[Bada Software and Hacking General] adfree:
Hmm.

First test with my created PIT file and 2 rounds...

http://xdaforums.com/showpost.php?p=50364038&postcount=22

- Odin is connected!
FlashDevRead 63: Error(offset,length,j4fs_end,nErr)=(0x40000,0x1000,0x72757470,0x80040001)
j4fs_write_file_bootloader 192: Error(nErr=0x40000000)
process_packet: request id(100), data id(0)
process_rqt_init: platform number(0x0), revision(0x0)
process_packet: request id(100), data id(2)
process_packet: request id(101), data id(1)
.Done.
read 1 units.
check_pit_integrity: valid pit magic code.
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(3)
process_packet: request id(102), data id(0)
process_packet: request id(102), data id(2)
process_packet: request id(102), data id(3)
process_rqt_xmit: size(262144), id(0), final(1)
[B]Save Image (BOOT1) to flash ......
binary version: EVT1.
boot.bin is unknown bootloader.
not relocate & fusing continue..
Erasing: 0 to 1
.
bbm erase part success
.Done.
Written 1 units.[/B]
current percent: 6 (1/16)
current write_count=1
process_packet: request id(102), data id(0)
process_packet: request id(102), data id(2)
process_packet: request id(102), data id(3)
process_rqt_xmit: size(0), id(-4294967294), final(0)
xmit_complete_pda: binary type is not AP!!

Round 1.

Is only modified PIT writing... with I9000 SBL + Odin...

Block 1 = boot.bin

Block 2-8 = boot2.bin

Restart/Reset...

Round 2.

Created TAR with splitted Bootloader...

boot.bin 256 KB from dump...

boot1.bin the tail from dump...

result...

boot.bin is written... boot2.bin NOT written...

Strange... after dump with JTAG... first few Bytes are modified...

:confused:

I can see in Log something about "fusing"...

Next tests...

Best Regards

Edit 1.

Argh... my fault... now I will check result...

- Odin is connected!
FlashDevRead 63: Error(offset,length,j4fs_end,nErr)=(0x40000,0x1000,0x72757470,0x80040001)
j4fs_write_file_bootloader 192: Error(nErr=0x40000000)
process_packet: request id(100), data id(0)
process_rqt_init: platform number(0x0), revision(0x0)
process_packet: request id(100), data id(2)
process_packet: request id(101), data id(1)
.Done.
read 1 units.
check_pit_integrity: valid pit magic code.
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(3)
process_packet: request id(102), data id(0)
process_packet: request id(102), data id(2)
process_packet: request id(102), data id(3)
process_rqt_xmit: size(262144), id(0), final(1)
Save Image (BOOT1) to flash ......
binary version: EVT1.
boot.bin is the one-binary.
relocate & fusing continue..
completed.
Erasing: 0 to 1
.
bbm erase part success
.Done.
Written 1 units.
current percent: 6 (1/16)
current write_count=1
process_packet: request id(102), data id(0)
process_packet: request id(102), data id(2)
process_packet: request id(102), data id(3)
process_rqt_xmit: size(3932160), id(-4294967294), final(1)
Save Image () to flash ......
process_packet: request id(103), data id(0)
process_rqt_close: xmit completed!
FlashDevRead 63: Error(offset,length,j4fs_end,nErr)=(0x40000,0x1000,0x72757470,0x80040001)
j4fs_write_file_bootloader 192: Error(nErr=0x40000000)
process_packet: request id(103), data id(1)
process_rqt_close: target reset!
ARIES MAGIC_ADDR=0x0 / INFORM5=0x12345678
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------

+n1stVPN 22272
+nPgsPerBlk 64
+n1stVPN 46080
+nPgsPerBlk 64
ERROR.. Bootable SBL doesn't exist ..

Edit 2.

Ouch... again dead end... :rolleyes:

But now I am little bit smarter... :D

In Android world is boot.bin encrypted/signed...

So it will be decrypted first, before written to OneNAND... by Bootloader/SBL...

boot.bin is 256 KB ... (1 Block size)... and contain PBL "and"...

PBL from I9000 is UART enabled...

-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------

+n1stVPN 22272
+nPgsPerBlk 64
+n1stVPN 46080
+nPgsPerBlk 64
ERROR.. Bootable SBL doesn't exist ..