yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
I have lost overview... :o

Few times I read something about "dump"... :confused:

I can't find it.

How to dump iRAM?

Maybe other dump functions work?

Thanx.

Best Regards
[Bada Software and Hacking General] Rebellos:
Sorry, I haven't clearly stated how to use it.

rebell_memdump is only function in functions.inc, which can be called from FOTA to dump some memory area.

Just check out mem_dump.ASM, commented it a little.

It's example which does full dump of iROM (64KB from 0xD0000000)

You can use it to dump iRAM also, of course if it is accessible.

If you want to use it just change dump_what and dump_size to proper values, also set headers to proper model and BL version and set s_dumppath and s_dirpath to where dump should be stored.
[Bada Software and Hacking General] mijoma:
As I look at the development and the current status of the work, I'd like to propose an optimization of the Android loading process through FOTA. Currently, the our FOTA code does rely on the original bootloader installed by calling some functions (especially filesystem mounting) from the bootloader. That makes FOTA and bootloader version bound and current tutorial advise changing the bootloader. The bootloader change is a step that introduces the biggest risk (although relatively low by itself) of bricking the phone. To address that we would have to adjust FOTA code (the include file) to match the bootloader already installed. There are two problems in that appoach:

1. Include file with the necessary functions addresses needs to be prepared for most of the versions of bootloader in the market

2. The user would have to know what version is running on the phone. The bootloader version is not obvious as it may be different than the rest of the firmware and it's quite confusing to understand that for average user.

Ad 1. Sure, it's some work to analyse several bootloaders, but there are not that many of them. After looking at bootfiles from 14 different firmware versions I found 5 different bootloaders as they are usually common for branded and non-branded firmwares and do not change with each version. Assuming 10 versions of bootloaders to analyse it should not take more than several days to have include files with necessary functions only for all of them.

Ad 2. Manual process in that area makes little sense. Automatic version check is not a difficult task. The simplest way (not too good though as may not be reliable in some situations) is checking the LR register on FOTA code entry. Having the result of the analysis of bootloaders (as of point 1) we can discover what version of the bootloader is calling our FOTA code. The second (probably better) option is implementing some sort of checksum (any algorithm that wouldn't collide on such a limited number of bootloaders would do) over bootloader code and keeping the list of known versions checksum.

Having these two issues sorted out, we can create a universal FOTA working with any bootloader. It should automatically determine the version of the bootloader than is running on the phone and adjust addresses it is calling for the detected version. All calls to bootloader code should be made through pointer table specific for each BL. Adding support for additional BL would just mean finding the function addresses, generating a checksum and filling out the table with pointers.

The described way makes it easier to maintain FOTA for different users and eliminating bootloader change step significantly reduce the risk of bricking the phone by inexperienced users with little tech know-how.

Anybody have some comments about the idea?

Best Regards,

mijoma
[Bada Software and Hacking General] oSandmaNo:
Would that mean the FOTA code would run on any firmware? so we wont have to flash to any specific firmware right?

im using indian firmware and i dont have FOTA so will there be any problem if i use your FOTA after making it universally compatible as you said
[Bada Software and Hacking General] mijoma:
Yes, this is exactly what I'm suggesting.

People in favour of the idea are asked to help creating a database of bootloaders posting boot_loader.mbn files (not full firmwares).

Please check the bootloader version (offset 0x1A01E8 near the end of the file - you may just search for "S8500+" or "S8530+" string). Sample versions "S8500+XX+JL2", "S8500+XX+JEE".

The versions that I have are:

S8500+XX+JD9
S8500+XX+JEE
S8500+XX+JL2

S8530+XX+JK1
S8530+XX+JK2
S8530+DD+JK3
S8530+XX+JK8
S8530+XX+JK9
S8530+XX+JL1
S8530+DD+KB2
[Bada Software and Hacking General] oSandmaNo:
I mean some countries dont have FOTA

like in indian firmwares there is no FOTA file to be flashed

so can the universal FOTA be used on such firmwares?

this is a really good idea since it reduces bricking risk

ill post my bootloader tomorrow after college
[Bada Software and Hacking General] mijoma:
No FOTA support comes from the fact that it's not enabled on apps_compressed.bin - bootloader (unless some very old) should have that implemented and only changing the bootloader is high risk business.
[Bada Software and Hacking General] oSandmaNo:
Oh so does that mean we can flash FOTA on FOTA disabled firmwares?

sorry for the trouble im causing you
[Bada Software and Hacking General] mijoma:
The FOTA code won't start unless the apps_compressed.bin has a 0xF07AF07A at the specific offset. We should be able to enable that even if there's no support in the firmware, but it has never been tested, so I won't be able to tell for sure.
[Bada Software and Hacking General] SilGe:
This boot_loader.mbn have version "S8500+XX+JH3".
[Bada Software and Hacking General] mylove90:
love the idea of the universal fota

i checked S8500JPKC1 bootloader and found out that it is S8500+XX+JL2 version

now i've 2 questions

1. how to enable fota in the fw from the apps_compressed.bin file?

