[Galaxy S III General] scholbert:
technical info, datasheets... stuff

eMMC function, structure and usage

1. Basic info

The onboard eMMC is the mass storage of our device.

There's much more under the hood, than you might expect and notice during normal usage within the OS.

The area we may access from within Android OS is called USER area (all partitions belong to this area).

This part could be easily accessed and you may back up all data of this area to a disk image.

Apart from that, the eMMC is used as secure boot media.

On some of the ICS kernels there was a block device called /dev/mmcblk0boot0 (protected by ro-flag).

This device node is missing on most of the S3 devices and hence it is not possible to access this part.

Anyway, it is hidden area where Samsung placed the bootloader and stuff, the BOOT area.

If you are using still ICS bootloader it consists of at least 2 parts:

2MB area for BL1 (s-boot+TZSW+ddi-data)

2MB area for BL2 (not used, zeroed out)

If you upgraded to JB/KK bootloder another part is setup up and configured:

RPMB (KNOX counter, etc.)

I found no information about the size, but it's a multiple of 128K and may be set up between 128-512K.

Once activated the information stored in this area is controlled by internal security mechanism of eMMC.

Only trusted code is granted access and even worse, from a users sight it acts like OTP memory.

To get some info about the eMMC built in your device the sysfs entries are a good place to start.

We could grep the type of device form here, e.g. the eMMC in my GT-I9305 gives this output:

# cd /sys/class/block/mmcblk0/device
# cat name
MAG4FB
# cat manfid
0x000015
# cut -b 19,20 cid
f7 // this is the firmware revision in hex
# cat date
09/2012

See the datasheet attached (this is the exact part) :D

2. EFI partition and GPT

The first block of USER area of starts with traditional MBR.

Next block starts with the header for the EFI partition which is the base container for all other parts.

[SIZE="2"]45 46 49 20 50 41 52 54	Signature "EFI PART"
00 00 01 00	GPT version 1.0
00 02 00 00	header size 512 Bytes
5B DF 6D 84	CRC32 of header
00 00 00 00	reserved
01 00 00 00 00 00 00 00	Current LBA (location of this header copy)
FF 9F D5 01 00 00 00 00	Backup LBA (location of the other header copy)
22 00 00 00 00 00 00 00	First usable LBA for partitions (primary partition table last LBA + 1)
DE 9F D5 01 00 00 00 00	Last usable LBA (secondary partition table first LBA - 1)
41 4E 44 52 4F 49 44 20 4D 4D 43 20 44 49 53 4B ANDROID MMC DISK
02 00 00 00 00 00 00 00	Starting LBA of array of partition entries (always 2 in primary copy)
80 00 00 00	Number of partition entries in array
80 00 00 00	Size of a single partition entry (usually 128)
28 53 B2 A4	CRC32 of partition array
00 00 00 00[/SIZE]

The rest of this block is the GPT.

Reference:

http://en.wikipedia.org/wiki/GUID_Partition_Table

Other useful reading:

http://xdaforums.com/showpost.php?p=31254495

3. PIT

This is another essential part of the USER area of eMMC and defines all partitions used by the OS.

Here's the definition of the internal structure:

[SIZE="2"]typedef int __s32;
typedef unsigned int __u32;

#define PARTITION_MAGIC 0x12349876

typedef struct _partition_header {
__u32 dwMagic;	/* MAGIC CODE */
__s32 nCount;	/* PARTITION (OneNAND + MOVINAND) */

/* PIT Option. */
__s32 dummy[5];
} __attribute__((packed)) partition_header;

typedef struct _partition_info {
__s32 nBinType;	/* BINARY_TYPE_ (AP or CP?) */
__s32 nDevType;	/* PARTITION_DEV_TYPE_ */
__s32 nID;	/* PARTITION ID */
__s32 nAttribute;	/* PARTITION_ATTR_ */
__s32 nUpdateAttr;	/* PARTITION_UPDATE_ATTR_ */
__u32 dwBlkSize;	/* BLOCK SIZE / OFFSET IN BLOCKS */
__u32 dwBlkLen;	/* BLOCK LENGTH */
__u32 dwOffset;	/* FILE OFFSET (obsolete) */
__u32 dwFileSize;	/* FILE SIZE (obsolete) */
char szName[32];	/* PARTITION NAME */
char szFileName[32];	/* FILE NAME */
char szDeltaName[32];	/* DELTA FILE NAME FOR BOOTLOADER FOTA */
} __attribute__((packed)) partition_info;[/SIZE]

Example:

[SIZE="2"]BOOTLOADER:
00 00 00 00 nBinType;	/* BINARY_TYPE_ (AP or CP?) */
02 00 00 00 nDevType;	/* PARTITION_DEV_TYPE_ */
50 00 00 00 nID;	/* PARTITION ID */
02 00 00 00 nAttribute;	/* PARTITION_ATTR_ */
01 00 00 00 nUpdateAttr;	/* PARTITION_UPDATE_ATTR_ */
00 00 00 00 dwBlkSize;	/* BLOCK SIZE / BLOCK OFFSET */
C6 06 00 00 dwBlkLen;	/* BLOCK LENGTH */
00 00 00 00 dwOffset;	/* FILE OFFSET (in TAR) */
00 00 00 00 dwFileSize;	/* FILE SIZE */
szName[32];	/* PARTITION NAME */
42 4F 4F 54 4C 4F 41 44 45 52 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
szFileName[32];	/* FILE NAME */
73 62 6F 6F 74 2E 62 69 6E 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
szDeltaName[32];	/* DELTA FILE NAME FOR BOOTLOADER FOTA */
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[/SIZE]

4. Complete partition table (GT-I9305)

[SIZE="2"]Block Size = 0x200

BOOT AREA:
Partition	Image Name	OFFSET	LEN in BLK	LEN	OS Partition	Physical Partition
BOOTLOADER	sboot.bin	0x00000000	0x06C6	0x000D8C00	0x50	0x50
TZSW	tz.img	0x000D8C00	0x0138	0x00027000	0x51	0x51
DDI-DATA (DATA)	-	0x000FFC00	0x0001	0x00000200

USER AREA:
Partition Name	Image Name	OFFSET	LEN in BLK	LEN	OS Partition	Physical Partition
eMMC MBR (MBR)	-	0x00000000	0x0001	0x00000200
EFI PART (GPT)	-	0x00000200	0x0001	0x00000200
PIT	m3.pit	0x00004400	0x0010	0x00002000	0x46	0x46
MD5HDR	md5.img	0x00006400	0x0800	0x00100000	0x47	0x47

BOTA0	-	0x00400000	0x2000	0x00400000	0p1	0x01
BOTA1	-	0x00800000	0x2000	0x00400000	0p2	0x02

EFS	efs.img	0x00C00000	0xA000	0x01400000	0p3	0x03
m9kefs1	m9kefs1.bin	0x02000000	0x2000	0x00400000	0p4	0x04
m9kefs2	m9kefs2.bin	0x02400000	0x2000	0x00400000	0p5	0x05
m9kefs3	m9kefs3.bin	0x02800000	0x2000	0x00400000	0p6	0x06

PARAM	param.bin	0x02C00000	0x4000	0x00800000	0p7	0x07
BOOT	boot.img	0x03400000	0x4000	0x00800000	0p8	0x08
RECOVERY	recovery.img	0x03C00000	0x4000	0x00800000	0p9	0x09
RADIO	modem.bin	0x04400000	0x2c000	0x05800000	0p10	0x0A
TOMBTONES	tombstones.img	0x09C00000	0x80000	0x10000000	0p11	0x0B
CACHE	cache.img	0x19C00000	0x200000	0x40000000	0p12	0x0C
SYSTEM	system.img	0x59C00000	0x300000	0x60000000	0p13	0x0D
HIDDEN	hidden.img	0xB9C00000	0x118000	0x23000000	0p14	0x0E
OTA	-	0xDCC00000	0x4000	0x00800000	0p15	0x0F
USERDATA	userdata.img	0xDD400000	0x0000	0p16	0x10
[/SIZE]

5. DDI-DATA

In the hidden boot0 partition the values like the flash count are stored.

Triangle away is able to modify this data.

It's stored at 0x000FFC00 on the boot0 partition of emmc.

struct ddi_data {
int magic; // must be 0x12340012
int custom_flash_count;
int odin_count;
int binary_type; // 0 = samsung official, 1 = custom, 2 = "Unknown"
char model_name[16];
int rom_type; // this is the first 4 bytes of the decrypted 16 bytes
in the param partition. 0xFF000000 = samsung, 0xEE000000 = custom }

For details please refer to this post:

http://xdaforums.com/showthread.php?p=28953690#post28953690

Further useful reading:

http://wiki.cyanogenmod.org/w/EMMC_Bugs

Thesis:

Remove KNOX bit by eMMC low level format command:

With KNOX activation at booloader level, there's an area which stores the KNOX bit information called RPMB.

During research of the eMMC sudden death, some firmware files for the eMMC controller had been reverse engineered and some of the custom commands had been discovered.

Read this and follow ups:

http://xdaforums.com/showpost.php?p=49548099&postcount=121

By changing the boot mode and boot up completely from SD-card into special recovery, it might be possible to send this command with a tool called mmc-utils:

https://github.com/BenGardiner/mmc-utils

Because this will wipe out everything, it would be a great adventure and you'll need a proper backup of all significant parts from the internal eMMC. Otherwise device specific parameters will be lost forever.

See this remark as a reference as well:

http://xdaforums.com/showpost.php?p=51297844&postcount=135

I'll spent some time to think about a useful SD-card layout... :laugh:

TBC

scholbert