yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
Short successfully tested with S8600XXKJC RC1 file.

Thanx.

:cool:

Step 1.

Decrypt with Wave_Remaker

Step 2.

Use TriX

Because I forgott step 1... I was wondering 2 times why not finished. :o

At this time only S8600 seems more "encryption"...

Best Regards

Edit 1.

Also successfully extracted with Wave_Remaker_New_0_1_2.exe other S8600 files easily:

FactoryFs_S8600_Open_Europe_Common.ffs

ShpApp.app

First attempt with CSC seems failed...
[Bada Software and Hacking General] b.kubica:
csc ís more complex

2nd not compressed part easily can be extracted with TriX and fs_shell script

1st part, the compressed one, first cut 0x1000 bytes at the very beginning of csc file, then use TriX to decompress it, save as org file and use Wave Remaker to extract as rc1.org :)

more will later, I'm on wave now ;)
[Bada Software and Hacking General] lasentenza:
Just try to decompress s8500 rc1 file with trix, made .org file then extract it with wake remaker and it works!!

Great work :D
[Bada Software and Hacking General] adfree:
CSC_S8600_Open_Europe_Common_OXAKJB.csc

I have cut the encrypted part from 0xFC2060...

You can read short before text CSCF as Unicode... C_S_C_F is visible...

Then I've used Wave_Remaker to decrypt... and then I was to lazy. :D

But I saw the DCB: text string... and searched little bit around... with HEX Editor.

S8600 seems all files are encrypted with TkToolVer:2.0.0

S8500, S8530 and the other prior bada handsets only boot_loader.mbn and apps_compressed.bin are encrypted by TkTool...

Funny is, that not newer or different Algo. :D

But it seems at tail/end is something different... :confused:

I've ever used to disable MD5 check as orientation 0x060000000200000002

Now minimum 0x06 is not more... :confused:

Not tested... I have replaced complete last 1024 Byte by old known stuff.

To flash RC1 from S8600 in my S8500...

Best Regards
[Bada Software and Hacking General] alex932109:
ho1od, привет. Через твою программу я распаковывал Shpapp (Dump file), заменял пару файлов и сохранял это всё как новый Shpapp. Потом прошивался новым файлом. Сейчас нужно проделать те же операции над файлом rc1 из прошивки Bada 2.0 s8500MBUKI1. Беда в том, что при попытке Dump file программа выдаёт ошибку. Вобщем вопрос: реально ли сейчас открыть файл rc1 через вашу программу и заменить в нём некоторые файлы? Если нет, то может посоветуйте пару других способов, как это сделать. Пытался собрать файл из распакованных файлов, которые давал adfree 2 страницы назад, но размер полученного файла сильно отличается от оригинального.
[Bada Software and Hacking General] ho1od:
Распаковать то можно, сейчас это делает TriX, несколькими постами выше это описано. Ремейкер тоже скоро это будет делать напрямую, думаю к выходным отлажу все. Но останется проблема обратной запаковки. Написание программы запаковки займет много времени. Поэтому пока ничем утешить тебя не могу.

Sorry for the Russian
[Bada Software and Hacking General] Rebellos:
Thank you. They had to release compileable source of the WebBrowser, so they had to include Bada headers, they cut out everything what was unneeded but still. Interesting things, giving one more sight on Bada Platform structure.

And btw, just take a look how old that system is, as example NvMgr header, one of the tasks to manage internal system settings in Bada:

/*
* Mocha
* Copyright (c) 2000-2003 Software Center, Samsung Electronics, Inc.
* All rights reserved.
*
* This software is the confidential and proprietary information
* of Samsung Electronics, Inc. ("Confidential Information"). You
* shall not disclose such Confidential Information and shall use
* it only in accordance with the terms of the license agreement
* you entered into with Samsung Electronics.
*/

/*:Associate with "Non-volatile Manager" */

The same source bases had been used in S8500/S8530.

Please, get me more if you can. ;d
[Bada Software and Hacking General] Tigrouzen:
okay let's try some search about it !!!

