Dear Jake,
On 24 Apr 2005, at 11:56, Otaku wrote:
The flashes were desoldered, then the tsop48 was dumped.. I couldn't get my hands on an adapter for the vsop :( They were both resoldered ( I changed the boot param block on the flash and fixed the crc ) and was rewarded with a working console. From this I was able tar the filesystem (just to make sure - I'd already reconstructed it from the flash dump), and dump the pbl.. ( Thanks to Noodles for pointing out the mmap neccessity :D ).
I sacrificed a different one so I could trace the jtag traces though.. :) They do go somewhere : theres a resistor block that needs fitted on the top of the board, iirc.. I've just acquired a TI debug pod for the omap, so I'll doubtless be continuing along this route, once I've completed disassembly of the pbl.
Good news! Fancy sharing which pads the JTAG lines run to? ;-) I've only the one E3 and don't fancy popping it into the oven & buying a new one :-D
[I'm also interested in the pads silkscreened 'CFG0' and 'CFG1'; look like pullup/downs on them. I'm wondering if they do something interesting with PBL since they're made specifically 'configurable' (for instance in-house dev mode on a production board).]
Cheers,
Matt