yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] mylove90:
a request for ho1od

can you please examine S8500XXJB6 and make your tool able to extract it??

trix can't do it so if your app could it will be super

any file from that fw will be enough for me
[Bada Software and Hacking General] adfree:
Meanwhile for XXJB6

http://xdaforums.com/showpost.php?p=11070379&postcount=5

To extract *.img take an while... :o

I do it for every Frame from 48 + 1 Pics... via WinHex.

Best Regards
[Bada Software and Hacking General] ho1od:
Where can I download S8500XXJB6 ?
[Bada Software and Hacking General] xator91:
Here friend: http://netload.in/datei0M2CPM5V3x.htm

Best Regards, XaToR BadaItalia
[Bada Software and Hacking General] ho1od:
Update v 0.0.2

New features:

View images in a file RC2

Replacing images in this file. The file must be BMP 24bpp format

Change debug level

The program can be downloaded in the first post
[Bada Software and Hacking General] astrotom:
I used your tool to create a custom SHPApp.app file. But I think multiloader checks the MD5 hash and does not enable me to upload it to the phone. I have read adfree's post on disabling it but I couldn't understand him. So if you could help me in detail, I would be grateful.

Thanks.
[Bada Software and Hacking General] ho1od:
I tested the program and flash the modified files via multiloader V5.64. Everything works fine. Upload your file and give me a link, I'll check it

PS. Signature at end of file, it is not MD5 hash, this is another hash function. I disassemble it from multiloader and inserted into the program. The file is signed correctly
[Bada Software and Hacking General] astrotom:
One doubt. Will I have to extract and recompile using your software itself? Because I had extracted the software earlier using trix. So maybe that's making your software not sign it correctly? Also I don't see how I can extract amss and csc files with your software. When I select on your AMSS and CSC tabs, there's nothing. I can't find the fie button which is there on the FFS, PFS and SHPAPP tab.
[Bada Software and Hacking General] ho1od:
I can make a separate menu item, for signing the files created in Trix. If need be.

Working with CSC and AMSS files will be in next update
[Bada Software and Hacking General] ho1od:
For study CSC dump _http://files.mail.ru/2GXQWO
[Bada Software and Hacking General] lasentenza:
Well done it works!! Thanks :D
[Bada Software and Hacking General] ho1od:
New update 0.0.9.2

Added Wave3 CSC (Second part) view

Added Wave3 RC2 view
[Bada Software and Hacking General] adfree:
0.0.9.2 works under Win 7 hom_ :D

Successfully tested with:

CSC_S8600_Open_Europe_Common_OXA.csc

FactoryFs_S8600_Open_Europe_Common.ffs

ShpApp.app

Rsrc2_S8600(Mid).rc2

Thank you very much.

Best Regards
[Bada Software and Hacking General] ekhalid:
Hi,

How can i re compress apps_compressed.bin ?? so we can modify it!

Thanx
[Bada Software and Hacking General] Rebellos:
You can't, unless you have QuramD compression software or someone reverse whole QMD decompression algorithm and release soft.
[Bada Software and Hacking General] ~MaX~:
can anyone tell me how i can extract files from an *.app file after i opened it with wave remaker?
[Bada Software and Hacking General] alex932109:
How to install polaris office?
[Bada Software and Hacking General] ekhalid:
PolarisOffice: 06cm35xl2f.zip (18.2 MB)

You have to add it in shp.app (OSP/Applications/) with Wave_Remaker.
[Bada Software and Hacking General] ho1od:
In the directory where the Remaker, "Bada" folder is located, it contains all the extracted files.
[Bada Software and Hacking General] ho1od:
You can drag and drop this folder
[Bada Software and Hacking General] ekhalid:
Yes.

Are you seen my question here: http://xdaforums.com/showthread.php?t=1294406

Please Ho1od, if you have a solution... it's very important to replace so files ;)

Thanx
[Bada Software and Hacking General] ho1od:
You want to generate a new certificate to be signed. SO files?
[Bada Software and Hacking General] ekhalid:
In the same file there is one signature for each file, for exemple:

<File>
<Name>MediaPlayer.so</Name>
<Signature>pi03XWj5ImqKtMV13ZRVsZr8SCNR9swYliHSNtKRozzCoHQcnhEnWok/yZi91cCBsUAAPbjb6XNvl9Vw4+MjRv0l7Y6VIw9imRhn2mw+Nz1qI9MwYUUtLQv40Z9ZF2UnLJaJcbiYkNsJ2CvGkwSIf7xQADelzjlgAUhPgKLSSx4=</Signature>
</File>

and in the end of file we have a certificate of all of these signatures like this:

<certificate>
MIICXzCCAcigAwIBAAIJANlIO6NaFoBzMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAktSMRwwGgYDVQQKDBNTYW1zdW5nIEVsZWN0cm9uaWNzMSAwHgYDVQQLDBdTYW1zdW5nIGJhZGEgZGV2ZWxvcGVyczEuMCwGA1UEAwwlU2Ftc3VuZyBiYWRhIFNCIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMDA0MjkxNTEzMDZaFw0yMDA0MjYxNTEzMDZaMGYxCzAJBgNVBAYTAktSMRwwGgYDVQQKDBNTYW1zdW5nIEVsZWN0cm9uaWNzMSAwHgYDVQQLDBdTYW1zdW5nIGJhZGEgZGV2ZWxvcGVyczEXMBUGA1UEAwwOYmFkYSBTQiBTaWduZXIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN/uoC7ZBU8LdL9MK9KQbe56zWQU8RB06TNzk0RXJySSO7Az6qwX3JO3hhnRZ1Tq2heurc18IssTKmeAgMCH2DvVpLx26KdqKJovQux1lkRxPGJqXlR7gRUamoAArwTrGojfKIq3tU1k2IBwBPMT+KWP36qxXFf4MVv1LxPKmIbPAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAfmM+N1WhglZPFld2ySNnTtgwwAWJVnbhPZxvvZan6ceWhtllV6XHnT6HP/vJCXffUyCK7P7O8HrBHd8dttjO7rD/VwjBatbE0DT1QNxG3z73JbskabTiqEkp9E2mf/lFbzz3dZRmtnT6N9bXcD17M1eeeqDpcH15vrXQX8sgFgg=
</certificate>

If i replace one of these files, i can copy/paste it's own signature but the certificat is still false; and i have to regenerate a new one.

Sorry for my poor english.
[Bada Software and Hacking General] b.kubica:
a couple of weeks ago I decompressed apps 2.0 using only phone itself. I added run custom code option to bterm, run prepared LaunchNucleus function and downloaded decompressed segments from DRAM. Of course LaunchNucleus decompress only 2 of 3 segments - first at 0x40000000 and the 2nd at 0x41300000. The 3rd one at 0x1C000000 is paged by default but we can play with QuramMduceBFlashReadData directly.

unsigned int QuramMduceBFlashReadData ( unsigned int dst, unsigned int src, unsigned int unpacked_len );

I included LoadNucleus code to bterm package at googlecode. I've no more time ATM ( I become a father for the very first time ;) but I will try post something useful tomorrow.
[Bada Software and Hacking General] ekhalid:
congratulations :eek:
[Bada Software and Hacking General] ho1od:
Congratulations! :D
[Bada Software and Hacking General] ~MaX~:
i dont understand what you mean exactly....

if i take the folder from s8600 fw and add it to the shp.app of xpkh3, it is not there after restart, and i cant install it directly to the phone by any of the known methods....

so it would be very kind if you explain how you installed it step by step

thanks,
[Bada Software and Hacking General] mylove90:
Hey Max

look...ekhalid dumped shpapp.app from Wave 3 FW , took the office folder , dumped Shpapp.app from XPKH3 , put the office folder in it and then he did a full FW flash or let's say he flashed files FFS, CSC , ShpApp and voila you got the office

P.S: backup you phone before doing this because it will get formatted of course

Best Regards
[Bada Software and Hacking General] Trzebiat:
Polaris Office

One question: if I put Polaris Office folder in dumped ShpApp from KH3 and save it using Wave Remaker, do I need to flash full KH3 with this one ShpApp file changed (bootloader and all files) or in this case when I have now KH3, could I flash only all files except Bootloader (check only full download in ML) or only ShpApp?
[Bada Software and Hacking General] b.kubica:
iirc shpapp is flashed to separate partition - downloading shpapp should format shpapp partition and then write new back so checking only shpapp should be enough
[Bada Software and Hacking General] ho1od:
New interface. What do you think of it?
[Bada Software and Hacking General] Tigrouzen:
Of course its better !!!

