Если аппарат откликается на volup+power либо shift+power
можно поробывать
1)вклчюить бут (должно высветися KEYP_SELECT_DOWNLOAD
2)подсоединить кабель usb
3)поставить дрова к появившемуся Microsoft RNDIS KITL for Intel PXA27x (в атаче)
4)назначить MICROSOFT WINDOWS VIRTUAL ADAPTER - ip 100.100.100.2
4)Запустить tftpd32 (только тфт клиент ) -измкнить server interface 100.100.100.2 -порт поставить 980 -host 100.100.100.1
5)Далее кидаем файлы (BOOT.BIN,DOC.BIN)

Вот только как собрать образ doc.bin?

Да похоже у меня такая же проблема.
Файлы бут.бин я ему кидал (реакция одинаковая) экран мигает.

вот содержимое команд eboot:
вызываемое с клавы
у тошибы есть rs232 отладочный но надо проверить.

PCMCIA1 -> PCMCIA0 -> SMSC -> USB USB -> SMSC -> PCMCIA0 -> PCMCIA1 SMSC -> USB-> PCMCIA0 -> PCMCIA1 PCMCIA0 -> PCMCIA1 -> SMSC -> USB INFO: Changed start address for %s to 0x%x.
--- it should be uldr image 1 ----
--- it should be uldr image 2 ----
DownLoad IPL length =0x%x
--- DownLoad X-LOADER type ----
g_pBSPArgs->kitl.flags %Xh 01
MAINSTN BCFG
LoadEBootCFG: Set debug serial port

LoadEBootCFG: ResetDefaultEBootCFG()
****** OEMVerifyMemory FAILED - Invalid Memory Area ******

****** OS RAM address ******

****** FLASH address ******

****** bootloader address ******

****** OEMVerifyMemory checking physical range [ 0x%x ==> 0x%x ]...
FACTORY Key Pressed!
change partition Key Pressed!
CHANGE PARTITIOIN 71M COMPLETED !!!
press any key to reboot your headset!!!
MENU_SELECT_CLEANBOOT Now...
MENU_SELECT_REBOOT Now ...
MENU_SELECT_KITEN Now ...
after InitSpecifiedEthDevice INFO: MAC address: %x-%x-%x-%x-%x-%x
ERROR: Invalid Ethernet address read from Ethernet controller.
ERROR: Failed to detect and initialize Ethernet controller.
MENU_SELECT_DOWNLOAD Now ...
KEYP_SELECT_BOOT_IPL Now ...
KEYP_SELECT_UPDATEIMAGE Now...
MENU_SELECT_PINGPONG_IMG Now ...
MENU_SELECT_TESTSDRAM Now ...
MENU_SELECT_TESTKEY Now ...
Selection = 0x%x
RUU Key Pressed!
SDCard Key Pressed!
KEYP_SELECT_UPDATEIMAGE Now ----
No
Yes
Clean Boot ? (y/n)
KEYP_SELECT_tFtp Now ...
KEYP_SELECT_KITDIS Now ...
KEYP_SELECT_KITEN Now ...
KEYP_SELECT_DOWNLOAD Now ...
Software version is different from hardware version.
Please download correctly software version.
KEYP_SELECT_NULL Now ...
CLEAN USER PARTITION COMPLETED!
+++OEMPlatformInit
launch address is 0x%x
if you want continue download, prepare data first,then unplug usb !!!
press download key to continue from begin!
ERROR: EbootWaitForHostConnect failed!
SpinForever...

XLoader Version : %s
EBoot Version : %s
Hardware Version: ORCA_PP ORCA
1 up_key shift_key......Download with USB_RNDIS.
2 fn_key......Boot from IPL KITL enable.
3 P_key Boot from IPL KITL disable.
4 O_key Test Key Value.
5 L_key Test Memory.
6 Update Image.
7 Use tftp download Image.
8 Goto Sleep.
----------------------------------------
Enter your selection:
key scan code is 0x%x
press key to display scan code
Update Mode is TRUE Now ... ..

Update Mode is False Now ...

Use tFtp download is TRUE Now ...

Use tFtp download is False Now ...

keypad pressed is: 0x%x

please see the backlight
Error At Addres: 0x%x, Data is 0x%x
Data Check Failed!!!
Parameter Check Failed!
pass 2 ...!
Test Sdram second round ...
pass 1 ...!
Test Sdram first round ...
buffer size must great or equ to 16 bytes
Goto Sleep now ...!
this line won't print now!
Flash Partion handle %d Test pass ...!



Test Flash Begin, Please Wait ...

-------test partion 1-----

-------test partion 2-----
ERROR: Failed to initialize SMSC LAN91C111 Ethernet controller.
INFO: SMSC LAN91C111 Ethernet controller initialized.
ERROR: Failed to initialize Bulverde Rndis USB Ethernet controller.
INFO: Trying to locate/initialize PCMCIA NIC in slot 0...
INFO: Trying to locate/initialize PCMCIA NIC in slot 1...
INFO: Trying to initialize USB RNDIS...
INFO: Trying to initialize the built-in SMSC NIC...
!OEMEthSendFrame failure, retry %u
RNDISMINI --- RESET ---
RNdis:: Too much outgoing, bailing out!
ASSERT! Rndis::MddSendRndisMessageComplete return FALSE
ASSERT Fail at uiMessageSize(%d)<=MAX_PACKET_SIZE(%d)
RNdis:: No mem for INITIALIZE_COMPLETE.
RNdis:: Should not happen!
RNDISMINI Err!! unsupported RNDIS host ver.
RndisMdd:: PDD's max RX buffer = [%d] bytes.
ERROR! RndisInitialize msg received!!!
RndisMini recv REMOTE_NDIS_HALT_MSG from host!
r n d i s . c p p ASSERT at File(%s) line (%d)
RndisMini rcv REMOTE_NDIS_RESET_MSG from host!
RNdis:: Unknown RNDIS msg, buff[0x%x] l=[%d]!
Overrun=0x%x

