yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
Sounds interesting.

1.

You found ELF files for S8600 Boot ?

2.

You found way without JTAG, or JTAG is needed to write your Boot?

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Rebellos:
CONFIG_DEBUG_LL

and

CONFIG_EARLY_PRINTK

plx <3
[Bada Software and Hacking General] oleg_k:
it's my current config for my kernel:
[Bada Software and Hacking General] oleg_k:
No, don't ELF files for S8600, i wrote new bootloader for boot linux kernel.

Now i use JTAG, but if we find a way to cript my bootloader,like appsboot.mbn,we will use regular multiloader
[Bada Software and Hacking General] CageOff:
So cool! :)
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?t=1443575

Maybe PlatformDownloader_S8600_KI5.exe maybe have unsecured Boot...

But I can't flash nor I have connected my S8600 with RIFF...

TPs seems to small for my big Fingers...

Best Regards
[Bada Software and Hacking General] Rebellos:
Thanks. I'd check debug macros and debug uart configuration. There's few UART ports in it, and maybe kernel is printing to the wrong one... though this wouldn't explain why kernel unpacker is printing something (Uncompressing and booting comes already from zImage) - this would indicate that debug port number is correct. Are you sure that kernel and ATAGs location is correct, and RAM is set up properly by LK? Maybe something bad happens when kernel proceeds to enabling MMU and caches... I'm pretty clueless. :<

I collected some links I found useful in this article: http://xda-university.com/as-a-developer/porting-android-to-non-android-devices

Especially interesting for you might be last link in "Custom bootloader" section. :)
[Bada Software and Hacking General] adfree:
For S8500 I found way to write direct into OneNAND at:

0x0010 0001

No need to encrypt something... :D

With Multiloader... choose ETC.

http://xdaforums.com/showpost.php?p=37229969&postcount=37

S8600 not tested...

This is far far away from perfect... but maybe helpfull.

Need someone who is able to remove restriction from ML to use lower adresses then 0x10000...

I was only able to change text strings... in ML...

Best Regards
[Bada Software and Hacking General] oleg_k:
On first page i posted bootloader source and memory dump, stage - after load oemsbl and before loading my bootloader.

To Adfree,

S8600 don't use OneNAND, used EMMC flash memory (like sd-card).
[Bada Software and Hacking General] adfree:
Today I've found S8600XXKI9.zip

I have forgotten this Firmware... but I have now short compared with Bootfiles from XXKJC... BIG differences... So I think this should be nearly identical with PlatformDownloader_S8600_KI5.exe

Still unsolved to decrypt or extract content of:

PlatformDownloader_S8600_KI5.exe

and

PlatformDownloader_S8600_KJ7.exe

:o

Best Regards
[Bada Software and Hacking General] adfree:
Not my S8600... but user tried PlatformDownloader_S8600_KJ7.exe

:o

It seems it was wrong Partition Table aka partition.bin... :o

Boot Binary Download Start Ch[0]
Appsboot 338.7KB OK[1.1s]
OemSbl 1757.7KB OK[1.8s]
ERR : NAK_FLASH_ERROR 0
Error : [B]partition Write[/B] [0.2s]
ERR : NAK_FLASH_ERROR 0
Download Start Ch[0]
Amss 16654.3KB OK[15.6s]
Apps 29622.3KB OK[54.1s]
_Open_Europe_Common 40370.2KB OK[73.5s]
(Low) 2980.3KB OK[1.9s]
ERR : NAK_INVALID_CONTENT 0
ERR : _Open_Europe_Common Erase

Now S8600 ask for QHSUSB_DLOAD

My first idea is Qualcomm QPST now...

Or maybe if Driver used, then Multiloader will work again... for second attempt..

Found only 64 Bit Driver yet... not tested nor Thread... only attachment...

http://xdaforums.com/attachment.php?attachmentid=631288&d=1308601930

Will check also QPST to check what is needed...

Best Regards

Edit 1.

More Driver...

http://xdaforums.com/showpost.php?p=21911621&postcount=2
[Bada Software and Hacking General] adfree:
Okay...

It seems for QPST fsbl.mbn is missing...

I can remember from old MSM6250 handsets it is mandatory to have all files for QPST... because otherwise you need JTAG...

