yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] Rebellos:
Good to see you're all doing it well. :)

Just few notes:

a) alot_of_**** is in fact modified list_dir, it should contain all codes I used

b) To perform manual mounting moviNAND procedure you have to comment out __PfsMassInit because it does initialising of moviNAND and i haven't discovered how to do it second time.

c) mem_dump and loadfile are designed to jump into them straight after __PfsMassInit

d) Maybe anyone can dig out TFS4 pOp struct I/O functions reference, but probably it doesn't exist or exist only in TFS4 source code, which Samsung provides only to their partners who applied for using TFS4 in their projects.

e) Maybe it is possible to mount SD Card into FAT FS easier than into TFS4, bootloader seems to have full set of FAT procedures which are not being used.

f) You don't have to discover all addresses which I used. For example you can totally resign from spaces (btw, pointer to them is used in fota_check, together with exlamations), maxim_charging_control (calling it doesn't seem to work, but I copied this one from Bartek's code), boot_hw_power_down, DloadMain. But of course using them makes experimenting with FOTA more comfortable (especially entering download mode straight after code being executed)

//edit

g) Ah ye, the manual which helped me to understand PfsMassInit http://www.samsung.com/global/busin...ads/tfs4_v16_initialization_process_rev10.pdf

//edit2

"TFS4 Programmer’s Guide" could be interesting, if anybody finds it

//edit3:

f) Remember that most of functions if they have to return some pointer they return 0 if it failed, or if they just have to do something they return 0 if succeed and -1 if failed.

//edit4:

If you want to load unpacked BL into IDA: Select ARM710a CPU, ROM start address 0x42480000, the same is loading address, file offset 0x20000, select first line of code, press "C" on keyboard and watch the IDA magic. After that send thanks to mijoma.

Remember that you take full responsibility for what happens with your Wave, it is easy to burn hardware inside or format boot area by few ASM lines for example.
[Bada Software and Hacking General] nbates66:
well, i managed to dig out two possible addresses, but i'm beginning to suspect that the address marked as tfs4_close in our XXJL2 file is actually tfs4_readdir, needs investigation.

_EnterGate equ 0x424C338C
tfs4_util_set_errno equ 0x424CA8BC

i realise that both of them i kinda unused and useless to us, sorry about that, i've been trying to to find readdir via branches from other functions, and the function at 0x424C7864 which is currently labeled tfs4_close looks like it could be mislabled as i've found no other addresses that could match... yet, can anyone investigate this?
[Bada Software and Hacking General] srg.mstr:
can you try to search "tfs4_readdir" and "tfs4_write"? May be diff XXJL2 with *.elf from S8530JPKA1?

Edit. Latest list of address for XXJL2 from Raitis, need to confirm:

tfs4_init equ 0x424C2CE4

tfs4_mount equ 0x424C3A1C

tfs4_open equ 0x424C76F0

tfs4_close equ 0x424C7864

tfs4_read equ 0x424C7C20

tfs4_get_errno equ 0x424C9D40

tfs4_pdev_movi_rp_get_op	equ 0x4249EA78

tfs4_pdev_reg equ 0x424C35EC

tfs4_opendir equ 0x424C6804

tfs4_closedir	equ 0x424C6B00

tfs4_readdir	equ 0x424C3D74

tfs4_write	equ 0x424C83A4

tfs4_readdir_unlink	equ 0x424CA1EC

tfs4_util_set_errno equ 0x424CA8BC

_EnterGate equ 0x424C338C

guMoviRegErrCnt	equ 0x425C3C2C

x_pos@disp_FOTA_Printf_1	equ 0x425C3D38

string@disp_FOTA_Printf_0	equ 0x4275FD9C
[Bada Software and Hacking General] nbates66:
ok i'll take a look at that tommorrow (or later today 0.o) so far i've mainly been comparing with XXJEE.
[Bada Software and Hacking General] Rebellos:
If you have located _Entergate you can try to find it out the rest functions by reference order which shouldn't change in further compilations of bootloader in S8530 such order is (may differ from S8500):

Right click on function (EnterGate in our case) and "jump to xref to operand"

Btw, seems like I've made some mistake in my loadfile procedure, it doesn't work as I wanted. Please consider that.
[Bada Software and Hacking General] nbates66:
*tfs4_readdir	equ 0x424C3D74 <<same address as tfs4_pdev_reg

they can't both be right, thats the only conflict i've found there so far though, nice job

EDIT: @ Rebellos, reference order locations appear to be different between XXJEE and XXJL2 as well

EDIT2: i think both tfs4_pdev_reg AND tfs4_readdir at 424C3D74 are wrong. correct addres for tfs4_pdev_reg was posted earlier by Raitis:

tfs4_pdev_reg	equ 0x424C35EC
[Bada Software and Hacking General] mijoma:
OK, I haven't been around for few days and you all have made a lot of mess here :) Will have something to read on. Now, back to BL:

The loading address for SBL is 0x40244000. My modifications were just changing the GPIO pins the SBL was referring to. The SBL does not do much more than loading zImage from memory, setting params and executing the kernel. My personal opinion is that the baseband initialization code that we have in original BL is of bigger importance and we should leave it as it is just dropping several additional lines of code in FOTA to put the zImage in the right place.

