yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
S8500XPKJ1

First FOTA in bada 2.0 ...

Maybe someone could compile FOTA for test... :)

Please.

Best Regards

Btw...

S8500+XP+KJ1g :confused:

Never seen before... some special? Or maybe mistype...

Hmm... will check S8530...
[Bada Software and Hacking General] b.kubica:
we've compiled fota for 2.0 weeks ago ;)

check some of my posts in this thread
[Bada Software and Hacking General] adfree:
I'm not smart enough to understand all your posts. :D

Here is modified FOTA for S8500XPKJ1 to play with Android Booting...

http://xdaforums.com/showthread.php?t=1343706

Thanx.

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=19656749&postcount=11

Please b.kubica

Can you maybe update FOTA Mod for bTerm?

So we could dump memory... maybe we can learn how Update over the Air now work exactly in S8500.

I mean real test. As 5 MB is downloaded from KK5 to KKV...

Where this 5 MB is stored?

Hot it looks?

Is it compressed? Encrypted? Or both?

Will S8500 create then new complete apps_compressed? :confused:

More Questions. :o

Thanx for reading.

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=19683731&postcount=31

I have found these DELTA files... Format seems like ... no idea... :o

Header seen allready:

BPDZ

I'll update now, then maybe via JTAG dump and see if apps_compressed is now newer...

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?p=19707607#post19707607

Handset creates new files...

So also Compression Algo for RC1 and apps_compressed.bin is possible... :D

I have now JTAG dump from KKV...

Best Regards
[Bada Software and Hacking General] adfree:
[B]SEC: mas production command issued with develpment usb binary[/B]
SEC: mas production command issued with develpment code binary
SEC: mas production command issued with invalid code binary

I've tried SetMassProdu... Command and got Blue Screen from SysSecureBoot...

I have no idea if good idea... maybe in combination with UnlockSecBoot...

Hmm, seems no effect..

> cmd="PrtSecBoot"

> SecBoot : slot num(33), mass production(0), verSecurity(2), slot age(93)

:confused:

Btw...

Any ideas about Delta Files and how to start manually? :confused:

Thanx for reading.

Best Regards
[Bada Software and Hacking General] adfree:
FOTA from XXLA1 is changed... since 5. january...

No idea what is affected...

Short tests with rcs failed...

But maybe my fault...

Will play also with RC1...

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=23152312&postcount=97

It seems now XEO Poland is official activated for FOTA updates... :cool:

Please, need someone who can this confirm...

Maybe this is an way for more tweaking... maybe Bootloader replace possible...

Thanx for reading.

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=24326053&postcount=103

I have managed to update manually "FOTA updates"...

"Funny"... this should be known since 1 year... :mad:

http://www.mysamsungwave.com/index.php?topic=85.0

Later I'll try Delta files on bada 1.x, as it seems same mechanism... :rolleyes:

Maybe this enable chance to replace Original Bootloader with less Security... :o

Only idea... :)

No idea how encrypted/compressed yet...

Best Regards
[Bada Software and Hacking General] adfree:
If since many months such documents like this floating around:

GT-S8600_SVCM_final_Anyservice_111019.pdf

Maybe someone found meanwhile ELF BOOT Files for S8600 for study?

:confused:

Thanx in advance.

Best Regards
[Bada Software and Hacking General] adfree:
Stupid Question...

FOTA needs mandatory correct apps_compressed.bin to work?

During my tests I need to check what is written into OneNAND... but key combination not work anymore, after flashing only my test apps_compressed.bin.

I can see only Pic with:

Firmware upgrade encountered an issue...

So I can't use bterm... :(

Damn. So I need solder wires to S8530 to check with RIFF JTAG what I have created...

Best Regards
[Bada Software and Hacking General] adfree:
We have now 2013... new year new attempt. :D

Maybe someone could help S8600 users...

Minimum Goal is to see such text on S8600:

http://www.youtube.com/watch?v=A35k3E1F1O4

No joke.

I have not much time yet for S8600 study...

First I will make few tests with S8500...

Best Regards
[Bada Software and Hacking General] adfree:
Minimum requirement to investigate FOTA from S8600 and...

Wave_Remaker to DEcrypt bplib_S8600OpEuroCommon.fota

You should see then such text...

