yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] Rebellos:
Damn, I love you for this one!

Seems like you were right and it indeed loads around 512bytes of fota file, weird that when my code is reaching offset near 450 it doesn't want to work. :confused:

//edit 2: ...or I just done something wrong before, now made test app and it is easily reading string from offset 515

//edit 3: Now I've noticed it isn't working if I put string in the middle of the code, before numeric variables, it's all working fine when string are on the end of code, before magic_1 declaration. Maybe FASM offset calculation bug.
[Bada Software and Hacking General] adfree:
SHP_CSC_FEATURE_FOTA_DISABLE=1

Found in folder Registry/ShpCSCFeature.ini from XEKC2.

There are few more SHP_CSC_FEATURE_xxx example this:

http://xdaforums.com/showthread.php?t=1041058

I think it is more Info file instead ini... I will try if SHP_CSC_FEATURE_FOTA_DISABLE=0 makes something for XXJL2 Boot...

Best Regards
[Bada Software and Hacking General] astrotom:
There was one line line like that for call recording too in the KC2 firmware. But when we use that file in JL2 firmware, it doesn't work. The new features in kc2 are unlocked in some other part of the firmware.
[Bada Software and Hacking General] b.kubica:
i merged mijoma's template with my one. Now, our code is placed right after first 0x200 bytes - I think it's a bit cleaner. Also small file_open test included :)

regards,

Bartek
[Bada Software and Hacking General] adfree:
I've tested yet...

This time I'm sure Boot is XXJL2. :D

1.

apps_compressed.bin from XXJL2

SHP_CSC_FEATURE_FOTA_DISABLE=1

Result no changes, FOTA example runs.

2.

apps_compressed.bin from XEKC2

SHP_CSC_FEATURE_FOTA_DISABLE=0

Result no changes, FOTA not executed...

So I'm pretty sure. ShpCSCFeature.ini is only Info file from apps_compressed.bin.

Best Regards
[Bada Software and Hacking General] Rebellos:
Ahoy!

Thanks for such interesting example.

Weheee, found this one, all tfs4 instructions implemented in bootloader are explained there in Table 26. Test Shell Command, thats not reference manual, but always.

http://www.samsung.com/global/busin...nmemory/downloads/tfs4_v150_porting_guide.pdf

Got no idea how to use tfs4_readdir, probably it is the right procedure to list files and directories, but don't know how to... maybe something like http://linux.die.net/man/3/readdir

Should it return stack pointer to the direntry struct or what?

This one i'm sure for now:

if I pass r0 to the tfs4_readdir then it seems to return SOMETHING on r0, like stack pointer by 4 higher than given (assuming than opendir returns stackpointer), trying to redirect it in right format to the printf.
[Bada Software and Hacking General] Xenоn:
@adfree

SHP_CSC_FEATURE_FOTA_DISABLE string has no effect on the boot. It controls 'Software update' item in the settings. SHP_CSC_FEATURE_FOTA_DISABLE = 1 hide this item.
[Bada Software and Hacking General] Rebellos:
I have got almost full directory-listing module, the problem is that I cannot force printf to show wide-char text, it has got function "printf_wctomb" to show it, but I've got completely no idea how to force printf to jump into it, %s causes printf jump to printf_str, %S causes showing S, %ls doesn't work too. And I don't really feel like analysing whole sprintf ASM switch. :/

