[Simri]

Question about (C905) DebugMux and developer firmwares:

What is SDKServer (on phone part, found this string in FW: SDKServer: Ready to serve the world!)
What is MoseS neede for Interactive Debug via DebugMux (pc part)
What is OpaAccess
What is ARM probes, DSP probes, Inject.

W760 [Brown]


K800 [Brown]

This post has been edited by Simri: 01 July 2009 - 10:19 PM

[Corman]

Where did you find this program?

[jamesbond22]

-corman-, on 2009-06-26 17:37, said:

Where did you find this program?

http://debugmux-logg...e.informer.com/

[RD274]

Thats a ad link ....

It contains NO INFO ... it justs exists so that it appears high up in the Google Search list!

[Simri]

DebugMux for Sony Ericsson Phones

Dont have to high hope/expectation!

Read First 1424-LZN9010345_Debug_Mux_User_Guide_Rev_H.pdf and Tips_and_Tricks.pdf
(Interesting program: Platform Assistant)

To get all function, you maybe need to use DEV firmware.
I only got print channels to work on brown W760 (TEMS firmware) and same on brown K800.

How to update PC DebugMux Server part unpack DebugMux Server Update to ... go to ... \3.6.0.0\ and copy DebugMuxSrv.exe to
C:\Program Files\Ericsson\DebugMux\Server or C:\Program\Ericsson\DebugMux\Server

PC DebugMux Server Version:
3.3.0.0 R3B
3.3.0.0 R3C (orginal version)
3.4.0.0 R3D
3.6.0.0 R3F

Attachment Removed

This post has been edited by Simri: 14 July 2009 - 04:12 PM

[jock]

hmm intressting indeed

[den_po]

Simri, on 2009-06-29 19:06, said:

I only got print channels to work on brown W760 (TEMS firmware) and same on brown K800.

wow, nice. it's helpful for debug purposes for those who haven't a service cable. but it will not help when a phone reboots =)

[Stonos]

den_po, on 2009-07-01 07:10, said:

but it will not help when a phone reboots =)

Actually, you can log a boot phase: Use DCU-60, in the logger right click on "Print server channel" and enable "Automatically open". Crash or restart your phone using an elf, and you will see that the logger will start logging a part of the boot sequence.
Of course, this is not the sequence that happens while you see the SE logo (the one that appears on cold-boots) where interesting things could be happening...

Here's a sad thing I learned for my FS today:

dbgmuxlogger.exe said:

FSFLASH: Mount block located @ 0x24EA2000
FSFLASH: 4 BAD blocks @ 0x25D0C000-0x25D0FFFF
FSFLASH: CLEAN blocks 18000
FSFLASH: MIN CLEAN blocks 128
FSFLASH: BAD blocks 4
[...]
FSFLASH: TOTAL number of blocks: 24576
FSFLASH: AVAILABLE blocks: 23633
FSFLASH: MAX logical block nbr: 44625
FSFLASH: COMMITTED blocks: 5607
FSFLASH: FREE blocks: 18026
FSFLASH: DIRTY blocks: 941 (4 BAD)
FSFLASH: CLEAN blocks: 17997 (5306 NOR)
FSFLASH: HEADER blocks: 27

Also, the phone sets various partitions to dirty and then sets them back to clean after a while. This seems to happen all the time, and I'm not sure if it's normal (probably not... ).