Also SMRP(SAMSUNG Mobile Reference Platform) its the best sdk we can have !!!

There's big one samsung original SMDKs5v210

http://oopik-inc.com/george/Samsung Android/
[Bada Software and Hacking General] adfree:
:)

Please.

Maybe someone has time to research Algo for IMRC compressed RC1.

http://xdaforums.com/showthread.php?t=912728

Thank you very much.

Best Regards
[Bada Software and Hacking General] Tigrouzen:
About IMRC ?
[Bada Software and Hacking General] adfree:
IMRC is Header of "prior" used Compression Algo for RC1... XXJB6 and XXJC5 for instance...

But IMRC seems not dead, other Samsung models use this too...

Now we have QMD humanreadable... first 3 Bytes.

But I wished I could see JB6... if not on my S8500, then partial...

Best Regards
[Bada Software and Hacking General] Tigrouzen:
Remember now thank.
[Bada Software and Hacking General] ho1od:
The source code routines decompression bada2 RC1

thank you b.kubica
[Bada Software and Hacking General] ho1od:
Update 0.1.3

Added RC1 and CSC bada2(8500) view
[Bada Software and Hacking General] b.kubica:
hi,

do you think about rewriting some parts of code in pure C?

I compared seed decrypt/encrypt routines and the result was real awesome - decrypting S8500XXJID apps with latest Wave_Remaker_2_0_1_3 took 122 secs against 5(sic!) seconds using pure C! Anyway, seed routines are quite simple, no overflow or other error should occur

the result should be better but because of array<unsigned char> <==> unsigned char conversions (2 for loops)

testing qmd now
[Bada Software and Hacking General] ho1od:
Thank you, it is better :)

pure C decrypt apps_compressed.bin S8500XPKH3 delta TickCount: 0x58F

managed C++ decrypt apps_compressed.bin S8500XPKH3 delta TickCount: 0x5EC

Full project attached. Thanks for all
[Bada Software and Hacking General] Nov4Chas3r:
Hi all! :)

I'm a noob, so forgive me in advance, but I would like to know if will there be a way to recrypt Wave Lite's RC1. Coz' if we don't get bada 2.0, only chance will be modding.

Thanks, keep up the excellent work. :D

Regards.

Nova
[Bada Software and Hacking General] adfree:
Tested S8500XPKJ1 with Wave_Remaker 0.1.3

Seems all files are successfully compatible, no changes... :cool:

Thanx.

Best Regards
[Bada Software and Hacking General] mylove90:
Except *.RC2 files

saved file can't be flashed with Multiloader 5.67

Best Regards
[Bada Software and Hacking General] lasentenza:
Same for me with rc2 file.
[Bada Software and Hacking General] Tigrouzen:
Ist hash pass check problem ;)
[Bada Software and Hacking General] adfree:
Short tested with S7250DJPKJ3...

RC1 and CSC seems not run...

Best Regards
[Bada Software and Hacking General] ho1od:
necessary to decrypt
[Bada Software and Hacking General] b.kubica:
deleted........
[Bada Software and Hacking General] adfree:
I'm pretty sure I did it with RC1... decrypt first...

Maybe my fault, CSC not decrypt before. :o

I'll try TriX now with RC1 and then again Wave_Remaker...

Best Regards

Edit 1.

Same decrypted RC1 file saved as:

RC1.bin

TriX = yes

Wave_Remaker = no reaction...

My fault, I forgot important fileextension. *.rc1 or if decompressed too, to save as *.org

Next time I'll try to open my eyes. :D

Edit 2.

RC2 encrypted too... but after decryption. :D
[Bada Software and Hacking General] adfree:
Again about RC1...

Found uncompressed files... not sure because filesize, but startet with smallest...

73616D73756E6720687474703A2F2F
samsung http://

15 Byte in xt9mdb.dat in KD6 RC1

Will search for more...

