yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] FreddieP:
When I take the SIM from my AT&T One XL and try using it in an

unlocked

AT&T i747 (updated to stock, unrooted LH9) i'm thinking of buying it gets no data connection and only an occasional phone signal--and i'm in a good signal area.

Most of the time the i747 thinks there is no sim installed. For instance when I go into Settings->More Settings and try tapping on Mobile Networks the message 'Insert SIM card' is displayed.

I tried factory resetting the phone, no change.

I can swap my SIM into my wife's One XL and everything works fine... my wife's SIM works fine in my One XL. But neither my sim nor my wife's sim works in the i747.

I chatted with AT&T cust svc and they told me they have to register the IMEI of the new phone every time i want to swap SIMs which as far as I know is complete BS. Isn't the point of unlocked GSM phones easy SIM swapping?

I also tried shimming the SIM in the i747 with a sheet of paper in case it was loose. No change.

Any thoughts? Bad radio hardware? I'm there is something wrong with the i747 since two seemingly good SIMs won't work in it.
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] egyptshun:
Might be a bad unlock aswell. Call att if your brave.
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] FreddieP:
After many unsuccessful attempts i entered the secret code to check lock status (*#7465625#) and after it ran returned with:

'Connection problem or invalid MMI code'

But is that about lock status or that the running the code was in error?
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] themadproducer:
I am on Rogers and can and always have been able to use my sim in any of my Rogers or unlocked devices. My wife on the other hand, is with Telus, and she cannot use her sim on any other device without registering the device first. There might be a self help online method if I recall. So it possible you have the same sort of deal is Telus?
[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] FreddieP:
Solved--exchanged phones at at&t service center, now have 4g on my s3 with same sim as i use with One X.
[Verizon HTC Droid Incredible 4G LTE] playmobot:
will it work with root browser?
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
METHOD 2 will work with any root explorer but METHOD 1 wont. editing the build prop right in the app doesnt work right unless its ROOT EXPLORER
[Verizon HTC Droid Incredible 4G LTE] playmobot:
but root explorer can edit build.prop's too ive used it on my old phone and kindle fire.
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
Yes it can edit them but it might save them wrong. ES can edit them too but it saves them wrong. I am not familiar with root browser but its worth a shot, the worst that could happen is it doesnt work. Just make sure you backup your original build.prop
[Verizon HTC Droid Incredible 4G LTE] playmobot:
ok, btw root browser is free so if it works that means less pirates :D
[Verizon HTC Droid Incredible 4G LTE] jose51197:
I think you mistaken team fireballas is me and captain rewind
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
arent you the ones who got the phone unlocked and rooted? i figured you deserved some credit because this couldnt have been done without root
[Verizon HTC Droid Incredible 4G LTE] playmobot:
after i click continue it gets stuck at "adding your account"
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
Is this working for anyone with the new update and the new SIM card?

If you are, but its still not working PM me. I have another file for you that should fix the problem
[Verizon HTC Droid Incredible 4G LTE] Jafmf95:
Is there a way to identify if you have a correct SIM?
[Verizon HTC Droid Incredible 4G LTE] jose51197:
I meant you wrote thanks to jose51197 and team fireballas while it is thanks to team fireballas(giving same credit to me and captainrewind)
[Verizon HTC Droid Incredible 4G LTE] j13smiley:
yes - how do we tell which one we have?

if we need a new one - how tough is it to get verizon to give you a new one?
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
if you got your SIM card before late october, its not the right one.

Verizon is supposed to give everyone with an inc4G the new sim. Its their job. You dont need to convince them.

This should either be fully working or determined that it wont work within a few hours.
[Verizon HTC Droid Incredible 4G LTE] davidetkin511:
I fixed it
[Verizon HTC Droid Incredible 4G LTE] Jafmf95:
Yup. Easy peasy. I called *611, said I wanted a new SIM so I could use Isis. She confirmed my number, put me on hold for 2 minutes to do whatever they do to generate an order, that was it. On it's way. 2 day shipping, no charge.
[Verizon HTC Droid Incredible 4G LTE] wgpeter:
I will go into Verizon tomorrow to get a new SIM card then give it a try. Last time I did it the phone kept getting hung up telling me NFC was not responding or shutting down. Hoping your method works better.
[Verizon HTC Droid Incredible 4G LTE] taj80:
I called customer service and they had no idea what the nfc sim was and couldn't even find it in the system. Only after I got a manager on tier 2 support did they tell me that the nfc sim cards were only available for phone numbers in the two test markets. Typical Verizon support(s..t), so after calling a second time and getting the same response I might believe that they only have them in Salt Lake and Austin right now.
[Verizon HTC Droid Incredible 4G LTE] GuestD0894:
I actually made a call to them no more than 5 hours ago. While it was true that the support agent only had very little knowledge on the subject, her supervisor explained everything and sorted it out. I'm in New York (nowhere near the test markets) and they're sending it to me for free with 2 day shipping. They also said you could just as easily walk in to any Verizon store and pick one up on the spot.
[Hardware Hacking General] pandaball:
I found this picture of the Exynos 4412 taken from a SGS3, with resistors. It gets cut out a bit on the top, but that's the best I managed to find.

