yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note I717] darkspr1te:
More info, plus help offered

Your welcome tyllerdurdent,

I am going to be putting a few hours into the dev from now actually for if you want assistance then no problems,

I also advise the following, download ubuntu live cd, it has a lot of tools your going to need to extract data you require, if we go step by step we might be good, i did a lot of test writing before i got my first boot, and that again only happens one in 20, i dont know why.

the rawpartiton0.xml above is incorrect for our devices as it states the first partion is 32mb, (i think it's ment to be amss.mbn, or NON-HLOS.mbn , our pit file which i did extract from my emmc dump says it's 105mb. i am confused and to why rawpartiton0.xml says the first bootloader is at start_sector="65537" but fdisk shows it as start 204801, i think someone needs to show me how to convert from blocks to sectors,

in patch0.xml it says

208801 is where we have our ebr start,

i also think the IROM based pbl, sbl etc use the partition types in some way, why else have so many types? can any one explain that

this is a fdisk view of what i think our partition table looks like

Device Boot Start End Blocks Id System
/dev/sdb1 1 204800 102400 c W95 FAT32 (LBA)
/dev/sdb2 * 204801 205800 500 4d QNX4.x
/dev/sdb3 205801 208800 1500 51 OnTrack DM6 Aux1
/dev/sdb4 208801 208801 0 5 Extended
/dev/sdb5 212992 213991 500 47 Unknown
/dev/sdb6 221184 225279 2048 45 Unknown
/dev/sdb7 229376 234375 2500 4c Unknown
/dev/sdb8 237568 258047 10240 48 Unknown
/dev/sdb9 262144 263143 500 46 Unknown
/dev/sdb10 270336 271335 500 5d Unknown
/dev/sdb11 278528 279527 500 91 Unknown
/dev/sdb12 286720 307199 10240 93 Amoeba
/dev/sdb13 311296 511999 100352 c W95 FAT32 (LBA)
/dev/sdb14 516096 522239 3072 4a Unknown
/dev/sdb15 524288 530431 3072 4b Unknown
/dev/sdb16 532480 538623 3072 58 Unknown
/dev/sdb17 540672 741375 100352 8f Unknown
/dev/sdb18 745472 751615 3072 59 Unknown
/dev/sdb19 753664 759807 3072 5a Unknown
/dev/sdb20 761856 29843455 14540800 5b Unknown
/dev/sdb21 770048 790527 10240 ab Darwin boot
/dev/sdb22 794624 815103 10240 60 Unknown
/dev/sdb23 819200 839679 10240 94 Amoeba BBT
/dev/sdb24 843776 3911679 1533952 a5 FreeBSD
/dev/sdb25 3915776 8114175 2099200 a6 OpenBSD
/dev/sdb26 8118272 8736767 309248 a8 Darwin UFS
/dev/sdb27 8740864 9005055 132096 a9 NetBSD
/dev/sdb28 9011200 10035199 512000 95 Unknown
/dev/sdb29 10035200 30777343 10371072 90 Unknown

Oh, download wxdhex or wimlar program, you going to need a hex editor that can load BIG files , 16gb worth
[AT&T Samsung Galaxy Note I717] tyllerdurdent:
i717-GB-Modem.zip IS THE SAME AS TAR?

i717-GB-Modem.zip	21.35 MB	7	0	2012-06-30 08:45:11

I could not find the i717-gb as tar file but I find it as a zip file. but I'm not sure about thif the contents are correct. Could you check

http://d-h.st/1aP

i717-GB-Modem.zip contents

META-INF

COM

GOOGLE

ANDROID

update-binary

updater-script

TMP

amss.bin

mdm.bin
[AT&T Samsung Galaxy Note I717] darkspr1te:
Blocks and sectors

This may explain it , the different figure in the xml files

Because sectors are logical on the drive (Logical Block Addressing = LBA) you need to convert between LBA and physical (file system) sectors. This is pretty easy to do:

First - get a table of the start and end sectors of the partition table:

[root@207-150-166-140 ~]# fdisk -lu /dev/hda

Disk /dev/hda: 120.0 GB, 120034123776 bytes
255 heads, 63 sectors/track, 14593 cylinders, total 234441648 sectors
Units = sectors of 1 * 512 = 512 bytes

