yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] mijoma:
Just a note: BL3 for bada 2.0 was moved a bit lower - starts at 0x42180000.
[Bada Software and Hacking General] b.kubica:
I added sample bada terminal application to badadroid google project

currently it works only with usb_dump_flash fota to easily upload nand dump via usb to pc.

Upload speed is pretty good - ~500KB/s (for sure we can increase it but I don't know how to set windows comm timers properly)
[Bada Software and Hacking General] adfree:
My brain is to small...

Where I can find usb_dump_flash fota ? :confused: :o

Thanx in advance.

Someone tried yet?

Best Regards
[Bada Software and Hacking General] b.kubica:
in repository :)

ok, I will assembly it and add to bterm package
[Bada Software and Hacking General] b.kubica:
I added new version. The connected device should be detected automatically :)

Assembled fota included too
[Bada Software and Hacking General] adfree:
Nice. :cool:

Short tested with 64 KB... on XP...

Now I try 256 Mb to read.

Thank you very much.

Best Regards
[Bada Software and Hacking General] adfree:
http://code.google.com/p/badadroid/downloads/detail?name=bTerm_v0.10.zip&can=2&q=

bada 2.0 has no FOTA yet...

bada terminal application 0.10 works for bada 1.x

Best Regards
[Bada Software and Hacking General] adfree:
:cool:

NAND Dump via FOTA...

Today I've compared my 2 dumps... with my JTAG dumps... (RIFF Box)

From 0 - 0x4180000 identical... :cool:

My second attempt was 256 MB dump ... successfully.

But 512 MB not finished... interrupted by 381 MB... :confused:

See Screenshot...

Thanx.

Best Regards

P.S.:

Maybe good for...

1.

Backup... NV stuff...

2.

Emergency Backup...

If Bootcycle you have chance to access 2 GB MoviNand...

Ehm. Is this possible for MoviNAND too?

Maybe as Emergency Solution for Data recovery...

Not tested other adresses higher 0... :o
[Bada Software and Hacking General] b.kubica:
new 0.11 version is out:

- possible to dump ram area

- fixed percent counter

Available commands:
dump [nand] DEADBEEF DEAD
dump ram DEADBEEF DEAD
exit

nand is optional (default dump option)

@adfree,

thanks for the info - the same problem I've got at the same address. I will try to fix it asap

---------- Post added at 10:26 AM ---------- Previous post was at 09:54 AM ----------

hmm, flash_dump by Rebellos also has problem with 0x17440000 - 0x17C00000 area :?
[Bada Software and Hacking General] Rebellos:
Deadbeef <3

Flash_Read_Data does reading and post parsing data through BML/FSR system (I haven't dived enough deep to say much more about it, but you can find drivers for both BML and FSR in various Samsung's kernels)

oneNAND area is splitted in few different parts, of 2 already known types - normal, raw data and paged system secure data (I'm still wondering why it is so, maybe it gives better error correction or what)

Paged data is physically written in following layout

<page of data>

<page of 0x00>

<page of data>

<page of 0x00>

<page of data>

<page of 0x00>

And so on.

When read by JTAG you'll get it in above layout. When read by Flash_Read_Data (used in dumper FOTA), BML_FSR does cutout all null pages and write solid data buffer to RAM.

You cannot order Flash_Read_Data to read normal and paged data together. It'll hang immediately.

Page size is fixed, it's 0x800 (2KB) on S8500 and 0x1000 (4KB) on S8530

on S8500 paged area is 0x1E700000 - 0x1F500000

on S8530 - 0x1EC00000 - 0x1F500000

Maybe that small unreadable area is locked in BML/FSR table, it seems to support locking certain areas to prevent accidental overwriting during flash.