OEMSBL BOOT Downloader for MDM9200

If you Google this... you can find you are not alone...

http://pastebin.com/1sFpM8vc

Best Regards
[Bada Software and Hacking General] adfree:
For Beginners like me

Here is next step of FOTA Investigation/Development...

http://xdaforums.com/showthread.php?t=1496729

I am able to compile with brandnew Win XP :D and bada SDK 2.0.4 (other SDKs not tested)

Maybe we can find correct addresses for S8600, S7250 and so on...

This means NOT we have then Android for these devices... but for learning...

Best Regards
[Bada Software and Hacking General] krittin98:
what is the lr register of fota ?

Thanks
[Bada Software and Hacking General] Rebellos:
Your question doesn't make any clear sense. LR register during FOTA execution depends on current function executed. However, during BL3 jumpout to the FOTA, LR does contain address of return point from FOTA to BL3. We're using it to continue normal bootup process of Bada if there are no special keys pressed (call key)
[Bada Software and Hacking General] adfree:
Summary for noobs like me... 2013.

Between rumours... theory and confirmed things...

1.

Groups/family because Hardware...

Qualcomm devices (SECOND processor and few other Chips from Qualcomm)...

S8500/S8530/M210S

S8600/M410K/M410S

FOTA file available and since bada 2 activ... ORIGINAL files from Firmware looks like this:

bplib_S8500OpEuroCommon.fota
bplib_S8530OpEuroCommon.fota
bplib_S8530KoreaSKT.fota

bplib_S8600OpEuroCommon.fota
bplib_S8600KoreaSKT.fota
bplib_S8600KoreaKT.fota

2.

One feature of Original FOTA is this... File/Firmware update over the Air

Here background info:

http://xdaforums.com/showthread.php?t=1363328

3.

ELF files of Bootloader are available for S8500 and S8530, very often... different Versions... bada 1 + 2...

HELPFULL but you need brain... :o

ELF files for S8500 and S8530 we have more then 2 years...

http://xdaforums.com/showpost.php?p=12652904&postcount=42

4.

S8600 is Qualcomm device... YEs, but nothing leaked public about Bootloader, because 99,9 % Qualcomm... and not enough users... :crying:

5.

Broadcom devices are DIFFERENT in HardDWARE + Software...

Broadcom are all other bada devices... like:

S5250, S7230, S7250, S5380

6.

To find something about Bootloader related for BROADCOM... I have nearly NOTHING found since 2 years...

And I have NO such device to test something... nor I would buy such device... Sorry. Tooo small Screen with small Resolution...

6.1

Few """"similar""" because Broadcom stuff... their are leaked Bootloader sources...

Here for instance...

ftp://82-117-232-91.gpon.sta.kh.velton.ua/../../../../SAMSUNG/software/S5230/

GT-S5230_UART_Downloader.zip

http://xdaforums.com/showpost.php?p=39719483&postcount=195

No idea if usefull... no time nor brain enough nor Broadcom device

7.

It would be nice or funny to have all bada devices supported by FBOOT - FOTA bootloader

http://xdaforums.com/showthread.php?t=1496729

In theory possible... because all Original Firmware with FOTA file...

bplib_S5380DOpEuroCommon.fota

etc.

8.

Please remember...

NO Kindergarten... :D :o

Remember how long and Hardcore Android Porting for S8500/S8530 is...

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=42954130&postcount=51

It seems in S8600 FOTA is more secured... :(

Maybe with CRC, Hash or RSA stuff... or SEED I don't know yet...

Best Regards
[Bada Software and Hacking General] R@j:
NAND and different addresses

How to you get the NAND and different addresses of the device ????

I'm new here , so sorry for my childish question.

:rolleyes:
[Bada Software and Hacking General] adfree:
Every help is welcome. Also every test helps... :cool:

Maybe for S8530 as beginning it would be nice to know. Which Firmware Version you use?

As first little overview I saw minor changes in Boot Versions... :confused:

http://xdaforums.com/showpost.php?p=12743246&postcount=44

Maybe mijoma if he has time could prepare FOTA for S8530 as Test.

Best Regards
[Bada Software and Hacking General] Rebellos:
SW Version (software?):

S8530CXJK3 (is it all about the last 5 symbols?)

HW Version:

MP 0.600 (hardware i assume, I think it doesn't matter alot at all)

CSC Version (:confused:):

S8530PLSJK4 (PLS looks like country/language code of mine)

some other thingys, doesn't look like important any way.

