yashsingh1/xdaforums huggingface dataset:
[Hardware Hacking General] AdamOutler:
All we are missing is clock and mode select.

Clock=baud rate

Mode=resistor used... or something along that line... I need to read more on that usb multiplexer chip.
[Hardware Hacking General] AdamOutler:
Flashing the boot loader is not a problem with jtag. http://xdaforums.com/showthread.php?t=1000175

The problem is soldering. I can bearly see the connections. they are 0.2mm wide. It's difficult to get 40awg wire to solder to those connections and once you have, they move too easily. I cant find a pressure connector for that size either. I know they exist though.

Regardless... I think it is possible to jtag over the USB mux, or at bare minimum, it will be possible to load a program into memory over USB which will activate download mode.
[Hardware Hacking General] ntfreak:
Looking at the partial schematic posted on U301 it only shows two gpio - JTAG_TXD and JTAG_RXD.

I am inclined to say that is the DCC channel that is used for trace debugging and not the jtag port you are thinking of.

Cheers

Spen
[Hardware Hacking General] midas5:
I have send an email to Samsung requesting information.
[Hardware Hacking General] js22:
Not quite.

JTAG uses a 4-wire protocol to manipulate an internal (to the chip) state machine. Clock is a digital input from the users equipment. On a rising (falling ?) edge of clock, the level of the other 3 wires determines the input bit, the output bit, and the next state in the state machine.

The schematic is confusing in that regard, but quite simply, if you don't have (at least) 4 wires, you don't have JTAG.

Also, just having JTAG-level access is not enough. Once you are able to manipulate the internal sate machine, you need info about that particular chip to be able to accomplish anything useful. A previous post suggested that our CPU might have a sufficiently generic interface to borrow from other (documented) chips, but I'm not aware of anyone who has reported that to be the case. Our CPU data sheet does not cover the JTAG architecture.
[Hardware Hacking General] js22:
Very nice summary, androcheck.

Item (a) is really the core of the problem right now.

Item (b), is already handled : we know for sure that the UART Rx/Tx lines are hooked up to the USB connector, as we can read ASCII output from the PBL/SBL and even interact with the SBL command line.

Item (c), IMO, is not capital-D done but is looking good TheBeano has done a great job of disassembling the iROM, but (AFAIK) there are a few dangling questions. But nothing that can't be worked out.
[Hardware Hacking General] TheBeano:
You can buy dedicated jigs like this one now so you don't have to solder any more. There's a video on youtube showing the process using the $150 Riffbox. But this thread is really all about avoiding that, because we are cheapskates I guess. :) There is already a JTAG thread, maybe move that part of the discussion over there?
[Hardware Hacking General] androcheck:
Just thinking:

Trying to understand the complete scenario I came to another question:

Do we know what exactly happens when we get into download mode using the 301K resistor value? How gets the information from FSA9480 all the way into the SBL code so that it knows to boot into download mode?

What I mean is the following: is it possible that the BOOT pin out of the FSA9480 is used (also) to indicate the SBL to enter download mode?

This would explain why the SBL reads out the OM register (as we see in the SBL bootlog which TheBeano posted here for example).

Is there a way to check the SBL bootlog when booting into download mode using the resistor? Do we see there a different OM value?

Or other way: have you checked already if maybe the 301K resistor value is the one we are looking for?

Maybe it's double-used: first during initilazitaion of the S5PC110 to look for alternate boot-sources (OM pins) and if the boot process continues, later on, it's used in SBL code to initiate the download mode?
[Hardware Hacking General] Bawdz:
Also has anyone tried a homemade jig with just a 300k resister??
[Hardware Hacking General] AdamOutler:
by simply removing the USB Cable and inserting it without a battery and uploading a firmware I get this...

��������������������������������������������������������������������������������
Uart negotiation Error

Secure Fail Error

What is Secure Fail Error? Is is signed?
[Hardware Hacking General] AdamOutler:
What kind of checks trigger secure boot fail?
[Hardware Hacking General] midas5:
Ok. That is what happened to the IROM boot console messages!

Comm port 2 must be the jtag uart.

It will be useful later to find out if our firmware is running or not. We could get it to say hello to com port 2.
[Hardware Hacking General] midas5:
I think we have to use 0xD0020000.

Other memory the unit has is powered down at that point.

Part of the task of the pbl/sbl is powering up the main ram.
[Hardware Hacking General] AdamOutler:
Midas5, can you get the pin numbers you'd expect to be the I2C bus? I'm too busy to do research on that. I'll find the pins for you though.

