yashsingh1/xdaforums huggingface dataset:
[Hardware Hacking General] midas5:
Dam. You should be seeing 0xAA and some failure text message from the irom when OM = 0x29

Try a cold boot like this:

remove battery.

Insert battery

Insert uart cable.
[Hardware Hacking General] midas5:
You will only see the 0xAA on the very first boot. If it cycles, it will skip the 0xAA serial boot attempt.

You have to power off the device to get a serial boot attempt.
[Hardware Hacking General] Rebellos:
As the manual says:

lol, just discovered this notice in UM

All our researchs and manual tells that you MUST obtain 0xAA during cold boot.

I'm extremally busy for about half month now. Got already concept of resurrect-BL, all we need is copying some IBL functions (got already DMC init there under configure_ram function http://code.google.com/p/badadroid/source/browse/trunk/FOTA/inc/functions.inc) + some simple uart or usb protocol (odin or multiloader from SGS SBL or S8500 BL3, i'd prefer usb - faster and smaller error rate, disadvantage is that it is somewhat more complex) which allows us to load real SBL/BL3 in its place and jump into download mode.

Easy, but requires alot of time. :<
[Hardware Hacking General] midas5:
As I understand it the order is (when OM=0x29):

Cold boot

It Tries to Boot from UART

It Tries to Boot from USB

It Tries to Boot from MMC (The external SD Card)

It Tries to Boot from OneNand

I think the SD card would be the safest.

I think it would be good to see the UART output from the IROM so we can be sure we are at the right point. It would also help with us writing our own recovery boot code if we can get it to output on UART so that we know it is running.

We should be seeing the 0xAA.

Without that, I think that we might not be where we need to be.

Another possible test is using the 301k resistor and get a PC to sniff the USB port to see if the IROM USB ID is being seen.
[Hardware Hacking General] AdamOutler:
Hey, check this out... It should be charging the battery right now, but it's not. It will charge the battery if you shut the phone down, but not if you insert the battery and then plug in USB

This is a sudo lsusb -vv.. I pulled the battery out of the device, then plugged it into my computer. It then came up with this. It's just sitting here waiting to be utilized. How do I use it? I don't know...

Bus 001 Device 082: ID 04e8:1234 Samsung Electronics Co., Ltd
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x04e8 Samsung Electronics Co., Ltd
idProduct 0x1234
bcdDevice 1.00
iManufacturer 1 System MCU
iProduct 2 SEC S5PC110 Test B/D
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 50mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0xff01
Self Powered

I don't believe I've seen this before....
[Hardware Hacking General] AdamOutler:
Ok.. So, on Windows, the act of probing the device for drivers triggers the device to go into charging mode. On Linux, the device is not probed so it will not go into charging mode... This is an odd and seemingly useful characteristic.
[Hardware Hacking General] AdamOutler:
HAHA!!! this device is the Development Platform now! http://www.samsung.com/global/busin...o.do?fmly_id=834&partnum=S5PC100&xFmly_id=229

click the download button in the brown box near the bottom, sign up, and request download.
[Hardware Hacking General] AdamOutler:
I'm attaching the s5PC110 drivers and DNW utility to this post. I can confirm that they work. this is what you need to communicate with a S5PC110 Test B/D

===== USB DEVICE STATUS =====
USB_CONFIGURATION_DESCRIPTOR
bLength = 0x9, decimal 9
bDescriptorType = 0x2 ( USB_CONFIGURATION_DESCRIPTOR_TYPE )
wTotalLength = 0x20, decimal 32
bNumInterfaces = 0x1, decimal 1
bConfigurationValue = 0x1, decimal 1
iConfiguration = 0x0, decimal 0
bmAttributes = 0xc0 ( ??? UNKNOWN!! )
MaxPower = 0x19, decimal 25
-----------------------------
USB_INTERFACE_DESCRIPTOR #0
bLength = 0x9
bDescriptorType = 0x4 ( USB_INTERFACE_DESCRIPTOR_TYPE )
bInterfaceNumber = 0x0
bAlternateSetting = 0x0
bNumEndpoints = 0x2
bInterfaceClass = 0xff
bInterfaceSubClass = 0x0
bInterfaceProtocol = 0x0
bInterface = 0x0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe00
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x81 ( INPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe01
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x2 ( OUTPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
[ERROR:File Open]
[ERROR:File Open]
=============== USB Receive Test ==============

I don't really know how to use this app yet, but if you have S5PC110, you will not be bricked :D
[Hardware Hacking General] AdamOutler:
In order to make this work, I need a ram image of the bootloaders and param.lfs. how do I pull these off the phone? I know they're still in memory after bot
[Hardware Hacking General] midas5:
The TEST B/D mode is what we have been trying to get to. That is the IROM USB download mode.