Device Boot Start End Blocks Id System
/dev/hda1 * 63 208844 104391 83 Linux
/dev/hda2 208845 4401809 2096482+ 83 Linux
/dev/hda3 4401810 8482319 2040255 82 Linux swap
/dev/hda4 8482320 234436544 112977112+ 5 Extended
/dev/hda5 8482383 29447144 10482381 83 Linux
/dev/hda6 29447208 50411969 10482381 83 Linux
/dev/hda7 50412033 52516484 1052226 83 Linux
/dev/hda8 52516548 234436544 90959998+ 83 Linux

the above copied from

http://timelordz.com/wiki/SMART_Rewriting_Bad_Sectors

i have a feeling we may need to shift our files (the basic files need to start odin are listed in rawpatch0 above, i dont know if that 100% true but it was the only files i wrote on by first sucess)

also

http://xdaforums.com/showthread.php?p=31843525&postcount=13

in the above link they talk about the header of the qualcomm file

and

now i used this in a way to find my bootloaders (i717 by this time, not shve-160l )

and to find the partitons

you will see in a hex editor at the start of each boot loader

something else to think about, my lack of success that last two days to produce a boot could be because my partitons are not clean , thats is to say if i write my sbl1 to 1000, and the trailing 0000 of the partition definition of my 99 block ebr/mbr ends at 999 , if i have dirt data between 999 and 1000 the cpu/pbl my interpret that as code(some of my boots is brick, some are into QDLoad, i have no pattern yet) , something i must test or confirm, or just worry about.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Yes thats correct

updater script btw contains text, binary is the flashing exe i think,

and a google of a simlar sansung product the skyrocket gives me a simlar pit layout
[AT&T Samsung Galaxy Note I717] darkspr1te:
Other files

contents of the i717 boot loaders i used

ABOOT_SGH-I717M_I717MUGLA2_user_CL875155_REV00

527K Jan 6 2012 aboot.mbn
115K Jan 6 2012 rpm.mbn
72K Jan 6 2012 sbl1.mbn
111K Jan 6 2012 sbl2.mbn
601K Jan 6 2012 sbl3.mbn
117K Jan 6 2012 tz.mbn

other files pulled from

ABOOT_SGH-I717M_I717MUGLA2_user_CL875155_REV00 (no bootloader but all the other system files )
[AT&T Samsung Galaxy Note I717] darkspr1te:
Nice Find, Although i suspect its untested as they dont have the .hex file for that cpu like we have for the 8660, it's rocking horse manure at the moment.(hard to find MPRG8960.HEX)

EDIT: To Clarify my above comment, I was using a saying used in yorkshire, UK, meaning hard to find and NOT saying the poster talking was talking rubbish.

When was the last time a rocking horse produced manure ?

Hope I've cleared that up.
[AT&T Samsung Galaxy Note I717] jon1234444:
no worries, perl/python what's the difference? :)

but now I am getting new errors :(

Traceback (most recent call last):
File "mbrebrdump.py", line 53, in <module>
mbr()
File "mbrebrdump.py", line 16, in mbr
partition = dict(zip(('boot', 'id', 'start', 'size'), unpack('4I', buf)))
struct.error: unpack requires a string argument of length 16
[AT&T Samsung Galaxy Note I717] darkspr1te:
Sadly the program was not written by me and i am not a pythong programmer but i will look into it today. i might be able to come up with a alternative option.
[AT&T Samsung Galaxy Note I717] SouL Shadow:
I could probably whip up a bash script for you. Everything there looks pretty self explanatory, except for the "partition=dict(zip((.....),unpack(...))"

I don't know python so I'm not sure what zip() and unpack() do or what arguments they take. I know they are reading some data and putting it in to an array of key-value pairs, but exactly how that data is manipulated, that's the only hang up.

Also, take a look at "Jet" http://xdaforums.com/showthread.php?t=1940512 I've been working on that with the op, yarrimapirate. We both think that it could be extended to a biggee purpose. Also, we use the program emmc_recover, written by fuses, which might be useful as well. You can find the forked source at my github: http://github.com/soulshadow which includes links back to the original authors.