Sorry for laziness, but I haven't found answers to some questions I had regarding some Android internals. Anybody has a comprehensive description of the android booting process with detailed information how params.lfs and .pit files are used (with their format)?
[Bada Software and Hacking General] nbates66:
params.lfs is a container file, containing images of various screens the bootloader can show (boot splash showing Galaxy i9000 logo, android kernel crash logo, download mode logo etc) i'm not sure if it contains anything other than that, from what little i've heard of .pit files they have something to do with setting the NAND partition layout... *MAYbe.

you can extract the images from params.lfs using revskills, use the menu option "open binary for ripping" then under the ripping menu select jpgs.

as for the functions i'm thinking of perhaps skipping finding functions for XXJL2 and building the file on XXJEE functions instead and building our fota on that, since we have .elf files for it. Still yet to find the "readdir" function inside XXJL2 loader.

EDIT: looking at a Android firmware flasher, the path box for the ".pit" file also has a checkbox for "repartition device" as well, if that helps :S

EDIT2: various links:

http://elinux.org/Android_Booting

http://bloggervarun.wordpress.com/2010/01/25/embedded-linux-boot-process/

http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images#Background
[Bada Software and Hacking General] mijoma:
Thanks, but I was rather thinking about more technical description of file formats. I do get the general concept.
[Bada Software and Hacking General] nbates66:
ok i've stopped looking for functions inside the XXJL2 bootloader for now, can build fota code following the XXJEE bootloader instead, since i've flashed it and it seems capable of booting my XXJL2 firmware anyway and it's much easier looking for XXJEE functions via the .elf files, saving time. For now i'll try to work toward loading the galaxy bootloader.
[Bada Software and Hacking General] Rebellos:
Sorry, I'm a spammer. :<

Thanks, is BL file offset equal 0? Fixing my loading functions right now. ^.-

Have been looking for such info too, it seems that they doesn't exist anywhere, only splitted through different forums and threads. :/

I'm wondering what BL does with IRQ table, memory buffers etc before jumping in the kernel. If it does anything it should be done in FOTA too.

//edit:

I thought before studying that Android and Bada kernels use some BL functions, but now it looks for me like they are both totally independent from BL. So do we even need I9000 BL if we want boot from SD Memory? (external or moviNAND)

//edit2:

Now fully working and tested load file procedure, feel free to remove debug prints, I've been wrong, tfs4_open doesn't return NULL or *FILE pointer, it does return INDEX of file in opened_file_table (can be 0) or -1 in case of error.
[Bada Software and Hacking General] mijoma:
Yup,

The whole SBL is loaded from offset 0 (in the mbn you have BL1, BL2, BL3; in SGS the PBL loads SBL). I don't think running SBL through FOTA will do any good without the partitions in OneNAND.

You can have a look at is SBL 40246D50 and some code around (setting params). About external interrupts, they need to be disabled before booting, just like in normal Nucleus launching. Additionally, we should initialize display and modem (load dbl and amss).

Best Regards,

mijoma
[Bada Software and Hacking General] mijoma:
No, we don't.
[Bada Software and Hacking General] Rebellos:
Well, of course even loading kernel image appeared to be not so easy as it looked a moment before. While I can load anything (BL in that case) under RAM 0x40244000, Wave hangs when I'm trying to load even a single byte under 0x32000000.

Is it write protected by default, requires different mem mapping in BL or contains critical data? :confused:

//edit:

According to S5PC110 manual

0x40244000 lies in DRAM 1 block (mapped as bank1 in kernel), and it seems to be fully writable by BL

and 0x32000000 is in DRAM 0 (mapped as bank0 in kernel), gotta read more about it, do we need additional initialization of RAM here.

Nucleus kernel seems to be loaded to block 1. Asking oleg in another thread if it is possible to launch kernel from there.

