This document shows how to debrick a Toshiba e740 or e750. The same procedure will also work for the e3xx e4xx and e8xx families, but the disassembly procedures are different. Here are some pictures of my e740 and jtag_interface.

Note: This procedure MAY work for other PDAs too. the key requirements are a CPU supported by bsrflash (PXA25x only currently) and a PDA with a supported flash type and configuration. (the only currently supported type has TWO 16 bit strataflash devices across a 32 bit databus). if your PDA does not have these characteristics, dont despair - bsrflash is modular and easily extensible.

Here are bootloaders for various PDAs.

1. Remove the battery.
2. Remove the two Torx T6 screws from the base.
3. Remove 4 No 00 screws from top cover (two under rubber caps) and the back (two above the two slots).
4. Pry the top cap off (stylus side first). This is held on by a plastic clip at each side, so be careful.
5. Push the CF slot eject lever back (use your stylus) to prevent the rear of the lever fouling the back case section. This is the lever *inside* the socket - the part that actually pushes out the card, not the black plastic eject toggle.
6. Unclip the stylus side of the casing *all* along the side. The top clip is very near the top edge of the case, be sure to unclip it also.
7. Gently lift the edge of the case until the other side pops off.

Locate the debug header on the board and solder wires to it according to the pinout below (required pins are labelled with a '*'. Solder a header to the other end of the wires - and be sure to mark or key the header so you know which pin is which.

Be sure to use a good quality header and socket, as I have experienced signal integrity issues with cheap ones. I suggest using a DB9 male/female pair, rather than the molex header I show in the picture.

I recommend putting a loop in the wires inside the PDA (see picture), so that if they are pulled there is some strain relief - if you rip off the JTAG pads you will be in trouble!

I brought the wires out through the stylus hole. I applied some bluetack to the wires to hold them fast in the hole, which I find reduced further strain on the wires near the solder pad area. Whilst you may not intend to assemble the JTAG header permanently, you WILL need to be able to close the case, as you need to power up the PDA to use this setup, which requires the battery to be present.

Lastly, put your PDA back together (you can leave out the screws and the top plate if you are planning to use this as a once-off).

Next build the JTAG interface. Here is the schematic:

I advise connecting the lead to the PDA before the PC. This ensures the 74HC125 has power before it is connected to the PC parallel port.

Once you have connected the lead, you need to run bsrflash to replace the data you lost from your PDA. You can get a copy from my git repository.

git clone git://git.mnementh.co.uk/bsrflash.git

You probably only need to replace the bootloader, but even if you erased the OS too, dont worry - once you have replaced the bootloader, you can use it to replace the OS without using JTAG any more (May not be true for all PDAs). Simply take the first 256KB of the ROM image, and flash this using bsrflash: (This can take a very long time). You will need (on e7xx at least) to unlock the flash first, which is shown in the instructions below.

dd if=rom_image.bin of=wince_bootloader_img.bin bs=262144 count=1
bsrflash u
bsrflash p wince_bootloader_img.bin

You should verify the image after flashing it:

bsrflash v wince_bootloader_img.bin

Once you have flashed the unit successfully, turn off the main power switch (the small white one at the bottom) and then turn it back on. You should see the bootloader pop up within 5 seconds or so. If not, and the flash verified ok, you may have another problem.

If you need to reflash the OS as well, then at this point, you should put the OS image on a CF card in a file named KERNEL.NB0, and then reset the PDA whilst holding the middle two buttons.

good luck!