yashsingh1/xdaforums huggingface dataset:
[Hardware Hacking General] zianna123:
call it a hunch, but i still believe the CP is the key to all this.

i understand that you say the CP only fires up late in the boot process, but i have been reverse engineering the modem.bin and there is code in there for flashing that just doesn't make sense. the memory locations seem to point to the IBL+PBL and parts (secondary location) of the SBL.

it's still to early to back this up with anything concrete. but i will post what i have as i uncover it.

it's kind of hard to do full tests with openocd and the uart etc. as my phone is working. so a lot of the registers are set up very quickly on power up. by the IBL

what i have resorted to now is using qemu and gdb. so setting break points and forcing different forks is a little easier. but it isn't definitive enough for hardware confirmation.

on a separate note i notice my sbl is different to the rest of yours. while still being version 3.0 and unsecured (not fused) the sequence of the messages it outputs is very different to your logs???
[Hardware Hacking General] midas5:
Ok. So the sim interface is not used during irom boot. What volts peak to peak are the signals? Does the above change depending on the boot_on or boot_off resistor ?
[Hardware Hacking General] midas5:
How did you do that?
[Hardware Hacking General] zianna123:
the point is not how it gets done.. it is easy to do, and replicate. ((http://jhulst.com/publicsvn/captivate/kernel/linux-2.6.29/kernel/kernel_sec_debug.c)) < the code >

but to aid this project(and keep to the original objective), getting this to run on a completely bricked phone. as this mode is called by and handled by SBL, it is of no significance as yet.

the cool thing so far tho is you will notice that OM stayed 0x9. meaning that if i can now manage to load SBL from my laptop to the phones RAM then run it from ram we will be in business. and also you will notice that i set the flag for the cp to reboot into mode 3 (so its only a matter of getting that flag set on a bricked phone)

the key is not to drive it at 916200... its just to fast (or maybe my uart is flaky)

but i could only do this trickery at 115200

minor issue.... loke is not running at this low level, so even though i am in upload mode.. ODIn or heimdall wont work to restore the brick.

it's in too low of a init.

Heimdall v1.2.0, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna

http://www.glassechidna.com.au

This software is provided free of charge. Copying and redistribution is

encouraged.

If you appreciate this software and you would like to support future

development please consider donating:

http://www.glassechidna.com.au/donate/

Manufacturer: "SAMSUNG"

Product: "Gadget Serial"

Serial No: "?"

length: 18

device class: 2

S/N: 0

VID:PID: 04E8:6601

bcdDevice: 021B

iMan:iProd:iSer: 1:2:0

nb confs: 1

interface[0].altsetting[0]: num endpoints = 1

Class.SubClass.Protocol: 02.02.01

endpoint[0].address: 83

max packet size: 0010

polling interval: 09

interface[1].altsetting[0]: num endpoints = 2

Class.SubClass.Protocol: 0A.00.00

endpoint[0].address: 81

max packet size: 0200

polling interval: 00

endpoint[1].address: 02

max packet size: 0200

polling interval: 00

Claiming interface... Success

Setting up interface... Success

Beginning session...

Handshaking with Loke... Failed!

ERROR: Failed to receive response
[Hardware Hacking General] midas5:
I might have found something useful.

*#7284# Used for switching between PDA and MODEM mode.

Normal USB debugging mode, PDA:

Bus 002 Device 002: ID 04e8:681c Samsung Electronics Co., Ltd Galaxy Portal/Spica Android Phone

Normal USB, not-debugging mode, PDA:

Bus 001 Device 004: ID 04e8:6877 Samsung Electronics Co., Ltd

Normal USB, not-debugging mode, MODEM:

Bus 001 Device 005: ID 1519:0020

Normal USB debugging mode, MODEM:

Bus 001 Device 006: ID 1519:0020 (Has 7 /dev/ttyACM0-6 com ports. )

Download mode:

Bus 001 Device 019: ID 04e8:6601 Samsung Electronics Co., Ltd Z100 Mobile Phone

Phone powered off, in "Charging mode". I.e. Standard "Charging" cable that comes with the device.

