I bought an 8GB iPhone 3G with a shattered screen planing to fix it. Sadly it turned out that the cracked glass wasn't all that's wrong with this phone. Firmware upgrades mostly end in a 1002 error and I get no Wi-Fi, no reception and no bluetooth. I've spent five days (and the better part of five nights) trying to fix this one.
I've tried just about every firmware and jailbreak there is. After generating 70+ iPhoneUpdater logs each one taking about 25 minutes to create I'm out of ideas. Please help!
Below are a few lines from a typical iPhoneUpdater log that I find especially interesting:
Code:
radio-error = 256
radio-error-string = 'Corrupted stack'
AMDeviceIoControl: failed, error 31, usbd status c0000004
USBControlTransfer: error 0, usbd status c0000004
<Restore Device 03791A28>: operation 19 progress -1
device returned AMR error 1002
I believe that operation 19 is a baseband upgrade. It takes about 10-15 minutes and is probably the source of the 1002 error. When iTunes finishes/gives up the restore, it spits out a whole lot of lines beginning with:
Code:
==== device restore output ====
Everything looks OK until it tries to Ping. It tries around 46 times, resetting and powercycling the baseband about 7 times. After the failed pings it says:
Code:
Modem appears to not be responding. Continuing to update with available firmware
Firmware Version: Unknown
EEP Version: Unknown
EEP Revision: Unknown
Boot Loader Version: Unknown or None
FLS/EEP Mismatch: Mismatch
Configuring Hardware Mux...OK
It repeats the pinging a few times and then:
Code:
-------------------------------------------------------------------------------
BEGINNING BOOT
-------------------------------------------------------------------------------
Sending boot code...Powering radio on through AppleBaseband
OK
Automagic-ing firmware from path /usr/local/standalone/firmware...
- FLS file /usr/local/standalone/firmware/ICE2_04.26.08.fls and EEP file /usr/local/standalone/firmware/ICE2_04.26.08.eep are available
Automagic-ing firmware from path /usr/local/standalone/firmware -- All OK
Version ICE2-04.26.08 is available
Deciding whether to update or not...
- Loaded version is unknown, updating anyway.
Deciding whether to update or not -- All OK
Reading Reference file /usr/local/standalone/firmware/ICE2_04.26.08.fls...OK
Sending EBL Loader...
Sending EBL Loader Length...OK
Sending EBL Loader Data...OK
Sending EBL Loader Checksum...OK
Sending EBL Loader -- All OK
Sending EBL...
Sending EBL Length...OK
Sending EBL Data and Checksum...OK
Sending EBL -- All OK
Getting EBL Version......OK
- Boot Mode 0xCC
- EBL Version Major/Minor: 6.2
- EBL Version 'ICE2_RAM_B'
- Flashing Compression: 0, CRC Type: 0, CRC Method: 1
Reading Reference file /usr/local/standalone/firmware/ICE2_04.26.08.fls...OK
Sending Protocol configuration...OK
Sending Flash ID...OK
Doing CFI Stage 1...OK
Doing CFI Stage 2...OK
-------------------------------------------------------------------------------
DONE BOOT
-------------------------------------------------------------------------------
Getting software version of file /usr/local/standalone/firmware/ICE2_04.26.08.fls...OK
Increasing baud rate to 921600...OK
Validating EBL Version...OK
-------------------------------------------------------------------------------
SENDING FLS FILE: /usr/local/standalone/firmware/ICE2_04.26.08.fls
-------------------------------------------------------------------------------
Loading FLS file /usr/local/standalone/firmware/ICE2_04.26.08.fls...OK
>> Sending Block of type CodeClass(0) from file /usr/local/standalone/firmware/ICE2_04.26.08.fls...
Beginning Dynamic EEP erase at 0x20E40000 to 0x20EBFFFE...Progress: 0 percent, 0 of 524286Progress: 100 percent, 524286 of 524286. OK
Sending Security Block...Timed out
Trying again (9 tries left)
Configuring Hardware Mux...OK
It repeats from "BEGINNING BOOT" nine times but always ends with "Sending Security Block...Timed out". It then starts over with the pinging and tries to send security block another nine times (can't blame it for not trying!). Finally it ends with:
Code:
Sending Security Block...Timed out
Giving up
!!! Exception at :0:
- BBUReturnTimedOut(10)/2: Command receive error, progress 0 of 6
My conclusion is that iTunes isn't able to update the baseband. After restoring I usually get stuck in the recovery mode loop. I get out of it with iRecovery -s and "setenv auto-boot true". Here are a few interesting lines from iRecovery:
Code:
(Recovery) iPhone$ radio detect
Radio board detected.
(Recovery) iPhone$ radio version
Unknown
(Recovery) iPhone$ radio readnvram
Radio NVRAM Entries:
(Recovery) iPhone$ radio vitals
Radio status is Corrupted stack
ping ok med phasbandupdater
Again we see this Radio Corrupted stack which I believe is the problem. The empty Radio NVRAM is also worrying.