Any ideas?
[Bada Software and Hacking General] mijoma:
Nice. I think all you just need to do is rewrite every second character. Should be enough.
[Bada Software and Hacking General] b.kubica:
adr	r1, w_test
adr	r0, s_fmt
bl	disp_FOTA_Printf
...
s_fmt	db '%ls',0
w_test	du 'my wide char string',0
[Bada Software and Hacking General] b.kubica:
http://sourceware.org/newlib/libc.html#sprintf

look for size field :)

damn, posts didn't merge
[Bada Software and Hacking General] mijoma:
Yes. The application part that runs after booting has no effect on the FOTA bootloader code. The only issue is that apps needs to have a mentioned magic in the header so that bootloader knows that apps can handle FOTA and it should check whether some patch has not been downloaded and needs to be applied. That's the condition for our code to be executed.
[Bada Software and Hacking General] Rebellos:
Are you sure it does work? As I stated in my previous post - I tried it, tried it again now too, with no success.
[Bada Software and Hacking General] b.kubica:
@Rebellos, yes i tested it already, sample attached.
[Bada Software and Hacking General] Rebellos:
Then, obviously i did something wrong, done manual single-byte conversion, works well too. :)

Mwahahah!

Sorry if my code looks like cow's ****, it's my first own asm code. :D

Remember to include proper addresses and modify multiloader header if you want to test it on S8500.

//edit:

Okay, any1 wanted to do real file explorer and manager for Wave? Touchscreen handling and some ops left todo. :D

//edit2:

SD Card doesn't seem to be mounted by default, so a year of struggles ahead!
[Bada Software and Hacking General] b.kubica:
i added one more sample test - it shows even TEXT section is writable

so we can easily patch BL to our own purposes

btw, i added 2 new useful macros - START and END, so the patches are model independent now - required only including different *.inc file
[Bada Software and Hacking General] Rebellos:
Great job, just one thing - S8530 FOTA starts on 0x0a900000 offset in NAND, not 0x0C600000 like in S8500.

Anybody knows where can I find some infos about bootloader modified by mijoma which oleg posted in the other thread? I mean, does it have symbols, or other useful infos available, what does those 3 files contains? Gonna look for it in galaxy s thread, but I would be glad if anybody helps me.

And question to mijoma: what exactly did you modified there?

I'm wondering why bootloader exposes functions like tfs4_read and _read, tfs4_read seems to be using TFS4 FS, and _read using FAT, does it means that we have to handle internal Wave FS different than SD card, or BL devs left possibility to mount tfs4 like fat and vice versa and let OS devs decide? Need further investigation.

List of possible device names which can be used to mount SD card

Note that I found them written as wide-byte strings, "ms" looks like "mediastorage"

And single byte dev names

while tfs4_mount (probably this one supports widechar) has got no comment in ELFs

_mount (FAT-style) is commented like this

Thats all for today from my side.
[Bada Software and Hacking General] mkz14:
Try on %c instead of %s, may work... or printk sprintk

note that I am newbie on ASM
[Bada Software and Hacking General] nbates66:
one sec, i'll find it for ya...

got it: http://xdaforums.com/showpost.php?p=12993726&postcount=316

it's just the sbl file.

EDIT2: it's a modified Galaxy S bootloader, as far as i know, i couldn't really find much useful info in it but i'm not much of a programmer.
[Bada Software and Hacking General] Rebellos:
Thanks, but this one I've got, I was asking about kind of different informations. Please anyone can confirm if loading address of i9000 BL should be 0x40200000 with file offset 0x0000000.

Damn, I really can't get this wchar printf working, it hangs my Wave, maybe it's kinda difference between s8530 and 8500 printf or I'm really dumb.

Probably the second thing, cuz b.kubica's example is working fine. O.o

Ghad! This is making me sick :mad:

//edit: tested it wrong

Now thats weird, this code, when run separately prints result like "//ont/Mc", but still, s_path used as tfs4_opendir param returns correct result, and with little bit longer code printf hangs everything. O.o

//Solution:

Use my code to convert wchar_str to c_str, why?

Check this one with Bartek's sprintf
[Bada Software and Hacking General] b.kubica:
I'm on wave now and can't test it till Tuesday when I'll back from holidays
[Bada Software and Hacking General] Rebellos:
printf formatted with %ls doesn't print some characters, and on others it hangs.

