yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
1 problem is...

DBL, OSBL + EMMCBOOT from I9001 without modification...

In this Software configuration NO keys nor Touch nor JIG nor any kind of Commands work with my S8600...

I can only copy boot.img OR recovery.img to address 0x0900 0000...

This is address where normal Android kernel is located... aka boot.img...

partition 7

Key combination starts Android kernel aka recovery.img from OTHER partition...

In I9001 it is partition 12...

recovery.img shows only Android + Box Picture, then restart...

I can not interact with S8600...

I can only clickcklick and show what is executed from address 0x0900 000 aka partition 7

I was not able to mix OSBL from I9001 with LK from oleg_k nor other combination found yet...

But OSBL for S8600... from I9001 is absolute useless/deadly without JTAG yet...

You can only 1 time in theory... writing I9001 Image with QPST...

See what I can see and then you have an little problem without JTAG...

-

NO chance write 1 Byte to S8600, because ever Reboot... endless loop...

You can see Video ever and ever again...

After few cycles... Display got Errors and will be hot, hoter then before...

Again.

I have no clue if oleg_k LK is correct able to execute any boot.img...

With Fastboot?

How?

On SD card?

How?

On internal EMMC?

Please tell me how...

For instance I9001 boot.img

Log text from SD card booting could be result of text inside OSBL... or inside boot.img... first few lines...

If I am stupid idiot, then maybe someone could show me.

How to use oleg_k LK proper...

:confused:

Thanx in advance.

Best Regards

Edit 1. [MENTION=4946969]Galaxy3HELL[/MENTION] [MENTION=640363]Tigrouzen[/MENTION] [MENTION=535343]all[/MENTION]

"WE" have NO working "loader" nor procedure to use any kind of Android kernel aka boot.img.

oleg_k is the ONLY one, like in Highlander... who can tell us.

How to use his LK proper... to be sure LK is proper loading AND executing boot.img

Ich versuchs nochmal in meiner Mamisprache...

Ich kriege oleg_k LK nicht zum gewünschten Erfolg...

Dieser LK scheint kein Android Kernel im boot.img Format auszuführen...

Ich könnte natürlich saudumm... das ist durchaus möglich...

Es wäre ja wirklich hilfreich, eine idiotensichere Anleitung zu schreiben...

Es nützt nix, wenn jemand ne supi boot.img fürs S8600 aus dem Ärmel schüttelt und keine Sxu weiß, wie er das starten soll...

Edit 2.

Memo to me...

I could try to replace I9001 AMSS or to remove and check result...

Maybe I can replace with S8600 AMSS...

Header looks similar... ELF...

S8600 AMSS is smaller, so it should fit in I9001 partition... partition 5

Edit 3.

[MENTION=5540748]BenzoX[/MENTION]

Thank you very much again for trying.

So you have 2 times compiled LK and Gunter33 2 times.

So with LK Binary from oleg_k we have 5 Versions...

But once again...

Result differs in content and size... compared to this:

http://xdaforums.com/showpost.php?p=37200735&postcount=7

And I can only see short orange screen... then long long black...

No Fastbootdrivers...

In my opinion this is maybe incomplete or wrong source code...

Alternate reason, I am tooo stupid...
[Bada Software and Hacking General] adfree:
My testresult...

If I kill partition 16 I loose short time to see Lockscreen...

Hmmmmmm...

So I need working 7 GB dump from I9001 and resize partition 27...

partition 27 is "5 GB" big... FAT32 ...

I am not able to find easy Fulldumps in Internet...

For instance this dump is corrupt/damaged:

http://xdaforums.com/showpost.php?p=53992905&postcount=45

Check DBL for instance...

This is working and I will take this as reference:

Samsung_GTI9001_2GB.rar

https://www.boot-loader.com/app/webroot/medusa_free_section/SAMSUNG/GTI9001/

I will try to identify used Firmware and Download stock Firmware with this Version...

Now I can flash back to S8600 bada Firmware and will try BenzoX new compiled LK...

Best Regards

Edit 1.

Seems Firmware in working dump is something like this:

I9001XXKF8

Need to find download link...

Edit 2.