The ram image format is currently not known. The serial download has a header and a checksum. I expect the USB download mode will have a similar checksum.

I think we now have a reliable method to get into IROM download mode. If the Ibl/PBL is corrupted,

it goes into USB download mode mode. If only the SBL is corrupted, we need to short OM5 to OM0 during cold boot.

I think all we need now is

the image format and a platform specific ram image that will let us correct the blm1 and blm3 in the onenand.

I suggest that a place to start will be getting an image to load into ram and just vibrate the phone or flash the display. We will then have the file format correct.

Then some real work is needed to do the actual recovery image.
[Hardware Hacking General] antsm:
I saw few manuals related to DNW and (if i'm correct) by using USB mode we only able to transmit/receive data to/from RAM. After that we need to communicate with Bootloader via serial and perform some commands to move data from RAM to NAND.

http://tinyurl.com/dnw-how-to

http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW

http://www.boardset.com/products/mv6410.php

But in our case bootloader is dead, so how we can take profit?
[Hardware Hacking General] midas5:
True, the DNW will load something from the USB port into RAM.

The useful part is we can load any code we like into RAM and RUN it.

So, the code we put into ram with the DNW just has to include code that writes to the OneNand Flash and reads from the USB port. We can then download something from the USB to the OneNand flash just like the SBL does with ODIN.

The problem we have currently is:

1) The format of this image, including any header and checksums.

2) The source code to compile into the image to do the job we need.
[Hardware Hacking General] midas5:
If you want a Linux DNW tool, you can get it here:

http://dev.odroid.com/projects/uboot/wiki/#s-7.2

It is called smdk-usbdl
[Hardware Hacking General] midas5:
The "smdk-usbdl" tool is nice.

I have just looked at the source code.

It takes an image filename as input. In a format of a dd bml.

It then adds the correct header and checksum and sends it to the device over USB.

We might be very close to a solution here.
[Hardware Hacking General] AdamOutler:
Alright! now all we need is a "uboot" image or something I guess... Something that would be PBL/SBL/Params.lfs/pit all-in-one.

Great find on the smdk-usbdl tool!

This is a golden link http://dev.odroid.com/projects/uboot/wiki/#s-7.2
[Hardware Hacking General] midas5:
I could help with writing the irom download ram software, but i don't have a development phone to work on.

Anyone interested in donating one to me?
[Hardware Hacking General] AdamOutler:
^^ Dude, if you can get the locations of the i9000 xOM5 pad, then you can apply this mod to your own device. It writes to memory so you can do plenty of testing without permanent damage to the firmware... I can perform destructive testing with my device.

Here is my final Captivate image.
[Hardware Hacking General] midas5:
Hey, the code I write will be writing to the OneNand flash at the BL1(IBL/PBL) and BL5(SBL) locations.

Any code that writes to OneNand could be very destructive if it had a bug in it. The recovery would mean either removing the OM5 resistor or purchasing a riff box.

Even if I removed the OM5 resistor, without my code working, I cannot recover the device without a RIFF box.

I don't wish to do this to my main phone I use everyday which is an I9000.
[Hardware Hacking General] AdamOutler:
If you can write a Hello World which can read the PBL, then we can adapt it to work with heimdall.... slowly.
[Hardware Hacking General] AdamOutler:
Another option is I could send you my UnBrickable Modded brick. The JTAG pads are damaged beyond JTAG capabilities.

I believe that you show more confidence in programming the bootloader then I do. I am currently looking for a precompiled firmware which will make the phone just plain boot up. Do you think you can program a bootloader which will make the device download?
[Hardware Hacking General] midas5:
I am intending to write something that loads into RAM that can be

extended to do:

Flash: Read and Write over usb.