I think about writing to samsung customer support that their bootloader printf function is bugged so I except quick firmware update or cash return.
[Bada Software and Hacking General] mkz14:
I doubt they will do care even a little bit about that xD...
[Bada Software and Hacking General] aLexzkter:
That malfunction does not affect the service you paid for xD
[Bada Software and Hacking General] Rebellos:
If any1 interested in SD Card mounting try

http://www.samsung.com/global/busin...oads/tfs4_v16_mount_technical_paper_rev10.pdf

And if any1 wants to be helpful and feel like uber google mastah I'd be freackin happy kiddo if I get TFS4 error enums (listed in tfs4_errno.c of Samsung's tfs4 driver)

Note:

__PfsMassInit in fact DOES mount SD Card, but God knows where... And it loops mounting 3 times! No idea for what, maybe it is designed to mount up to 3 SD media.

//edit:

It can be __PfsMassInit doesn't mount primary partition from SDHC, and just some small partitions bada created by first SD card load (or it can not be).

//edit2:

Is MoviNAND 2gb totally capable? Or is it only for bootloader and firmware?

Is there one more storage volume (like SD) onboard?

__PfsMassInit loads such things as bada partitions under

letters, when f/ is like primary mounting point of all data partitions except firmware filesystem from movinand (was it rc1 or something?) mounted as /a/ and SDHC card which I haven't discovered yet.

Under f/ subfolders we can find all partitions available to end-user when we connect Wave in USB-Storage mode + some additional partitions I don't clearly recognize.
[Bada Software and Hacking General] omarittu94:
shouldn't be easyer if you try to boot android by the media partition (of around 400 mb) of the internal memory?????
[Bada Software and Hacking General] oSandmaNo:
@Rebellos

waves internal memory is partioned into 3

one for user media,one for bada applications and one for email

thats why it loads 3 partitions
[Bada Software and Hacking General] antz.bin:
Its 4 partitions not 3.

Quoting my post on the other thread.. hope this can help.
[Bada Software and Hacking General] haoto:
Hi, I'm confused too. I'm only basing this on my experiences with PCs, but isn't it possible to just put the linux kernel and initrd in the media partition, and then mount the SD card from the linux kernel?
[Bada Software and Hacking General] omarittu94:
may there are some problems mounting by media(but i don't think so..)

I find strange that mojima and rebellos never thought about that
[Bada Software and Hacking General] nbates66:
hey if it's so simple we'll invite you to go ahead and write the code for us? :P

Mijoma has stated that he simply doesn't have much time to work on this, and Rebellos only just began recently, so be too pushy :P
[Bada Software and Hacking General] haoto:
Take it easy buddy. I think omarittu94's intention is to help work out the easiest solution here. I know we were pointing out the obvious, but just in case.

Since the phone doesn't need a SD card to boot, I think it's perfectly logical that the bootloader doesn't mount the SD card at all. Of course, feel free to ignore this if you know otherwise :)
[Bada Software and Hacking General] bartaspoz:
Guys you making me sick.

If then didn't mentioned about that - that means that is not the optimal way.

I'm not an expert but i think that the problem coudl be different file system of bada - TFS4.
[Bada Software and Hacking General] Rebellos:
TFS4 is 100% FAT compatibile (so Samsung papershits says), so theoretically even Windows should be able to mount it.

I've been thinking about first try to mount I9000 bootloader and Android kernel from internal memory, but it's way less comfortable when I cannot manage its filesystem other way than through booting Bada and using USB-Drive mode.

