yashsingh1/xdaforums huggingface dataset:
[Galaxy Note II, Galaxy S III Developer Discussion ] Oranav:
No, this documentation is irrelevant.

As I said before on this thread, there are 2 vendor-specific MMC commands Samsung has implemented: CMD60 and CMD62. It's their own implementation, you won't see any documentation for it unless you sign an NDA.

I have reversed most of the CMD60 and CMD62 interface though. There are some interesting features there.

MoviNAND doesn't have any CMD61 implementation.

They included it probably because they just copy-pasted some engineering code.

Besides that, an interesting fact is that CMD60 has an interface for doing firmware upgrades (so you don't need a stub as they've done here); they don't use it however.

Right, thanks. I didn't know it was the microcontroller type.

Actually, offset 0x1c is the 4 reserved DWORDs of the Cortex-M3 vector table.

Note that it is only located there for this firmware; in our RAM dumps, it's located elsewhere (hard-coded to the smart report generate function).

This isn't true. As I've said, there is more than one kind of smart report, and it depends on which "block" you read.

If you read block 0 (as in the MoviNAND documentation), you get the regular report.

If you read block 0x1000 (as in the FFU and in the SDS temporary patch), you get the extended report.

There are more possible values. One, for example, is 0x2000 - to read the FTL context structure (0x3E4C bytes long).
[Galaxy Note II, Galaxy S III Developer Discussion ] Oranav:
Yes, I'm 100% sure.

This is a pseudo-code of MMC_READ_SINGLE_BLOCK command handler after you issue CMD62(0xEFAC62EC) CMD62(0x0000CCEE):

void __fastcall f_smart_report_send(mmc_command *cmd)
{
uint32_t arg; // r1@1
int arg_high_byte; // r4@1
int arg_low_byte; // r5@1
...
arg = cmd->arg;
arg_high_byte = arg & 0xFF00;
arg_low_byte = (unsigned __int8)arg;
...
if ( arg_high_byte == 0x4100 )
{
sub_41954((int)g_output, arg_low_byte);
goto done;
}
...
if ( arg_high_byte == 0x2000 )
{
f_ftl_get_context(&ftl);
f_memcpy(g_output, ftl, 0x3E4Cu);
}
...
if ( arg_high_byte == 0x1000 )
{
f_memcpy(g_output, &g_smart_report_output, 0x200u);
}
...
if ( arg_high_byte == 0 )
{
f_memcpy(g_output, &g_smart_report_output, 0x90u);
}
...
}

It was obtained using Hex-Rays decompiler over the 0xf1 firmware. It's exactly the same in 0xf7.

There are more possible values for arg, which I didn't include.
[Galaxy Note II, Galaxy S III Developer Discussion ] Rob2222:
Hello,

Sourcecode update 8 is out and has some differences in the MMC driver compared to update 7.

They seem to use a feature called Power Off Notification (PON) now.

Do they maybe use it to detect locked state (by sd-fix) faster?

However, the sd-fix patch bytes they are writing to the eMMC are still the same.

BR

Rob
[Galaxy Note II, Galaxy S III Developer Discussion ] AndreiLux:
We're aware of it. Although no absolute confirmation, they enable the chip's notification to communicate to the kernel of a restart; it'll probably avoid the 10 minute lockups.
[Galaxy Note II, Galaxy S III Developer Discussion ] Rob2222:
Hello,

but isn't this notification send on power-down from the host to the eMMC?

At least thats the way I understood the code. But I am not sure.

BR

Robert
[Galaxy Note II, Galaxy S III Developer Discussion ] E:V:A:
We don't think this is very interesting, as it just give time for the device to make proper shutdown in case watchdog wanna shut it down. It's probably the watchdog that is responsible for shutting down the eMMC when reaching the oo-loop mentioned earlier.

You can read all about it in JEDEC JESD84-B451 on page 185 (207 in PDF).

