yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
ALL I9001 Software/Firmware on my S8600... unmodified.

NO external/removable SD inside.

Limitation is. I9001 is BIGger then S8600 eMMC...

Only I8150 have same size... like S8600. But here are other problems...

Please...

Ich will NICHT chatten. Das geht mir auf den Keks...

Ich kriege eh nur Brocken serviert... bezweifle das das im Chat besser wird...

My native language is German...

Yours seems French...

To many things lost in Translation... this SU x x x x x...

NO chat with me.

I got never an usefull answer about your uploaded zImage...

And what is this?

http://xdaforums.com/showpost.php?p=54279946&postcount=557

:confused: :confused:

Please, if you attach or upload something, maybe please more additional infos please.

Same for oleg_k...

No additional infos... nearly no description, no answers, no support...

Zero help...

Btw, this is NOT my fault...

S8600 is f. cheap old test device...

f. 50 $ or less available...

Everone could choose if S8600 is worth enough...

For me it is simple play, study... about Bootloader, JTAG stuff, Qualcomm etc...

Because DBL, OSBL, AMSS is not obsolete stuff...

Best Regards

Edit 1.

recovery.img needs also AMSS to start...

Short tested by nuke 0x200 at 0x0780 0000...

Maybe Bootloader OSBL or EMMCBOOT check for valid ELF Header...

Will try with empty AMMS, but with few Bytes Header...
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

Maybe you can try to boot with Tigrouzen (Wrong?) zImage? If chip start, you can see ANYTHING on screen. Maybe on this zImage you can see more or do not have restart so fast?
[Bada Software and Hacking General] Tigrouzen:
I don't push initramfs under my kernel but if you want i can make one without modem init also
[Bada Software and Hacking General] ghoslslender124:
[MENTION=640363]Tigrouzen[/MENTION]

Is modem neceserry to BOOT android?
[Bada Software and Hacking General] Tigrouzen:
Yes for phone but for boot Android you can without
[Bada Software and Hacking General] ghoslslender124:
So, on your zImage we CAN try BOOT without Modem, like in first kernel build for S8500. Modem is not necessery.

[MENTION=1030585]adfree[/MENTION]

Try to tests?
[Bada Software and Hacking General] Tigrouzen:
http://www.4shared.com/file/rYk2cV6Mce/recovery.html
[Bada Software and Hacking General] ghoslslender124:
[MENTION=640363]Tigrouzen[/MENTION]

What is this? In your link?
[Bada Software and Hacking General] black0000:
its tigrouzen kernal without modem for 8600
[Bada Software and Hacking General] adfree:
MD5 for recovery.img:

http://www.4shared.com/file/rYk2cV6Mce/recovery.html

A074D892E9703C3D947F15412C404DD7

Tested.

Written with JTAG to address 0x0900 0000 in 4 GB eMMC (internal memory).

Length 0x0047 3000

I9001 EMMCBOOT is executed... because I can see Samsung Logo...

Then black Screen for few Seconds then Restart... Samsung Logo...

No ADB nor other Driver detected...

No Halt via JTAG possible...

I am at home now... ready to make some tests.

Best Regards

Edit 1...

Tested with SGH-I847 AMSS... seems I have few seconds more...

SMSM: Modem SMSM state changed to SMSM_RESET.

MSM is Mobile Station Modem

S means maybe Security...

http://www.qualcomm.com/solutions/multimedia/security

Maybe f. IMEI...

Will check the Unlocker infos again... about partition cleaning...

Later I will add ADB Logs...

Now I8150 AMSS...

Then S8600, then Huawei etc...
[Bada Software and Hacking General] adfree:
It seems I was able to find right incredients + procedure to boot I9001 Firmware on my S8600. :angel: :victory:

With AMMS from SGH-I847 it is """""""""""""stable""""""""" no reboot... yet...

Not tested hours... but minutes.

NOT working:

Keys... accept Volume - and Power as Middle key...

Touch not work...

Bad and dangerous...

S8600 very hot...

I mean heat...

AT+HIDSWVER? +HIDSWVER: I9001XXKQM/I9001XXXKQM//I9001XXKQM
OK

AT+CGMM
GT-I9001
OK

AT Commands work...

But I can not leave Info window in russian language...

Now I need something... to navigate...

Later more, I will go now to my beloved bed...