And, tbh I know it is possible to mount SDHC card through bootloader, then I feel like I have to found it how. ;d
[Bada Software and Hacking General] haoto:
Don't be so quick to attack people, especially if you clearly don't know what you're talking about. Again, there is a possibility that FOTA just doesn't have the ability to mount SD cards, in that case "booting" from SD using FOTA would never work and you have to put the kernel in internal memory.
[Bada Software and Hacking General] mylove90:
internal media memory is perfect for me off course if dual boot is present in the bootloader as the SD memory card is not that fast for all people and it is dependent on its quality

for ex i tried sygic mobile maps from my SD card and it was so slow so i removed it and installed it again on the bada apps internal memory and it now runs in a good speed

so please think of that again maybe you will choose the internal memory finally for all people sake

PS : i am not a programmer so if that hard just drop it and consider booting from SD card
[Bada Software and Hacking General] tom112112:
booting from sd also decreases battery life
[Bada Software and Hacking General] srg.mstr:
I have formatted my SDHC16G into two partition (partition order: first FAT, second Ext2 - not vice versa):

primary1 0x0C Win95 FAT(LBA) ~14G

primary2 0x83 Linux Ext2 ~2G

Bada works fine with primary1.

IMHO: may be in FOTA we need to initialize a Compact Flash Controller (CFC) and execute a modifed linux bootloader (placed in internal flash) such as U-BOOT or LILO. Linux bootloader can mount ext2 and load zImage from ext2.

Is that easy to modify linux bootloader for S8500, put it into internal flash through BadaOS and execute it from FOTA?
[Bada Software and Hacking General] nbates66:
hey is it possible to find out what the folder structure here is(specifically, what are the user allocated storage and SDcard mountpoints labeled as)?
[Bada Software and Hacking General] Rebellos:
Yes, already found out this structure, actually Nucleus kernel mounts SD card into /a/Mount/Mmc after bootloader finish his work.

Under /f/ I find:

CSC contains

SystemFSISO contains Kies installation CD image

SystemFSMedia contains, I thought it's /dev/ms1 device alias, but it has got the same root dir tree, files inside it can be seen in bada as read-only, locked

SystemFSMediaSet contains

SystemFSPowerOnOff contains some on off audio and animations

Mass contains

It seems there is NO user stored files anywhere under /f/ mountpoint

/dev/ms1/ has got the same dir tree as SystemFSMedia, but this one contains images, sound and themes stored by user, not by samsung/brand operator

/dev/ms1/ is being mounted as /g/ //edit1: I confirmed it

I've listed directory only up to first subdir.

So in fact, __PfsMassInit doesn't seem to mount any SD Card partitions, it mounts /dev/ms0 and /dev/ms1 but has got functions to initialize and mount SD Card too for sure, haven't found out HOW to trigger those, yet.

//edit2, moar info:

Apart from /f/ and /g/ __PfsMassInit mounts SOMETHING under /h/ too, this one contains:

bada contains

while bada seems to be a mountingpoint of a different partition (I can be wrong)

appex

Note that this is structure for my own S8530, on which I've got installed SDHC 4GB card (in case it could have got influence on that) and some apps.

Note2: This structure may be not followed inside Bada, cuz it may be using different mounting procedure (may be using the same, ain't sure).

//last edit:

/dev/ms2 is mounted as /h/
[Bada Software and Hacking General] Raitis:
S8000(jetdroid) also use Nucleus

Looked into Jetdroid source Seems S8000 also has nucleus

Most interesting part are boot_loader_interface

https://github.com/Dopi/JetQi/blob/testing/src/cpu/s3c6410/boot_loader_interface.c

void enable_SD_LDO (void)
{
asm volatile (
"stmfd sp!, {r0-r1}\n\t"

"mov r1, #0x07F000000\n\t"
"add r1, r1, #0x8000\n\t"

// set pull-down on MMC_CDn1/GPG6
"ldr r0, [r1, #0xc0]\n\t" // read Port G Configuration Register
"and r0, r0, #0xf0ffffff\n\t" // clear bits 24-27 ==> GPG6 is input
"str r0, [r1, #0xc0]\n\t" // write Port G Configuration Register

