[E3-hacking] 2. Re: W00t; it runs. (Matt Evans)
Matt Evans
e3-hacking@earth.li
Sun, 24 Apr 2005 13:20:01 +0100
Dear Jake,
On 24 Apr 2005, at 11:56, Otaku wrote:
> The flashes were desoldered, then the tsop48 was dumped.. I couldn't
> get my hands on an adapter for the vsop :(
> They were both resoldered ( I changed the boot param block on the
> flash and fixed the crc ) and was rewarded with a working console.
> From this I was able tar the filesystem (just to make sure - I'd
> already reconstructed it from the flash dump), and dump the pbl.. (
> Thanks to Noodles for pointing out the mmap neccessity :D ).
>
> I sacrificed a different one so I could trace the jtag traces though..
> :) They do go somewhere : theres a resistor block that needs fitted on
> the top of the board, iirc..
> I've just acquired a TI debug pod for the omap, so I'll doubtless be
> continuing along this route, once I've completed disassembly of the
> pbl.
>
Good news! Fancy sharing which pads the JTAG lines run to? ;-) I've
only the one E3 and don't fancy popping it into the oven & buying a new
one :-D
[I'm also interested in the pads silkscreened 'CFG0' and 'CFG1'; look
like pullup/downs on them. I'm wondering if they do something
interesting with PBL since they're made specifically 'configurable'
(for instance in-house dev mode on a production board).]
Cheers,
Matt