Best Regards
[Bada Software and Hacking General] Galaxy3HELL:
wait, i dont know did i understand, but did you just get s8600 in download mode and flashed it, did you boot android and its not rebooting?
[Bada Software and Hacking General] hero355:
I'm just contracted for Wave 3, waiting for you to get some stable android, then I'll buy one :angel::laugh:

Keep up works :victory::good:
[Bada Software and Hacking General] adfree:
AT+CGMR I847UCLA4

OK

This could be the AMSS Version...

Russian info window looks like battery temperature warning...

So this could be reason why my S8600 will be very hot...

Now I need something like this, to press OK Button without working Touch... :rolleyes:

http://xdaforums.com/showpost.php?p=33361660&postcount=18

For ADB I saw something like this...

https://developer.tizen.org/forums/sdk-ide/sdb-shell-input-tap-or-touch-screen-command.

adb shell input tap x y

But at this state ADB is not active yet... :rolleyes:

Modem + Diag Port is visible... = 2 COM Ports

Best Regards

Edit 1.

Meanwhile I will try to identify "useless" Pics in EMMCBOOT...

http://xdaforums.com/showpost.php?p=54336118&postcount=35

Huawei EMMCBOOT was 70 KB...

oleg_k LK is less 200 KB...

If I can find all Pics, then maybe easier to ""reverse"" something...
[Bada Software and Hacking General] csj0530:
Can you explain...

1. Where JTAG.zip is used?

2. What files are contained on zip(rar)?

3. Is there information/evidence that I can classify whether is for S8600 or others?​

Thank You. For All.
[Bada Software and Hacking General] adfree:
Sorry, I have NO idea what in this ZIP file... We only know, if we have this file.

I hope something similar like ELF files found from S8500...

If someone has this S8600_JTAG_120125.zip, he could answer...

I have also requested these files on this forum:

http://forum.gsmhosting.com/vbb/f818/searching-these-files-documents-1742258/

Soon is Christmas... maybe someone is willing to help... :angel:

Best Regards
[Bada Software and Hacking General] adfree:
1.

Still need this file...

S8600_JTAG_120125.zip

Please. :angel:

2.

If I can make correct cable for S8500...

http://xdaforums.com/showthread.php?t=919569

Then maybe later I can test it with S8600...

But maybe someone is faster and/or smarter and has allready log of UART output on S8600...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Taxidriver05:
Maybe useful...

http://www.gsmnew.net/index.php?dir...UMP/New Dump/Samsung_Fullflash/Samsung S8600/

Download file and watch for content...
[Bada Software and Hacking General] adfree:
Ja danke. Das ist ein Dump via JTAG... RIFF Box...

Irgendwo hab ich auch noch einen 4GB großen... das ist weniger hilfreich.

Wir bräuchten die ELF Dateien, oder ähnliches...

Das was wir bei S8500/S8530 zu Hauf haben... im BOOTFILES Ordner.

Dann käme man eventuell ein Stück weiter...

MfG
[Bada Software and Hacking General] csj0530:
Small Post

I'm curious is S8600_JTAG_120125.zip or .rar exists on Free, Public Web or

Internet

I cannot find files using file search engines, even if I make options to search related search results,

of course no exact named files
[Bada Software and Hacking General] Taxidriver05:
Nope...!

Only paid file download... :(
[Bada Software and Hacking General] adfree:
Extension rar is my fault... :o

Only see S8600_JTAG_120125.zip...

And only found on pay sites... BUT this means not. This content is nowhere else...

Internet is big... maybe chance to find under different names...

I have this content not... :crying:

Best Regards
[Bada Software and Hacking General] adfree:
After months...

http://xdaforums.com/showpost.php?p=49269189&postcount=15

Maybe with knowledge of I9001 usefull to play with JTAG...

http://opensource.samsung.com/

You can find:

[B]GT-I9001_OpenSource.tar.gz[/B]
[B]GT-I9001_CHN_OpenSource_HKTW.tar[/B]

Best Regards
[Bada Software and Hacking General] kktkaran:
Hell samsung , whats the use of putting S8600 in open source code list ? s8530 and s8500 both arenot on list .
[Bada Software and Hacking General] Taxidriver05:
Do not know, if still known...

http://www.multiupload.nl/MTO1KVUXYC

Not sure, what this file is for...
[Bada Software and Hacking General] mirhl:
already been reported

useless
[Bada Software and Hacking General] Taxidriver05:
Okay...

Sorry...!

