Trying to unbrick a zumo 220

**kunix** · 3rd November 2014, 10:45 AM

Neil, it does make sense to compare the fw_all.bin being flashed and the fw_all.bin dump, regardless if fw_all.bin is packed or not.

Unpacking is always made in RAM, after fw_all.bin is copied there from flash.
And by comparing fw_all.bin being flashed and dumped one we test the flash chip.
I've seen some flash chips not saving data to some blocks.

Actually It's better to compare the original fw_all.bin, as it's bigger and we can test more flash blocks.

**smokefree** · 3rd November 2014, 10:58 AM

OK, here's the result. I used the original (non-packed) fw_all.bin:

- As of offset 0081BF00, fw_all.bin is empty, where 14.bin contains only FF's up to and including offset 0087FFF0.
- The only real difference found, is in offset 00000010. fw_all.bin reads 0C 80 A0 E1, where 14.bin reads 0B 80 A0 E3. See screenshot below:

SG0UBHe

This difference looks a bit like step 2 in post #4, but there 0C 80 A0 E1 in the original file is changed into 0C 80 A0 E3 (the 0C at the beginning is left unchanged there).
What does this indicate? How did the 0B end up inside 14.bin?

**smokefree** · 3rd November 2014, 11:10 AM

Originally Posted by Neil

It seems logical to me only by comparing 14 to the original [or unpacked] fw_all can there be a valid comparison. So in essence, whether the flash was done with original or packed fw_all, the compare of the dumped 14 has to be to the full [not packed] fw_all, is that right?

...which is what I mentioned in the first line of post #29.

**kunix** · 3rd November 2014, 12:16 PM

I think all hex editors have a fill operation.

UPD:
I'm very kind today that's why I generated 128MB of 0x3E for you! You can cut it as you want and hope it's enough. Keep the change.
[Only registered and activated users can see links. ]

**smokefree** · 3rd November 2014, 06:33 PM

Originally Posted by kunix

I think all hex editors have a fill operation.

Hardly ever used a hex editor, so was not aware of the "fill" function. I made a copy of the fw_all.bin file and replaced the contents with 0x3E, hence resulting in the exact same size as the original file.

A new challenge came up however: immediately when the unit is brought into pre-boot mode, the screen shows LOADER LOADING and freezes there. Therefore I'm currently unable to flash anything. Even an hour later the screen still shows the same. FYI: the unit still has CURE FW inside.

IJV3e1T

Edit:
The correct sequence of events is as follows:
1. Updater.exe is standing-by to flash the tweaked fw_all.bin.
2. The zumo is brought into pre-boot mode successfully. See screenshot below:

5TeX6zs

3. OK is clicked in the Updater.exe window.
4. The "Updating Software In..." window is shown very briefly only. See screenshot below:

gxH5WZ4

5. Immediately after the above window is shown, it gets covered by another window, showing an error message from Updater.exe. See screenshot below.

na5HkqK

6. At the very same moment, the zumo shows LOADER LOADING and freezes. The display remains frozen after removing the USB cable. The unit has to be switched off manually.

Note: I am able to flash CURE or ORIGINAL FW into the unit using GarminCure3 and Updater.exe. Just not this 0x3E version of fw_all.bin.

**smokefree** · 3rd November 2014, 06:56 PM

If fw_all.bin IS 14.bin, would it not be an idea to correct the two bytes of the dumped 14.bin file in a hex editor so it is identical to the original fw_all.bin (except for having the FF's at the end) and flash it back into the zumo via microSD?

I know how to modify the file in a hex editor. Just need the exact syntax how to flash rgn14 back via microSD.

**kunix** · 3rd November 2014, 07:43 PM

Have you just used a patched boot.bin for update.txt execution?
Use the original one.

The whole idea behind 0x3E is to locate the broken flash block. If you just change two bytes, you will only test 1 or 2 blocks, depending on the location of bytes.

**smokefree** · 3rd November 2014, 08:10 PM

Originally Posted by kunix

Have you just used a patched boot.bin for update.txt execution?
Use the original one.

The way I tried to flash the 0x3E version of fw_all.bin is by dragging and dropping it on Updater.exe and bringing the zumo into pre-boot mode. From post #8 I understood that is the way to do it. There was no boot.bin involved in my method. Do I understand correctly from your reply I should use the microSD method?

**kunix** · 3rd November 2014, 08:16 PM

Oh my..
updater.exe expects you to feed him RGN file, which has some special structure and headers. I have no idea what happened when you fed him with this garbage

You should have built an RGN file from the original boot.bin and this fw_all.bin.
And actually I've just realized that RGN_Tool wouldn't allow this (it won't detect fw_all.bin's region. It's a stupid idea to detect regions by file contents, as it turns out).
You would need makergn.exe or gfw.exe to build such RGN.

So, yes, it's better to flash this file with update.txt with the following command: xrgn,14,1:/14.bin.

**smokefree** · 3rd November 2014, 08:49 PM

Originally Posted by kunix

<...> it's better to flash this file with update.txt with the following command: xrgn,14,1:/14.bin.

OK, but from post #1 (Edit 2) we know that the zumo does not read from the microSD voluntarily. I needed to perform the trick Neil described in post #4. Would that be the same procedure for this 0x3E version of 14.bin file?

Thread: Trying to unbrick a zumo 220

Thread Tools

Display

Hybrid View

Advertissements

Bookmarks

Bookmarks

Posting Permissions