Again idea to inject uncompressed files into RC1... :o

Best Regards
[Bada Software and Hacking General] smarty99:
Cant sign rc1 file

i must say that the tool is great

it works great and really helps

but maybe I am doing a mistake - or pls help ...

i just cant sign the Rc1 file - i have decompressed it

and wants to use the multiloader

and the wave remaker -i press to sign the file and waits and waits

and nothing happens... why ??????

btw - using the latest beta firmware for s8530
[Bada Software and Hacking General] meero:
Thanks for the share!
[Bada Software and Hacking General] adfree:
Wave_Remaker can only 1 direction... not both.

Decompress is possible for RC1

For handset you need mandatory compressed RC1...

No known Tool for compress data for RC1 nor apps_compressed... :o :(

Hopefully 1 day in future.

In other words. You can NOT create valid RC1 for handset... only for bada SDK... for study.

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=19550093&postcount=46

Meanwhile I try now to understand more about the first 256 Byte of RC1...

Maybe chance to set Compression OFF...

I've found KH2 and KH3 QMD part in CSC ... same first 256 Byte...

I'll try to decompress and then compare... Maybe same filesize... :confused:

Best Regards
[Bada Software and Hacking General] adfree:
It seems XXKK5 has working OTA update...

Around 5 MB is received...

http://xdaforums.com/showpost.php?p=19656749&postcount=11

This means, handset can decompress AND compress.

Maybe "we" can do now more with FOTA.

Best Regards
[Bada Software and Hacking General] adfree:
In theory I think S8500 create new apps_compressed file in handset.

I'm self not able to update from KK5 to KKV over the air... :o

I hope b.kubica will release new bTerm with FOTA for KK5...

http://xdaforums.com/showthread.php?t=1298950

Please. :)

Then maybe we could investigate, how OTA Update work... dump and compare.

Best Regards
[Bada Software and Hacking General] mylove90:
Huge success for Wave Remaker with S8500XXKK5

CSC , RC1 , RC2 , FFS , Shpapp all extracted !!!!

Is Samsung lowering its defense or giving us a chance to mess around for a while ?!!!

Best Regards
[Bada Software and Hacking General] adfree:
KKV is nice...

Because only 1 Byte change. Maybe helpfull for Compression Algo for apps_compressed.bin.

S8500XXKK5
S8500XXKK[B]V[/B]

Will upload soon dumped apps_compressd here:

http://xdaforums.com/showthread.php?t=1363328

Decompressed with TriX... many thanx. :cool:

Best Regards
[Bada Software and Hacking General] ho1od:
update 0.1.4

Only for test

Added view all files in one window

Added view .rsr files
[Bada Software and Hacking General] lasentenza:
Hi Ho1od,

Is it possible to have the CSC file from S8600 please??
[Bada Software and Hacking General] ho1od:
Oh, I forgot about this phone. Tomorrow it will add support
[Bada Software and Hacking General] adfree:
Thank you very much for *.rsr few. :cool:

So it is much easier to handle for research.

Best Regards
[Bada Software and Hacking General] litebass2:
We can edit the .rsr file and save the file?

or it just for view?
[Bada Software and Hacking General] ho1od:
After a day or two will be ready to edit. Now viewing only

But without the compression routines that do not need to

Do you think it's not necessary?
[Bada Software and Hacking General] lasentenza:
Hi Ho1od,

I have a new request! lol

I know you work a lot on your tool but can you look why we can't add apps on the latest version of shpapp please?

We got bootloops after modifying it :(
[Bada Software and Hacking General] adfree:
You could try to activate Mid or High Debug Level for investigation...

I think it is because some list... where Apps are stored...

You have to modify this list...

I am too lazy at the moment to mod Fw files... maybe later...

Best Regards
[Bada Software and Hacking General] ho1od:
need to explore new protection used in the firmware
[Bada Software and Hacking General] navinng:
What does the signature.xml file in apps do? Its really different in the KK5
[Bada Software and Hacking General] ho1od:
update 0.1.5

Only for test

Added correct view of national languages
[Bada Software and Hacking General] szb314:
it works now :D

001 -- ZCJG2

002 -- XAKJ1
[Bada Software and Hacking General] adfree:
:cool:

Thanx, short tested with KK5 CSC from S8530.