Adfree, can you post JTAG dump of that area?
[Bada Software and Hacking General] adfree:
I'm paranoid for my own private data... :o

But I think there are many floating around JTAG dumps... try this:

S8500

http://www.filefactory.com/file/ca8402d/n/S8500_0x00000000_512M_RAW.rar

S8530

http://www.filefactory.com/file/ca80ea0/n/S8530_FULL_RAW.rar

Allready known files from here:

http://xdaforums.com/showthread.php?t=898996

Btw.:

I have some problems to compare my own JTAG dumps, as huge areas are different...

Maybe reserved stuff of temporary blabla... for CPU...

I've tried also not to start handset, but no real success.

Many data changed... for instance I'm not able to understand, how Boot is written... via JTAG... not only 0 - bla...

There must some Flags or something other important...

But my before and after JTAG dumps contains several MB different data... :(

Stupid Question. :D

Is this possible to send these Commands in "Upload data to PC" Mode?

Not tested yet... :confused:

Then also maybe bada 2.0 possible... force Error...

I'll try later...

Thanx.

Best Regards
[Bada Software and Hacking General] b.kubica:
should work on 2.0 too - just assembly fota with right header

bada_term hooks DloadProcessPacket function so by now it works only in download mode - but extending it to other modes should be easy (few lines of code)
[Bada Software and Hacking General] mijoma:
About 2.0 we need several things apart from what we had with 1.0/1.2:

- FOTA execution address to be placed at 0x200 offset of the FOTA file

- as we need FOTA enabled marker in the apps_compressed header (F07AF07A) and from what I saw with the so far released 2.0 apps, it's not then we need some plan to do this - 2.0 includes already signature checking of the apps (during download), so we would need to first load some apps that do have that (some 1.2 apps) or to modify 2.0 and download it onto the device before putting 2.0 bootlader there using older bootloader version that did not validate the sig.

Once we have enabled FOTA on 2.0 for the first time we can patch the BL3 in runtime to do whatever.
[Bada Software and Hacking General] b.kubica:
that's odd

I've followed few steps:

download apps v2 fota enabled

download BL v2

download prepared fota

download rc1 v2

fota is very simple - just start download mode but still it's not working - phone starts normally :/

RAM:44000000 loc_44000000
RAM:44000000 B loc_44000204
RAM:44000000 ; ---------------------------------------------------------------------------

RAM:44000100 aFota_engine_ve DCB "FOTA_ENGINE_VER_INFO_2.0",0
RAM:44000100 ; ---------------------------------------------------------------------------

RAM:44000200 DCD 0x44000000
RAM:44000204 ; ---------------------------------------------------------------------------

RAM:44000204
RAM:44000204 loc_44000204
RAM:44000204 mov r1, #1
RAM:44000208 mov r0, #2
RAM:4400020C bl 0x420D8564 ; maxim_charging_control
RAM:44000210 bl 0x420B07E0 ; disp_Dload_User_Init
RAM:44000214 bl 0x42083C44 ; DloadMain

RAM:44280000 aBpdz DCB "BPDZ",0
[Bada Software and Hacking General] sabianadmin:
Ok :) refreshingly honest. if you need help with anything please ask
[Bada Software and Hacking General] mkz14:
I'd gladly donate to you some money mijome:).
[Bada Software and Hacking General] adfree:
This time my tests with all files from XXJL2. :D

1.

I've tried bplib_S8500OpEuro_XXJL2_mijoma_upload.zip

Result black Screen. No reaction on OFF Button. So I removed Battery... then I was able to go back to Download Mode.

No idea if same like Upload, only without Text... but no reaction on Button is different.

2.

I've filled all Data with FF before 1024 Bytes... empty FOTA.

Then I see first time:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

FOTA Engine is not installed

Plz install below FOTA Eng.

(FOTA_ENGINE_VER_INFO_2.0)

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Aha. Never seen before, only read from other users...

But here again you can press OFF several Seconds, then handset restart.

And you can go back to Download Mode...

With my empty file I'll test again XEKC2, if maybe FOTA complete disabled...

Best Regards

Edit 1.