[den_po]

Stonos, on 2009-07-02 11:45, said:

Actually, you can log a boot phase: Use DCU-60, in the logger right click on "Print server channel" and enable "Automatically open". Crash or restart your phone using an elf, and you will see that the logger will start logging a part of the boot sequence.

you don't understand what have i meant =) you can't get a crash log by using dcu-60

### @JAVA shut down the Print Server! ###


################################################################################
###
################################################################################
###
This is the Platform Error handler
SW Build: R6DA001	 prgCXC1250546_GENERIC_MY
An error has been reported by the kernel:
user_called :	  0x0
 error code :	  0x80100113 OSE_EUNEXPECTED_EXCEPTION_REGDUMP
	subcode :	  data abort (data access memory abort) OSE_KRN (0x00100000)
	product :	  Kernel
header file :	  ose_err.h
	  extra :	  0x6033fa20
	  mode  :	  supervisor
	reg PC  :	  0x45BA8046
	reg LR  :	  0x4423E16D
	reg PSR :	  0x60000013
	reg SP  :	  0x6033FAEC
Current Process:  0x0001012b
Process Name:	 @JAVA
File:			 
Line:			 0

CRASH ID: 0x27731F4B
FAR: 0x45BA8046
IMEI: 352837-01-488698
Saved print info: start 0x202E7750 size 45904 pos 41432
Prints on queue info: start 0x201CDD60

### Saved Print Lines #############################################################

[Stonos]

den_po, on 2009-07-02 14:30, said:

you don't understand what have i meant =) you can't get a crash log by using dcu-60

Aha, that's very interesting. I should really get/make a service cable...

[the_laser]

moses is special kind of sdk compilation for test phone software on win32
"The MoseS application is built as a Win32 variant of the phone project and is used for simulating normal phone usage with increased debugging facilites"

not very intresting thing, sesam is much better (fully emulates hw of semc phones, using real phone software)

sdk server is simular rudiment from sdk build

dsp/arm probes is kind of "address points" for collecting different data from network state via tvp commands.
"opa" - open platform api

This post has been edited by the_laser: 04 July 2009 - 12:25 PM

[Corman]

Yet again a reply from the master ! This reminds me of an idea I had a while back (a phone emulator)

[Simri]

Some question about DB2020 securit
What impact have empty OTP or leave OTP unclosed on securit?
What impact have PAF (Product Activation Flag) on securit?
How to access llrs232-mode/lldebug-mode (LLRS232/LLDEBUG) via cable?

the_laser tanks for explanation.

This post has been edited by Simri: 04 July 2009 - 08:08 PM

[the_laser]

1. normal firmware will not run with empty OTP or run without radio enabled (unless you calculate xCRCs)
2. PAF is checked by loaders only, PAF=0 = r&d phone.
3. set logical one on service_n pin (connect it to vpp, it is done on any "standart" service cable)

[Simri]

the_laser, on 2009-07-05 00:42, said:

1. normal firmware will not run with empty OTP or run without radio enabled (unless you calculate xCRCs)
2. PAF is checked by loaders only, PAF=0 = r&d phone.
3. set logical one on service_n pin (connect it to vpp, it is done on any "standart" service cable)

But are that possible to run with OTP LOCKED:0 ?
What im intend about LLRS232/LLDEBUG is not Print Server, what im mean is access Interactive Debug* or cmd prompt:

example:

cd /
cd WAS_RRC
[WAS_RRC] ToggleRFC_2507_Capability
cd /
dir

*Interactive Debug Data Provider

[the_laser]

1. normal firmware will run with 5-locks on phone with open otp area, even with calculated xCRC.
2. it is firmware feature, either it have

// Enable Interactive Debug support
#define IDEBUG

or not have.

retail firmware are not, some developer firmware had enabled option, some are not.

Simri, on 2009-07-05 15:43, said:

But are that possible to run with OTP LOCKED:0 ?
What im intend about LLRS232/LLDEBUG is not Print Server, what im mean is access Interactive Debug* or cmd prompt:

example:

cd /
cd WAS_RRC
[WAS_RRC] ToggleRFC_2507_Capability
cd /
dir

*Interactive Debug Data Provider

[Simri]

the_laser, on 2009-07-05 20:48, said:

1. normal firmware will run with 5-locks on phone with open otp area, even with calculated xCRC.
2. it is firmware feature, either it have

// Enable Interactive Debug support
#define IDEBUG

or not have.

retail firmware are not, some developer firmware had enabled option, some are not.