Nice, so I can better understand.

Best Regards
[Bada Software and Hacking General] ho1od:
We have a cool team. With your nice work guys :)
[Bada Software and Hacking General] ho1od:
update 0.1.6

Only for test

Added Save .app, .ffs, .pfs files

Added Save as .org files
[Bada Software and Hacking General] litebass2:
thank you..

how to save ? just drop files?
[Bada Software and Hacking General] civil.scholar:
frome file menu ;)
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=19852430&postcount=43

For Language names, maybe we could take what Samsung wrote into:

IDS_COM_OPT_INPUTLANGUAGE_

:confused:

I've tried to make overview for all 11 languages in KK5 OXA...

Best Regards
[Bada Software and Hacking General] adfree:
Not sure if I am the problem with my 0 size files.

Latest Version not create my modified *.org... something is missing.

0.0.8 works fine. :cool:

I'm on XP.

Thanx for reading.

Best Regards
[Bada Software and Hacking General] ho1od:
OK, I'll understand
[Bada Software and Hacking General] ho1od:
ORG file always have the root directory "System".

For build the file SistemCSC need another procedure, I'll do this later

I have a work plan: first - editing the RSR, the second building the not compressed CSC
[Bada Software and Hacking General] ho1od:
update 0.1.7

Only for test

Added edit .rsr files

To remove the language - click the right mouse button. In the context menu, select delete

For editing - click the left mouse button, edit, press Enter

To save from the File menu - select save changes.

:)
[Bada Software and Hacking General] litebass2:
ohhh thank you!!!

we still can't add more lang ,just to edit Existing language and delete yes?
[Bada Software and Hacking General] ho1od:
Add language = Change ID language + Edit strings.

I'll do this later
[Bada Software and Hacking General] litebass2:
O.K..and again thank you :)
[Bada Software and Hacking General] adfree:
At the moment I'm trying to reduce/remove languages...

From 11 to 4...

2 as "placeholder"...

My order is:

0-1-5-3-2

English-Nederland-French-German

Most *.rsr follows this order except for instance:

NavigationMobile9.rsr

Biggest file...

I have problem to remove languages...

Wave_Remaker crashes... only by NavigationMobile9.rsr

Will try again.

Best Regards

Edit 1.

Maybe NavigationMobile9.rsr is not only big file... maybe strange, because empty 0 field right/end... :confused:

I'm started from last one, then saved often... then success. :D
[Bada Software and Hacking General] ho1od:
update 0.1.8

Only for test

Added bug fix for null pointer of languages (for example NavigationMobile9.rsr)

Added Editing CSC (Save as non compressed CSC)

thank you b.kubica

CSC file is created only for S8500-S8530 (not S8600)
[Bada Software and Hacking General] alex932109:
Hi, holod. I have unpacked csc file from Wave M with Russian and Ukrainian languages. I dump csc from XXKK5, replace files in CSCrcs\SystemCSC\IME\OpEuro\XT9 and SystemCSC\String. After that I save all as non compressed CSC. But when i try to flash, i get this error in Multiloader:Can not open: CSC! What the problem is? Thanks.
[Bada Software and Hacking General] ho1od:
update 0.1.8.1

Only for test

bug fix for correct view CSC from S8600
[Bada Software and Hacking General] civil.scholar:
yesssssssssss

thank you :D now it works correctly
[Bada Software and Hacking General] ho1od:
I think it is not correct MD5 hash

I'll fix it
[Bada Software and Hacking General] adfree:
Please.

Maybe export *.rsr to *.txt or *.xls

This could be helpfull for searching words...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] ho1od:
The standard function MD5 hash from NET Framework, not work properly with the CSC file.

I returned the old function, found in multiloader, now signing correctly. But the saved file is cyclic rebooting. I will investigate further.
[Bada Software and Hacking General] ekhalid:
Deleted by me.