I obviously lost overview...
[Bada Software and Hacking General] hero355:
This is for Tizen I guess :laugh:
[Bada Software and Hacking General] Taxidriver05:
Sure?

Compared to Tizen source?
[Bada Software and Hacking General] adfree:
http://www.4shared.com/zip/dplzM-EPba/S8600_JTAG_120125_By_AnycallMo.html

Big thanx to anycallmongolia. :good:

Best Regards
[Bada Software and Hacking General] adfree:
GT-I9001_OpenSource.tar.gz

GT-I9001_CHN_OpenSource_HKTW.tar

130 MB + 400 KB...

Kernel inside for I9001...

Maybe usefull for study...

Best Regards
[Bada Software and Hacking General] adfree:
Maybe little progress...

Now I have learned little bit more about UART and few USB Commands... :angel:

And as I've played before with S8600 Platform Downloader, chance is not too low...

Maybe now more luck with S8600 Boot output...

My progress with S8500...

http://xdaforums.com/showpost.php?p=49690168&postcount=36

Later I will try to catch output with S8600...

Need some time...

Best Regards

Edit 1.

Yes, it is possible to use normal USB cable, send few Commands to S8600 and catch some output...
[Bada Software and Hacking General] adfree:
SAMSUNG_GTS8600_FullFlash.bin.img

Dumps via JTAG can be opend via WinHex...

First 512 Byte are MBR...

Really funny... my new knowledge about MBR is not outdated... :o

I9300 for instance also used MBR for repair SD Card... + sboot.bin

I would laugh, it S8600 can be forced to start from external SD Card, instead eMCC...

QHSUSB_DLOAD...

Best Regards
[Bada Software and Hacking General] Taxidriver05:
As far as I understand, in theory badaDROID for GT-S8600 is not completely obsolete?
[Bada Software and Hacking General] adfree:
About Hardware keys...

Under bada Firmware key event logged with WinComm ...S8600

Volume +
CAppSndKey::IsMutedKeytone: iKeyType (42) cause by AUI

Volume -
CAppSndKey::IsMutedKeytone: iKeyType (43) cause by AUI

Power/Lock key long pressed...
OemKeyLongPressInd : EV_KEY_LONGPRESSED event(Power Off UI Concept)

Home
CAppSndKey::IsMutedKeytone: iKeyType (37) cause by AUI

:confused:

Hmm...

Volume down S8600 = key 114
Power from S8600 = key 107

http://xdaforums.com/showpost.php?p=54289469&postcount=559

Hmmmmmmm, maybe in oleg_k sources proper keys visible... or...

And if... is it possible to patch boot.img ...zImage from I9001 to fit proper keys?

Maybe someone could please check oleg_k sources... from LK and S8600 kernel...

Thanx in advance.

Best Regards

Edit 1...

LK BOOT_S8600-master/dev/keys/gpio_keys.c/*

* Copyright (c) 2012, Shantanu Gupta <shans95g@gmail.com>
*
* Based on google's gpio keypad driver, Adds support for
* keys which are directly mapped to gpio pin.
*
* TODO:
*
* BUGS:
*	If board changes pdata->gpio_keys after init, strange stuff can happen
*	This can be fixed by making a local copy of pdata, but no board
*	would do that anyway or using const modifier.

[B]#define GPIO_KEY_HOME	180	//MSM_GPIO(180)
#define PMIC_KEY_VOLUMEUP	0	//PMIC_GPIO(1)
#define PMIC_KEY_VOLUMEDOWN	1	//PMIC_GPIO(2)
[/B]
#define GPIO_MSM	0
#define GPIO_PMIC	1

static int some_key_pressed;
static unsigned long gpio_keys_bitmap;

static struct timer gpio_keys_poll;
static struct gpio_keys_pdata *pdata;
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=640363]Tigrouzen[/MENTION] i know you already done a lot and helped [MENTION=1030585]adfree[/MENTION] but could you chech this and correct zlmage from i9001 with s8600 hardware buttons to navigate? :)

[MENTION=1030585]adfree[/MENTION] please post your i9001 boot.img that needs to be patched and somebody will fix that buttons navigation.

could you post screenshoots of s8600 so we can see where did you stuck right now?

Greetings :eek:
[Bada Software and Hacking General] adfree:
You can every I9001 boot.img use, you want... custom or Samsung stuff...

Touch is complete not working, so Hardware keys is not really mainproblem...

Russian language I can maybe deselect by changing Product Code SER from I9001 JTAG dump...

