yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] wertyzilla:
S8500zcjk2

Crc32: 89005d3a

!!!! This bootloader is unknown - please post it in fota thread on xda !!!!

thanks
[Bada Software and Hacking General] mylove90:
BTW mijoma

your tool seem not to work under Win 7 64-bit:(
[Bada Software and Hacking General] mijoma:
Thanks. I coded the app in 10 minutes and never tested it severely to be honest. Can you describe non-working in more detail? How do you run the app? Does it just give wrong results, causes exception or anything else?

BTW. I updated svn and the pre-built fota:

http://badadroid.googlecode.com/files/S8500_univ_boot.zip

It currently supports the following bootloaders:

S8500DDJE7_MAY

S8500JVKC1_MAR

S8500XXJD9_APR

S8500XXJEE_MAY

S8500XXJEF_JUN

S8500XXJF1_JUN

S8500XXJF4_JUL

S8500XXJH2_DEC

S8500XXJH2_NOV

S8500XXJH3_AUG

S8500XXJI3_FEB

S8500XXJI3_NOV

S8500XXJID_SEP

S8500XXJK2_MAY

S8500XXJL2_APR

S8500XXJL2_DEC

S8500XXJL2_MAR
[Bada Software and Hacking General] intelligentking:
does that means that i can try booting android using the XXJEF bootloader cuz i can see that new fota supports that?

thanks
[Bada Software and Hacking General] mijoma:
Yup, you can try.
[Bada Software and Hacking General] mylove90:
pop up cmd window but closes it too fast

opened it in windows cmd so it won't close

it says filename is missing!!!!

where should i place the *.exe file to work?

Edit1 : ok manged to use it

it says that my XXJL2 bootloader is unknown and i should post it!!!!!

i posted it few pages ago : http://xdaforums.com/showpost.php?p=14602877&postcount=231

Edit2 : i was checking apps_compressed.bin:D

my bootloader is already known

sorry for the hassle
[Bada Software and Hacking General] anghelyi:
Gents!

First thing first: I never coded in ARM assembly but some 20 years ago I played with x86 asm and c64 asm too :) So my skills are not fresh. I try to modify the FOTA code to boot android as default not Bada. I'm I right if I think that I have to modify this piece of code?

ldr	r0, [_key]

ldrb	r0, [r0] ; Middle key

cmp	r0, 1

beq	fota_dload_mode

ldr	r0, [_key]

ldrb	r0, [r0, 2]	; CALL key

cmp	r0, 0

bne	c_run

bx	lr	; back to the bootloader

To something like this:

ldr	r0, [_key]

ldrb	r0, [r0] ; Middle key

cmp	r0, 1

beq	fota_dload_mode

ldr	r0, [_key]

ldrb	r0, [r0, 2]	; CALL key

cmp	r0, 0

beq	c_run

bx	lr	; back to the bootloader

Or am I completly off? :D

Thanks!
[Bada Software and Hacking General] intelligentking:
i tried but it didn't work.
[Bada Software and Hacking General] mylove90:
@intelligentking

you need to patch apps_compressed.bin

upload it and i'll patch it for you:)

or you can patch it for yourself

1.Decyrept the apps_compressed.bin files used bootloader decyreption in Wave remaker

2.open the decyrepted file using hex editor

3.Got to offset 0x554

4.put value 0xF07AF07A from 0x554 to 0x558 (Remember it's little endian so the value will be written backwords)

5.search for this values

02 00 00 00 02 00 00 00 00 08 00 00 00 00 02 00

change it to

01 00 00 00 02 00 00 00 00 08 00 00 00 00 02 00

6.encyrpt the file and flash it

i think it will be easier if i patched it for you:D
[Bada Software and Hacking General] oSandmaNo:
@mylove90

if you could please make an executable that could automatically patch the apps_compress.bin file

:D:D:D

EDIT:

should we encrpyt the file after editing?
[Bada Software and Hacking General] intelligentking:
thank you so much for your help. as my sign says i m always hungry for knowledge, lemme try it myself first. otherwise i will definitely upload it for you :).