Important...

Qualcomm not use Encryption for QPST files...

This is Samsung thingie + "end.bin" last 1024 Byte...

So decrypt all Bootfiles and cut last 1024 Byte...

For fsbl.mbn I will check JTAG dump from S8600...

Best Regards

Edit 1.

http://xdaforums.com/showthread.php?t=1367055

downgrade_WM6_boot.zip contain fsbl.mbn ... maybe as example...
[Bada Software and Hacking General] oleg_k:
Adfree,

link pls for founded S8600XXKI9.zip
[Bada Software and Hacking General] adfree:
http://hotfile.com/dl/145796951/79ecec6/S8600XXKI9.zip.html?lang=de

Try this. If not then I search again...

About fsbl.mbn...

I have searched for fsbl_hw.c string in 4 GB JTAG dump SAMSUNG_GTS8600_FullFlash.bin...

Can not find so I think fsbl is not or in other area... :confused:

About your Memory Dump FROM_MEM_0_128MB.bin

:o

I am not 100 % sure but maybe read problems...

Short tried to extract Cert, but string Qualcomm is not written correct...

Best Regards
[Bada Software and Hacking General] oleg_k:
I try to read again memory dump )

thanks for links...

Also,

i find,what samsung used OKL4 Microkernel 3.0 (maybe 4.0)

http://wiki.ok-labs.com/Release/3.0

About ver 4.0 --

The OKL4 Microvisor is designed from the ground up as a high-performance mobile virtualization platform. It is a microkernel-based embedded hypervisor - called a Microvisor, with a small footprint and the right combination of performance and hardware support to target mobile telephony use. The OKL4 Microvisor 4.0 is distinguished by supporting mobile virtualization, componentization, and security, enabling a new generation of applications and capabilities with impact across the mobile ecosystem.

OKL4(with Qualcomm RTOS) also used in modem AMSS

http://xdaforums.com/showthread.php?t=1829915
[Bada Software and Hacking General] adfree:
Need overview/list with Firmware packages with Bootfiles included...

Here this is what I have...

Later I will compare if difference...

XXKI9
XXKJC
S8600BOKJ1_TPLKJ1.rar
S8600BOKK6_S8500TPLKK7_T-Mobile.rar
S8600JPKK2_S8500OJPKK2_OJP.rar
S8600ZCLA1.7z
S8600NAKL1_S8600EPLKL1

Best Regards
[Bada Software and Hacking General] ghoslslender124:
1. http://xdaforums.com/showthread.php?t=2588979 That? :)

2. https://github.com/Oleg-k/LK_BOOT_S8600/tree/master/kernel only this... i try to compile that but my pc sucks...

Please read PM
[Bada Software and Hacking General] adfree:
Found this about I8350...

http://www.4shared.com/account/home.jsp#dir=cYn7Ie66

Thanx:

http://forum.gsmhosting.com/vbb/9824254-post3.html

Maybe here more luck...

Best Regards
[Bada Software and Hacking General] ghoslslender124:
We need to find way to flash all files by Multiloader...
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=270883]oleg_k[/MENTION] is back, so he will help and finish his work.

android on samsung s8600 will be running in 2014.

fingers up guys.
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=4619000]Gunter33[/MENTION]

https://github.com/Oleg-k/LK_BOOT_S8600/tree/master/kernel

is this kernel for s8600, if it is, could you build it? :)

thanks
[Bada Software and Hacking General] ghoslslender124:
Yes, it is Kernel. Compile it, but.. Whre put it? Bada system partition like S8500?

Waiting for [MENTION=270883]oleg_k[/MENTION]...
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=1030585]adfree[/MENTION]

about fastboot and uploading kernel and ROM via fastboot mode.

xdaforums.com/showthread.php?t=2131284

it is possible to flash kernel with fastboot, but only what we need wright now i proper kernel.
[Bada Software and Hacking General] mirhl:
Would you really be able to use fastboot on samsung devices? It seems a bit too absurd imo
[Bada Software and Hacking General] Galaxy3HELL:
well, adfree said that with oleg bootloader, his PC is reading android device in fastboot mode... or something like that.. yeah i know that samsung doesnt support fastboot mode, but some device does...

nexus: https://www.youtube.com/watch?v=eE7vPTYfUtE

but let we wait for adfree response, and we must stop spamming thread, first ME :p

:highfive:
[Bada Software and Hacking General] ghoslslender124:
Less speaking more job.