[SIZE=2]7.4.86 [B]POWER_OFF_NOTIFICATION[/B] [34]

This field allows host to notify the device before the device is powered off.
Values not in the below table are invalid and setting them will result in
SWITCH_ERROR.

Value Name Description
-----------------------------------------------------------
0x00 NO_POWER_NOTIFICATION Power off notification is not supported by host, device shall not assume any notification
0x01 POWERED_ON Host shall notify before powering off the device, and keep power supplies alive and active until then
0x02 POWER_OFF_SHORT Host is going to power off the device, The device shall respond within GENERIC_CMD_6_TIME.
0x03 POWER_OFF_LONG Host is going to power off the device The device shall respond within POWER_OFF_LONG_TIME.
[/SIZE]
[Galaxy Note II, Galaxy S III Developer Discussion ] MSK1:
I have just had SDS this morning....

the morning after the update..
[Galaxy Note II, Galaxy S III Developer Discussion ] phoenixdigital:
My friend was also running a ROM with the 'patch' from Samsung and his phone still died of SDS.

I know that when my phone came back from repair it was still vulnerable to SDS. I am no longer content that this supposed 'fix' in the kernel and recovery is enough to protect my phone. I am almost certain this will happen again.

Has there been any more research into patching the firmware on the eMMC ourselves?
[Galaxy Note II, Galaxy S III Developer Discussion ] MSK1:
Oh no!!!!!!!!!

Can anyone verify this. .... !!!!!!
[Galaxy Note II, Galaxy S III Developer Discussion ] phoenixdigital:
To further clarify he was running Super Nexus Build 2

http://xdaforums.com/showthread.php?t=2076672

which contains

I9300: Patched kernel with sudden death fix from Samsung's kernel update 7 sources

I have been informed there is an update 8 out in the wild.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
You know, there are plenty of other ways a device can fail with the same symptoms as SDS other than SDS itself... We have no idea if that device actually did have SDS occur. Considering that the number of damage reports has plummeted to almost nothing since the patch was deployed, I'm suspecting he had some other sort of failure... It happens, bad luck.
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
Basically, unless Samsung comes out and says something (like Sony did a few days ago for the same exact issue), we can't do much. I haven't had SDS, but all I know is from now on if I buy another Samsung device, it's going to be a US model. I don't care about the specs anymore. We've reached a point where the Exynos is only marginally faster than the competition. It's not worth the risk of ending up with a dead device that won't be repaired overseas (since I'm in the US). I've already had my S3 repaired once for a separate issue and it cost me $80 to ship it and a month of waiting.
[Galaxy Note II, Galaxy S III Developer Discussion ] AndreiLux:
What does this have anything to do with Exynos/Qualcomm?
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
Sorry, I thought I was in the main SDS thread (I'm subscribed to this and both).

But while we're on this topic, to answer your question, the Qualcomm models have only had a few instances of SDS. And I live in the US, so warranty repair or replacement is easier for me.

Again, sorry. I posted in the wrong thread.
[Galaxy Note II, Galaxy S III Developer Discussion ] AndreiLux:
I wasn't aware that Qualcomm made eMMC modules! Learning something every day.
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
I believe the North American models use different eMMC chips than the ones that are in the SDS-prone batch of i9300's, but I don't think they're necessarily made by Qualcomm.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
Pure coincidence, and not really related to this thread. There's nothing preventing a defective chip from showing up in a Qcom-based Samsung (see Hercules/Skyrocket and Superbrick).
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
Oh, of course. I agree fully. I'm just saying that for the S3 specifically, SDS is far less frequent because of the difference in hardware (and most likely eMMC). It has been reported a few times, but it's nowhere near as ubiquitous as with the i9300/i9305.
[Galaxy Note II, Galaxy S III Developer Discussion ] kaidokert:
So, i have suddenly became responsible for reviving my spouses SDSed GT-I9300 or at least pull data off the eMMC ( phone bought in US through Amazon so warranty is a predicament ). I have a day job, several hobbies and generally nice outlook in life and no interest hacking this, but "because my girlfriend's a vegitarian which pretty much makes me a vegitarian" situation here i am obliged.