Bus 001 Device 008: ID 04e8:681d Samsung Electronics Co., Ltd Galaxy Portal/Spica Android Phone

I.e. Phone powered off, plug in charging cable.

I think we need to do some investigations to work out where this ID 04e8:681d comes from. If it comes from the IROM, we could be in luck here.

If we talk to this 04e8:681d device quickly enough, we might have our brick recovery mode.
[Hardware Hacking General] zianna123:
ID 04e8:681d will load the 2 generic volumes, but as they are not mounted by the phone, u cant access them...

theres not much more to it.
[Hardware Hacking General] midas5:
Do we know at what point during the boot 04e8:681d appears?

How far in the boot process does it need to get to display the "Charging" animation. Is it at SBL stage, or zimage stage or before that.

Is is at IROM stage?

I mean, what is the point of displaying 2 generic volumes if you cannot do anything with them?
[Hardware Hacking General] zianna123:
the charging indicators are in the lfs, at that point the sbl is already up and mounted various partitions

it gets called by init_fuel_gauge. if you check your logs its way down in the list.

remember, there is very little code in the IBL ( there is only enough space to set up the board timings ,ram and some basic pointers and registers)

there is no way there is a working usb stack etc there.. u need the IBL+PBL to call a secondary loader to do the work

on a bricked phone with a non working IBL, it is up to you to set these registers manualy, so as to get access to more hardware.
[Hardware Hacking General] zianna123:
On a good point tho

i can brick my phone.. killing sbl

and bring it back to download mode, and recover quiet nicely using just the comm port. so there is hope. the big issue is when the PBL is corrupt!!

reading nps status file is successfully!.
nps status=0x52415453
PMIC_IRQ1 = 0x7c
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
aries_process_platform: Debug Level High
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
main: booting stop.
loke_exit: bye~ bye!
reading nps status file is successfully!.
nps status=0x52415453
PMIC_IRQ1 = 0x3c
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0xc0
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
aries_process_platform: Debug Level High
keypad_scan: key value ----------------->= 0x60
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
main: booting stop.
loke_exit: bye~ bye!
reading nps status file is successfully!.
nps status=0x52415453
PMIC_IRQ1 = 0x3c
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0xc0
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
get_debug_level current debug level is 0x47494844.
aries_process_platform: Debug Level High
keypad_scan: key value ----------------->= 0x50
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
keypad_scan: handler name = usb download

==> Welcome to ARIES!
==> Entering usb download mode..
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
[Hardware Hacking General] midas5:
zianna123,

All that output is output from the SBL code.

So, at which point in that did the SBL get corrupted?
[Hardware Hacking General] zianna123:
ahh wait point taken.. sbl wasnt neccesarily dead..

i had the phone <--!--> pc screen, but that is infact still sbl..

/me needs to check his facts before quickly posting.

which probably explains why the comm port still worked.

the more i look at this. i dont thnk there will be a true serial way of doing it on a total brick. there just wont be a way to fire up the hardware without jtag.

or atleast i need a true brick to play with. as this is my everyday phone. i am not willing to do more coding / hacking with it.

other than a few peeks and pokes..
[Hardware Hacking General] AdamOutler:
We might be able to start the CP by using a combination of the reset button, and signals: 3v3, ground, Power, programming, data and clock at the SIM card. It's definately worth it to check out... Power, ground, reset should be able to start a processor... data and clock can do communications...

