yashsingh1/xdaforums huggingface dataset:
[Captivate Android Development] AdamOutler:
Well put me in a dress, call me sally and slap me where the sun don't shine....

adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ./s5pc110_testcode.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 104
=> loaded 16384 bytes from ../s5pc110_testcode.bin
=> Downloading 16394 bytes to 0xd0020000
=> Data checksum e02a
=> usb_bulk_write() returned 16394
adam@Adam-Desktop:~/Desktop/dltool$

************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************
Uart negotiation Error

No Secure Fail Error!

It never completes if I put it at 0xD002008 or 0xD20010, however at 0xD002000 it simply completes and freezes. No additional uart. This is better then everything showing secure fail!
[Captivate Android Development] AdamOutler:
Robellos, I've just verified... Every other firmware has done this

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

Secure Fail Error

Signed BL1s do this

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

I don't know what we need to do to "start" the code, or maybe it started and failed silently? It does not show anything on UART, but it's passing Secure Fail Error and obviously doing what it's been programmed to do... Maybe try an offset of 0x10, or 0x8 at the start of the file?

This file WILL load at 0xD002_0000 through USB. I'm having problems with UART... I wrote a preliminary bit in BASH... It's really nothing so far.

#! /bin/bash
#Set up device variables
ComPort="/dev/ttyUSB0"
BusPirate="false"

####sudo check####
if [ "$(id -u)" != "0" ]; then
echo "You do not have sufficient privlidges to run this script. Try again with sudo"
exit 1
fi

#prepCom prepares the com port by initializing the bluetooth device and the serial port
prepCom () {
#initialize port
echo "Setting port specs"
stty -F "$ComPort" speed 115200 -raw -brkint -icrnl -imaxbel -opost -onlcr -isig -icanon -iexten -echo -echoe -echok echoctl -echoke time 5 min 1 line 0

if [ $BusPirate = "true" ]; then
echo -e "\n\n\n\n"
sleep 1;
echo "m">"$ComPort"
sleep 1
echo "3">"$ComPort"
sleep 1
echo "9">"$ComPort"
sleep 1
echo -e "1">"$ComPort"
sleep 1
echo -e "1">"$ComPort"
sleep 1
echo -e "2">"$ComPort"
sleep 1
echo -e "2">"$ComPort"
sleep 1
echo -e "(1)">"$ComPort"
sleep 1
echo -e "y">"$ComPort"

fi;
}

mainLoop () {
#mainLoop will read 1 charactor at a time until it sees ">", then it will display the cooked data and let the user input his/her data.
mkfifo ./fifo
cat $ComPort &
Stage=0
while IFS= read -r -n1 char
do
# display one character at a time
echo "$char"
done < ./fifo
}

#Prepare communications
prepCom
#Main I/O loop
mainLoop
[Captivate Android Development] midas5:
Can you please post the source code to that ?
[Captivate Android Development] Rebellos:
Its proper target location is 0xD0020000, it was supposed to be uploaded through UART tbh, but USB will do aswell. Probably I messed up something somewhere. Gotta do double check.

No Secure Fail Error is very good sign. I'll post sourcecode tonight or next day, when I fix mess inside.

//edit: attached version with some changes, now instead my own functions it does use callback to iROM debug_print to minimalise risk of my mistake. The thing is that I'm not sure if iROM is callbackable and does it have uncorrupted stack (it should be...)

it should print song lyric in endless loop

source is included, it is messy, sorry, no time to fix it now

//edit2: interesting info about apple A4, http://theiphonewiki.com/wiki/index.php?title=Limera1n, I bet that's S5PC110 with different SECKEY and maybe few cosmetic changes. The most interesting is SHAtter, maybe some guy found way to generate collisions with SECKEY...
[Captivate Android Development] AdamOutler:
Yeah. I can't do UART reliably yet. It's a pita... I'll try the method I used the other day, tonight when I get off work. It's a matter of setting it up and then hitting a button while plugging in the USB cable... It's just so erratic and I don't like doing that.