Maybe this is valid Link... seems 200 MB...

http://narod.yandex.ru/disk/23169571001/I9001XXKF8.rar.html

No idea if older Firmware available for I9001...
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

How to make FULL Dump from I9001? My friend have this phone, maybe he can help :)
[Bada Software and Hacking General] BenzoX:
Thank you adfree for your time testing our code and idea :)

Now I guess we have to wait for Oleg to correct LK or precise instructions
[Bada Software and Hacking General] adfree:
http://xdaforums.com/wiki/Samsung_Galaxy_S_Plus/GT-I9001

http://xdaforums.com/showthread.php?t=1660596

This looks interesting...

[MENTION=5833757]ghoslslender124[/MENTION]

Good question...

More then 1 way possible...

A.

with ADB...

Will check Link for Command... something with dd blabla

B.

With JTAG...

If I need 7 hours for 4 GB...

Then maybe 14 hours for 8 GB... :o

C.

We could use existing dumps and maybe insert via copy and paste from Firmware...

Need some time for study... if this is possible...

Somewhere are files like this...

i9001Reset.zip

Caution!

Remember all kind of dumps could contain PRIVATE data...

Pictures, SMS, Mails etc...

Also 7000 MB ... or compressed around 2000 MB is heavy to upload...

I think I will do my own dump from my own I9001... maybe this should be good idea, to prevent...

Need few days...

About compiled LK Versions for tests...

I could try to make Tutorial or Video...

How to insert EMMCBOOT into apps_compressed.bin with:

WinHex
WaveRemaker

Here is my reference file:

http://xdaforums.com/showpost.php?p=53431652&postcount=347

http://www.mediafire.com/download/2aypae40na9l23c/apps_EMMCv1.rar

With working oleg_k LK inside...

So in theory more users could confirm if new compiled LK work or not...

Caution... if Bootloader write something, this could be dangerous/killing something... So it is risky to test Bootloaders...

Now I will short check if AMSS is important to start Kernel...

Or maybe same or better result with AMMS form S8600...

Best Regards

Edit 1.

AMSS is mandatory for booting kernel...

if nothing at 0x0780 0000 then stuck at Samsung Logo...

Now second test... replaced with bada AMSS...

Edit 2.

Same result, stuck at Samsung Logo...

Both tests shows USB detect failed... so any kind of Driver... hmm..

I could do test with I8150 AMSS and I847 ... maybe more luck...
[Bada Software and Hacking General] yakapa40:
hello tigrouzen

S8600 chipsets:

U300 74AUP1G04 Low-power inverter

U501 NLAS5223BMNR2G ultra low analogic switch

U605 MAX14577EEWA-T IC CHARGER LI+BATT MUX WLP

U202 SKY13385-460LF CI commutateurs RF .1-3.5GHz SP3T SOI IL .5dB @ 2.45GHz

U301 ISA1000A single supply haptic driver

UCP300UP K3PE4E400-XGC1

UME-200 SDIN5D2-4G-944L (IC-NAND Flash Memory, 4 GB)

U502 YDA165-PZE2 IC-AUDIO AMP

U103 BGU7007 Low Noise Amplifier (LNA) for GNSS receiver applications

PAM101 AWU6618RM47Q7 Power Amplifier ; RF Microwave ; 880 to 915 MHz

PAM100 SKY77350-21 IC-POWER AMP

u400 MIC842LYC5 micropower, precision voltage comparator with an on-chip voltage reference

U503 NCX2220GM Comparator ICs COMP 5.5V 5uA

U602 R3111Q281C RICOH - LOW VOLTAGE DETECTOR

U601 AAT1146IJS-1.2-T1 Fast Transient 400mA Step-Down Converter

U504 MIC5365-2.8YMT High Performance Single 150mA LDO

U600 AAT1274IWO-T1 LED Camera Flash Driver

U603,U604 RP152L002B-TR DUAL OUTPUT, FIXED POSITIVE LDO REGULATOR

U302 AAT2146IJS-0.6-T1 Fast Transient 600mA Buck Converter

U608 MAX17043G-T Fuel Gauge, Li-Ion,

U401 PM8058 qualcomm power management ic

U607 STM6519APARUB6F 1-CHANNEL POWER SUPPLY SUPPORT CKT

UPC300 MSM8255-0-AB IC-MODEM

U102 QTR9215 qualcomm RF tranceiver module (audio codec)