0xC000000 was referenced in the source code for uBoot on the MangoBoard platform which uses the S5PC110 chip, but I trust your judgement.
[Hardware Hacking General] AdamOutler:
What is this on page 22 of the s5pc110 manual?

0xC000_0000 is the OneNand address... does that mean we're writing to OneNand?

I'm trying to understand why I'm getting this error when I upload firmware... I know it has something to do with chain of trust.
[Hardware Hacking General] AdamOutler:
adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ../"u-boot.bin" --a d0020000SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 007
=> loaded 247576 bytes from ../u-boot.bin
=> Downloading 247586 bytes to 0xd0020000
=> Data checksum e0bb

It does not take it at this location... It times out and sits there.
[Hardware Hacking General] midas5:
There is a limit on the amount of bytes you can send to the irom boot. I think you are trying to send something too big.
[Hardware Hacking General] midas5:
What does the jtag uart say when you try the above ?
[Hardware Hacking General] Rebellos:
Secure Fail Error is kind of default case of iROM error switch, it is the most wide used errorcode in all procedures.

Now it makes sense what is happening with iROM debug messages. So does even normal usb connector has anything to do with iROM? Few days ago I could swear that UART2 is that one muxed by FSA and connected to microUSB...

So communication with iROM goes in fact through the other port, am I right?

Adam, what you are trying to upload is way too big to handle by iROM - thats 241KB, iRAM has got 96KB only, and upload size is limited to something smaller (some place for bootinfo registers must be saved)

Try d0020008 and d0020010 locations also.

//edit:

Spent some time to dive into asm code again.

Results?

iROM is fully compatibile with DNW v1.01 (the one I've got) protocol, both USB and UART. The thing is that sending code through USB you can choose its destination address, and that protocol is also used in uboot, not iROM only.

By sending code through UART it is always placed in 0xD0020000, max amount of code is 87040 bytes (exactly 85KB), the rest of iRAM is reserved for some addresses used during iROM execution.

So doesn't matter what address you choose if you use Serial connection - code is always being loaded under 0xD0020000.

And now thats the thing: First 16 bytes (4xASM WORD (long int)) are e-fuse info. If somehow you've got EVT1_SEC version of S5PC110 - iROM won't jump into code if these words doesn't fit 128bits of SECKEY and will print "Secure Fail Error". It's based on RSA checksum, for now I don't see how it can be broken.

Sorry for leading you into mistake with Secure Fail Error, now I'm almost sure it can show up only on versions with not-null SECKEY register.
[Hardware Hacking General] AdamOutler:
Well, I busted off my JTAG UART points, including the Vias at the ends of the pads...

So...... I went and found more...

Then I made them accessible from the outside of the phone
[Hardware Hacking General] TheBeano:
The JTAG UART TXD and RXD are also connected to the FSA9840 USB switch, it's shown on the circuit diagram (Service manual "Troubleshooting" page 8-10, "U301" diagram). To get them switched to the USB port at boot time you have to have the 619k resistor connected to the ID pin of the USB port.
[Hardware Hacking General] AdamOutler:
The switching occurs after the IROM has loaded. You can't get the

Insert an OTG cable into the connector!

without going directly to the points
[Hardware Hacking General] AdamOutler:
I'm working on this protocol... here's what I got....

void setup() {
// initialize both serial ports:
Serial.begin(115200);
Serial1.begin(115200);
}

void loop() {
// read from port 1, send to port 0:
if (Serial1.available()) {
int inByte = Serial1.read();
Serial.print(" R0x");
Serial.print(inByte,HEX);
Serial.print (" ");
Serial.print (inByte, BYTE);
//if special char, react.
if (inByte == 0xAA){
Serial1.print (0xAA, BYTE);
Serial.print("S0xAA ");
} else if (inByte== 0xCC) {
Serial1.print(0xCC,BYTE);
Serial.print("S0xCC");
}
}
// read from port 0, send to port 1:
if (Serial.available()) {
int inByte = Serial.read();
Serial1.print(inByte, BYTE);
}
}

The R's mean I Received a Byte the byte is displayed after. The S's mean I sent a Byte.