Memory: Read and Write over usb.

Boot kernel over usb.

I think a good first step would be reading the onenand flash over usb

for backup purposes.

Having the OM5 already set, meaning I don't have to solder anything

would be good.
[Hardware Hacking General] AdamOutler:
would it be worth trying to get my operable device into download mode, then taking a memory dump via JTAG, then uploading that to the S5PC110 device?

What does the program we're trying to make look like?
[Hardware Hacking General] midas5:
The program would initialize the clock, set up the DMA etc.

It would then wait for USB bulk packets.

I would use a protocol like Type, Length, Value.

With different Type packets doing different things.

The program would then respond with a type,length, value USB bulk packet with status responses.

We could then build on this to do things like transfer data from USB to RAM.

So, to do a flash of the onenand I would do:

1) Transfer the data from usb to RAM on the phone.

2) Request a checksum of the RAM memory range to ensure the usb to RAM transfer worked correctly.

3) Request flash erase of flash memory range.

4) Request flash write from RAM memory range to location in flash.

5) Request checksum on flash memory range.

It should be fairly simple with just a large "case" statement.

It would be very resilient to errors, unlike the current odin.

The difficult bits will be the usb transfer code, and the onenand flash write/read code.

For your information, there are about 6 types of onenand flash, so we would need to somehow autodetect the flash type, and then use the matching read/write functions for that particular flash type.

The flash read/write code is likely to use dma and involve interrupts, so again not simple.

The final aim would be to get to a stage where we can repair the IBL/PBL/SBL and params partitions. Maybe even the partition table itself.

Once we have those, we can reach the normal "odin download mode" and recover the rest.

Unfortunately, we cannot use uboot itself, because it assumes we have a serial and a usb port accessible at the same time.
[Hardware Hacking General] Rebellos:
You don't need oneNAND driver. All you need is setting up clocks as IBL does, DMC setup (take a look at badadroid repo, there is working code of setting up almost everything, little messy and its probably not right configuring mapping to 0x40 block, only 0x20, but its almost pure IBL code and always easier to modify)

Then load SBL with modified one conditional jump (to always enter DLOAD mode) from USB into 0x40244000 and jump there. It has been confirmed to work on S8500 and S8530. SBL is very error resistant, it does continue booting tries even without correct partitioning and no params.lfs, it won't show anything on screen (maybe blinking only) but enter dload mode properly and respond for ODIN requests.

Adam/midas5 please find/upload the right SBL and I will patch it for you properly (it isn't necessary at all, but in all that stuff holding dload mode combination would be senseless if it can be bypassed, dont you think?)

//edit:

Take a look at all these stuffs, all of them have been done by mijoma and me for S5PC110 android development

http://code.google.com/p/badadroid/source/browse/trunk/FOTA/

//edit2:

If SBL is not able (I believe it is) to repartition oneNAND using PIT file during odin flash, SBL command prompt is worth trying also.

//edit3:

The easiest way to get USB communication would be basing on Spica BL posted by Adam, these are done for S3C but it's very similiar architecture, maybe only SFR correction for S5PC110 is needed and all of these will work. oneNAND and BML drivers are there too :]

Adam, do you think that mod can be done with begginner soldering skills and not some special soldering iron?
[Hardware Hacking General] AdamOutler:
^^ no, this requires advanced skills. Not for the beginner.

I don't think those bootloaders will help. We need a massive bootloader conglomeration to send over I think. I believe we need it all in one file. Like UBOOT.
[Hardware Hacking General] midas5:
Adam,

While you can (apu unsoldered/removed), it might also be a good idea to trace the I2C as well, to see if it is accessible anywhere.

If we can use that to corrupt just one byte of the PBL on the onenand, it would cause the IROM to revert to Test B/D mode. Allowing us to do recovery on it, without maybe removing the OM5 resistor.

If you remember, you got to Test B/D mode when you flashed a DDed PBL incorrectly.

Unfortunately, I don't think I have enough spare time to write the bootloader code. Something has come up that requires my urgent attention.
[Hardware Hacking General] Rebellos:
I'm wondering if its possible to not solder anything but just connecting for few seconds (during bootup) PDA_VCC line (2.8V) through few kOHM resistor with AP side of pulldown resistor, making short circuit through that resistor which is already there, but its probably something 100kOHM+, I think until its only short-time connection, it shouldn't burn/damage anything, am I right?