As a last resort, i'm looking at desoldering the eMMC chip and wiring it into one of 3.3v dev boards that i have ( a bunch of cortex-M0s, Arduino Due, Pandaboard etc ) and from what i gather eMMC only requires 2 lines in minimum conf, CLK and DAT0 to talk to it so i could do abysmally slow raw data dump if i wanted to. But i only started reading up on the entire issue and glossed over eMMC spec for the first time 15 mins ago.

Any better pointers before i go down that last resort path ? The phone still goes to Odin mode, can i load a minimal kernel or u-boot or something through that somehow ?
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
The problem is that most likely, the eMMC is so hosed at a low level that the data is inaccesible.

There are some special tricks available (search around) for booting the I9300 off of a special SD card to repopulate the bootloader. So if you can replace the eMMC chip, you should be able to repopulate the bootloaders.

Another possibility is that if you can boot from an external SD, you MIGHT be able to send commands to resize the boot partitions downwards and back up. This will, in theory, cause a full chip reset. All data will be lost, but the damaged areas will get cleaned up. However, this is only theory based on reading the leaked datasheet - no one has EVER done this, so no one knows if it will work.

Ideally for these repairs we'd have an expert in JTAG recovery help out - I'm sure with the knowledge from that datasheet and a few dead devices, the RIFFbox guys could figure something out. I once emailed Josh at mobiletechvideos these new discoveries, but never heard back from him.
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
It's been done on the original Note actually. Can't find the original thread but I remember reading it. The guy basically moved the partitions over.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
"It" being what? - replacing the eMMC (yeah, 1-2 people have soldered new ones on, they needed JTAG to repop the bootloaders since there is no known way to repopulate bootloaders via USB or SD on 4210 devices - Many 4412 devices including I9300 can be recovered from hardbrick from SD) or fixing a damaged eMMC using boot partition resizes (i'm fairly certain no one has done this yet)
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
No; like I said I saw a fix where the guy moved the partitions over so that the undamaged portions were unused.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
That's a fugly hack that usually doesn't last long because the corrupted data structures seem to spread.

We're talking about ways to completely recover a device.
[Galaxy Note II, Galaxy S III Developer Discussion ] AdamOutler:
[MENTION=3036272]Oranav[/MENTION] , [MENTION=1767826]Rebellos[/MENTION] and myself are working on a bootloader to work around this issue. https://github.com/Rebell/exynos4_uboot

We should be able to insert test commands to my bricked GS3, but I want to try to recover the data first. This device was given to me for data recovery and testing bootloaders. Currently we are working around the EMMC and booting from SDCard.
[Galaxy Note II, Galaxy S III Developer Discussion ] vim1:
Hi , I am searching for peoples who reversed eMMC. We created HW solution to access eMMC directly in PCB and trying to revive bricked cards.
[Galaxy Note II, Galaxy S III Developer Discussion ] hackerse7en:
is this the emmc ?

http://www.parts4repair.com/samsung-galaxy-note-ii-n7100-flash-chip-with-program/

if i buy this emmc and replace it in my n7100 will it work?
[Galaxy Note II, Galaxy S III Developer Discussion ] Ricky Divjakovski:
did you end up going through with the project? im curious?
[Galaxy Note II, Galaxy S III Developer Discussion ] Rebellos:
We didn't finish it. Lack of time or something...
[Galaxy Note II, Galaxy S III Developer Discussion ] n4naveen:
can someone tell me SDS bricked note 2 can be reversed or something with the existing eMMC ? ... I bought it in singapore which he claimed to have international warranty but back in india samsung service center guys reject to fix it under warranty.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
In theory, yes. In practice - no one has yet to put the required components together. (Actually, while the I9300 does have an SD-based "unbrick bootloader" process, I'm not sure if that works on Note2 units)

