| Versions |
  |
|
| Author |
 Topic  |
|
ProITM
11 Posts |
 Posted - 14 août 2008 : 16:38:42
|
[/quote]
Yes, but right now I don't know what is the address in memory, where BT address is saved.
[/quote]
It is saved in the flash memory.
It is the last chain from the first 256 bytes. If you made the read, and default length was set to 0x00000100 (in hex) is the last chain.
Address from F8 to FD in reverse order, is the BT address. |
 |
|
|
Wictor
Finland
14 Posts |
Posted - 14 août 2008 : 18:13:32
|
quote:
Originally posted by ProITM
It is saved in the flash memory.
It is the last chain from the first 256 bytes. If you made the read, and default length was set to 0x00000100 (in hex) is the last chain.
Address from F8 to FD in reverse order, is the BT address.
Thank you very much ProITM! I did read the first 256 bytes before first flashing, but for some reason I didn't check that file after that. These first 256 bytes contain a lot differences compared to FW image. I guess all the device specific calibrations and settings are at that area(0-0x100).
I already managed to change my BT address by patching the FW image. But then I tried to download only the rom image(0-0x100) and that erased probably the bootloader, because now I cannot get any connection to my holux. After powering the device, only red battery led is on.
Any ideas to get the device functioning again??? JTAG?
// Wictor |
Edited by - Wictor on 14 août 2008 18:13:57 |
|
|
|
ProITM
11 Posts |
Posted - 14 août 2008 : 21:11:53
|
quote:
Originally posted by Wictor
But then I tried to download only the rom image(0-0x100) and that erased probably the bootloader, because now I cannot get any connection to my holux.
Any ideas to get the device functioning again??? JTAG?
Sure the bootloader was damaged. Flash memories writes in blocks, so you can't only write 256 bytes. The minimum for this type of memories are 64Kbytes, so all the bytes after 0x100 were filled FF.
I don't know if JTAG is posible. Last resource, flash the memory with a programmer.
|
Edited by - ProITM on 15 août 2008 00:03:57 |
|
|
|
mdeweerd
798 Posts |
Posted - 14 août 2008 : 22:48:57
|
Try 'BT747_1.54.3_en_full.zip' in the 'debug_release' on sf.net for BT747.
In 'Othr'/'Holux' you'll find 'BT Mac Addr' and under it a 'SET' button. This should allow you to set the BT address - I hope it works - no guarantee! Let us know. |
|
|
|
Wictor
Finland
14 Posts |
Posted - 15 août 2008 : 10:45:58
|
Hi!
Here are some images of the M-1200 PCB. Does someone know what is U15 IC in the first image? I can't find separate flash device, so I guess it's integrated to one of the MT chips...
//Wictor |
|
|
|
mdeweerd
798 Posts |
|
|
Wictor
Finland
14 Posts |
Posted - 15 août 2008 : 12:18:16
|
quote:
Originally posted by mdeweerd
What is the FCC number of your device?
FCC ID: RJIM-1200XX |
|
|
|
mdeweerd
798 Posts |
Posted - 15 août 2008 : 12:35:39
|
Thanks, there are internal pictures as usual, but unfortunately, the schematic is missing:
FCC link |
|
|
|
mdeweerd
798 Posts |
Posted - 15 août 2008 : 12:44:10
|
For schematics of a Holux devices, you can look at the Holux M-241 documentation.
Another MTK module: Ct-M621
(edit:added reference) |
Edited by - mdeweerd on 15 août 2008 14:04:40 |
|
|
|
Wictor
Finland
14 Posts |
Posted - 15 août 2008 : 13:01:03
|
Thank you mdeweerd! I'm always amazed what you can find from internet when you just know, where to search.
I see that there are JCK, JDI, JDO, JMS, JRCK and JRST pins in the MT3318. I'm pretty sure that those are used to program the device in the factory.
// Wictor |
|
|
|
ProITM
11 Posts |
Posted - 15 août 2008 : 14:52:05
|
quote:
Originally posted by Wictor
Here are some images of the M-1200 PCB. Does someone know what is U15 IC in the first image?
Maybe U15 is a SPI memory. In Holux M241 schematics you can see Macronix MX25L SPI memory. |
|
|
|
lalamper
7 Posts |
Posted - 15 août 2008 : 21:23:40
|
So you said flashing was "successful".. But this firmware is for Holux-M1200 only (I got it from Holux itself).
Which file did you use? By telling the truth I dont know the difference between them..
Other: In the FCC documents you can find an engineer's name and phone number. Maybe it possible to communicate with him..?? |
Edited by - lalamper on 15 août 2008 21:55:27 |
|
|
|
Wictor
Finland
14 Posts |
Posted - 15 août 2008 : 23:06:26
|
quote:
Originally posted by lalamper
So you said flashing was "successful".. But this firmware is for Holux-M1200 only (I got it from Holux itself).
Which file did you use? By telling the truth I dont know the difference between them..
In the rar file there was two FW binaries for M-1200. I tried them both in my M-1200. Both were functional and I was able to use my Holux with BT and data cable.
But after the upgrade I noticed that my BT address was reseted to FF:FF:FF:FF:FF:FF. I wanted to have my Holux as before and program the address back to device. So I edited one of the FW bin file to have my BT address. Then I flashed the device again with edited binary. After that unit was working and had correct BT address.
Then I found out that there were other differencies in the first 256 bytes of flash memory. I thought that those are some device calibrations and I tried to program only memory area 0-0x100. THAT WAS BIG MISTAKE. As soon as download was done, I noticed that only red battery led was on and no BT led as normally after download. The problem is that you cannot erase only small part of the flash device, but you need to erase whole sector at once and program it right after that. I knew that thing about flash memories, but sometimes things just go wrong...
So now I have dead Holux and I guess I never get it back to functional again, because you need to have proper HW tools to program empty flash memories. And in this case flash is embedded to MTK GPS chip, which makes it even harder. I'm working with embedded systems, so I have access to some tools.
To summarize, you CAN program your Holux M-1200 with these two FW binaries, but you always need to program the whole program area 0-0x511FF. If you compare these two binaries you will see that the program area are identical in these two files, only differencies are in area between 0x100-0x1BF, which define FW versions, build id etc. |
Edited by - Wictor on 16 août 2008 08:02:28 |
|
|
|
lalamper
7 Posts |
Posted - 16 août 2008 : 09:46:07
|
| Thank you for the detailed description, Wictor. I am sorry about your M-1200, unfortunatelly I have no idea how to make it work. |
|
|
|
Wictor
Finland
14 Posts |
Posted - 19 août 2008 : 21:23:42
|
quote:
Originally posted by ProITM
It is saved in the flash memory.
It is the last chain from the first 256 bytes. If you made the read, and default length was set to 0x00000100 (in hex) is the last chain.
Address from F8 to FD in reverse order, is the BT address.
How did you get this information? Do you happen to know what other bytes in this area define? I have compared two different M-1200 units with same FW and their only difference is the BT address. So no unit specific calibration data...
// Wictor |
|
|
|
Topic |
|
|
|
| This page was generated in 0,95 seconds. |
 |
|
- 
- 
HOLUX M-1200 and M-1000B