Attached is Booting...

Samsung Logo is replaced by own Pic in EMMCBOOT.MBN...

Best Regards
[Bada Software and Hacking General] mailrok:
The fact that you have shown in the video, there is generally Ukrainian)
[Bada Software and Hacking General] Galaxy3HELL:
so what we need drivers for s8600 LCD?

can you boot to ClockWorkMod recovery?
[Bada Software and Hacking General] BenzoX:
Adding key driver should be something similar to this, it need knowledge about GPIO (and it need GPIO to be correct to start with)

Adding touchscreen driver would need to change things in the same file (touchscreen calibration is around line 2041 in this file, but before calibration you need a functionnal touchscreen.)

This file is probably the equivalent of our mach-wave.c and this is where some drivers are implemented, you can see GPIO init at the beginning and key definition around line 700.

Touchscreen around line 3350

Also saw Bluetooth, cam, touchkeys...

Maybe some devs know enough in hardware/software interaction to create proper key/touchscreen drivers. Bu i think it need a wave 3, lot of knowledge and lot of time...

Maybe best is to start from cm sources for i9001, or any "working" android version (BTW adfree, what is your android version ? Since it's working it may be best bases to start with... Or maybe test another android version such as CM11, CM10, AOSP... for i9001... see if differences in boot. But it's slow procedure : install it on i9001 then dump on wave 3, hard if you have no "functionnal" i9001)
[Bada Software and Hacking General] adfree:
oleg_k LK/EMMCBOOT.MBN can detect if keys are pressed...

Volume +
Volume -
Home

We should check sources from him...

Btw...

This Picture seems Pinguin Tux from Linux in oleg_k LK...

Later more...

Need compare I9001 and I8150 about hardware keys...

About GPIO maybe Qualcomm QXDM stuff helpfull...

Logging S8600 in ""QC Mode""...

Best Regards

Edit 1.

1 idea is to compare I9001 and I8150 with this file:

\system\usr\keylayout\[B]qwerty.kl[/B]

http://chris.boyle.name/blog/2010/08/android-keymaps/

http://xdaforums.com/showthread.php?t=1007867

http://xdaforums.com/showthread.php?t=1650615&page=44

Edit 2.

This could be from I9001...

https://github.com/skywalker01/android_device_samsung_ariesve/blob/master/qwerty.kl

key 399 GRAVE
key 2 1
key 3 2
key 4 3
key 5 4
key 6 5
key 7 6
key 8 7
key 9 8
key 10 9
key 11 0
key 1 BACK WAKE_DROPPED
key 158 BACK WAKE_DROPPED
key 230 SOFT_RIGHT WAKE
key 60 SOFT_RIGHT WAKE
key 107 ENDCALL WAKE_DROPPED
key 62 ENDCALL WAKE_DROPPED
key 229 MENU WAKE_DROPPED
key 139 MENU WAKE_DROPPED
key 59 MENU WAKE_DROPPED
key 127 SEARCH WAKE_DROPPED
key 217 SEARCH WAKE_DROPPED
key 228 POUND
key 227 STAR
key 231 CALL WAKE_DROPPED
key 61 CALL WAKE_DROPPED
key 232 DPAD_CENTER WAKE_DROPPED
key 108 DPAD_DOWN WAKE_DROPPED
key 103 DPAD_UP WAKE_DROPPED
key 102 HOME WAKE
key 105 DPAD_LEFT WAKE_DROPPED
key 106 DPAD_RIGHT WAKE_DROPPED
key 115 VOLUME_UP WAKE
key 114 VOLUME_DOWN WAKE
key 116 POWER WAKE
key 212 CAMERA

key 16 Q
key 17 W
key 18 E
key 19 R
key 20 T
key 21 Y
key 22 U
key 23 I
key 24 O
key 25 P
key 26 LEFT_BRACKET
key 27 RIGHT_BRACKET
key 43 BACKSLASH

key 30 A
key 31 S
key 32 D
key 33 F
key 34 G
key 35 H
key 36 J
key 37 K
key 38 L
key 39 SEMICOLON
key 40 APOSTROPHE
key 14 DEL

key 44 Z
key 45 X
key 46 C
key 47 V
key 48 B
key 49 N
key 50 M
key 51 COMMA
key 52 PERIOD
key 53 SLASH
key 28 ENTER

key 56 ALT_LEFT
key 100 ALT_RIGHT
key 42 SHIFT_LEFT
key 54 SHIFT_RIGHT
key 15 TAB
key 57 SPACE
key 150 EXPLORER
key 155 ENVELOPE

key 12 MINUS
key 13 EQUALS
key 215 AT

https://github.com/skywalker01

Has also I8150 stuff, but I can't see qwerty.kl...
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?t=899023

Meanwhile I am trying to set my S8600 to Qualcomm mode...

