yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

You are my god. I sell my Multipla and buy Wave 3.

Hm, we have LK Bootloader, can you ,,extract" THAT Boot.img from this Dump?
[Bada Software and Hacking General] oleg_k:
Hi, guys

How Can I Help...?
[Bada Software and Hacking General] BenzoX:
Wow, that's more than impressive adfree !

Congrats !

That mean that we have an already "functionning" android kernel booted whithout LK (by default bootloader ? ) ?

Maybe possible to boot to recovery in this case, see if it reboot like in rom or not.

All these dump thing i don't understand, have you replaced all memory on wave 3 by 9001 one, or some is conserved (bootloader...) ?

I only have knowledge on wave 1&2, where /boot and /recovery are non existant (recovery is inside kernel), so once kernel is booted, we can do nearly anything we want easily, format nand and install rom as we want and this kind of thing.

I think LK bootloader allow this, and i hope it allow loading kernel from everywhere (as Fota do on wave 2), i'm not sure the default one can...

Hi Oleg, glad to see you.

I wasn't able to compile your LK sources with "bootable" result... Maybe wrong toolchain, but with the instruction you gave on page 1 i build a file adfree couldn't successfully boot. Yours succeeded.

Also, kernel sources returned many errors, maybe again wrong toolchain...
[Bada Software and Hacking General] ghoslslender124:
[MENTION=270883]oleg_k[/MENTION]

Welcome Back my friend :)

Now we have team.

Give me correctly zImage and 10 min and i give you working kernel

[MENTION=5540748]BenzoX[/MENTION]

He replace FULL Bootloader and Kernel from I9001 with JTAG.

No bada boot.
[Bada Software and Hacking General] oleg_k:
For compiling kernel need use arm-none-linux-gnueabi, arm gcc4.4.3,

Sourcery G++ Lite 2010q1-188

http://www.mentor.com/embedded-software/sourcery-tools/sourcery-codebench/editions/lite-edition/

For compiling LK_bootloader need use arm-none-gnueabi

[MENTION=1030585]adfree[/MENTION]

UART in i9001 and S8600 is different (UART2 and UART3), see schematic for devices.
[Bada Software and Hacking General] ghoslslender124:
[MENTION=5540748]BenzoX[/MENTION]

Maybe u can compile it? When i format and install ubuntu i download all needed files
[Bada Software and Hacking General] Galaxy3HELL:
Nice to see you here [MENTION=270883]oleg_k[/MENTION]

Hope you will help these guys to finish port in 2014.
[Bada Software and Hacking General] adfree:
[MENTION=270883]oleg_k[/MENTION]

Thank you very much, to post here.

:good:

Request...

Please. :angel:

1.

I need these file please.

I8150_Manual_JTAG_PROGRAM.zip
I9001_Manual.zip

Links are here:

http://xdaforums.com/showpost.php?p=52583740&postcount=32

We have allready from S8600 JTAG related files... few...

http://xdaforums.com/showpost.php?p=49269189&postcount=15

2.

I have heavy problems with OSBL, APPSBOOT/EMMCBOOT from I9001...

Also not easy with I9001 PCB... :eek:

If I kill EMMCBOOT at address 0x0700 0000 then 2 Ports installed on S8600...

Here you can see my I9001 with RIFF:

http://xdaforums.com/showpost.php?p=53916613&postcount=438

3.

UART output I can see on my I9001 and on I8150:

http://xdaforums.com/showpost.php?p=53916613&postcount=438

How to solder UART direct, instead USB port?

Thanx in advance.

Best Regards
[Bada Software and Hacking General] adfree:
Short tests with Hardware keys...

Volume +

Volume -

Middle

No UART output...

No Download Mode nor any other mode...

So keys seems different mapped... in I9001 and S8600

-------------------------

Maybe Touch not working... but time is too short before restart...

-------------------------

Android kernel is 2 times in I9001... but they are different...

boot.img
recovery.img

I have written recovery.img to address 0x0900 0000 where normally boot.img is...

I can see:

Samsung Logo
Galaxy Logo--->at this point I can see [B]ADB[/B] + ? second unfinished stuff
Box Android Picture
Restart

Will try to catch moment where ADB is visible and send Command:

adb reboot-bootloader

Later more... and also I will upload my dump from I9001...

Something is different...

Best Regards
[Bada Software and Hacking General] adfree:
This is my "magic" dump... from my I9001

No idea yet, what different...

This is from 0 - 0x0900 0000 before boot.img

I have combined with 2 GB dump:

Samsung_GTI9001_2GB.rar

Later I will try to insert into 4 GB...