Thanks for quick reply.

Regards
[Bada Software and Hacking General] adfree:
Thanx.

I'll try to find this Firmware in my collection or in Internet...

Now this take an while...

Generally I've short looked into mijoma template FOTA.

Only 450 Byte Code... the rest is enough space to write many things.

Over 2 MB place for exercises. :cool:

Best Regards
[Bada Software and Hacking General] mijoma:
Not any more :]

Now we have other problems

Let's call it firmware update, but it's actually only one file that you need to upload. You don't need a basefile provided you put the magic values exactly in the locations I described in the first post.

You start with digging out the information about the version of the bootloader. Bootloader is usually not branded, common to all operators. That version shall be important only if you are planning to use anything from the original bootloader to find addresses of the functions you are planning to call - that you need to do manually - get the bootloader file and disassemble it.

Don't get me wrong, but JFGI rule applies as for that matter. Let me just close that with calling it 'debugging interface'.

Yes, yes, yes, as someone once said ;]

Well, you don't need to upgrade the bootloader, so just don't do that. In my opinion it's better not to touch phone internal non-volatile memory outside the FOTA. It's not as easy as one might think (little easier than SD support, but next to impossible to do accidentally), so no worries.

apart from breaking a bootloader, that would require someone with a JTAG, all the rest should be recoverable.

Best Regards,

mijoma
[Bada Software and Hacking General] adfree:
@ mijoma

Maybe we could make an "workshop" for Beginners.

Only if you have time. Please.

As base I've researched in mijoma_dummyFota_XXJL2_rev_key.zip

I've played little bit around... only text change... because first attempt to add more text failed... :o

I've made an German Version. :D :D

Only for better understanding for me.

Question number 1.

How to add more text? It seems you have 30 Bytes (30 Chars) each line...

2.

!

Is this from Bootloader? Or you can change into ? or * or...

3.

Position of text?

Is it possible to start in upper corner? :o

Thanx for reading.

Best Regards

P.S.:

Attached file is tested by me. BUT it is only to have something to play/compare... at your own risk.
[Bada Software and Hacking General] mijoma:
The difference between these two files is the address of the variable holding bootmode and the destination of the jump to the original code. The values come from the comparison of disassembly of both bootloader versions. The original fota is not used (I could have already used the empty one, but I just started with modification of original).
[Bada Software and Hacking General] mijoma:
The problem is that it's just pure assembly. Each line is loading of the text address to R0 and execution of printf from the original bootloader. Before, display initialization is called. The point of proof-of-concept is the simplicity.

The best way - rewrite a piece of code to iterate through some memory where texts should be put.

Spaces and exclamations come from original bootloader. Should be no problem to patch the image of bootloader in RAM.

Sure. The code just starts with displaying 6 lines of spaces.
[Bada Software and Hacking General] nbates66:
i really wasn't sure where to post this, but is any of this info relevant to work on the wave? The main gripe is that it's focused on the Galaxy S, with the only similarity being the samsung S5PC110 application processor, but there is some information concerning booting from SD.

http://forum.cyanogenmod.com/topic/15831-some-researches-about-the-sgs-bootloader/
[Bada Software and Hacking General] adfree:
@ nbates66

Very interesting for me. Thank you very much. :cool:

About FOTA. I've tried several thingies... It seems not possible to Log via WinComm... Hmm. I could try if Qualcomm Communication work in this mode... via QXDM.

WinComm Communication is in apps_compressed.bin...

Best Regards
[Bada Software and Hacking General] Rebellos:
Thanks for all replies and advices, started messing around and now i feel kinda stuck, probably missed something on forums or what.

Is it possible to dump firmware files from Wave through USB connection? Multiloader and QuB seems to have only flashing functions, with no way to download flashmem content.

Thanks in advance

PS: And basically I can upload everything except bootloader using multiloader and if I fukk something up in the worst case I have to reflash using original soft, is that right?