R0xAA ªS0xAA R0xAA ªS0xAA R0xCC ÌS0xCC R0xCC ÌS0xCC R0xCC ÌS0xCC R0xCC ÌS0xCC R0xCC ÌS0xCC R0xCC ÌS0xCC R0xD
R0xA
R0x55 U R0x61 a R0x72 r R0x74 t R0x20 R0x44 D R0x61 a R0x74 t R0x61 a R0x20 R0x4C L R0x65 e R0x6E n R0x67 g R0x74 t R0x68 h R0x20 R0x4F O R0x76 v R0x65 e R0x72 r R0xD
R0xA
R0xD
R0xA
R0x49 I R0x6E n R0x73 s R0x65 e R0x72 r R0x74 t R0x20 R0x61 a R0x6E n R0x20 R0x4F O R0x54 T R0x47 G R0x20 R0x63 c R0x61 a R0x62 b R0x6C l R0x65 e R0x20 R0x69 i R0x6E n R0x74 t R0x6F o R0x20 R0x74 t R0x68 h R0x65 e R0x20 R0x63 c R0x6F o R0x6E n R0x6E n R0x65 e R0x63 c R0x74 t R0x6F o R0x72 r R0x21 ! R0xD
R0xA
R0x0

So it looks like I'm getting the characters, but the CC is not being received, or is the wrong character... Any chance you can review the UART procedure?

It's saying UART DATA LENGTH OVER... obviously it has not received a char other then 0xAA and a few 0xCC
[Hardware Hacking General] TheBeano:
I think there's a timing problem with the response to the handshake, because it's retrying both the AA and CC when it should be only doing it once. Try sending the response byte immediately without the Serial.prints for monitoring, just set a flag in your program to record that you have done the handshake and print it out later.
[Hardware Hacking General] midas5:
You have the protocol slightly wrong.

RX 0xAA

TX 0xAA

(If you get another 0xAA, send another 0xAA)

RX 0xCC

TX 0xCC (only once)

Follow this with 4 bytes for the length of the code you are going to load.

Follow that with the code to load.

If the code you load is correct, and the checksum works, you should get 0xBB back at the end.

The length in the 4 bytes must be less than 0x15400 (IRAM is not that large)

I would use a length of 0xffff and pad your code out to that.

If you keep getting "length over" you are sending the bytes in the wrong order (big/little endian)

I.e. send 0xff, 0xff, 0x00, 0x00

If you get a length error, send:

0x00, 0x00, 0xff, 0xff

When you send the length bytes you should not be sent the 0xCC.

If you send the first length byte, and get a 0xCC in return, go back to sending a 0xCC once and try sending the length bytes again.

Important point, do not put any delay between sending the 0xCC and the first length byte.

The code has timeouts in it, so if you wait too long, it will return to sending 0xCC again.
[Hardware Hacking General] AdamOutler:
WE HAVE HELLO WORLD

Rebellos! You are the man!

Ok, steps to reproduce:

1. Perform UnBrickable mod from the first post in this thread. http://xdaforums.com/showthread.php?t=1206216

2. With the phone off, Insert battery into phone. Press power on button for 1 second. Observe message on internal UART:

Insert an OTG cable into the connector!
������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

3. Insert the OTG Cable (standard USB cable plugged into USB port on phone-- OTG port) and obvserve message on internal UART port:

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

4. on a Linux system run the "dltool" and use this firmware http://xdaforums.com/attachment.php?attachmentid=698077&d=1314105521 from Rebellos

adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ./s5pc110_test/s5pc110_testcode.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 050
=> loaded 16384 bytes from ./s5pc110_test/s5pc110_testcode.bin
=> Downloading 16394 bytes to 0xd0020000
=> Data checksum af84
=> usb_bulk_write() returned 16394
adam@Adam-Desktop:~/Desktop/dltool$

5. Observe Internal UART message:

Hey you!
Out there on the road,
Always doing what you are told,
Can you help me?

which repeats every 20 seconds.

GREAT WORK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[Hardware Hacking General] Nitro_123:
I just LOVE this Mod and Love your work Midas5, Adam, Thebeano , rebellos etc!!!!

Best of luck ahead and sorry for disturbing all of you :):) :D
[Hardware Hacking General] AdamOutler:
Were finally saving bricks.

The unbrickable captivate is a one-click operation. http://xdaforums.com/showthread.php?t=1242466

We have plans for the Droid charge. http://xdaforums.com/showthread.php?t=1245391

I need a i9000 sacrificial board to begin one-click resurrection for all future i9000s.
[Hardware Hacking General] azzledazzle:
WOW I cant believe its finally happened. Your a genius.

My GF's contract is up for renewal end of the month (sept) If no one has kindly given you a phone il give you hers.