http://www.chipworks.com/media/wpmu/uploads/blogs.dir/4/files/2012/06/Exynos1.jpg

This one is from a development board; at first glance the resistors look different compared to the one above, but I'll link to it anyway:

http://www.cnx-software.com/wp-content/uploads/2012/07/samsung_exynos4_CPU_module.jpg

And these two are for the motherboard:

Front: http://www.chipworks.com/media/wpmu/uploads/blogs.dir/4/files/2012/06/Board1.jpg

Back: http://www.chipworks.com/media/wpmu/uploads/blogs.dir/4/files/2012/06/Board2.jpg
[Hardware Hacking General] Bologna:
Always on great projects Adam :good:

i9300 Irom dump Attached
[Hardware Hacking General] Rebellos:
Not sure if you've noticed. But dumps are empty ;)

Why? It's protected memory area using ARM TrustZone and it's unreadable from kernel level. Someone with JTAG access could dump it before SBL gets executed. Or maybe there's some engineering version of bootloaders that doesn't block iROM in TZ.

Once again, Samsung decided to screw us.
[Hardware Hacking General] AdamOutler:
Hopefully droid 4412 has less security than gs3. http://odroid.foros-phpbb.com/t1671-irom-dump
[Hardware Hacking General] mdrjr:
as I said to adam on odroid forums.

I'll get in touch with him to help with that.
[Hardware Hacking General] Rebellos:
@External abort on non-linefetch - this is for sure abort generated by ARM TZ subsystem when there's memory access request from non-secure to secure area.

@Dump -I can confirm this is full iROM dump. Just not sure if iRAM (containing iROM bss section and EBL+IBL) isn't somehow corrupted.
[Hardware Hacking General] AdamOutler:
WARNING: Trying this may cause your device not to boot, but if it works it will enable serious bootloader development. I would do this myself, but the i9300 is the only device which is capable of recovering from fatal errors with the SDCard method in the first post.

I need help from an i9300 owner. I was reviewing the log from above. The SBOOT partition reads the PARAMS. The PARAMS are Version 1.0. The Samsung Captivate (Galaxy S1 with insecure bootloader) also uses PARAMS version 1.0. So, likely the information provided by the Samsung Captivate PARAMS would work on the Galaxy S3.

About Params: The params contains the splash screens you see when you turn your phone on and settings which control boot. These settings include UART output, kernel parmeters, and boot modes.

So, I need someone to download this: http://xdaforums.com/attachment.php?attachmentid=666193&d=1311664074 then try flashing it with Odin3.

-or- using heimdall

heimdall flash --5 params.lfs

Flashing this file carries the risk of not being able to use your phone for a day or two, but I will help you if something goes wrong and your device will be recoverable by touching two points on the board while inserting a specially made SDCard.
[Hardware Hacking General] simone201:
Just a question Adam...

Afaik on the S3 the param partition isn't J4FS, if i remember right is ext4 or similars...

Do you think SBoot can read j4fs too (for the params)?

Or maybe we could mod an S3 param.bin to make it as needed.

BTW i can be a tester in the weekend ;)

Inviato dal mio GT-I9300 con Tapatalk 2
[Hardware Hacking General] AdamOutler:
Well, the Galaxy Camera PARAM is not mountable as EXT4. Is it mountable on the i9300? Can you pull a log dump and get me a copy of the PARAMS partition? PARAM is generaly a single file which contains setting+splash images.

use the Basic Hacking Tools Installer to get the ViewMem utility http://xdaforums.com/showthread.php?t=1424811. Commands to get a log dump:

viewmem 0x46000000 0x00200000>/sdcard/log.txt

Then upload the log.txt somewhere.
[Hardware Hacking General] simone201:
Here we go, attached the zip file :good:

Tell me if it is useful :highfive:
[Hardware Hacking General] AdamOutler:
Ok, yeah, that's not a filesystem. It's a Params.lfs file. Same as always. It is binary settings+binary representations of images created with "JFIF Lead Technologies". I'm sure they have a method of combining those files into a PARAM partition, and there IS a way of extracting the images. But it's not a filesystem.

