yashsingh1/xdaforums huggingface dataset:
[Captivate Android Development] nubecoder:
Not trying to start diverging from the topic, but all of this seems kind kind of similar to the Wii's BootMii.

IIRC there is Boot0, Boot1, and Boot2. In the case of BootMii, they exploited a flaw in some Boot1 code allowing them to "inject their code" into Boot2.

Their custom Boot2 code allowed for (among other things) brick protection early in the boot process (by means of full, byte per byte NAND back-up and restore functionality).

(Bringing it back on topic)

I understand at this point you are simply trying to get SBL loaded and executed.

But it makes me wonder if, in the future, there might be something of a "very low level / un-brickable back-up / restore" functionality that can be programmed.

Regardless, I always enjoy reading about this kind of stuff and wish nothing but the best for this project.

And again, great work to everyone involved!

=]
[Captivate Android Development] Rebellos:
There is theoretically alot free space for code in IBL, so theoretically such mechanism could be added in future. Good idea. But I doubt I'll have enough power of will to start doing such thing, probably I'll leave method ready for someone other. ;d

//ghaad, I've got hardly understandable posts today, sorry.
[Captivate Android Development] boardsportsrule:
From the title of this thread, I'm pretty sure that's the goal..
[Captivate Android Development] Rebellos:
No, our target is hard brick reviving. He was talking about low-level backup. That's the similiar thing, but not the same. ;)
[Captivate Android Development] AdamOutler:
The timer works now!

adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ~/Desktop/dltool/s5pc0_test/s5pc110_sbl_loader.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 071
=> loaded 24576 bytes from /home/adam/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum fe80
=> usb_bulk_write() returned 24586
adam@Adam-Desktop:~/Desktop/dltool$

������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

Welcome to the S5PC110 resurrector by Rebellos!

Calling SGS IBL Stage2, pray so it wont hang...

DONE!

Testing if BL3 area is R/W

DONE!

Cleaning OTG variables

DONE!

Please prepare USB dltool with BL3 (SBL)

Starting downloader in...
4
3
2
1
0

failed! hanging... handset will reboot...

It takes about 2-3 seconds after "0" before it gives the failed! hanging message... I cannot upload firmware at this point... It hangs and will not reboot.

You need to kick that watchdog.... It's not rebooting when it says it will
[Captivate Android Development] Rebellos:
Damn, don't know what is with that watchdog, nvm.

Gotta test one more thing before I go to sleep, expect another testcode in 5-10minutes.
[Captivate Android Development] AdamOutler:
What you describe has already been done on our phones. We are going for a much lower level. We are writing the Boot1 code. It is possible to inject boot 2, but what we want is simply to execute boot2 when no boot 1 or 2 exist. They are doing backups in case the kernel crashes... they are using bootloader 2 to do the work... They basically just "unlocked the bootloaders" to allow for alternate unsecured kernels on the device. Their work is basically to load a hacked secondary bootloader on a properly working system using factory download modes. We are communicating lower then this where nothing except the processor exists.
[Captivate Android Development] Rebellos:
Sorry, realized that gotta copy some bigger iROM part to test. Will take few minutes longer. Gonna edit this post soon and attach bin.
[Captivate Android Development] AdamOutler:
Just use the reply button. I'm subscribe to this thread and if I walk away for a few minutes then I will get a notification. I hate it when people edit a post in a thread that I'm subscribed to.. I read the first few lines and think nothing changed.
[Captivate Android Development] Rebellos:
Okay, as you wish. ;P

Here it goes

Won't respond to the results probably, gonna be back in 12 hours or so. I hear my bed is missing me.
[Captivate Android Development] AdamOutler:
Freezing at Reinitalizing iRAM variables..

adam@Adam-Desktop:~/Desktop/dltool$ sudo ./smdk-usbdl -f ~/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin -a D0020000
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <ben-linux@fluff.org>

S3C64XX Detected!
=> found device: bus 001, dev 074
=> loaded 24576 bytes from /home/adam/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum 1cc8
=> usb_bulk_write() returned 24586
adam@Adam-Desktop:~/Desktop/dltool$

uart:

��������������������������������������������������������������������������������
Uart negotiation Error

Welcome to the S5PC110 resurrector by Rebellos!