I've spent the last couple months researching and learning about the msm8960, secureboot 3, ehostDL and qhsusb_dload. Now reading through your thread here, it seems you're working on something similar to what I've had in mind.

-SLS-
[AT&T Samsung Galaxy Note I717] jon1234444:
correct me if I'm wrong, but I think your method is similar to what has been used for other HTC devices, like this thread: http://xdaforums.com/showthread.php?t=1627917

I'm not sure why it wasn't ported to the EVO 4G LTE, it looks like the OP dexter93 made a thread for it that was closed

but that method doesn't work for all bricked devices (like my busted EVO 3D), so we're hoping we can use this method to use qpst to unbrick

the meat of darkspr1te's method is here: http://xdaforums.com/showthread.php?p=33545892#post33545892
[AT&T Samsung Galaxy Note I717] SouL Shadow:
Sort of. We dd different data in to a partition causing the phone to enter qhsusb_dload mode after a reboot. Then we exploit a very short window where we can write data to most partitions using emmc_recover.

We use this trick to downgrade our hboot (appsbl). While I know the methods used aren't exactly new, the script we've written could be used for much more. Ultimately i'd like to see it become a full recovery tool able to detect different causes for a "bricked" phone and restore the necessary data. If the hex file for the msm8960 ever turns up, i'd like to also find a way to bypass the need for qpst to push the downloader to imem and subsequently reflash any and all needed partitions, directly from the script.

Anyway, I just wanted to point out these utilities in case they might be of some use here.

-SLS-
[AT&T Samsung Galaxy Note I717] darkspr1te:
Many thanks for bringing this our attention. I was not aware of the window although during the early stages of my investigation i did look at this utility and i did try it but it produced no results. Now that i am aware of it i will do some more digging. in one of the second/third stage loaders it has a list of partitions (not named like we know them) so i am assuming we can access the emmc at that point.

But now that i think of it, it was my sbl3.mbn file that was damaged so i doubt the emmc utility would have worked. Originally my device was bricked without QDload mode, I push it into QDload mode the first time but mistake, It was only after i got the hex file and the emmc resistor mod that i was able to have the access i have now.

From some of the documentation i have seen i think Qualcomm are unifying their bootloaders, This could explain the lack of a leaked .hex file, but that is a assumption on my part.

On the bypass of qpst, there is a perl script to upload the hex, but i dont think anyone has dug into what protocol happens after that. Also the MuPhone uploader program can be scripted as well as emmcswdownload.exe can but run in cmd line mode, although i've not tried doing the whole hex+_msimage.mbn download via command line, but i do agree that moving away from qpst is the way forward. both in windows solutions and a linux port of the qpst side of things for those of us who dont like glass and fruit based OS's.

As my mum used to say, in a world without walls and fences, who needs windows and gates.

back on topic.

If you need the perl script let me know, i think it was written by scotty2 but i've never tracked the user down, just a few posts and a lot of irc chatter. In fact the chatter seems like they were close to a solution in replacing qpst now that i think of it.

The text is in sbl3.mbn

OVERFLOW
/sys_boot/image/AMSS.MBN
/sys_boot/image/EMMCBOOT.MBN
/sys_boot/image/BOOT.IMG
/sys_boot/image/ADSP.MBN
/hdev/sdc1
/mmc1
/hdev/sdc2
/mmc2
/hdev/sdc3
/mmc3
/hdev/sdc4
/mmc4
/hdev/sdc1_p
/mmc1_p
/hdev/ftl1
/ftl1
/hdev/ftl2
/ftl2
/hdev/usb1
/usb1
/hdev/usb2
/usb2
/hdev/usb3
/usb3
/hdev/usb4
/usb4
/hdev/usb5
/usb5
/hdev/usb6
/usb6
/hdev/usb7
/usb7
/hdev/usb8
/usb8
[AT&T Samsung Galaxy Note I717] E:V:A:
Ooh Nooo! This thread is getting way out of topic and soon risk becoming another futile HTC S/WP OFF thread. :( Please consider starting a new thread for your appropriate device.

Just to say it again. First, a 8960 hex file would need to be signed as most 8960 based devices have their secure boot qfuses blown by default (or equivalent). Thus each device would need their own (signed) hex file, unless signed by the same key. The only way to know what key it is using is by inspecting the appropriate qfuse HW registers. Currently I have no time to develop these tools, as I first intended to, but it is not very hard to do, if you're interested.