2. can i use fota file for S8500XXJL2?

P.S : i already read this

but for me it is like magic:D

Attached JPKC1 bootloader for further study
[Bada Software and Hacking General] mijoma:
After the decryptiion of the apps_compressed the right file should have a 0xF07AF07A at 0x400 offset from the beginning of the description string. Try offset 0x554.

Remember it's little endian.

Yes
[Bada Software and Hacking General] mylove90:
so this is after decomprssion:)

what about compressing the file back to flash it?!!!

Wave remaker can't do it right now:(

i think i am going to use XXJL2 apps_compressed.bin file for now until we find a workaround this

Thank you very much mijoma for your support
[Bada Software and Hacking General] mijoma:
It's only decryption that you need to do. You don't need to uncompress the file as the offset is before the compressed part. Wave remaker can decrypt and encrypt.

Anybody trying to modify apps, remember to switch off hash verification performed by multiloader (change one byte from 02 to 01 in the last 1024 bytes of the file).
[Bada Software and Hacking General] mylove90:
Already patched the file but can't find out how to do what you said above!!!

i searched for hex value 02 from the end of the file and changed it to 01 but still can't flash it?!!!

Am i doing something wrong?

it took ages from me to understand what you meant by 0x400 and 0x554:D

i hope that you are not mad from me i am just a noob to these thing:D

Thanks in Advance
[Bada Software and Hacking General] mijoma:
Possibly you are doing something wrong. The description which byte is that was posted long, long time ago by adfree. I cannot find it now, but just search for

02 00 00 00 02 00 00 00 00 08 00 00 00 00 02 00

and change the first byte from 02 to 01. That's all.

Naah, no worries - I'm not that kind of guy.
[Bada Software and Hacking General] mylove90:
Thanks you mijoma for your patience with me:)

yes i succeed to enable the fota in apps_compressed.bin file (of course with your help:D)

i can see Android trying to boot now but i didn't prepare the SD card yet so it won't

now preparing the card and after finishing i'll put the files with the tutorial for JPKC1 fw
[Bada Software and Hacking General] oSandmaNo:
can this be done to all firmwares? :O
[Bada Software and Hacking General] mylove90:
Not sure

but i think if the firmware is compatible with XXJEE bootloader you will be able to enable fota support for it

without XXJEE bootloader i was getting a black screen (couldn't boot both bada and android)
[Bada Software and Hacking General] mijoma:
It seems so, but we'll see.

To make it automatic we should ask ho1od to add that feature to Wave Remaker.

Bootloader compatibility is another story and, apart from making the android installation procedure safe, that's why I started the discussion about making FOTA code compatible with different bootloader versions.
[Bada Software and Hacking General] mylove90:
mijoma

Can we make Android boot from any other place other than the SD card?
[Bada Software and Hacking General] mijoma:
Making it boot from the OneNAND is not that difficult, but it won't be dual boot for sure. It introduces quite a danger as bootloader would have to be replaced. The real problem, however, is that afterwards going back to bada would not be easy and probably even more dangerous. With the current development status it makes little sense to install android on the NAND as it's far from being usable. When the development is finished and everything works we may think about optimizations and putting all android files in NAND.
[Bada Software and Hacking General] srg.mstr:
But what can we do with some proprietary libs from SEC (Samsung Electronics Corporation)? I guess these libs have access to OneNAND directly.

And switching to BADA is as easy as switching to Android. Write dump to OneNAND for about 5min and reboot phone ;)
[Bada Software and Hacking General] mijoma:
I'm not sure what you mean by SEC and I don't think any library may have direct NAND access as there is still FSR driver there. It's TinyFSR in the kernel to be specific, while only bootloaders implement fully featured FSR. This is where I see a danger as we can run SBL from FOTA, but once we have SBL on NAND it may be hard to run BL3 to make partitions right. I don't say it has to be a problem, but we won't know until someone checks that.
[Bada Software and Hacking General] mijoma:
Is nobody interested?
[Bada Software and Hacking General] mylove90:
Checked S8530JPKA1 bootloader and its version is S8530+JP+KA1!!!!

