[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I have the drivers all installed and tested previously.

The device is not going into edl automatically.

I can short the testpoint to get into edl mode. I have done it a few times on this device now.

My last attempt was using the standard U2 edl rom I flashed it in 9008 mode.

After the flash i am able to get into download mode.

In odin i flashed the complete factory AT&T software for U2.

After the odin flash the device just constantly reboots.

I cannot seem to get it into download mode again.

However it is difficult because I have no working display.

The display quit working after the first time i did a edl flash using the test point.

So either my display is not working because of how the device is bricked.

Or i damaged the board taking it all apart.

The other thing i'm thinking is that there is data and partitions that never get flashed by odin or the edl.

All of those partitions will be erased and blank.

Also there is data that starts in sector 7 of /dev/block/sda

The first 24 kb (6 sectors) is the primary GPT table.

The modemstring1 partition starts on sector 264.

So 264 - 6 = 258 sectors of memory that are not a partition. (258 * 4 = 1032 kb)

So there is 1032 kb between the end of the gpt table and the beginning of the first partition. (modemstring1 - /dev/block/sda1 )

Part of that space of memory contains the .pit file. ( .pit Partition Information Table )

After the .pit there is more data in there and i think that there is a hash used for secboot verification.

I have a complete backup of every partition on my device but i do not have the data in the beginning of /dev/block/sda.

I found the Qualcomm Manual for Enabling secureboot and for enabling RPMB ( ANTI-ROOLBACK-Protection)

You can see the manuals here. There are some good ones. I would download them.

https://github.com/dongyongzhi/android_work

The specific manual I am referring to is.

https://github.com/dongyongzhi/andr...45_Application Note- Enabling Secure Boot.pdf

Look at section 6.1

Enabling anti-rollback

Section 6.9 specifically deals with the RPMB ( OUR RPMB FUSE IS BLOWN)

That's the fuse it shows as provisioned when you boot comes up in red on the top of the screen.

Here is what the manual says.

TrustZone secure application anti-rollback
RPMB is a signed access to a replay protected memory block. This function provides a means for
the system to store data to the specific memory area in an authenticated and replay-protected manner.

[COLOR="SeaGreen"]This is provided by[/COLOR] [COLOR="red"]first [/COLOR][COLOR="seagreen"]programming authentication key information to the eMMC memory[/COLOR] [COLOR="Red"](shared secret)[/COLOR].
The QFPROM software version value ( Section 6.6) does not apply to TrustZone secure application anti-rollback. Trustzone saves a secure application APP_ID (Section2.2.1.4.8) and software version (Section 2.2.1.4.1) to the TrustZone RPMB partition. Up to 40 anti-rollback version records of the TrustZone secure applications can be savedto the TrustZone RPMB partition.

So my theory is the 258 sectors of memory that are not a partition. (258 * 4 = 1032 kb)

IS WHERE THIS DATA FOR RPMB authentication key information IS STORED.

Meaning if you flash the edl package it overwrites that data and odin or the standard edl will never write it back to the device. Unless you have a backup and manually flash it there in edl mode as a singleimage. (singleimage is true for this in the rawprogram.xml).

Now RPM is resource Power Management and could very well be the reason i have no display.

Most likely i damaged the board but i would like to test this idea. Like i said i have all the partitions backed up so i can flash them back. But i need that 1032 KB backup from someone.

If you are on rev 2 bootloader i would appreciate it if you can help me out.

Here is what i need.

Open a command window.

then run these commands.

adb shell
su

To make the backup for me use this command as root in the shell.

dd if=/dev/block/sda of=/sdcard/sdatest.img bs=1024 count=1060

That will copy the first 265 sectors of /dev/block/sda (1060 kb)

The file will be in the internal storage of your device.

If you can upload that for me I can test further.

Thanks.