Need a man who can compile Kernel for us.
[Bada Software and Hacking General] kktkaran:
u guys r talking about where to copy kernel , but with oleg_k bootfiles , dual boot by keycombo is successfull ??

which keycombo ?
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=4994962]kktkaran[/MENTION] adfree said that his PC with oleg_k bootfiles reconise android device with fastboot... so if he menage to set up fastboot or whatever, it could be possible ( if we had kernel ) to upload kernel trought fastboot directly on device and run it..
[Bada Software and Hacking General] ghoslslender124:
http://xdaforums.com/showthread.php?t=2588979 fastboot drivers
[Bada Software and Hacking General] Galaxy3HELL:
https://www.mediafire.com/folder/efguol6vbid5d

here is kernel of i9001, if you success with fastboot, you can try to flash...

but i think that edited and freshly builded kernel is needed,,,

and again back to i8150 DL mode:

http://xdaforums.com/showthread.php?t=1317394
[Bada Software and Hacking General] hero355:
In first alpha of froyo on Wave, oleg_k said default kernel of I9000 not work on Wave, it needs to compile for Wave ;)
[Bada Software and Hacking General] ghoslslender124:
[MENTION=4377945]hero355[/MENTION]

maybe you can help us with porting?
[Bada Software and Hacking General] adfree:
My result for today...

After writing 6 hours new I8350 dump... 3,6 GB of 8 GB...

i8350fullbackupworkingriff.part01.rar
.
.

I can see few more pics...

4 Pics...

Samsung Logo is known...

New is next Samsung Logo with URL... Later I can show Video as result...

Surpricing new... Volume + and - activate 2 Modes... short and then restart...

Attached as Pics...

Not working...

DL Jig ...

:confused:

I hope not because only 300 KOhm instead 301... :rolleyes:

I was not able to enter DL Mode with Picture, I saw 1 time...

Nor any other Key combo leads to DL Mode...

Again my method to erase EMMCBOOT at position 0x0163FE00...

But no progress with Flashertool... :(

-----------------------------

About FASTBOOT and oleg_k EMMCBOOT.mbn

I saw only Windows request for "Android device" and no Driver installed...

As I thought my ADB driver are installed proper...

So I have ignored. Nobody told to install FASTBOOT driver...

I never worked with FASTBOOT Drivers, so where should I know this... :eek:

On weekend I have not much time... maybe... We will see.

First I have to find tutorials about FASTBOOT... 1 in my language is here:

http://www.pocketpc.ch/htc-hd2-andr...smiths-little-kernel-loader-installation.html

But my brain is small... I need time to understand and to try something...

Best Regards

Edit 1.

I8350 Full 7 GB dump can be analysed by renaming into .img ... then open with WinHex...

Now I'm trying to write Dumpi8350ortjtag.part1.rar... content is only 500 MB ...

It seems maybe from same device... as I can see also DBT blabla on blabla partition... maybe...

Edit 2.

Added Screenshot of Windows Mobile Driver... requested, if VolumeUpHoldI8350stuff2.jpg is seen.
[Bada Software and Hacking General] Galaxy3HELL:
install drivers for device which dump is installed, on this second picture its connected and waiting for software flash.. i have seen it on my before devices.
[Bada Software and Hacking General] Galaxy3HELL:
oleg_k said today on facebook that he is searching for last kernel source..

probably he will help, i asked him how did he upload kernel to device, and waiting for response.

:angel:

edit 1...

[MENTION=1030585]adfree[/MENTION]

little informations for you:

fastboot is android's USB protocol for communicating between the PC

and the bootloader. Being in "fastboot mode" means you are in the

bootloader and the bootloader is ready to communicate with the

fastboot protocol. However it is possible to be in the bootloader but

not in fastboot mode (if the bootloader does not support fastboot, or

is expecting to communicate via some other protocol).

>> However it is possible to be in the bootloader but

>> not in fastboot mode

>

> Is there a way to get into this via code (maybe a kernel module or

> something).

