[Galaxy S I9000 Android Development] tdcfpp:
Hello everybody.

I guess this is the official thread for heimdall. I would need expert advice. I have to restore a bricked Galaxy S5 Neo whose PIT partition has been removed.

UART log says there is no PIT partition, and even BL1 is not found:

[Debug Info.]
S-BOOT : VERSION_-+I0
CI 0
blk_bread: MMC mode
[MMC] error during transfer: 0x0000020c
dev 0 rw failed rw_flag = 1
pit_check_integrity: invalid pit.(0x0)
init_param_part: can't find partition.
blk_bread: MMC mode
[MMC] error during transfer: 0x0000020c
[MMC] response timeout error : 00000104 cmd 12, ret -19.
mshci: MSHCI REG DUMP ver: 9994 called
dev 0 rw failed rw_flag = 1
blk_bread: MMC mode
[MMC] error during transfer: 0x0000020c
dev 0 rw failed rw_flag = 1
pit_check_integrity: invalid pit.(0xffffffff)
blk_card_total_sector: MMC mode
blk_card_total_sector: total sector is 0x1d5a000
update_guid_partition_table: There is no pit binary.
blk_bread_bootsector: MMC mode
[MMC] error during transfer: 0x00000424
[MMC] cmd 12 timeout!
dev 0 rw failed rw_flag = 1
[mmc] cmd 6 busy, last cmd reg 0xa000214c
[MMC] cmd 6 timeout!
[mmc] cmd 13 busy, last cmd reg 0xa000214c
[MMC] cmd 13 timeout!
emmc boot partition close failed.
[mmc] cmd 6 busy, last cmd reg 0xa000214c
[MMC] cmd 6 timeout!
[mmc] cmd 13 busy, last cmd reg 0xa000214c
[MMC] cmd 13 timeout!
if_ddi_data:66 fail!
MAGIC_RAM_BASE: ffffffff, MAGIC_RAM_BASE2: ffffefff, ompin: 0
[ldfw] can not find CM partition in pit file
[mobi_drv] add: 0x43e4ef20, size: 13289
MobiCore IDLE flag = 0
MobiCore Driver loaded and RTM IDLE!
[EFUSE] 8 bit read: 0x0
[EFUSE] 2 bit read: 0x0
[EFUSE] 3 bit read: 0x0
[EFUSE] 4 bit read: 0x0
[EFUSE] 5 bit read: 0x0
[EFUSE] NANTIRBK0 bit reading: start
[EFUSE] NANTIRBK0: 2 bit
[EFUSE] 12 bit read: 0x0
[EFUSE] 13 bit read: 0x0
[EFUSE] 14 bit read: 0x0
[EFUSE] 35 bit read: 0x0
[EFUSE] read done. [0]
[EFUSE] SMC Read the 0x0 ...
[EFUSE] SMC Read Count value: 2
[EFUSE] SMC Read the 0x1 ...
[EFUSE] SMC Read Count value: 1
[EFUSE] SMC Read the 0x2 ...
[EFUSE] SMC Read Count value: 0
[EFUSE] SMC Read the 0x3 ...
[EFUSE] SMC Read Count value: 0
commercial_bit mismatch!(0 vs 1), updating...
No BL1.
blk_rpmb_open: MMC mode
[RPMB] emmc_rpmb_open:
[MMC] cmd 6 timeout!
[RP] emmc_rpmb_open fail...
DDR SIZE: 2G (0x80000000)
[TMU] CPU:37*C, G3D:35*C, APL:36*C
set_charger_enable: charger enable(0x51)
init_ific: CHARGER ID : 0xc
init_ific: chg curr(0x30), in curr(0x40)
get_vbvolt: vbvolt: 0x00
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
get_charger_status: invalid charger device=800
set_auto_current: get_charger_status(0)
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
set_auto_current: unknown_state, curr(500)
get_vbvolt: vbvolt: 0x00
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
get_charger_status: invalid charger device=800
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
set_charger_current: chg curr(0x35), in curr(0x40)
get_vbvolt: vbvolt: 0x00
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
get_charger_status: invalid charger device=800
PMIC_ID(S2MPU03) = 0x02
PMIC_STATUS1 = 0x18 MR2B MR1B
PMIC_STATUS2 = 0x11 RTC60SE RTC1SE
PMIC_PWRONSRC = 0x02 JIGONB
PMIC_OFFSRC = 0x00
PMIC_INT1 = 0x04 JIGONBF
PMIC_INT2 = 0x11 RTC60S RTC1S
PMIC_INT3 = 0x00
PMIC_RTC_CTRL = 0x00
PMIC_RTC_SMPL = 0x23
RTC TIME: 2000-01-01 12:00:13(0x01)AM
s5p_check_keypad: 0x0
s5p_check_reboot_mode: INFORM3 = 0 ... skip