UART is good, however, it takes 2 extra wires to be soldered... If we can use USB, that's a plug-n-play solution with only 2 solder joints to enable the OM5 mod. Using UART takes at least 4 and likely 6, which does not really reduce the extremely fine work involved in recovery of our phones...

I think the ideal solution is to use UART output for development of the method. Once complete, we could have a script verify that there is a dev board connected, upload your firmware via USB, then the device will be ready to take a USB flash. The connections used for UART are very tiny and difficult for the average person to work with. It's my hope that we can simply add an additional step of "plug in USB and run this script" to the first post of this thread.

Don't get me wrong... I'm still persuing UART as an option because it may add additional functionality for some people. UART Download requires a special box between the computer. UART Download requires -internal- UART connection. The external UART does not function during the IROM Initialization which leads me to believe that the IROM initializes it's download mode, then checks the resistor value on the USB chip, then authorizes it to switch. UART is not as efficient as USB, more costly, and requires more equipment so it is not as good as USB.
[Captivate Android Development] Rebellos:
Of course I get your point. If we find callbacking iROM functions possible, I can write BL3 loader basing on smdk-usbdl in few hours. :]

(please notice I edited my previous post and added modified code in there)

//nvm, found error there

//edit2:

Did some tests with nbates66 and we found out that iROM code is executable even from BL3 level :]

Posting fixed code+binary, with much less mess. :] Hope it works, waiting for feedback.
[Captivate Android Development] AdamOutler:
Mark this moment.....

WE HAVE HELLO WORLD

Rebellos! You are the man!

Ok, steps to reproduce:

1. Perform UnBrickable mod from the first post in this thread.

2. With the phone off, Insert battery into phone. Press power on button for 1 second. Observe message on internal UART:

Insert an OTG cable into the connector!
������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

3. Insert the OTG Cable (standard USB cable plugged into USB port on phone-- OTG port) and obvserve message on internal UART port:

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

4. on a Linux system run the "dltool"

adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ./s5pc110_test/s5pc110_testcode.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 050
=> loaded 16384 bytes from ./s5pc110_test/s5pc110_testcode.bin
=> Downloading 16394 bytes to 0xd0020000
=> Data checksum af84
=> usb_bulk_write() returned 16394
adam@Adam-Desktop:~/Desktop/dltool$

5. Observe Internal UART message:

Hey you!
Out there on the road,
Always doing what you are told,
Can you help me?

which repeats every 20 seconds.

GREAT WORK!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[Captivate Android Development] Rebellos:
Bah, I just miscalculated pause time, it was supposed to be around 3seconds. ^^

I've got almost ready alpha BL3 downloader. Please post pack of boot.bin+sbl.bin you are going to upload. I'll rebuild boot.bin init functions and get ready for loading sbl.bin through USB.

Thanks in advance.
[Captivate Android Development] AdamOutler:
I'm attaching boot.bin(BL1), part.pit(Partition Information Table), param.lfs (device parameters) and Sbl.bin(BL2). These are Captivate Android 2.3 bootloaders.

This is my standard partition table

==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20

You should not need EFS... that contains serial number and I believe it is auto-generated. The SBL 2 is the same file as SBL. Param contains the download mode picture. I'm not sure if the pit is required for your code, but I included it anyway... This should be interesting to see how a non-linear filesystem is uploaded.

I'm fully prepared to brick this phone if you're ready to see it through. I cannot JTAG this device, because i've been so rough on it that all of the JTAG pads are off. It would take 4-8 hours to set up JTAG, if it is even possible. so this will be a bold move for me to use your test code for download mode... Just so you know, I'm not entirely worried as this is my dev phone.
[Captivate Android Development] Rebellos:
Thank you.