Works fine, Just got a fake IMEI (enough said !)

Great news, Great work !! finally a truly unbrickable device.

Although i dont feel competent to do the unbrickable mod myself lol
[Hardware Hacking General] jbutcher91:
you dont need antthing like that just buy a
[Hardware Hacking General] jbutcher91:
you dont need antthinf like that just buy a 'jig' off ebay for $5, and its unbrickable
[Hardware Hacking General] AdamOutler:
I would appreciate if you would do some research before posting in a 50+ page research thread.... there is a reason for JTAG and there is a reason I've made it obsolete on out platform.
[Hardware Hacking General] Rebellos:
Send me it's EFS and original IMEI number to the PM/mail dmarszk@gmail.com. I don't promise anything but would like to play with that, never done that before. :P

Are BT and Wifi MAC broken also? If yes, send me these too.

Still, don't expect anything great, I even don't have device to test it. :o
[Hardware Hacking General] Northern.dj:
I have been following this thread and its a good idea and if you guys crack this so its just a special usb lead Made by you guys and the software then you will make a mint out of it , But having to alter the hardware is a pain

I had the pleasure of watching how a Samsung Engineer does it and they have a Black box linked via Usb to a Pc and they follow a simple menu that does the work, First option was can the phone go into recovery mode/Download mode if you press No there is a timer on the screen and that then goes up to 20 mins, Now if you can go into download mode it puts the phone in to download mode and runs odin.

If no Download mode you have to leave the phone plugged in for the full 20mins after that it goes into Download mode

They have been using this to fix the three button recovery for people, I asked him have you ever had a bricked phone he said a bricked phone is a hardware only problem software/firmware no this box fixes it. This box works on all Samsung products this is what we need to get hold of and copy

Keep the good work going
[Hardware Hacking General] Rebellos:
Still, there exist bricks for which USB port can't be used alone without hardware interference. Or we just haven't found the way to do it...
[Hardware Hacking General] AdamOutler:
You are speaking of the AnyWay jig. It does not load firmware on a damaged piece of hardware... sorry. There is no chance of this because USB is initialized by the PBL. Signals go to the processor and start modes... there is no physical way your black box could work through USB. Only TTA20 which is not on our devices. Its not USB but it looks similar.

_
[Hardware Hacking General] AdamOutler:
BTW... my setup is much better then an anyway jig
[Hardware Hacking General] xpcomputers:
The 20 min aspect of the Samsung method is interesting. Sounds like it isn't as comprehensive a solution as this ingenious method created by the guys in this thread... But equally, for some problems, the Samsung method will work without needing the phone hardware opening for modding. I wonder if the 20 min wait can be found in the loader instruction set and replicated?

Anyway... Top Marks to you guys on this thread. You've worked long and hard on this project and deserve some kudos!!!

Mike

Garbled meaning induced by swype on my SGS! ;)
[Hardware Hacking General] midas5:
There might be something to this.

Unfortunately we don't know the state of the phone before the visit to the engineer. If the pbl is corrupt, our IROM fix would fix that. If the SBL is corrupt, the device would appear to be a brick.

If a wrong phone firmware was installed, we would see a brick.

The 20 mins might be some watchdog recovery mode. I have not traced the watchdog code path through the IROM.

Adam, are you able to test this?

Brick your development phone. Plug in a usb cable and wait 20mins and see if you get anything on the jtag uart. Also try with the download 301k jig.
[Hardware Hacking General] azzledazzle:
Dont want to go into detail of why its IMEI is not original, As forum rules do not condone anything illegal.

BT and MAC address work fine, The phone is being used AS a phone daily.

It is no different than any other SGS except that the IMEI is untraceable.

Thats all i want to say, If this post has broken rules / caused some discrepancies. Then MODS Please delete.
[Hardware Hacking General] midas5:
It would be good to be able to recover the efs if it gets corrupted.

At the moment, if the phones efs is deleted, it gets recreated, but an engineering IMEI gets used. If we could get the original IMEI set it would be useful.
[Hardware Hacking General] AdamOutler:
MobileTechVideos (as far as I know) is the sole provider of GalaxyS EFS partition restoration. You can't remove the IMEI from the hardware, but you can delete the EFS partition. This is why the red shows up in my video after resurrection here at 1:50

[youtube]fw-D_cKeAb8&feature=player_detailpage#t=110s[/youtube]

After running BADA OS my EFS was cleared because partitions were assimilated to bada. Oh well... It's my dev phone and I don't really care
[Hardware Hacking General] dontbanmebro:
watchdog

atchdog could come in handy if we figure out a way to modify memory, it could be used like a pause button. Also, watchdog could explain why sometimes my phone runs slow when I'm around power supplies at work...

off topic... the year register is only 12bits wide, and , it can only handle 999 years and a 2 is in the first position. Be prepared for Y2K all over again in 999 years... Y3K.