All boot files are attached for further study also

Just a stupid question....do you need bada 1.0 and 1.02 bootloaders too?

Edit : Just checked bootloader you have and found S8500+XX+JH3 to be bada 1.0 bootloader so yes you need the all....please correct me if i am wrong
[Bada Software and Hacking General] oSandmaNo:
S8530+DD+KB2 for S8530DDKB2 firmware

attached is the bootloader.mbn file
[Bada Software and Hacking General] mijoma:
Thanks, but I do have that already.

My current list is:

S8500XXJD9

S8500XXJDZ

S8500XXJEE

S8500XXJF1

S8500XXJH3

S8500XXJL2

S8530DDJK3

S8530DDKB2

S8530JPKA1

S8530XXJK1

S8530XXJK2

S8530XXJK8

S8530XXJK9

S8530XXJL1
[Bada Software and Hacking General] hellseekar:
well hope this helps!....this is my first post here ever!...lol
[Bada Software and Hacking General] mylove90:
Two new bootloaders

S8500+XX+JF4 taken from JPJG2

S8500+XX+JI3 taken from JPKB1

now you have all bootloaders for middle east region

next i'll check the two Turkish firmwares

Edit : S8500JVJK1 seems to be offline

E-mailed samfirmware about it already and i hope it will be online again tomorrow

for now i have S8500+JV+KC1 taken from JVKC1
[Bada Software and Hacking General] adfree:
S8500

http://netfolder.in/folder.php?folder_id=M4w7E4h

S8530

http://netfolder.in/folder.php?folder_id=SWFbK6M

Big thanx to samsung-stuff.de :cool:

Sorry, I'm at the moment to la.., ehm busy. To search my HD, unpack, compare, upload... maybe laaater.

Maybe better to concentrate on 1 working Bootloader to minimize "problems/sideffects". For instance:

Chinese Firmwares seems other adresses... too many input I think.

Best Regards
[Bada Software and Hacking General] mylove90:
Adfree

are those all full firmwares with bootloaders?!!!!!

i'll shoot myself if your answer is yes:D

i know you are so busy but we just need bootloaders please:o

Thanks in Advance
[Bada Software and Hacking General] mijoma:
OK. First Proof-of-Concept is there to try. The sources are on googlecode, so is the binary (http://badadroid.googlecode.com/files/bl_univ_boot_poc.zip). Anyone interested may try and report back, especially when it comes to speed as it introduces checksum over full BL3 part (0x180000 bytes).
[Bada Software and Hacking General] adfree:
There are many, many helpfull Android supporter on this board.

So hundrets of users will help you. :D

At the moment I'm not busy, but exxxxtreme lazy... :o

Not only for Android... also my bada investigation is "on ice"... freezed for now.

I hope in 1 or 2 weeks I have again more "fire" for search and/or research...

Like Arni:

I'll be back

:D
[Bada Software and Hacking General] nbates66:
ok i just attempted using this one, the binary in the zip file doesn't appear to work for me unfortunately, when holding the buttons bada simply boots normally, i'd like to try with one compiled myself but googlecode sources aren't syncing properly for me atm, my bootloader is S8500XXJEE
[Bada Software and Hacking General] mylove90:
mijoma

i flashed the XXJL2 bootloader back and it doesn't work with it too (doesn't boot Android just bada )

maybe you can take a look at the code and see what is wrong with it please

Thanks in Advance
[Bada Software and Hacking General] bartaspoz:
Mijoma, have you thougt about searching audio chipset hardware init procedure in the original galaxy bl? One of the main problems of actual android port.
[Bada Software and Hacking General] nbates66:
unfortunately, such a thing isn't as simple as searching along the lines of "a for audio" :P

if it is the problem, the code will likely have to be written from scratch or taken from pbl, since Bada bootloader apparently leaves audio powered off and lets the kernel do it's initialization.
[Bada Software and Hacking General] Rebellos:
@Audio initialization,

Whats more, it can be not BL3/SBL related, as with boot through SBL kernel has got audio problems too.
[Bada Software and Hacking General] mijoma:
Thanks guys. It just couldn't work the very first time. It will work this way if the bootloader CRC will not match any in the known bootloaders table. I'll have to make a dump of what's really there as not to make too many assumptions.