I've soldered some small 1/2" pieces of bare, solid core wire to the edges of my SIM pins on the phone. I might be able to come up with something. I just don't understand how to use the Bus Pirate just yet... I've been trying to learn, but the documentation is sparse on 2wire communications.

btw.. this is 2wire comms. The purpose of the CLK line is USUALLY to "clock in" and out the DATA line for synchronous communications. each CLK pulse on the 2wire bus tells the bus to pay attention to the data line at this time. at the point the CLK goes high or low, is the point when the bit on the DATA line is to be "clocked in" to the card or processor. now, I'm not saying for sure that the clock is required, however, UART is Universal Asynchronous Receive/Transmit and requires no clock, when using a CLK line, the communications is synchronous.
[Hardware Hacking General] zianna123:
um i havnt had a chance to properly look at the schematics, but that 3.3 to the sim card should be a supply out put. i would think that they would run some sort of diod (or at least have protection on the power ic) , putting a supply on that would be a tad risky untill fully checked where that line goes dont you think?

the bus pirate is a neat little toy .. i used it to reflash the spi on my tablet. and also for jtag.. but havnt had much use for the i2c stuff.
[Hardware Hacking General] AdamOutler:
Meh... a tad bit risky is my middle name.... Adam aTadBitRisky Outler.... The 3v3 pin spends most of its time powered down. If we hope to establish communications, that pin would likely need to be powered up. I plan on playing with that this weekend, along with getting JTAG working. Got any better ideas?

Btw, can you post up your bus pirate jtag config? I could use it.
[Hardware Hacking General] antsm:
Mine brick when it connected to USB detects as:

And the same substring can be found in irom dump at offset (0xC83C) in unicode:

S E C S 5 P C 1 1 0 T e s t B / D

So, i'm not sure that irom can't work with USB stack :)
[Hardware Hacking General] zianna123:
i pretty much followed this to use jtag on my flytouch tablet.

http://dangerousprototypes.com/2010/03/04/bus-pirate-openocd-jtag-how-to/
[Hardware Hacking General] AdamOutler:
At this point you should be attempting to establish UART communications. It is likely that you will see the HEX code 0xAA which would enable UART upload as per S5PC110 development board instructions. Please use UART.
[Hardware Hacking General] zianna123:
@ antSm

me thinks i have been confusing my terms.. i have only looked at the IBL (initial boot loader, and primary boot loader and modem) i see that you guys are lower down on the irom. now there would definatly be code there as it is atleast a few megs not just 280k like in the IBL.

thats a damn good sign that yer board gets detected as such. i would love to get my grubby hands on a phone that is in that state.. but the sgs is very new here in s.a not many people bricking them.

even though i have a riffbox, i am not keen to go the jtag route. on these babies. maybe i should grab a download of the evaluation board. that would give me a lil more insight on what they doing with it, but that would take you back to modifying OM again i gues. which i think you guys discoverd was pulled either high or low in hardware.

hmm, so dumping my irom, and doing a simple strings on it , reveals that the uart is taken care of .. actualy pretty much alot is done in there.. on the mids i have been playing on the SOC was dumb.. and everything got done in the 2nd bootloader.

i can see im getting no sleep tonight!!! ... this is gonna be a fun ride

now if only i could take my work lab home.. did i mention i work at a nuclear reactor plant... oh so many toys!
[Hardware Hacking General] AdamOutler:
Would you like some annotated code? I have put together what I call "The GalaxyS hack pack" here: http://xdaforums.com/showthread.php?t=1111866. This package contains everything which can be downloaded. I'm adding more to it. I've got pictures and part numbers for JTAG stuff. the JTAG connector on the Captivate, Fascinate and Vibrant are missing... the i9000 has a .2mm pitch, 1mm row ZIF DIP (zero insertion force dual inline pins)connection for which I've identified part numbers to order near the end of this thread: http://xdaforums.com/showthread.php?t=1000175

Please keep us updated, you're the first to get the IROM/PBL operational in a virtual machine.
[Hardware Hacking General] midas5:
I can assure you that you do not have to worry about the clock signal. Comms with a sim card is asynchronous UART at 9600 Baud with both tx and rx sharing the same wire. It might be useful sniffing the i/o line while the phone communicates with the sim, because the actual rate might be 9700 Baud. i.e. A non standard rate.
[Hardware Hacking General] midas5:
I have looked at the irom code. This means the ibl / pbl is corrupted. The phone then tries to boot from external sd card, and if that fails, it tries usb.