Now you can be sure you've got 99% unbrickable phone (you can always use hammer)

Remember to have copy of your nv_data. I think in 30minutes I'll post pack of alpha sbl loader + modified sbl.
[Captivate Android Development] AdamOutler:
I should mention that I am running one of those crazy wildly modified ROMs from a Captivate 2.1 bootloader, which is running Android 2.4.4, because I don't really care about this phone. So, if this works, it's not the code running on my phone, that's for sure... If you think I should flash back to stock, let me know.
[Captivate Android Development] bulletproof1013:
Awesome...lemme know for testing.
[Captivate Android Development] Smasher816:
Congratulations on the mile stone. Awesome work Adam and Rebellos!

So now that you have figured out how to get your custom software uploaded does that mean it is definitely possible to reupload the bootloaders from a "hard" bricked state.

And also possibly get uboot and dual booting (from sd)?

Edit: if so do you think you could preform this mod on my phone (I have no soldering skills)?
[Captivate Android Development] Rebellos:
We're now targeting running SBL. If it does run, it doesn't really matter what rom you've got. You can enter download mode of just loaded SBL and do total reflash using PIT if I'm not wrong (I haven't been flashing anything using Odin/Heimdall in life ;d)

Well, yeah. To be honest uboot from Odroid can be booted this way without big changes.

Posting alpha version. Adam please test it, it has got pretty clear instructions. Please monitor both uart channels if it's possible (SBL will produce output to the second one).

You don't need modified SBL for this test. Use the one you've posted.

Use upload address for first binary the same as for hello world, and for Sbl.bin its 0x40244000

(Don't expect anything great, I've got no test device to test it myself, probably I did something wrong, I'll use that method to recover my brick when we find out fully working solution, as I won't solder anything)
[Captivate Android Development] nubecoder:
Great work AdamOutler and Rebellos (and anyone else who contributed)!

=]
[Captivate Android Development] AdamOutler:
The code which Rebellos is producing currently is going to be an alpha download mode... That's not even beta software and I wouldn't recommend testing it if you want to use your device.

This, which rebellos posted earlier can be tested and verified on your device. http://xdaforums.com/attachment.php?attachmentid=698077&d=1314105521 You will need access to the internal UART. I don't know if it will be possible until Rebellos fuses the binaries to his code properly though.

I'd recommend that you do not perform this mod without soldering skills. This is some fine work on very small components. However, any electronics repair shop should be able to do this for you. I'd do it for $30 + shipping.

SDCard is a slightly different modification. Currently we are tethered booting custom code. The SDCard mod would require removing xOM4 resistor as well and bridging the active leads on the pins.... Rebellos would be able to tell you if it would work or not...

Rebellos, would it be possible to dd/ or fuse the bin to a SDCard and have a magic SD hanging around the house?
[Captivate Android Development] AdamOutler:
js22

TheBeano

midas5

many others....
[Captivate Android Development] bulletproof1013:
ok thanks. will wait for beta, thanks again everyone!
[Captivate Android Development] Rebellos:
Not exactly the same as in uBoot, but from our BL1_stage2 Its easy to simulate behaviour of iROM with xOM4=1. Also with ultimate unbricking method we've got development platform for custom dual-booting uBoot which can be written onto oneNand.
[Captivate Android Development] AdamOutler:
��������������������������������������������������������������������������������
Uart negotiation Error

Welcome to the S5PC110 resurrector!
Configuring DMC controllers...

done!
Please prepare USB downloader with BL3 (SBL)

Starting downloader in...
:
9
8
7
6
5
4
3
2
1
0

No change to lsusb results

Bus 001 Device 004: ID 04e8:1234 Samsung Electronics Co., Ltd
[Captivate Android Development] Rebellos:
Thanks, last code for today and I gotta get some sleep.

//edit:

SBL repartition looks very interesting, never seen it also. :d
[Captivate Android Development] AdamOutler:
������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

Welcome to the S5PC110 resurrector!
Configuring DMC controllers...

done!
Cleaning OTG variables

done!
Please prepare USB downloader with BL3 (SBL)

Starting downloader in...
:
9
8
7
6
5
4
3
2
1
0

Downloading complete, please hold download mode key combination if you are not using prepared SBL.

