[E3-hacking] 2. Re: W00t; it runs. (Matt Evans)

Matt Evans e3-hacking@earth.li
Sun, 24 Apr 2005 13:20:01 +0100

Dear Jake,

On 24 Apr 2005, at 11:56, Otaku wrote:

> The flashes were desoldered, then the tsop48 was dumped.. I couldn't 
> get my hands on an adapter for the vsop :(
> They were both resoldered ( I changed the boot param block on the 
> flash and fixed the crc ) and was rewarded with a working console.
> From this I was able tar the filesystem (just to make sure - I'd 
> already reconstructed it from the flash dump), and dump the pbl.. ( 
> Thanks to Noodles for pointing out the mmap neccessity :D ).
> I sacrificed a different one so I could trace the jtag traces though.. 
> :) They do go somewhere : theres a resistor block that needs fitted on 
> the top of the board, iirc..
> I've just acquired a TI debug pod for the omap, so I'll doubtless be 
> continuing along this route, once I've completed disassembly of the 
> pbl.

Good news!  Fancy sharing which pads the JTAG lines run to? ;-)  I've 
only the one E3 and don't fancy popping it into the oven & buying a new 
one :-D

[I'm also interested in the pads silkscreened 'CFG0' and 'CFG1'; look 
like pullup/downs on them.  I'm wondering if they do something 
interesting with PBL since they're made specifically 'configurable' 
(for instance in-house dev mode on a production board).]