Solution found ;)
[Bada Software and Hacking General] ho1od:
update 0.1.9

Only for test

Bug fix for correct sign CSC

Bug fix for cyclic rebooting

:)

I have test it

Today was a good day, three update :)
[Bada Software and Hacking General] ekhalid:
Deleted by me.

Solution found: do not ask anyone ;)
[Bada Software and Hacking General] adfree:
I think it is an good or "better idea" to wait...

waiting for FINAL, OFFICIAL Release of bada 2.0 Firmware for S8500/S8530...

If someone crack Security now for Apps, also for apps_compressed.bin... :eek:

Samsung could improve Security then... and we wait long, longer, maybe much longer... :(

As Samsung must fix Security hole again...

Better use Wave_Remaker for Research (Analyzing Firmware)... learning ...

We have now so many things, where we can be creative to improve some functions/features...

Please. Don't be only an Copy & Paste Hero... :p

Thanx for reading.

Best Regards
[Bada Software and Hacking General] ekhalid:
I'm not a copy/paste hero and I did not ask for help to you, OK?

Do not tell me what i have to do?

I defended you for a real on sammobile for "copy and paste" for your TUT (productname change).

thanks to me if you have SSH active ;):mad:

Edit: Fair play.
[Bada Software and Hacking General] adfree:
@ ho1od

Please.

Since Version 1.8 last language in *.rsr few is also gone.

Not only NavigationMobile9.rsr

Now in KK5 only 10 instead 11 languages visible.

Thanx.

Best Regards
[Bada Software and Hacking General] ho1od:
Plz upload it file
[Bada Software and Hacking General] ho1od:
Thank you for testing. I'll deal with this
[Bada Software and Hacking General] adfree:
*.dcf is AES128... DRM since bada 1.0

http://xdaforums.com/showthread.php?t=1345375

But I think it is not the right time to crack Apps Security on Beta Firmware... in public.

Please wait, if Final Firmware Release is available.

Maybe january 2012 or later...

Best Regards
[Bada Software and Hacking General] ho1od:
OK my friend :)
[Bada Software and Hacking General] adfree:
@ ekhalid

Maybe you want remove your IMEI? ;)

Check you post and overwrite your IMEI... next time more caution...

Best Regards
[Bada Software and Hacking General] ho1od:
Thank you very much b.kubica. From its source code decompression is much faster. ;)
[Bada Software and Hacking General] b.kubica:
you're welcome :)

seed routines are also very fast. in TriX decrypt + decompress apps 2.0 take only 5 seconds :)

still on time to publish updated version but now with new Wave Remaker and option to save csc and rc1 it's not necessary :)
[Bada Software and Hacking General] ho1od:
Wave Remaker have Seed routines from you, now. Thanx :)
[Bada Software and Hacking General] KrazyKong:
Thanks ho1od for a great little tool.

Quick question, when using Wave Remaker with the XXJB6 firmware (the earliest version of the Wave 8500 firmware), it seems to be using an older or different compression system. Can you make it work so that we can open the .CSC file from XXJB6?
[Bada Software and Hacking General] ho1od:
update 0.2.0

Only for test

Added QMD routines from b.kubica

Added tooltips wish file size

Added few bug fixes

Thank you b.kubica
[Bada Software and Hacking General] ho1od:
update 0.2.1

Only for test

Added bug fix drag and drop files and folders to left treeview

Added drag and drop files and folders from right treeview to left treeview
[Bada Software and Hacking General] alex932109:
Hi, holod. How I can delete full row in rsr file? It's very important for translating to Russian. I need to delete marked row: http://savepic.su/978013.png
[Bada Software and Hacking General] mylove90:
Hi Alex

nice to see you here :)

thanks for the keyboard translation to russian...it was a good first step

to delete a language from rsr file press right click on its column and press delete this language

This will take a while if you are ripping-off language from SDK files because languages are too many

it is nice to see you here again :)

Best Regards
[Bada Software and Hacking General] ho1od:
He asked about the deletion of rows