---------- Post added at 06:23 PM ---------- Previous post was at 06:07 PM ----------

http://rk-team.net/showthread.php?28-ColorTbl
[Bada Software and Hacking General] civil.scholar:
nice job ho1od ;)

i have a question :

is there any way to edit and save rsrc file in rc1 format ? (for use in multiloader)
[Bada Software and Hacking General] ho1od:
Now it is impossible, but "Never Say Never Again" :)
[Bada Software and Hacking General] adfree:
For RC1 maybe different ideas...

Maybe possible to use uncompressed RC1 like in SDK... So Question 1 is how many space is reserved for RC1? :confused:

In RC1 is also many crap... we could delete some trash from RC1 to fit reserved space...

We could try to modify apps_compressed.bin

http://xdaforums.com/showpost.php?p=18268116&postcount=29

This is not impossible. Maybe easier as complete Algo for Compression. :)

Best Regards
[Bada Software and Hacking General] ho1od:
This is a bad idea. Compressed block has three streams. The first stream of bits are flags. The second stream is offset in a byte for the third stream and offset to the differential table. The third stream is the data and is offset in two bytes for the third stream. Changing a single bit can cause a crash.
[Bada Software and Hacking General] adfree:
Short tested 0.1.0 with *.ffs; *.app; *.rc2 from S8600BOKJ1_TPLKJ1

Successfully. :cool:

Thanx.

Only CSC... this time not encrypted...

Best Regards
[Bada Software and Hacking General] spacks:
Thank you ho1od. You did promise you will work more on Wave_Remaker after your holidays. And true to your promise, Wave_Remaker is being improved almost everyday now. Wave_Remaker is one of the best tools available to editing Wave firmwares. And with time, all will be definitely possible with Wave_Remaker. The new look and feel is a big plus. Thanks and keep up the effort. We appreciate your good works.
[Bada Software and Hacking General] spacks:
Hello ho1od,

In the new Wave_Remaker_2,

the title bar shows Wave Remaker by holod ver. 0.1.0.

Please kindly rectify.

See screenshot below.
[Bada Software and Hacking General] lasentenza:
Thanks for new graphical version, it's better like this :cool:
[Bada Software and Hacking General] psycoy:
on the new CSC_8500_vodafone_lite does not work ... by psycoy
[Bada Software and Hacking General] ho1od:
Ок, I'll fix it
[Bada Software and Hacking General] mylove90:
Also .RC2 files are not editable :(
[Bada Software and Hacking General] ho1od:
Ок. Thanks
[Bada Software and Hacking General] prepulsar:
Windows dev

Hi,

I am a Windows developer and I have just finished writing a hex editor and dissassembler for Windows PE. My site is [#removed due to not knowing the legal status of the RE work here #] and if you would be interested in sharing your source with me, and letting me publish the executable (or link to it with credit being given for my effort) I would like to help you develop this.

As I understand it the options for my S8530 are limited due to

different LCD controller to that of the S8500

no official samsung update firmware yet

I can only find the 2.0.x SDK which won't produce executables for my 1.2.x device (just what I read)

Please feel free to put me straight on any of the above or tell me where to get off.
[Bada Software and Hacking General] adfree:
:)

I think your options are only limited by your imagination.

If you want develop bada Apps you can code as much as you want...

See several Games are higher then 400 MB...

Some Hacking is not finished... because not many skilled or better engaged users are willing to try or to learn.

If you want support bada (users). Then you can find many unfinished projects...

Or you can make your own project for S8530...

Write an cool App.

Thanx in advance.

You can also support Android port... no problem. But at this state. Most high knowledge is mandatory... Most of our hardworking Reversers spent many time in learning process... months/years...

Best Regards
[Bada Software and Hacking General] prepulsar:
Thanks adfree for taking the time to answer.

My skill in refining ROMs extended to taking some of the Chinese apps out of my Android 2.1 tablet, badly impacting on stabililty so I gave up. There was a neat tool for updating the bootloader on that SmartQ though.

I have a masters in Electronics Systems but don't want to give too much away. I prefer to work at the system rather than app level is what i am trying to say. How can I get me an official ROM? Do you have them backed up somewhere? Like I say, I haven't even switched on my phone owing to my screen protectors getting lost in the post last week :(

I'd link or post some portfolio, I know this site has a great rep but it seems slightly more underground than MoDaCo and I have plenty of forward engineering projects on the go. Being a Brit I could kinda use some ARM exposure.
[Bada Software and Hacking General] adfree:
http://www.megaupload.com/?d=EMI41LUU

@ ho1od

Not sure if you on bada 2.0... but I have upload System + SystemCSC folder from last S8500 Firmware...

