yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] Rebellos:
You can connect it to get UART output from wave. But it's not the way to unbrick device. To unbrick device you don't need UART, but UBMod. Resurrection is still under construction.
[Bada Software and Hacking General] ekhalid:
Ok, thanx Rebellos, i'm waiting for it :(
[Bada Software and Hacking General] josehur9:
I do the same, but i can't see lismore, only ready on multiupload.

By the way, if i apply the sbl that comes with sgs series unbrick for windows i can use odin with my phone, but impossible to use multiuploader.

Tomorrow i wil upload a photo of my modded device.

Thanks rebellios!
[Bada Software and Hacking General] adfree:
I have backup my NV items with QPST...

This was enough to restore my S8500 after my little erase experiment with JTAG.

This restores also IMEI...

NV item 550...

Also good idea, maybe...

To backup folder NV and nvm...

What is actually status? :o :confused:

I wish to rebuild old Firmware XXJB6...

But I can't bypass Bootloader Security or I am toooo dumb to use RIFF JTAG for this...

Never successfully changed Boot. Only with 1 click Ressurection Button I can write successfully XXJEB Boot...

This is enough for reanimate handset, but not enough for research... :(

Any suggestions. :)

Thanx.

Best Regards
[Bada Software and Hacking General] ho1od:
I have the same problem

I need a memory map, I should make a new bootloader on the basis of BL1 from Rebellos
[Bada Software and Hacking General] Rebellos:
The problem about all of that is that SGS series usually does handle damaged NVData by creating dummy one. Here in case of damaging oneNAND partition table, SysSecureData corruption causes BL3 just fails at almost every operation. I'm slowly working on making some code for resurrecting SysSecData partition.

UBMod is working but BL3 does fail on writing anything to flash. :(
[Bada Software and Hacking General] k8500:
The One Click Resurrector link (first post) does not work, and I had trouble finding it anywhere else. Could you update it?

Thanks for your great work, btw!
[Bada Software and Hacking General] hero355:
also see here maybe little help ---> http://xdaforums.com/showthread.php?t=1235219
[Bada Software and Hacking General] k8500:
I think we need this one. But, what option to select? S5PC110 (Galaxy S)?
[Bada Software and Hacking General] hero355:
İ never used it before I can't help anymore
[Bada Software and Hacking General] k8500:
Can anyone actually write a simple step by step on what to do to revive a bricked GT-S8500 (after the physical modifications are done)?

I just want to make sure that this actually works before I do the modifications.
[Bada Software and Hacking General] Rebellos:
Actually I never finished it. Trouble is in reviving SysSecure data in case these are damaged. It's of course possible but troublesome. But in case your oneNAND is working and contain valid syssecdata and just bootloaders had been damaged - you should first load HIBL and then image of BL3. I'm sorry but I won't provide you guide.
[Bada Software and Hacking General] adfree:
Please can we complete the steps for S8500 this year. :angel:

At the moment I am here:

Windows32DriversAndCommandLineApp.zip works under XP...

after unbrick.bat I can see Modem Driver under COM 33...

Odin3_v1.85.exe can find my "Captivated" Wave...

I have tried to take BL3 from RIFF Box ELF... because it is special one for Download Mode...

echo off
echo Please connect device, install secusb2 driver and press any key...
PAUSE
win32-smdk-dltool HIBL.bin D0020000
win32-smdk-dltool [B]S8500BL3RIFF.bin 42480000[/B]

echo Your device is in download mode, press any key...
PAUSE

Please, where is my mistake?

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Rebellos:
Did you try S8500 BL3 from HIBL repo? I'm sure we've got it working partially. The trouble is that there's no-go beyond that point if SysSecData is damaged as it's used for initializing download mode (not sure, maybe it would go into dload mode without it) and flashing things.

SysSecData rebuilding code would be needed, and never been arsed to write some, as it's just too much work. :s
[Bada Software and Hacking General] adfree:
Thanx.

My progress:

http://xdaforums.com/showpost.php?p=43597348&postcount=28

Short summary.

I have now 2 BL3 for DL Mode:

Your BL3 from HIBL repo
BL3 ELF as Binary...from RIFF

At the moment I can not flash with ML.

Warring : Security fail!!

