yashsingh1/xdaforums huggingface dataset:
[Galaxy S I9000 Android Development] phoenixdigital:
Congratulations someone finally did it apart from me! Shame about the result though.

With the 3 button click you need to

1) pull the battery

2) put battery back in

3) hold vol down + home

4) press power until logo comes up (while still holding onto other 2 buttons)

5) release ONLY power when logo

6) continue holding vol down and home

7) hopefully download mode shows up.

If you have enough linux skills I wouldn't mind a copy of your BML4. That will confirm Spl.bin was flashed.

Just follow these steps

1) Root phone using 1-Click root method

2) Install Terminal Emulator on phone

3) Run "Super User Permissions" (not sure if this is required)

4) Run "Terminal Emulator"

5) Type the following (Will be asked for Super User Permissions... say allow... triple check the dd line before you press enter)

su

dd if=/dev/block/bml4 of=/sdcard/bml4.bak

6) Plug your phone into your computer and get bml4.bak and post it up on the net somewere...then I can compare it with the ones I have to see if you did get updated.

If the 3 button recovery mode is not in BML4... where else could it be?
[Galaxy S I9000 Android Development] Bhonka:
I've never taken my battery out to get into recovery and I don't release home and keep the others held down I just hold them all down until the download screen appears.
[Galaxy S I9000 Android Development] wang1chung:
Im still at work but ill try when i get home. Can i still use the same update.zip file to root my phone? And my apn settings were lost during the update. Just to confirm i was only supposed to use the pda tar and not the modem or csc file right?
[Galaxy S I9000 Android Development] phoenixdigital:
It was just the CSC you were meant to skip.. modem would have been fine.

Not sure what update.zip you are talking about. If you mean the one you had downloaded previously then possibly yes? Better to get latest from the link I had in my post to be sure though.
[Galaxy S I9000 Android Development] Senorclean:
Keep an eye on your battery usage - if cell standby starts munching through your battery, you'll know the firmware/baseband mixup is stopping it from going to sleep (I've been there).

Generally the rooting update.zips will work on any Eclair build, but not Froyo - so you should be fine to use them.
[Galaxy S I9000 Android Development] wang1chung:
it's done. i can't seem to install anything from the market place though, so i just downloaded to my computer, and uploaded and installed it.

here is the link to the bml4 backup:

http://www.mediafire.com/?hzkc82xl792b72l

can i just download the jh2 update and apply via odin now? i need my gps for this stupid trip tomorrow. the jh2 update only has a pda file. should be ok right?
[Galaxy S I9000 Android Development] phoenixdigital:
Thanks for that wang1chung I appreciate it.

Go for it nothing more needed for me. Change to whatever firmware you want.

As for the BML4 file you just gave me

It matched the Spl.bin file that was in the JM5 firmware. There was one slight difference which was a date string inside it but that is all.

Wangchungs = Jul 19 2010 13:20:09

JM5 from samsung firmwares = Jul 30 2010 15:04:44

Everything else was identical....

So the bootloader appears to be a bum steer with regards to 3 click download mode.

Which means it's stored somewhere else OR there is a config setting somewhere that the bootloader checks to see if they let the 3 click mode work.

The reason I suggest a setting somewhere is there is a line in the bootloader which says "Debug Level 0x%x". Maybe only if the debug level is set to a particular setting the 3-click will work... I'm grasping at straws here now..

Screenshot of Spl.Bin (yellow area is where date was different for wan1chung)

Anyone else got any ideas?

Thanks wang1chung for manning up and trying it out.
[Galaxy S I9000 Android Development] wang1chung:
well what about just copying bml1-8 from a 3click phone and flashing that to a disabled phone?

only problem is no reliable/safe way to flash it yet
[Galaxy S I9000 Android Development] phoenixdigital:
The latest Optus Firmware is I9000DTJG4

I think the other firmwares and I9000UGJG8 and I9000UGJH2 are for another carrier... maybe Aust or USA...

Correct just the PDA is fine. All of those firmwares have the MODEM firmware inside the PDA.
[Galaxy S I9000 Android Development] phoenixdigital:
Yes noone has really told us how to do that at all yet. (I had some suggestions earlier in this thread but noone said it will or will not work)

Copying all of the BML's would be a start however you can't copy bml3 as it contains some phone specific things which we can't really talk about. Hopefully that config if it exists is not there.
[Galaxy S I9000 Android Development] wang1chung:
i have an idea.

i got my gf the same phone.........currently she is on the old jg9 firmware, but if i update hers to jh2, then download bml1-8 (excluding 3 cause it will obviously be different) and compare it to my bml1-8, we should be able to find which is different. oh yeah, forgot to mention hers is not disabled. i'm going out of town for a few days, but when i get back if nothing else has been figured out, i can do this and hopefully get a point in the right direction with this.
[Galaxy S I9000 Android Development] phoenixdigital:
Its worth a shot. Give it a go when you get the chance.