Maybe this helps little bit for compression algo. :o

Thanx.

Best Regards
[Bada Software and Hacking General] b.kubica:
crypt seed used in bada firmwares

Crypt-SEED-0.01/SEED_KISA.c

in attachment version prepared for Wave_Remaker (funny thing - I coded it yesterday, and realized that this is crypt seed few minutes ago ;)
[Bada Software and Hacking General] ho1od:
also it has openssl, but slightly modified the samsung this algorithm by adding the following

KEY[0] += x;( x is first readed word of data)

KEY[16] += x;( x is first readed word of data)

#define G_FUNC(v) \
SS0[(unsigned char)(v) & 0xff] ^ SS1[(unsigned char)((v)>>8) & 0xff] ^ SS2[(unsigned char)((v)>>16) & 0xff] ^ SS3[(unsigned char)((v)>>24) & 0xff]

static seed_word KEY[32];

# define E_SEED(T0, T1, X1, X2, X3, X4, index) \
(T0) = (X3) ^ KEY[(index)]; \
(T1) = (X4) ^ KEY[(index)+1]; \
(T1) ^= (T0); \
(T1) = G_FUNC((T1)); \
(T0) = ((T0) + (T1)) & 0xffffffff; \
(T0) = G_FUNC((T0)); \
(T1) = ((T1) + (T0)) & 0xffffffff; \
(T1) = G_FUNC((T1)); \
(T0) = ((T0) + (T1)) & 0xffffffff; \
(X1) ^= (T0); \
(X2) ^= (T1)

array<unsigned char>^ SEED_decrypt( array<unsigned char>^ buffer, BackgroundWorker^ bwAsync){

MemoryStream^ myStreamOpen = gcnew MemoryStream(buffer);
BinaryReader^ br = gcnew BinaryReader(myStreamOpen);
br->BaseStream->Seek(br->BaseStream->Length - 752, SeekOrigin::Begin);
//array<unsigned int>^ KEY = gcnew array<unsigned int>(32);
for(int i = 0; i < 32; i++){
KEY[i] = br->ReadInt32();
}

array <unsigned char>^ decrypt = gcnew array <unsigned char> (br->BaseStream->Length);
MemoryStream^ stream = gcnew MemoryStream(decrypt);
BinaryWriter^ bw = gcnew BinaryWriter(stream);

br->BaseStream->Seek(0, SeekOrigin::Begin);

seed_word x1, x2, x3, x4, x5;
seed_word t0, t1;

while(br->BaseStream->Position != br->BaseStream->Length - 0x400)
{

x1 = br->ReadInt32();
x5 = x1;
x2 = br->ReadInt32();
x3 = br->ReadInt32();
x4 = br->ReadInt32();

E_SEED(t0, t1, x1, x2, x3, x4, 30);
E_SEED(t0, t1, x3, x4, x1, x2, 28);
E_SEED(t0, t1, x1, x2, x3, x4, 26);
E_SEED(t0, t1, x3, x4, x1, x2, 24);
E_SEED(t0, t1, x1, x2, x3, x4, 22);
E_SEED(t0, t1, x3, x4, x1, x2, 20);
E_SEED(t0, t1, x1, x2, x3, x4, 18);
E_SEED(t0, t1, x3, x4, x1, x2, 16);
E_SEED(t0, t1, x1, x2, x3, x4, 14);
E_SEED(t0, t1, x3, x4, x1, x2, 12);
E_SEED(t0, t1, x1, x2, x3, x4, 10);
E_SEED(t0, t1, x3, x4, x1, x2, 8);
E_SEED(t0, t1, x1, x2, x3, x4, 6);
E_SEED(t0, t1, x3, x4, x1, x2, 4);
E_SEED(t0, t1, x1, x2, x3, x4, 2);
E_SEED(t0, t1, x3, x4, x1, x2, 0);

bw->Write(x3);
bw->Write(x4);
bw->Write(x1);
bw->Write(x2);

KEY[0] += x5;
KEY[16] += x5;

}

while(br->BaseStream->Position != br->BaseStream->Length){
bw->Write(br->ReadInt32());

}
myStreamOpen->Close();
br->Close();
bw->Close();

return decrypt;
}
[Bada Software and Hacking General] adfree:
:o

Again Question about Qmage *.qmg

http://quramsoft.com/solution_e/qmage.asp

Could it be that it is only compressed... as sometimes I can see IHDR like PNG Header? :confused:

Qmage stuff seems easy to extract ... from *.rbm files from RC1 of bada 2.0:

QM as as Start/Header

next QM as END... maybe better HEX Value

2000000000000000000000001C000000

It seems not important to hit exact End...