As for the log, Samsung must have changed the location. That looks like app-data. Delete that file so as not to spread your app data info.

Please run this check the memory location:

viewmem 0x40000000 0x1000

Which will produce a 4096byte log on-screen. Then look for a line like this...

ATconsole=ram loglevel=4 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.debug_level=0x4f4c sec_log=0x200000@0x46000000.....

Get the "sec_log" variable information and run viewmem with those two numbers reversed.

You're basically looking at the unsecure memory header information which gives you the address to the secure_log which is what I'm looking for. The secure log will have SBOOT information in it.
[Hardware Hacking General] alephzain:
PARAM is a tar file. tar xf param.img give :

-rw-r--r-- 1 3624 2012-08-21 10:03 adv-env.img
-rw-r--r-- 1 42023 2012-08-21 10:03 ani_upload_1_kernel_panic.jpg
-rw-r--r-- 1 39255 2012-08-21 10:03 ani_upload_2_cp_crash.jpg
-rw-r--r-- 1 47443 2012-08-21 10:03 ani_upload_3_forced_upload.jpg
-rw-r--r-- 1 10810 2012-08-21 10:03 ani_upload_4_hardware_reset.jpg
-rw-r--r-- 1 11586 2012-08-21 10:03 ani_upload_4_smpl.jpg
-rw-r--r-- 1 54151 2012-08-21 10:03 ani_upload_4_unknown_reset.jpg
-rw-r--r-- 1 11495 2012-08-21 10:03 ani_upload_4_watchdog_reset.jpg
-rw-r--r-- 1 12276 2012-08-21 10:03 ani_upload_4_wtsr.jpg
-rw-r--r-- 1 9703 2012-08-21 10:03 ani_upload_4_wtsr_smpl.jpg
-rw-r--r-- 1 12711 2012-08-21 10:03 ani_upload_5_user_fault.jpg
-rw-r--r-- 1 19098 2012-08-21 10:03 ani_upload_6_hsic_disconnected.jpg
-rw-r--r-- 1 84123 2012-08-21 10:03 download_error.jpg
-rw-r--r-- 1 73061 2012-08-21 10:03 download.jpg
-rw-r--r-- 1 64410 2012-08-21 10:03 logo.jpg
-rw-r--r-- 1 37205 2012-08-21 10:03 lpm.jpg
-rw-r--r-- 1 36572 2012-08-21 10:03 lpm_wireless.jpg
-rwxr-xr-x 1 5851 2012-08-21 10:03 sud_0.jpg
-rwxr-xr-x 1 2713 2012-08-21 10:03 sud_1.jpg
-rwxr-xr-x 1 5634 2012-08-21 10:03 sud_2.jpg
-rwxr-xr-x 1 6292 2012-08-21 10:03 sud_3.jpg
-rwxr-xr-x 1 4604 2012-08-21 10:03 sud_4.jpg
-rwxr-xr-x 1 5706 2012-08-21 10:03 sud_5.jpg
-rwxr-xr-x 1 6792 2012-08-21 10:03 sud_6.jpg
-rwxr-xr-x 1 3885 2012-08-21 10:03 sud_7.jpg
-rwxr-xr-x 1 6826 2012-08-21 10:03 sud_8.jpg
-rwxr-xr-x 1 6528 2012-08-21 10:03 sud_9.jpg
-rw-r--r-- 1 168616 2012-08-21 10:03 warning.jpg

At the end of PARAM partition there is a hash or checksum too.

sec_log (sec_log=0x100000@0x43000000) in attachments
[Hardware Hacking General] AdamOutler:
Tar opens it up, but there are also command line SBOOT parameters in there. if you view as a hex file you'll see: "'console=ram loglevel=4" . So, i'm guessing it must be a bit more complex than simply a tar file. As I understand it, a TAR file is a header with information cat'ed in after it. I think the decoded tar format is dropping the actual param information though...

edit: unless adv-env.img contains those settings? I'm away from my computer so I can't tell for sure. That console=ram needs to be changed to /dev/ttySAC2
[Hardware Hacking General] AdamOutler:
I'm collecting information from Ralekdev and Rebellos. They've been researching a lot and I'm going to let them post their findings. However, I want to say that UnBrickable mod looks possible on the Exynos4x12 devices. Also, SDCard boot has been confirmed.