My Wave is without IMEI and no NV data... so I think this is the reason...

Next attempt I can restore before and try again... :D

Otherwise if NV items are the problem, then easiest way would to force BL3 to start with Factory Production Mode

http://xdaforums.com/showpost.php?p=41670635&postcount=5

So Restore with QPST possible...

About HIBL... :D

It seems I can restore XXJB6. :D :D :D

I hope that not dream.

http://xdaforums.com/showpost.php?p=43598534&postcount=21

Here BL3 starts at:

0x42380000

Will test today... maybe here Modification to force DL Mode more success.

Maybe less Security?

Best Regards
[Bada Software and Hacking General] adfree:
To reach Download Mode, it seems not mandatory to Modification of BL3...

If fast enough Keys pressed, then DL Mode. :D

Tested with unmodified BL3 from XXJB6 :cool:... but also

Warring : Security fail!

Because also special JTAG Bl3 fail... I think the magic is somewhere here, in CMM script:

SYStem.CPU CORTEXA8
SYStem.JC 8mhz

break

r.s cpsr 0xd3
d.s SD:0xe2700000
d.load.elf BL3_univ_s.elf

r.s PC 0x42480000
go

enddo

Best Regards

Maybe this watchdog disable thingie...
[Bada Software and Hacking General] adfree:
My progress...

http://xdaforums.com/showpost.php?p=43732739&postcount=328

For now I can not use HIBL complete...

DL Mode not work with Multiloader...

I will try to check why... it seems to "die" after pressing Port Search...

Short test with Commands send manually, handset seems not to answer anymore...

Second test to boot only also fail... I can see only Picture from RC2...

So Read access to OneNAND seems to work... but it seems to fail to load or execute apps_c..

Will test different HIBL Version I can find... maybe also only my fault...

My BL3s + addresses from 0xA0 works fine with CMM Script + RIFF... but here is watchdog disabled...

Best Regards
[Bada Software and Hacking General] adfree:
I have tried 3 different HIBL.bin Version I have found...

Latest I think was 2.1 ...

No success... I can't bypass ML Security... :(

No idea why...

Theory about write protection short tested...

Something is written into OneNAND from BL3...

Need to be tested again, maybe something else writes data into OneNAND... :o :confused:

Interesting...

{"S5PC110 (Galaxy S)", "SMDK", "HIBL.bin", "D0020000", "Sbl.bin", "40244000", GalaxyInstructions},
{"S5PC110 (Nexus S)", "SMDK", "HIBL.bin", "D0020000", "nexus_sbl.bin", "33040000", NexusSInstructions},
{"S5PC111 (Galaxy Player)", "SMDK", "HIBL.bin", "D0020000", "GPSbl.bin", "40244000", GalaxyInstructions}

Also Galaxy Player with S5PC111 work on S8500... I mean the SBL starts COM Port :good:

Will try to find S5PC2xx stuff to check backward compatibility...

HIBL stuff found here...

https://code.google.com/p/hummingbird-hibl/downloads/list

Thanx.

Oh, not tested yet... HIBL v2.3 ...

http://code.google.com/p/hummingbird-hibl/source/list

Best Regards

Edit 1.

Oh, maybe 2.5 latest...

http://code.google.com/p/hummingbird-hibl/source/detail?r=42

Will try...
[Bada Software and Hacking General] adfree:
Maybe luck, maybe progress... :D

I have flashed Fullflash/JTAG Image from I9000 to my S8500...

Now Odin writes successfully.

<ID:0/036> Added!!
<ID:0/036> Odin v.3 engine (ID:36)..
<ID:0/036> File analysis..
<ID:0/036> SetupConnection..
<ID:0/036> Initialzation..
<ID:0/036> Get PIT for mapping..
<ID:0/036> Firmware update start..
<ID:0/036> cache.rfs
<ID:0/036> NAND Write Start!!
<ID:0/036> factoryfs.rfs
<ID:0/036> modem.bin
<ID:0/036> param.lfs
<ID:0/036> Sbl.bin
<ID:0/036> zImage
<ID:0/036> boot.bin
<ID:0/036> RQT_CLOSE !!
<ID:0/036> RES OK !!
<ID:0/036> Completed..
<OSM> All threads completed. (succeed 1 / failed 0)
<ID:0/036> Removed!!