PDA_VCC is one of main V lines which is going straight from MAX8998, so the only danger there is burning copper line connecting GND with pulldown resistor, but current, assuming its 100kOhm resistor, would be around 28miliAmpers. Does this concept sounds too crazy or is possible to do? ;d

Have you got confirmed connection? This upload mode does support uploading to iRAM only (96KB under 0xD0020000), and is jumping immediately into target address, am I right? Will try to get time at the end of week and write endless UART "hello world" code, still its somewhat complicated and requires time : (
[Hardware Hacking General] bulletproof1013:
If you need help with any of this. I have done the " unbrickable mod" and have a connection to the app via USB, and I dont have a brick.while I don't know alot of development in this area. I am willing to test anything needed.pm me if so.
[Hardware Hacking General] AdamOutler:
Everyone needs to sign up and attempt to get the information to develop the s5pc110. Request the info at the bottom of this page. http://xdaforums.com/showthread.php?t=1206216
[Hardware Hacking General] AdamOutler:
Everyone needs to sign up and attempt to get the information to develop the s5pc110. Request the info at the bottom of this page. http://xdaforums.com/showthread.php?t=1206216ikkkkk
[Hardware Hacking General] Rebellos:
I'm getting odd feeling that something is not right there...

Assuming that PC110 and PC100 mem layout is the same

How can iROM put anything into 0x27E00000 (the address in AESOP manual) if its DRAM region :/ it isnt accessible from iROM.

Have you got S5PC100 Usermanual maybe to check for mem layout differences? I just hope that 0x27E00000 is just iRAM and everything is right, and we just should try using 0xD0020000. Or... DNW is in fact talking with some other level of BL, or DRAM is somewhat automatically booted up (doubt really)
[Hardware Hacking General] AdamOutler:
uBoot loads defaults to 0xC000000. Where are you getting that AESOP? Android somethign Open Source Program? What is AESOP?
[Hardware Hacking General] Rebellos:
Moved from edit, as you posted:

found S5PC100 UM, not the latest revision, but not the oldest also, and should do aswell.

Something doesn't fit here if you ask me :/ Memory map is almost the same as in S5PC110

Btw, IROM functionallity is kinda better explained in this manual, aswell as FIMD and FIMC, that becomes somewhat useful for display drivers development for Waves. ;]

http://www.speedyshare.com/files/29810150/S5PC100_UM_REV101.7z

AESOP is that korean site you linked :D

http://tinyurl.com/dnw-how-to

//edit:

0xC0000000 is in S5PC100 MP3_SRAM

Where did you get that info about uboot loading in there? ;o Interesting... thats 128KB of ram, maybe it can be indeed used for execution.
[Hardware Hacking General] bulletproof1013:
I found one with a rev 1 of *2010* - http://www.speedyshare.com/files/29810934/S5PC110_EVT1_UM10.pdf
[Hardware Hacking General] AdamOutler:
This is comming over JTAG UART

|0|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA
SERIAL1: � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
|0
SERIAL1:
|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|A
SERIAL1: � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � r
|0
SERIAL1:
|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|A
SERIAL1: � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|AA|D
SERIAL1: � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �
|55|72|20|67|74|61|69|6E|45|72|72|A
SERIAL1: U r g t a i n E r r

Communications established������������������������������������������������������
Uart negotiation Error
��������������������������������������������������������������������������������
Uart negotiation Error

Insert an OTG cable into the connector!
��������������������������������������������������������������������������������
Uart negotiation Error

There is nothing over normal USB UART.
[Hardware Hacking General] AdamOutler:
I inserted a OTG Cable with a flash drive attached to my device...

Insert an OTG cable into the connector!
��������������������������������������������������������������������������������
Uart negotiation Error

Enumeration TimeOut Error

OND Check Sum Error
[Hardware Hacking General] bulletproof1013:
so this means that we are not really communicating?

does this have anything to do with it ?