Maybe then more start or longer... :D

For now I have insert different Android kernel...

boot.img and recovery.img from I9001

I can see something... read prior posts...

boot.img from I8150 and I847 nothing visible on Screen... but Modem +ADB driver detected before restart...

All combinations seems too short time to work with ADB Command... :rolleyes:

Best Regards
[Bada Software and Hacking General] mirhl:
[MENTION=1030585]adfree[/MENTION]

Afaik no samsung phone ever supported "adb reboot bootloader" cause they all have download mode
[Bada Software and Hacking General] TStaudigl:
Welcome back [MENTION=270883]oleg_k[/MENTION]

Due to compile Problems with your kernel source, my idea was to use the latest android sources and to merge in your changes... what to you think about that?
[Bada Software and Hacking General] ghoslslender124:
[MENTION=5936306]TStaudigl[/MENTION]

look at first post on this page. Can you have a look? ;) Maybe with this toolchain we can compile it without errors
[Bada Software and Hacking General] TStaudigl:
Actually i'm discussing kernel compile stuff with Oleg on Facebook... More info to come soon
[Bada Software and Hacking General] adfree:
I am 100 % sure, because this was the solution on my F%$ I9001 PCB to get Download Mode with Software...

See this:

http://xdaforums.com/showpost.php?p=54038941&postcount=466

Please remember, if you play with security related things on I8150, I9001, S8600...

You have enough problems to fix this...

Writing whole EMMC or parts of internal memory means danger...

I9001, I8105 have more modes as S8600... I have seen minimum 4 different Driver constelation...

Remember boot.img

+

2. different recovery.img

For S8500 I know only 1 kernel aka zImage to manage Recovery too...

Also if you kill EMMCBOOT at address 0x0700 0000 I9001/S8600 do other things and install other driver...

http://xdaforums.com/showpost.php?p=54118474&postcount=485

If you search for VID... you will find ADB related threads...

Best Regards
[Bada Software and Hacking General] BenzoX:
Phone have probably no drivers keys with i9001 kernel...

Can computer see your device with "adb devices" during boot ?

If you are able to use adb, you can try command "adb reboot recovery".

Also, on another topic, why not using an IRC chat similar as badadroid one ? It's free, you can use it from browser or desktop or mobile, and it's facebook-phobic friendly :D
[Bada Software and Hacking General] adfree:
Hardware keys and Touchscreen could be different...

Hardware keys I am 95 % sure...

And for Touch 50 %, because too short time to test something before restart...

Restart is problem...

I have only few Seconds time... this seems too short to interact with ADB...

Driver is visible in device manager, but ADB command can't detect something... before restart...

Meanwhile I do more tests with dumps...

Maybe with luck more time... before restart or maybe ""stable"" boot possible...

Maybe someone could help me to understand, where "drivers"/settings located in boot.img...

Display
Touch
Keys

All in zImage ?

Or something also in RAMDISK ?

:confused:

Maybe we could try to mix something...

I can remember... I8350 Firmware/Bootloader allowed keys...

I mean I saw succcess with different Screens... So keys are working on S8600...

S8600 and I8350 have same hardwarekeys...

But this is Windows handset...

I8150 Display is black... keys not working...

But maybe Touch? :D

Later I will check custom I9001 kernels... maybe 1 is booting "fully" without restart...

I am old man... older as 16... :D

I hate every instant messenger or chat system...

If I want to talk to someone... for instance my mom...

I call her... :D

Posting posts in forum for instance XDA

:good: :good: :good: :good: :cool:

PM is okay... but hey, better more then 2 user can read something...

I don't need any other communication way...

Too lazy for this because I don't want share my IP nor if I am online or offline...

This is not what I want.

Summary:

XDA post and PMs:

YES please.

NO ICQ

NO Fbook

NO other annoying schnickschnack... which is not installed on my PC.

NO chatting... I need time to read and understand and to answer...

NO alternate stuff to XDA posts please...

My Email account is also ever full...

I hope it is clear now...

Thanx.

I need few hours for writing 4 GB via RIFF JTAG...

I can tell every result earliest after 6 hours... :rolleyes:

Best Regards
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=1030585]adfree[/MENTION]

Here you can find all kernels ( GB, ICS, JB ) and recovery ( including stock one ) for Galaxy i9001

http://xdaforums.com/wiki/Samsung_Galaxy_S_Plus/GT-I9001#Kernels

:highfive: :fingers-crossed:
[Bada Software and Hacking General] ghoslslender124:
From here i make my kernels with Tigrouzen zImage
[Bada Software and Hacking General] mirhl:
I remember some times I had adb started long before lockscreen

Did your flashed rom come with already enabled adb (in developer settings)?