Starting BL3 in...
:
9
8
7
6
5
4
3
2
1
0

there is no time delay on the countdown. it's so quick I'm not even sure if it's happening.

Bus 001 Device 020: ID 04e8:1234 Samsung Electronics Co., Ltd

There was no download mode that I could see.
[Captivate Android Development] Rebellos:
Can you post logs from smdk-usbdl tool? I'll post more tests tommorow.

Are you watching second uart for sure?

Oh yes, there wasn't delay for the second countdown? Or for both?
[Captivate Android Development] AdamOutler:
adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ./s5pc110_test/s5pc110_sbl_loader.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 022
=> loaded 16384 bytes from ./s5pc110_test/s5pc110_sbl_loader.bin
=> Downloading 16394 bytes to 0xd0020000
=> Data checksum 13c3
=> usb_bulk_write() returned 16394

Neither countdown was a real countdown... it was very quick. Almost all at once. It said

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

Welcome to the S5PC110 resurrector!
Configuring DMC controllers...

done!
Cleaning OTG variables

done!
Please prepare USB downloader with BL3 (SBL)

all as one

then pause one second

Starting downloader in...
:
9
8
7
6
5
4
3
2
1
0

all as one

pause one second

Downloading complete, please hold download mode key combination if you are not using prepared SBL.

Starting BL3 in...
:
9
8
7
6
5
4
3
2
1
0

all as one... maybe a slightly longer delay on the downloading complete message. It was not enough time to react. Possibly it's microseconds instead of miliseconds? Dunno.. I don't know what code you're using.
[Captivate Android Development] psycho2097:
Opened this thread after 4-5 days....! Wow, major breakthrough rebellos n Adam! Congos...
[Captivate Android Development] midas5:
Are you using the SHAtter tool to do this signing of BL1 or do you have some other signing tool?
[Captivate Android Development] midas5:
I have just looked at the sbl loader code you posted. Is it really that easy to get signed code?

I.e. Stage 1 signed (0 to 0x1fff), stage 2 unsigned (0x2000-0x3fff).

So, as long as we have the same code at 0 to 0x1fff, we can put anything we like at 0x2000 onwards?

If the Stage 1 code does not require stage 2 to be signed, we have our freedom!

Is what I am seeing correct?
[Captivate Android Development] Rebellos:
Yes, exactly. Samsung shot themselves in feet by releasing BL1_stage1 with null stage2 public key.
[Captivate Android Development] AdamOutler:
Rebellos, please, when you get a chance, start a new thread. You need to lay out the S5PC110 Software Development Kit. Please explain how a noob can create a hello world. Ill link it to the first post under firmware with proper credit. We need pictures or video of hard to describe items and links to software used. You are the only one who knows how to do it right now.
[Captivate Android Development] Rebellos:
Where do you think I should start it? SGS board or maybe some other? It is about SGS, Captivate, Wave and few other handsets in fact.

Btw, I found 2 pullups to VCC_PDA_2.8V and 4 pulldowns to GND on S8530 board in one row, exactly where you guessed, I just checked it wrong previously. Now gotta figure out which pulldown is OM5, by jumpering probably.

Are pullups ~10.1kOhm in your case also? Pulldowns are 100.3kOhm, exactly as in your case.

In the meantime... my actual source files + 2 binaries to test (one with cleaning of iROM OTG configuration, one without) ;]

//edit:

Also, I'm not sure if I'm the right person to explain dev kit practical use. I still don't exactly know how to upload anything to iROM, it's up to you. ;d
[Captivate Android Development] AdamOutler:
I'd say go with the ordering from left to right in the picture in the first post.... assuming the same order.

You are the person to explain developing firmware. Put it in the forum general or the forum development. That's XDA general or XDA development. You are writing bootloaders. Call it.... how to write your own Galaxy S bootloader. This is legendary stuff, so do it well.

