De-brick a Fujitsu-Siemens Loox (Or flash it back to original)

Well. I got me a PDA. A Loox 610 BT from fujitsu-siemens. Used of course, and a brick too. Quite dead a brick to be exact. It was sold as good, arrived with a crashed flash, I won’t dig into the seller-buyer relations, but let’s say, I was left with an expensive paperweight in my hand.

0. Who can profit from my experience?

This text might help you if your PDA:
– doesn’t switch on at all (using the power button)
– switches on, but shows just a green screen (or whatever unicolor screen)
– switches on and shows only the startup screen (and either stays so forever or dies out in a moment)
– you attempted a flash update and it failed.
or
– you did a flash update, it sucks and you can’t get it downgraded.

However, your PDA must not be completely dead, this means in particular:
1) when plugged in it should charge (blinking LED that goes on when the battery is full)
2) when turned on with the monkey-grip it should show some sort of bootloader (see following section on what the monkey grip is)
3) your PDA, when powered on and plugged into USB, shall NOT be recognized by the PC (active Sync / device manager) – does not apply if you need a downgrade.

Why so?

First, if it’s dead to the point it won’t take charge, the internal power circuitry is either damaged or locked up to an extent, that will prevent even an otherwise healthy PC from starting. Read: you might have a good ,,smart part” and you are missing the ,,power cord” to get it going. No point in fixing what ain’t broken.

Then, if the bootloader isn’t there, or is dead for some reason, you have absolutely no way to get the firmware in, out or booted. It just doesn’t matter WHY it fails, I just can’t help you, go on looking for a solution, maybe there’s one, but I don’t have it.

The last thing is, if your PDA does get recognized when attached to PC’s USB port, it simply isn’t dead. If you can’t see a thing, it means that your LCD is dead, or backlight is off, or something, but the system behind it is up and running and – if you wish – you can reflash the PDA from your desktop PC without the tricks here. Possibly it will help anyway, possibly not, sure will be less risky then the procedures here. However, read on about the monkey-grip, it can be useful if you need a flash downgrade.

I. The Monkey Grip

PC’s have (or used to have, as it has changed somewhat now) the [ctrl]-[alt]-[del] three-finger-salute paid to dead software. PocketPCs have something similar too. However, don’t mistake it with a soft reset, which is more soft than a reset!

The reset options for a pocket Loox, from lowest-impact to the most-devastating one, are as follows:

(o) the soft reset: punch the small button in the hole, the device reboots. Your data is there, your settings are there, just the misbehaving app was killed (and whatever you didn’t save is gone).

(-) the hard-software reset: hold the power button, punch the soft-reset button. The device re-initializes the system. Say your byes to your data, settings, programs and such. It’s all clean now (except LooxStore and your SD/CF cards). The power is not interrupted, it’s all software, but it leaves nothing behind! It seems, that this kind of a reset is not available in all firmwares.

(o) some devices (Loox 610) have a hardware reset switch. It’s actually rather a main power switch, it just disconnects the secondary battery and so all data in RAM dies. System gets re-initialized afterwards. This is true hardware reset, however not always available (some devices simply don’t have this switch).

(-) the MONKEY GRIP. It’s again a software call, but it not only kills all the data, it boots directly to a built-in low-level flasher instead of rebooting Windows Mobile OS. To activate this mode, do the following…

[ WARNING: even if you want to just-try, REMOVE ALL CARDS FROM THE DEVICE! And – your data, setting, all programs, EVERYTHING will go bye-bye even, if you just try it! You have been warned! ]

…switch the device off (if possible). Press and hold FSC-button/record button (the top button on the left side of the device), the power-on button and press the soft-reset. Keep holding both the power and side buttons till you see the flashloader screen.
Now what you see depends on what device do you actually have. Loox 610 shows some text-mode screen with a header that goes something like ,,Pocket PC OS Flash Loader”. Loox 420 shows the dolphin’s picture that comes upon standard boot, but now there are few letters at the top of the screen (the bootloader version and the system language). To exit this state you have to reset your device. Either a soft reset or a hard-softreset should do. Power switch won’t. Battery is not supervised in this mode, so the device will run till the lights go out! Plug the charger in, or you are in for trouble.