Pretty much two things are needed to recovery an SDSed or Superbricked device:

1) Use the boot partition resize trick to cause a low-level eMMC wipe - see Hashcode's success on the Kindle Fire - won't work if the device's eMMC is so corrupted it can't even boot a kernel or recovery

2) Once the eMMC is wiped, repopulate bootloaders - this is far harder to do on Exynos devices than on GP OMAPs like the Kindle Fire, which is why no one has done it yet - in theory this last part could be done by a JTAG service
[Galaxy Note II, Galaxy S III Developer Discussion ] vim1:
We ready to test your theory ;) Please answer in AIM

We have done vendor boot size change with CMD62 on VYL00M

Command 62 (ARG: 0xEFAC62EC)

Command 62 (ARG: 0x00CBAEA7)

Command 62 (ARG: bla bla)

But none of "low-level wipe happened"
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
Interesting, it worked for the Kindle Fire guys - http://xdaforums.com/showthread.php?t=2413453
[Galaxy Note II, Galaxy S III Developer Discussion ] Oranav:
If you're feeling adventurous, you can try a command (I found during the firmware reversing) which should low level format your chip:

CMD62 (ARG: 0xEFAC62EC)

CMD62 (ARG: 0xFAC0021)

Note that it will delete all the chip metadata (incl. wear leveling state and bad block info) and probably everything in it... Your responsibility :)
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
This will also wipe your bootloader and partitions. I don't recommend it. Nothing short of a JTAG will fix it.
[Galaxy Note II, Galaxy S III Developer Discussion ] Oranav:
Yep. It even resets write protection lock if there's any... Huh.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
Based on their posting history, I think the guy we're responding to works for one of the JTAG recovery shops. ;)
[Galaxy Note II, Galaxy S III Developer Discussion ] vim1:
It doesnt wipe any bad block info , bcoz state in smart report didnt change ;) that confirmed. Wipe erases regions, user, boot1, boot2 , most possible rpmb and also reset extcsd boot config and wipes write protection flags.
[Galaxy Note II, Galaxy S III Developer Discussion ] Oranav:
Cool... Did it fix SDS though?

If the smart report wasn't changed I worry that it doesn't fix SDS.
[Galaxy Note II, Galaxy S III Developer Discussion ] skiddd:
Is it just me or did anyone else realize that fw.bin is not actually an actual firmware update?
[Galaxy Note II, Galaxy S III Developer Discussion ] vim1:
It dosnt fixed SDS on fully bricked devices ( eMMC name == 000000 )

Reason if very simple - all they have early revision of eMMC firmware and have not

factory reset command handler , any way if they even have it it is not enough

Need to write custom code for accessing internal NAND and recover wear leveling table. There is some ARM6 guru ? We can access card even fully dead mode

Ome thing we need to make custom code for eeprom recovery

Отправлено из моего iPad используя Tapatalk HD
[Galaxy Note II, Galaxy S III Developer Discussion ] Mashed_Potatoes:
Guys sorry for going off topic, but can we replace the dead emmc chip? my friend had SDS and he found a broken note 2 with working emmc chip. can it be replaced?
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
Not without special soldering equipment. I think Josh at MobileTechVideos did purchase such equipment. However I think some people are pretty close to being able to resurrect these with JTAG.
[Galaxy Note II, Galaxy S III Developer Discussion ] Mashed_Potatoes:
Well he has been told that the repair would cost him 150 dollars minus the replacement eMMC chip.