U200 BCM4330SB2KUGB broadcom wireless LAN driver

U506 BMC022

and if you need more about s8600 it's here ;http://dfiles.eu/files/vtdoenhma

best regards
[Bada Software and Hacking General] BenzoX:
[MENTION=1030585]adfree[/MENTION]

About LK bootloader, all adresses thingy and init procedure for s8600 are here (init.c and rules.mk)

Maybe this will help you to understand partition layout needed by LK and where to put kernel...

But if Oleg wasn't successfully booting kernel (as precised in post 1), i don't think you make things wrong, maybesomething is missing in code...
[Bada Software and Hacking General] Tigrouzen:
Great !!!
[Bada Software and Hacking General] Galaxy3HELL:
Maybe we could learn something from this thread or use some files and compare to Oleg's Bootloader.

Link: http://xdaforums.com/showthread.php?t=2147997

edit

http://xdaforums.com/showthread.php?t=1827674

also should we read this.
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=53940773&postcount=443

I have also answered... few days ago...

Anyway...

We need someone who is able to boot without JTAG and I9001 stuff from S8600...

Perfect would be, if oleg_k would help us please.

To understand how to use his LK...

If we use I9001 Bootloader chain.

Because DBL->OSBL->EMMCBOOT + proper AMSS + more stuff which cames with OSBL Security etc...

Maybe someone could ask oleg_k in russian language...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] hero355:
Maybe I can try, but where can I connect with him easily? :o
[Bada Software and Hacking General] ghoslslender124:
On facebook :)) he is in our facebook group :D Alien on avatar, you see him
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

I found it in... Internet :D

I don't know what is this but maybe it is helpfull ( Service Manual, SVCM? )

1# http://dfiles.eu/files/otelm3mll

2# https://mega.co.nz/#!A9wFWDKS!K8djPblOsYGrlDOQ8e1oItxRJBkkYv7bnT8g0_qM1P4

3# https://mega.co.nz/#!sxRhlBBT!a6Lc-82IchTWpTovYIgK1dkeD-7rxMiQDTmIPsgfZNU

:cowboy:

And.. I have no foun answer to your post (http://xdaforums.com/showpost.php?p=36088812&postcount=24&nocache=1&z=7757017845287919

), so please :D Maybe u need this, but i dont know for what :D

1# S8500: https://mega.co.nz/#!EohTjKAS!zCAzHUSmlO_pyimy1MtpOA1PRS-qpBUa697v5GAtxe8

2# S8530: https://mega.co.nz/#!A0Z1RRTA!XIddfct4eppkMPYgJ_s4HwR4aRYo3typiSAwXcBANr8
[Bada Software and Hacking General] adfree:
My tests for today...

Android Kernel maybe seems to start, if RAMDISK is "disabled" in boot.img...

Not sure if ADB comes from zImage or from OSBL or EMMCBOOT...

:confused:

http://xdaforums.com/showpost.php?p=54152342&postcount=506

Magic in this dump seems EMMCBOOT... in meini9001v1repaired zip

For now and for my low brain I will mark or replace all Pics from Booting...

To know what is now active...

So I will start with Samsung Logo in EMMCBOOT...

Later more..

Best Regards
[Bada Software and Hacking General] adfree:
I did few tests and I am pretty sure this EMMCBOOT from this package attached here:

http://xdaforums.com/showpost.php?p=52022633&postcount=87

bootloaderI9001.zip

Is the reason why my S8600 boot to I9001 Android kernel...

If I replace this EMMCBOOT at 0x0700 0000 then I can see:

SAMSUNG Logo
then short left upper site 1 Pixel in white...
Restart

Hmmm strange... I have few EMMCBOOT from I9001 but all failed...

2 JTAG dumps...
RIFF Resurrection DLL

Hmmm, I have no idea yet, where I have found this... :confused: :o

Also I am not sure, how to identify Version or date...