Calling SGS IBL Stage2 (DMC + oneNAND configuration)

DONE!

Testing if BL3 area is R/W

DONE!

Reinitializing iRAM variables
[Captivate Android Development] AdamOutler:
For those of you following the development, we tested around 8 different builds last night with various results leading to a gain of knowledge. Rebellos stayed up to 6AM (Poland time) last night working on this. We switched to using a private FTP server and google talk because it is quicker for Rebellos to FTP the bootloader directly to my server and chat about results in real-time.

If anyone wants a copy of the firmware we are working on Rebellos, or myself can post it up. We're not trying to hide any results. I'll post here at least once per debugging session if Rebellos does not.
[Captivate Android Development] midas5:
I think it would be useful if we put the source code on github or something similar. I could then contribute.

One thing i would point out is that if both i and rebelios had a development phone this would proceed a lot faster.
[Captivate Android Development] AdamOutler:
I know... I started a thread in general asking for boards. http://xdaforums.com/showthread.php?t=1236273 . I can't send you my device because if I was not working on this project then I'd be working on another project which would require it. So, I'm doing what I can.

We were discussing that since I cannot get the device to him, he may be able to use my computer.. ill set up a virtual machine with the device connected and perform a manual reset when requested. You could also use this. Pm me and we can set up gtalk.
[Captivate Android Development] krisvek:
I'm very much a novice in ASM still, but I wouldn't mind having access to the source Rebellos is working with as he updates it, github or here. This is a very educational experience, and I'm hoping things might get to the point where I can be useful. Unfortunately, I rely on my Captivate too much to want to risk destroying it, but I would love to help develop some code if I can. This semester I have a another course on ARM/ASM development as well, so it might coincide nicely with my following this. I'm hoping that at some point the benefits from this will be achievable without hardware alteration? (maybe not the hacking benefits, but perhaps the fruits of the labor)

You guys are awesome, btw.
[Captivate Android Development] bulletproof1013:
Still not ready to flash. And keep using my phone right?
[Captivate Android Development] nubecoder:
+1 for GitHub shared code (not that I have any experience with ARM ASM). ;]

From what I gather, the HW modification will be required, even when they get this all figured out and working flawlessly.

Yes, still in heavy development, I'm sure there will be some kind of announcement when it's ready for "consumer" use.

I'm not involved in the development of this, so I'm just giving my best educated guess here, feel free to correct me where ever I'm wrong.

=]
[Captivate Android Development] Rebellos:
My actual sources

(alot of debug mess in there)

I'm not familiar with git

Is googlecode SVN okay?
[Captivate Android Development] AdamOutler:
and just for fun we tried to run a BADA bootloader on this device..

Starting BL3 in...
:
9
8
7
6
5
4
3
2
1
0

[BOOT_V1.0 (May 28 2010, 21:22:23)]
SelectBootingMode: H/W...0x0.
[SYSCON][Err] SysCon_Drv_Get_FOUTAPLL() - No Matched PLL, reg_value: 0x80C80601
[SYSCON][Err] SysCon_

+++FIMD_Drv_INITIALIZE
FIMD_Drv_ChangeMode: MDNIE_MODE
Frame Rate:62 SCLK_FIMD:133400 kHz ClkDiv:4
S6E63M0 : LDI_Pentile_Set_Change Pentile_Value =6c
---FIMD_Drv_INITIALIZE
---FIMD_Drv_SetWinOnOff(WIN4:1)
LCD initialize d
Flash_Unlock failed
Poweron status - ffffffff
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
FSA9480 0x03 Register = 0
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
FSA9480 0x0A Register = 0
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
FSA9480 0x0B Register = 0
[I2C_GPIO1] write error:no ack-slave addr-[0x4a]
FSA9480 0x07 Register = 0

The GPIOs are different according to Rebellos. So it won't work directly, but it can be tested and my phone still turns on just fine.
[Captivate Android Development] Smasher816:
Absolutely amazing work you two.