"ldr r0, [r1, #0xc8]\n\t" // read Port G Pull-up/down Register
"and r0, r0, #0xffffe7ff\n\t" // clear bits 12-13
"orr r0, r0, #0x00000800\n\t" // set bit 12 ==> GPG6 pull-down enabled
"str r0, [r1, #0xc8]\n\t" // write Port G Pull-up/down Register
"ldmfd sp!, {r0-r1}\n\t"
// : : "r0", "r1"
);
LCD_print_newline("Enabled SD-card LDO");
}

void qi_cstart(void)
{
//LCD_init2(); // this is still in ASM
JetDroid_mode_MSG();

LCD_print_newline_col("Initializing baseband ...", LCD_color_white);
//jump_Baseband_Init();
asm volatile (
"stmfd sp!, {r1-r4}\n\t"
"ldr r0, aadr_Baseband_Init\n\t"
"blx r0\n\t"
"b after_bb_init\n\t"
"aadr_Baseband_Init: .word 0x5141983C\n\t"
"after_bb_init:\n\t"
"ldmfd sp!, {r1-r4}\n\t"
);

//MSG_PMIC_setup();
//PMIC_setup();
enable_SD_LDO();

LCD_print_newline("jumping to start_qi() ...");
start_qi();

LCD_print_newline("Now entering infinite loop ...");
spin_forever();
}

void jump_OneNAND_Init (void)
{
asm volatile (
"ldr pc, adr_OneNAND_Init\n\t"
"adr_OneNAND_Init: .word 0x51401C3C\n\t"
);
}

void jump_LaunchNucleus (void)
{
asm volatile (
"ldr pc, adr_LaunchNucleus\n\t"
"adr_LaunchNucleus: .word 0x514023A8"
);
}
[Bada Software and Hacking General] Rebellos:
Thank you very much, gonna look inside this and find similiar code inside bootloader, or write it by my own.

Attaching some of my current work, contains part of memory dump to file code, full listdir code and initializing moviNAND and manual mouting it into tfs4 code.

//edit2:

full memdumping procedure

loadfile to memory

Going back to SD mounting tries.
[Bada Software and Hacking General] mkz14:
I love to see this movement of code, that means this is going ahead, maybe I should be able to help you in anyway? I do not know about ASM (I know basic stuff) but I know coding and about OS's
[Bada Software and Hacking General] Rebellos:
Try to find SDHC controller GPIO init sequence (called in bootloader SDHC_Init) for S8530/8500, i've got one for moviNAND, but want to compare them, ain't sure if they are equal, gonna test it probably tommorow.

Latest research:

__PfsMassInit opens SDHC interface MMC0, which is moviNAND, MMC2 (external SD Card) remains closed, gotta try out how to redirect MMC0 initializing procedures to MMC2.
[Bada Software and Hacking General] mkz14:
So your target is just moving the booting procedures from XNand to SDHC slot?
[Bada Software and Hacking General] Rebellos:
It isn't, yet, for now I can redirect booting from Samsung's code in oneNAND to the our own code stored as file in moviNAND.

I've learned how to mount and manage moviNAND memory, because this one has got ready to use procedures. I'm trying to copy moviNand init sequence which is compiled in to use port MMC0 and use it at port MMC2.

Gotta rewrite those procedures into FOTA or find them in bootloader, if they exist, if they don't, it's at least few hours or days of work, Tfs4 needs pointers to them to init and mount device:

the similiar table of functions is created to init and mount oneNand

those table of functions are called pOp structures

*pOp - physical device I/O operation function

pointer structure. (from samsung tfs4 manual)

I think i'll drop SD mounting. If there is no shorter way to do it from bootloader level - I won't do it. I've got high school finals in 2 weeks, time to start some learning I think. :D