:confused:

For instance in XXKF8 you can find text string XXKF8 in DBL or OSBL...

But in working EMMCBOOT I can see only something like this, if I search for text:

I9001

/home/jongshik/GINGER_PROD/GGSM/[B]2011[/B]/I9001/MAIN/Working2

:confused:

Later more...

Best Regards

Edit 1.

Maybe this is from XXKP4 package?

SMD_PDA_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC.smd
SMD_MODEM_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC.smd
SMD_CSC_GT-I9001-MULTI-CSC-OXAKP2_EMMC.smd
AriesVE.ops
[B]Boot_loader.tar[/B]

:confused:

Can somebody help me to find valid Link for I9001 XXKP4...

Thanx in advance.

Edit 2.

Maybe this one...

http://www.mmnt.net/db/0/0/89.178.4...msung/прошивка для 9001/I9001XXKP4/I9001XXKP4

Edit 3.

This Link seems to work...

http://narod.yandex.ru/disk/23176014001/I9001XXKP4.rar.html

About SMD archive... maybe I need this later...

http://www.android-hilfe.de/1912149-post37.html

Edit 4.

narod link worked...

XXKP4 have also EMMCBOOT.MBN inside SMD...

And here this version not work...

Boot_loader.tar is correct, but ALL files also inside SMD files... in other Version/Build...
[Bada Software and Hacking General] yakapa40:
I9001XXKP4 with multi CSC AXAKP2 is here:http://fileom.com/qm2lucol1b8u/I9001XXKP4.rar.html

AriesVE :

0,partition

1,dbl

2,osbl

3,amss

4,emmcboot

5,adsp

6,boot

7,system

8,cache

9,userdata

10,recovery

11,persist

12,preload

Boot_loader

SMD_CSC_GT-I9001-MULTI-CSC-OXAKP2_EMMC

SMD_MODEM_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC

SMD_PDA_I9001XXKP4_CL374422_REV00_user_low_ship_EMMC
[Bada Software and Hacking General] ghoslslender124:
You need only Bootloader.tar? If more, tell me. I upload full soft for you

bootloader: http://speedy.sh/4A5Wm/Boot-loader.tar

This is inside: [IMG="aaa"]http://iv.pl/images/07481875366799420606.jpg[/IMG]
[Bada Software and Hacking General] adfree:
This is my "reference info" about working I9001 files

size	MD5 Hash
dbl.mbn	219560 Byte	4DF1037858F4BA06DA931AB52300FF75
osbl.mbn	875040 Byte	A0361B0CD4CA192FC44B9DBA47020EAD
[B]EMMCBOOT.MBN	559676 Byte	0E8C100A864116207939695139F3A4F3[/B]
partition.bin	029184 Byte	D2A44685217B4065CDB9F1357A2F98E9

RAW Picture(s) in EMMCBOOT.MBN

address HEX
00031EF8-0003ED37	SAMSUNG Logo

I can replace this Picture. :good:

Converter Tools and for Viewing:

WaveRemaker
IrfanView

In ramdisk (boot.img)

ARIESVE.rle

Second Picture after Samsung Logo...

I can replace by filename change... :o

Tools:

Android Image Kitchen

Missing how to display/view RLE files from I9001?

:confused:

Maybe someone could help me please.

Animation... seems QMG...

Later will try to identify and to replace...

Short Lockscreen stuff should be from zImage... in boot.img

So I can see/identify what is actually started... according to my Video result:

http://xdaforums.com/showpost.php?p=54146490&postcount=493

If I have found Animation... then I can create new Video... to show what I did...

Best Regards
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

http://xdaforums.com/showpost.php?p=6775233&postcount=5

Only way to open .rle is CONVERT it

+ Please, give me Boot.img, this on what you work now
[Bada Software and Hacking General] adfree:
:D

Converting is klar...

But what work with Windows for these I9001 files?

I have attached 3 RLE files... taken from I9001 boot.img

I know for sure:

ARIESVE.rle -> Logo blabla
charging.rle->battery Icon, because I have replaced with ARIESVE.rle

initlogo.rle no idea yet, I was to lazy to rename again into ARIESVE.rle and repack again boot.img and write via JTAG.