EDIT: kinda stuck in there so here you go sir

http://www.mediafire.com/?pojsbczry6b9v3n

should we encrpyt the file after editing?
[Bada Software and Hacking General] intelligentking:
we you able to find the offset he asked to find? i changed the second value but was unable to find offset.
[Bada Software and Hacking General] mylove90:
Can't make it:(

i am not a code writer at all i just do mods and love doing that :D

maybe you can ask Dokugogagoji for that he is a good app maker but i guess he has exams now so just PM him and when he is back he will make it

the offset is not a value to find it is an address to go to

now uploading the patched file

you can investigate it after downloading

here is the patched file : http://www.mediafire.com/?ddb1ljdjrlqii6y
[Bada Software and Hacking General] intelligentking:
i know offset is the address but i was having difficulties in finding that :). and did you re-encrypt the file after patching it?

EDIT:

@mylove90 thank you so very much for helping me :)
[Bada Software and Hacking General] intelligentking:
follow shadows TUT and also flash this apps_compressed.bin file.

it will work

http://www.mediafire.com/?ddb1ljdjrlqii6y thanks to mylove90 for the patched file
[Bada Software and Hacking General] firestonez:
Just wanna share bootloader for SEA firmware

The latest for SEA firmware is DXJL3 but it didnt come with bootloader file

CRC32: B231ECF3

http://www.mediafire.com/file/si9m1z6cbc7cte5/BOOTFILES_DXJEA.rar
[Bada Software and Hacking General] Rebellos:
You've changed

to

So thats for sure right. :)
[Bada Software and Hacking General] mijoma:
I made a small app. It's in the attachment.

Best Regards,

mijoma
[Bada Software and Hacking General] mijoma:
Thanks. Praise Samsung - we have another XXJEF build :)
[Bada Software and Hacking General] anghelyi:
Thanks! It seemed OK for me, or more like logical, but it's my first attempt to touch

assembly code in 20 years :)

Edit: and it works :)
[Bada Software and Hacking General] lbyao:
boot_loader XXJF4

CRC32: DBD9BDBB
[Bada Software and Hacking General] dixter:
Have searched high and wide but I've been unable to find a copy of S8500NEJE6 to download. I found XXJE6, would that have the same bootloader?
[Bada Software and Hacking General] xator91:
New bootloader from XXKF2 new firmware ;)
[Bada Software and Hacking General] mijoma:
There's no rule. Most branded firmwares still have unbranded bootloaders.

As it came out recently, the Samsung release policy when it comes to bootloaders is generally strange - they seem to build bootloaders each time (or most of times) when doing a full firmware release - sometimes name them differently even when based on EXACTLY same code base, sometimes name them same even when the source or compiler options are different. Seriously uncool!

For example, I already found two builds of XXJEE from the same day (6 hours difference), same code base. There is also other XXJEE build with a minor difference in _printf_fp_hex_real.
[Bada Software and Hacking General] adfree:
I know this from other handset manufacturer...

Siemens/BenQ...

I think this is also in other R&D "normal"... maybe depend on Software Developer, as many different people/groups compile sources...

Maybe they have not ever access to same sources...

Best Regards
[Bada Software and Hacking General] dixter:
Well, it seems that XXJE6 doesn't include bootfiles, at least the version that I looked at, and I can't even find NEJE6. I guess I'll have to find an unlock code and flash to one of the compatible firmwares.
[Bada Software and Hacking General] mijoma:
No, the sources are the same - just recompiled.

I know different Quality Assurance practices for public releases, although not from the handset business. I hope it's not normal for whole R&D.
[Bada Software and Hacking General] xator91:
Hi mijoma, have you read this post? http://xdaforums.com/showpost.php?p=15229412&postcount=314
[Bada Software and Hacking General] mijoma:
Yup, got it. Thanks. I made changes to FOTA code, reorganized it to address a bit the issue of lots of builds for same release (just to avoid too many pointer tables).
[Bada Software and Hacking General] Lithophyses:
i added xxkf2 bootloader a second time.

thats a new leaked firmware for wave 1 that will go official in few days.

i flashed it. after restart i flashed universal fota but android doesnt start, its always bada.
[Bada Software and Hacking General] mijoma:
Thanks, I made changes to the subversion and uploaded a new version of FOTA.

Future releases are coming only if people deliver bootloaders.
[Bada Software and Hacking General] dixter:
So if I can't find a copy of a firmware to download, there's no way of ripping the bootloader off my phone and I just have to flash to a different firmware and bootloader?
[Bada Software and Hacking General] mijoma:
At this moment, it's not possible without hardware (JTAG).