Is that a rip-off? We've seen guys replace and solder the new eMMC in like 20 minutes on youtube.
[Galaxy Note II, Galaxy S III Developer Discussion ] Entropy512:
Considering what a high-risk delicate operation it is and how much specialized equipment is required - no.
[Galaxy Note II, Galaxy S III Developer Discussion ] Product F(RED):
You guys are seriously better off just buying a new phone at this point if your phone is dead. It's just not worth it. Sell it for parts (the screen w/assembly alone will get sell for around the cost of a new S3). Sell the SIM/MicroSD card reader combination. Sell the body of the phone. You might be able to sell the mobo for parts to someone who has experience. Just list it all on eBay and then buy yourselves a new phone with the money.
[Galaxy Note II, Galaxy S III Developer Discussion ] adfree:
Stupid question...

Someone checked Tizen stuff?

Test device RD-PQ has I9300 pba inside...

Not sure if Live Demo Unit... but I9300A visible on Label...

Maybe checkout s-boot-mmc.bin ca. 290 KB...

http://download.tizen.org/releases/system/

Sources for uboot are here:

ftp://ftp.denx.de/pub/u-boot/

For instance u-boot-2014.04-rc1.tar.bz2

Samsung folder inside...

TRATS is S2 related...

TRATS2 is I9300 related...

I think RD-PQ is 16 GB variant...

Partition table is inside u-boot-mmc.bin

Attached...

IS unsigned or I have not seen Signature...

I9300 retail ignored this PIT...

I think because missing Sig...

Please, I am new to I9300 :o

And I have only 1 damaged device with damaged Display, so I can't see nor Touch working...

So I was not able yet to dump few first Bytes from eMMC...

My obsolete knowledge about 512 Byte MBR + partition table... is from S8500/I9000...

For instance S8500 has 512 MB OneNAND and 1960 MB moviNAND... something similar like eMMC...

OS stores additional info into this MBR...

2NDFORMATCOMPLETED
2NDRSTORECOMPLETED
[B]PRODUCTCODEINVALID[/B]

If NAND/Headerinfo is alive in OneNAND...

Instead text PRODUCTCODEINVALID is Unique number written...

sysinfo related...

I can not find I9300 dump to compare.

Maybe someone can help me to find Link or maybe someone can upload please first 512 Byte for study.

Thanx in advance.

Best Regards
[Galaxy Note II, Galaxy S III Developer Discussion ] .NetRolller 3D:
I wonder if the previously mentioned eMMC low-level format command can be used to remove Knox from the i9305 (& possibly the i9505 as well)... ;)

EDIT: Suggested procedure:

-Make a full Nandroid of all accessible partitions (including EFS).

-Prepare SD card for bootloader repair. (Does this still work if the entire eMMC is wiped, or does some boot partition need to be preserved? If not, use JTAG.)

-Do a low-level format.

-Restore the bootloader from SD card or JTAG.

-Flash param.bin, and restore EFS, ROM and user data.
[Galaxy Note II, Galaxy S III Developer Discussion ] E:V:A:
So what is it? Because, I sure as hell have no idea why'd you bother making such a post without further explaining yourself.
[Galaxy Note II, Galaxy S III Developer Discussion ] ryanbg:
I think this would work. SDC3 fuse is burned, so it should boot fine as long as the GPT and properly signed images/partitions are in place.
[Galaxy Note II, Galaxy S III Developer Discussion ] jerryspring:
what does it mean when it says -104687000 bytes free? it shows that when i look at phone on the pc. does that mean an emmc fail? asking cuz roms wont flash to my note 2. they are stuck in boot animation
[HTC Amaze 4G] krayzielilsmoki:
Hey guys I rooted this phone almost a year ago and installed a custom rom. I remember the procedure being very different from other phones I have done and very complicated. At the moment I am still "S-on" and running Android Revolution HD 1.1.0 (android 2.3.4)

My goal is to install the newest version of Android Revolution ( looking for a very stable rom, so I'm open to suggestions)

The thread mentions extra steps if you are coming from a non-ics rom.