Please, maybe someone can convert these 3 RLE Pics and tell me, which Tool was succesfully worked...

boot_screen_logo_creation_package
convert_rle_to_image.bat

Short tried this... but RAW is 0 KB...

Edited Resolution... but nothing better...

:confused: :confused:

@echo --------------------------------------
@echo Converting RLE file to image file
@echo --------------------------------------
@echo .
@echo Using %1
@echo .
@echo [ STEP 1] - converting to RLE to RAW format...
@bin\5652rgb -rle < %1 > %1.raw
@echo .
@echo [ STEP 2] - converting to Final iamge format...
@bin\convert -depth 8 -size [B]480x800[/B] rgb:%1.raw %1.png
@echo .
@echo --------------------------------------
@echo DONE!!!
@echo --------------------------------------

depth could be wrong...

Any help is welcome... No JTAG is needed. :D ;)

I need this solution for Windows...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] ghoslslender124:
[MENTION=1030585]adfree[/MENTION]

hahahha

i found the same metod http://xdaforums.com/showthread.php?t=1140406 :D

moment i make it for you, Bro :3

Please took attachments :))

i use tool from link above , Windows :)) All files correctly

Small instruction:

Extract 3 .rle files via Android image Kitcher

Extract tool from link above into your home folder 9user name as folder)

Copy .rle files into tool folder

Open CMD

cd <tool_folder_name>

write: convert_rle_to_image.bat <file_name>

For me works perfectly ; )
[Bada Software and Hacking General] BenzoX:
Bootanimation, lockscreen and russian language is ROM related (located in /system), not kernel (zImage or Boot.img) it means that kernel is able to start I9001 rom on this hardware. Your rom (i9001 stock rom) is successfully started by this kernel (stock i9001 kernel ?) and then crash.

So, nand is read and system started successfully, but there is pobably big instability with some hardware so it crash (or maybe caused by incomplete dump, but i doubt it).

Having some log and especially kernel log would be cool, if adb work...
[Bada Software and Hacking General] Tigrouzen:
Full kernel OKL4 for Android

http://www.4shared.com/file/ojlkqhrQba/okl4-android-30tar.html
[Bada Software and Hacking General] adfree:
In main it is kernel zImage related, because no kernel or wrong stuff... then nothing else work...

This is my main problem with oleg_k LK...

Nothing work after zImage, nor RAMDISK stuff...

So complete boot.img is not decompressed nor executed...

Not with FASTBOOT nor with SD boot...

I have no ADB working to log something...

Nor UART...

JTAG can not halt at every position... because this MSM8255 ... with more then 1 core + Security crap...

And partition layout is corrupt... if you try to use I9001 stuff... 7000 MB EMMC...

S8600 have smaller... 4000 MB size...

I8150 have alos only 4000 MB instead 7000 MB

So maybe I can mix/combine something... from I8150, I9001 and so on...

Few tests successfully with I9001 pcb + I8150 or I748...

Also remember, in stock I9001 Firmware AMSS is mandatory...

No idea if any I9001 or I8150 custom or stock boot.img exists, without AMMS enabled...

Best Regards
[Bada Software and Hacking General] adfree:
I have little progress with ADB...

If I use this Recovery kernel... seems I have few seconds more... before restart.

http://xdaforums.com/showthread.php?t=1694617

http://www.mediafire.com/download/ji7z7yznh25zjjp/twrp2.3.2.1-recovery.img

Downloaded this and wrote to address 0x0900 0000...

Because I can NOT choose between boot.img and recovery.img...

Few ADB Commands tested...

adb devices
List of devices attached
0123456789ABCDEF recovery

adb logcat
/sbin/sh: exec: line 1: logcat: not found

About this custom kernel twrp2.3.2.1-recovery.img...

I can see 1 Logo...

Then menu...

Battery % seems correct...

But then Reboot...

:rolleyes:

Hmmm.

So maybe Custom I9001 in Alpha or Beta phase or custom recovery kernel...

without Reboot S8600 is somewhere floating around...

:confused:

Best Regards

Edit 1.

