[Bada Software and Hacking General] adfree:
Summary for now...

QPST Log

StartSB2Download
Begin SB2.0 Software Download
Skip Reset: 0
Lock phone
Examine phone mode
Get partition file name
Partition file (and path for flash programmer): C:\S8600_QPSTv3\MODIFIEDpartition.mbn
Flash Programmer file:
Examine phone mode
Mobile not in download mode!
SynchronizeConnection starting...
Sending Hello to flash programmer...
Disabling automatic polling.
Try Hello with polling disabled...
Try Hello with polling disabled...
Try Hello with polling disabled...
SynchronizeConnection succeeded.
Sending Hello Packet
Version info = 3 2
Block size = 400
Flash base = 0
Device Name=eMMC:
Flash ID size= 4
Sectors = 128
Feature mask = 0x09
Sending Close 0
Log: Cannot close when not previously opened
ARMPRG error: 15, text: Cannot close when not previously opened
CloseDownloader error
Sending Security Mode 1
Decoding partition file
Sending partition file
Sending Partition Table
DBL image: C:\S8600_QPSTv3\16ByteEXAMPLE_DBL.mbn
Opening DBL file
Sending MI Open mode 15 size 0
Sending DBL file
Start download 16 bytes
Writing address 0x00000000 size 0x10 device 0
Reply address 0x00000000 size 0x10
Updating Progress Bar: Size: 16	Bytes Written 16	Bytes Total 16 PercentCompleted: 100
Sent 16 Acknowledged 16
SetEvent download complete 2335
Sending Close 0
CloseDownloader response
Sending Reset Packet
Download end, status 0, error 0
Exit SB 2.0 download with status 0x00000000

DBL.MBN I have cut to 16 Byte for better USB sniffing...

Portmon Log... short Version after partition is sent...

623	0.00000754	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
624	0.00735457	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length5:7E16CF857E
625	0.00000363	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
626	0.00000307	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
627	0.00018997	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length6:7E1B0F89867E
628	0.00000307	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
629	0.00669303	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length5:7E0C143A7E
630	0.00000307	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
631	0.00000307	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
632	0.00018997	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	[B]Length25:7E070000000054455354FFFFFFFFFFFFFFFF54455354383F7E[/B]
633	0.00000391	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
634	0.49975290	???	IRP_MJ_READ	QCUSB_COM5_1	TIMEOUT	Length0:
635	0.00000335	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
636	0.00000279	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
637	0.00014276	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length5:7E1554B77E
638	0.00000363	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
639	0.49983587	???	IRP_MJ_READ	QCUSB_COM5_1	TIMEOUT	Length0:
640	0.00000335	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
641	0.00000279	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
642	0.00011510	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length5:7E0BAB4E7E
643	0.00000363	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
644	0.49944141	???	IRP_MJ_READ	QCUSB_COM5_1	TIMEOUT	Length0:
645	0.00001145	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
646	0.00000810	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS

Later I will try...

Send partition via RevSkills... to restore MBR 512 Byte...

This is working allready... :cool:

To restore DBL... I need "only" first few Bytes... 16 Byte is enough to fix it...

Check my example in dbl_DE_v1.bin in package DANGER_DBLkill4Androidv1.rar

http://xdaforums.com/showpost.php?p=52672854&postcount=270

You can see, first few Bytes are overwritten... to make DBL invalid...

Maybe tomorrow I have all Commands to make it with RevSkills...

Best Regards