[Captivate Android Development] AdamOutler:
I have not seen anything in the Captivate forums about UART, I2C, or really anything other then Download Mode/Recovery Mode. We could use some developers to help with this project. It's an interesting combination of hardware, software, and inter-chip communications protocols...

I think everyone knows about the 301Kohm resistor between pins 4 and 5. Did you know about the 150Kohm or the 619Kohm resistors? How about the middle battery pin?

Watch this video.

[YOUTUBE]GGrFAU1sig8[/YOUTUBE]

Resources

Users

One-Click Unbrick was relesed This will unbrick softbricked phones http://xdaforums.com/showthread.php?t=1153310

Kernel developers

UART Kernel debug log AND shell terminal (like adb shell without adb active) On the captivate you can get into the SBL prompt, then type

printenv
setenv SWITCH_SEL 6543
printenv
saveenv

This changes the SWITCH_SEL value from 65 to 6543 and enables extra output. This will give you a kernel debug output and drop you into a shell prompt.

Developers

bootloader source code For a simlilar samsung device: http://xdaforums.com/showthread.php?t=1018862&page=68

here is the iROM,: I've rehosted it here: http://teamkomin.googlecode.com/svn-history/r75/branches/IROMcode/bootdumps.rar

here: http://www.mediafire.com/file/c9bg6gyk1cuapsz/bootdumps.rar

and here: ftp://adamoutler.dyndns.org/bootdumps.rar

we need help deciphering it. We think the annotations may be wrong. This is the unchangable code in the first few blocks of memory. There must be a way to communicate with this.

Hardware guys

S5PC110 processor datasheethttp://www.mediafire.com/file/3znisgfm3amxgpj/S5PC110_EVT1_UM10.pdf This is the processor in our phones. This documents everything which is capable natively with the processor. It is 2425 pages long.. I read through it and added some notes here.. This is the meat of the manual: http://xdaforums.com/showthread.php?t=1018862&page=51

FSA9280A datasheet http://www.mediafire.com/?d4e21efhuktctcb This is the first time we've had access to this manual. Our phones use the FSA9480A chip, this chip is functionally the same. The datasheet here describes all functions available to the USB switching device. From the FSA9280 datasheet we've located all resistor values. http://xdaforums.com/showpost.php?p=14408452&postcount=62

All

The All-In-One GalaxyS HackPack hardware, software and documentation on our phones http://xdaforums.com/showthread.php?t=1111866

It has been revealed from a source which is not to be mentioned that the OM pins/registers are fixed and cannot be changed on the processor without removing the processor from the device or making some hardware modifications.

Here's some must read threads.

Fun with resistors:http://xdaforums.com/showthread.php?t=820275 This thread shows all known resistor values

Lets save some bricks:http://xdaforums.com/showthread.php?t=1018862 This thread deals with ways to revive phones from the dead. We are hacking the heck out of them in here.

Development platform booting from MMC http://hi.baidu.com/j2h3344/blog/item/85740dfc0be35951d7887dd5.html This is the platform used to develop our phones. We need to find these OM bits, or access them somehow.

the middle battery pin http://xdaforums.com/showpost.php?p=13448859&postcount=253 This may be the answer. We could use some help in this area.

Download the GalaxyS Hack Pack here: http://xdaforums.com/show....php?t=1111866

Known Causes of hard Bricking

1. PBL(Primitive bootloader) and SBL(secondary bootloader) were not designed for the phone

2. Mismatched PBL/SBL combination

3. SBL does not fit in the Partition information table, or location does not match Partition Information Table

4. Bad USB cables

5. power loss

6. Damaged PBL/SBL

--Theoretical--

7. Something known as Secondary Bootloader Rotation may be to blame for improper bootloaders sometimes. Apparently when flashing, the SBL and SBL2 blocks may switch places. In this case you may have the proper PBL, but the SBL is not proper for the device.

Hardware Used

If you're looking to help, you'll need some development hardware. I use an Arduino Mega. http://www.bizoner.com/arduino-atme...e-p-180.html?zenid=9mg23h688slfjgh88910o5jfd2 This is a programmable interface. You can use this code to talk to the phone. http://xdaforums.com/showpost.php?p=13351363&postcount=223

Here's some plans for a communications adapter http://xdaforums.com/showthread.php?t=925034

The plan

If we can get into a bricked phone via UART or the i2C bus, or the USB bus, or any other method available to U301, we can corrupt the PBL(boot.bin) in the OneNand which will cause the processor to search for a PBL and SBL on USB, UART and MMC.

If we can locate an additional communications port somewhere on the phone we can change or corrupt the code running in memory and then cause the processor to reboot into USB or UART mode.

So far we know of UART only and have eliminated that as a solution on it's own.

Using SBL, it is very likely possiblity that Windows7 phone or iOS, or ubuntu could be ported over.... Basically, full control.

Why you should help

We've been working on ways to recover these phones for months now. We're comming to an end. We need massive amounts of testing to figure out this last bit.

This is a call to duty. Every developer who has ever released a boot.bin, SBL.bin, param.ifs or a PIT with their release needs to be a part of this. Every member who has ever bricked a phone while using one of the many tools which are designed to upgrade your phone can help. Anyone who wants to feel secure while flashing their phone should put some effort into this because it's expensive and requires superhuman soldering to JTAG these phones. If you've even thought about using Odin3, we need your help.

Update: UnBrickable Captivate http://xdaforums.com/showthread.php?t=1206216