About the audio, I'm no expert, but it does not seem like something initialized in the bootloader in a specific way, so you need to look at the kernel. Let's not assume that anything that is not working is due to bootloader as my personal opinion is that only some crucial low level stuff may have bootloader dependency.
[Bada Software and Hacking General] nbates66:
well it's rather puzzling, oleg has indicated that audio should work with the original kernel config, and does when booted from pbl-sbl. :confused:

the workaround that got posted in olegs thread the other day makes it a bit more interesting...
[Bada Software and Hacking General] mijoma:
Ok. I have the dump. I forgot that the mbn file is not text section only, but also rw. In other words, the image after the execution is different from the file contents. Simple crc on the whole won't do then. I've also noticed that last 128 bytes (that are unique for each BL) are missing (zeros instead).

Good news is that the very beginning consists of code only and there is Build date and time there, so should be OK. I committed the modified version and http://badadroid.googlecode.com/files/bl_univ_boot_poc2.zip is also available for test.
[Bada Software and Hacking General] mylove90:
Thanks mijoma

it really works with both XXJEE & XXJL2 bootloaders from my test
[Bada Software and Hacking General] nbates66:
yep it works, very nice mijoma, execution speed difference, if any between this and the single-bootloader fota's is small/non-existant.
[Bada Software and Hacking General] mijoma:
Thanks for test. The execution time shouldn't be crippled badly even for the original version doing 1.5 MB CRC. Now, we're checking only 16 kB (could be even less, but as it seems OK there's no reason to change that).
[Bada Software and Hacking General] ShadowAS1:
Hey :D

Mylove90 PM'd me this about updating my tut:

Explain this to me please :D?

ShadowAS1
[Bada Software and Hacking General] mijoma:
Read previous posts in the thread: http://xdaforums.com/showpost.php?p=14537812&postcount=229

and http://xdaforums.com/showthread.php?t=1020444&page=24
[Bada Software and Hacking General] dixter:
Hi guys, long-time lurker and first-time poster. I wanted to help contribute to the universal FOTA, but I'm not sure how to go about obtaining the required information. My Wave runs on S8500NEJE6 firmware, one which I believe you haven't had info about so far. Could you possibly let me know how to help you out?
[Bada Software and Hacking General] mylove90:
mijoma

i found a problem after an experiment

i can't flash edited apps_compressed.bin file under XXJL2 bootloader:(

but i can flash it under XXJEE bootloader

so what is really the problem??
[Bada Software and Hacking General] adfree:
Maybe Checksum check... at start you see CRC...

Best Regards

Edit 1.

Maybe depend where your change is...
[Bada Software and Hacking General] mijoma:
That's exactly what I've been asking for. If anyone is interested then please download and check boot_loader.mbn file from firmwares posted by adfree several posts back in this thread. Searching for "S8500+" in the bootloader file should give you the version string. If the version is not known yet then post the boot_loader.mbn file in this thread.
[Bada Software and Hacking General] mijoma:
Will have to look at this problem more closely. My first impression when looking at the bootloader was that it should check the signature of apps. For some reason it wasn't done correctly on JEE. I will compare it to JL2 to see what are the differences and whether we can modify apps running this BL or not.
[Bada Software and Hacking General] dixter:
I've had a look around but I'm still not quite sure to upload my own firmware - I want to rip the boot_loader.mbn from that, but there are no download links for S8500NEJE6/S8500H3GJE7 and I can't work out how to download the boot_loader.mbn from my phone to my own computer. Sorry to be irritating.
[Bada Software and Hacking General] lbyao:
one new bootloaders

S8500XXJh2
[Bada Software and Hacking General] mijoma:
Thanks. I added XXJH2 support.

Bootloaders supported currently:

S8500DDJE7

S8500JVKC1

S8500XXJD9

S8500XXJEE

S8500XXJF1

S8500XXJF4

S8500XXJH2

S8500XXJH3

S8500XXJI3

S8500XXJL2 (two builds)

To the rest:

Again, isn't anybody interested in having the support for all bootloaders?

It's not that difficult to look through. I won't do that myself. You may need me for some harder tasks, but you have to deal with that part yourselves.
[Bada Software and Hacking General] mijoma:
Not that simple to rip that from the device. You need to find a file.
[Bada Software and Hacking General] Rulistaff:
I saw I have S8500XXJID FW on my HDD and it seems this bootloader is not on your list.

If it can help...
[Bada Software and Hacking General] mijoma:
Thanks.

For people that don't know how to check that and do have different bootloaders on the hard drive I made a small app.

