• Fix LRF
The purpose of this page is to provide introduction to the way to get into completely"dead" PRS-500 and PRS-505 Readers and collect links to original efforts (to get an idea where to read and whom to ask) and useful tech files. My contribution is minimal, I tried this method myself on PRS-500 reader (on the operational reader, just to test the method). On this page you will find the links and detailed description of my experience. If you are not familiar with the discussed problems, please ask your questions in the-ebook.org or mobileread.com forums.
At the bottom of this page you will find also dumps of NOR and NAND flashes of operational (russified) PRS-500 and PRS-505 in case somebody will need some part for it.
The story (as per 01/08/09).
From the very moment it was known that main processor has 2 "hardware" ways to access internal registers and therefore to get a possibility to modify content of the memory. They are JTAG and bootstrap. Location of JTAG or boot pins were unknown untill service manuals for 500 and 505 became available.
As far as I know there were several successful attempts to unbrick the readers with both bootstrap (wenjie, his post) and JTAG/bootloader (root, his post and discussion form here) (to my current knowledge, sorry if I missed something or somebody). All the following is a result of kind help of root (see discussion). He has used code of wenjie and has compiled the uboot.bin bootloader (latest version v3). I made b-records of his uboot.bin, used b-records for initialization from wenjie's project and added some more b-records built from wenjie's C code. Links to the mentioned projects can be found in the discussion. The bootloader is named and shows itself as "505" but it perfectly works for 500 as well.
So now it is possible just upload the b-record files to the Reader and get running bootloader program which provides set of commands and drivers to operate with the Reader. Note, with the bootloader neither part of original PRS-50X code is used, it means the Reader can be restored virtually from any possible damage of the firmware. Uploading the bootloader is safe, because its located in RAM, but executing the commands requires special attention, because any part of the firmware can be modified without warning.
Principle of operation, from MC9328MXLRM.pdf processor manual:
The main processor have 4 pins (boot pins) which determines from where to load the program. In the original PRS configuration they are set to 0101 which means boot from CS0 space. There is special combination 0000 (bootstrap); when this combination is set, UART of the main processor is ready to accept so called b-records. With the b-records one can access internal registers and internal memory of the processor. In this mode baud rate is set automatically based on the serial communication attempt. To run uboot bootloader program we need access to the RAM where uboot will be uploaded and some more "hardware" settings. This is done with b-records accessing internal registers of the processor. This b-records are in the "init.txt" file. After we have access to RAM, we just upload uboot itself to 0x09000000 address of RAM (in b-record format) and execute it from this address ("uboot.txt" file). After successful run of the uboot there will be serial communication with the device and set of uboot commands can be executed, uboot has a code to access all types of the memories (RAM and NOR, NAND flashes). In the following instruction all init files are cobined with the u-boot (u-boot_v2.txt).
The steps are (see tools at the bottom of this page):
3. Using hyperterminal program (Windows) or similar set communication parameters to 57600 8-n-1, control flow :none.
01/12/09. root modified bootloader to v3 which supports upload of kernel (also provided by root), please see discussion (in Russian) for successful application of this method to PRS505:
kernel for 505 kernel for 505 which can be uploaded and executed with bootloader v3
Autorun Script to get content of the flash (from operational Reader), use 1Gb card, because mtd2 is huge.