PS2: Well, maybe not "everything" exactly, it's probably possible to cause highly increase CPU voltage with some dangerous code.
[Bada Software and Hacking General] astrotom:
If you want to dump firmware files, you can do it directly using the firmware files which you can download from www.samfirmware.com. And use Trix to dump the firmware files, modify and re-upload them. If you want to get firmware files from phone, use TkFile Explorer or Stune. You can then modify files and replace them into the phone. I am attaching the required softwares.
[Bada Software and Hacking General] astrotom:
@Rebellos

You can upload bootloaders too with multiloader. But its recommended that noobs don't use boot change while using multiloader. You wont brick your phone if you dont use boot change. If however you do get an error while flashing, NEVER UNPLUG YOUR PHONE from your PC. Try the flashing process again with bootfiles. Repeat this until you dont get errors while flashing. Errors are shown on the right hand side white box.
[Bada Software and Hacking General] Rebellos:
Thanks for all advices.

interesting strings (commands?) that i found in bootloader code, probably useable during download mode, anyone knows how are they being send? I assume multiloader does use some of them, wondering what bootloader produces after sending him the first one.

Furthermore, bootloader supports "download mode" and "upload mode" aswell, is it different key combination or maybe it does switch from download to upload mode after receiving certain command?

Dunno if it's something new for you, probably not, but always. ;d

Ah yes, I'm analysing S8530CXJK3

@Down:

I had read it, just forgot all details.

Still i'm happy i could discover it by myself! :D
[Bada Software and Hacking General] nbates66:
download mode is activated by holding the volume down, lock and power buttons to boot the phone, as for upload mode, if you'd read the thread...

http://xdaforums.com/showpost.php?p=12635164&postcount=12

:P
[Bada Software and Hacking General] mijoma:
These are debug messages for download commands sent to BL. They are transmitted over HDLC packets. Not all commands are implemented, they are dummy and give just simple confirmation response - DUMP, ERASE_MC, READ, VER_CHECK, COPY, UNLOCK, USB_VERIFY, DOWNLOAD_UNLOCK and FULLDOWNLOAD commands do nothing.

Upload is entered after system crash, hw failure, etc. Generally - after some serious issue. I made a simple FOTA code jumping to the upload mode.
[Bada Software and Hacking General] adfree:
Strange.

Only today I saw first time connection via Modem Port with this Upload data to PC thingie... WinComm seems not receive data...

For WinComm I know AT command AT+WINCOMM is mandatory...

Maybe Upload must also be unlocked... but how? :confused:

I'm on JE7...

Thanx.

Best Regards

Edit 1.

Interesting PDF:

http://www.armdesigner.com/xsms/html37/uploadfile/20100707120620748.pdf
[Bada Software and Hacking General] kakashibg:
mijoma, along with Oleg_k you are working to complete the project for the bada and android research to launch the s8500 by mode FOTA? would like to ask what progress?

ps: sorry for the stupid question of my little

I use google translate
[Bada Software and Hacking General] mijoma:
Quite honestly, I haven't got enough time for this. I've done attempts to mount the SD through FOTA, but with little success. It's not that hard, but seems I'm missing some detail.

As for the Android porting project I extracted some LCD handling code and made some modifications to SGS bootloader to match the GPIO in Wave, but that's all.

In the first post of the thread I've already stated I hope somebody can take if from here. The method is served on a plate - has almost no limitations - full memory and devices access, original BL loaded in DRAM (may think about patching). All you need is to write some pieces of the code and test that. What I don't get is how Samsung Jet community gathered bright enough guys to do all that stuff and Wave owners wait for somebody else do that job for them offering donations for everybody asking, even without the skills. You won't ever finish your porting projects if you're planning to base them on 2-3 guys. Better find yourselves some reverse engineers and developers.

I've helped as I could and I'm already reaching my time limit for next several months.
[Bada Software and Hacking General] aLexzkter:
So...yeah. We can forget about the port for now :/

No one has showed any interest in Samsung Wave, until three or four guys showed up...but that was obviously not enough...

We should find some American reverse engineers (there are lots of them over the XDA community) although none of them has paid any attention to us so far (as a consequence of no Waves being sold in America)

In my opinion, we could come to an agreement with the XDA staff...they could pin the Android to Wave port thread on the main page and make an engineers call for the Wave as a request from us on the main page . We have to sort this out in anyway and we open to ideas...

