yashsingh1/xdaforums huggingface dataset:
[Hardware Hacking General] AdamOutler:
Ok... Can someone figure out a way to put IBL/PBL, SBL and SBL2 on a external MMC card? This should be the focus at this point.

We've got diagnostics:UART/dmesg

We've got reading material:IROM code and S5PC110__EVT1_UM10.pdf ( processor manual)

I've got some really big guns on the way within the next week or so. a 32 channel logic sniffer which can view every external connection on the phone and display simultaneous output on a computer. Also, a bus pirate which is specifically designed to communicate and inject data into all forms of digital communications supported by the S5PC110 chip.

I'm sure something will turn up based on experiments with a logic sniffer alone.

So, we need a method of booting. It should be possible to boot from MMC and on top of that, there is a message in PBL which states that it has found an SBL. We may be able to convince it to boot from an MMC SBL, or at least find an MMC SBL. This would be a great goal at this point, being that it's been said that the phone CAN boot from MMC.
[Hardware Hacking General] Rebellos:
So 0-0x3FFF block of boot.bin DIFFERS from IBL which is in fact on SGS but it is never flashed? Did I understood you right? Interesting. Is 0-0x3FFF dump of SGS BML1 available somewhere? Can you make it?

//edit @Adam:

Try to watch all external SD pins, if these are powered during first stage of booting and if yes, is there any logic signal.
[Hardware Hacking General] AdamOutler:
Here's how the processor views it.....

samsung has broken up their second bootloader into a few parts and added the params.lfs partition.

I think everyone should read the processor manual I referenced earlier as reading material... there's tables and pictures in there which will help. I learn something each time I read it.

note: "The booting device is selected by Operating Mode (OM) pins. " Which means OM=0x9 is a hardware function and likely located directly below the processor..... however, there is a possibility it may not be... it may be somewhere else, like an mmc card pin.... Or even a normally closed GP register somewhere on the board accessible by any means of communication like i2c, or uart, or even a certain combination of pins being driven high may affect it..
[Hardware Hacking General] AdamOutler:
page 490 of the processor manual speaks of Serial Wire JTAG

Also, something called Coresight provides step-by-step debugging of code running on the processor.
[Hardware Hacking General] Rebellos:
In s8500 theres no way to change OM register without unsoldering s5pc110, @ this one i am 101% sure.

ARIES and Wave boards are somewhat similiar, do you believe that there is difference in OM connection? I dont.

Wondering whats the difference between jtag and coresight, jtag also provide step by step debugging, isnt it?
[Hardware Hacking General] AdamOutler:
How can you be 101% sure? From what we've seen, that will pretty much mean all platforms are done the same. How do you know there is not a transistor on the board which breaks ground or high on a signal from say... the call processor... or maybe even grounded to another register or I/O pin on the Application Processor?

The watchdog timer is part of the boot sequence. It's referenced in the boot sequence on the processor manual

Watchdog could come in handy if we figure out a way to modify memory, it could be used like a pause button. Also, watchdog could explain why sometimes my phone runs slow when I'm around power supplies at work...

off topic... the year register is only 12bits wide, and , it can only handle 999 years and a 2 is in the first position. Be prepared for Y2K all over again in 999 years... Y3K.

Ok... so, reflecting on the boot sequence.... The IROM/Processor calls and verifies the PBL, The PBL calls and verifies the SBL.... If the PBL fails verification, it fails over to other methods of booting, like UART. We need to figure out what failover the PBL contains.

One of the bricks I analyzed... Let's call it an "odin brick".. It had a mismatched PBL/SBL. It could be possible that it was looking for a MMC boot or something. Please take a look at the PBL and see what failover it has...

as for external I2C, we're looking for two lines which are in a high condition. I was not able to establish communications on the line which we assumed to be UART TX on the JTAG port. It may be worth it to look at that port again with i2c... I will make a note of that to come back again later. We still have yet to locate the EXT-I2C hard-lines to the i2c bus which is referenced by a NAK in the SBL boot sequence randomly... These hardlines would be able to control the processor and make it do just about anything.

All we know right now about I2c is that it has an EXT-I2C connection somewhere, the AP can function as a I2C master or slave, it communicates via 8bit comms, and an unlimited amount of data can be sent to the processor over i2c.

the SPI bus would allow unlimited access to the processor, and just as with I2C, it does not require any software to be running. This bus runs at 8-bit/16-bit/32-bit. I'm not good with SPI, but if we can find the wires, this would be very powerful. SPI or i2c would both potentially be able to load software and then restart.