Umm, got any idea for what is LoadCompSegments used? This one looks important, it calls SysSecBootInit but... What the hell is Quram Flash? O.o One more memory type inside Wave?
[Bada Software and Hacking General] adfree:
With DRAM seems really complicated... to understand. :o

If this is really true. Then schematics shows for 1G same color like Qualcomm Processor... maybe 128 MB only for Call Processor... :confused:

In Bootloader ELFs soooo many Digits... write protection could be also for RC1 and apps_compressed.bin...

I don't know what where when is loaded... :o

Too many input in my little brain. :D

Best Regards

Edit 1:

Here part of schematics, where colors are for 128 MB, 256 MB and 512 MB...

http://xdaforums.com/showpost.php?p=10582027&postcount=9
[Bada Software and Hacking General] mijoma:
Have a look at DRV_Modem_BootingStart and see addresses that are used.

Kernel is PIC, but it still may reference some physical addresses for some specific reasons.
[Bada Software and Hacking General] Rebellos:
I can't find any instruction of writing somewhere 0x30000000 - 0x40000000, can you gimme any advice?

doesn't work in any way ; (

//edit:

Sorry, now i've noticed it, it's 0x25000000 used in modem driver.

Damn, and 0x25000000 seems to be easy writable >.<
[Bada Software and Hacking General] adfree:
Quram seems to have something to do with RC1 compressed file with header:

QMD

Best Regards
[Bada Software and Hacking General] nbates66:
so Rebellos, have you tried loading and executing the kernel/bootloader from a different address, just to see what happens?

(also, people, get onto the irc chatroom :P )
[Bada Software and Hacking General] Rebellos:
As mijoma stated before, executing galaxy BL won't do anything, so resigned from that.

Tried to execute kernel for S8500 by oleg from addr 0x40100000, like Nucleus. It of course hanged without showing nothing, because of wrong display driver and probably bad memory allocation. I don't know, maybe I hoped my phone will start to burn or something...

I gotta wait for S8530 kernel with sourcecodes now.
[Bada Software and Hacking General] sabianadmin:
My suggestion is to try to fix the bad memory address problem you think you are having and i will test it on my S5800, Can you no just fish out the logs from android after you have tested it?
[Bada Software and Hacking General] Rebellos:
Nbates is currently trying to compile kernel and boot it under s8500, im almost outta time in next 3 weeks.

Got no clue where does it, if it even does, store logs. Probably without correctly mounted fs and no jtag to catch debug packets we can only pray for screen output. Never seen kernel source before tbh and its size is... overwhelming me.
[Bada Software and Hacking General] nbates66:
yeah currently kernel doesn't get to execute, phone just hangs, we're hoping to build a kernel that will execute from a different memory location, just hitting a few snags at the moment in the compiler.. :P
[Bada Software and Hacking General] adfree:
Request from S8530 user.

Please I need Memory Map:

http://xdaforums.com/showpost.php?p=13248248&postcount=26

Example from S8500 is here:

http://xdaforums.com/showpost.php?p=13132505&postcount=48

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Rebellos:
I'm trying to do what you requested, but I got no clue how to apply higher debug level than Low into my samsung, I cannot access internal menu, accessed it once and now it seems to be locked. Btw when i loaded some of Rsrc2_S8530(Mid).rc2 but from different firmware package bada didn't want to boot.

Can you try to find some (Mid) file for XXJL2?

//edit: Damn, and how should I use WinComm? This is black magic for me. Trying to communicate with my phone but I'm afraid it won't happen.
[Bada Software and Hacking General] adfree:
You can set via Command also Debug Level... attached here:

http://xdaforums.com/showthread.php?p=13248248#post13248248

For config WinComm read Samsung GT-S8500L Wave Training Manual SW.ppt:

http://xdaforums.com/showpost.php?p=12975001&postcount=8

Thanx.

I hope this work with S8530... not tested. :o

Best Regards
[Bada Software and Hacking General] Rebellos:
Really, I've got Training Manual and don't see anything about WinComm, downloading it again tho.

So, if I understand it right I should send FmPrtShpMemoryMap on port COM5 in my case and receive memorymap on COM6 by WinComm? I get nothing so far.

Btw. I love those russian ads on download sites, they are like "COME AND CHECK OUR ADULT CONTENT, WANT SOME PORN?!?!?!?! CLICK HERE! WANT SOME MASSACRE MOVIES WITH LEG AMPUTATION?! ITS RIGHT HERE!"
[Bada Software and Hacking General] adfree:
Yes, exact.

Samsung GT-S8500L Wave Training Manual SW.ppt

site 15 and 16

site 16 is WinComm Screenshot.

If you send SetDebugLevel High or SetDebugLevel Mid you should have access to Internal menu:

*#7092463*#

You can remove then later Debug by SetDebugLevel Low.