1.

To make Pics visible... the hard way. :o

http://xdaforums.com/showpost.php?p=18431096&postcount=27

2.

bada SDK Emulator... maybe Pics are uncompressed in RAM? :confused:

maybe dump PC RAM... will try later... maybe OllyDbg can catch something usefull

3.

:D

Someone has an Viewer.

Thanx in advance.

Best Regards
[Bada Software and Hacking General] ho1od:
This is a library of Samsung's Android phone. They have routines for decompression QM
[Bada Software and Hacking General] adfree:
Stt.exe

Samsung Theme Designer seems "only" 4 MB...

I have short tested with OllyDbg...

My brain is too small. :o

SDKs seems not easy to run with OllyDbg.

SDK crashes...

I have no reversing skills. :(

Best Regards
[Bada Software and Hacking General] ho1od:
I have finished writing routines decompression bada2

I'll debug it

thank you b.kubica :)
[Bada Software and Hacking General] b.kubica:
if you need I can decompress other files too :)

10KB decompression routine... freaks
[Bada Software and Hacking General] ho1od:
Yes, I will be grateful
[Bada Software and Hacking General] b.kubica:
better idea

download TriX from http://nokix.sourceforge.net/trix/bada/ and unpack it

run TriX and open project file MduceBFotaDecompress.txj - it will load MduceBFotaDecompress.trx script

at general tab select input file (decrypted with Wave_Remaker)

go to Scripts tab and run hit Start button

the file should be parsed and decompressed

at the end program will ask for filename where to save decompressed image

i just ripped MduceBFotaDecompress routine from bootloader, assembled it. Then TriX execute it to decompress file (ARMulate plugin emulate ARM processor)
[Bada Software and Hacking General] Tigrouzen:
#include "../MduceBFotaDecompress.h"

doesnt find file then i changed to #include "MduceBFotaDecompress.h" and placed file with near tjx
[Bada Software and Hacking General] ho1od:
Super idea!!!!!!!
[Bada Software and Hacking General] b.kubica:
thats odd - it works fine for me - i suppse it something related to ms dll hell (TriX requires crt). I uploaded fixed version (no include this time, i copied arm code array directly to script)
[Bada Software and Hacking General] alex932109:
Can't dump rc1 file from S8500MBUKI1-error. Please help.
[Bada Software and Hacking General] adfree:
Compression Algo for bada 2.0 has been changed... work in progress.

If you have installed bada 2.0 Firmware, then you can backup via sTune content of RC1...

http://xdaforums.com/showpost.php?p=12436452&postcount=1

Btw... It is already uploaded. Content of RC1 from S8500MBUKI1:

http://xdaforums.com/showpost.php?p=18432420&postcount=222

Best Regards

Edit 2.

I'll collect now few RC1 contents... at the moment I have copied:

KG5

KG6

KG7

KH1

KH2

KH3

+ CSC ...

Soon I'll upload.

From KG5 I were able to flash only RC1 from higher Versions... so less time.

Edit 3.:

http://www.megaupload.com/?d=0MU37I7T
[Bada Software and Hacking General] adfree:
RC1 Algo from S8600 seems identical... :)

http://xdaforums.com/showpost.php?p=18823811&postcount=50

I've tried short also apps_compressed from S8600 with TriX... but 0 Byte is decompressed...

S8500 stuff works... :cool:

Maybe I have to cut something from start...

Best Regards
[Bada Software and Hacking General] adfree:
:confused:

Maybe it is possible to use No compression in RC1... :confused:

Short checked System folder form few bada 2.0... Firmware, including S8600...

Decompressed stuff is around 10 MB bigger... :confused: :rolleyes:

Maybe it is enough, if filenames are compressed + QMD as Header. :confused:

To shrink again RC1... we could remove some trash... I think Sounds for instances...