It really depends on the hardware, but typically it is done by passing

"bootloader" as an argument to reboot. See

system/core/toolbox/reboot.c for an example.

> and when in bootloader mode -> I wish to boot the system with another

> zImage - similar to the command fastboot provides to temporarily boot

> another kernel image.

If you want to be able to do this programatically from code running on

your device, you could probably do this via the recovery program. I

don't much about how that works, but there should be a lot of

information available from the android hacker community

edit 2..

right now i belive that oleg_k created bootloader with fastboot mode to flash kernel..

www.omappedia.com/wiki/Android_eMMC_Booting

http://processors.wiki.ti.com/index.php/Android_gingerbread_eMMC_booting

xdaforums.com/showthread.php?t=2091921

read this.

EDIT 3.

rebellos work with lk bootloader..

HERE
[Bada Software and Hacking General] ghoslslender124:
1. What android we want? 4.4? 4.0?

2. Kernel. We need kernel.

3. Flashing without JTAG? How?

4. Try to find more devs..
[Bada Software and Hacking General] adfree:
Attempt 1 for installing driver... FASTBOOT...

Taken from here:

http://xdaforums.com/showthread.php?t=2588979

My PC is XP...

1.1

Extracted with 7Zip... but nothing detected...

1.2

If Installer used... 3 x Yes...

After second confirmation I got this:

All 4 files copied.
Der Befehl "SETX" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

:confused:

Result is, driver can't be found...

I could try reboot PC...

On Screenshot VID PID visible...

Later more...

Best Regards

Edit 1.

Attempt 2...

Rebooted my XP, but nothing ... no success...

Moved to other PC... installed via Installer...

This time my PC Win 7 ... shows this, seems all okay...

All 4 files copied.

ERFOLGREICH: Angegebener Wert wurde gespeichert.

But PC not detect correct Android driver..

Sidenote...

If I remove Cable and plug in, then I can see portchange written on Display...

Also if I press Buttons, Logfile shows something:

KEY: State of key is changed!

1 time, after plug in USB cable into Win 7 PC... Log:

[564860] STALL GET_DESCRIPTOR 128 6 1006 0 10

:confused:

Google Power... :rolleyes:

VID_18D1&PID_D00D\5&428A151&0&2

Nothing...

But for

VID_18D1&PID_D00D

http://xdaforums.com/showthread.php?t=737728&page=3

.

.

Only as overview... own risk...

http://www.driveridentifier.com/scan/download.php?item_id=306980517&scanid=38CEC209CA194B188EC5D534E5C738C5&hardware_id=USB\VID_18D1%26PID_D00D

Will try to read, maybe can find compatible driver...
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

Later I try to compile driver from last link for you.

Hm.. We can tell we have (maybe) correct driver

Windows see our device

But how to flash it? via Odin? via Multiloader?

in android_winusb.inf i can see it:

;

;Google NexusOne

%SingleAdbInterface% = USB_Install, USB\VID_18D1&PID_0D02

%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_0D02&MI_01

%SingleAdbInterface% = USB_Install, USB\VID_18D1&PID_4E11

%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_4E12&MI_01

It look like Google Nexus Driver needed

//

[MENTION=1030585]adfree[/MENTION]

i make custom driver (replace few lines) please try them and tell me whats happened

1. http://speedy.sh/ypJN5/1.zip

2. http://speedy.sh/BZ2kx/2.zip

Plz try them
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=37737717&postcount=21

He posted long time ago something about moboot:

http://code.google.com/p/moboot/source/browse/

http://code.google.com/p/moboot/downloads/detail?name=moboot_0.3.5.zip&can=2&q=

Few CMM Scripts for JTAG inside... maybe for study/research...

Thanx, need some time for test...

In oleg_k source I can see this:

/* Assuming unauthorized kernel image by default */
static int auth_kernel_img = 0;

static device_info device = {DEVICE_MAGIC, 0, 0};

static struct udc_device surf_udc_device = {
[B].vendor_id	= 0x18d1,
.product_id	= 0xD00D,
.version_id	= 0x0100,[/B]
.manufacturer	= "Google",
.product	= "Android",
};

Where is PID info?

:confused:

VID_18D1&PID_D00D\[B][COLOR="Red"]5&428A151&0&2[/COLOR][/B]

Maybe last part is...