Will check again...

Best Regards

Edit 1.

Tested again... with FULL erased/empty OneNAND not possible:

<ID:0/036> File analysis..
<ID:0/036> SetupConnection..
<ID:0/036> Initialzation..
<ID:0/036> Get PIT for mapping..
<ID:0/036> Firmware update start..
<ID:0/036> cache.rfs
<ID:0/036> NAND Write Start!!
<ID:0/036>
<ID:0/036> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

Solution seems proper OneNAND content or writing before working Image... like this:

i9000 full working.bin

Forgotten where I have found this...

Okidoki, will check my collection of S8500 Fulldumps... :D
[Bada Software and Hacking General] adfree:
WDOG_CTRL_SFR	dw 0xE2700000

I have seen this in HIBL source...

CMM Script...

d.s SD:0xe2700000 %LE %LONG 0x00000000

So Watchdog maybe not proper deactivated... for S8500/S8530.

Or HIBL is "optimized" only for I9000 etc... Android devices...

I have also success with Resurrection DLL of RIFF for I9000 and so on, if I choose:

Gremlin zone repair...

I think this is aka UPCH stuff...

http://xdaforums.com/showthread.php?t=1328002

So I need not 45 minutes to flash whole I9000 512 MB Image...

I can press Ressurection Button... few Seconds and my S8500 is ready for HIBL action... but only with ODIN stuff... SBL...

I will do some more tests with CMM Script...

remove line of Watchdog etc... to check if then RIFF Box creates same restriction...

Best Regards
[Bada Software and Hacking General] Rebellos:
Disabling watchdog is just to make sure the phone won't reboot out of sudden after ~3secs from bootup.
[Bada Software and Hacking General] adfree:
Thanx, few days ago I have tried again with CMM Script editing...

So I removed Supervisor line + changed Watchdog address to fantasy Value...

SYStem.CPU CORTEXA8
SYStem.JC 4mhz

break

d.s SD:0xe2000000
d.load.elf BL3_univ_s.elf

r.s PC 0x42480000
go

enddo

Working on full erased/empty OneNAND...

So magic is somewhere else in RIFF JTAG... :confused: :o

Maybe Commands sent by RIFF, which I can not see... only sniff...

---------------------------------------

On empty/erased OneNAND if I do Resurrection for I9000 with Gremlin Option.

Then unbrick.bat + Odin Flashing = success. :cool:

I have forgotten if I have tried this UPCH thingie from S8530...

http://xdaforums.com/showpost.php?p=43436279&postcount=6

Will try again and report later...

Best Regards
[Bada Software and Hacking General] adfree:
:confused:

Strange...

No way to use BL3 of S8500 to bypass Multilflasher...

Tried now also this S8530 dump:

http://xdaforums.com/showpost.php?p=43436279&postcount=6

No luck with bada... :(

But this work for SBL ... and Odin flashes all files...

:confused:

Will try to compare all 3 JTAG dumpes...

Will try to use BL3 from S8530 to be sure, this is not S8500 problem...

Best Regards
[Bada Software and Hacking General] adfree:
New tests...

I have taken my S8530 Dump from S8530 Resurrection DLL...

First data I have found at 0x1FF00000 something with UPCH...

So I have deleted/erased data from 0 - 0x1FEFFFFF

Odin works with I9000 Firmware after unbrick.bat...

So something mandatory is in this area between 1FF00000 and 20000000.

This is 1 MB ...

Will check more...

Best Regards
[Bada Software and Hacking General] adfree:
My fault... :o

unbrick.bat + SBL + Odin works on complete empty OneNAND... in my S8500.

bada BL3 no chance at it seems... :(

I have tested several combinations with my little brain... with S8500.

Same result like him:

http://xdaforums.com/showpost.php?p=20915050&postcount=29

Damn BL3 checks something, but I have no idea what...

Maybe later I will check bada 2 Beta Bootloaders like XPKD6 or XPKG5... maybe here lower Security...