Second, there main reason why we don't see any wild 8960 hex files out there, is that there probably aren't any, since they are not needed. All functionality is already built in to PBL / SBL1. So a potential trick/experiment could be to just hexify a SBL1 copy...

Again, please move your non-E160L discussions to a new thread under "General Discussion/ Hardware Hacking"!

(As bootloader hacking are definitely more HW related than SW.)
[AT&T Samsung Galaxy Note I717] darkspr1te:
Agreed.

I will try the hexify my sbl1 tonight and trigger qdload mode, i should still have my binhex tools around,

E:V:A, i have copies of both 8660 and 8960 compiled files for fluid dev boards , the site i pulled them from is now password'ed up but do you think posting them will offer and insight to current dev work ?

EDIT: I now have access to 115.com files, keep eye out for links to there that contain repair tools and qualcomm doc's for our msm8x60 , pm any that you need. i am goind to trawl through my old links as there was some gems that would have helped me a great deal.
[AT&T Samsung Galaxy Note I717] SouL Shadow:
I would be interested in anything related to 8960 or general 8x60 info that might also apply to 8960.

Ps. My research is centered around the msm8960, ehostdl, and qhsusb_dload. While i have an htc device to test with, I expect to extend my work to all devices with the msm8960. Any benefit to s-off or such would be coincidental. My main goal is a user-based total recovery solution. I posted here because of the similarities between the msm8660 and 8960 in this matter. I'm also willing to learn more and help out here, if possible, as we seem to be working toward similar goals.

-SLS-
[AT&T Samsung Galaxy Note I717] jasonwang:
I got some file from M1 mobile( chinese phone),

MPRG8660.hex，may be compatible MSM8260

8660_msimage.mbn，who can tell me if different with different mobile. Here (http://blog.csdn.net/su_ky/article/details/7773273) tell you how to re-build. i try to re-build it, but i compare original (from manufactory) and new (from me), it's look not same.

rawprogram0.xml I think we can get it by here. http://xdaforums.com/showthread.php?t=1959445

my mobile(htc sensation) have sent to repair, i cannot to reseach it, if somebody interest it, come to here http://xdaforums.com/showthread.php?t=1989001&highlight=brick
[AT&T Samsung Galaxy Note I717] darkspr1te:
Msm8960 files as promised

http://www.4shared.com/zip/Gl3gYxdp/M8960AAAAANLGD1720251.html

Drop the box file

http://db.tt/Jm72rJR9
[AT&T Samsung Galaxy Note I717] darkspr1te:
And msm8660

http://www.4shared.com/file/2yptozfM/filesepos-pscom-noamd-Qualcomm.html

drop box link

http://db.tt/NTUjbDqc
[AT&T Samsung Galaxy Note I717] darkspr1te:
A Nice bunch of qualcomm related info. Good info on MSL and NV Too

http://mobiles-han.blogspot.com/2012/06/master-subsidy-lock-msl-codes.html
[AT&T Samsung Galaxy Note I717] SouL Shadow:
The link for M8960... says it's not valid. And the 8660 link wants me to log in.

-SLS-
[AT&T Samsung Galaxy Note I717] darkspr1te:
Yeah, sorry, 4shared is not letting me give full public access without a premium account. You have to sign up for the free account to get these files.

Having issues with dropbox uploads so i tried this

I have fixed the msm8960 link though

regards

darkspr1te
[AT&T Samsung Galaxy Note I717] darkspr1te:
Fixed and added dropbox links now

Sent from a de-bricked SHV-E160L
[AT&T Samsung Galaxy Note I717] darkspr1te:
Just a quick bump to ask if anyone found anything interesting in those files i posted.

Sent from a de-bricked SHV-E160L
[AT&T Samsung Galaxy Note I717] unoaman:
SC-03d FIXED BUT PHONE HANGS AND SCREEN GOED BLUE AFTER SOME TIME

Hi darkspr1te,

Fortunately i have arranged the below partition and now my phone get switch ON with working screen :). But there is a little problem.

the phone screen starts fluctuating and goes blue after some time and the phone is unresponsive on usb after some time.