Ok... so, reflecting on the boot sequence.... The IROM/Processor calls and verifies the PBL, The PBL calls and verifies the SBL.... If the PBL fails verification, it fails over to other methods of booting, like UART. We need to figure out what failover the PBL contains.

One of the bricks I analyzed... Let's call it an "odin brick".. It had a mismatched PBL/SBL. It could be possible that it was looking for a MMC boot or something. Please take a look at the PBL and see what failover it has...

as for external I2C, we're looking for two lines which are in a high condition. I was not able to establish communications on the line which we assumed to be UART TX on the JTAG port. It may be worth it to look at that port again with i2c... I will make a note of that to come back again later. We still have yet to locate the EXT-I2C hard-lines to the i2c bus which is referenced by a NAK in the SBL boot sequence randomly... These hardlines would be able to control the processor and make it do just about anything.

All we know right now about I2c is that it has an EXT-I2C connection somewhere, the AP can function as a I2C master or slave, it communicates via 8bit comms, and an unlimited amount of data can be sent to the processor over i2c.

the SPI bus would allow unlimited access to the processor, and just as with I2C, it does not require any software to be running. This bus runs at 8-bit/16-bit/32-bit. I'm not good with SPI, but if we can find the wires, this would be very powerful. SPI or i2c would both potentially be able to load software and then restart.

The modem interface has abstracted access to the same bus that the OneNand is located.... possible check.

Good call on the MMC card Robellos.. The MMC card supports "512 bytes FIFO for data Tx/ Rx"

There's several GP registers which are dedicated to "Keypad" interface... So.. Now being that the numbers are so different between all of the buttons currently used, it may have an affect to short out one pin on a button to another pin on a different button. This would cause a different key to be pressed... Just something to look at.. It would be nice to find all of the pins.

So yeah... There's still lots to try.
[Hardware Hacking General] AdamOutler:
I thought we were done with the S5PC110.

Have you heard of UnBrickable Mod? When the processor fails over, not just hangs, you can use UBM. Otherwise you need to bring xOM5 high.

You can continue research, but I think we've exhausted all other non-soldering options. Its just a matter of performing the mod and using the UnBrickable Resurrector.

See here for the latest resurrector. http://xdaforums.com/showpost.php?p=20152780&postcount=2
[Hardware Hacking General] slabchevy:
genius! Ive Got 3 bricked devices (captivate , atrix, iphone3GS) and about 12 bricked iPhone motherboards, ill donate if needed.!
[Hardware Hacking General] AdamOutler:
Atrix and 3GS are out of the scope of this thread, and the Captivate is done. Search UnBrickable Captivate.
[Hardware Hacking General] thesnowsnake:
which box to buy

Which box is the best and most supported with newer phones. Riff or what??

I have more than one brick, could build a wall maybe LOL
[Hardware Hacking General] AdamOutler:
Did you read the thread or are you just trying to get your post count up?
[Hardware Hacking General] thesnowsnake:
No to one. I am very new here so maybe I'll reask. I have a bricked lg p505r but would like to know more so I don't mind buying a Riff box or what ever, but need to know which is the very best supported. By this fourm and the company that is all. So maybe a suggestion into the hardware or a usb tool ..

There is my count higher now LOL. ps Is that really important? Or is about helping fools like me. Thanks.
[Hardware Hacking General] LP4E:
Hi guys! what about the development of unbrickable mod for galaxy s2? is there any methods to unbrick it? I already tried the jig but it doesn't work, i think the problem is the bootloader (broken) thank you in advance for your reply.
[Hardware Hacking General] AdamOutler:
You will receive no help in this thread about the RIFF box. The whole point of this thread was to avoid JTAG. Wrong thread, read it. Search your device forums or find a kinda, sorta, similar thread and post it there.

Wrong thread. You can find help here: http://xdaforums.com/showthread.php?t=1372365 and here: http://xdaforums.com/showthread.php?t=1313588

I'm beginning to think this thread should be locked. it's a development discussion thread for the Hummingbird processor and we keep getting noob questions which are off-topic.