Theoretically, a software doing dump through UART/USB is possible to implement (with reading shadowed bootloader from RAM as the easiest option and reading OneNAND far more complicated), but the PC side would have to be developed as well.

The dump from RAM would not be usable for reflashing as the image after initialization is different (in RW sections), but after offsets discovery it would be possible to dump OneNAND to moviNAND using filesystem implemented in the original bootloader. All that is quite a work to be done, so I doubt we can find people for the job.
[Bada Software and Hacking General] Lithophyses:
thanks, works now
[Bada Software and Hacking General] adfree:
GT-S8500S8500BUJI3S8500VFGJI3_VD2.zip
GT-S8500S8500BVJK1S8500ONEJK1_ONE.zip
GT-S8500S8500BWJL1S8500VIAJH1_VIA.zip
GT-S8500S8500NEJH2S8500DREJH2_DRE.zip
GT-S8500S8500XXJH3S8500EPLJH3_EPL.zip
S8500BOJE7.ZIP
S8500BOJI2.rar
S8500BUJF1.zip
S8500BVIJJ3.rar
S8500BVJH1_IDEJH1_Orange_pl.rar
S8500BVJJK1.rar
S8500BWJE8.ZIP
S8500BWJH1.rar
S8500BWJL1(2).rar
S8500CXKA1.rar
S8500DDJE5.zip
S8500DDJE6.zip
S8500DDJE7.zip
S8500DXJE8.zip
S8500DXJE9.zip
S8500DXJEA.zip
S8500JPJG2_FULL.rar
S8500JPJJ3.rar
S8500JPJKB1.rar
S8500JVJK1.rar
S8500LUHJL1.rar
S8500PMJE2.rar
S8500PMJL2.rar
S8500XEJH2.rar
S8500XEJK2.rar
S8500XEJL2_Full.rar
S8500XEKA1.rar
S8500XEKC1.rar
S8500XEKC2.rar
S8500XIJL1.rar
S8500XXJB6.rar
S8500XXJC5.zip
S8500XXJD2.zip
S8500XXJD3.zip
S8500XXJD4.zip
S8500XXJDA.zip
S8500XXJDB.zip
S8500XXJDZ.rar
S8500XXJF1_Full.rar
S8500XXJF8_Full.rar
S8500XXJH1.rar
S8500XXJH3.rar
S8500XXJI5.7z
S8500XXJI5_Full.rar
S8500XXJID.rar
S8500XXJJ9.rar
S8500XXJK1.rar
S8500XXJL2.7z
S8500XXJL2_Full(2).7z
S8500XXJL2_KPN.rar
S8500YXXJDC.part1.rar
S8500YXXJDC.part2.rar
S8500ZCJF1.rar
S8500ZCJF7.rar
S8500ZCJG2.rar
S8500ZCJH1.rar
S8500ZCJI3.rar
S8500ZCJK1.rar
S8500ZNJI3.rar
S8500ZSJE4.rar
S8500ZSJH2.rar

This is what I could contribute... not all packages contains Bootloader, but if you can tell me which Firmware is "missing", I can check my stuff...

Best Regards
[Bada Software and Hacking General] Rebellos:
http://code.google.com/p/badadroid/source/browse/trunk/univ_fota/inc/abstract.inc

We've got so far

In different builds.
[Bada Software and Hacking General] dixter:
Any chance of finding S8500NEJE6? Thanks for all this, I'm downloading S8500DDJE6 in the case that it has the same bootloader as NEJE6.

EDIT: I checked S8500DDJE6. Bootloader is S8500+DD+JE6 so I've uploaded it. Unfortunately for me, this means it's almost certainly not the same as NEJE6...
[Bada Software and Hacking General] mijoma:
Thanks to Rebellos, we're going to have a new universal FOTA based on the concept of reloading the bootloader image in RAM with our modified version of the original one (as FOTA may have up to 3 MB it fits without problem). The process might take a bit more time to execute, but we'll have a look at optimizing that in the future.

This way without any difficulty we should run what we want and not depend on the version in the device (as it's only task is to execute FOTA code), but the requirement for the correct header in apps_compressed.bin still applies.
[Bada Software and Hacking General] mylove90:
mijoma

that sounds really good

maybe we will keep the dual boot and won't need to replace bada at all

what do you mean by "the correct header in apps_compressed.bin still applies"?

is that the support for fota only or something else???