So now the captivate is truly unbrickable (with your mod).

And add in that this can be done on tons of devices, you guys may have an absoultly huge breaktrhough.

If you get something like uboot working with wp7 or iOs, you can expect to see a phone, $30+ shipping, and a tip coming your way (for this mod).
[Captivate Android Development] AdamOutler:
I wish I had logs to back this up...

I installed BADA OS bootloaders on my phone. They trashed my partition table. It bricked my phone. The thing was a black screen brick. It did not work at all!

I was worried for a bit because it would not download, but eventually we got it! It works!

UnBrickable Mod is now in full effect!
[Captivate Android Development] Rebellos:
To be honest W7 and iOS are achievable, but it's loads of tons of work in pure assembler, as they aren't opensource (Ain't sure about W7, maybe it has got pure library construction and all drivers can be written as .dlls not compiled into kernel, I don't know). I'd say for SGS family you can count on Bada (not alot of work to port it from Wave) and any opensource os, like ubuntu.
[Captivate Android Development] azrienoch:
A big fat congratulations. Pure development. Love it.
[Captivate Android Development] nubecoder:
Exactly this, huge congrats guys.

=]
[Captivate Android Development] connexion2005:
Congrats to all involved. Outstanding work!
[Captivate Android Development] AdamOutler:
Thanks! So, do we call this "Exposed JTAG"? http://www.youtube.com/watch?v=LdLf7qtwQj8&feature=player_detailpage#t=124s lol... j/k... When you said that, it made me fell like Neo... "when I'm ready, I won't need JTAG".

We need to apply this to more devices. Lets get some broken, busted, old junky, water damaged phones in the mail!
[Captivate Android Development] starche_old:
great job, guys :-)
[Captivate Android Development] midas5:
Good to see our bootloader working now.

So, we have the recover fix for:

1) Phone gets into Test B/D mode.

2) We can force Test B/D mode using the OM5 mod that is easier and cheaper than jtag.

Now there is a possiblity to force Test B/D mode without any solder by using I2C. If we can find the I2C trace on the board, we could force the IBL boot to fail checksum by writing one wrong byte to the onenand. This would force the IROM into Test B/D mode.

Also, along the way we found a sighed IBL that does not require a signed PBL. This gives us total freedom to write our own bootloaders. E.g. We could force the phone to boot from sd card.

We could then have one sd card being Android, another being Bada, another being some development os.

I think a good modifications to our own PBL on onenand would be to try and load SBL, and if that fails, instead of halting like the current one, it jumps into Test B/D mode.

The phone would then be unbrickable without even needing OM5 solder.

These are just a few of the improvements we could make to the bootloaders.
[Captivate Android Development] nmcc89:
congrats guys, you've done a fantastic job over the last few months
[Captivate Android Development] Nitro_123:
EPIC WORK guys!!!! Reading this from day 1 and am soooo happy to see it's finished. :)

now hopefully we can get some dual-boot solutions coming up. And i think the SGS has 2 GBs of ROM so i think it can dual-boot from the ROM memory itself? and can this mod be made to work on the SGS I9000 ?? I hope it can be done :)
[Captivate Android Development] connexion2005:
It can it will just take some time as there will be some reverse engineering required for each of the boards they work on as the resistor location is different. Once the OM5 pins are found on a board, it should be the same from there out. I'm interested in whether they can crack the I2C bus an hijack the iROM.
[Captivate Android Development] b-eock:
How much does all the adruino thing and everything needed cost Adam, and what OS would i need to be running?

Sent from my stock KH3 2.3.4 AT&T Captivate!
[Captivate Android Development] AdamOutler:
You can help connexion2005. Since you are a major repair shop, any dead boards you receive, send them my way... Here's the list http://xdaforums.com/showthread.php?t=1236273

You will need..