To check something... about GPIO...

Key events in QXDM or similar Qualcomm Tools...

About Picture in oleg_k LK...

If you load whole EMMCBOOT.MBN with irfanview... you can see something...

RAW Pic from Pinguin inside...

Please is someone able to identify these 2 Pics in oleg_k sources of LK?

Resolution seems near 170 Pixel x ...

If LK on S8600, then "ugly square" visible...

But here should be Pinguin correctly displayed...

Best Regards
[Bada Software and Hacking General] BenzoX:
There is an picture here, coded in RGB565 (haven't tried to diplay it), 480*86 Pixel

Haven't found other (maybe not enough search)
[Bada Software and Hacking General] adfree:
Thanx for help.

:good:

The second splash.h shows this...

#ifndef __PLATFORM_SPLASH_H
#define __PLATFORM_SPLASH_H

#define SPLASH_IMAGE_WIDTH 124
#define SPLASH_IMAGE_HEIGHT 113

Will try to make Binary and check real Resolution...

Best Regards

Edit 1.

/* This image is [B]228x113[/B] raw Image resembling QuIC logo*/

static char imageBuffer_rgb888[]

:confused:

Don't ask me why or how...

Edit 2.

So more then 2 Pics inside... as it seems...

LK_BOOT_S8600-master\dev\fbcon\include\splash.h
LK_BOOT_S8600-master\platform\msm_shared\include\splash.h

For now I can see only 2 Pinguins... 1 with colors... 1 in gray...

This looks interesting...

// Image of buttons at the bottom of the screen for working ts driver
// Dimensions X * Y: 480 * 86
// ([0,0] is left bottom corner of the screen for the following numbers)
//	[HOME]	[UP]	[SELECT]	[DOWN]	[BACK]
// x:	0	-	90	90	-	180	180	-	300	300	-	390	390	-	480
// y:	0	-	86	0	-	86	0	-	86	0	-	86	0	-	86
[Bada Software and Hacking General] BenzoX:
You need to write whole system partition, it should be something like 500MB, less if you use Gingerbread, and also a bit of /data (100 MB should be enough) to allow the phone to boot.

Minimal dump size should be something like system size+150 MB (it also need all little partition at the beginning)

To control phone, maybe interesting thing here http://www.howtogeek.com/howto/42491/how-to-remote-view-and-control-your-android-phone/
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

Its only idea.

Maybe first port I9001 display driver - make it WORKING

than atach it into soft

Than flash firmware?
[Bada Software and Hacking General] adfree:
Not sure if we mean same...

1.

For S8500 and S8530 to reach Download Mode on empty/blank handset to use with ODIN or Multiloader I need only SBL or BL3... with CMM Script:

http://xdaforums.com/showpost.php?p=43732228&postcount=116

I can use ELF files or Binary... 1 MB - 5 MB...

Easy, because Hardware keys working and I need only few Seconds to reach Download Mode...

2.

I can erase easily memory (512 MB OneNand) on S8500... and Bootloader make selfinit... with all Security crap like IMEI etc...

3.

F%&/ I9001/I8150 is full of Security checks... nothing is easy...

You need more then 5 MB for Booting and enter Download Mode...

Not possible to clear memory under 5 hours... :rolleyes:

S8500 need only few Seconds.

You need proper MBR + partition + DBL + OSBL + EMMCBOOT + AMSS + something more...

Otherwise NO Download mode possible... maximum Samsung Logo is visible from EMMCBOOT...

4.

Floating around I9001 JTAG dumps in Internet are:

7 GB---->FULL/MAXimum with all partitions inside = 21

2 GB---->16 partitions from 21 inside

I have reduced working dump to 0x32C0 0000... "800 MB"

15 partitions inside... partition 16 is visible, but...

So next analyze could be, what is inside in all these 15 partitions and could they be empty or they are mandatory...

5.