Thanks in Advance
[Bada Software and Hacking General] mijoma:
Yes, that's what I mean.
[Bada Software and Hacking General] Rebellos:
The newest universal fota is available there:

http://code.google.com/p/badadroid/source/browse/trunk/FOTA/bl_univ_boot.ASM

(Ready to compile for S8500, if you want to use it with S8530, just change first line to include S8530 macros, altought android is not working yet for S8530)

Compiled version:

//look post below

It support any bootloader, altought it has got disadvantage - it makes booting 5-10seconds longer, even to bada. You have to keep call key pressed for longer time if you want to boot android (till BL3 ends booting twice)

Recovery mode isn't done yet.

If you want to have recovery mode + shorter booting cycle and your BL is supported by mijoma's universal FOTA - better use that one for now, but if you want to use some diagnostic code or your BL is not supported - give the new one FOTA a try. :)

Please test it and give feedback if something is wrong.

Also note its untested version for S8500, may cause some unpredicted results.
[Bada Software and Hacking General] Rebellos:
Added Recovery Mode and Download Mode

http://code.google.com/p/badadroid/downloads/detail?name=S8500_bl_univ_boot_v2.3.zip

Please test if all combinations are working for you.
[Bada Software and Hacking General] cyberbast:
ERROR

Unable to collect the files: nbates66FilesystemMoviNANDLoopback100711v1public.zip.001 and nbates66FilesystemMoviNANDLoopback100711v1public.zip.002 with Winrar.

Thank you for uploading the file "ext2system.img" in a single part.

Thanks !
[Bada Software and Hacking General] mijoma:
And what that has to do with the thread you posted in?
[Bada Software and Hacking General] hellseekar:
i tried it but still no use!

after flashing fota phone automatically booted bada

after switching it off tried to do the vol up+menu+power but it still boots bada!!!

my bootloader is DDJE7 and firmware id DDKD1

Should i try it with mijoma's universal boot loader??.......lol

Edit: flashed universal bootloader and fota still not able to bood anderoid all the time bada is booting
[Bada Software and Hacking General] frxbg:
Hi @hellseekar Мaybe this will be useful

http://xdaforums.com/showthread.php?p=15280751#post15280751
[Bada Software and Hacking General] hellseekar:
Thanks it worked!
[Bada Software and Hacking General] ShadowAS1:
He posted it in every thread which has to do with the port -_-
[Bada Software and Hacking General] er_macellaro:
Hello,

i can't start recovery mode with new fota. I have installaed JK1 firmware with JI2 bootloader.

Can i flash universal bootloader to try start movinand tutorial?

Thanks
[Bada Software and Hacking General] oSandmaNo:
if you still need bootloaders

here is the latest for S8530 which i got today

S8530DDKF1

Stupid QR code, here is the mediafire link

http://www.mediafire.com/?ittx7t8l2amcx9l
[Bada Software and Hacking General] adfree:
Sorry, I am blind. :o

Where is FOTA for dump iROM of S8500?

Can someone support old blind man?

me :D

Thanx in advance.

Best Regards
[Bada Software and Hacking General] srg.mstr:
http://code.google.com/p/badadroid/source/browse/trunk/FOTA/mem_dump.ASM?spec=svn354&r=354

if u need i can assemble it
[Bada Software and Hacking General] adfree:
Yes please.

My skills to compile something is very low... :o

Thank you very much.

Best Regards
[Bada Software and Hacking General] srg.mstr:
this is new version from Rebellos, i have never checked it:

dump from 0xE0E00018 to 0xE0E00028

http://code.google.com/p/badadroid/downloads/detail?name=mem_dump.fota&can=2&q=#makechanges
[Bada Software and Hacking General] adfree:
Thanx.

I will try it and report.

Best Regards

Edit 1:

First attempt

Boot + all other files on XXJL2

But now XXJL2 not start... only black Screen... only DL Mode possible.

Is XXJL2 correct for this FOTA? :confused:
[Bada Software and Hacking General] Rebellos:
Sorry, the file in SVN has been commented wrongly. It used to dump iROM before many changes.

Corrected the file and compiled binary for you.

It is supposed to be run with XXJEE BL. (Bypassed loading its own XXJEE as many people reported bugs within)

Corrected source here:

http://code.google.com/p/badadroid/source/browse/trunk/FOTA/mem_dump.ASM?r=356

And binary in attachement.