Anyway, I have been looking at the hardware around the processor of the Galaxy Camera. Here, have a look:

I believe the enlarged resistors to be the XOM pins. I don't have enough documentation or hacking yet to determine what each one does, nor their numerical order. I will be experimenting with them tonight though. I've marked out the facts about the board in Green and Purple.

The green lines are the visible grounding points. These resistors are low values.

The unmarked resistors are those which are either high or carry clock signals.

The purple dots are almost positively the XOM pins. I hope to somehow identify the purple as XOM0, XOM1.... XOM7. I don't have any clear ideas about how to identify the pins except by trail and error, but I will try. The purple dots are the points which need to be modified for testing. One of them needs to be brought low or high to reverse the boot order.

The blue areas are potential UART points. We have two UARTs to locate. these UARTs are identified in the manual as UART2 and UART3. In Linux they become /dev/ttySAC2 and /dev/ttySAC3. These devices are not created by default, but you can create them on your own system with root permissions.

su
mknod /dev/ttySAC0 c 204 64
mknod /dev/ttySAC1 c 204 65
mknod /dev/ttySAC2 c 204 66
mknod /dev/ttySAC3 c 204 67
mknod /dev/ttySAC4 c 204 68

These commands create the /dev/ttySAC which can be accessed by busybox microcom.

So, work is nearly complete on GOAL #3 of this thread. Goal #4 and and UnBrickable Mod are still dependent upon IROM analysis.
[Hardware Hacking General] theq86:
I made a tiny dd (16 MiB) from the beginning of my t-flashed sdcard. I think this should be enough.

if you need a fulldump though give me some time. I only have 8 GiB sdcards. But I think this should be ok. Basically, the t-flash just writes a 512 Byte header to the sdcard and then after that the sboot.bin content follows.
[Hardware Hacking General] AdamOutler:
Ok. So, I haven't been able to get the device to boot from SDCard, but that doesn't mean much. We need the hardware keys from the ODROID-X development board. Rebellos posted over on the ODROID forums to get those.

I do have something cool to report though. I found the hardware UART which means we aren't working blind. Here's download mode.

...cut register info for size....

cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
mmc_initialize: mmc->capacity = 15269888

Samsung S-Boot 4.0-413474 for EK-GC100_EUR_XX (Oct 27 2012 - 03:30:02)

EXYNOS4412(EVT 1.1) / 1023MB / 7456MB / Rev 11 / GC100XXALJF /(PKG_ID 0x19115008)

initialize_ddi_data: usable! (11:0x0)
PARAM ENV VERSION: v1.0..
init_fuelgauge: fuelgauge power ok
init_fuelgauge: POR status
fuelgauge_por: POR start: vcell(3871), vfocv(3931), soc(67)
fuelgauge_por: update SDI GC1 parameter
fuelgauge_por: RCOMP(0x008f), TEMPCO(0x4015)
fuelgauge_por: POR finish: vcell(3873), vfocv(3886), soc(71)
init_fuelgauge: disable charging for soc-cal
set_charger_current: chg curr(14), in curr(23)
set_charger_state: buck(1), chg(0), reg(0x04)
init_fuelgauge: vcell comp. = 3821
get_table_soc: vcell(3821) is caculated to t-soc(44.654)
init_fuelgauge: start: vcell(3821), vfocv(3891), soc(71), table soc(44)
init_fuelgauge: finish: vcell(3821), vfocv(3891), soc(71), table soc(44)
init_microusb_ic: MUIC: CONTROL1:0x00
init_microusb_ic: MUIC: CONTROL1:0x00
init_microusb_ic: MUIC: CONTROL2:0x3b
init_microusb_ic: MUIC: CONTROL2:0x3b
====================
s5m8767 pmic register
====================
ID = 0x05
ONSRC = 0x06
STATUS1 = 0x02
STATUS2 = 0x10
STATUS3 = 0x07
IRQ1 = 0x10
IRQ2 = 0x3a
IRQ3 = 0x00
PWROFFSRC = 0x00
PMIC_RTC_WTSR_SMPL_REG = 0x80
S5M8767_REG_BUCHG = 0x6f

s5p_check_keypad: 0x0
s5p_check_reboot_mode: INFORM3 = 0 ... skip
s5p_check_upload: MAGIC(0xc0c0c0c4), RST_STAT(0x10000)
microusb_get_attached_device: STATUS1:0x39, 2:0x60
s5p_check_download: 4
AST_DLOAD..

