iPAQ 1940 stuck in bootloader screen

I am in the same situation as you, except that my iPAQ 1940 has a bad ROM, corrupted by the "iPAQ Backup" program storing too much information on the "File Store". I have been trying to upload a proper ROM and stumbled upon the boot screen as you have above. This boot screen is the "parrot" screen, I think, and can be accessed by pressing "power", then all 4 bottom buttons (calendar contacts mail today) and then reset. It takes a few tries and a bit of finesse...

As for getting out of this screen, I have only found 1 command that works (g xx). I assume it means Goto, as in "start executing code from address xx."

Try mtty, connect to the usb port and type "g 0"

Otherwise, I've been able to leave the screen by just performing a hard reset. I assume the bootloader accepts the same commands as the 22xx series, but the CPQHAMMER password doesn't seem to unlock anything for me.

I haven't found anything online about this, and asked HP to reflash my ROM since it's still under warranty, but their courier service is taking forever to pick it up, and I would also rather not be iPAQless for over a week!

Can anyone help me out with a bootloader password?

Hi firehawk2k,

THANX for help!!! Finally a usefull answer... :o)))

That means iPAQ is responding at least to something...
I tried g 00, g 01 ...
On some of these it just reboots and goes again into the bootloader screen...

hmm interesting...

Without this password it is not possible to load ROM image, i guess. Right?
...and because we can't see any prompt in the MTTY, we can't dump the password from the ROM with "mb 7500 11" command. Right?

Additionally I found some interesting link here:
http://michaelo.free.fr/pda/h2210/original_bootloader_commands.html

THANX for help

Well, I do see a "USB>" prompt in my MTTY, but it doesn't accept any commands except "g" (and "usb" but that seems to terminate the link). Ya I've already tried the h2210 commandset with no luck... Either it's completely different from ours (maybe the ver 1.08 or the xScale?), or it could be that almost all of the h1940 command functions are factory locked out until the password is entered.

Too bad nobody has tried documenting tweaking an h1940. I would beg HP support for help on this, but I'm thinking it's venturing into warranty-voiding territory.

I'm sorry, but I don't think I can help much more on your problem... I'll post more if I learn anything else.

I knew I should have gotten a palm!

Have you tried this ?

http://www.geocities.com/ipaq41xx/

>press record button to enter bootloader main function

Hi microwire,

that's a cool stuff there... however, it doesn't work for me.
I tried record button, but no response from terminal... :o((
..also other buttons... :o(

THANX

The 1910 is an early version of 1940, but under wince 2002 and a different chip, right?

http://handhelds.org/download/feeds/wince/h1910/h1910-bootldr
I've stumbled upon the h1910 bootloader v.1.02 and read through the insides, finding a list of commands:

readcpuid ruu setcompr readuid wm button adc uart usb romchip lcdtest sd2r r2sd cp lr map ram s ppdl lcp l ud u eb eh ew mv mw mh mb g r h

So far, none of the memory (mv mw mh mb) functions seem to work, and neither does the help (h) function, but I have gotten rom to sd (r2sd) to work! (Notice how 'r2sd' is different from the 22xx command 'd2s')

I am skeptical about trying sd2r, since the ROM dump seems to include the diagnostic and bootloader, and dumping these back into ROM might corrupt my only means of interfacing with the iPAQ.

Do you guys think I should purchase an SD card reader, zero out the hex inside, dump the ROM, and overwrite it with a working ROM hex dump? I don't know what the offsets are for the bootloader, diagnostic, and WinCE ROM.

Or maybe I could purchase a new 1940, r2sd the ROM, return it, and sd2r it back to mine?

I have found something interesting though. There seems to be the string "Power Bootloader from SD card? OS from SD card? ROM from SD card?" that suggests that there's a command you can use to boot from SD, bypassing the ROM. I would prefer this, seeing as I wouldn't want to overwrite (and potentially further damage) my ROM, but I'm having trouble finding the command.

I'm still reading through the rest of the 1910's bootloader, but it's mostly strings... I'll keep you posted.

MAN THAT'S PERFECT!!!!

THANX A LOT... :o))

Now I know it's doing something... I just did a backup to SD.. :o))))

There is a command "ruu" which means Remote USB Update... After that command I can finally see some response from the iPAQ:

ruu
hp iPAQ h1940.00.06 GER

I must now find out, how to send the image back to iPAQ....

However, I will play now with SD...

...I just tried "lr" command:
>lr
>start download

:o))))

Out of curiosity, did the lr command work? And which ROM file did you upload?

I've fixed mine, I think.