It requires /dumps/ directory to be present on moviNAND User partition.
[Bada Software and Hacking General] adfree:
:o

Today is not my day...

My steps.

- Boot XXJEE + BOJE7 Firmware (old T-Mobile)

- TKFileExplorer... create folder

User/dumps

. hold call + on...

Result display output:

...

dumpmem error:0xFFFFFFF1 not found!

Entering BL3 DL

Best Regards
[Bada Software and Hacking General] Rebellos:
It says it doesn't found "dumps" directory. Odd.

Try to connect Wave in Massive Storage mode and create directory through windows explorer, maybe I mixed up something and it's not User partition. Well, that was the one around 600mb if my memory isn't faulting me.
[Bada Software and Hacking General] adfree:
Okay, mass storage mode was good idea. :D

(now I can find this under Media/dumps if I use sTune, TKFileEx... etc.)

So g: is folder Media

File is empty... only 0000 :(

I'll try again and also try other FOTA...

Thank you for support. :cool:

Best Regards
[Bada Software and Hacking General] Rebellos:
LOLOLOL, Just noticed that my code was doing following thing:

guess thats why nbates couldn't dump securekey values for me ^^'

Sorry for that.

Attaching 2 valid dumpers, please send me SECKEY.bin after executing both FOTAs (one will dump iROM, another one will dump SECKEY)
[Bada Software and Hacking General] adfree:
seckey

0000000000000000000000000000000000000000100000000F60F007A7FC9EAE1D00AC62

:cool:

iROM also successfully dumped.

Thank you very much. :cool:

Best Regards
[Bada Software and Hacking General] b.kubica:
I don't know current status of work with fota but how do you think, is it possible to follow these steps:

BL loads the modified fota

fota code modifies the BL ram image - hack LaunchNucleus()

BL execute LaunchNucleus(), all segments are loaded and at the end patch the image in ram (image of loaded elf )

and the 2nd one (harder i think):

BL loads the modified fota

fota code modifies the BL ram image - hack download code

Bl accept decrypted and decompressed image of apps_compressed and write it to nand

Bl accept decompressed image of rc file

thanks,

Bartek
[Bada Software and Hacking General] Rebellos:
Yes, every FOTA in this repo directory

http://code.google.com/p/badadroid/source/browse/#svn/trunk/FOTA

is able of reloading modified BL, all you have to do is comment out this line http://code.google.com/p/badadroid/source/browse/trunk/FOTA/inc/macros.inc#32

included BLs there are S8500XXJEE_BL3.bin S8530JPKA1_BL3.bin (depends which model header you include), you can modify them in any way you want.

However, many people reported issues with FOTA which does second shadowing of BL3, thats why I turned it off in macros.inc line 32 and for now mijoma's universal BL is in use (need manual analyze of every BL version, generating pointers table and CRC checksum)

you can find mijoma's univ FOTA there

http://code.google.com/p/badadroid/source/browse/#

Please note: Be aware of messing in download mode without yours SECURE_DATA backup on your PC and being ready to apply UnBrickable Mod (details there: http://xdaforums.com/showthread.php?t=1250270) or JTAG - I accidentaly damaged my BL3 in oneNAND by messing with DLoad mode functions through FOTA.

//PS: Bartek, as far as I know, advertising commercial sites in your signature is against XDA rules : (
[Bada Software and Hacking General] b.kubica:
ok, thanks for the info that is I was looking for. Firstly I will try first method (modify in ram) to hack apps code.

It should be even faster to do some test - uploading few kB patch against whole apps uncompressed code :)

PS. About rules - I read forum rules and I think my link wasn't strictly ads. IMHO it was something like private portfolio but ok, I removed it to cut off all doubts ;)

PS 2. Nieźle wam idzie - pierwszy raz od pół roku mam trochę czasu, trochę się pozmieniało hehe :)
[Bada Software and Hacking General] adfree:
Please, can we have some FOTA for complete OneNand dump?

