[AT&T Samsung Galaxy Note I717] darkspr1te:
boot.bin is a fat16/31 image containing the amss files or application cpu files (it's mountable in linux as a loop device)

I am unsure what boot-topaz.bin is exactly but i have found some gold

mmc0
root=/dev/mmcblk0p%d rootwait ro
bootargs
mmc0p%d
headsetuart
bootconsole
ttyS0,115200n8
Switch Uart to Headset
framebuffer
charging
Shutdown with STRONG charger and low battery, reboot to show charge screen
Sleeping for %i seconds before poweroff
Booting bootie again...
power_key
%s: entry
target_init_board_id: emu=%d, product=0x%x, hwbuild=%d
topaz-
Wifi
boardtype=%s

So we can have a uart from the headset port ? uart to what? diagnostics or cpu or modem ? we need to investigate

It's also refers to bootie, so is this topaz file bootie really ? is bootie the same as u-boot

it's quite possible that the device can use the headphone jack as uart , if we have a 3.5mm jack to 3.5 mm jack and connect the touchpad to a pc sound card and record the power on stage it might give us a digital signal recorded via line in, if you have a oscilloscope that would also help. i dont know if the headphone jack is 3 band or 4 band jack , if its a 4 band jack then it may require a trigger or resistor from ground to id pin to activate, i don't have the hardware so i am only guessing from the strings inside the file.

More strings found, points to a form of interactive shell i think.

@chargebypass
set currentlimit for charger type = %d & enabled
not enough arguments:
=================================================================
Topaz charger low level commands
%s: currentlimit <param> : set current limit of DC-Input.
available <params> : '0mA', '100mA', '500mA', '750mA'
: '900mA', '1000mA', '1400mA'
: '1500mA' and '2000mA'
%s: charge on | off : Enable charging.
%s: detect : Detect charger type
<return values> : 0 = no charger, 1 = invalid charger
: 2 = USB Host, 3 = PUCK-USB
: 4 = HOLSTER(not available)
: 5 = WALL-HP, 6 = WALL-OMTP
: 7 = USB CDP Host, 8 = PUCK-TOPAZ
: 9 = WALL-TOPAZ
%s: battery : Show battery status
%s: combo	: Combo command! detect,set & enable.
currentlimit
currentlimit = %s

Another uart, this one via USB i think

DEBUG UART initialized.
Whoops, passed NULL to flush_endpoint_sw
Whoops, ept struct has an invalid dqh pointer in flush_endpoint_sw
Whoops, malformed ept_queue_item, ignoring memleak
%s: reset : resets the usb controller, applying configured tuning values
%s: read : reads the contents of USB PHY config
%s: config reg clear_mask set_mask : configures the values loaded into PHY config reg n
reset
Resetting controller...

now it's looking very much like it's a u-boot

Battery Level: %2d %%
p=%d ca=%u v=%u i=%d
charging is done for WebOS Doctor support
%s enable <capcity>
target battery capacity is %d%%
weakchargerlimit
true
%s: charger %s, V %d <= %d
%s: powering off due to missing charger
commands to set charging states
@sys_init
sys_init
* enabling FTM autoboot mode
diag boot
* disabling FTM autoboot mode
* enabling MFT boot mode
force_usb_serial
force_bootie_console
%s: booted because '%s'
show_panic_screen
update-uimage
fbcon
boot_always

Oh, It is bootie then

bootstrap2
******************************************
* Welcome to bootie!
* Version: %s
get bootie version
@none
mutex_release: thread %p (%s) tried to release mutex %p it doesn't own. owned by %p (%s)
mutex_acquire: thread %p (%s) tried to acquire mutex %p it already owns.
mutex_acquire_timeout: thread %p (%s) tried to acquire mutex %p it already owns.
idle
bootstrap
somehow fell through thread_exit()
timer %p already in list
returned from target
Using default address 0x%x
%sp%d
Reading bootloader from device %s...
bogus size (%u bytes), refusing to boot
Loading bootloader to 0x%x (%d bytes)
crc from flash 0x%x, calculated crc 0x%x
failed crc check
chainboot
boot another bootloader image based on environment
Jump to a given address with the given arguments

There was more strings within the file that pointed to some possible debug info,

can some one descibe the various ports on the device, headphone, usb/charger . is there any pinouts to either ? right now i dont think it will help us to fix the boot setup but later it may help .

darkspr1te

darkspr1te