Just as a precaution, maybe use WinHex to fill the SD with zeros first (from the Edit menu) through a card reader, otherwise you might have extra data in your ROM??
If you do have a valid ROM image in your SD, doing a bootloader init will give you the option of flashing from SD, so you don't even need to be connected to the computer.

Also as a side note, during my update from 1.00 to 1.10 ROM, I accidentally unplugged the usb cable. The uploader complained, but said to hard reset, reconnect, and run the uploader again. After a hard reset my iPAQ was dead as a brick, but the uploader was still able to connect and upload. I'm guessing there might be a hidden registry setting that indicates that it was interrupted, and lets it skip to the upload while bypassing the activesync step.

Is this a way to change the language ?
I have a spanish 1940 and would like to change the lang. to english or german. ROM-Updates are now available in ENG/GER/FRA but I didn't found any hints what to change including checksums.

Regards MW

well, on "start download" I'm getting "\.\\WCEUSBSH001 Request header time out" :o(((
...and while my ROM appears to be corrupt, I can't use it for restore from SD... well, it works, but after a while it just stops... I mean the lower progress bar came to approx. 25% and then it's over...

I have another h1940 here, which is working well, but I don't know, how to swith it to "parrot", so I can make a SD backup from it...

Would it be possible for U to send me your SD backup??

THANX
Buzz

Parrot on the 1940 is as I described above...
"...can be accessed by pressing "power", then all 4 bottom buttons (calendar contacts mail today) and then reset. It takes a few tries and a bit of finesse..."
Try putting it on a table, hold thumb on power, and each of your other fingers on the other buttons. Then with the stylus in the other hand, click the reset. It usually takes me 2 tries to get it to power on to parrot.

Unfortunately, I've tried to copy my SD backup to HD, but either my card reader or winhex doesn't like that it lacks a FAT file system. Any ideas? WinHex complains of an invalid drive, Windows complains that it isn't formatted, and Windows Disk Management reports a healthy partition lacking a file system.

As for the language issue, I've read that you need to copy a hex edited image AFTER the updater finishes its checksum routines, but BEFORE it begins uploading.
http://www.expansys.com/forumthread.asp?code=FR-IPAQ5000&thread=2

Otherwise, maybe try the "writeasset 1940 eng"? command documented here:
http://www.geocities.com/ipaq41xx/commands.html

I just found some additional commands:

http://www.geocities.com/ipaq41xx/sd_to_pc.html

for the winhex saving the image from SD:

Tools -> DiskEditor

There U can see "Logical Drives" and "Physical Media"
U must take it from the "Physical Media" subtree...
Or U go to:
Tools -> DiskTools -> Clone disk
and do it there, as I did... :o)

I tried all 4 bottom buttons + reset + power on the other iPAQ, but I can't manage to get it right, because once U press any of those 4 buttons, iPAQ is started....

...this time it worked... I'm in "parrot" :o)))
gonna do the backup of the working iPAQ...

Hi firehawk2k,
I did successfuly restore from SD (backed up from another h1940), but still, it wont start properly. Just into the "parrot"...

I think, that's it... I'm giving up... will send it to HP on Monday... :o(((

Anyway, it was quite interesting. THANX for help.

When dumping the ROM to the SD-card, keep in mind, that the ROM in the 19XX-family seems to be compressed. HP uses the zlib-functions (same as PKZIP) to inflate/deflate the ROM during cold boot up.

There is a command setcompr which might has some influence on this.
Anyway, please let me know if you successfully coud transfer the ROM from one ipaq to another.

@firehawk2k
I couldn't find a similiar language-line in the ROM as the one described in the article. writeasset doesn't seem to be a functional command on the 1940. I couldn't try this at the moment, because i need the warranty from HP to have them change my broken display

Regards Patrick

Remove the battery for app. 1 minute after that switch on the device.
This is the way, i returned from parrot-mode

MW

Hi firehawk & microwire,

THANX for your help, but I just sent it back to HP... :o(
Anyway, it was very interesting "research" into the bootloader commands.. :o)
Maybe we should post some summary of it...

Anyway, I will continue with the "parrot" stuff once I will receive new iPAQ...

I'm losing respect for HP now... Supposedly a courier was going to pick up my broken iPAQ after 2 business days, but it's been 3 weeks already and still nothing- (I haven't cancelled my service request).

I'm pretty glad you guys helped me fix it, otherwise I'd be still waiting without an iPAQ for over a month. Thanks a bunch.

