[Hardware Hacking General] AdamOutler:
This thread's purpose is to port the Boot from SD recovery from Galaxy S3 to other devices. Since there is no procedure, and I am performing the work, the final output will be named UnBrickable SD to follow along with my previous work with UnBrickable Mod.

Goals:

Obtain IROM Dump [100%]

The IROM contains information about the internal workings of the processor. We now have an Exynos 4412 IROM and IRAM dump which contains all information about booting procedures. Thanks to mdrjr for using his 4412 development board in UBOOT mode to pull the dumps.

Analyze IROM for boot-from-ExternalSD bit [100%]- In Progress

We've sucesfully booted from SDCard and run unsecure code.

Define General structures which may help to identify future boot-from-ExternalSD temp-mod [30%]

Once the memory location of the boot-from-ExternalSD pin is known, testing can occur and generalizations can be made.

Make an overlay template of the Exynos4412 processor [0%]

This overlay will make finding the pin on future Exynos4 devices easier. Requires removal of a processor from an Exynos device.

Find a way to make an UnBrickable Mod [10%]

This goal may be removed pending IROM analysis. We've booted from SDCard and run unsecure code.

Port to other devices

They will be listed here and this thread may be moved to Hardware Hacking eventually.

[ X ]Galaxy Camera http://xdaforums.com/showthread.php?t=2023069

[ ]Galaxy Note 2 (All Variants)

[ ]Galaxy SIII (All Exynos variants other than i9300)

[ ]Meizu MX2

Initial information

Here's what I've been able to pull up about the device so far.

Exynos 4412 manual

http://com.odroid.com/sigong/nf_file_board/nfile_board_view.php?keyword=&tag=&bid=118

How to recover an i9300 from bootloader failure

This can be used as a model for what is trying to be accomplished here. This will be reproduced, the goal is to identify the proper resistor on each device which is mentioned in the PDF below.

Samsung PDF: http://xdaforums.com/attachment.php?attachmentid=1165515&d=1341007899

Sboot for odin: http://xdaforums.com/showpost.php?p=28028157&postcount=2

We may be looking for an XOM resistor

I believe the resistor triggers an XOM[] resistor (as Samsung calls them) or Boot Mode resisor. XOM resistors are responsible for switching on or off a register inside the processor which is cheked by IROM on each boot. When the array of XOM registers match a value, the processor is commanded to boot from a predetermined source such as OneNAND, EMMC, or USB. The XOM5 resistor on the Hummingbird (AKA Exynos3xxx) processor was responsible for boot-from-USB mode and enabled UnBrickable Mod to take shape with the elite assembly hacking from Rebellos.

This image shows the XOM[0] value. Unlike the Exynos3, XOM[0] does not control boot sequence. Until I saw this picture, I had hypothesized based upon my work with Exynos 42xx processors that the XOM[0] and XOM[6] registers control clocks. This image confirms it.

So, this narrows it down somewhat, but not much. Based on my previous work, we are likely looking for XOM[1...5],

The Memory

Here is an example from the Exynos42xx IROM which was decompiled into assembly, then converted into C and annotated properly by Ralekdev. http://pastie.org/private/p9x0yhcmegxjrxtkn6nxoq . The Exynos 42xx processor is very much different from the Exynos 3xxx processor. And to throw another monkey wrench into the gears, the Exynos 44xx processor is different from the 42xx processor in regards of this thread.

Here is the memory map pulled from the Exynos4412 processor. This shows the IROM location in which we are interested.

The Resistor

I can infer from the documentation that the resistor which is shorted is part of a voltage divider. The divider's operation causes the voltage to be either low or high normally and the shorting action causes the divider to swing the other direction. This divider may or may not be present on other Exynos devices as the feature is not documented, we cannot rely on this structure being there. The resistor will be there for sure, but it may not be as simple as shorting two contacts.

Current Tasks

Galaxy S2 (all variants except Skyrocket)

Galaxy Note 1 and 2 (non-qualcomm variants)