Soldering iron.. $10-100

I use a temperature controlled one, however I only got that recently.. before I was dremmelling a $10 35W radio shack soldering iron to a sharp point.

Arduino Mega/Android Open Accessory Development Kit (ADK)/Bus Pirate/3v-5v UART device- $40 for arduino $300 for ADK... $35 for Bus Pirate.. $20 for other UART>USB devices.

A relay (for the wire).. Also available at Radio Shack for $3

So like.... it's a balance of skill/stedy hand and price.

Here's the rundown on how to get everything working http://xdaforums.com/showthread.php?t=1235219
[Captivate Android Development] AdamOutler:
I should mention that radioshack has now started carrying parallax items. Including a Arduino knockoff. You can get everything for bootloaders development at radio shack

You only need the stuff at the first post to reload a bootloader though.
[Captivate Android Development] Rebellos:
UART interface (Arduino) is not necessary. You just won't see the debug output but still can upload needed binaries through USB.

I think that someone is mixing up SRAM with SROM. At least I don't know anything about additional 2mb ROM in SGS (well, oneNAND is also EEPROM in fact, but I think you mean something else).

Please correct me if I'm wrong.

OM resistors should be at the same place on I9000 as on the Captivate.
[Captivate Android Development] midas5:
There is a second ROM, but i don't know what it does. It is called the DMZ i think. Changing one of the pins causes it to run instead of the IROM
[Captivate Android Development] Rebellos:
Indeed.

Interesting, haven't noticed it before.

Changing which pin? Where did you read that?
[Captivate Android Development] midas5:
I am not sure of the details. Just search the apu manual for DMZ.
[Captivate Android Development] AdamOutler:
Interesting... theres no references to it except that it is an insecure memory location...

0xD800_0000 to 0xDFFF_FFFF

128MB DMZ ROM...

Why is it 128MB? That's huge... It could be capable of running an entire OS on the chip... Ubuntu Minimal would fill 1/2 of that.

I don't know if we are executing that though..
[Captivate Android Development] bulletproof1013:
Adam, sending you something in the mail to show my gratitude should be there 3-7 days. its not much , but hope you enjoy ;) thanks for the hard work. I would of sent everyone who contributed a lil something but...dont know your address's. Anyhow Thanks for everything everyone.
[Captivate Android Development] Nitro_123:
can someone please confirm this??
[Captivate Android Development] bulletproof1013:
http://xdaforums.com/showthread.php?t=1236273
[Captivate Android Development] Nitro_123:
Thanks friend. Really appreciate it :D
[Captivate Android Development] Rebellos:
S5P100 UM:

Please note that 128MB is size of the address space, which doesn't mean there is such big amount of mem.
[Captivate Android Development] AdamOutler:
Rebellos, I'd like to try using the U-Boot universal bootloader sometime. Do you think it would be possible to use the Hummingbird Interceptor Bootloader to load U-Boot to 0x40244000 and it would just run, or is the PBL signed and I'd have to offset the code a bit, or would it be a bit less simple then that and we'd have to encorperate the IBL part 1 into Uboot?
[Captivate Android Development] ostrianiel:
Wow this came at a great time!

I bricked my phone a week ago. Hard brick, no response to anything...

Anyway, I'm in mexico so I cant really send it to Samsung or a JTAGer. With this developed how could I get my baby running again?
[Captivate Android Development] bulletproof1013:
YES!
[Captivate Android Development] ostrianiel:
After I do the mod, install the drivers, etc. What would I flash to get it to boot again?
[Captivate Android Development] AdamOutler:
For now, you will need a Linux machine...

I will release the firmware shortly... it's on our SVN repository here: http://hummingbird-hibl.googlecode.com/svn/trunk/

If you'd like to get started, perform the modification and then get Linux ready in a virtual machine, or install it on your computer and we can work from there... I'll send you a file by email. I'll make an official release when I can get a video together. We've decided not to release without clear instructions including a video to show people. The reason is we don't want the release thread cluttered with other stuff. right now this unbrick involves typing in convoluted commands into the Linux Console... not user friendly, but it works.