===== USB DEVICE STATUS =====

USB_CONFIGURATION_DESCRIPTOR

bLength = 0x9, decimal 9

bDescriptorType = 0x2 ( USB_CONFIGURATION_DESCRIPTOR_TYPE )

wTotalLength = 0x20, decimal 32

bNumInterfaces = 0x1, decimal 1

bConfigurationValue = 0x1, decimal 1

iConfiguration = 0x0, decimal 0

bmAttributes = 0xc0 ( ??? UNKNOWN!! ) <---------------------this

MaxPower = 0x19, decimal 25
[Hardware Hacking General] AdamOutler:
I uploaded a uboot and got this...

Insert an OTG cable into the connector!
��������������������������������������������������������������������������������
Uart negotiation Error

Secure Fail Error
[Hardware Hacking General] AdamOutler:
In this picture posted above

I'm seeing that U301 with a direct connection to JTAG ports.... I went looking for that part in the literature and I found U301 1001-001586. I found a cross reference on that part IC-ANALOG MULTIPLEX:SCCSP900779A,WLCSP,2 SAMSUNG

I can't find a datasheet on that chip which we are directly communicating with. It's my belief that we don't need anything except U301 MUX which is what the USB port directly connects to. If we can figure out that U301 a bit better, we may be able to JTAG over USB.
[Hardware Hacking General] js22:
Interesting possibilities. I don't recall if OM pins are sampled before or after the UART is enabled. If before, it could be that OM5 is connected to CPU's Tx; then a pull-up would set OM5 to 1 until UART was enabled.

Or, if OM5 was the inverse of CPU's Rx (jig's Tx) then sending idle would boot normally, but sending break would cause a UART boot.

Almost certain that our UART is not configured to reset CPU on break.

Dunno when I'll get a chance to test anything, but for now its encouraging to feel like there are still a few options left.
[Hardware Hacking General] AdamOutler:
Member Odia once posted "

1 last bit of info to help users without 3BM working, connect to the modem port and send AT+FUS? you will then be in DLM."

Can we try this on a brick? Does DLM actually rely on SBL or does the image come from SBL?

Here's memory locations

1 blk = 40000 (256KB)

Partition Name START LEN

BOOT 00000000 0000 0003FFFF 0001

PIT 00040000 0001 0003FFFF 0001

EFS 00080000 0002 009FFFFF 0028

SBL 00A80000 002A 0013FFFF 0005

SBL2 00BC0000 002F 0013FFFF 0005

PARAM 00D00000 0034 004FFFFF 0014

KERNEL 01200000 0048 0077FFFF 001E

RECOVERY 01980000 0066 0077FFFF 001E

FACTORYFS 02100000 0084 11E7FFFF 047A

DBDATAFS 13F80000 04FE 085FFFFF 0218

CACHE 1C580000 0716 022FFFFF 008C

MODEM 1E880000 07A2 00C7FFFF 0032

07D4 1F500000
[Hardware Hacking General] midas5:
But, that screen can be displayed even if there is a perfectly valid operating system.

For example, you can use a 301K jig, the "heimdall close-pc-screen" and it then boots normally. No need to download any new firmware at all.

This is why I thought that it might help. The phone is in a mode that will not boot even if you have valid firmware in it. This might be the "different" factory boot mode we are looking for.
[Hardware Hacking General] Odia:
No that would not work on a bricked phone because the modem device does not exist.
[Hardware Hacking General] TheBeano:
U301 is the FSA9480 chip, see the "Fun with resistors" thread.
[Hardware Hacking General] TheBeano:
All of the code that handles the phone side of the Odin/Heimdall download mode is in the secondary bootloader as far as I know, so if you interrupt it while it's receiving a download it will also display that error.
[Hardware Hacking General] TheBeano:
These are already done, please read back up the thread.
[Hardware Hacking General] TheBeano:
JTAG is at least a four or five wire protocol so you need to open up the phone and attach to the test points. You can buy jigs and equipment for this but it is expensive and not something the average user can do.
[Hardware Hacking General] ntfreak:
While jtag can be expensive this is not always the case.

I am a admin/dev on the openocd project, as long as you can get access to the jtag pins then who knows what you can do.

The galaxy s uses a cortex-A8 cpu and this is already supported by openocd.

From there is it just a matter of the flash driver.

Getting access is the hard part :)

I will agree that it is not for the feint hearted.

Cheers

Spen