source: tt-loader/README @ 13

TT-Loader

This program is for advanced users. You should consider it as beta software
and we can't guarantee it will do what it is expected to do. So if you
use it, you admit you're using it at your own risk.

This is a program loader derivated from OMAP Flash Loader, a replacement
by Luis Recuerda for the FlashRecoveryUtility program from Tim Rikkers
(http://tree.celinuxforum.org/CelfPubWiki/FlashRecoveryUtility).

This program can load alternative boot loader on OMAP730 plateform when
starting the device with an USB cable plugged. It is designed to be used
with the "TwinTact" (also known as E2831 device), aka TT, a mobile phone
by neuf, a french telecom company.
Also, this program is for Linux (and perhaps other Unixes), not for M$-windows.
And, the better of all, it is GPL, with all its sources, not a binary program.

omapfl program has been developed using reverse engineering on the protocol
communication between the original program and the internal boot. Luis have not
totally understood that protocol, but it works. ;)

To compile this program you only need a gcc compiler and the libusb
(http://sourceforge.net/projects/libusb/) instaled at your system.

To use it, executes the program passing it two arguments. First argument is
the second stage loader (the included/compiled 2nd.bin file) and second one
is a text file with a serie of command (example in commands.txt). Then, plug the
USB cable in the phone, no need to power with the power button. If it doesn't work,
you will have to unplug the USB cable and remove the phone battery.

You can also have an automatic detection and launch using udev. Get udev twintact.rules from
tt-tools at http://source.pkg.fr/doc/Projets/tt-tools and the twintact-udev script. In
that last script, you have to check line 49 to do what you need.

The file "2nd.bin" is the second stage boot loader. The main program (tt-loader)
send it to the OMAP processor, where it is executed by the internal boot
loader. Then this last will expect some command to prepare a third stage boot loader.

To process, you will also need some third stage boot loader for upload. The first way
to get one is to dump it from your own phone from the native linux environment. I
assume you know how to connect with at least telnet... maybe dropbear from tt-tools...
If you want to try examples from commands.txt, you will need a x-load.bin & a u-boot.bin
in the current folder. Here is a short checlist to get that files:
 * For x-load.bin:
   * cat /dev/mtdblock/0 >/mnt/fat/x-load.bin
   * get x-load.bin on your PC
   * optionnaly, strip any null byte at the end of the file to reduce upload delay
   * be sure the file path on the PC is the one expected in commands.txt
 * For u-boot.bin:
   * cat /dev/mtdblock/1 >/mnt/fat/u-boot.bin
   
It should be possible to load and start a linux kernel directly, but the upload could
take a very long time.

You should find quickly new commands.txt to do fun things with your TT on OpenTwin,
so check http://www.opentwin.org or ask on the mailing list.

I have added the compiled file "2nd.bin", if you need to recompile the
second boot loader, you will need a cross compiler, if the name is diferent
of mine (armv5tel-redhat-linux-gnueabi from F8 packages), change file "2nd/Makefile".
If your local gcc compiler is not called "gcc", change "Makefile", also if your include
files for libusb isn't located at /usr/include (add -L/.... to INCLUDES= line at Makefile).

If you need more help about this program, you can contact me on IRC or by OpenTwin ML,
check http://www.opentwin.org. Also check http://source.pkg.fr and http://www.pkg.fr
you should find there my mail and more.

Best regards and enjoy it,

Guillaume Bougard


Acknowledges:

Thanks Luis Recuerda to have released omapfl under GPL.

To Tim Rikers for the original FlashRecoveryUtility program.

To Texas Instruments: thank you for DO NOT answer any question about the
internal ROM boot loader, and, thank you for the WORST documentacion about
a CPU or microprocessor I have ever seen.