[Galaxy S 4 Developer Discussion [Developers-Only]] darkspr1te:
Hi All,

So i had a spare S4 sitting around and was using it for VR app with google cardboard device. Recently I left it flat and when i tried to boot it after a charge i only get sammy logo then blank screen.

Recovery is also failing with just being stuck on sammy logo, ODIN mode get stuck at initializing and goes no further.

I have full system backup from TWRP, efs etc so am not too worried about erasing of data etc.

I have tried the usual Nand erase all, efs wipe options in odin, all versions from 1.85 to 3.12 of odin, i did use 3.07 to flash this s4 with the note port rom posted else where in the forums.

I have also tried flashing boot.img/kernel etc and pit files together and separate with no luck, odin still get stuck at the same point in flashing.

Have tried diff usb ports and cables, again no luck.

anyway, thats not the point of the thread,

after reading this hexdetective blog i saw they had somehow managed to stop SBOOT, so i had to try this on my new donar S4.

After making up a jig with both 301K and 619K resistors on and hooking it up to my bus pirate i was greeted with this ,

hmm, nothing more, just the above text. Back to the hexdetective article they mentioned is scans for enter and other key combo's

so this time, I held volume down, Jig already plugged in I then add the battery while mashing enter i got this :-

Samsung S-Boot 4.0 for GT-I9500 (Jun 4 2015 - 20:54:14)

EXYNOS5410 EVT 2.3 (Base on ARM CortexA15)
2045MB / 0MB / Rev 10 / I9500XXUHOF3 /(PKG_ID 0x2f0e0d08)

BOOTLOADER VERSION : I9500XXUHOF3

PMIC rev = PASS2(3)
MON: 0x0(0)
MON[0] = (0)[0x00, 0x00]
MON[1] = (1)[0x00, 0x00]
MON[2] = (2)[0x00, 0x00]
MON[3] = (3)[0x00, 0x00]
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000f11
mmc->host_caps: 0x00000f11
!!!Enter 8 Bit DDR mode.!!!
[mmc] capacity = 30777344