II. WHAT IS IT GOOD FOR?

If you have an SD card with a system image on it in the SD slot (or put one in when the bootloader is active), this bootloader will ,,pull” the image into the main flash memory. What the bootloader looks for is a file with a name that ends with `.nb0′ (that’s a zero, not an `O’). The file contents/internal layout is important too, the bootloader won’t flash just anything that’s called .nb0, however, it won’t check if this specific image is any good for your device or if it’s complete (!). If you don’t pay attention, you might e.g. x-flash a 610BT with 420’s firmware this way and dead-brick your pda.

Now, if your PDA won’t start normally, but will boot to the bootloader after performing the monkey-grip, it means, that either the main flash is corrupt, or it does not match the version of the bootloader. [WARNING: assumptions!] I believe, that when you update the flash of your Loox using the USB-Tool, first it updates the bootloader and then it sends the full flash image. It seems, that not every image can be booted by every bootloader version. What I know for sure is, that the newer images provided by FSC are in general not enough to revive a dead device. [Assumptions mode:off]. Now, if you have a dead flash and live bootloader, you fix flash, ok?

The following is accurate for the Loox 610BT. I don’t know to what extent does it apply to other versions.
Fujitsu-Siemens provides 6 versions of Firmware to download (two are misplaced on the website, marked as WM2003SE, although they are the original WM2003, so you have to check the ,,unsupported OS” checkbox to see them).

They are as follows:

German:
FSC_1002160.EXE P22452-P929-V526.NB0
P22452-P929-V526 1.00 [DE] Windows Mobile 2003 Released: 18.11.2003

FSC_1002161.EXE P22452-P929-V526.dat
P22452-P929-V526 1.01 [DE] Windows Mobile 2003 Released: 11.12.2003

FSC_1002162.EXE P22452-P929-V551.dat
P22452-P929-V551 1.00 [DE] Windows Mobile 2003 Released: 05.03.2004

English:
FSC_1002989.EXE P22452-P929-V527.NB0
P22452-P929-V527 1.00 [EN] Windows Mobile 2003 Released: 18.11.2003 (*)

FSC_1002988.EXE P22452-P929-V527.dat
P22452-P929-V527 1.01 [EN] Windows Mobile 2003 Released: 11.12.2003 (*)

FSC_1002163.EXE P22452-P929-V552.dat
P22452-P929-V552 1.00 [EN] Windows Mobile 2003 Released: 11.02.2004

(*)- these are mistakenly reported on FSC website to be WM2003SE. They are not.

As you can see, there are the original releases (v52x 1.00), the first updates (to v52x 1.01) and then a major update to v55x.
The last digit tells the FW language, so v526 == v527 except for that the first one is german and the second one is english.
The very first update in each language ist actually not an update, but a PRIMARY RELEASE, i.e. the original flash that got shipped. It is also an NB0 file, which means, it can be safely flashed directly from an SD card. This is what you need if your device is half-dead (i.e. bootloader OK, but no system).

III. HOW TO REVIVE MY LOOX?

0. Get the firmware from FSC. The filenames for Loox 610 are lised above for your reference. Install it to your harddrive, check for the NB0 file in the installed directory (default c:\fsc.temp).

1. Get a good SD card, 64MB is enough, 1GB is maximum officially supported. Format it as FAT. Put the NB0 file in the main dir. Pay attention to the language: the bootloader (at least in Loox 610BT) does not check the flash language before flashing, so if you screw it up you may wake up with your pda in german!

DON’T rename .DAT to .NB0: they will flash, but the device will be dead, just get the proper NB0 file.

Warning: the bootloader WILL find the right file even if the card is not empty, but due to a bug in the initial bootloader it may crash if the NB0 file comes up too late in the list. So CLEAR the card and play safe.

2. Remove CF cards, unplug any connectors except for the power supply, charge the battery (so if the lights go out it keeps running). Doublecheck that everything is in place, SD card secure in the slot, and do the monkey-grip. If you did it right, the flash loader will come up and start reading your NB0 file in. After few moments it will start writing the flash. Cross your fingers and wait till it finishes. Once it says it’s finished, press the power button. ALLOW PLENTY OF TIME FOR THE FIRST BOOT, it has taken almost two minutes for my pda to initialize! It’s definitely longer than the usual soft-reset.

3. Remember to remove the NB0 file from the SD card. If you don’t, you will have problems when upgrading your device later.

4. Optional: update your PDA to the newest flash release (use ActiveSync and the Update Tool from FSC).

Good luck,
Marek
locust@poczta.onet.pl