legija]

MSM 8255 (used also in first HTC Desire HD) has ARM11 RPM core which is fused in production models. Usual RPM core bug exploited in ARM7 /ARM9 RPM cores doesn't work here if SBL1 is deleted.

This results that way so MCU cannot be halted properly.

If phone is in QH_USB mode, You could try accessing it via USB loader.

- Select HTC Desire HD
- Tick DCC Loader USB Interface
- DCC Read/Write TAB - click "Read memory" with any selected size from ROM1.

Report here if any luck.

Important is, to install proper driver from Drivers dir.

[smos]

Hello.
Thank you for reply. Can not connect thru USB loader. This phone in bootloop on Sony logo. Tried flash cache partition, but all remain the same.
My goal is to read userdata partition. Second option, as I see it, is to find pcb manufactured before
12w10 and swap NAND to that board and read memory.

[Legija]

You could also move nand chip to other board.

[spike_belmont]

Is this "QH_USB mode" the same as "Qualcomm HS-USB QDLoader 9008"?

If yes, does it mean that we can perform operations on this 9008 mode?

MSM 8255 (used also in first HTC Desire HD) has ARM11 RPM core which is fused in production models. Usual RPM core bug exploited in ARM7 /ARM9 RPM cores doesn't work here if SBL1 is deleted.

This results that way so MCU cannot be halted properly.

If phone is in QH_USB mode, You could try accessing it via USB loader.

- Select HTC Desire HD
- Tick DCC Loader USB Interface
- DCC Read/Write TAB - click "Read memory" with any selected size from ROM1.

Report here if any luck.

Important is, to install proper driver from Drivers dir.