[Hardware Hacking General] androcheck:
Good morning! :)

A lot of new interesting input here!

To sum up again a little bit (please correct me if I got something wrong):

The goal:

Our goal here is to find a way to recover a *completly* software-bricked phone, with no working PBL and/or SBL at all (with of course intact hardware) without the need for opening the hardware.

In this state the last working piece of software is the undeletable IBL/IROM code on the chip inside (which we dumped and disassembled in this previous posting). You would not see any logo or warning symbol on the display at all, because all these normally get displayed by higher-level piece of software in the bootchain (the SBL).

What we need:

So we need some way to be able to boot from an alternate source (because the PBL/SBL on the OneNAND is cake) and recover the OneNAND content from there, or - if possible - find a way to directly flash new software on the OneNAND somehow.

What we know:

To achieve one of these we have to find out how we can access the required pins on the main processor from outside (via usb-port). We know that directly behind the USB port we have a USB-switch (FSA 9480 which is labeled "U301" in the schematics) which can be triggered by applying different resistor values.

AdamOutler, you wrote something about JTAG. As I do not know very much about this, please correct me if I am wrong. But if I understand you correctly, JTAG is a possibility to directly reflash the nand chip (given that you have the appropriate equipment)?

If yes, we are talking here about 2 different approaches:

Approach 1):

We saw in the manual of the Samsung S5PC110 main processor (and confirmed this also in the disassembled IROM code) that the processor gets input from 6 external PINs which define the boot device order (and type). Especially two pins are of interest: OM[5] and OM[4] because if they are set to "1" "0" the processor would first try to boot from UART before it tries the normal boot-sequence.

For this to get working we need the folowing:

a) We must assume that the FSA 9480 switch is wired at least to the OM[5] pin of the S5PC110 main processor and can be triggered to send a 1 to this pin somewhow.

b) We must find out how to trigger the usb switch to expose the UART pins from the main processor to the usb port, so we can talk with it.

c) We have to figure out which protocol is needed on this line to load an external PBL/SBL boot image. There is nothing about this protocol in the processor's manual, but theoretically it should be possible to find this by disassembling the according IROM code.

Approach 2):

In the schematics floating around we also see that there are some lines labeled with "JTAG" connected to the U301 device (the usb switch). This means if we somehow can trigger the usb switch to expose these lines to the usb port, it should be possible to connect with JTAG equipment to the phone, which also may give us the possibility to recover content on the OneNAND. AdamOutler, did I get this correctly?

Sorry for my lack of knowledge, but what kind of equipment is needed for a JTAG connection? I do not know very much about this.

But to get to an end:

The main thing we don't know is: How do we have to trigger the usb-switch accordingly. I found not really much about the FSA 9480 on the net. Maybe it's worth a try to contact the Samsung developer who introduced the driver for the chip on the Linux kernel-mailinglist (Minkyu Kang).

I'm optimistic that together we can find a working approach!

Have a nice day! :)