And what time does it usually start on the original i9001?
[Bada Software and Hacking General] oleg_k:
hardware Keymaps is different i9001 and S8600,

also different console UART port - UART2 and UART3.

In my LK_bootloader console uart is working)

And also big different - memory model for i9001 and s8600

for i9001 need:

CONFIG_APPSBOOT_3M_CONFIG = y

CONFIG_PHYS_OFFSET=0x00400000

for s8600 need:

CONFIG_APPSBOOT_3M_CONFIG is not set

CONFIG_PHYS_OFFSET=0x00200000
[Bada Software and Hacking General] adfree:
[MENTION=270883]oleg_k[/MENTION]

Please describe procedure to use your Little Kernel (EMMCBOOT) from here:

http://xdaforums.com/showpost.php?p=37200735&postcount=7

What "we" found during endless attempts...

1.

Gunter33 found FASTBOOT Drivers and he realized that SD card boot I9001 boot.img from I9001 dump... if written to SD

How to use your LK Boot with FASTBOOT?

I can only display RAW Picture with

[B]fastboot boot[/B] boot.img

http://xdaforums.com/showpost.php?p=53532648&postcount=362

Maybe I am using wrong parameter or wrong FASTBOOT EXE...

Because here I can see address and parameter -b

2.

To use your EMMCBOOT LK... I have meanwhile 3 ways...

JTAG
QPST
easiest way modified apps_compressed.bin

3.

Please tell me exactly, how to use your LK to achieve nearly same result as here in your first post:

http://xdaforums.com/showpost.php?p=37157782&postcount=1

:confused:

You have used FASTBOOT or SD card or internal EMMC?

Maybe I made big mistakes...

:confused:

4.

My brain is small... I have not found UART stuff in schematics nor successfully logged something if your LK is active...

Please describe...

Wires soldered direct to PCB like I did with my S8500 ?

http://xdaforums.com/showpost.php?p=48826407&postcount=15

Thanx in advance...

My results for today...

After more then 20 hours writting with RIFF JTAG, found no better solution for now... :(

All tested combinations lead to "autoreboot"... restart... only few Seconds ADB port...

First analyzing of my working I9001 dump from here:

http://xdaforums.com/showpost.php?p=54152342&postcount=506

DBL, OSBL + EMMCBOOT is 1:1 from here:

http://xdaforums.com/showpost.php?p=52022633&postcount=87

Visible main difference...

Not working dump restart after SAMSUNG Logo... and 1 white Pixel is visible in upper left corner before Reboot...

If I remember correct... this is visible in my Videos...

Maybe this dump is working, because this after ODIN write edited DBL by me...

And maybe some funny Flag is set...

:confused:

Now I am back on my S8600 with S8600 Firmware...

Next attempt is to check my dump 0- 0x0900 0000 + added boot.img to write with QPST...

To check if 200 MB is enough to write into EMMC...

Best Regards
[Bada Software and Hacking General] adfree:
This I9001 dump looks interesting...

Also folder Fastboot inside...

:confused:

http://xdaforums.com/showpost.php?p=53992905&postcount=45

I need for tests other I9001 dump... maybe more luck...

[COLOR="Red"][B]i9001_Riff_unlocked_cm_JB 4.1.2 JZO54K ..bin[/B][/COLOR]

With this dump, restart is earlier...

This is custom Firmware... short tried with stock kernel, but same...

Reboot seems before Animation + Lockscreen visible...

[B]Samsung_GTI9001_2GB.rar[/B]

:good:

With this 2 GB dump I have at the moment best "result", mixed with my 0x0900 0000...

Now I am writing 256 MB for test if this start... because something is in MBR...

:confused: :confused:

I9001_user_16G_256M.bin

No idea what this is...

I9001.ext_csd

:confused:

Will report after 256 MB are written...

Is someone able to identify files in source code for:

Display
Touch
Keys

:confused:

I mean I am sure oleg_k LK is correct using Display + detect if HArdware keys are pressed...

So Source Code 1 is:

https://github.com/Oleg-k/LK_BOOT_S8600

No idea if all stuff is uptodate here...

Source Code 2:

https://github.com/Oleg-k/kernel_source_s8600

Source Code 3 and 4 is from I9001 and I8150... for instance from here:

http://opensource.samsung.com/reception.do

"We" know I9001 Display shows something on S8600... looks good.

Conclusion Driver nearly correct...

I8150 stuff shows nothing on S8600... so it should be visible difference, if someone would compare I8150 source with I9001 stuff...

Thanx in advance.