//edit:

attaching my whole FOTA folder, maybe someone finds it useful
[Bada Software and Hacking General] srg.mstr:
I have XXJL2 firmware. and It has very small list functions in "S8500XXJL2.inc". Not all functions, which you use, is discribed there.
[Bada Software and Hacking General] Rebellos:
The code of all s8500 bootloaders are basically the same, only addresses differs. So you can get yourself IDA Pro, load BL3 elf file and in other IDA instance load your bootloader (decrypted by QuB, CPU ARMv710, file offset 0x20000, Rom section start the same as in loaded elf(smth like 0x4380000 i dont remember exactly now), loading address the same as rom start, then mark first byte as code and you can start finding out adresses by yourself)
[Bada Software and Hacking General] nbates66:
unfortunately, i don't have any S8500 bootloaders that have the elf files included, can anyone else link?
[Bada Software and Hacking General] Raitis:
http://xdaforums.com/showpost.php?p=10304951&postcount=3
[Bada Software and Hacking General] nbates66:
Rebellos's XXJEE.inc file has alot more instructions than our XXJL2.inc files, however the instructions that ARE there have appear to have identicle addresses, at first glance dispite this, the XXJEE.inc file still lacks instructions that do appear in the XXJL2.inc :confused:

i'm gonna see if i can get the instructions i need from there, Since i only have IDA Pro Demo version, i can load .elf files in ARM but i can't set a loading offset.

edit: nope, found some of the instruction addresses are different... does anyone know which firmware version those elf files are from in the post above? It looks like XXJEE, i'm not sure the addresses of this firmware will work XXJL2 :(
[Bada Software and Hacking General] nbates66:
well, i decided to just try and use the XXJEE file (i'll have to flash an XXJEE bootloader to use it) but now i've found that it doesn't have a spaces string set, and i've no idea how to find it in IDA.
[Bada Software and Hacking General] Raitis:
with ida 5.5 also can deassamle bootloader

google for it
[Bada Software and Hacking General] srg.mstr:
What does you mean bootloader?:

1. boot_loader.mbn and dbl.mbn files from BOOTFILES folder? But it's crypted. And i can't to view them in IDA.

2. if you mean *.elf (with *.map) files from adfree, look into boot_loader.mbn file offset 0x001A01E8 => S8500+XX+JEE

3. if we want to do android bootloader for all bada firmwares - we need *.map for all bada bootloaders
[Bada Software and Hacking General] nbates66:
we do have decrypted XXJL2 bootloader files though, decrypted using QuB i think, i'll try to link the post for ya.

think this is what i have:

http://xdaforums.com/showpost.php?p=12619020&postcount=36
[Bada Software and Hacking General] Raitis:
i mean JL2 boot_loader.mbn, it can be decripted qith QUB
[Bada Software and Hacking General] srg.mstr:
Can you help me to convert this bootloader into *.elf and *.map files (better do it into full S8500XXJL2.inc file). Because i'm begginer in QuB and IDA.

View attachment S8500XXJL2_SocialHub.zip
[Bada Software and Hacking General] Raitis:
For JL2 it must be found manually as without elf, function names are addresess.

It can be done by opening 2 ida's

1) ELF file BL3_univ_s.elf

2)JL2 decrypted bootloader

In elf version it can be easy found by name, then must found same function in JL2 by comapring content of function

I'm also begginer, and that not going so fast for me

But already found few :)
[Bada Software and Hacking General] srg.mstr:
Manually finding more than 3000 address of functions... May be is it something easy?

OK, look at "alot_of_****.ASM" and "list_dir.ASM" posted by Rebellos. Can you find adress of functions "tfs4_opendir", "tfs4_readdir", ....... All them that Rebellos used.
[Bada Software and Hacking General] Raitis:
Sure i'm try find missing ones used in "alot_of_****.ASM"

Yet found

tfs4_pdev_movi_rp_get_op	equ 0x4249EA78
; tfs4_readdir -- not correct same adress for tfs4_close equ 0x424C7864
tfs4_pdev_reg	equ 0x424C35EC
tfs4_opendir	equ 0x424C6804
tfs4_closedir	equ 0x424C6B00