PLL_CPU = 806MHz PLL_APL= 806MHz PLL_MEM0= 825MHz
PLL_MEDIA = 667MHz PLL_BUS = 800MHz PLL_USB = 50MHz
[MUIC] couldn't find battery_detect api
[MUIC] board_uart_rustproof batt: 1
[MUIC] rustproof mode Disabled
PMUDBG_CENTRAL_SEQ_STATUS : 0x0
PMUDBG_CENTRAL_SEQ_MIF_STATUS : 0x0
PMUDBG_CPU_CPU0_STATUS : 0x0
PMUDBG_CPU_CPU1_STATUS : 0x0
PMUDBG_CPU_CPU2_STATUS : 0x0
PMUDBG_CPU_CPU3_STATUS : 0x0
PMUDBG_APL_CPU0_STATUS : 0x0
PMUDBG_APL_CPU1_STATUS : 0x0
PMUDBG_APL_CPU2_STATUS : 0x0
PMUDBG_APL_CPU3_STATUS : 0x0
PMUDBG_CPU_L2_STATUS : 0x0
PMUDBG_APL_L2_STATUS : 0x0
PMUDBG_CPU_NONCPU_STATUS : 0x0
PMUDBG_APL_NONCPU_STATUS : 0x0
s5p_check_upload: MAGIC(0xFFFFFFFF), RST_STAT(0x10000)
microusb_get_adc_value: ADC:0x1c
s5p_check_upload: debug level is 00! (mask: 0x60)
set_mrstb: Invalid debug level(0x0)
check_pm_rtc_intr: unknown value..
s5p_check_upload: enable dump_gpr
microusb_get_adc_value: ADC:0x1c
s5p_check_download: 0
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
get_vbvolt: vbvolt: 0x00
microusb_get_attached_device: INTR1:0x00, 2:0x00
microusb_get_attached_device: DEV1:0x00, 2:0x08, 3:0x00
get_charger_status: invalid charger device=800
check_pm_status: non chargable jig, bypass check power
scr_draw_image: draw 'logo.jpg'...
read_param_file: param is not initialized.
dsim_read_data Can't find RX FIFO READ DONE FLAG : 7fdffb8b
40, 0, 2, 0x400002
mipi-dsi driver(CMD mode) has been probed.
decon-int: ver0, max win3, command mode, hw trigger
single dsi mode
decon0 registered successfully
init_fuelgauge: IC POR State : 0x10
init_fuelgauge: Fuel Gauge IC POR State
set_charger_enable: charger disable(0x38)
Initialization_routine: S2MU003 Fuel gauge init
Initialization_routine: reg25:0xf, reg24:0xfe, reg23:0x83
Initialization_routine: reg25:0x0, reg24:0x2, reg23:0x83
Initialization_routine: reg5:0x7f, reg4:0xdf
Initialization_routine: reg25:0xf, reg24:0xfe, reg23:0x83
ReadFGRegisterWord: S2MU003 FG REG[0a]:0x0a43
ReadFGRegisterWord: S2MU003 FG REG[0a]:0x0a43
fuel_gauge_read_soc: raw capacity (0xa43:6413)
ReadFGRegisterWord: S2MU003 FG REG[04]:0x7fdf
fuel_gauge_read_vcell: vbat (3995)
Initialization_routine: SOC(6413), VCELL(3995)
set_charger_enable: charger enable(0x78)
Can not load MD5 Header
s5p_restart_handler ('N':null)

The facts:

1) I don't want to lose userdata partition

2) I don't know the size of the hidden partition. There are 3 or 4 PIT variants

I see a couple of possibilities:

P1) Create a custom PIT file without hidden and without userdata partition. Then flash TWRP with repartition enabled.

Question1) Will it format the whole MMC? I.e. will I lose the pictures and other data stored there?

P2) Create a custom PIT file with a second placeholder for the PIT partition, but where the partition is called PIT2 in the file. Then flash the custom PIT file of P1 (without hidden and without userdata partitions) so:

Maybe if I have success, I can flash TWRP and extract an image of the MMC where hidden and userdata partition resides and try to guess the blocks where userdata partition begins. Or maybe TWRP doesn't look anymore into the PIT partition in order to mount all the relevant partitions: system, userdata, ...

Maybe I'm blind and I don't see another possible fixes.

What do you think?

Thanks in advance for your help

Edit: I'm considering as well in hard flashing the custom PIT partition without hidden and without userdata partitions. PIT partition has the partition identifier 70.