What do you guys think about it?
[Bada Software and Hacking General] badelemental:
If mijoma is quitting, then nothing can be done.At this rate may be oleg_k might loose his interest in the project too . Just praying that this project could be completed successfully otherwise I am going to sell my wave on ebay and will get a android phone..
[Bada Software and Hacking General] nbates66:
i'd certainly hope not, isn't anyone else trying to work on this other than mijoma? I'm still trying some things with the fota file but i'm kinda being hampered by bugs in the various applications i'm using, as well as my lack of assembly editing knowlege (probably mostly the latter :p )
[Bada Software and Hacking General] RusEm:
good job guys )))

very interesting research )))
[Bada Software and Hacking General] astrotom:
Ah! Looks like the founder of the Qub Tool has joined xda!
[Bada Software and Hacking General] RusEm:
Oleg_k and mijoma, I want to ask you...

PLZ return control to start adress of firmware after you boot...(as it make Samsung boot).

CUZ it will make compability of you boot and my tool )))
[Bada Software and Hacking General] baza14:
Today is 17th... Where is the informations from androidport.net?
[Bada Software and Hacking General] Rebellos:
I started to play with fota files on my S8530, weird thing i get is that even if i change FOTA_ENGINE_VER_INFO_2.0 to 1.0 for example or just make some letters null it still does boot normally, should it? This one confuses me :/
[Bada Software and Hacking General] mijoma:
Attach the file you have, I'll have a look.
[Bada Software and Hacking General] Rebellos:
For now I just made it longer to add BPDZ later and copied some of your code for further use, but first I want to see kind of error message from bootloader as I expect when it doesn't find correct FOTA string.

//edit: maybe i'm flashing it wrong or what, should I check some additional things in multiloader except searching port, selecting file and clicking download? :D

INFO: PLEASE DON'T TRY TO USE/ANALYZE IT, YOU'LL WASTE YOUR TIME.
[Bada Software and Hacking General] mijoma:
1. You need a correct apps installed - it needs to have 0xF07AF07A magic in the header

2. To run the code you need both FOTA_ENGINE... magic at 0x100 and 'BPDZ' magic at offset 0x280000 of the file

3. Code runs from 0x43800000, which is offset 0 of the file.

4. ARM opcodes are 4 byte long. Code needs to be aligned properly.

5. Addressing is relative

Nothing special about loading
[Bada Software and Hacking General] Rebellos:
Thanks for the reply, but for the beggining i didn't want to see own FOTA code WORKING, but just the result of flashing, doing everything step by step, shouldn't Wave even run if it doesn't find correct magic value at 0x100 offset (changed F to f and 2.0 to 1.0)? I thought it's checking for first magic value and shows "FOTA ENGINE NOT INSTALLED" or something like that. For now I left 0x00 offset empty for inserting jmp to 0x~130 (edited it only in hex editor for now)
[Bada Software and Hacking General] mijoma:
No, if you have no correct apps (with the F07AF07A magic) loaded.
[Bada Software and Hacking General] Rebellos:
Ahh, now I think I get this additional check, no more questions for now. Thanks! :)
[Bada Software and Hacking General] nbates66:
well it's good to hear that others are experimenting with the Fota other than mijoma, because i honestly don't count :p

i've been seeing the results of inserting various bootloader files into the Fota file, with the i9000 boot.bin from olegs thread (original post) triggering an odly scrambled green screen, which may be it's attempt at showing it's splash screen when it either can't find the image file, or it isn't initialising the screen properly, or possibly neither! :p
[Bada Software and Hacking General] Rebellos:
Good, I will try to insert original bootloader code into FOTA file, like it didn't jump there, so we can keep control over the execution flow and load everything like bootloader does. No idea if I manage to do it, probably not, gotta take a closer clook into booting order (is dbl or boot_loader first? where does dbl jumps to boot_loader code or vice-versa?) and posts about it. If this succeed, will try to insert this i9000 one modified by mijoma.

//trying, trying and I don't know how the heck can I get apps starting with the magic F07AF07A, none of mine encrypted or not starts with that, don't think it'll work if I set it manually xd

//YEAH! My apps didn't supported FOTA, loaded the old, not branded one without replacing anything else and its all working as expected! Let tha mash begin now... ;]

Huh, flashed with rsrc2 (Mid) from different firmware release and after boot it shows nice debug screen with information about assertion during loading apps, restarts when I tap any key and enter Upload Mode, so it probably stored debug report in some NAND area and its possible to download it through USB, interesting, but i'm worried it's unuseful for us. ;d
[Bada Software and Hacking General] mijoma:
For people experimenting with FOTA, you may use fasmarm as an assembler for the architecture. I enclose some example source for S8500. I don't say they are perfect, but something to start with.