[Upgrading, Modifying and Unlocking] Aou:
I've been following the Captivate UnBrickable Mod thread, this thread, and I'm thoroughly impressed by the work you two (and many others) have done. I've taken an interest in poking around inside my Infuse (see pictures).

My questions are these:

1a. If someone were to successfully create a custom IBL/PBL that boots on the S5PC110, or even go so far as to load U-Boot or similar, would it be possible to flash this modified code onto the oneNAND, overwriting the existing IBL and (if needed) PBL?

1b. Supposedly, the IBL+PBL is "locked" on the Infuse, but gtg465x and I were able to successfully write the IBL+PBL+SBL on my first Infuse, inevitably hard-bricking the device (it's since been warranty replaced, so don't bother asking for my dead/bricked device - sorry!). If I had some way of unbricking my new device conveniently (JTAG for example), I would re-try the method gtg465x used, just to watch UART output and see what was going on behind the dark screen of a bricked Infuse.

1c. Regardless, it seems it would be possible to write anything to any part of the oneNAND if one had the proper tools (JTAG, which I am actually considering purchasing a JTAG device for several reasons!). Correct me if this is not the case.

2a. Has anyone tried intentionally corrupting the IBL? Has anyone tried to reproduce this state to confirm that this enables UART/USB as the primary booting source?

2b. If I had a way to recover my device (JTAG, again), I would like to test this myself.

3a. What cable/device/attachment is needed for the CPU to be able to attempt to boot from UART/USB (given xOM5=1, for example)?

3b. Is this just the standard USB OTG cable, or are you communicating to the device over TTL UART?

3c. What is the CPU physically looking for, exactly, when booting this way?

I suppose my goals are these:

1. I would first like to be able to JTAG my Infuse, as a means to recover from the stupid s*** I would like to do to it.

2. I would like to retry gtg465x's method of writing bootloaders, and confirm that this is possible by using nothing but software on the device itself (i.e. no JTAG), given the device is still operational and rooted.

3. I would like to intentionally corrupt the IBL, theoretically turning the device into a KIT-S5PC110 development board. From here, I could work as a tester on your team, and try loading whatever-code-you-come-up-with on the Infuse and hand you results.

4. Once a working/useful IBL+PBL has been created/ported (such as u-boot), I would like to attempt flashing this onto the oneNAND and be able to boot from this without the need of tethering the device to a PC. Further, this would theoretically allow booting from any device (emmc, for example), which would open the door to many, many possibilities.

5. I'd like to see a Dev take the work from goals #3 & #4 and create a script/package/etc that recreates these two steps. I would be happy to test such a script/package/etc.

6. Once goal #5 is complete, Devs could easily start working on porting alternative operating systems to our devices, without substantial fear of bricking their device (e.g. boot iOS or WP7 from emmc, screw around with that, and then boot back into Android from their NAND when they are done for the day).

Thanks for your time reading through my wall-o-text. ;)