After getting out of the recovery mode loop I can jailbreak and get into the phone. Here are some info from Settings > General > About:
Code:
Network: Not Available
Carrier: Not Availible
Wi-Fi Address: N/A
Bluetooth: 00:00:00:00:00:00
IMEI:
ICCID:
Modem Firmware:
I can get the iPhone to this state on just about every firmware available for the 3G. I've transfered a whole bunch of apps through USB. OpenSSH, Mobile Terminal, Fuzzyband, Bootneuter, etc...
Fuzzyband, Bootneuter, etc. all gets stuck at Querying Modem and similar.
The one thing I did that actually yielded some kind of result was running phasebandowngrader. On firmware 3.0 and 3.1.2 it didn't do much, but on 2.2.1 however it got interesting:
Code:
Validating parameters...OK
Disabling sleep...OK
Powering radio on through AppleBaseband
Opening device path /dev/cu.debug, using initial baud 115200
- Ping OK
Modem appears to not be responding. Continuing to update with available firmware
Firmware Version: Unknown
EEP Version: Unknown
EEP Revision: Unknown
Boot Loader Version: Unknown or None
FLS/EEP Mismatch: Mismatch
Configuring Hardware Mux...OK
-------------------------------------------------------------------------------
BEGINNING BOOT
-------------------------------------------------------------------------------
Sending boot code...OK
Reading Reference file ICE2_02.28.00.fls...OK
Sending EBL Loader...
Sending EBL Loader Length...OK
Sending EBL Loader Data...OK
Sending EBL Loader Checksum...OK
Sending EBL Loader -- All OK
Sending EBL...
Sending EBL Length...OK
Sending EBL Data and Checksum...OK
Sending EBL -- All OK
Getting EBL Version......OK
- Boot Mode 0xCC
- EBL Version Major/Minor: 6.2
- EBL Version 'ICE2_RAM_B'
- Flashing Compression: 0, CRC Type: 0, CRC Method: 1
Reading Reference file ICE2_02.28.00.fls...OK
Sending Protocol configuration...OK
Sending Flash ID...OK
Doing CFI Stage 1...OK
Doing CFI Stage 2...OK
-------------------------------------------------------------------------------
DONE BOOT
-------------------------------------------------------------------------------
Getting software version of file ICE2_02.28.00.fls...OK
Increasing baud rate to 921600...OK
Validating EBL Version...OK
-------------------------------------------------------------------------------
SENDING FLS FILE: ICE2_02.28.00.fls
-------------------------------------------------------------------------------
Loading FLS file ICE2_02.28.00.fls...OK
>> Sending Block of type CodeClass(0) from file ICE2_02.28.00.fls...
Beginning Dynamic EEP erase at 0x20E40000 to 0x20EBFFFE...Progress: 0 percent, 0 of 524286Progress: 100 percent, 524286 of 524286. OK
Sending Security Block...Timed out
Trying again (9 tries left)
Configuring Hardware Mux...OK
It tries nine times but "Sending Security Block" always Times out. Finally it Gives up:
Code:
Sending Security Block...Timed out
Giving up
!!! Exception at :0:
- BBUReturnTimedOut(10)/2: Command receive error, progress 0 of 6
Re-enabling sleep...OK
___________________________________
Sucess!
Reboot your device and check your Baseband number.
It should be 02.28.00 now. Run Yellowsn0w and have fun.
Still it's not able to send the security block what ever that is. But at least it managed to Ping OK! This should mean that the radio unit isn't completely dead?
After booting up something has changed in Settings > General > About:
Code:
Carrier: (null) (null)
Wi-Fi-address: N/A
Bluetooth: 00:00:00:00:00:00
IMEI: XX XXXXXXXXXXXX X (censored)
ICCD:
Modemfirmware: 02.11.07
In this state I once again ran the radio commands from iRecovery but they still didn't show any improvement.
One interesting thing I did was to in iRecovery enter the wifiaddress:
Code:
setenv wifiaddr xx:xx:xx:xx:xx:xx
The wifiaddress I entered then showed up in Settings > General > About. Wifi still didn't work though. I suspect that it needs a few lines more then just the MAC address.
The symptoms of this problem matches almost exactly those of a problem that people had with the 2G iphone. They seem to have fixed it by downgrading to 1.x firmwares and then reflashing the baseband. Sadly I haven't been able to get a 1.x firmware working on my 3G. I've come across a few people with the same problem on the 3G but no one seems to have fixed it.
Sadly the 3G doesn't have a separate communications board so changing the baseband/radio chip would mean changing the whole board. These boards cost more than I payed for the phone so it's not an option.
Desoldering the radio chip and reprogramming it should work, but I can't find anyone with the required tools and skills. Does anyone know where I could get a job like this done?
Any and all input would be much appreciated!
LinkBack URL
About LinkBacks
Help with error 1002
Originally Posted by brokenBB
Reply With Quote
Posting Permissions