I'm working on creating a 200 meg or less virtual machine which serves the sole purpose of unbricking a device. it will be ready shortly. Then you can download Virtualbox (80 megs), download the virtual machine, import the virtual machine, click start and it will do its thing.

For now, the best thing you can do is apply the om5 mod and get Ubuntu working. I'll work with you directly from there.
[Captivate Android Development] AdamOutler:
I should mention that our enthusiastic friend here:

used this mod last night on his captivate.
[Captivate Android Development] midas5:
Regarding the release of the fix, it would probably be best to put the source code, howto docs, and binary files all on the svn. Particularly when the OM5 mod is different on each model.

Once the OM5 mod is done we should be able to write a one click recovery program that gets from test B/D mode to LOKE download mode.
[Captivate Android Development] AdamOutler:
We're already working on it....

I was able to reuse code from my Heimdall One-Click app. This made development really quick.. I've got to clean up the code still and add in windows functionality and drivers... You can still see it saying "heimdall" all throughout the code.

Normally, at this point, I'd say "hey, if you want to run this, get Linux".. However we ran into a critical error with Heimdall's ability to apply a repartition to the device. It cannot do it. When my device was assimilated by Bada OS, I had to transfer from Linux to a Virtual Machine running Windows in order to run Odin...

Rebellos is working on a port of SMDK-tool to Windows, so we may be able to get everything up in operations tonight.

Likely, we will not support Windows XP. If you're using Windows XP, you will need a Linux Virtual Machine to unbrick or install drivers on your own. I will likely not be able to provide support for XP as it is 10 years old and Microsoft is dropping support within 6 months... Just as microsoft's policy is to support for 5 years and then only have paid support/minimal services, I think it would only be appropriate to say: You'd have to pay me to support Windows XP fully. So... if you're running XP, get a Linux VM. Preferrably Ubuntu. Use VirtualBox. it's free and it takes work to set-up. If you want no-work, fork out cash and buy a newer version of Windows.

Midas5, send me your email address via PM so I can add you as a contributer to the SVN.
[Captivate Android Development] jmtheiss:
Adam,

As this project moves forward, do you ever forsee there being a time when the mod will not require a hardware modification?
[Captivate Android Development] connexion2005:
If they can hack the I2C bus then the OM5 resistor should be able to remain untouched.
[Captivate Android Development] jgaviota:
Do you think it will ever be possible to unbrick a Galaxy Tab?

Odin froze after flashing pbl before flashing sbl, hence hard brick
[Captivate Android Development] Rebellos:
If you really want to run Uboot, it would need some changes in source (different execution base, and GPIO mapping also differs) and recompilation. Tbh I don't see reason why to do it now. If somebody gives me good reason I can do it.

I still don't believe we're able to convince AP using I2C in any way to boot in USB dload mode. Well, not on Waves atleast, I've got whole AP connections schemes and I don't think there is a way to do it on SGS also.

However, it may be possible to recover from brick using UART on SIM card slot.

I'm porting linux tools to win32, they are ready to test. And it's possible that we'll have working unbrick method for Windows tonight.
[Captivate Android Development] ostrianiel:
Thanks! Ill get started on the hardware mod tonight
[Captivate Android Development] midas5:
The I2C idea is as follows:

Use I2C to corrupt the BL1 aka IBL.

We should be able to read and write to the onenand over I2C. Very slow but should work.

The will cause the IROM to fall back to test B/D mode due to the security check failing on BL1.
[Captivate Android Development] midas5:
Regarding the repartition problems with heimdall.

We have sbl source code so we could fix heimdall now if we wanted.

We could make repartitioning safer.

If we compare the new partition with the existing one, and the new one has the same partition sizes for PBL and SBL, we could repartition without having to write bootloaders. This would make repartitioning safer. I think all the existing partition tables have the same PBL and SBL partitions.
[Captivate Android Development] ostrianiel:
That was the most ridiculously difficult soldering I've ever done :eek:

Ill see if it all went well when the virtual box is ready