The phone is still unusable right now. I wanted to have som thoughts from ur side which can help me to repair the phone in full working condition.

The screen behaviour is seen in all mode ( odin + recovery + Android os)

i was able to boot the phone only once in Android OS which was bit laggy and slow so i thought may be a restart will fix this and the screen started behaving abrupt and going blue after the reatsart.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Glad there is progress, The symptoms you are describing bring two things to mind.

1. one or more of the boot loader files are not right for this device, the signing of the files has been accepted but they could be for another device. When i used e120l aboot.mbn the screen was messed up, all other buttons worked but screen was issue.

2. the partition table in mbr/ebr does not match the actual point of stored data, eg, mbr says /dev/block/mmcblk0p3 starts at sector 36 but it really starts at 38 so there is a extra two sectors of data injected into our code chain.

My gut says it's 1. but i included 2 as i've had that issue and it caused the screen to go blue from bottom to top in a slow graphic, it did show the odin mode screen for a fraction of a second.

where did the loaders come from

"sbl1,sbl2,sbl3,tz,rom,aboot"

do you get any odin connection ?

darkspr1te
[AT&T Samsung Galaxy Note I717] darkspr1te:
I happen to notice some possible error's in your modded script

# for windows use md backup
# md backup

#back-up script
echo "Backing up Bootloaders"
echo
echo " if any of the following fail with errors do no reboot your device, correct the error and re-execute"
echo
adb shell dd if=/dev/block/mmcblk0p2 of=/sdcard/sbl1.mbn bs=512
adb pull /sdcard/sbl1.mbn backup/sbl1.mbn
adb shell dd if=/dev/block/mmcblk0p3 of=/sdcard/sbl2.mbn bs=512
adb pull /sdcard/sbl2.mbn backup/sbl2.mbn
adb shell dd if=/dev/block/mmcblk0p5 of=/sdcard/rpm.mbn bs=512
adb pull /sdcard/rpm.mbn backup/rpm.mbn
adb shell dd if=/dev/block/mmcblk0p6 of=/sdcard/sbl3.mbn bs=512
adb pull /sdcard/sbl3.mbn backup/sbl3.mbn
adb shell dd if=/dev/block/mmcblk0p7 of=/sdcard/aboot.mbn bs=512
adb pull /sdcard/aboot.mbn backup/aboot.mbn
adb shell dd if=/dev/block/mmcblk0p8 of=/sdcard/boot.mbn bs=512
adb pull /sdcard/aboot.mbn backup/boot.mbn
adb shell dd if=/dev/block/mmcblk0p9 of=/sdcard/tz.mbn bs=512
adb pull [COLOR="red"]/sdcard/sbl1.mbn[/COLOR] backup/tz.mbn
adb shell dd if=/dev/block/mmcblk0p10 of=/sdcard/maybepit.mbn bs=512
adb pull [COLOR="Red"]/sdcard/sbl1.mbn[/COLOR] backup/maybepit.mbn
adb shell dd if=/dev/block/mmcblk0p11 of=/sdcard/pit.mbn bs=512
adb pull[COLOR="Red"] /sdcard/sbl1.mbn[/COLOR] backup/pit.mbn

I marked in red that you pulled sbl1.mbn a few times and named it to different files, is it not ment to be /sdcard/tz.mbn /backup/tz.mbn ??

it looks like you forgot to change the sbl1 part for each file and ended up copying sbl1 in many files, if this is the case it would explain you issues and i am surprised that its even booted, shocked even.

please confirm this .

darkspr1te
[AT&T Samsung Galaxy Note I717] jon1234444:
I've just about given up, I can't get past the "Image Download Failed. Cookie(if present) not received" error at the emmcswdownload step. tried about 1000 different ways (different drivers, different versions of windows and qpst, hex and mbn files from various sources, tried making my own mbn from stock files) and can't get it to work.

someone has posted this method for the touchpads here: http://rootzwiki.com/topic/36658-tpdebrick-v01/

if you read through it there are others complaining about this cookie issue but there doesn't seem to be any clues on how to get past it, except maybe it has to do with 32 vs 64gb versions.