Just a note though... It seems that HP has removed the 1.10 ROM update for the 1940 and replaced it with a 1.00.03 update. I'm not sure what this new (or old) ROM does, or if they took it away because of any problems with 1.10? But it seems like it's just the 1.00 ROM again. Here's a link:
http://www.ipaqabilities.com/iaforums/viewtopic.php?t=41

Any news?

Yesterday I tried to upgrade my ipaq from 1.00 to 1.10 and it failed, and now I see only the bootloader screen.
I've tried to go to "parrot" mode, but it doesn't work (I tried MANY times).

Using mtty the only commands ipaq seems to accept are:

"ruu", that print model, version and language, then it wait for me to send 8 more characters (a password? a mem address?), after that ipaq reset.

"g <address>" that should jump to an absolute address in memory (unuseful without knowing function start address)

"usb" that close the connection.

The "lr" command seems to be a mtty internal command, and not an ipaq one.

Can anyone post a 1940 bootloader dump?

Note about ROMUpdateUtility:

1) it check activesync connection
2) read ipaq model and language
3) download and execute EnterBootLoader.exe to enter bootloader mode
4) start uploading rom

When it fail it should restart from point 4). Bootloader is waiting for data. Instead in my case restart from point 1) after the failure, but activesync doesn't work no more, so it sto telling I've not connected the ipaq.

There should be a way to skip directly to 4) (a registry key or a command line option) anyone knows?

If I launch ROMUpdateUtility with any command line option (from CMD) it show immediately a window telling "congratulation, rom uploaded correctly"

There is an hidden command (but I don't know hot to use it) called "ByPassBootloaderCheck"

I hope someone will find a solution I don't like to send my ipaq back to hp to restore (and I think I will NEVER upgrade it again)

I MANAGED TO GET IT WORK!!!
I DO NOT BELIEVE IT!!!!!

It's really simple:

regedit

In HKEY_CURRENT_USER\Software\ROMUpdateUtility\HB20
1) create a dword key called "ByPassBootloaderCheck" with the value 1
2) create string a key called UpdateFile, with the value
"C:\iPAQ\SP26263\H2B11020uo.nbf" (or whatever your rom file name).

Restart ROMUpdateUtility, and it will download the rom directly to the IPAQ bootloader and complete the install (without checking for activesync)!

That's all folks

Hi thedayofcondor,

That's really interesting!!

Is it working now? Any problems? Did U have any problems before?

I've got new iPAQ now and the first thing I did was a complete ROM dump to SD card. So if you still need it, I can send it to you.

Now I would like to get my "broken" iPAQ back to test, if I can fix it this way (with registry). :o)

well I can still execute the "EnterBootLoader.exe" on new iPAQ, but would rather not risk it :o))))

B.

Dear buzz

How did you reach the parrot on the new ipaq?
I also have a new ipaq (display was broken) but i couldn't made it to the parrot mode with this one. On my old ipaq, i made it 1or 2 times but it was not easy.

What i tried with the new one:
I executed enterbootloader.exe and had the same situation like you
-> bootloaderscreen.

But whith condors info's I made a romupdate skipping steps 1-4 which at the end sucessfully resets the ipaq to normal operation.

Note about ROMUpdateUtility:
1) it check activesync connection
2) read ipaq model and language
3) download EnterBootLoader.exe to the ipaq
4) execute EnterBootLoader.exe to enter bootloader/parrot-mode
5) start uploading rom
6) resets the ipaq to normal operation

I think, there must be something like a bootloader-command to resets
the ipaq and put the loader to normal state to start PPC.

Did you think, there is a difference in the bootloader-mode you reach with the buttons and the one you get with EnterBootLoader.exe ?

MW

hmm...

normally you can get the bootloader this way:

" ...can be accessed by pressing "power", then all 4 bottom buttons (calendar contacts mail today) and then reset. It takes a few tries and a bit of finesse..."
Try putting it on a table, hold thumb on power, and each of your other fingers on the other buttons. Then with the stylus in the other hand, click the reset. It usually takes me 2 tries to get it to power on to parrot."

I found, that U should release the reset first. Then, after a second release all other keys...

I'm really glad, that thedayofcondor found this trick with registry.
There were couple of people stuck after executing bootloader.exe...

I think that the difference is not in the bootloader itself, but in the way U start it. What I think is, that when U just press buttons, U can get there, but after reset, this state of iPAQ is forgotten. Probably it was not written into the iPAQ's "boot registry/options". However I suspect, that when U execute "enterbootloader.exe" on iPAQ it writes something into iPAQ's "boot registry/options", which prevents it to start normally until U successfuly make an upgrade with RUU. Then (i think), RUU @ the end of upgrade process resets that boot flag to normal...

Does it make any sense???