I uploaded him a new update with these features
[Bada Software and Hacking General] b.kubica:
could you add option to save rc1 as noncompressed rc1? Now only org option is available :)
[Bada Software and Hacking General] ho1od:
Ок, after a few hours
[Bada Software and Hacking General] ho1od:
update 0.2.2

Only for test

Added save as non compressed rc1

Added deleted row (edit rsr)

Added export language to txt file(edit rsr)

Added import language from .txt file (edit rsr)

Added few new bugs :)
[Bada Software and Hacking General] litebass2:
Added save as non compressed rc1

also for bada 1.2

?
[Bada Software and Hacking General] ho1od:
Yes it and for bada 1.2
[Bada Software and Hacking General] navinng:
can we edit rc1 and flash it with multiloader now...or does it need to be compressed to work with multiloader???
[Bada Software and Hacking General] litebass2:
But the file is grow up from 50MB to 100MB
[Bada Software and Hacking General] ho1od:
I tested it only with bada2, I have not bada1.2
[Bada Software and Hacking General] b.kubica:
s8500 reserve 111MB for rc1 in 1.2 ;)
[Bada Software and Hacking General] litebass2:
If you can do something with it I would be most grateful :o
[Bada Software and Hacking General] b.kubica:
but there is nothing to do - file is big but still is valid
[Bada Software and Hacking General] litebass2:
Its not valid I can't flash it...err Rsrc1 Erase ...
[Bada Software and Hacking General] Tigrouzen:
Its not file error but adresse to RC1

Something wrong in your bin adresse to erase right nand adress for rc1
[Bada Software and Hacking General] litebass2:
but the max size for rc1 it's 65MB no?
[Bada Software and Hacking General] adfree:
0x19800000 bada 2.0 RC1 for S8500

0x4800000 bada 1.x

Check this out...

If you use Multiloader ETC, you could enter address...

Best Regards
[Bada Software and Hacking General] Tigrouzen:
Have you got message like "Nand Size not correct" ?

If not then its in your file have wrong adress to find right Rc1 place to erase first it on Hardware and after he wright in.

Maybe you mistake with S8530 and S8500 file ...

cause this error its happen when you use other firmware for your hardware. Like if u try to flash S8500 RC1 to S8530

Or if you use different version of your firmware like XXK5 Rc1 and XXK7 Rc1 can be differente adresse

all about this information adress i remember its on bootfile or amss, im not sure..

Also you make .org uncompressed ?
[Bada Software and Hacking General] litebass2:
I had this message when my rsc file (for bada 2.0.1) was over 30MB

when I replaced some fonts it was O.K..

and now I take the rsrc1 from S8530JPKG1, dump it and compress it

and try to flash and I get the error...

when I flasg the source without dumping it o.k and no problem.
[Bada Software and Hacking General] Tigrouzen:
JPKG1 its BADA 1.2 ?

Then i cant told you Ho1od say's he deosnt use BADA 1.2 for test but Bada 2.0

Cause we advance and better works on newer firmware...

if i got a time i can do test and tell you but im on BADA 2 tommorow maybe
[Bada Software and Hacking General] litebass2:
yes its bada 1.2..

I work in parallel on bada 2.0.1...

I just wanted to check if we can change somting in rsrc1 file from bada 1.2...
[Bada Software and Hacking General] Tigrouzen:
Realy i dont test any firmware from Bada 1.2 but maybe i remeber Arabic firmware are more complexe...

Did you try another firmware from Bada 1.2 just for know if same ?
[Bada Software and Hacking General] litebass2:
yes..but also the same problem with rsrc1...maybe the compression diffrent from bada 2.0 firmwares..
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=20179615&postcount=362

Check Multiloader... bada 1.x and bada 2.0 uses DIFFERENT adresses.

I have also yet no time to check bada 1.x ...

Yes, Compression is different... but not confirmed if all parts...

Best Regards
[Bada Software and Hacking General] litebass2:
Sorry, I did not notice your message ..

Well, thank you very much .. Now I understand