Buffer is too big 0x%x

Wrong Data DataLength Msg=0x%x,Pkt=0x%x

RNdis:: Invalid RndisPacket l[%d] rem [%d]
Wrong Data Type 0x%x
Rndis:: initialization: Fail!
Rndis:: initialization: Success
Rndis:: Get MAC address %x,%x,%x
Rndis:: Err no MAC address read from PDD.
Rndis:: PDDInit Success!
Rndis:: initialization!
Rndis:: Address static map to addr=%x
Rndis:: initialization: with addr=%x
B R OID[%x] not yet implemented!
HostMini:: New filter set: [0x%x] --> [0x%x]
HostMiniInit:: !!
u t i l . c  M i c r o s o f t 0 1 2 3 4 5 6 7 8 9 A B C D E F NM i c r o s o f t R N D I S K I T L f o r I n t e l P X A 2 7 x
Microsoft Windows CE Ethernet Bootloader Common Library Version %d.%d Built Sep 17 2007 13:24:53
ERROR: Checksum failure (expected=0x%x computed=0x%x)
nk.exe ****** Checksum failure on record %d, ABORT!!! ******
****** Data record %d corrupted, ABORT!!! ******
ERROR: failed when reading raw binary file.
Invalid Flash Address/Length
!OEMVERIFYMEMORY: Invalid image
Unable to read image start/length
ERROR: The X000FF packet is an old-style multi-bin download manifest and it's no longer supported.
Please update your Platform Builder installation in you want to download multiple files.

Unable to read download manifest information.

Download manifest packet failed checksum verification.

Unable to read download manifest checksum.

Unable to read image signature.
rom_offset=0x%x.
Don't Support flash.dio.nb0 now!!
B000FF
X000FF
N000FF
ROMHDR at Address %Xh
System ready!
Preparing for download...
EthDown::TFTPD_OPEN::%s
EthDown::Illegal Operation Code %u
Server Registration Failed
EbootSimpleTFTP not initialized
EbootGratuitousARP failed
Some other station has IP Address: %s !!! Aborting.
No ARP response in %d seconds, assuming ownership of %s
Error On InitDHCP() Call
Some other station has IP Address: %s !!! Retrying.
Got Response from DHCP server, IP address: %s
-EbootSendBootmeAndWaitForTftp
+EbootSendBootmeAndWaitForTftp
server associate file name is doc.bin
doc.bin boot.bin Illegal TFTP Operation - Read/Write Req Expected You must access files in binary mode. octet Locked Down Link %d
Src IP %s Port %H Dest IP %s Port %H
No Server Process Associated With File Name %s
TFTP: Desktop losing ACK, block number = %d, Ack again
TFtpStateMachine::TFTP_STATE_CLOSE Link Deleted
TFTP Error Received From Host %X - %s
TftpReceiver, port: 0x%X, wkp: 0x%X

TFTP link[%u]: State:%u, DestAddr.wPort: %u, SrcAddr.wPort: %u
Duplicate IP Address Detected:
-IP address %s in use by device with MAC address %B:%B:%B:%B:%B:%B.
-Requesting new IP address via DHCP...
!CheckUDP: UDP header checksum failure
!CheckUDP: IP header checksum failure
!CheckUDP: Not UDP (proto = 0x%X)
netmask: %s
ProcessDHCP()::DHCP_INIT::SendDHCP(DHCP_DISCOVER) Error
ProcessDHCP()::DHCP_INIT
ProcessDHCP()::DHCP_SELECTING::SendDHCP() Error
ProcessDHCP()::DHCP_SELECTING::DHCPFindOption() Got DHCP_OFFER without DHCP_SUBNET_MASK
ProcessDHCP()::DHCP_SELECTING::DHCPFindOption() Got DHCP_OFFER without DHCP_SERVER_ID

ProcessDHCP()::DHCP IP Address Resolved as %s, Lease time: %d seconds
ProcessDHCP()::DHCP_REQUESTING::DHCPFindOption() Got DHCP_ACK without DHCP_LEASE_TIME
ProcessDHCP() Error - No DHCP Message Type Option
InitDHCP() Error - First DHCP Option isn't the message type
InitDHCP():: Calling ProcessDHCP()
EbootDHCPRetransmit()::Error On SendUDP() Call
SendDHCP()::Error On DHCPRetransmit() Call
SendDHCP()::Error On SendUDP() Call
Error in SendUDP
Got EDBG_CMD_CONFIG, flags:0x%X
Got EDBG_CMD_JUMPIMG
TFTP download started previously by host %s, ignoring cmd from %s
Sent BOOTME to %s
SendBootme()::Error on SendUDP() call


комбинациями вол ап + повер или шифт повер вызываем
KEYP_SELECT_DOWNLOAD

...
XLoader Version : %s
EBoot Version : %s
Hardware Version: ORCA_PP ORCA
1 up_key shift_key......Download with USB_RNDIS.
2 fn_key......Boot from IPL KITL enable.
3 P_key Boot from IPL KITL disable.
4 O_key Test Key Value.
5 L_key Test Memory.
6 Update Image.
7 Use tftp download Image.
8 Goto Sleep.
...
Можно подробнее, как выйти в это меню? ОЧ надо!
В toshibe G500 это меню вызывается комбинацией 0+power.

Как выйти в это меню в G900? Нужно запустить тест памяти (пункт 5). В g500 это помогало при перепрошивке