Best Regards
[Bada Software and Hacking General] Rebellos:
BL3 is coded to have much tighter security than SBL, mostly it needs SysSecData and areas around intact to perform a flash properly.
[Bada Software and Hacking General] adfree:
But how it could be that same BL3 can do the task with CMM Script in JTAG RIFF on empty OneNAND.

:confused:

Okay, my tests with JTAG victim S8500... so no Original state.

But I don't think that other users fail is reason of SysSecData... maybe because untouched area...

Btw.

Where is SysSecData ? :o

OneNAND?

Or in moviNAND somewhere?

1 idea is to create own PIT file... to write area from 0 - 0x400000 with Odin...

But I have at the moment no clue about PIT...

I have only short checked to write only PIT and then check dump...

It seems many weired data is written too on many different addresses...

Solution could be...

own SBL :D

With writing only area marked in PIT file...

This could then also work on "all" other Android handsets... :angel:

Not only bada...

I9000 etc.

I have few damaged I9000 boards for tests... maybe...

Best Regards
[Bada Software and Hacking General] adfree:
Memo to me...

Warring : Security fail!!

ML or Boot hangs here...

CMD_USB_SECURITY

Next time I will try to to write something via Command...

And/or sniff what Handset find after Port Search...

CMD_USB_INFO

Maybe allready this Command failed, as I've tried again with complete empty OneNAND...

Later more... in second round... :D

Best Regards

Edit 1.

Sniffed with Portmon... after CMD_USB_SECURITY Wave do nothing...

Fulldump with JTAG shows nothing is written... except UPCH stuff...

Now I will compare Dump with CMM Script Version...

Hmm. Content of 512 MB OneNAND is 1:1 same...

So the problem is in RAM... maybe.

Hmmm. Maybe something goes wrong in RAM...

Will try next write few Bytes only via Command... maybe this work...

I have also tried before send few Commands successfully without Error, but no visible effect...

7E0271010000007BCD7E
7E01607D5E937E
7E0150FDA27E

Edit 1.

CMD_USB_SECURITY is only 1 part of writng Computername Country etc...

7E0280...blabla is send and normally answer is:

7E 02 02 6A D3 7E

But "HIBL Version" not answer this...

512 MB OneNAND at 0x1E800000 is empty... no further Commands send possible...

Normally at this address Header 3412CDAB is written... and 2 x 32 Bytes... + few Bytes more...

Will try later to find out, what this is... maybe encrypted SEED stuff...

No idea yet, when this section is complete written... maybe after finish whole Flashing job...
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=49719555&postcount=27

[B]CMD_USB_SECURITY[/B]
security_usb_cmd ()
gHostInfo.pComputerName = blabla
gHostInfo.pIP = 111 111 1 11
gHostInfo.pLocation = atHome
gHostInfo.pToolVer = yes
gHostInfo.uDatePC = 1234
Packet Received 7 6 6

It is possible to set higher Debug Level... with more output...

No idea if Level 9 is maximum, as 4 Bytes reserved in this Command...

Only little problem... I have no idea, how you have manipulate via FOTA to output on UART...

:confused: :confused:

As I can not use FOTA with HIBL...

Will try if output is on same position... so I could try catch via JTAG...

Best Regards

Edit 1.

Okidoki...

HIBL.bin force/enable more output to UART...

This is not Standard of BL3...

So maybe now something reserved/blocked in RAM to perform CMD_USB_SECURITY complete and to answer with:

7E 02 02 6A D3 7E

For test Write Commands I need more time/practice... :o
[Bada Software and Hacking General] adfree:
CMD_USB_ERASE
erase_memory() : 0x1d900000 (0x80)
FLASH_RSRC2_START_ADDR
UbootWriteData 6

Erase seems to work with HIBL...

I've created this Command:

7E 02 EE 00 00 90 1D 80 00 00 00 F7 1D 7E

Maybe it would help to simple remove/replace CMD_USB_SECURITY in Multiloader.

I can find AT Command and replace easily in ML:

http://xdaforums.com/showpost.php?p=49806904&postcount=37

But I am not able yet, to identify the other Commands in ML... :o

@ Rebellos

If you not working for Samsung R&D Poland or to busy with I9300, please help to identify Commands in Multiloader exe...

So we could successfully finish this project in 2014. :angel:

For bada too.

I need more time for write Command...