MODEL_NAME:{{GT-I9500}}
eMMC_SERIAL_NUMBER:{{15010056335730304D00BD02E0D8408D}}

Current SBOOT version : VERSION_-+A3
- read_bl1
pit_check_signature (PIT) valid.
initialize_ddi_data: usable! (10:0xa)
[RPMB] emmc_rpmb_open:
Get DATA success.
[RPMB] emmc_rpmb_close:
initialize_rpmb_data: usable! (GT-I9500:VERSION_-+A3)
PARAM ENV VERSION: v1.0..
DDR SIZE: D32 (0x0d35)
init_microusb_ic: before MUIC: CDETCTRL:0x2d
init_microusb_ic: after MUIC: CDETCTRL:0x2d
init_microusb_ic: MUIC: CONTROL1:0x1b
init_microusb_ic: MUIC: CONTROL1:0x1b
init_microusb_ic: MUIC: CONTROL2:0x3b
init_microusb_ic: MUIC: CONTROL2:0x3b
set_charger_state: buck(1), chg(1), reg(0x05)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
set_auto_current: get_charger_status(0)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_auto_current: unknown_state, curr(475)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_charger_current: chg curr(14), in curr(0)
fuelgauge_read_i2c_word : 0x0, 0x0
fuelguage : mode=0x0
fuelgauge_read_i2c_word : 0x0, 0x0
fuelguage : hibrt(0000) == 0x0
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
fuelguage : wpc_status(0)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
AP_PMIC_SDA = 2
PMIC_ID = 0x82
PMIC_STATUS1 = 0x1c
PMIC_STATUS2 = 0x11
PMIC_OFFSRC = 0x00
PMIC_PWRON = 0x02
PMIC_IRQ1 = 0x04
PMIC_IRQ2 = 0x11
PMIC_IRQ3 = 0x00
PMIC_RTC_INT1 = 0x04
PMIC_RTC_INT2 = 0x18
PMIC_RTC_INT3 = 0x00
PMIC_RTC_OFFSRC = 0xe0
PMIC_RTC_SMPL = 0x03
RTC TIME: 2017-04-30 21:51:02(0x01)PM
s5p_check_keypad: 0x11000000
s5p_check_reboot_mode: INFORM3 = 0 ... skip
board_get_clock_info :
CLK_SRC_TOP3 (0x1002021c) = 0x00000000
CLK_SRC_TOP2 (0x10020218) = 0x01100100
CLK_SRC_TOP1 (0x10020214) = 0x00000000
CLK_SRC_TOP0 (0x10020210) = 0x00000000
CLK_MUX_STAT_TOP2 (0x10020418) = 0x02211211
CLK_MUX_STAT_TOP1 (0x10020414) = 0x01111000
CLK_SRC_FSYS (0x10020244) = 0x30000666
CLK_DIV_CPU0 (0x10010500) = 0x03550020
CLK_DIV_TOP0 (0x10020510) = 0x02712303
CLK_DIV_KFC0 (0x10038500) = 0x03400720
CLK_DIV_FSYS1 (0x1002054c) = 0x00000001
CLK_DIV_FSYS2 (0x10020550) = 0x00000001
PAUSE (0x1003091c) = 0xfff8fffe
LPDDR3PHY_CTRL (0x10030a10) = 0x00000001
MPLL_CON0 (0x10014100) = 0xa10a0302(532 MHz)
BPLL_CON0 (0x10030110) = 0xa0c80301(800 MHz)
CPLL_CON0 (0x10020120) = 0xa0a00301(640 MHz)
DPLL_CON0 (0x10020128) = 0xa0c80401
MMC0 CLKDIV (0x12200008) = 0x00000001
MMC0 CLKSRC (0x1220000c) = 0x00000000
MMC0 CLKSEL (0x1220009c) = 0x03020001
sclk_mmc0 = 266000KHz, sclk_mmc2 = 266000KHz
mmc0 host clk = 33250KHz
board_get_clock_info : time = 0
s5p_check_upload: MAGIC(0x0), RST_STAT(0x100)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
s5p_check_download: 0
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
check_pm_status: charger is not detected
fuelgauge_read_i2c_word : 0xc8, 0x0
check_pm_status: voltage(4000) is ok
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
fuelguage : wpc_status(0)
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
[fuelgauge] start set model data for max17048
[fuelguage] : OriginRCOMP = 0x97, OriginAlert = 0x1c
fuelguage : OCV_DATA1 = 0xcd, OCV_DATA2 = 0x2f
[BATT]fuelguage : re-write RCOMPseg data
fuelguage : SOC_DATA1 = 0xe9, SOC_DATA2 = 0x19
fuelguage : model was loaded successful
fuelguage : RCOMP(0x76)
fuelguage : OCV_DATA1 = 0xcd, OCV_DATA2 = 0x2f
[max17048] hibrt, vart, vreset setting
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
fuelgauge_read_i2c_word : 0x0, 0x0
fuelgauge_read_i2c_word : 0x0, 0xff
fuelgauge_read_i2c_word : 0x7d, 0x0
fuelgauge_read_i2c_word : 0xa7, 0x6
fuelgauge_read_i2c_word : 0xc7, 0xd0
fuelgauge_read_i2c_word : 0xc7, 0xd0
fuelgauge_read_i2c_word : 0xc7, 0xd0
fuelgauge_read_i2c_word : 0xc7, 0xd0
fuelgauge_read_i2c_word : 0xc7, 0xd0
fuelgauge_read_i2c_word : 0xcd, 0x2f
microusb_get_attached_device: STATUS1:0x3d, 2:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
[fuelgauge] Discharging table soc
[BATT]7906 = ( 394600 - 325342 ) *100 / 876
[fuelgauge]soc(83), table_soc(79), vcell(394600)
fuelgauge : fg_reset_soc (0)
fuelgauge_read_i2c_word : 0x1, 0xff
fuelguage : REG_VCELL = 0xc7, 0xf0
fuelguage : REG_SOC = 0xa7, 0x6
fuelguage : REG_MODE = 0x0, 0x0
fuelguage : REG_VERSION = 0x0, 0x12
fuelguage : REG_HIBRT = 0x0, 0x0
fuelguage : REG_RCOMP = 0x76, 0x1e
fuelguage : REG_VART = 0x0, 0xff
fuelguage : REG_CRATE = 0x26, 0xcc
fuelguage : REG_VRESET = 0x7d, 0x0
fuelguage : REG_STATUS = 0x0, 0xff
fuelguage : REG_RCOMP = 0x76, 0x1e
[TMU] 47, 45, 46, 46
cmu_div:4, div:1, src_clk:532000000, pixel_clk:128682048
ID1=0x40, ID2=0x80, ID3=0x47, 0x00408047, L

autoboot aborted..
S-BOOT #

Whoop, we have a uboot clone of sorts,

Anyway, I have now stopped SBOOT at the start via UART,

what next?

well type HELP of course!

Following commands are supported:
* help
* log
* load_kernel
* boot
* reset
* findenv
* saveenv
* setenv
* printenv
* checksum_need
* mobiload
* mobismc
* usb
* upload
* keyread
* readadc
* printcsd
* rpmbwritedata
* rpmbreadcount
* rpmbsetkey
* rpmbclose
* rpmbopen
* sdcard_read
* sdcard
* mmc_bp_enable
* usb_write
* usb_read
To get commands help, Type "help <command>"

ok, we have some commands, lets see what we can do with them.

this is not in any particular order, as I discover what the functions do I will expand, for now some functions are know and others and not.

ah, we card boot from sd-card, ok, but how do we make a sdcard ?

google "GT-I9500_Boot_Recovery.tar"

you should find a file that contains SBOOT.BIN,

next insert your sdcard into your PC's sdcard reader and the following command, note that the card will be erased in the following steps, dont use a card with data.

may require SU depending on your setup

dd if=/dev/zero of=/dev/sd? count=4 bs=512
dd if=SBOOT.bin of=/dev/sd? seek=1 bs=512

the SBOOT.BIN file must start at 0x200 of the sdcard, not at 0x0 or it will fail.

insert card into phone, and power up.

you will get a screen with following text

Now on my device, when I am using the sdcard recovery it will get past the 'initializing' text but then fails to write, could be damaged EMMC as in the boot up text a few signatures fail (that could also be unsigned kernel/boot.img)

To Be updated, more to come, stay tuned, that's not all folks,