[B]1--->[/B]
[B]2--->DBL
3--->OSBL
4--->EMMCBOOT
5--->AMSS[/B]
6--->empty ??
[B]7--->boot.img[/B]
8--->??
9--->?? something Security related...
10-->?? something Security related...
11-->?? Ext3 filesystem...
12-->recovery.img
13-->Sales Code/Production Code inside... SER
14-->?? Ext3 filesystem...
15-->?? Ext3 filesystem...

Will test 1 day, if the 3 Ext3 partitions could be empty... or mandatory data must inside to start Download Mode...

Partitions 9 and 10 could be empty, if I remember correct... not mandatory data inside...

Who should do this?

At they moment "we" could play with existing stuff... to bypass missing kernel support...

Btw.

Someone could capture GPIO logging... to find out key events... on S8600:

http://xdaforums.com/showpost.php?p=54441445&postcount=54

I will test next days my second S8600, maybe here it is working...

About Remote Control for Android...

http://xdaforums.com/showpost.php?p=54449419&postcount=592

Thanx for Link...

Will try...

Best Regards
[Bada Software and Hacking General] BenzoX:
Android Screencast wasn't working on my Nexus 4, dunno if it work with your s8600

But you can use :

adb shell

input tap x y

input swype x1 y1 x2 y2

input keyevent z

you should be able to navigate (with some difficulty) in phone with that.

[MENTION=5833757]ghoslslender124[/MENTION] port drivers isn't the main priority right now, we need first to get out of JTAG...

Then people and dev without jtag will be able to build and test, because for now only adfree can work...

But for that it need LK to work
[Bada Software and Hacking General] adfree:
XXKP4...

SMD_CSC_GT-I9001-MULTI-CSC-OXAKP2_EMMC.smd

SMD_MODEM_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC.smd

SMD_PDA_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC.smd

Download Start...
<0> Create File...
<1> StartThread Detected : 1
<2> StartThread Detected : 0
<3> StartThread Detected : 0
<4> StartThread Detected : 0
<5> StartThread Detected : 0
<6> StartThread Detected : 0
<7> StartThread Detected : 0
<8> StartThread Detected : 0
<1> setup connection...
<1> odin mode.. check plcatform verification.
<1> VerifyPlatform:V0, P0,R0
<1> START!!!
<1> SMD Download mode...
<1> SMD Download mode...
<1> SMD Download mode...
<1> set download environment.
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> big partition size!!
<1> partition.bin download..
<1> 1/11 Finished.
<1> dbl.mbn download..
<1> 2/11 Finished.
<1> osbl.mbn download..
<1> 3/11 Finished.
<1> amss.mbn download..
<1> 4/11 Finished.
<1> EMMCBOOT.MBN download..
<1> 5/11 Finished.
<1> adsp.mbn download..
<1> 6/11 Finished.
<1> boot.img download..
<1> 7/11 Finished.
<1> system.ext4 download..
<1> 8/11 Finished.
<1> cache.ext4 download..
<1> 9/11 Finished.
<1> recovery.img download..
<1> 10/11 Finished.
<1> persist.ext4 download..
<1> 11/11 Finished.
<1> reset pda..
<0> Started Timer
<1> Close serial port and wait until rebooting.

Same result like with XXKF8...

AT+HIDSWVER? +HIDSWVER: I9001XXKP4/I9001OXAKP2//I9001XXKP4
OK

I will download few Custom Firmware for I9001... rooted...

Maybe then more luck with ADB...

Short results...

adb shell
~ # su
su
/sbin/sh: su: not found
~ # ACTION_DOWN
ACTION_DOWN
/sbin/sh: ACTION_DOWN: not found
~ # input ACTION_DOWN
input ACTION_DOWN
/sbin/sh: input: not found
~ #
adb shell
~ # input keyevent ACTION_DOWN
input keyevent ACTION_DOWN
/sbin/sh: input: not found
~ # input keyevent z
input keyevent z
/sbin/sh: input: not found
~ # input tap 100 100
input tap 100 100
/sbin/sh: input: not found
~ #
adb root
adbd is already running as root

2 Screenshots taken via ADB... looks not right color...

Best Regards
[Bada Software and Hacking General] BenzoX:
Sorry, syntax is "input keyevent x" with x some value between 0 and a something like 256.

But key code depend of each phone, I don't know what it is on i9001
[Bada Software and Hacking General] Tigrouzen:
For color under recovery mode it is just need adapt RGB on source. file graphics.c

https://github.com/CyanogenMod/android_bootable_recovery-cm/blob/cm-11.0/minui/graphics.c