: Entering usb mode for EK-GC100_EUR_XX (4)..
FACTORY MODE
PRODUCT NAME: EK-GC100_EUR_XX
CUSTOM BINARY DOWNLOAD: Yes (11 counts)
CURRENT BINARY: Samsung Official
SYSTEM STATUS: Official
cmu_div:5, div:2, src_clk:800000000, pixel_clk:66765600
s6d6aa1_write :: retry: 1
s6d6aa1_write :: 0x11
Download mode turn to AP_USB(4)board_set_dev_pm: hello! I'm USB.(1)
exynos4 usbd2 phy init
usb old tune = 0x2819b3
usb new tune = 0x2831b3

I'll try a few other things. and I need to review this log very carefully.. I noticed Odin does not use Loke anymore... I't sjust called "hello! I'm USB."... Interesting.. Anyway.. Back to work on it.
[Hardware Hacking General] AdamOutler:
Here is the help file:

S-BOOT # help
Following commands are supported:
* chipinfo
* help
* log
* reset
* boot
* load_kernel
* printenv
* setenv
* saveenv
* findenv
* checksum_need
* checksum_result
* usb
* upload
* keyread
* readadc
* usb_read
* usb_write
* sdcard
* mmcdtest
* fuelgauge
To get commands help, Type "help <command>"
S-BOOT # help chipinfo
* Help : chipinfo
* Usage : display exynos chip info.
S-BOOT # help log
* Help : log
* Usage : *usage : log

S-BOOT # help reset
* Help : reset
* Usage : reboot
Reboot system

S-BOOT # help boot
* Help : boot
* Usage : boot [kernel options]
Boot Linux with optional kernel options

S-BOOT # help load_kernel
* Help : load_kernel
* Usage : load kernel image..
S-BOOT # help printenv
* Help : printenv
* Usage : printenv

S-BOOT # help setenv
* Help : setenv
* Usage : setenv [name] [value]

S-BOOT # help saveenv
* Help : saveenv
* Usage : saveenv

S-BOOT # help findenv
* Help : findenv
* Usage : findenv [filename]

S-BOOT # help checksum_need
* Help : checksum_need
* Usage : Setting checksum need. 0 or 1
S-BOOT # help checksum_result
* Help : checksum_result
* Usage : Setting checksum result. 2 or 3
S-BOOT # help usb
* Help : usb
* Usage : usb download command.
S-BOOT # help upload
* Help : upload
* Usage : usb upload command.
S-BOOT # help keyread
* Help : keyread
* Usage : *Usage : keyread

S-BOOT # help readadc
* Help : readadc
* Usage : *usage : readadc <channel>

S-BOOT # help usb_read
* Help : usb_read
* Usage : usb_read reg
Read the usb ic register

S-BOOT # help usb_write
* Help : usb_write
* Usage : usb_write reg, val
Read the usb ic register

S-BOOT # help sdcard
* Help : sdcard
* Usage : sdcard test command
S-BOOT # help mmcdtest
* Help : mmcdtest
* Usage : mmcdtest
S-BOOT # help fuelgauge
* Help : fuelgauge
* Usage : *usage : fuelgauge

S-BOOT #

Here are the environmental variables and others..

S-BOOT # printenv
: REBOOT_MODE: 0
: SWITCH_SEL: 3
: DEBUG_LEVEL: 20300
: SUD_MODE: 0
: DN_ERROR: 0
: CHECKSUM: 3
: INT_RSVD6: -4291820926
: INT_RSVD7: 0
: INT_RSVD8: 0
: INT_RSVD9: 0
: CMDLINE: console=/dev/ttySAC2 loglevel=4
: STR_RSVD1: (null)
: STR_RSVD2: (null)
S-BOOT # sdcard
OCR return 0xc0ff8000
mmc->card_caps: 0x00000000
mmc->host_caps: 0x00000111
cmd_sdcard_test: completed.
S-BOOT # chipinfo
4W8K_0017_0197_0191
S-BOOT #

So, this looks very promising. I'm betting this can be used to

A: debug booting from SDCard

B: Provide valuable information

C: Show why a device is failing

D: Assist with U-Boot project

E: Allow loading kernels from SDCard
[Hardware Hacking General] simone201:
This looks amazingly promising Adam!!!