If you have a linux box, please try to post the output of

lsusb -v
[Hardware Hacking General] midas5:
You are lucky. You should be able to recover from that. In fact, this entire thread is about trying to force the phone into this state.
[Hardware Hacking General] antsm:
I assume to establish UART connection we need to assign this SEC S5PC110 Test B/D device to virtual COM port, but how to do this without any drivers for such VID_PID?

Yeah, here it is:

Bus 005 Device 006: ID 04e8:1234 Samsung Electronics Co., Ltd
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x04e8 Samsung Electronics Co., Ltd
idProduct 0x1234
bcdDevice 1.00
iManufacturer 1 System MCU
iProduct 2 SEC S5PC110 Test B/D
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 50mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered

Oh, nice to hear :)

As for external sd booting: i found a topic about HeroTab C8 tablet, which based on s5pv210 (quite similar to s5pc110 except DDR memory supporting).

http://www.slatedroid.com/topic/159...dropadherotab/page__view__findpost__p__161005

So in case of HeroTab C8, bootloader needs to be written at sector 0x0 of the SD-card.

And it seems to be a special version of bootloader (u-boot-sd.bin in terms of HeroTab C8, instead of regular u-boot.bin)

So, backing to our I9000, what kind of bootloader should we use to boot from SD? ;)
[Hardware Hacking General] AdamOutler:
please let us know exactly what you did to get to this point.

UART requires a 3-5v RX/TX device like arduino mega or bus pirate or just about anything capable of UART. You connect 619Kohms of resistance between USB Pins4-5. You connect RX and TX to USB 3-4. The receiver device would be like. /dev/ttyUSB0. Its very simple to establish communications using a program designed for a standard modem like minicom.
[Hardware Hacking General] AdamOutler:
Where are you getting this information midas? I just took readings with my oscilliscope and I did not come anywhere near 9600 hz... I'm getting 10hz.

Proof, check out the videos here of the clock and data... as soon as they finish uploading: http://www.youtube.com/user/outleradam
[Hardware Hacking General] zianna123:
and as for what bootloader is needed, there is a port of u-boot for the galaxy, but it may be easier to use the windows files that adam has packaged in his hack pack

for creating one nand sd cards.

on a side note, i have managed to get into all 3 modes listed in the lfs

although nuthing exiting came from it.

the modes are upload forced by keypress

--> by editing dbug mode and changing it to DMID or DHIGH

then holding menu and volume up for 5 seconds.

forced upload moad due to non kernel mode user panic

--> any KP will do the trick the safest i could find was using viewmem

basicaly read a memory area like 0xd0000000 0x10001 (out of bound)

forced upload by power reset

--> using viewmem again read memory area 0x60000000 0x10

the phone will freez, then press the power button

each takes you to a different menu, but the same mode 3 (modem upload mode)

im off now to go find a way to safely trick irom into thinking there is no ibl
[Hardware Hacking General] zianna123:
Adam from my sim cloning days, i can verify that the sim card runs at 9600 (with a few variants operating at or around that speed) depending on the clock.

the only real difference was the 5v and 3 vold variants

3,579545 MHz 9600bps

7,3728 MHz 19200bps

10,245 MHz 28800bps

some work at 28800 but almost any work at 19200 (99%).
[Hardware Hacking General] midas5:
It really should be 9600, if the clock pin is about 3.5Mhz.

A web site that backs up my comment:

http://www.ladyada.net/make/simreader/solder.html

Search that page for "baud".
[Hardware Hacking General] AdamOutler:
Please explain this then... those are 50ms divides... the clock takes 2 divides. 100ms period=10hz http://youtu.be/DZOSHCKFt-A
[Hardware Hacking General] js22:
So do you agree that if OM{5..0} = 0x29, that the shifted value is 0x14, and that r8 gets set to 0x10 ? Then code goes to UART ?
[Hardware Hacking General] TheBeano:
Yes that's right. The "Normal" boot type in R8 is 1, which tries NAND, then SDMMC2, then serial/USB. R8=10 will go to UART/USB load if it's a cold start (RST_STAT bit 0=1), or NAND if it's a warm start.
[Hardware Hacking General] AdamOutler:
As a note, I've tried all baud rates. Maybe minicom would be better.

