[Bada Software and Hacking General] adfree:
1451	0.00015533	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length40:7E0151434F4D206661737420646F776E6C6F61642070726F746F636F6C20686F73740202018AFD7E
1452	0.00000391	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1453	0.01580005	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length45:7E0E43616E6E6F7420636C6F7365207768656E206E6F742070726576696F75736C79206F70656E65640AB11D7E
1454	0.00000307	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1455	0.00000251	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1456	0.00018522	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length40:7E0151434F4D206661737420646F776E6C6F61642070726F746F636F6C20686F73740202018AFD7E
1457	0.00000559	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1458	0.00919446	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length48:7E0D0F00000043616E6E6F7420636C6F7365207768656E206E6F742070726576696F75736C79206F70656E6564AF957E
1459	0.00000307	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1460	0.00000279	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1461	0.00022768	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length40:7E0151434F4D206661737420646F776E6C6F61642070726F746F636F6C20686F7374030309C6327E
1462	0.00000335	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1463	0.00434832	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length5:7E18B16C7E
1464	0.00000279	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1465	0.00000363	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1466	0.00020422	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length5:7E1554B77E
1467	0.00000363	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1468	0.27471005	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length6:7E1A00A6677E
1469	0.00000335	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1470	0.28779691	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length6:7E1C0076337E
1471	0.00000279	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1472	0.00000279	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1473	0.00017041	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length6:7E170157C67E
1474	0.00000363	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1475	0.31169855	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length24:7E0E577269746520756E7375636365737366756C0A65AC7E
1476	0.00000419	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1477	0.00000335	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1478	0.01144699	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length24:7E19009A1B7D5DAABC487D5D1F403354455354212185DD7E
1479	0.00001117	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1480	0.03978215	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length27:7E0D07000000577269746520756E7375636365737366756CF05B7E
1481	0.00001453	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1482	0.00000670	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1483	0.00026623	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length6:7E1B0F89867E
1484	0.00000307	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1485	0.02814464	???	IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length24:7E0E577269746520756E7375636365737366756C0A65AC7E
1486	0.00000838	???	IOCTL_SERIAL_PURGE	QCUSB_COM5_1	SUCCESS	Purge:TXABORTTXCLEAR
1487	0.00000447	???	IOCTL_SERIAL_GET_COMMSTATUS	QCUSB_COM5_1	SUCCESS
1488	0.00018382	???	IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS

Here is my sniffed Logfile from Tool Portmon... if I use QPST to write 16 Byte of partition.mbn

First send Command looks like this as text...

~QCOM fast download protocol host

S8600 answers:

~Cannot close when not previously opened

Aha... :D

Not correct start... QPST sends permanent Ping over USB...

So first real answer from S8600 seems this in HEX:

7E18B16C7E

Then blabla Ping Pong Pong Ping... communication...

Later I will check if all needed for writing... without QPST...

This Command is my 16 Byte... :cyclops: partition.mbn

7E19009A1B7D5DAABC487D5D1F403354455354212185DD7E

Interesting... before 1 answer from S8600 is:

~Write unsuccessful

:confused:

More analysing...

Later more...

Best Regards

Edit 1.

This I mean with Ping Pong...

IRP_MJ_WRITE	QCUSB_COM5_1	SUCCESS	Length 40: ~.QCOM fast download protocol host.....~
IRP_MJ_READ	QCUSB_COM5_1	SUCCESS	Length 569: ~.QCOM fast download protocol targ...........eMMCd

If QPST is open... QPST and S8600 "talk"... :D

This answer with eMMCd is, if allready ARMPRG.HEX is sent successfully...

Edit 2.

About Command to write 16 Byte partition.mbn...

7E1900

7E is "Header"...

19 is Command... for write...

00 could be address...

Hmmm...

Check this PDF...

80-V5348-1_J_Streaming_DLoad_Protocol.pdf

19 is about partition table...

19
Partition table
Host
Y
3.00
Send partition table to use for programming images
1A
Partition table received
Phone
Y
3.00
Response to send partition table

Later I will compare with other write Commands... DBL for instance...

Anyway... for 16 Byte content. QPST send 24 Bytes... so 8 Bytes are additional info...

Last 5 Bytes... uupsi... at end only 3 Bytes...

85DD7E

7E is clear... to end Command... then maybe CRC before...

2 Bytes somewhere in the middle... :confused:

Hmm. Found 2 x 0x5D

No idea yet...

Short summary...

In QPST Software Download... partition.mbn is MANDATORY...

I have to choose valid file...

I have also tried the other files from this package S8600_JTAG_120125.zip...

Like partition.bin etc., but none of them seems correct... or maybe my mistake because low brain... :o

Maybe partition.mbn is written to wrong location... because this ARMPRG.HEX file was not special designed for S8600...

Anyway... these files we have can write to S8600 without JTAG...

We need "only" correct procedure or ...

Edit 3.

Used Revskills to send Command:

7E19009A1B7D5DAABC487D5D1F403354455354212185DD

Without 7E at end... Revskills do this automatic...

S8600 answers:

7E 1A 00

1A I saw in this Document...

Response to send partition table

Now I will check with JTAG, if something is written, or I need to send more Commands BEFORE this Command...

Edit 4.

:D :cool:

It seems I can send this Command more then 1 time...

Tested by clicking again and again...

Response is ever:

7E 1A 00

Translated "okay" or accepted...

Then I have edited 2 Bytes without generating new CRC...

Also accepted... :cool:

Will do more tests... if content is checked... or I can write what ever I want to write into partition part...

Edit 5.

My new Command for tests in Revskills is this:

7E1900FFFFFF5DFFFFFFFF5DFFFFFFFFFFFFFFFFFF85DD

Answer looks nice :cool:

7E 1A 00

Seems I can ignore CRC...

Will check result with JTAG... :fingers-crossed:

Edit 6.

Working... :cool:

But strange... sniffed for my partition.mbn 512 Byte... result is 520 Byte...

RevSkills answers:

Partition table length exceeded

Will check result via JTAG, maybe all is okay...