:confused:

Where I can find this in source code?

Best Regards
[Bada Software and Hacking General] ghoslslender124:
Give me PID - I try to wrote custom driver
[Bada Software and Hacking General] adfree:
Back to "basic"...

To find an way to bypass Security to use modified stuff with Multiloader...

We should know, how it work and what is inside these files from folder BOOTFILES:

appsboot.mbn
dbl.bin
osbl.bin
partition.bin

I have dumped eMMC from 0 - 0x09000000 XXKI9 with JTAG, Firmware is available.

1.

dbl.bin after DEcrypt with WaveRemaker can be found in dump at:

[B]0x200[/B]

So this is FIRST stuff direct after 512 Byte Master Boot Record.

1:1 except last 1024 Byte Signature... for ML

DBL is from start to end encrypted... for use with WaveRemaker...

Later tests if DBL can be modified... with ML...

2.

osbl.bin after DEcrypt with WaveRemaker...

It seems only half file is encrypted, after 0x1AC000 allready decrypted stuff...

:eek:

OSBL is 2 time in eMMC...

0x007D200
0x4000000

3.

appsboot.mbn

Nearly same sh. like osbl... only half file is encrypted... other part not... :rolleyes:

Encrypted part is from 0 - 0x50000

4.

partition.bin

Spread over eMMC but first MBR inside...

Also half encrypted... haalf not...

Boot Binary Download Start Ch[0]
[B]Pbl[/B] 11.0KB OK[0.1s]
ERR : NAK_FLASH_ERROR 0

Pbl seems partition.bin NOT Pbl... but I will try next time, to sniff connection...

Maybe Loader is sent to S8600... .HEX ...

Best Regards

Edit 1.

Short tested with XXKI9.

Remember result could differ with XXKJC Boot... but:

Boot Binary Download Start Ch[0]
Pbl 24.6KB OK[0.1s]
AppsBoot 338.7KB OK[0.4s]
OemSbl 1758.8KB OK[2.1s]
Dbl 229.4KB OK[0.3s]
All files complete[3.6s]

Easy test with DBL...

Decrypted with WaveRemaker... WinHex...

Text string Core in Gore... :D Somewhere you can see foldernames...

Encrypted with WaveRemaker... corrected MD5...

Flashed via Multiloader 5.67

Later I will dump again eMMC, to be sure, modified DBL is in eMMC...

Edit 2.

I will concentrate for now on DBL... because this is first stuff loaded and executed...

For now, because f. Security... I have 229376 Bytes (224 KB) for replace whole content... for tests.

I9001 DBL is smaller, so it would fit into 224 KB...

Edit 3.

This seems to work with DBL from I9001. :cool:

Boot Binary Download Start Ch[0]
Pbl 24.6KB OK[0.1s]
AppsBoot 338.7KB OK[0.4s]
OemSbl 1758.8KB OK[1.9s]
Dbl 229.4KB OK[0.3s]
All files complete[3.3s]

XXKI9 starts normal, with DBL from I9001...

Hopefully XXKJC DBL is not stronger secured... :o

Now I will dump eMMC with JTAG, to be sure, I9001 DBL is now active...

Edit 4.

Yes, I9001 DBL is really written with Multiloader and work with XXKI9. :cool: :cool:

Now I will flash XXKJC Bootfiles and check again...

Edit 5.

Added appsboot info

Edit 6.

Found some reading material... Google search...

http://www.phonesdevelopers.com/1776419/
[Bada Software and Hacking General] ghoslslender124:
If we succesfull decrypt all files we have 99% of succes..

Maybe wave S8500 can you help? etc. dumps on start? this all red txt when fota starts?

I'm now in school, but i search way to write custom drivers.. But we need way to flash bootloader.. Maybe first decrypt full NAND flash?

Best Regards
[Bada Software and Hacking General] adfree:
Please...

Do some homework...

DEcrypting is NO problem...

Click click. Tool Wave Remaker do this job... for you.

NO brain is needed. :D

Problem is to Encrypt modified stuff... to create VALID/ACCEPTED files flashable via Multiloader...

Again. There are big Differences between S8500 and S8600... in Security etc.

