yashsingh1/xdaforums huggingface dataset:
[XPERIA X8 Q&A, Help & Troubleshooting] smokerman:
vai ás opçoes e ve se nao mexeste em nada..nao recomendo o OC porque este tlm nao precisa..se usares o default a 600mhz vai ficar tudo impecável.;)

minha opiniao pessoal: mudares para alfs kernel..sem bugs em quase nada..depende da rom que usares..mas actualmente fazem mais ROMS para alfs do que para NA..hope i helped,abraço.:)
[Gen8, Gen9, Gen10 Q&A, Help & Troubleshooting] MarsCarmen:
If I install Urukdroid in openaos like this post http://xdaforums.com/showthread.php?t=1153522How to update UD?
[Gen8, Gen9, Gen10 Q&A, Help & Troubleshooting] FrEcP:
- deleted -
[LG Nitro HD] beobu:
Smartphone Screen Shoot-Out: Which Has the Best High-Def Display? of Laptopmag

Hi all,

I am considering for Nitro HD to replacing my MS Moto.

But I am quite confuse with this test, especially for brightness, color accurancy, sharpness and maybe viewing angles.

So should I buy Spectrum or Nitro?:confused:

And you can read the Nitro review of laptopmag. It is not good at all.

All benchmark is low, some of very low.

Is this because of stock rom??? (sorry, I do not know how to post link and do not allowed)

Thx
[LG Nitro HD] Sharpshooterrr:
I think the Spectrum and Nitro have the exact same screen.
[LG Nitro HD] V@no:
Um...And the fact that Spectrum is for Verizon (CDMA) and Nitro HD for AT&T (GMS) doesn't bother you a bit?

No amount of unlocking can make one work on another's network and vice-versa...

http://www.gsmarena.com/new/compare.php3?idPhone1=4377&idPhone2=4329
[LG Nitro HD] beobu:
Yes, I know they use the same panel. But why display test result is different?
[Android Development on Bada] mijoma:
Hello

I treat this thread as DEVELOPMENT focused, so please keep non-technical questions and all the excitement aside and use it strictly for the technical discussion.

As most of you have been able to witness, FOTA seems the right track for bypassing bada bootloader security.

During the Android porting we have found ourselves in the situation where we developed a fairly simple asm code for the purpose of loading and booting Android.

A successful attempt has some important limitations, though. One major is strict dependency from the bada bootloader level 3 (BL3) that we used to interact with the hardware for us and provide filesystem abstraction. I feel that main reason for that happening was coming directly from what was the biggest advantage in the beginning - simplicity of building crafted FOTA module from asm.

Since the time I've made the discovery of the FOTA vulnerability (as described initially here) and after I provided sample framework for building crafted FOTA file for fasmarm (see here) only b.kubica and Rebellos took over and made it into the FOTA booting Android. That approach required installing specific bootloader version in the phone and used patched I9000 secondary bootloader (SBL), as we needed it to correctly initialize the display for the kernel.

The first attempt to make it more universal was proposed, but it still only introduced additional abstraction layer for BL3 calls and was using the very same assembler framework.

I'd like to change something again and therefore, I've scratched a new framework for building FOTA. This time, it is using a proper gcc toolchain and quickly jumps a level higher in abstraction - into C/C++ code. Linker scripts provide abstraction for building the right FOTA file headers and footers for:

- S8500 running bada 1.x

- S8500 running bada 2.x

- S8530 running bada 1.x

- S8530 running bada 2.x

All four targets are built from same source files with a single 'make'. I tested all that by writing FLOCK (that still is BL3 dependent but written in C).

In my opinion, it should allow us to get into development of the modules handling hardware, filesystem, etc. by ourselves (or simply building that from external source codes handling that) resulting in full independence from version of the bootloader installed.

Now we get to the right question - do you have suggestions as for what opensource bootloader project we should integrate into FOTA? I've done a proof-of-concept integration of u-boot and it compiles flawlessly (of course, getting it to run is whole other story as there's lots of low-level initialization procedures to be rewritten). Please answer with some supporting arguments as it's not voting and would prefer a discussion and picking the right solution.

The second thing - is there anybody with the know-how and interest in this development? I'd like to share the code and support it only in some spare time, so it would be perfect if somebody took it over.

Again, please keep this thread clean - strictly technical discussion here.

Regards,

mijoma
[Android Development on Bada] adfree:
b.kubica has awesome demonstrate with bTerm and unsecdload.fota:

- dump NAND for Backup or study...

- bypass apps_compressed.bin Integrety check. :cool: :cool:

It would be nice, if this could be combined and/or port for S8530 too.

I wished I could dump with bTerm also in bada 2.0.

I saw only Rebellos did something with bTerm...

Also I miss Upload to...

http://xdaforums.com/showthread.php?t=1176189

:o

Thanx in advance.

Best Regards
[Android Development on Bada] Rebellos:
One of the logical alternatives for uBoot is Qi from OpenMoko, it is much more simple, but that brings more limitations. And I haven't seen S5PC110 support in there. So some S3C cpu driver would need to be updated.

http://wiki.openmoko.org/wiki/Qi

Also leaked Loke for Spica could be used - it has got also S3C drivers (S5P~~is only abit updated S3C arch) already done for S3C64xx, so the cpu-driver the same as above.

Writing bootloader from scratch is rather pointless and I'd anyway use uBoot for that project - there already exists fully working sources for Odroid, that is Hummingbird based. But not much more we can do than hope some dev suddenly pop out of nowhere and join the project.
[Android Development on Bada] mijoma:
OK.

It's been a while and there has not been any activity around.

My time availability is completely not there as well. The least I can do is to upload something I had started months ago and never continued.

Maybe somebody experimenting with FOTA can use it at some point, maybe not.

In the attachment there's a project to be built using gcc toolchain (I used the one from bada SDK). It's rather simple but it already implements some of the lowest level stuff so the entry point is in C already and produces all 4 platforms (S8500 bada 1.x, S8500 bada 2.x, S8530 bada 1.x, S8530 bada 2.x) in one go.

I don't say it's an easy go from now, but you can use it however you wish and I hope it may be of some help at some point.

Best Regards,

mijoma
[Android Development on Bada] adfree:
Please.

Maybe mijoma or Rebellos could answer.

1.

Oleg_K replaced bada boot_loader.mbn in OneNAND...

If correct, how he was able to use other Boot? :confused:

I was never able to write Original Boot of my own choice with RIFF (JTAG)...

2.

As test device for Bootloader action I think S8000 Jet is perfect...

- cheap on Ebay...

- "similar" to S8500 but much less secured...

Maybe if Devs have S8000 for training...

Maybe this could little bit increase progress... about Bootloader functions... and or MODEM AMSS...

3.

It seems with CMM Script and JTAG (100% confirmed) it is possible to disable some of Bootloader Security... also few Commands (idea)... maybe...

UnlockSecBoot
PrtSecBoot

http://xdaforums.com/showpost.php?p=32611984&postcount=59

Maybe with FOTA it is possible to disable complete Boot Security and then remove/replace Boot by something else...

In my case I "need" XXJB6 bada complete... So XXJB6 Boot one day on my S8500 would be nice to see... :angel:

Best Regards
[Android Development on Bada] mijoma:
It is possible to replace the whole bootloader chain. Rebellos looked at the options and it comes out that depending on the data in the iRAM each bootloader stage will perform or not a verification of the next bootloader stage.

The bootloader that is used by Unbrickable Mod for our processor (used by Odroid project originally) is braking the chain of trust and this is the possibility to write whatever.

You should forget about S8000. It helps us in no way and there's no compatibility between the devices.

It is possible to disable security with JTAG but work will focus on the development platform that does not require JTAG. It will most probably allow using other bootloaders, but XXJB6 is nothing really special. I would rather like to see something (u-boot based possibly) being able to flash bada and android to OneNAND (not moviNAND as current) and run both without the security

Rebellos checked the partition map and it may be even possible to fit both systems into OneNAND if there wouldn't be FOTA installed.

FOTA may be used at the beginning of the process as there's no better place to start with diagnostics, modifications to memory, flashing of unsecure components and so.
[Android Development on Bada] adfree:
S8600XXKL1_S8600OXCKL3_TPH

S8600JVKK4_S8600XFVKK1_XFV

S8600DXLD1_S8600OLBKK6_XXV

S8600DXLD1_S8600OLBKK6_XME

S8600JVKK4_S8600OJVKK2_XFE

S8600DXKK6_S8600OLBKK6_XSP

S8600DXLD1_S8600OLBKK6_XEV

S8600DXLD1_S8600OLBKK6_XTC

S8600XXKK7_S8600OXEKL1_VHC

S8600XXLD1_S8600OXDLD2_XSK

S8600XXLD1_S8600OXDLD2_XEH

S8600XXLA1_S8600OXDLA1_VDC

S8600BOKK6_S8600TMZKK6_TMZ

S8600JPLB1_S8600OJPLB1_TMC

S8600DXLD1_S8600OLBKK6_THL

S8600XXLD1_S8600OXDLD2_XEZ

S8600JPKL1_S8600OJPKK3_AFG

S8600XXKK7_S8600OXFKL1_SEB

S8600XXLD1_S8600OXELD1_SKZ

S8600XXKK7_S8600OXEKK5_SEK

S8600XXKK7_S8600OXCKK1_PHE

S8600JPLD1_S8600OJPLB1_THR

S8600XXLD1_S8600OXELD1_MTS

S8600AELE1_S8600SFRLE1_SFR

S8600XXKK7_S8600OXFKK7_MTL

S8600JPKL1_S8600OJPKK3_PAK

S8600JPLD1_S8600OJPLB1_MWD

S8600XXLC3_S8600PRTLC4_PRT

S8600XXLA1_S8600OXBLA1_NEE

S8600JPLA1_S8600OJPKK3_MID

S8600JPKL1_S8600OJPKK3_JED

S8600JPKL1_S8600OJPKK3_KSA

S8600FRLE1_S8600LPMLE1_LPM

S8600XXLD1_S8600OXELD1_KCL

S8600XXLD1_S8600ITVLD2_ITV

S8600BVLD2_S8600FTMLD2_FTM

S8600JPKL1_S8600OJPKK3_BTC

S8600JPKL1_S8600OJPKK3_EGY

S8600JVKK4_S8600OJVKK2_AFR

S8600XWLD2_S8600OXGLD1_ATO

S8600JPKL1_S8600OJPKK3_ABS

S8600NAKL1_S8600EPLKL1_EPL

S8600XXLC3_S8600OXFLD1_COA

S8600XWLD2_S8600OXGLD1_BSE

Maybe luck and ELF files in 1 package...

Best Regards
[Android Development on Bada] hero355:
ELF can be only Operator firmwares (If it has).Because mostly it is been on operator firmwares

If I have enough space on HDD,I'll check all :)
[Android Development on Bada] _hacker_:
how to flash?

hi, i dont get it how to flash android onto wave 1. And i cant find a download link :confused: Can anyone help me? I downloaded Odin but I cant do anything with it. Can anyone write a short tutorial for that? Sorry, i gave up already to find it out myself.

Thanks,

hacker
[Android Development on Bada] By_KeReMM:
Wave 525

Can you create fotabootloader for wave 525 ? is it possible?
[Android Development on Bada] Rebellos:
Most likely no.
[Android Development on Bada] By_KeReMM:
ok.

wave 575 bada 2.0 port wave 525? most likely yes. because same drivers. my friends wave 723 bada 2 firmware ported wave525 but phone always restart. all low wave phones same boot files. i tested it. is you port bada 2 files for wave 525? i test it.

Sorry ,bad my english
[Android Development on Bada] hero355:
Theory! If we change in 575's bootfiles phone model to 525 then you'll chance

But :D You'll brick your handset
[Android Development on Bada] By_KeReMM:
No Theory. Real! i tested all boot files for low waves in my phone. Worked! but wave 533 boot files bricked my handset :D

it is Possible! Coming Soon! Next Summer! i will work this subject.
[Android Development on Bada] adfree:
@ By_KeReMM

Check this out:

http://xdaforums.com/showthread.php?t=1325713

Maybe search Internet for existing ELF files for Broadcom...

Maybe this help...

Best Regards
[Android Development on Bada] By_KeReMM:
i dont understand but i checked this.

is 7230 and 7230E same phones? 2 links not work "No Torrents Found".

if port boot files and apps_c... , i Ported all fw files. i'll test it. all files work! but apps_c... not extract

Sorry , Bad English.
[Android Development on Bada] adfree:
10 years later... :o

After reading little bit... and after Editing 2 files...

I was able to compile demo sources... :good:

http://xdaforums.com/showpost.php?p=34856402&postcount=4

make.cmd and Makefile

Edited to correct path to my installed bada SDK.

So it is easy...

1 click compiling... after start make.cmd.

Now I play little bit...

Thank you mijoma.

Best Regards

---------- Post added at 02:11 AM ---------- Previous post was at 01:46 AM ----------

Lesson 1.1

Inspired by Tigrouzen nandbootsd.fota ASCII Pic... :good:

Thanx.

Open with Text Editor

FOTA.c

[B]disp_FOTA_Printf[/B]("| Author: mijoma |");

Now you can try text or ASCII Pics... :D

Later I will write how many lines max. possible...

Best Regards

---------- Post added at 02:36 AM ---------- Previous post was at 02:11 AM ----------

#include <string.h>
#include <stdarg.h>
#include "BL3.h"

int main(void)
{

//here we start the real deal :)
int mmuctrl = MemMMUCacheEnable(gMMUL1PageTable, 1);
disp_FOTA_[B]Init[/B]();
disp_FOTA_Printf("*----------------------------*");
disp_FOTA_Printf("| FOTA TESTLOADER |");
disp_FOTA_Printf("*----------------------------*");
disp_FOTA_Printf("| Author: mijoma |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("| |");
disp_FOTA_Printf("*----------------------------*");
disp_FOTA_Printf("");

//.... Your code here...

//loop infinitevely
while(1);

return 0;

}

Here you can see maximal visible lines for output of text...

I can count 24 lines... tested on S8500.

Best Regards

P.S.:

IMPORTANT!!!

Remember if you play with BOOT or FOTA or whatever on your handset...

ALL at YOUR own risk!

Edit 1.

It seems each line can have 30 Characters...

So 30 x 24 = 720 :D
[Android Development on Bada] Rebellos:
@adfree:

So... does it work? I'm not sure if we ever tested it. ;D:D
[Android Development on Bada] adfree:
Yes, I can see text Output on my S8500 (XXLA1). :good:

Later I will try if S8530 also would work...

No idea... is M210S confirmed meanwhile ? Not sure if S8530 FOTA would work in M210S Firmware...

I could later try with S8500... and M210S Firmware...

Best Regards
[Android Development on Bada] ihavenick:
Truely its mine "ascii" in fota and we made it (With T) in .asm and Fasm compiler but i cant get working this.I tested this no output no boot but it can boot only bada :D . Mine bootloader is kk5
[Android Development on Bada] ihavenick:
Can you boot to Android?
[Android Development on Bada] adfree:
I have compiled only "Demo sources" from post #4... only text output.

zImage Upload to RAM not implemented...

This is perfect for check for instance on M210S...

Or maybe someone is able to find correct addresses for S8600, or S7250 or other Broadcom...

BL3_FBOOT_S8500_b2x.c

#include "BL3.h"

[COLOR="Red"]unsigned long c_MemMMUCacheEnable[] = { 0xaab9f874, 0 };
unsigned long c_disp_FOTA_Init[] = { 0xbfab9174, 0 };
unsigned long c_disp_FOTA_Printf[] = { 0xb69c410b, 0 };
unsigned long c_OemSysGetSystemInfo[] = { 0xc3ac31a5, 0 };
[/COLOR]
unsigned long *fun_crc[i_endMarker] = {c_MemMMUCacheEnable,
c_disp_FOTA_Init,
c_disp_FOTA_Printf,
c_OemSysGetSystemInfo
};

In theory only 4 lines have to be changed...

Maybe later I will try on my S8600, what exactly happens...

S8600 explode or... :D

Best Regards
[Android Development on Bada] ihavenick:
:D nope npthng will happed you know fota looking for which key pressed so if you dont touch it it will work :D

I will add R changes to make it work i looked there is not a boot code :D

Time to try fix it
[Android Development on Bada] adfree:
Okidoki...

Short tested on S8500 XXLA1...

If FBOOT_S8530_b2x.fota, then my S8500 not react of key pressing... but normal booting.

Now I will flash my S8500 with M210S Firmware, and check what is working...

Later I will report...

Best Regards

Edit 1.

Short tested on my S8500 with M210S Firmware...

FBOOT_S8500_b2x.fota
FBOOT_S8530_b2x.fota

No effect.

If I compare both files, I see where adresses differ... Little Endian...

Next step... To identify if all 3 addresses mandatory for key press event... or maybe only 1 needed... to see some difference...
[Android Development on Bada] ihavenick:
If you diable atag.c and .h it will show fota output but if you enable it blackscreen
[Android Development on Bada] adfree:
Task seems much harder...

:o

Short tested...

3 addresses differ between S8500 and S8530, but ALL 3 have to be bytecorrect... otherwise nothing happens.

Anyway... text strings like:

MemMMUCacheEnable
disp_FOTA_Init
disp_FOTA_Printf
OemSysGetSystemInfo

Taken from BL3_FBOOT_S8500_b2x.c can be found in ELF files from Bootloader...

I will try to find more infos...

Thanx for info... this comes later...

Best Regards
[Android Development on Bada] Rebellos:
These ain't adresses. These are CRC hashes of the functions.

And in S8600 there is most likely completely different system of booting and loading ROTA. So no go there.
[Android Development on Bada] ihavenick:
do anyone know how to get varible for fboot?

_PfsMassInit equ 0x420A9978 for asm

unsigned long c___PfsNandInit[] = { 0xa5fef2be, 0 }; for fboot

then we need

MemoryCardMount equ 0x420AA4D8 this to for Fboot
[Android Development on Bada] adfree:
All I know is study ELF files from Bootfiles folder... there have some maps...

BL3_univ.map

You can find here and in ELF text string...

PfsMassInit

This is all I know, SORRY.

Also I have no time yet for deeper reseach in this...

This exceeds my knowledge and skills. :o

My next pactice tests are... investigation in ELF...

fboot/Obj/FBOOT_S8500_b2x.elf

If these are valid files for JTAG RIFF to upload as

d.load.elf...

Second idea...

Need more brain for compiling ELF... especially BL3_univ_s.elf with bada SDK...

DREAM, because no idea how... :o

Last idea... need find valid path to Download zImage from OneNAND...

Best Regards

Edit 1.

For my JTAG test... with FBOOT_S8500_b2x.elf

Found valid ELF at pos:00000000
------------------
Type : 0002
Machine : 0028
Version : 00000001
[B]Entry : 43200210[/B]
Arch flags : 05000002
Hdr size : 00000034
ProgHdr offset : 00000034
ProgHdr size : 00000020
ProgHdr entries : 00000003
SectHdr offset : 000104B0
SectHdr size : 00000028
SectHdr entries : 0000000C
SectNameStrings : 00000009

ProgHdr:
--------
Type:0x00000001 Offset:0x00008000 VAddr:0x43200000 PAddr:0x43200000 Filesize:0x00000F78 Memsize:0x00000F78 Flags:0x00000007 Addralign:0x00008000
Type:0x00000001 Offset:0x00010000 VAddr:0x43480000 PAddr:0x43480000 Filesize:0x00000410 Memsize:0x00000410 Flags:0x00000005 Addralign:0x00008000
Type:0x00000001 Offset:0x00018000 VAddr:0x44000000 PAddr:0x44000000 Filesize:0x00000000 Memsize:0x00004018 Flags:0x00000006 Addralign:0x00008000

Later more

Edit 2.

JTAG RIFF Box can upload this ELF... :D

So now (for me) I need to know how to compile Binary from ELF... if possible with bada SDK

Thanx in advance.
[Android Development on Bada] Rebellos:
objcopy -S -O binary input.elf ouput.bin

It does STRIP elf file into raw binary.
[Android Development on Bada] adfree:
bada_SDK_2.0.4_Common\Tools\Toolchains\ARM\arm-bada-eabi\bin\objcopy.exe

Thanx, will try and report...

Best Regards

Edit 1.

Output file is bigger then 220 MB... :D :D

But compared with BL3_univ.nb0 it is 1:1 :cool: :victory: :cool:

Thank you very much.
[Android Development on Bada] Rebellos:
You might need to specify to dump only .text and .data sections, google for it.
[Android Development on Bada] adfree:
Thank you. At the moment prior solution is perfect enough for me.

I have only to cut tail from ouput.bin

Now I can proceed my Bootloader journey.

Best Regards
[Android Development on Bada] mijoma:
Here you go! It's to be used with decrypted bootloader file

You can find that code in the FBOOT.

At some point I found function checksums (or something between what appears to be an estimate where function starts and ends) more reliable than bootloader versions as there are different compilations of the same bootloader source under the different versions.
[Android Development on Bada] ihavenick:
Thanks :) soo i must use this like "main(0x420AA4D8 , MemoryCardMount); " hmm and it must give output on screen i think :)

i saw now " decrypted bootloader file" soo i must add it to code or when calling function thanks again i will try
[Android Development on Bada] mijoma:
No - you use the compiled application (I attach the compiled version) like:

"bl_crc bootloader.mbn > output.txt"

where you have decrypted the bootloader prior to calling that.

In the output file you'll see lines like:

"offset 0x424800D0 -> CRC = 0x706D5428

..

offset 0x4257CE00 -> CRC = 0x30DBBDB7"

It's simply a map between the function start address and the CRC that it has assigned. After that you are free to use them in the right BL3_FBOOT_S85... source code files. Please remember that there is a shadowing option - if not all pointers from the function pointer table are resolved, the FBOOT will load a known (the ones that are in RAW_FBOOT_S85... files) bootloader version to the memory and restart BL3. This should result in having all pointers resolved and proceeding to FBOOT main. The bottom line is to provide CRC checksums for the RAW bootloaders compiled into FBOOT.
[Android Development on Bada] Tigrouzen:
Compiled on linux with Gcc, but all time have offset begin at 0xF

Diffrent bootloader.mbn begin at 0x8 or 0xE mean there's right bootloader.mbn we need use ?
[Android Development on Bada] ihavenick:
Thank you very much :) now it found kernel on sd put it to buffer but when its on kernel(0, 0x891, ATAG_buf);

its dies.(Crashes)

Soo need to fix 0x891 or ATAG_buf varible
[Android Development on Bada] Rebellos:
0x891 is old ARIES mach-code.

Proper ones are 8500 (wave1) and 8530 (wave2) (in decimal, not in hex).
[Android Development on Bada] adfree:
Thank you very much mijoma :good:

This is very helpfull to understand little bit more.

http://xdaforums.com/showpost.php?p=40217843&postcount=37

:cool:

bl_crc.exe used with S8500 XXLA1 boot_loader.mbn (DECRYPTED with Wave_Remaker)

Now I can check this example again from here:

http://xdaforums.com/showpost.php?p=34856402&postcount=4

BL3_FBOOT_S8500_b2x.c

#include "BL3.h"

unsigned long c_MemMMUCacheEnable[] = { 0x[B]aab9f874[/B], 0 };
unsigned long c_disp_FOTA_Init[] = { 0x[B]bfab9174[/B], 0 };
unsigned long c_disp_FOTA_Printf[] = { 0x[B]b69c410b[/B], 0 };
unsigned long c_OemSysGetSystemInfo[] = { 0x[B]c3ac31a5[/B], 0 };

unsigned long *fun_crc[i_endMarker] = {c_MemMMUCacheEnable,
c_disp_FOTA_Init,
c_disp_FOTA_Printf,
c_OemSysGetSystemInfo
};

Now I can search for CRC in output.txt from bl_crc.exe...

offset 0x[B]420893D0[/B] -> CRC = 0xAAB9F874
offset 0x[B]420B03E8[/B] -> CRC = 0xBFAB9174
offset 0x[B]420B041C[/B] -> CRC = 0xB69C410B
offset 0x[B]420930F0[/B] -> CRC = 0xC3AC31A5

Now with help of BL3_univ.map you can search for offset...

[B]MemMMUCacheEnable[/B] 0x420893d0 ARM Code 424 dloadloader.o(.text)
[B]disp_FOTA_Init[/B] 0x420b03e8 ARM Code 52 disp_Lismore.o(.text)
[B]disp_FOTA_Printf[/B] 0x420b041c ARM Code 88 disp_Lismore.o(.text)
[B]OemSysGetSystemInfo[/B] 0x420930f0 ARM Code 136 SysSecureBoot.o(.text)

:cool:

Now compare Symbol Names from BL3_univ.map with BL3_FBOOT_S8500_b2x.c

:D

Short tested with M210S output.txt... then it is clear why not working...

I will try to make stupid tests like Download Mode etc... or this could also help me with JTAG and CMM Scripts...

Thanx.

Best Regards
[Android Development on Bada] adfree:
offset 0x???????? -> CRC = 0x?????????

Please, what I need for Download Mode and/or "Upload data tp pc" Mode.

:confused:

Thanx in advance.

Best Regards