Best Regards
[Bada Software and Hacking General] Rebellos:
My first was incomplete or smth, anyway it doesn't seem to work well in S8530. No access to internal menu after sending SetDebugLevel High.
[Bada Software and Hacking General] adfree:
Could be, because not tested with S8530...

But I know that activated RC2 is confirmed for S8530.

http://www.badanation.de/topic.php?t=3717

RC2 from this Thread is attached.

Best Regards
[Bada Software and Hacking General] adfree:
About WinComm + S8530 no confirmation yet... maybe disabled.

I saw WinComm Settings also in other menu... *#1973...

Sorry, can't check self on S8530. :o

Btw.: First answer from FmPrtShpMemoryMap is:

_SHP_FOTA is enabled

Best Regards
[Bada Software and Hacking General] mijoma:
There clearly is some misunderstanding what JTAG is for.

As for debug, you may want to try UART (available on microusb) as a way of getting the bootlog.
[Bada Software and Hacking General] Rebellos:
I thought that those uart packets are being send by some another external interface. Thanks, that is helping me alot. :)

//edit: umm, but do you know how to catch them? :s Cant find any useful info about uart communication through usb. :/
[Bada Software and Hacking General] mijoma:
It's not USB, just pins on micro USB connector. Look at some threads on SGS forum - there's quite detailed description there.
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=13269642&postcount=750

Maybe someone else can collect these infos and "convert" for S8500/S8530 user... like me. As I've asked long time ago for such cable in my Thread.

oleg_k was the only who answered about such cable for Logging.

But I need further infos... Pics, How to for made such cable at home. :o

Thanx in advance.

Best Regards
[Bada Software and Hacking General] alex_manow:
Hello adfree

Here is the schematic of microUART(don't look to usb cable), You can use some cables from old nokia's like 6610,3510 or SE like K700i etc.

You need to use right resistor (oleg told which one, 523K am I right?)

So U need connect GND - 5 TX - 3 RX - 2 and resistor to PINs 4-5

schematic pic from sgh.ru
[Bada Software and Hacking General] adfree:
Thanx alex_manow

So first I will try to find some cable/connector to play with.

At home only 1 cable. :o

So I need shopping first.

Best Regards
[Bada Software and Hacking General] alex_manow:
Try to find cable with chip PL2303(made by prolific) or FT232X(made by FTDI) = fast and don't worry about drivers... other like OTi can be lower(115k max) and have problems with drivers in newer OS than XP...

You can also made cable yourself, datasheets are available on many sites. But will be cheaper to buy... i think ~1 Euro for cable DKU-5 for nokia.
[Bada Software and Hacking General] nbates66:
don't suppose you've seen this already?

https://github.com/cmsgs/utilities/tree/master/pit-stuff
[Bada Software and Hacking General] Rebellos:
Attaching the really ALPHA code which SHOULD boot kernel from FOTA in I9000 Sbl way, of course I couldn't really test if it is working, probably not. But maybe someone will be interested in my noobie ATAG reconstruction.

Of course I take absolutely no responsibilities if it blow up your phone.
[Bada Software and Hacking General] sabianadmin:
Looking through the assembly their dosnt seem to be any glaring errors, obviously i can't test it for lack of a jtag box. Would mijoma take a look at this?
[Bada Software and Hacking General] nbates66:
at the moment i'm thinking that perhaps the reason nothing (apparently) happens when we attempt this is simply because the kernel is configured to mount it's filesystem from NAND, which won't work.

also sabian, we've been running that fota file(and a few variants) in attempts to boot the kernel for a while now(without Jtags), it hasn't damaged any phones yet, but we really need some method of collecting debug info (usb connector with resisters as was posted earlier).

so right now, the file appears to run fine right until execution of the kernel, at which point it appears to hang(though the phone does warm up somewhat at this point).
[Bada Software and Hacking General] Rebellos:
Take a look into oleg's logs, I assume from that the screen init happens before any fs mounting try. Of course I can be wrong, asked oleg about this but I start to doubt if he wants to write anymore in that spam thread. :p
[Bada Software and Hacking General] duxxyuk:
usb triggers different boot modes

Apperently with the Samsung Galaxy phones the 560K resistor shows the log when the first bootloader finishes (after which the phone chooses the boot medium I'm assuming). It might be interesting to look through their posts as they have found that using different resistors asks the usb controller to put the phone into various modes :

http://xdaforums.com/showpost.php?p=9259956

and more precisely they point out the use of a 619k resistor to start debug output right from boot..

http://xdaforums.com/showpost.php?p=9259956&postcount=26

I hope this helps :-)
[Bada Software and Hacking General] srg.mstr:
S8500 bootloader log

I have connected two resistors in parallel 1M (~503K) between 4 and 5 pin.