And I need years to reverse Multiloader for find Commands... :(

Thanx in advance.

Best Regards
[TouchPad Accessories] Humper.GFX:
Hi guys, I got 2 subject so I thought I'll just make one thread for this.

I'm from EU so I used my US charger with an other plug. Seemed to

work great, doesn't complain like it does with my HTC phone charger.

But now the charger gets pretty hot, along with the USBplug that is in the charger. Should I be worried? I would say its about 50-70celsius.

_______________________

So I got Quake from preware, but it doesn't work with touch only (even tho there r touch controls?) so Im wondering if its possible to get it working with this:

http://icontrolpad.com/

That would be nice with the snes emulator also so I might buy it, its very expensive tho but I like the oldschool'ness of it.
[TouchPad Accessories] Troute:
You're likely to burn it out if you keep using it, don't leave it on unattended.
[TouchPad Accessories] Humper.GFX:
Sure? Does your get hot?

The charger should handle ~220v as we got here. So I don't get why this shouldn't work.
[TouchPad Accessories] Adonis K.:
Isnt there a way to find a compatible European charger without paying 30$ for the travel pack?
[TouchPad Accessories] dmarchant:
Pretty much any micro-USB charge will charge the Touchpad, it is just some will be quicker than others. I am charging from the USB port on my laptop at the moment and it has upped the charge by 8% in the last hour or so with the screen off.
[TouchPad Accessories] Humper.GFX:
Yeah but the normal one gives about 30% on that time. But as I said, it should work, no problem. I don't think its uncommon for it to get hot but I'm not sure tho
[TouchPad Accessories] dmarchant:
My official charger gets quite warm, together with the USB plug. Clearly that is the only device that will charge at full speed and without a warning on the screen. However, as I was trying to point out, you don't have to go down the official charger route if you are prepared to either accept the on-screen warning or a slower charge rate. The Blackberry Playbook charger gives 5V 2A and although it comes up with the on-screen warning charges almost as quickly as the official unit.
[TouchPad Accessories] Troute:
I bought one of these http://www.mymemory.co.uk/iPod---iP...s-USB-Charger-and-Socket-for-iPod_iPhone_iPad the other day, rated at 2.1 amps (though the unit shows 3 amps). I get the dire message about not enough voltage or current but it works fine and quickly. Obviously I don't use the supplied Apple cable...
[Thunderbolt Q&A, Help & Troubleshooting] trentreed:
It seems to not want to restore sense roms it works fine on cm....

Ideas anyone?
[Thunderbolt Q&A, Help & Troubleshooting] cam30era:
Where did you find 5.0.2.0?
[Thunderbolt Q&A, Help & Troubleshooting] RevosFTS:
Use the older one there se problems across the board with cwm recovery 5x

Sent from my tbolt running ShiftTh3ory AOSP
[Thunderbolt Q&A, Help & Troubleshooting] Kaptain75329:
I think version 5.0.2.1 has been released - perhaps check to see if this resolved the issue?
[Thunderbolt Q&A, Help & Troubleshooting] hallstevenson:
Yeap, no issues here and I'm using .... *gasp* .... an older version. What did 5.x.x.x add that is a MUST-HAVE ?
[Thunderbolt Q&A, Help & Troubleshooting] trentreed:
5.0.2.1 has fixed the mounting issue
[Galaxy Tab 10.1 General] kettlecorn:
why do you have 2 threads with the same content?
[Droid X Themes and Apps] marculous:
http://dl.dropbox.com/u/11997836/bootanimation (3).zip

did this for my droid x

rename bootanimation.zip, place in system/media:cool::D:)
[Motorola Droid and Milestone General] zeppelinrox:
Update:

I got ICS SuperCharged! See Post 92!

And hey, rank the thread n click thanks n stuff :)

So I had indeed been working on V8 SuperCharger and when V6 got really hot, I kept pretty busy making it better and better.

Of course, this leads to a much better V8 than would have been possible.

At the time, it was very much Milestone specific in that I made an overclocking feature that makes a file just like 10overclock as below.