Best Regards

Edit 1.

Maybe here?

Key related stuff:

kernel_source_s8600 / drivers / input / keyboard
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

What give us Correctly zImage mixed with I9001 boot.img?

And it any way to write boot.img into memory Wiithout JTAG?
[Bada Software and Hacking General] BenzoX:
For now, whole Jtag is good for experimenting.

But final solution must be LK boot, which can boot boot.img from anywhere.

If we succeed to boot a kernel with LK, we'll be able to use any partition layout and any boot.img we want, it will be easy to build kernel from i9001 sources and flash rom (since it already boot) and adapt it to Wave 3 (this is less easy).

And if i understood, LK could be flashed and with multiloader, so not only Jtag users can work on it.

adfree :

About drivers, on badadroid screen driver were located in /drivers/video for each screen driver, with a main driver in /arch/arm/mach-s5pv210.

It have been moved to all files in mach-s5pv210 (where s5pv210 is the CPU)

You can briefly look at some commit in old badadroid project, to see wich files are modified here

Most of the low level stuff is handled by mach-wave.c, there should be a similar file in i9001 sources

Knowing what are the chipset in the wave 3 might be usefull, as it was for Badadroid project, like this

Look like some things are already well handled by stock i9001 kernel (screen is more or less working, nand memory also)
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=5540748]BenzoX[/MENTION]

We can flash Oleg_L LK with multiloader ( by flashing apps_compressed.bin ).

heres link for that: http://www.mediafire.com/download/2aypae40na9l23c/apps_EMMCv1.rar

We can boot kernel from SD Card ( this solution has find [MENTION=4619000]Gunter33[/MENTION] ) and i think we can flash it via fastboot ( [MENTION=4619000]Gunter33[/MENTION] finded corrected drivers for fastboot ) , but we need '' kernel thats setup to work with Wave 3 '' like Oleg_K.

Maybe we can correct i9001 to Oleg's config from his kernel, i dont know is it possible, but thats only options now.
[Bada Software and Hacking General] ghoslslender124:
[MENTION=5540748]BenzoX[/MENTION]

In prevoulsy post i write what Toolchain we need. Can you try compile Oleg source with THAT toolchain?
[Bada Software and Hacking General] Tigrouzen:
You need port driver on kernel, why i ask all about device chipset reference but nobody answer...

Touch chipset

LCD chipset

Nand chipset

Cpu chipset

PMIC chipset

BLuethoot

Wifi

Audio

Cam

GPU

If some one can open wave 3 and take all picture
[Bada Software and Hacking General] ghoslslender124:
[MENTION=640363]Tigrouzen[/MENTION]

What picture? Mainboard picture or what?
[Bada Software and Hacking General] Tigrouzen:
Yes like this : http://xdaforums.com/showthread.php?t=1156780

Or name of chipset only with reference.
[Bada Software and Hacking General] Galaxy3HELL:
[MENTION=1030585]adfree[/MENTION] can give you that picture, because he have broken s8600 soldered on jtag.

[MENTION=640363]Tigrouzen[/MENTION] would you help to make new kernel?
[Bada Software and Hacking General] BenzoX:
LK compiled with arm-none-gnueabi : herehttps://mega.co.nz/#!7gQg1TLa!v6nVLziYzzMyWhes4lX7F7k1b5c5mg54kPCt0SZ4ous (it's all the output folder)

Kernel compilation with arm-none-linux-gnueabi (from codesourcery lite arm 2010q1 202) return error : drivers/i2c/chips/yda165.c:1593: error: unknown field 'ioctl' specified in initializer

I don't understand, why not using a stock i9001 kernel just to make sure LK start the kernel correctly ? Once LK is correct, no more need of Jtag...
[Bada Software and Hacking General] Galaxy3HELL:
well i think LK is correct. After flashing edited apps_compressed.bin with LK Bootloader we can see display output and waiting for fastboot.

now, i think adfree already tried it and get some error with kernel ( like shourt output then phone shuts down ) or phone is not booting. Kernel with edited drivers for touchscreen, keys and LCD should work fine. Maybe you can extract it from i9001 dump what adfree given, and merge it with one from Oleg's.

That dump from i9001 which booted up to lockscreen is best change for us to make something, lots of editing is needed.
[Bada Software and Hacking General] Tigrouzen:
It is not easy like that you need kernel, asm, C knowledge to porting driver to make kernel work right under 8600 hardware.
[Bada Software and Hacking General] Galaxy3HELL:
yes Tigrouzen i know that, but im not developer so i dont to mess with it.

just explaining situation to BenzoX :laugh:

to much work on this phone, almost 2 years guys are working on it :)

:rolleyes:
[Bada Software and Hacking General] BenzoX:
yeah i know about this stuff

But before making working it right we should try making it work at all :D

It's not use working on kernel if user can't boot it, it means only people with Jtag can test...

