Sharp Telios HC-VJ1

Sharp Telios HC-VJ1 - Handheld-PC class PDA. It was released in 1999/2000. Runs Windows CE 2.11 or 3.0 (see below). Also known as Intermec 6651 Tablet PC.

Operating system

First models shipped with Microsoft Windows CE 2.11. In ~Q4 2000, Sharp released an ROM chip upgrade to Windows CE 3.0, but deeper look into ROM contents shows that it's still CE 2.11 kernel, only user applications (Office, Sharp OEM apps etc.) were upgraded.

Other OSes

- NetBSD/hpcmips - actively maintained, very good port.
- Old Linux build (2.4.0-vr3-test3) - LinuxVR fork. Based on 2.4.0-test3. Released somewhere in 2001.

Hardware

CPU: Toshiba TMPR3922AU (TX3922) @ 129 MHz
RAM: 32 MB
ROM: 32 MB, removable
Undocumented 8 MB Flash ROM
PCMCIA and CF slots
USB 1.1
IrDA
Propertiary Sharp 18-pin serial port with VGA out (looks like Zaurus serial port - to be verified)
7-inch touchscreen - 800x480
QWERTY keyboard

Bootloader tinkering

Various key combinations can be entered during startup:

Space+R - ROM Monitor (to be verified)
Space+M - ROM Monitor
Space+P - Boot from PCMCIA card
Space+V - Flash ROM from PCMCIA card
Space+K - Diag menu (see below)

Diag menu

Self-Check Menu contains various hardware checks and interesting utilities.

1st menu - HW checks

First check, Burn-In procedure etc.

2nd menu - more HW checks

PCMCIA RAM Card test, remote control diags

3rd menu - ROM tools

Dump Tool - Display and edit memory contents.
ROM Image Utility - allows sending and receiving ROM images via serial cable.
Patch Flash Utility - same as ROM Util, but for 8MB Flash
Copy to PatchFlash - copies bootloader, diagnostics and other utils to internal flash.
RAM Card Erase - erases PCMCIA RAM card.
Goto Monitor - launches a command prompt accessible through serial port.
RTC Alarm Check - name says it all
Splash Screen - shows splash screen. I don't know why they included it…
Interrupt test -
Other menu - goes to 1st menu
Yet another "Goto MONITOR" - see Goto Monitor

Executing custom code

Diags menu loads itself from 0xbfc00000 to 0x9fc00000 (probably RAM). Go to Dump Tool, press E, enter address you want to edit (i.e. 9FC06EF4 - Splash Screen option in Diags menu), then enter address of your code in little-endian. Exit from Dump Tool, choose Splash Screen and voila! It jumps directly to your code.

Links

Photos of Diags Menu
NetBSD/hpcmips port
Linux VR 2.4.0 for Telios

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License