I think I read somewhere that the .HEX file is only supposed to work on a specific device, yet apparently this one works on the galaxy note and the touchpad? maybe it works on some 8660 devices but not all? maybe it depends on how the device was bricked?

so unless anyone else has any insight, I'm pretty much done here, as I can't seem to get past step one :mad:
[AT&T Samsung Galaxy Note I717] darkspr1te:
I've had the cookie not present error a few times, I cannot be 100% sure but it's possible the .hex is not signed for the device(E:V:A's suggestion ) . i don't think it's because of the 16/32gb as the file i have has been used on 32gb model of the 160l. Are you selecting trusted in emmcswdownload?

I often got that same error also due to trying to upload the .hex twice without rebooting, you cannot upload twice with out a reboot and you get that error.

I've been finishing building a new cwm for the 160l devices so not had much chance to go back to my core debrick work.

It has also come to my attention there are two qdload modes, one activated by the iRom pbl and one via sbl1/sbl2.

I hope to further some work in that this weekend, but I have to be honest, where i live it's just come to the rainy season and it's our busy time in our office which has left me little time to do dev work.

when you use emmcswdownload , is the screen setup as follows (see image)
[AT&T Samsung Galaxy Note I717] unoaman:
SC-03d FIXED BUT PHONE HANGS AND SCREEN GOES BLUE AFTER SOME TIME

Hmm. I have same screen behavior "screen go blue from bottom to top in a slow graphic" (This make me sure that there is no hardware fault in phone :o) Now answers to ur questions.

where did the loaders come from

"sbl1,sbl2,sbl3,tz,rom,aboot"

Ans: I was lucky that one of my friend had the same phone so i rooted his phone and pulled out the partitions from his phone.

do you get any odin connection ?

Ans: Yes i do get odin connection but it goes away as soon as the screen goes blue.( I have observed that there is no fixed time for screen going blue, i.e it may take five mins or it may go blue in few seconds)

Question in next post -- marked in red

yes i know the modded script was wrong. so i dint used adb pull but after dd of all partition i connected the phone as mass storage and copied all the mbn to my local folder so i assume that all the mbn are correct.

now my few questions

1. yes acc to ur suggestion there is some error, the partition table in mbr/ebr does not match the actual point of stored data but which partition is the problematic one?

2.

#The following Two lines write back the MBR to sector 0 and EBF to sector 208801
# This is required to restore your partiton table so the the iROM code can find the loaders
dd if=partition0.bin of=/dev/sdb seek=0 count=1 bs=512
dd if=partition0.bin of=/dev/sdb skip=1 seek=208801 count=22 bs=512

i have used the partition0.bin of ur brixfix for my phone. is this correct and the location 208801 for ebr is correct for my device?

3.

dd if=SC03D/sbl1.mbn of=/dev/sdc seek=204801 count=500 bs=512
dd if=SC03D/sbl2.mbn of=/dev/sdc seek=205801 count=1500 bs=512
dd if=SC03D/rpm.mbn of=/dev/sdc seek=212992 count=500 bs=512
dd if=SC03D/sbl3.mbn of=/dev/sdc seek=221184 count=2048 bs=512
dd if=SC03D/aboot.mbn of=/dev/sdc seek=229376 count=2500 bs=512
# boot.img only needed if it's damaged on the device, for base ODIN/LOKE interaction you only need sbl1,2,3,rpm,tz files.
dd if=SC03D/boot.img of=/dev/sdc seek=237568 count=10240 bs=512
dd if=SC03D/tz.mbn of=/dev/sdc seek=262144 count=500 bs=512
[COLOR="Red"]dd if=SC03D/pit.mbn of=/dev/sdc seek=278528 count=500 bs=512[/COLOR]

please see the one in red above. That is the extra intelligence i have used from my side :D

Whats ur opinion? Am i Correct :D

For partition layout for SC-03D u can see this post

sc_03d http://xdaforums.com/show....php?t=1366130

I will wait for ur valuable reply :cowboy:

Thanks
[AT&T Samsung Galaxy Note I717] darkspr1te:
New cwm recovery for shv-e160l devices

no download yet but here are details via this link

http://xdaforums.com/showthread.php?p=35088701

Sent from a de-bricked SHV-E160L