For me it does, because it looks like some funny kind of protection when upgrading.
In case that upgrade is interrupted, the bootloader waits there for new ROM upload from RUU.... of course, with the registry set with ROM file...

My ipaq now work perfectly (even if I has not noticed so big improvements with 1.10 version)

I've also hacked romupdateutility to skip language check, so I uploaded english version to my italian ipaq

I've tried the parrot mode... the only differences I see are a "SD" statement under 1.07 when a securedigital card is inserted, I can exit parrot mode with an hard reset and I have a USB> prompt in mtty.
I think parrot mode is a more complete version of bootloader (but help command does nothing)

WARNING: If you type ruu, you exit parrot mode and enter bootloader, no more USB prompt a no way to exit without uploading rom again

The enterbootloader.exe does nothing, except a call to a system function that enter bootloader mode... so bootloader should be a stand alone application, able to complete the download.

"WARNING: If you type ruu, you exit parrot mode and enter bootloader, no more USB prompt a no way to exit without uploading rom again"

...you mean, to do the registry trick to upload and exit... right?

I must cut out those 256k from the whole backup. I'll send a link to you.
However, there are commands to backup just some parts of the ROM.

Anyway, what "hack" to UpdateUtility do U mean? It looks to me, that when U say in your registry, which file U want to upload, that's it... I've got my German iPAQ converted to English just by renaming and exchanging the ROM file after version check.

quote:Originally posted by buzz_lightyear

"WARNING: If you type ruu, you exit parrot mode and enter bootloader, no more USB prompt a no way to exit without uploading rom again"

...you mean, to do the registry trick to upload and exit... right?

I mean that if you go to parrot mode pressing the four keys while doing hard reset, you return to wince hard resetting again. If you type ruu you switch to simple bootloader, and from it the only whay (I know) to return to wince is uploading the rom again (with the UpdateFile trick)

quote:
I must cut out those 256k from the whole backup. I'll send a link to you.
However, there are commands to backup just some parts of the ROM.

I know, but I have no sd card reader available at the moment

quote:
Anyway, what "hack" to UpdateUtility do U mean? It looks to me, that when U say in your registry, which file U want to upload, that's it... I've got my German iPAQ converted to English just by renaming and exchanging the ROM file after version check.

Actually if you use the UpdateFile trick there is no reason to exchange the files. You can simply change the label in rom file header, as file checksum is skipped (as the activesync check).

With "hack" I meant that to be sure that uploads worked without problem, I removed the language check from ROMUpdate Utility code.

hello thedayofcondor

I followed your instructions in trying to upgrade from italian rom to english 1.10, but i am stuck with parrot mode and apparently the regedit updatefile trick doesn't work for me !
I must be doing something wrong ...
I am not supposed to change anything in the h2b11020uo.nbf file, just the UpdateFile in the regedit ?
The RomUpdateUtility still says that ipaq is not in line with rom version, after i push on the update button !
Could you please advise, my Ipaq 1940 is dead otherwise !!

What about the hack that you developed ?

I also have done a backup on SD of the old italian ROM, but I can not upload it back either. (On parrot mode sd2r works, completes the long upload successfully but then it does not start - i assume it waits a g xxxx command but i don't know the appropriate address)

Many thanks in advance

Don't worry, bootloader work well, it is never overwritten by a correct rom upgrade, so it will ever keep working

1) the updatedile trick should skip only the activesync check. You still cannot upload an eng rom over an italian ipaq as there is sttille one level of check. To succeed you must edit with an hex editor the rom file, changing ENG to ITA in the rom dump header. This is straightforward only if you upload the file in bootloader mode using the registry hack as the file is not checksummed.

2) make sure activesync is not running during update: that is, kill wcescomm before you start the update, otherwise activesync will get the usb interface ownership, and romupdate will fail.

The correct procedure is:
add updatefile key in the registry
edit the romfile to change ENG with ITA
kill activesync
detach ipaq from usb
hard reset it
connect again to usb
start the update

...and it should work

quote:
I also have done a backup on SD of the old italian ROM, but I can not upload it back either. (On parrot mode sd2r works, completes the long upload successfully but then it does not start - i assume it waits a g xxxx command but i don't know the appropriate address)

To exit the parrot mode you should hard reset the ipaq, and it will jump to wince. If this doesn't work then you're not in parrot mode, but in boootloader mode, and the only way to recover is upload the rom with romupdateutility.

I don't know the file format used by r2sd, but ruu use .nbf format, that should include other informations more than a simple rom dump, so please don't try to upload your italian romdump with it as it potentially could overwrite the bootloader