Thread: Trying to unbrick a zumo 220

smokefree, you've compared the original fw_all.bin and a GarminCure3-ed fw_all.bin. GarminCure3's patch is a bit different from that boot.bin patch.
Looks like the experiment was not 100% clean. Maybe it's a bad flash block which was "frozen" with GarminCure3-ed fw_all.bin piece. Or maybe it's your mistake.

Can you make fw_all.bin full of 0x3E bytes with the size of the dumped 14.bin. Then flash it, then dump it, and compare the flashed one and the dumped one?
It's not dangerous to flash garbage instead of fw_all.bin, you can always flash something else in pre-boot mode after.

Originally Posted by Neil

That's what i meant is pointless because the packed file will always differ when compared to the dumped 14. It seems logical to me only by comparing 14 to the original [or unpacked] fw_all can there be a valid comparison. So in essence, whether the flash was done with original or packed fw_all, the compare of the dumped 14 has to be to the full [not packed] fw_all, is that right?.

Right.

Originally Posted by Neil

@both
I'd have thought there should be no difference other that the empty padding at the end of the 14 dump. In a 265W i've removed the extraneous FFs and the fw_all and 14 bins are then identical in hex and hash check. Why should a zumo 220 be different? A fault?

Yes, when the experiment is 100% clean, this would indicate a fault. We can overcome such faults if they are not too abundant.

Originally Posted by kunix

Can you make fw_all.bin full of 0x3E bytes with the size of the dumped 14.bin. Then flash it, then dump it <...>

New territory for me here. Could your request be translated as: "Replace the contents of the dumped 14.bin by 0x3E bytes, then flash it, then dump it <...>"?


Edit:
Have opened a copy of 14.bin in a hex editor. I did find the option to replace a string by another string, but have no clue as to how to replace the entire contents of the file with 0x3E bytes.

I think all hex editors have a fill operation.

UPD:
I'm very kind today that's why I generated 128MB of 0x3E for you! You can cut it as you want and hope it's enough. Keep the change.
[Only registered and activated users can see links. ]

Originally Posted by kunix

I think all hex editors have a fill operation.

Hardly ever used a hex editor, so was not aware of the "fill" function. I made a copy of the fw_all.bin file and replaced the contents with 0x3E, hence resulting in the exact same size as the original file.

A new challenge came up however: immediately when the unit is brought into pre-boot mode, the screen shows LOADER LOADING and freezes there. Therefore I'm currently unable to flash anything. Even an hour later the screen still shows the same. FYI: the unit still has CURE FW inside.




Edit:
The correct sequence of events is as follows:
1. Updater.exe is standing-by to flash the tweaked fw_all.bin.
2. The zumo is brought into pre-boot mode successfully. See screenshot below:



3. OK is clicked in the Updater.exe window.
4. The "Updating Software In..." window is shown very briefly only. See screenshot below:



5. Immediately after the above window is shown, it gets covered by another window, showing an error message from Updater.exe. See screenshot below.



6. At the very same moment, the zumo shows LOADER LOADING and freezes. The display remains frozen after removing the USB cable. The unit has to be switched off manually.

Note: I am able to flash CURE or ORIGINAL FW into the unit using GarminCure3 and Updater.exe. Just not this 0x3E version of fw_all.bin.

Oh my..
updater.exe expects you to feed him RGN file, which has some special structure and headers. I have no idea what happened when you fed him with this garbage
You should have built an RGN file from the original boot.bin and this fw_all.bin.
And actually I've just realized that RGN_Tool wouldn't allow this (it won't detect fw_all.bin's region. It's a stupid idea to detect regions by file contents, as it turns out).
You would need makergn.exe or gfw.exe to build such RGN.

So, yes, it's better to flash this file with update.txt with the following command: xrgn,14,1:/14.bin.