The modem interface has abstracted access to the same bus that the OneNand is located.... possible check.

Good call on the MMC card Robellos.. The MMC card supports "512 bytes FIFO for data Tx/ Rx"

There's several GP registers which are dedicated to "Keypad" interface... So.. Now being that the numbers are so different between all of the buttons currently used, it may have an affect to short out one pin on a button to another pin on a different button. This would cause a different key to be pressed... Just something to look at.. It would be nice to find all of the pins.

So yeah... There's still lots to try.
[Hardware Hacking General] b4dg3r:
Suppose we could JTAG the S5PC110, could we could use boundary scan to try and identify where the OM pins go? Maybe they go to another device on the JTAG chain that supports boundary scan?

Do we know what devices are in the JTAG chain? Is there a BSDL file for S5PC110 around?

I don't know much about JTAG, this might well not be possible. :confused:
[Hardware Hacking General] AdamOutler:
The memory and processor is on the JTAG as well as a few other devices... page 484 of this manual: http://www.mediafire.com/file/3znisgfm3amxgpj/S5PC110_EVT1_UM10.pdf

Hey... I found that fsa9280 manual online http://www.mediafire.com/?d4e21efhuktctcb
[Hardware Hacking General] b4dg3r:
Other devices outside the S5PC110 package could also be on the chain. I wonder if the baseband processor is.

That FSA data sheet is a good find. 242, 292, 507 & 577 Kohm resistors deserve some further scrutiny I think.
[Hardware Hacking General] jutezak:
Interfaces

While the headphoen jack is an extrenal interface that is connected deep into silicon, there is more. There is a resistor sense - probably connected to the codec/amplifier to check if a headphone or line out is connected, and if there is a microphone or not.

However these usually also detect whether something is plugged in at all with a simple switch. Could that be the case? Should be simple enough to check looking at the connector.
[Hardware Hacking General] zianna123:
hey!!!

guys i didnt have time to go through all the posts got to page 30 odd

dont know if this is covered.

but have you noticed this screen before. i done it on a software brick. no sbl.

held menu button. put usb cable in (no kies drivers installed) then pressed a certain volume up / down combination trying to duplicate it now again and got this.

screen apears and says

rst_stat = 0x4

pmic_irq0x0

pmic status1 0x40

pmic status2 0x02c

modem booting

end modem booting

now start usb upload

FORCED UPLOAD by KEY PRESSING

sorry for my hasted post. it seems it has been discoverd. but what may add to your project that when in this mode. it installs a usb device called gadget serial. reading more about this now. to get the drivers etc. and want to see what it does.

as it seems there is more to this little find.

update / ok i have loaded the drivers.

it creates a samsung modem on com 12

the coincedetal part is the port speed "921600"

this is the same as what you guys have been finding
[Hardware Hacking General] AdamOutler:
I posted the FSA chip datasheet and jig values here:

http://xdaforums.com/showthread.php?p=14407905#post14407905

I graphed it out.

that's all resistor values... all 5 bits are taken. There are no more resistor values.. I'll update the fun with resistors thread.
[Hardware Hacking General] midas5:
Is there any way to read the OM5 when using the 301K resistor?

Can anyone dump the boot messages when the 301K resistor is attached, without usb power applied?

I.e. Use the JTAG serial interface to watch the boot up.

I.e.

1) Attach to the JTAG serial interface.

2) Insert Battery

3) Connect 301K resistor between pins 4-5. No power on pin 1.

4) Capture the serial port output and post it here.

The I9000 phone should boot into download mode.
[Hardware Hacking General] AdamOutler:
Nothing significant happens. I did that earlier and a link was requested again about 5 pages ago.

You can forget about modifying OM registers. They are inputs to the processor. It would require hardware modification.
[Hardware Hacking General] midas5:
Are there two separate cpus in the i9000?

Is the S5PC110 the application processor and there is some other baseband processor?

Which one boots first?