Example KG5... Original Rsrc_S8500_Open_Europe_Common.rc1 is 41 MB.

Copied System folder is 48 MB... (these data are decompressed)...

7 MB difference. :confused:

I think it is enough space reserved...

Best Regards

Edit:

http://xdaforums.com/showpost.php?p=17394605&postcount=159
[Bada Software and Hacking General] ho1od:
I think I can write a subroutine compression QMD.

I've finished debugging routines decompression, the next step, the routine decompression RC1.

Then I'll write a subroutine compression.
[Bada Software and Hacking General] ho1od:
Update 0.1.1

Added decrypt and decompress apps_compressed.bin Bada2

For test

thank you b.kubica
[Bada Software and Hacking General] b.kubica:
small update at nokix site - support wave3

S8600BOKJ1_APPS.7z
[Bada Software and Hacking General] adfree:
TriX runs fine on my XP.

Thanx.

Successfully tested with both available S8600 Firmware:

S8600XXKI9

S8600BOKJ1_TPLKJ1

Best Regards
[Bada Software and Hacking General] ho1od:
The source code routines decompression QMD
[Bada Software and Hacking General] Tigrouzen:
I supose its verry interesting code but what about it, it's for qmg files ?
[Bada Software and Hacking General] ho1od:
For file apps_compressed.bin bada2
[Bada Software and Hacking General] ho1od:
Update 0.1.2

Added support wave3 of decompress apps_compressed.bin Wave3

Added New design of tab Utils2

For test
[Bada Software and Hacking General] adfree:
Short tested with XP.

Is Tab Utils 2 functional? Or only under construction? :o

Tried RC1 from BOJE7 and one other older RC1...

Decompress 1 block RC1

************** Ausnahmetext **************
System.NullReferenceException: Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.
bei Wave_Remaker.Form1.button3_Click_1(Object sender, EventArgs e)
bei System.Windows.Forms.Control.OnClick(EventArgs e)
bei System.Windows.Forms.Button.OnClick(EventArgs e)
bei System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
bei System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
bei System.Windows.Forms.Control.WndProc(Message& m)
bei System.Windows.Forms.ButtonBase.WndProc(Message& m)
bei System.Windows.Forms.Button.WndProc(Message& m)
bei System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
bei System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
bei System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

Thanx. :cool:

Best Regards
[Bada Software and Hacking General] ho1od:
The Tab Utils 2 is fully functional. One block is a block cut from the compressed file. Function have not parsing, only decompress For example attached
[Bada Software and Hacking General] adfree:
Thanx for example. :cool:

My fault. :o

I've tried apps_compressed from KG5 after decrypt and decompress to use as apps.bin in Emulator...

Only black Screen.

Will try in alpha SDK...

Best Regards
[Bada Software and Hacking General] ho1od:
I have finished writing routines decompression RC1 bada2 :)

I'll debug it
[Bada Software and Hacking General] b.kubica:
if you need some decompressed rc1 please let me know
[Bada Software and Hacking General] ho1od:
Yes, i need it.
[Bada Software and Hacking General] b.kubica:
i found few decompress routines in apps (and few diffTable) - do you know which is for rc1?
[Bada Software and Hacking General] ho1od:
Decompress RC1 routines in apps_compressed.bin S8500XPKH3, is address 0x400FC370, diff_table is address 0x40736CF6
[Bada Software and Hacking General] b.kubica:
new version is ready
[Bada Software and Hacking General] ho1od:
b.kubica you're the best!!!!

thank you

PS. If you rename the decompressed .rc1 file to .org, then it can be disassembled in Wave_Remaker :)
[Bada Software and Hacking General] Tigrouzen:
Great Job !!!

No comment !!!
[Bada Software and Hacking General] b.kubica:
another hint - if we cut off 0x1000 bytes from csc (to start with QMD header), then we can decompress it with TriX also (of course only compressed part :)
[Bada Software and Hacking General] Tigrouzen:
I dont know if interesting for you Samsung make opensource about S5600

You can find it her 38M compresed 200+ decompressed.:

http://downloadcenter.samsung.com/content/SW/200906/20090629133159968/GT-S5230_S5233_S5600.zip

When i opened RC1 Orange Firmeware ive found one source file they maybe forget its in h extension and this files have some information about #include "RsrcBitmap.h"

In opensource s5600 you can find all about Rc1 also RsrcBitmap.h maybe can help to know how rbm compression make