Can you please post here your modified param.tar/bin file with changed console output?

I also have a UART cable so i want to play a bit with SBoot too in my I9300

Maybe there is a way of having UART output via USB cable also? Maybe using the 524kOhm resistor (if i remember right)?

Inviato dal mio GT-I9300 con Tapatalk 2
[Hardware Hacking General] AdamOutler:
Sucess!

I just booted the Galaxy Camera from SD and ran a SDCard designed to reload the bootloader.

PMIC rev = PASS2(4)
CHECK PWROFFSRC = 0x00
CHECK RTC PWROFFSRC = 0x00
[s5m8767] update LDO2 onoff[1]
[s5m8767] update LDO4 onoff[1]
[s5m8767] update LDO5 onoff[0]
[s5m8767] update LDO6 onoff[1]
[s5m8767] update LDO7 onoff[1]
[s5m8767] update LDO8 onoff[1]
[s5m8767] update LDO9 vol[1800]
[s5m8767] update LDO10 onoff[1]
[s5m8767] update LDO11 vol[1950], onoff[1]
[s5m8767] update LDO12 onoff[1]
[s5m8767] update LDO13 onoff[0]
[s5m8767] update LDO14 vol[1950], onoff[1]
[s5m8767] update LDO15 onoff[1]
[s5m8767] update LDO16 onoff[1]
[s5m8767] update LDO19 vol[1800], onoff[1]
[s5m8767] update LDO20 vol[3300]
[s5m8767] update LDO21 vol[3300]
[s5m8767] update LDO22 vol[2800]
[s5m8767] update LDO27 vol[1500]
wait.. 09
wait.. 08
wait.. 07
wait.. 06
wait.. 05
wait.. 04
wait.. 03
wait.. 02
wait.. 01
wait.. 00
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
mmc_initialize: mmc->capacity = 15269888
cmu_div:5, div:2, src_clk:800000000, pixel_clk:66765600
s6d6aa1_write :: retry: 1
s6d6aa1_write :: 0x11
SDCARD MODE
OCR return 0x80ff8000
mmc->card_caps: 0x00000000
mmc->host_caps: 0x00000111
COPY BINARY FROM SDCARD..
COPY BINARY TO EMMC..
SDCARD DOWNLOAD COMPLETED.

The Galaxy Camera now has UnBrickable SD. Thanks a ton to Ralekdev and Rebellos as well.

Lets move this thread to hardware hacking, begin phase II, relax the rules a bit, and I'll be starting a thread in Galaxy Camera and linking it here soon.
[Hardware Hacking General] E:V:A:
Excellent and quick work! But what did you put on your SD card and how did you format it? (or did I miss something?)
[Hardware Hacking General] theq86:
If you have a look at the OP you can see linked an internal samsung document and a special bootloader file (sboot.bin)

If you follow the instructions you will have generated an sdcard which consists of an 512 Byte header (probably ARM code to boot up from SD), as well as the sboot.bin content.

What happens while booting from SD is, that the sboot.bin will be written to a bootloader damaged device, thus rendering it useable again.

Adam statet, that Galaxy camera and Galaxy S3 I9300 are quite similar. So I think a running I9300 Bootloader on Galaxy Camera proves it.
[Hardware Hacking General] jerdog:
As requested moving this to Hardware Hacking
[Hardware Hacking General] AdamOutler:
Your account and posts should be deleted shortly.
[Hardware Hacking General] trogdan:
Adam,

I've been doing some related research with the GT-I9300 using heimdall (trying to get dump working (see last 3 comments)), and saw that you could use someone to help out with this mod. In my quest to learn more about Odin and the Exynos 4420 bootchain, I will go ahead and try to assist. What is it you are looking for after I flash params?

I believe I have put the primary emmc partitions back to stock, except for recovery (CWM currently), hopefully this won't affect the test.

I can also provide some high-resolution photos tonight.
[Hardware Hacking General] trogdan:
Interesting, you will note that is the same text that displays when I get the phone into "hardware reset" mode.