Also Im considering the Energy rom. (this one does not specify any extra complicated steps)

In the current state that I'm in should I run the all in one s-off tool? do I even need that for these roms? what recovery should I flash? (Im currently on a CW based recovery)

Thanks in advance for all the help.
[HTC Amaze 4G] Ninjistix:
you should first flash back to stock.... then update to ICS... after that you should once again unlock your bootloader and flash 4ext recovery this time.. but you id really suggest updating to ICS before trying to flash any ICS roms..., specially since your still "S-ON"
[HTC Amaze 4G] krayzielilsmoki:
To my understanding, flashing back to stock requires the stock recovery and a stock image.

I found the stock image here http://xdaforums.com/wiki/HTC_Amaze_4G/ROMs#Stock_ROMs

but can somebody help me find a stock recovery?
[HTC Amaze 4G] Dark Nightmare:
First of all, which carrier are you on? Are you s-off?
[HTC Amaze 4G] filthygoat223996:
He said he was s-on in the first post
[HTC Amaze 4G] DigitalUnderground:
Relock bootloader. Flash RUU for your carrier in bootloader. There are plenty of threads, and 2 stickies describing this
[Sprint Samsung Galaxy S III] DroidModder:
Just a fun thread/ poll to ask what your favorite Twitter App would be(if youre on twitter) Ill have links to the apps i like and use/used for twitter.

Twitter For Android

TweetDeck

TweetCaster

Twicca

Plume For Twitter

Falcon Pro

Now what are your favorite Twitter Apps?! :)
[Sprint Samsung Galaxy S III] 5FOOTER:
Plume it's easy on the battery and looks good to me.
[Sprint Samsung Galaxy S III] tgrrb5:
Falcon pro

Http://i921.photobucket.com/albums/ad51/518loans/publication5.png
[Sprint Samsung Galaxy S III] wuestsider:
Tweet Lanes is nice.

WUESTSIDER X!

Sent from my Mighty Galaxy S3!
[Sprint Samsung Galaxy S III] labunjef:
I usually just use the official twitter app, but always open to switching!
[Sprint Samsung Galaxy S III] DroidModder:
I tried Falcon Pro. It has a really nice User Interface and the APIs make it looks good with Jelly Bean. My only complaint is that it doesn't have a "Jump To top" button or a refresh feature

Sent from my BAKED GS3
[Sprint Samsung Galaxy S III] land2634:
I also tried Falcon Pro. I like the interface, but, unless I'm mistaken, real-time push notifications only work when on wi-fi.
[Sprint Samsung Galaxy S III] filmaker:
Tweetcaster!!
[Sprint Samsung Galaxy S III] DroidModder:
Yeah for sure. I agree, some updates need to be made to FP lol. tweetcaster is boss. I like TweetDeck but Twitter hasn't updated it in so long. I doubt it has APIs for 4.x.x lol

Sent from my BAKED GS3
[Sprint Samsung Galaxy S III] ricocollege:
Falcon Pro
[Sprint Samsung Galaxy S III] fergie716:
I bought plume pro over a year ago, it's constantly been updated and it's really customizable. The only thing I don't like are the widgets. They look awful lol. But the app itself is A+
[Sprint Samsung Galaxy S III] haynesr07:
I used Twicca for a long time. I prefer very minimalistic style clients. I have been using Tweetings for Twitter for about 2 months now. I love it, very good interface.
[HTC Wildfire S] strofakias:
HI everybody...i have install this rom http://xdaforums.com/showthread.php?t=1860291 and i want you to help me clea all the unnecessary apps and plugins.for example

certinstaller,csdffunctionG.defcontainer.ftphtcdialer.pack installer.providers applicationsproviders downloads ....because i need the internal memory

i ve tried int2ext+ but didnt work and i flash the rom two times because it was not open after the installation
[HTC Wildfire S] Foxtrot2_nov:
If you downloaded the rom and open the

the zip file and remove the .apk's you don't want. After that flash the zip, before that wipe everthing, and then you have more internal space. But don't remove the system apps.