And listened COM-port on 115200 bit/s.

View attachment S8500_bootloader_log.txt

http://www.youtube.com/watch?v=enfXpt7Ijtg
[Hero CDMA Q&A, Help & Troubleshooting] whodatxevg:
This rom works great, except after about a day the popup menus don't work ie power off menu, cpu speed menu, I have go SMS and the popup for that doesn't show, the screen dims and if I guess where the buttons are I can use it. What am I doing wrong?
[Hero CDMA Q&A, Help & Troubleshooting] Drunkpilot:
Are you running any kind of tweaks like Firerat's? Which rom build ...3/26? Need some more specifics to be helpful.
[Hero CDMA Q&A, Help & Troubleshooting] whodatxevg:
No tweaks, running the rom as it is flashed, no kernels no SD ext just the newest clockwork recovery.

It does this on every version of this rom, including the current version.
[Hero CDMA Q&A, Help & Troubleshooting] NineInchNails:
Have you been flashing over or doing a fresh install each build? If its been happening each build it sounds like you've been flashing over. Try doing wipe data 3 times in a row then flash the rom.

"Dwight! You ignorant slut!"

800% HTC SuperHero Gingerbread 2.3.3
[Hero CDMA Q&A, Help & Troubleshooting] whodatxevg:
I wipe data, ill try the triple wipe hopefully that helps.
[Hero CDMA Q&A, Help & Troubleshooting] il Duce:
this was an issue a few builds ago. I would say try a flashover from a previous build (no data wipe) and see. Also there was a "fix" that worked for some, which was to edit the system build.prop line where it says debug.sf.hw=1 to say =0 and it worked for some, try that too, YMMV.
[Hero CDMA Q&A, Help & Troubleshooting] waffle_:
Duce is correct. You shouldn't have to edit the build.prop, all you should do is flash over to the newest build.
[Hero CDMA Q&A, Help & Troubleshooting] whodatxevg:
I flashed this rom this morning, if I'm going to have problems ill know by tomorrow.
[Hero CDMA Q&A, Help & Troubleshooting] NineInchNails:
Good point duce

"Dwight! You ignorant slut!"

800% HTC SuperHero Gingerbread 2.3.3
[Hero CDMA Q&A, Help & Troubleshooting] whodatxevg:
Just had first occurrence of this problem today,the triple wipe seemed to help for about 3 days, I came from AOSP froyo. Did triple data wipe (one before install, one after first boot then one after gapps install.)
[Hero CDMA Q&A, Help & Troubleshooting] imkohl:
I'm almost positive its a cache issue. I just reboot my phone and it temporarily fixes it.

I most often notice it when changing themes in "Theme Chooser".
[Hero CDMA Q&A, Help & Troubleshooting] jasonmaloney:
It's a known video memory issue in Gingerbread itself. Every phone with CM7 (as well as the stock Nexus S) is having the same issue.
[Nook Color General] Mumnoch:
Been a lurker since I bought a Nook and the Froyo is by far my favorite so far however I do have 1 question concerning it. Has anyone been able to get a 16gig class 10 mSD card to work? I've tried to burn it several times and while it will boot up it FC's pretty much any program I open. Dolphin, Nook reader app, Settings, NookColor Utils, Market, etc. Are these Rooted image's not designed to be able to run on mSD cards that are class 10's? Thank you very much for any light you can shed on this and hello everyone!
[Nook Color General] Mumnoch:
Just a update, even leaving this latest build (3/31) @ the default settings (didn't resize the last partition) it works for a short bit, but then everything starts FC'ing again. Think it's the class 10 part of this that is messing up?
[Nook Color General] Mumnoch:
Anyone care to share what they did to get their class 10 card to work? (if it did)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Bangdoo:
Hi,

I have detected the reason why the battery at JVK is always so quickly. The Android OS syndrome.

It is the CPU running at 1000Mhz permanently. Even if the phone is in standby. Otherwise, switch the MHz number in stand down even more. What can you do?
[Galaxy S I9000 Q&A, Help & Troubleshooting] galaxysdev:
Cpu doesnt always be on 1ghz.You can see in what frequency the phone is using setcpu.
[Galaxy S I9000 Q&A, Help & Troubleshooting] x72GYx:
The CPU is not running at 1000MHz constantly. And if you are afraid that it is, do the following:

1. Download SetCPU from the Market.

2. Enable profiles, and set following profiles:

- Charging: min 1000, max 1000;

- Screen Off: min 100, max 200;

- Normal: min 100, max 1000.

This will also increase your battery life!