If you don't understand this... :eek:

Best Regards
[Bada Software and Hacking General] ghoslslender124:
sorry, it's morning, my brain doesnt work jet.. :D

Maybe try to modific Multiloader? and push it into phone?
[Bada Software and Hacking General] adfree:
Placeholder...
[Bada Software and Hacking General] ghoslslender124:
Leise du gutte Mensch! :D

Ok, I'm going. I write later and finish... our forum:]

Have a nice day
[Bada Software and Hacking General] adfree:
Step 1 seems solved. :cool: :angel:

Need only confirmation from other user(s).

Tools used...

WaveRemaker for De- and Encrypt...

WinHex...

Multiloader 5.67

Inside attached DBL is now I9001 DBL... you can compare from here:

http://xdaforums.com/showpost.php?p=52022633&postcount=87

At your own risk!

You need all Bootfiles from XXKJC for instance:

appsboot.mbn
dbl.bin---->[B]replace[/B] with attached file
osbl.bin
partition.bin

At your own risk!

This is only evidence, that we have chance to use "own" Code for DBL Bootloader... or "we" could patch DBL...

This means NOT Android Porting is ready/finsished nor started.

Best Regards
[Bada Software and Hacking General] ghoslslender124:
I sell my LG L5 and buy Wave 3. You are awesome.

But.. ok. We have boot.. We have progress. Next: kernel and rom?
[Bada Software and Hacking General] adfree:
Ehm.

We have 1 hint, where 1 Security hole could be.

DBL is not very important to boot Kernel...

DBL->OSBL->appsboot aka eMMCboot

Please, try to learn about Qualcomm Boot chain...

There are more then 1 Bootloader, every f. Loader checks Security of next Boot etc...

Try to see this, as EXAMPLE:

http://xdaforums.com/showpost.php?p=51233276&postcount=5

Now [MENTION=1767826]Rebellos[/MENTION] for instance could give some usefull hint...

Maybe their are allready existing DBL stuff... something like uboot...

Best Regards
[Bada Software and Hacking General] adfree:
Few tests later...

osbl.bin write this in Header to prevent start, if Security blabla...

BINARY AUTHENTICATION FAILED

Hmmm... 512 Byte long...

Hmmm... but the other Bytes are correct written from oleg_k EMMCBOOT...

Hmmm...

Idea, if I can replace in osbl this 512 Byte Block... maybe this would run...

Maybe...

Will check.

Best Regards
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=1030585]adfree[/MENTION]

so you are starting from scratch again? ;)
[Bada Software and Hacking General] ghoslslender124:
^up

Have you eyes? Yoo flash it on you own risk. Try, but you need all XXKJC bootfiles

Compiled LK Boot: www41.zippyshare.com/v/10140580/file.html
[Bada Software and Hacking General] Galaxy3HELL:
lol man i was just asking.
[Bada Software and Hacking General] ghoslslender124:
Maybe useful:

http://www.howardforums.com/printthread.php?t=1766709&pp=30&page=8&styleid=46

http://tjworld.net/raw-attachment/wiki/Android/HTC/Vision/RadioAnalysis/radio.source-files.txt (file)

http://days.cubictime.com/newpapers/OSBL/preview.htm (need google translate ,a lot of info)

http://xdaforums.com/showthread.php?t=1587650&page=78

http://xdaforums.com/showthread.php?t=1112236
[Bada Software and Hacking General] adfree:
New idea...

Maybe I can change start address for appsboot/emmcboot in osbl...

Little Endian... reverse order...

00005004

I can find 4 x in osbl from XXKJC...

This idea is based on this knowledge...

http://xdaforums.com/showpost.php?p=52429309&postcount=214

Problem here...

XXKI5 not write appsboot... text string not inside osbl:

BINARY AUTHENTICATION FAILED

XXKI9 not write appsboot... text string not inside osbl:

BINARY AUTHENTICATION FAILED

XXKJC not possible to replace whole 512 Byte "stamp"...

Maybe little chance to modify start of appsboot from:

0x04500[B]200[/B]
instead
0x04500000

To bypass first 512 Byte overwritten Bytes from OSBL...

Best Regards
[Bada Software and Hacking General] Galaxy3HELL:
anything new? :)