It's a windows console application that takes bootloader file name in the argument and displays its CRC (0x4000 bytes of BL3 to be specific) along with information about bootloader being known or not. The file may be encrypted (as it comes in the firmware) or not. I don't think I can make it much simpler, so just USE IT.

---

Edit: Added the S8500XXJID support on subversion.

---

Edit: The app was updated to recognize known bootloaders:

S8500DDJE7_MAY

S8500DDKD1_APR

S8500JVKC1_MAR

S8500XXJD9_APR

S8500XXJEE_MAY

S8500XXJEF_JUN

S8500XXJEF_MAY

S8500XXJF1_JUN

S8500XXJF4_AUG

S8500XXJF4_JUL

S8500XXJH2_DEC

S8500XXJH2_NOV

S8500XXJH3_AUG

S8500XXJI3_FEB

S8500XXJI3_NOV

S8500XXJI5_NOV

S8500XXJID_SEP

S8500XXJK2_MAY

S8500XXJL2_APR

S8500XXJL2_DEC

S8500XXJL2_MAR
[Bada Software and Hacking General] xator91:
I've searched many bootloader, and find this two :)
[Bada Software and Hacking General] mijoma:
Thanks. These bootloaders are some additional builds of existing bootloaders XXJI3 and XXJL2. It looks Samsung has a bad habit of using same release name for different builds. Some builds may even come from the same code. Now we have 3 different XXJL2 builds and two XXJI3. I added new specimens support and changed the naming convention on the svn to include month
[Bada Software and Hacking General] lbyao:
bootloader XXJK2
[Bada Software and Hacking General] mylove90:
Can you believe that i just saw that that post right now:D

i don't really understand what you mean

i can read the CRC part (not blind :D) but there is no address for it

i know it is CheckSum but how to disable it
[Bada Software and Hacking General] mijoma:
I don't think it's checksum, but still haven't investigated that much.

I have one question about how did it look like when you tried modified apps on JL2 - were you able to flash the file and it just didn't run or you got an error during flashing?
[Bada Software and Hacking General] mylove90:
the file was flashed but the phone didn't restart so the bootloader did something for sure

when i try to restart the phone myself it just hangs in Samsung wave black and white rc2 picture

oh right another thing

if i try to flash the file again multiloader says security failed
[Bada Software and Hacking General] mijoma:
OK. When you flashed the modified apps you had JL2? Did first flashing of apps on JL2 work and security failed message appeared the second time?
[Bada Software and Hacking General] mylove90:
ok just let me be clear

1st experiment

had XXJEE bootloader in the phone ,flashed modified apps_compressed.bin>>>> Success

2nd experiment

had already modified apps_compressed.bin in the phone ,flashed XXJL2 bootloader and new universal fota>>> Success

3rd experiment

had XXJL2 bootloader in the phone , flashed modified apps_compressed.bin >>> phone won't restart but the file is already flashed to the phone

in second trial the multiloader say security failed

it is like two pieces of a puzzle won't fit together if the bootloader piece is there first
[Bada Software and Hacking General] mijoma:
Thanks for the description.

It seems that verification is done only when installing apps. I know where to look now, but I will need some time to analyse that.

For reminder, I attach the application for checking the bootloader with all the 15 CRC checksums of known bootloaders. I honestly cannot imagine simpler task to help development of universal FOTA. Let me not express my disrespect to the community should there not be a single person doing that part.
[Bada Software and Hacking General] intelligentking:
DVJF3 boot loader

hi this a branded australin firmware's bootloader DVJF3.

I don't think you guys have any bootloader which actually supports a 850 Mhz UMTS brand
[Bada Software and Hacking General] mijoma:
Although may be coming from the DVJF3 firmware, the bootloader itself that you attached is XXJEF (thanks, we did not have that version earlier). Although bootloader pays important role to the initialization of Call Processor, it has no influence on supported bands. That's why the bootloader used in 850 MHz countries is the very same as everywhere. What will be different is possibly amss.bin
[Bada Software and Hacking General] intelligentking:
thanks for correcting me mijoma i think thats the reason i lost my cellular signals when i flashed XXJL2 on my bell's firmware :( and luckily i found it somewhere and the amss.bin of DVJF3 supports 850 Mhz 3g band :)
[Bada Software and Hacking General] alloyal:
help

plz help me

i want to falash my wave to xxjl2 for android and i lost my cellular signals

my wave is for telstar-australin operator and supports a 850 Mhz UMTS brand

and my last firmware:DVJF3

now iwant android

plz heeeeelp me:(