#!/system/bin/sh

echo "5 1100000000 66" > /proc/overclock/mpu_opps
echo "4 800000000 45" > /proc/overclock/mpu_opps
echo "3 600000000 35" > /proc/overclock/mpu_opps
echo "2 400000000 27" > /proc/overclock/mpu_opps
echo "1 200000000 22" > /proc/overclock/mpu_opps

The new file will be /system/etc/init.d/99sc-overclock

10overclock is

untouched

.

The 99sc-overclock settings will stick because it will run after 10overclock.

UnOverclocker simply deletes 99sc-overclock :)

Big thanks to skadude66 for helping me with testing out the Overclockerthingie!

This V8 Alpha also has an early implementation of 3g TurboCharger and user selectable colours.

I have these older screen caps that I'm using since I had lost my Milestone...

This is what it looks like....

\\\\ V 8 S U P E R C H A R G E R - M E N U ////
==============================================

1. SuperCharger & Launcher Status"
2. Aggressive 1 Settings {6,8,24,30,40,50 mb}
3. Aggressive 2 Settings {6,8,25,30,35,35 mb}
4. Balanced 1 Settings {6,8,24,26,28,30 mb}
5. Balanced 2 Settings {6,8,26,27,28,28 mb}
6. Balanced 3 Settings {6,8,26,28,30,32 mb}
7. MultiTasking Settings {6,8,22,24,26,26 mb}
8. Gaming Settings {6,20,40,70,80,90 mb}
9. MegaMemory Device {6,12,75,125,150,175 mb}
10. Cust-OOMized Settings {See Slot 3 Tips!}
11. OOM Grouping Fixes + Die-Hard Launcher
12. OOM Grouping Fixes + BulletProof Launcher
13. UnDo Kernel/Memory Tweaks
14. UnSuperCharger
15. 3G TurboCharger + Hardware Acceleration
16. Overclocker {99sc-overclock SuperCedes OC}
17. UnOverclocker {Removes 99sc-overclock}
18. REBOOT! (WARNING - There is NO Warning!)
19. Exit

WARNING:

This is only for goofing around with!

The overlocker and unoverclocker are the ONLY useful features as the current V6 SuperCharger has different OOM groupings and the current 3G TurboCharger, which was just released, has 5 different configurations to choose from ;)

If you do apply SuperCharging with this early V8 version, UNSUPERCHARGE V6

BEFORE

supercharging with this V8.

Other ROMS on other phones, I don't know what would happen if you tried the Overclocker :p

Lastly, if you can donate, please do since it will help make further updates and a more polished V8 much quicker :p

Installation Instructions are the same as found in the monster V6 SuperCharger thread :D
[Motorola Droid and Milestone General] afonsolage:
Wow!

I loved the V6 and i'm using it right now!

I'm downloading this V8 and ill post a feedback.

Thanks for this great work man! :D
[Motorola Droid and Milestone General] skadude66:
Good work Zeppelin! I got caught up in all of the V6 supercharger and haven't been keeping up with the latest betas! I'm keen on trying this out :D

If you lost your Milestone, what phone are you using right now? :O
[Motorola Droid and Milestone General] zeppelinrox:
A crappy samsung thingie... updates from over a month ago till now are done "in my head"

Engine Flush, Nitro Lag Nullifier, the new 3G TurboCharger, KAK... I haven't seen them running with my own eyes as of yet LOL

Of course, V8 Alpha was done before that... I think this was done in May/July...

Oh and I forgot to thank you in the OP for assisting with the OCing at the time
[Motorola Droid and Milestone General] skadude66:
Hehe, no worries about the OC, just a simple idea to implement!

At this point, it's pointless to get a new Milestone, the new GSII is supposed to release sometime soon on Telus :D
[Motorola Droid and Milestone General] zeppelinrox:
Keyboard?

I wonder if droid3/milestone3 will make it's way here
[Motorola Droid and Milestone General] skadude66:
No keyboard, but it's rumored to have a 4.5" screen. The Droid 3/Milestone 3 is on Bell, so if you can buy it no term, you can just enter in the APN for Telus afterwards I guess!
[Motorola Droid and Milestone General] afonsolage:
V8 is working nicely!

Thx man!

Im using Gamming Mode :cool:
[Motorola Droid and Milestone General] zeppelinrox:
When the time comes, I will definitely look into it :)

Cool indeed :cool: