[Galaxy S I9000 Android Development] DemonWav:
Okay, I will start off by saying that this probably isn't very useful to anyone, but I did all this work so I wanted to to release it so that maybe someone could find a use to it. I don't know if this has been done before or not, didn't see anything on this topic that wasn't an unanswered question, so might as well post this.

First off, I want to say why I did this. Basically, I did this mod to my phone to get a boot image like the Nexus S, which I made myself, to match the Nexus S boot image as best I could. This was all because of the AOSP ICS stuff, might as well try to make my phone look as Nexus-ish as possible right? Here is the image I used by the way: (reduced size)

So my next thought was to make the charging screen like the Nexus S as well, which I actually do like better than the Samsung Galaxy S charging screen. My first initial thought was to look in the param.lfs, but I couldn't figure out how to. The only real option I had left was to look at it in a HEX editor, but I didn't know what to look for. This was, until I started looking around and I noticed some similarities between JPG files and some bytes in the param.lfs. First I will explain what I learned and how to recognize JPG's in a HEX editor, then I will proceed to show what I discovered through the process.

How to recognize JPG's in a HEX editor.
​

JPG's start with the HEX value of "FF D8 FF E0 00 10"

It's kind of cute, but following that, you could actually see this in a text editor, is the HEX value of "4A 46 49 46"

As you can see, in UNICODE this makes "JFIF". "JFIF" is what I use for searching for JPG's, it's just the easiest. You just have to remember to go back and grab the first 6 bytes when you are copying/deleting the JPG.

The "JFIF" comes directly after the first 6 bytes, so here is what it looks like together:

That is how to find the beginning of the JPG, the end of the JPG is the HEX value "FF D9"

Using those two pieces of information, you can find the beginning and end of any JPG in a binary file, and actually extract the JPG from the binary file by simply copying the beginning and end and everything in between and pasting it in a blank file.
​

Using that information I went ahead and started finding, labeling and extracting all of the files from my modded param.lfs that I created with this mod. Because I had done this mod, my param.lfs had 10 JPG's in it, while a stock param.lfs seems to have 9 JPGs.

Here is a rundown of the JPG's in the param.lfs I created with that mod. You can download the param.lfs

here. All of the images here are the actual images that I pulled out of the param.lfs, except for the full screen images, which I shrunk down. You can see the full size by clicking the link, though.

1st: Phone -- ! -- PC screen

Starts at offset: 0x41000

Ends at offset: 0x41fcb

​

2nd: Spiral loading image

Starts at offset: 0x43000

Ends at offset: 0x462ea

Full Size Image
​

3rd: Forced Upload by Key Pressing

Starts at offset: 0x48000

Ends at offset: 0x53952

​

4th: Bootloader Splash Screen for I9000

Starts at offset: 0x55000

Ends at offset: 0x5ddf8

Full Size Image
​

5th: Bootloader Splash Screen for I9003

Starts at offset: 0x5f000

Ends at offset: 0x64e63

Full Size Image
​

6th: Power Reset or Unknown Upload Mode

Starts at offset: 0x68000

Ends at offset: 0x75386

​

7th: User Fault Not Kernel Panic Upload Mode

Starts at offset: 0x77000

Ends at offset: 0x7a1a6

​

8th: CP Crash Upload Mode

Starts at offset: 0x7c000

Ends at offset: 0x85956

​

9th: Kernel Panic Upload Mode

Starts at offset: 0x87000

Ends at offset: 0x91426

​

10th: Bootloader Splash Screen Mod

Full Size Image
​

​

I thought it was interesting that the Param.lfs mod that I mentioned earlier didn't overwrite the boot screen, it simply made a new one. This got me curious about what the stock param.lfs is like, so I opened this param.lfs up. I honestly have no idea where I got that from, I have had it for a long time, I just know it is the param.lfs found in one of the I9000 Gingerbread bootloader packs.

Here is a rundown of the JPG's in the stock param.lfs. All of the images here are the actual images that I pulled out of the param.lfs, except for the full screen images, which I shrunk down. Even though all of the images are simply duplicates of the other param.lfs, just in other locations, they are all different images. I uploaded them all separately. You can see the full size by clicking the link, though.

1st: Bootloader Splash Screen for I9003

Starts at offset: 0x40fff

Ends at offset: 0x46e62

Full Size Image
​

2nd: Forced Upload by Key Pressing

Starts at offset: 0x47fff

Ends at offset: 0x53952

​

3rd: Kernel Panic Upload Mode

Starts at offset: 0x57000

Ends at offset: 0x61426

​

4th: User Fault not Kernel Panic Upload Mode

Starts at offset: 0x63000

Ends at offset: 0x661a6

​

5th: Phone -- ! -- PC Screen

Starts at offset: 0x68000

Ends at offset: 0x68fcb

​

6th: Bootloader Splash Screen for I9000

Starts at offset: 0x6a000

Ends at offset: 0x72df8

Full Size Image
​

7th: Power Reset or Unknown Upload Mode

Starts at offset: 0x7a000

Ends at offset: 0x87386

​

8th: Spiral Loading Image

Starts at offset: 0x89000

Ends at offset: 0x8c2ea

Full Size Image
​

9th: CP Crash Upload Mode

Starts at offset: 0x8e000

Ends at offset: 0x97956

​

​

So..uh...this is where I get a little embarrased. :o One with a keen eye would notice that there is something missing from both param.lfs...there are no charging battery images. There is also another thing missing that I found interesting, and that is the infamous Download Mode screen. So in search for that screen I decided I would open up this sbl.bin. Again, I don't know what exact ROM this came out of, I just know it is the sbl.bin to an I9000 Gingerbread ROM.

Here is a rundown of all of the JPG's that I found in that sbl.bin. Again, all of the images here are the actual images that I pulled out of the sbl.bin.

1st: Download Mode

Starts at offset: 0x91a4c

Ends at offset: 0x982c1

​

2nd: Do not turn off target!!!

Starts at offset: 0x982c2

Ends at offset: 0x9a9ba

​

3rd: Left edge of the Download Mode progress bar

Starts at offset: 0x9a9bb

Ends at offset: 0x9ac74

​

4th: Right edge of the Download Mode progress bar

Starts at offset: 0x9ac75

Ends at offset: 0x9af2d

​

5th: Middle part of the Download Mode progress bar

Starts at offset: 0x9af2e

Ends at offset: 0x9b1c0

​

6th: Download Mode (again)

Starts at offset: 0x9b1c8

Ends at offset: 0xa1a3d

​

7th: Do not turn off target!!! (again)

Starts at offset: 0xa1a3e

Ends at offset: 0xa4136

​

​

So we found the Download Mode images! Yay! Again, I'm not completely sure how any of this is really helpful, except for a cruel prank to trick someone into thinking they couldn't get into download mode. And about that, I was really surprised when I got to the second Download Mode image. I know that on the phone you have a Secondary Bootloader, and then a Secondary Bootloader backup, but I wasn't sure if the "backup" was performed phone-side, or if they were both in the sbl.bin and I had gotten to the second Secondary Bootloader. As it turns out, that was the only other JPG's in the SBL.bin, so I really am not sure why there are two sets of Download Mode images. As for which one the phones actually uses, well my phone doesn't have Unbrickable Mod and I didn't want to risk anything, so I didn't test anything to find out. :)

Now after all that, there are still no battery charging images. Well, the reason I couldn't find them is probably because they were in plain sight, /system/media/.

-rw-rw-rw- root root 55696 2012-06-21 16:22 Disconnected.qmg
-rw-rw-rw- root root 605173 2012-06-21 16:22 LMprec_508.emd
-rw-rw-rw- root root 637001 2012-06-21 16:22 PFFprec_600.emd
drwxrwxr-x root root 2012-07-04 00:05 audio
-rw-rw-rw- root root 58556 2012-06-21 16:22 battery_charging_10.qmg
-rw-rw-rw- root root 53708 2012-06-21 16:22 battery_charging_100.qmg
-rw-rw-rw- root root 57984 2012-06-21 16:22 battery_charging_15.qmg
-rw-rw-rw- root root 57764 2012-06-21 16:22 battery_charging_20.qmg
-rw-rw-rw- root root 58176 2012-06-21 16:22 battery_charging_25.qmg
-rw-rw-rw- root root 57556 2012-06-21 16:22 battery_charging_30.qmg
-rw-rw-rw- root root 57924 2012-06-21 16:22 battery_charging_35.qmg
-rw-rw-rw- root root 57200 2012-06-21 16:22 battery_charging_40.qmg
-rw-rw-rw- root root 57372 2012-06-21 16:22 battery_charging_45.qmg
-rw-rw-rw- root root 57956 2012-06-21 16:22 battery_charging_5.qmg
-rw-rw-rw- root root 57396 2012-06-21 16:22 battery_charging_50.qmg
-rw-rw-rw- root root 56844 2012-06-21 16:22 battery_charging_55.qmg
-rw-rw-rw- root root 56704 2012-06-21 16:22 battery_charging_60.qmg
-rw-rw-rw- root root 56704 2012-06-21 16:22 battery_charging_65.qmg
-rw-rw-rw- root root 56568 2012-06-21 16:22 battery_charging_70.qmg
-rw-rw-rw- root root 56356 2012-06-21 16:22 battery_charging_75.qmg
-rw-rw-rw- root root 56300 2012-06-21 16:22 battery_charging_80.qmg
-rw-rw-rw- root root 56260 2012-06-21 16:22 battery_charging_85.qmg
-rw-rw-rw- root root 56232 2012-06-21 16:22 battery_charging_90.qmg
-rw-rw-rw- root root 56360 2012-06-21 16:22 battery_charging_95.qmg
-rw-rw-rw- root root 2805857 2012-06-21 16:22 bootanimation.zip
-rw-rw-rw- root root 56860 2012-06-21 16:22 chargingwarning.qmg

The reason I never recognized that was probably because no one knows how to open a qmage file. Nevertheless, I found where they were, with the help of supercurio pointing me to lpm.rc, which starts /system/bin/playlpm, and after examining /system/bin/playlpm, I noticed the calls to those files in /system/media. When Chainfire made his "NoMoarPowah!" app, I imagine he wrote a new playlpm, but I am not sure anything short of that will allow us to change the charging images. Welp, I hope this information is useful to someone! Wouldn't want all of this work to go to waste!