Is modem.bin the baseband code that is loaded into the baseband cpu by the apu ?
[Hardware Hacking General] midas5:
I have just looked back over 20 pages and cannot find it. My xda app says we are on page 52 now.
[Hardware Hacking General] TheBeano:
The communications processor is an Infineon XMM6180, the same chip used in the iPhone more or less. modem.bin contains a whole real-time operating system for it, called ThreadX. It's ARM code and you can disassemble it, but it's huge obviously and I don't think there's much documentation available for the processor.
[Hardware Hacking General] AdamOutler:
I would assume that the applications processor is first.

The BOOT line from the FSA chip is documented to go to the call processor, not the application processor. This would explain a bit more about what causes boot or charge conditions. It would seem that the call processor realty determines the boot state of the phone.
[Hardware Hacking General] Rebellos:
I've got confirmation of this info from low-level s8500 board schema.

@CP booting,

When connecting my turned off Wave to PC with Qualcomm drivers installed its recognizing Qualcomm device. However it probably happens after AMSS is being loaded into CP (it has got different CP than SGS and it is booted in slight different way), CP alone has got probably only small iROM code, maybe it is capable of USB communication.
[Hardware Hacking General] midas5:
So, is the call processor the same as the baseband processor?

So, i would think that the call processor is running before the apu. Where is the boot code for the call processor?
[Hardware Hacking General] midas5:
Can i download the s8500 board schema ?
[Hardware Hacking General] AdamOutler:
baseband is the same as call processor. The schematics call it CP. I dont know if we have boot code for Baseband/call processor.

No. Its not possible... Lets just say the information came from a reliable source... Some guy who babysits for the brother of a guy who's married to a barber who cuts the hair of a janitor who's mother's brother works for Samsung who overheard a conversation which detailed the OM pins are hardwired to VCC and GND....

That does not rule out cutting traces or removing resistors.... But im not trying to change OM values anymore.
[Hardware Hacking General] AdamOutler:
I just wanted to post this so that there is no more confusion.. from the processor manual page 2400.

The OM pins are INPUTS. INPUTS cannot be changed by software running on that chip. The OM registers are tied to hard lines. if the pin goes high, the register goes high, if the pin goes low, the register goes low... You can't override an input which is a part of the processor. it's a hardware thing.

If you were to find something on the board, look for resistors in a pattern like this...

0X00X0... The 0s or Xs might be resistors or opens, but it would be in that pattern to make the OM=0X9 which would be binary 010010 for a 6 bit register.
[Hardware Hacking General] AdamOutler:
These are the OM pins if it helps anyone

This is as seen from the bottom side of the processor.
[Hardware Hacking General] midas5:
0x9 is 001001 in binary.
[Hardware Hacking General] AdamOutler:
**** you're right. I had been under the assumption we were dealing with 5 bits until I looked it up... then I took my precious misconception and added a 0 to the end.... my bad..

My logic analyzer should be here soon... its in the state according to my tracking info. Too bad it dosent analyze my logic.... lol... binary.. logic... get it?
[Hardware Hacking General] TheBeano:
On this block diagram it's shown going to the AP (BOOT_MODE). Also on this diagram there is no documented connection from the SIM socket to any UARTs. That doesn't necessarily mean there isn't one, but the connection on the S8500 that was shown going through the SIM socket is shown as a direct connection here (AP_FLM_TX).
[Hardware Hacking General] midas5:
I have been looking at the irom code. With om = 9 it tries to load bootloader from onenand, then sd card, then download over usb / uart . The onenand has a power control registers, so we might be able to power down the onenand, forcing it to boot from sd card.

I also looked at the IBL , but it does not seem to do much more than boot the PBL .

I have not seen the irom talk to the sim card yet. It would be easier if i knew which uart was connected to it. Does anybody know?

The interesting bit of the irom is what it does if the boot is not a cold boot. It needs further investigation.

Finding a way to disrupt the onenand during boot still seems to be the best option.
[Hardware Hacking General] AdamOutler:
TheBeano.. the FSA documentation says the line goes to the baseband/call processor... Not saying that either is wrong, but we've got conflicting documentation... If it does go to the call processor, It would suggest the difference between charge and "on" is the call processor activation though.

I found a really high quality picture of both sides of the I-9000 boards and that gave me an idea...

I reversed the processor image and lined it up over the top of the back side of the board..

Then I overlaid the pins on top of that.

hrm.... his may deserve some more analysis... I've got a captivate junker comming as soon as it's sent from Connexxion2005
[Hardware Hacking General] TheBeano:
That's the chip manufacturer's data sheet though, it's up to the phone designer how they hook up the signals from the chip.
[Hardware Hacking General] AdamOutler:
True....

I tried disconnecting that large resistor above OM2,4, and 5... no change to the OM register. Just wanted to make that known.

I also sliced a small trace which would be above OM5.. nothing. So, I'm putting it back together now. :/

Edit: also tried joining those two test points by creating a trace with a #2 pencil
[Hardware Hacking General] AdamOutler:
Hrm.... I had it aligned wrong.. and I was working with the antenna amplifier...

Could it be as simple as popping off that resistor?

Will someone please check my work?

here are the images I used

Back side: http://guide-images.ifixit.net/igi/qQmVNHFgsuFRgSVo

Processor side: http://guide-images.ifixit.net/igi/qyIdQVxAcDcLE3nl This should be inverted

Pins as shown from bottom of processor: Note: pin 1 is top right
[Hardware Hacking General] midas5:
It looks to me that those resistors are more to do with the display than om pins.
[Hardware Hacking General] lilstevie:
the Cell Processor boot is controlled by toggling a GPIO, rild handles this and so does Sbl in userfault and unknown upload modes
[Hardware Hacking General] midas5:
Do we know which gpio that is?

Why does the sbl need the cp running? I thought all the cp does is handle the radio comms .
[Hardware Hacking General] Rebellos:
Most likely CP support some memory-dump procedure, in case of baseband crash.

DRV_MODEM_RESET is probably first signal from AP to CP through GPIO, it goes like this:
[Hardware Hacking General] AdamOutler:
Hey guys, I compiled a zip file containing all of the documentation, tools and binaries which you and I have found online or compiled. I call it The GalaxyS Hack Pack.. You can find it here http://xdaforums.com/showthread.php?t=1111866

Also, let me know if you deserve credit for anything.
[Hardware Hacking General] lilstevie:
on the tab it is GPIO163

as Rebellos said it is for some mem dumping procedure.

it is a bit more complex than just toggling the gpio though, efs needs to be mounted and nvram needs uploading, as well as modem.bin
[Hardware Hacking General] midas5:
Is it safe to say that during IROM boot, the CP is not running?
[Hardware Hacking General] lilstevie:
yes, the CP in a normal boot does not turn on until rild turns it on
[Hardware Hacking General] AdamOutler:
Hey..... I got my Bus Pirate in. It took a bit to set up, marking color codes and making a small case and what not.. I established bi-directional UART communications and attempted to monitor a few channels last night. Nothing revolutionary...

Let me know if you want testing on any of the following supported bus protocols.

I thought I should mention, Bus Pirate works with the OpenOCD project. The OpenOCD project supports JTAG on ARM processors. I can't test it out, because I have nothing to invasively test right now. Using the Bus Pirate, I think we MAY have a way to DIY JTAG for less then $40... I just thought i'd mention that.
[Hardware Hacking General] AdamOutler:
Does anyone know if the OneDRAM is shared by the Call processor? I was reading here that OneDRAM is designed to be used by both, but I think i Read somewhere else that it is included on the same package as the OneNand, stacked on top of the processor. Here, on a Samsung site, it shows both sharing the same memory.. which would make sense. http://www.samsung.com/global/business/semiconductor/products/fusionmemory/Products_OneDRAM.html

If it is true that both share the same memory, then it may be possible to interface the memory via the call processor, then reset the application processor and force it to boot again.

Can I get some clarification here? I need a datasheet or something for the OneNand, and I'm not really sure what I'm looking for. Someone point me at the datasheet for the OneNand package on top of the Application processor, or the DRAM package, or the call processor.
[Hardware Hacking General] AdamOutler:
I ran across this and thought it might be good for future reference
[Hardware Hacking General] AdamOutler:
This is good information. Thank you. I missed that post. I will take a look to see what I can find out about that chip. That also broadens my understanding of why certain modems work better then others. We need a datasheet on this.

I'll start here and see what I can find... http://www.mouser.com/Semiconductor...PU-DSP-DSC/_/N-6hpef?Keyword=Infineon&FS=True
[Hardware Hacking General] kar200:
Hey guys,

If you don't mind I want to ask a quick question here. I posted in the other threads a bit but and it looks like the experts in hardware are here :).

My phone home button stopped working. Took to repair and they told me liquid damage.

Basically the button does not work at all in software (OS or recovery) but works to get the download mode or the recovery (basically if I try to boot with it).

No one here in Brisbane QLD wants to repair it without changing the whole LCD system. They said they are glued together and impossible to remove although ebay has LCD's only on sale.

I was wondering if you guys thing my button can come back to life? I managed to open the phone and cracked a little bit of the plastic on the way :) but if there is something that can make it work again (like read on the net to submerge in Alc) I am happy to try as long as I don't pay 200 bucks they want me to.

If not then I will keep using it that way until I get another one.

Thanks,

K.
[Hardware Hacking General] AdamOutler:
^^ This is not the place for that. Your phone is not bricked, it has water damage. You need to replace the LCD/digitizer assembly. It's $80 online and you can DIY by heating the frame and separating the LCD/digitizer assembly from the front cover, then replacing with a new one.
[Hardware Hacking General] AdamOutler:
Can someone point out the CP in one of these pictures? I can only find the modem... that handles data only, i was under the impression that the CP handeled everything

http://guide-images.ifixit.net/igi/qQmVNHFgsuFRgSVo

http://guide-images.ifixit.net/igi/qyIdQVxAcDcLE3nl

edit: nevermind, I pulled apart my phone and my call processor is an XG616
[Hardware Hacking General] AdamOutler:
I noticed that the XC166 prototype board seemed to have just about all the capabilities of our modem. I sent an email requesting information about the XC616 or information on emulating the XC616 on a XC166 prototype board. I received an email from infineon recommending that I search their products... so I did.

I've found the XC161 chip, which seems to have the same functionality, however it's on a standard surface-mount package and I'm looking for a (i'm not sure of the term-someone correct me) ball-soldered mount package.

Someone please confirm or deny anything about this XC166 family of chips... Here's the webpage: http://www.infineon.com/cms/en/prod...html?channel=ff80808112ab681d0112ab6b3ae30781
[Hardware Hacking General] AdamOutler:
Intel XMM 6160 series baseband processors: http://www.intel.com/products/wireless/mobilecommunications/platforms/xmm6160/overview.htm

Intel® X-GOLD™ 616

aka Infineon X-GOLD 616 PMB 9801

Looks about right... specs match up. overview "datasheet"

http://www.infineon.com/dgdl/X-GOLD...f0004&fileId=db3a30431ed1d7b2011f5bee88ef75eb
[Hardware Hacking General] midas5:
Has anyone managed to find out what rate the clock pin of the I9000 SIM connector is being clocked at?
[Hardware Hacking General] AdamOutler:
I can try to find out.... What was the command to access the modem from the command line again?

If that dosn't work, I can do a factory reset on the phone, restart without a SIM and when it asks me to insert the SIM and press next, I can just keep pressing next.

Do you have any idea what the method of communication is? 2-wire? I2C?
[Hardware Hacking General] midas5:
SIM is a 1-wire protocol.

The clock pin is a free running clock. You do not need to write any I2C commands to measure it. The clock pin is actually optional.

The single I/O pin is a bi-directional data bus. (Standard UART, Send Request, Wait for response type protocol. Half Duplex. Phone initiating requests, SIM answering them.)

I think the SIM is a wild goose chase, unless we can get the CP to boot before the SBL is loaded.

Maybe we need to look at the source code a bit more. E.g. How does the "Android Contacts" read the numbers from the SIM card?

See if the AP asks the CP for them, or the AP manages to get them without using the CP.

This will determine if both the AP and CP have access to the SIM card, or only the CP does.
[Hardware Hacking General] midas5:
Is there any way to find out what is at zero page during boot.

I would like to know the memory contents during boot (i.e. As the IROM boots)

from 0x0000c90c to 0x0000c97c.

The CPU manual states that 0000_0000 - 1fff_ffff is:

Boot area, Mirrored region depending on the boot mode.

Does anyone have any clue as to what gets put their during boot?
[Hardware Hacking General] TheBeano:
My Logic Shrimp finally arrived so I was able to measure this. It's 3.3MHz, but it only starts up when the phone is at the "boot animation" stage of the boot process, which confirms that the CP isn't started up until late in the boot sequence. That doesn't mean it isn't still connected to the AP serial port though. The I/O pin goes high about 3ms before the clock starts, and there's nothing on the RST or VPP pins.