Maybe 2 parts for each 256 MB... as only 300 MB free on G...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Rebellos:
Yes, I'll work on it. However it will differ from JTAG dump, as some oneNAND areas use weird BML paging structure. Data read by JTAG has got 1block of data and 1 block of gap (block = 2KB on S8500 and 4KB on S8530), data read through BML interface are solid.
[Bada Software and Hacking General] b.kubica:
what about downloading via usb? DloadTransmite() looks easy to use
[Bada Software and Hacking General] Rebellos:
I'm personally too lazy to make something which will catch that data. If anybody does, also Upload mode handling can be implemented into that.
[Bada Software and Hacking General] b.kubica:
TriX has plugin for read/write serial ports. I'll try to do something

download mode packet types (not all are implemented):

0x23 CMD_USB_DUMP
0x24 CMD_USB_VERIFY
0x25 CMD_USB_DEBUG
0x50 CMD_USB_FULLDOWNLOAD
0x60 CMD_USB_DOWNLOAD_UNLOCK
0x70 CMD_USB_INFO
0x71 CMD_USB_SET_DBG_LVL
0x80 CMD_USB_SECURITY
0x90 CMD_USB_RESET
0xA0 CMD_USB_UNLOCK
0xB0 CMD_USB_COPY
0xB2 CMD_USB_CSC_WRITE
0xB3 CMD_USB_SHPAPP_WRITE
0xB4 CMD_USB_PFS_WRITE
0xC0 CMD_USB_LOCK
0xD0 CMD_USB_VER_CHECK
0xDA CMD_USB_READ
0xDD CMD_USB_WRITE
0xEE CMD_USB_ERASE
0xEF CMD_USB_ERASE_MC
0xF0 CMD_USB_FORMAT
[Bada Software and Hacking General] b.kubica:
BL3 address range (approx.): 0x42480000-0x42570000

fota address range: 0x43800000-0x43A80000

so the maximal offset is (0x43A80000 - 0x42480000) 0x1600000. arm32 BL support +/- 0x2000000 which means we're able to hack bl3 code directly from fota using only BL opcode :)
[Bada Software and Hacking General] Rebellos:
Yup, FOTA is using alot of BLs to BL3, as you can see.

If you mean patching - I've already been modifying BL3 MMC interface to use SD port instead of moviNAND, but it failed. Probably I ommited something.
[Bada Software and Hacking General] b.kubica:
patching was successful and i received nand dump via usb

i will post results soon
[Bada Software and Hacking General] b.kubica:
freaks...

funny way to send packet

7E PB TB [DATA] [CHK] 7E, where

7E - packet start

PB - parity byte

TB - command type byte

[DATA] - data coded to eliminate all 0x7D/0x7E bytes

[CHK] - crc16 checksum

7E - packet end

now I'm not sure if leave it in this way or develop own simpler packet transmission

7E PB TB [LENGTH] [PLAIN_DATA] [CHK] 7E

no stupid 0x7D bytes ^ 0x20 conversion - faster transmission, 2 times longer packet allowed (0x8200 bytes). Better for own purposes will be replace DloadTransmite/DloadReceive with own routines
[Bada Software and Hacking General] mijoma:
7E and 7D^20 is pretty standard HDLC as used in ppp for instance (but there it wraps lcp and ipcp). I wouldn't call that specific to Samsung - they just under that as link layer (though I would find a dozen of better link layers for that use).
[Bada Software and Hacking General] Rebellos:
Looks like they just did copy-paste from some UART-DLoad/Dump and didn't cared about such ordinary things as optimizing protocol... But it doesn't surprise me anymore. You better not look into 1.2 Bada kernel, THAT is an unoptimized mess.

//edit: Doh, I believe in mijoma's words more in mine in this matter. :P

Btw, ain't sure when ho1od will finish his work on unpacking bada 2.0 QuramD, do you think you can load 2.0 BL3 through USB from FOTA level, load 2.0 apps_compressed, force unpacking and then dump unpacked code? Would be nice... :d
[Bada Software and Hacking General] b.kubica:
yes i was thinking about that. and this can be done. In previous post I wasn't sure yet but now I am - I will hook Dload R/W and skip 0x7E packets. Instead I will communicate through 0x7F (not used, should be implemented easily). Than we can do really interesting things with that including unpacking 2.0 QMD

easiest way to do that will be as you mentioned:

'shadow' 2.0 BL3

hook it to support custom packets

download apps_compressed, unpack and upload back to pc
[Bada Software and Hacking General] channal1:
THANK YOU

i think i should thank you very much for you can waste lot of time to write this post .....thank you again for your sharing..