I did several tests...

apps_compressed.bin is again involved... not only Bootloader...

XXJL2 apps_compressed.bin + FOTA Mod = work

change only apps_compressed.bin from XEKC2 for instance, then complete FOTA is ignored. I've tested with my empty file...

I think, this is the reason, why I failed on JE7...

So no waste of time to do this on other Firmware. Only for XXJL2 apps_compressed.bin + BOOT from XXJL2.
[Bada Software and Hacking General] mijoma:
Thanks adfree for that test. Yesterday evening I've noticed that I made a stupid mistake and was looking at the other bootloader (XXJEE) when creating the bplib_S8500OpEuro_XXJL2_mijoma_upload file. I edited my post - renamed the file that was there to represent its contents and added a correct bplib_S8500OpEuro_XXJL2_mijoma_upload2 for XXJL2 with indication this is version 2.

Can you check that one when you have some time?

Thanks and sorry for the mistake.

mijoma
[Bada Software and Hacking General] adfree:
Thank you mijoma

This time it works. :cool:

But now exact this happens. I don't know how to connect. No COM Port...

:confused:

http://xdaforums.com/showthread.php?t=928170

BT? Wifi? Or maybe serial cable?

http://xdaforums.com/showthread.php?t=919569

Upload data to PC sounds nice, but I don't know how to use. :( :confused:

New Ideas about FOTA. :D

- maybe as repair solution... some users have bootcycle and you have no more access with sTune

Maybe possible to set Wave into some Mode where access to filesystem is possible...

- other idea... maybe some tweaks in apps_compressed.bin possible...

Thank you.

Best Regards
[Bada Software and Hacking General] adfree:
I've tested both for hwrev on XXJL2:

hwrev=4258004D

hwrev=0E

Same like Raitis:

http://xdaforums.com/showpost.php?p=12673264&postcount=146

@ mijoma

Can you please add these FOTA files in this Thread?

So we have all files on one place...

I've downgrade to BOJE7 with Bootfiles. And can confirm it works with:

bplib_S8500OpEuro_XXJEE_mijoma_upload.zip

:cool:

Thanx.

Best Regards
[Bada Software and Hacking General] mijoma:
OK. Uploaded.

Anybody with a desire to discover his phone

hwrev

can use the file attached.

It works only with XXJL2 bootloader.
[Bada Software and Hacking General] mijoma:
Another interesting test.

This time we shall completely remove original FOTA code, but jump to normal boot after execution of our FOTA. That, however, shall have one exception - when the phone is powered on while holding the "Call key" (the one that's used for receiving calls) - in this situation, a well known white screen with information of hwrev and keys pressed during power_up.

It shall look like something like this:

Key pressed 0 0

Key pressed 1 0

Key pressed 0 0

Key pressed 0 0

Key pressed 0 0

where the values represent keys as per map below

MENU --- RFU(0)

CALL ---- CAM

VOL_D -- RFU(0)

CAM ---- VOL_U

LOCK --- RFU(0)

Summarizing, The fota file attached should allow normal boot if nothing is pressed during power up and show a screen if you hold call key.

Let me know how that works for you as this shall be important in terms of possibility of executing certain functionality (i.e. boot from SD) based on key combinations.

Remember that the file is intended for use with XXJL2 bootloader only - pressed keys information and display handling is done using original bootloader

Best Regards,

mijoma
[Bada Software and Hacking General] adfree:
Tested, no success. :o

Maybe Call Button is reserved for other Things... :confused:

Maybe Camera Button is free?

But maybe again my fault, wait. Hopefully someone else try and confirm.

Thanx.

Best Regards
[Bada Software and Hacking General] mijoma:
Could describe what happened after you loaded the file - how did the phone behave when started without holding the call key? Did it boot the system normally or you had a black screen?

Second thing is what happened when you hold the call button (along with the power button)? Did the phone boot or not?

Best Regards,

mijoma
[Bada Software and Hacking General] adfree:
Without attached cable

I've pressed first Call then ON.

Hold both Buttons...

Then it looks like Bootcycle... only Wave Logo...

I think I turn it off again with holding...

Other test:

First ON

Hold

Then several clicks on Call...

Same, Wave Logo... then reboot. Again, I think I end with holding ON/OFF Button.

Third test.

Short ON, then I release Button.

Hold Call...

Wave normal starts...

Best Regards
[Bada Software and Hacking General] mijoma:
That's strange. I tried with my friends phone and worked perfectly as I assumed (meaning we can possibly differentiate behavior basing on the key combination). Are you sure you have XXJL2? I'll have to investigate the issue further.

Best Regards,

mijoma
[Bada Software and Hacking General] mijoma:
Do you mean you saw the screen with the hwrev and pressed keys information when starting with holding CALL key, and normal boot when you started without holding anything?
[Bada Software and Hacking General] nbates66:
i've got success using your last FOTA file mijoma, i'm using an XXJL2 firmware but had to update the bootloader with the XXJL2 booloader that you linked us to, holding call and power buttons gets the white screen with hwrev and the button pressed text, power button alone boots as normal.

hwrev = 0E
[Bada Software and Hacking General] adfree:
:o

Sorry, my fault again. I jump often between different Firmwares...

So I have forgotten to update back to XXJL2 Boot. :o

It's no sabotage. Only dumb mistake from me. :p

mijoma_dummyFota_XXJL2_rev_key.zip works. :cool:

Thank you very much.

Really good work.

Maybe next step to start something from SD?

Text file? To show other message?

Best Regards
[Bada Software and Hacking General] adfree:
During Logging "Boot" I saw something like that:

/User/Mass/SyncML/Fota

At this time I can't find this folder...

Will try to digging deeper...

Hmm. Correction. I found empty file FotaStatus.txt in such folder.

But maybe hidden folder...

Best Regards

Edit 1.:

I mean maybe for first test(s) internal Memory is "easier" to handle instead access to SD card.
[Bada Software and Hacking General] adfree:
/User/Mass/SyncML/Fota/.bplib_apply.backup

/User/Mass/SyncML/Fota/2400258.cfg

/User/Mass/SyncML/Fota/Fota_Update_Needed.txt

/User/Mass/SyncML/Fota

/Media/Others/delta.bin

/Debug/Fota_Language.txt

/Debug/PfsFlag.txt

/User/tfs4SharedQuotaGarbageFile

Several other folders in FOTA file... so i think FOTA has access to these folders/files.

Maybe for test it is "easier" to use internal Memory to inject "Android Starting Code".

Maybe SD Card access is locked by some "funny" Security thingies...

Best Regards
[Bada Software and Hacking General] mijoma:
No, it's not this. The FOTA bootloader code (not called from user mode after system boot) is basically the very same, including all permissions as the rest of the bootloader. Calling FOTA code is done though just jumping there. No additional security layer or anything. If you look at original FOTA code you'll find that it implements all the same as the bootloader (i.e. it does the authentication of components that were downloaded over-the-air), so you can do exactly same stuff.

The problem with mounting SD is rather of different nature. It's a bit easier to analyse what's the execution flow than actually use existing bootloader code in the right way. It's not rocket science, but requires time that I don't really have plenty of.
[Bada Software and Hacking General] adfree:
:D

Not for you, but for me.

I can only press 1 Button... but then higher chance rocket will explode. :eek:

My brain is only able to read Text Strings like folder names or something similar...

Best Regards
[Bada Software and Hacking General] Rebellos:
Ahoy!

I must say that i'm total beginner in RevEngineering mobile systems. I'm more experienced in x86 and higher level than kernel things.

But, bought Wave II a week ago, I know its hardware is almost the same like Galaxy S. So I thought "would be fun if boot Android on Wave", here I come.

As the most advanced thing i achieved with ARM machine was updating my HTC Touch system, got some questions to you to start messing around with Wave.

As far I understand the biggest problem here is walking around the boot loader Samsung protection.

So, what tools do I need if I want to inject my own bin code into FOTA mechanism? Do I need to do it by modded firmware update, modifying update file from samsung? How to get this "basefile" if my Wave II soft seems to be the updated?

What is JTAG? Is it some kind of external machine using internal phone pins to directly interact with chipset or what?

What is Download Mode? Is it firmware update mode? Is it possible to update everything throught it (including bootloader) or just "normal" OS files?

What kinds of memory have we got in and what its used for? We got RAM, CPU registers, flash NAND memory (do handset store all data, including bootsectors here or somewhere else) , eventually SD card, and... is there something more or did i confused something?

Or, in other words, I love experimenting, so please just tell me what better NOT to do and what safe-fail routines the phone does if bootloader update fails, I'm conscious that it's easy to break up the handset while updating bootloader and it's possible to recover it only by external interference into flash mem, is it possible to break it by updating other (OS/kernel) files? Or in the worst way update mode is always handled by bootloader (is it?) and I need reflashing to bring back the functionality?

Searched around abit, so if I get it right firmware updater checksum almost every file insite update pack except the eventual FOTA ones, which allows to redirect control flow from bootloader to our own code.

Do you think there is a big chance to make my Wave II useful only as paperweight if I start to mess with its internals while being careful? (I know, it's kinda mutually exclusive)

Sorry for so much questions. Thanks in advance if anyone bother answering that, probably almost noone would care to read book I had written. Won't cut myself if you blame me for trying something i totally don't get. But imo everyone starts like that or worse. I'm happy to see lot of advanced guys who can help me, of course if you want to.

Regards
[Bada Software and Hacking General] mijoma:
Can you provide a link to the apps file you used? I'd like to have a look and confront Fota_check code from 2.0 bootloader.
[Bada Software and Hacking General] b.kubica:
S8500XPKH3 - http://hotfile.com/dl/127456217/677969d/S8500XPKH3.rar.html

fota enabled at standard 0x134 + 0x420

---------- Post added at 03:01 PM ---------- Previous post was at 02:44 PM ----------

bada 2.0 has changed program headers VirtAddr from 0x40CF5000 to 0x40AF5000 so the GetBuildInfoRegionOffset can't find valid offset when old apps is present.

The only possibility I see is to load fota enabled apps ver. 2 with old bootloader as you mentioned before, then replace old BL with new one and download fota what I did already with no success...
[Bada Software and Hacking General] b.kubica:
are you sure about that? I was pretty sure it starts at 0x42080000, but that fota didn't work for 2.0 and I saw your post.

Now I reversed BL2 again and still I get this value - 0x42080000

BL2 from 2.0:

ZI_clear:
str	r2, [r0],#4
cmp	r0, r1
bne	ZI_clear
mov	r0, r8
bl	OEMInitDebugSerial
bl	LoadBL3
mov	r0, r8
bl	CheckBL3
ldr	r0, =0x42080000 ; jump to BL3
bx	r0

and part from BL3 2.0

TEXT:42080070	VMSR	FPSCR, R0
TEXT:42080074	LDR	R0, =StartUp
TEXT:42080078	BL	System_WaitForInterrupt_end
TEXT:4208007C	BL	System_EnableVIC_end
TEXT:42080080	BL	System_EnableIRQ
TEXT:42080084	BL	StartUp_end
TEXT:42080088	BL	__main

...

TEXT:420800A0 off_420800A0 DCD StartUp ; DATA XREF: ResetHandler+54
; 420800A0 00 00 08 42 00 00 0F E1 1F 00 C0 E3 D2 10 80 E3

:confused:
[Bada Software and Hacking General] larioteo:
Note: It is only a question not a punishment in your work guys! I respect this project and your work.

Have you guys maybe forgooten something important?

I know that my Wave II is like dead (black screen) after i am going in lock mode, it wont wake up if you dont flash bootfiles with the firmware. It could be caused in combination of the fota file, dont know it 100% but this error you can easy rebuild.

For Wave II users it seems to be not a good solution.

I understand that this all is working and doing its job, but maybe it is better to understand the whole bootloader, so some possible bugs in bada itself could be sovled. Reverse engineering has some bad parts behind it, never the whole code will be to 100% decodet and understand.

Regards
[Bada Software and Hacking General] mijoma:
We were both right and both wrong as we were looking at different versions of 2.0 and the addresses seem not to be the same throughout the whole line.

After I downloaded the XPKH3 from your link I finally understood that. I've been analyzing XXKG5 and there's a significant difference there - it starts BL3 at 42180000 while XPKH3 does indeed start from 42080000. I'll have a look what's with that FOTA in KH3.

Edit: After checking apps compressed, FOTA magic is not there by default - do you add it? When you add that manually and reencrypt does the file flash without problems?

Edit2: OK, I've read your post once again. I don't see where might be the problem that it doesn't run. The only thing that run through my mind is that maybe, for some strange reason, you are starting the phone (or better to say - it starts itself) in some strange mode and FOTA is not checked.
[Bada Software and Hacking General] b.kubica:
I modified apps in different way now. I put 0xF07AF07A at 0x554 and additionally at 0x420.

Now even if apps v2 is flashed old bootloader is able to load fota - GetBuildInfoRegionOffset() + 0x420 + 0x01100000 = 0x01100420
[Bada Software and Hacking General] b.kubica:
LOL, what a stupid copy/paste error - disp_Dload_User_Init() is not the same as disp_Dload_Init() ;)

first one load samsung logo from rc2, 2nd one display old style Download mode text so when I see logo I was thinking apps is launching :D

now I noticed it display that logo and nothing more - we're in dload mode! - what I want to achieve :)

thanks for your help

regards,

Bartek
[Bada Software and Hacking General] baza14:
SamFirmware got Wave 3 ROM. Size is 360 MB and there is FOTA file. See it here http://lockerz.com/s/142928550
[Bada Software and Hacking General] MrManson666:
What does that mean exactly for Android development?

There are still the driver problems, aren't they?
[Bada Software and Hacking General] anghelyi:
Driver problems? Yes, there are. But if it has FOTA, then most probably we can dual-boot android with it!
[Bada Software and Hacking General] mijoma:
I'd say that even with the current versions of the 2.0 firmware (that don't have FOTA marker enabled in the apps_compressed header) we can easily achieve dual-boot. We're also far enough to slowly think about moving to our own bootloader supporting several OSes (we need to still bear in mind that they won't fit the OneNAND at the same time).
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?p=18330544#post18330544

I've made new Thread about bTerm.

I think this is usefull/powerfull. :cool:

But I have not tried all features, as I have not understand all. :o

Btw.:

Now my S8530 is arrived... not powered on... :confused: but maybe easy to fix...

Then I can try also few things with S8530. :)

Best Regards
[Bada Software and Hacking General] civil.scholar:
is it possible to edit bootloader to load system fonts from another place such as factoryfs ?
[Bada Software and Hacking General] Rebellos:
No. Partitions are being mounted and fonts are loaded by Bada system, not by bootloader.
[Bada Software and Hacking General] glinsonaj:
after following the guide provided form xda developers for android booting,its still going for bada,i have S8500DDJE7 , so can u tell me how can i do plzzzz......... u hav any video tutorials ...
[Bada Software and Hacking General] adfree:
For Android check this section:

http://xdaforums.com/forumdisplay.php?f=1203

Here are support and many Tutorials...

S8500DDJE7

Is this Version for India?

No idea if Bootloader is different... but it is allready posted as supported:

http://xdaforums.com/showpost.php?p=15036616&postcount=275

Also possible, other Bootloader (Version) is on your device...

Best Regards