We are expecting 8-1-N communications right?
[Hardware Hacking General] AdamOutler:
Just to verify everything is working properly... can anyone verify the proper setup for the serial communications so I can make sure I am actually communicating properly. I know I'm getting something, but I believe I am communicating at 5V rather then 3.3 and I don't know what that means for the validity of the data.
[Hardware Hacking General] js22:
I'm not sure what 'screen' is; prolly best to use minicom.

You def don't want to connect a 5V Tx to tour phone. Either leave it disconnected or use a voltage divider. Using too high a voltage can damage hardware.

Usuallly a 3.3V signal into a 5V input is okay, but best to check specs.

AFAIK all coms from phone are 8N1. Anything from PBL onwards is 115200 unless user software changes it.

The mode you're using makes the analog switch connect to UART 2 under normal kernel operation, but the kernel may not set up the UART (since nobody really uses serial). So it could just be noise on the line.
[Hardware Hacking General] js22:
Oops. missed this post somehow.

Interesting idea checking OM using viewmem.

I ran several more times today trying various button combos, bur I get the same two bytes :Ox10 and Ox31.

I even tried writing OxAA after every byte received, JIK.

I'm convinced this would work if we could get bit OM[5] set. Just don't see how to do it.

BTW, do you have +5V connected to micro-USB connector? I don't. Might be that the fsa chip takes that into account.( In addition to switching the D+/D- lines, it also is tied into controlling the power management system.)

Another Q : what is the diff betw the FM-BOOT-ON-UART and FM-BOOT-OFF-UART modes? I've only been using the former (619k) and only from powered off condition.
[Hardware Hacking General] TheBeano:
I've tried the most obvious resistors with and without power on that pin. There isn't much difference except that 150K starts up automatically with power, without it you have to push the power button.

All we know is that "ON" also triggers car dock mode, and "OFF" doesn't. The serial output seems to be the same either way.
[Hardware Hacking General] TheBeano:
Have gone a bit wider for help, here's hoping.
[Hardware Hacking General] AdamOutler:
Screen is the defacto standard for communicating with a device. it brings the device directly to the terminal. I use it quite a bit for serial communications.

It's not noise for sure. That log above was recorded over a period of 1 hour. I can watch the lights light up on my rx/tx on my arduino and it happens when my device is plugged in once per second.

Here is the initial sketch I came up with for Arduino communication

void setup() {
// initialize both serial ports:
Serial.begin(115200);
Serial1.begin(115200);
}

void loop() {
// read from port 1, send to port 0:
if (Serial1.available()) {
int inByte = Serial1.read();
Serial.print(inByte, BYTE);
}
// read from port 0, send to port 1:
if (Serial.available()) {
int inByte = Serial.read();
Serial1.print(inByte, BYTE);
}
}

Maybe I should look at defining what a byte is to the serial interperater on my arduino.. possibly looking at 7n2..... Dunno. I'll keep working on it.
[Hardware Hacking General] zedgar:
Great work by you guys on this topic.

I'm on the vibrant and I can confirm that the 619k with a jig works to boot up the phone.

What is odd, is that I got it to boot into download mode the first time. Now every time I attach the resistors, I just boots up the phone normally. This also happens sometimes when I use 301k. Is that normal?
[Hardware Hacking General] AdamOutler:
Ya its normal. This thread is more for software communications. Check out the fun with resistors thread for information on using resistors to access different modes. We are primarily looking at ways to trigger communications without download mode or in other words... when the phone gets bricked.

Does anyone have a brick we can play with?