Welcome to Interactive Debug

[root] dir
Contents of directory root:
WHAM			   <DIR>
PHYMaster		  <DIR>
BT				 <DIR>
TupL2			  <DIR>
DebugMux		   <DIR>
WAS_L2			 <DIR>
WAS_RRC			<DIR>
USB				<DIR>
Channels		   <DIR>
pd_mixsig		  <DIR>
HCITL			  <DIR>
LLRS232			<DIR>
CAS				<DIR>
USBLD			  <DIR>
SysCtrl			<DIR>
OBEX			   <DIR>
AT				 <DIR>
NTCSD			  <DIR>
GAS				<DIR>
SIP				<DIR>
Registry		   <DIR>
email_stacks	   <DIR>
RS232			  <DIR>
HTTP			   <DIR>
ConnManagerTest	<DIR>
AC				 <DIR>
UMTS			   <DIR>
WS				 <DIR>
OBEXServices	   <DIR>
dwld			   <DIR>
WV				 <DIR>
mms				<DIR>
AMS_UI			 <DIR>
FLAFLA			 <DIR>
SyncML			 <DIR>
AMS				<DIR>
MsgSms			 <DIR>
Provisioning	   <DIR>
email			  <DIR>
sca				<DIR>
ICA				<DIR>
ConnManager		<DIR>

[root] cd AMS_UI

[AMS_UI] dir
Contents of directory AMS_UI:
monitor_startup_time	<CMD>

[AMS_UI] cd /

[root] cd UI

[UI] dir
Contents of directory UI:
Apps		<DIR>
Platform	<DIR>

[UI] cd Apps

[UI\Apps] dir
Contents of directory Apps:
MMT			<DIR>
R2R			<DIR>
Mediaplayer	<DIR>

[UI\Apps] cd..

[UI] cd Platform

[UI\Platform] dir
Contents of directory Platform:
Bookshelf	   <DIR>
GUI			 <DIR>
GUIObj		  <DIR>
InfoBrowser	 <DIR>
dump_textids	<CMD>
proc_tim		<CMD>

[UI\Platform] dump_textids

  TextId	  Type	 Value
  0xE8000000  Sto	  ""
  0xE0000001  Reg	  "Standby"
  0xE0000002  Reg	  "InitBook"
  0xE0000003  Reg	  "ScreensaverBook"
  0x88000004  Sto	  "{0x200E}06-May{0x200E}-06"
  0x88000005  Sto	  "00:04"

  0x88000006  Sto	  "00:03"
  0x88000007  Sto	  "00:03"
Total: 8 allocated TextIds


[UI\Platform] cd \

[root] cd sca

[sca] dir
Contents of directory sca:
logging		<CMD>
parse		  <CMD>
heapdump	   <CMD>
roam		   <CMD>
rss			<CMD>
memdump		<CMD>
clearallocs	<CMD>

[sca] logging
One argument required: on|off

[sca] logging on
SCA logging is ON.

[sca]

But im get this error on run DEV firmware:

[COPS] Secured Data Tampered!
[COPS] Secured Data Tampered!
MMM IMEI = 099999-00-123456-0, IMEI_SVN=01
[COPS] Secured Data Tampered!
[COPS] Secured Data Tampered!

[COPS] Secured Data Tampered!
[COPS]:01,009,099,2298,27
[COPS]:01,008,036,0956,11
[COPS] Secured Data Tampered!
[COPS]:01,009,099,2241,27
[COPS] Secured Data Tampered!
[COPS]:01,009,099,2241,27
[COPS] Secured Data Tampered!		  MMPROT[SIP]: InitSIPTransport: Request_IMEI_Read failed
[COPS] Secured Data Tampered!
[COPS]:01,009,099,2298,27
[COPS]:01,008,031,0300,11

What is this:
[COPS] Rewriteable IMEI option is set!

This post has been edited by Simri: 16 July 2009 - 08:49 PM