Google for I9001 recovery.img...

http://xdaforums.com/showthread.php?t=2204700

Later I will post results...

Edit 2.

http://d-h.st/qwa

Taken from here:

http://xdaforums.com/showpost.php?p=44931711&postcount=196

Volume down key work here. :good: :cool:

But not Volume up... :rolleyes:

Second round...

Power key is for select... :eek:

Hey, so 2 working keys found...

But all tested kernels from I9001 restart... :o :crying:

Third round...

I was able to do something with these 2 keys...

wipe blabla...

4. round and 5. round after reboot...

6. round...

I can do something... not sure if really executed..

Best Regards

Edit 3.

I can reach key test...

Volume down S8600 = [B]key 114[/B]
Power from S8600 = [B]key 107[/B]

Volume up AND Middle key from S8600 NO report if pressed...

Edit 4.

This I have found short about key mapping on I9001

http://xdaforums.com/showthread.php?t=1650615&page=44
[Bada Software and Hacking General] BenzoX:
What about "adb shell cat /proc/kmsg" or "adb shell dmesg" ? Those are kernel log, is something wrong is detected by kernel before reboot it will be there

If we know what's wrong maybe we can prevent reboot

About incomplete partition, shortened one is /data, no useful stuff on it (should be empty before first boot)

Maybe you can replace it with an empty partition of less size to fit in the 4gb (even 100 mb is enough for test)

I don't know if possible with Jtag...
[Bada Software and Hacking General] volk204:
adb shell cat /proc/kmsg > log.txt

log.txt will be in directory with adb.exe

Adfree, do you have partition layout for internal MMC on S8600? how many partitions on it and what size, name and etc))

is it similar with https://github.com/Oleg-k/LK_BOOT_S8600/blob/master/target/s8600/init.c#L97 from LK_BOOT?

AS far as i understand you try to start it from internal MMC with JTAG dump?

<6>[ 8.754058] mmc1: new high speed MMC card at address 0001

<6>[ 8.754150] sdio_al mmc1:0001: Probing..

<6>[ 8.754150] sdio_al mmc1:0001: Not an SDIO card

<6>[ 8.764038] mmcblk0: mmc1:0001 SEM04G 3.68 GiB

<6>[ 8.764251] mmcblk0: p1 p2 p3 p4 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 >

<4>[ 8.768493] mmcblk0: p28 size 26050560 extends beyond EOD, truncated

boot.img from I9001?
[Bada Software and Hacking General] BenzoX:
I think the Modem crash and trigger the reset, same issue here http://xdaforums.com/showpost.php?p=23692361/postcount=104

Source for the file writing the error here here

Maybe we can prevent modem init for now, maybe someone can build a kernel from i9001 FULL sources (to have a complete kernel) with a solution to this problem.

If someone know what to change in what file but is too lazy to download sources, tell me and i'll do it (@Rebellos, [MENTION=640363]Tigrouzen[/MENTION] ?)

To get full log : "adb shell cat /proc/kmsg > path_for_file.txt" Problem is to get the file after that because path_for_file will be on phone. Oops, wrong :D

If sdcard is mounted (which i doubt, no trace in log), you can try to do > /sdcard/kmesg.txt.

Maybe you can try to put it in /cache and then export it at next boot : path_for_file should be /cache/kmesg.txt

And at next boot : adb pull /cache/kmesg.txt.

(You can try to put it in /data the same way).

You can use linux, console have a way bigger buffer.

Edit :

Oh, thanks Volk, i thought adb shell would consider the whole next thing as a command and so file would be IN the phone :)
[Bada Software and Hacking General] Tigrouzen:
it is look 4GB mmc it is correct WAVE III have 4GB internal memory then why you can only dump 4gb

if you got other sd like 2gb or more try boot and log

We can see nand(mtd) not init, because bad driver...(bada, app_compreesed, amss(ril)..)

Also need kernel with modem disabled to not crash

By cons you will not have a choice, you'll have to come on a chat to move forward. if in a year there will be even at the same stage ... Because you're the only one to have a Wave III for now and then it is not professional at all how to work the old way, all the world dev working with a real-time chat ...