All devs haven't Jtag, and coding without possibility to test self is more than slow.

We have luck to have an already booting kernel. Its code is indeed incorrect (bad screen driver but functional, no keys, reboot...) but it boot. We have to make it work with LK and then work on porting each piece of hardware. Because for now only adfree and Oleg can test, and he can't test every test build we make...

I don't know if there must be differences in kernel whereas it's booted by i9001 bootloader or by LK. If yes, what i suggested upper may be more difficult because of adapting kernel code to LK. More experienced devs can probably answer to this :)
[Bada Software and Hacking General] adfree:
Main problem is...

No proper nor existing tutorial how to use LK from oleg_k...

Because ALL tests failed with LK...

Option A

Fastboot Driver...

This is all what I can do... display RAW Picture but not booting kernel.

http://xdaforums.com/showpost.php?p=53532648&postcount=362

1 reason could be, I am dumb...

Option B...

external SD card, with I9001 Image/dump...

LK shows something...

But maybe only from boot.img Header or from OSBL

I mean console stuff...

Maybe I am too stupid...

Option C

No success with internal EMMC...

LK writing to 0x0450 0000 is no problem... starting...

But then? Where how who boot.img

:confused: :confused: :confused:

Maybe I am not smart enough.

Normally simple solution would be.

oleg_k can tell us please, how to use his LK...

[MENTION=5540748]BenzoX[/MENTION]

Thanx, will try and post result...

But I need maybe 1 day...

I need with JTAG for

256 MB 30 minutes...

if I wrote 2 GB... then more then 3 hours needed...

for whole 4 GB EMMC ... 7 - > 10 hours...

I will do for now my tests with I9001 stuff on my S8600...

Short summary... again...

Maximum ""success"" with JTAG and 2000 MB I9001 EMMC dump:

Samsung_GTI9001_2GB.rar

Forgotten where Link... I will add, if I remember...

Little hint... I9001 have 7000 MB EMMC... so 2000 MB is only 30 %...

7000 MB NOT fit... we have only 4000 MB space in S8600...

MANDATORY!

http://xdaforums.com/showpost.php?p=54152342&postcount=506

You have to combine 2 files and create 1...

Written with JTAG is then this visible:

http://xdaforums.com/showpost.php?p=54146490&postcount=493

In words:

Samsung Logo
Galaxy S plus Logo
Intro Animation
short I can see Lockscreen and russian language...
Then Reboot.

http://xdaforums.com/showpost.php?p=54146085&postcount=491

Other dumps or combinations lead to earlier Reboot...

Then Restart after:

Samsung Logo
Galaxy S plus Logo

NO Animation, no short Lockscreen visible...

So 1 question is...

What is between 0x0900 0000 and end of file from this 2000 MB dump?

Samsung_GTI9001_2GB.rar

I will try to find answer by elimination...

As hint...

http://xdaforums.com/showpost.php?p=38671295&postcount=2

7 GB Full dump have 27 partitions...

This 2 GB has only 16...

Maybe partition 16 is not full...

So I will start remove partition 16 from Image...

So I need only less then 1000 MB to write, instead 2000 MB...

No idea where the boot animation files located...

Btw.:

http://xdaforums.com/showpost.php?p=53992905&postcount=45

This dump seems corrupt...

Check for instance DBL...

Seems many read errors inside...

Interesting... S8600 halt at address 0x0450 0000...

Best Regards

Edit 1.

This is what I can see... I think...

Boot Animation is also in this Thread attached...

http://xdaforums.com/showpost.php?p=27219943&postcount=19

So first I will check partitions for this ZIP...

Edit 2...

Looks QMG animation...

http://xdaforums.com/showthread.php?t=1596776
[Bada Software and Hacking General] BenzoX:
Usual Android partition layout is a lot of little partition and then /system /cache and /data

To boot Android need these three.

Bootanimation is most of the time in /system ( I have seen it elsewhere but it's outdated)

I think most of the 8gb dump is /data, system don't take more than 1GB and cache no more than 50 MB

A small /data is not a problem, but if partition is incomplete Android may not understand

If we could access recovery (maybe with an unsecured i9001 kernel in place of yours and "adb reboot recovery" during Bootanimation (adb should work during Bootanimation) , it would allow to repartition Nand, flash roms...

Maybe you can take a look at i9001 fstab (maybe here)