Ill test in about 7 hours when I get off work.
[Captivate Android Development] Rebellos:
On Wave these are in straight row, first 2 pull-ups and then 4 pull-downs, I doubt any connection can be found between order in Captivate and Wave. ;d
[Captivate Android Development] midas5:
Maybe they did not shoot themselves in the foot.

They have just made themselves an ideal development platform.

We can even write our own boot loaders now.

...me looks for an open source modem....<dream ends>
[Captivate Android Development] Rebellos:
Open source modem? Many Samsung's modem OS are based on NICTOKL4, that is in SGS, Captivate and Waves case. Its source (lil outdated) is available http://koala.cs.pub.ro/lxr/#okl4/

(Yes, thats right, on CP there is whole independent linux working)

Altought of course there are no board specific drivers, many of them can be ported from I9000 source (oneDRAM driver for example) with modifications, however I guess Samsung has got very modified NICTOKL4 modem OS source from Qualcomm.

Feel welcome to read this topic http://xdaforums.com/showthread.php?t=897468

It's about many bootloader and AMSS experiments made by devs from Wave section.
[Captivate Android Development] AdamOutler:
This is what I've been looking at since I saw the manual... Here's our path through the secure bootloader. I believe IROM is fixed and BL1/BL2 occurs in IRAM.

It would appear IROM "Go to 2nd boot" is not working. Maybe by "Checksum OK" they mean did not attempt to boot from alternate source?

It would also appear that the signature is simply used to mark the position of the start point for the second bootloader. This would also explain why some bootloaders work and some do not.. PBL expects a signed SBL or expects an unsigned SBL... Could be that the PBL has instructions to launch a speciffic memory location and that gets changed with signed or unsigned seccond bootloader.

Rebellos I just don't understand how you're fusing bl1 and bl2.
[Captivate Android Development] Rebellos:
This schema isn't fully valid.

PBL (BL2) is usually ran in DRAM, and BL1 is splitted in 2 parts.

Following the schema, we're creating BL2.

Following my research, we're creating BL1_stage2.

I just deeply analyzed uboot secured BL1 code and found out that if everything is okay it jumps to 0xD0022010, so I assummed that BL1_stage2 have to be located at 0x2000 offset of BL1_stage1 and it'll load properly (it also starts from 16byte sign info, following to Samsung's convention), and it did. ;)

Created thread:

http://xdaforums.com/showthread.php?p=16953778#post16953778
[Captivate Android Development] AdamOutler:
Robellos, Should I still stick with the above code when I test, or did you come to another conclusion?

In your other thread, how are you tieing all of this together? I don't understand how you can take a compiled PBL and a compiled SBL, then make them one file. I don't understand how you can insert non-compiled code into that. I don't know even how you are compiling them, let alone making them all work together. Can you explain that?
[Captivate Android Development] Rebellos:
You should stick to binaries posted in this thread above. Please test it if you can.

I haven't made PBL and SBL one file, I asked you for them mainly in research purposes, to check entrypoints and init procedures they do.

I'm making BL1_stage1 (from odroid, signed) and my code one file, or to be precise, FASMARM is doing it for me.

It's just inserts BL1_stage1 at the beggining, then fillup with 0x00 bytes until it reach 0x2000 offset of output file, then inserts dummy 16byte secure header and then my code starts, after code comes fillup until 0x4000 offset of output file, because I like when filesize is power of 2.
[Captivate Android Development] AdamOutler:
Ah. OK. What is the expected output of the test above then? Its difficult to pre-alpha test with no results for comparison.

edit: Btw.. I'm at work and I cannot test for another 1.5 hours.

I got to thinking... I'm not good with ASM files... Would you be able to somehow tell the ASM to execute another file? It would be interesting to see if you could somehow tether IROM>IBL>SBL by writing in some arbitrary instruction to set up environmental varriables then begin execution of SBL?