Your BML4 will probably be different as you have upgraded yours to JM5 (which has a bootloader in the update). So if you want to be consistent upgrade hers to JM5 then to JH2 (which has no bootloader update).

Let us know how you go... you might as well compare BML3 as there might be other stuff in there too. Just don't post it anywhere.

Edit: I use WinMerge for comparing. It's not a proper hex tool but it does the job and its free.
[Galaxy S I9000 Android Development] Senorclean:
Although it is a bummer that we haven't solved the problem, it is nice to know that flashing these firmwares doesn't overwrite download/fastboot modes! It's a nice feeling to know that at least those of us with 3 button mode have those as a failsafe.
[Galaxy S I9000 Android Development] phoenixdigital:
I found the debug level file it's in BML6 which is at /mnt/.lfs

All of the bootup images and error images are in there too..

Can someone with and without 3 button click modes please post up the contents of the file

/mnt/.lfs/debug_level.inf

mine contains

DLOW

I am hoping someone with reboot mode will have something like

DHIGH (Total guess)

Edit: Nevemind... someone already did from whirlpool... a phone with 3 button recovery still contains DLOW :(
[Galaxy S I9000 Android Development] Senorclean:
Sorry mate, DLOW here too on my un-neutered one.
[Galaxy S I9000 Android Development] phoenixdigital:
Incase anyone is interested here is the image of what the people with neutered phones see when our phone is bricked.

I have checked a few other files with a non-neutered phone and they are the same... however BML6 is different (Though that was a JM5 compared to JG4)

I wont get people to post up their BML6 incase there is something phone specific in there. I will get a copy of a friends who is non-neutered and on the same firmware as me.

Edit: Compared my friends BML6 with mine and it is mostly the same expect for a chunk of differences at the very beginning and end of the file.... not sure what we can do with this though as I am not game to write his to mine... incase of brickage :)

Also we still have not been told by anyone how to copy the bml from one device to another...
[Galaxy S I9000 Android Development] AllGamer:
Anyone cares to lead a bounty to make the 3 buttons working?

there are already a couple of guys looking into it phoenixdigital and Benjamin Dobell as I recall

I already lead the unlock bounty and i forked out $75 of my own money, now everyone is reaping the benefits meanwhile i get nothing in return
[Galaxy S I9000 Android Development] mike.sw:
Hey I will put some money for this. Although mine currently bricked and last time I used it had the 3 button download mode, it will help other folks.

And there are so much service guys out there.. no one on XDA with SGS? We really need safe platform to play on...
[Galaxy S I9000 Android Development] phoenixdigital:
Mike I got in contact with the official Samsung service centre in Brisbane and they quoted me $49 to re-flash. They said they could do it even if the 3 button recovery mode was disabled.
[Galaxy S I9000 Android Development] mike.sw:
So they got no problem reflashing it each time you mess it up or .. ?
[Galaxy S I9000 Android Development] phoenixdigital:
You are paying them to repair it so I dont see why not. I think if you kept taking it in for 'warranty' repair for free they would start to get suss.

But when I was on the phone to him I told him I was wanting to experiment with it and flash other firmwares and wanted to be sure they could reflash.

I asked to speak to a tech as I suspected they would probably just do the 3 button recovery mode but he said the tech was unavailable. But he was adamant they had the right gear there to reflash.

I suspect being an official Samsung repair shop they will have the specialised gear there to reflash regardless of how badly you f#$k it up.

The official repair centre in Brisbane is AllPhones at Chermside. Ring Samsung for your local one... report back your results too :)
[Galaxy S I9000 Android Development] mike.sw:
Well, Israel is really small market for companies like Samsung, so I doubt they have repair centers or labs here. They probably just send it oversea or use cellular providers like Orange to fix the devices.

Except that, the I9000 isn't officially marketed here yet so no go.

I bricked mine and sent it back to the store in UK... going to cost me way more they 50$ since I used DHL and if they going to replace it, I'm probably would need to pay taxes once more. blah...

What I meant in the original post is that I wish there was some guy here who works in Samsung service center, and can allow himself to brick his phone as much as he please and fix it back the next morning for free ;)
[Galaxy S I9000 Android Development] MKVFTW:
Ive seen this on my neutered phone and i ended up being able to fix it. After some explicit language and tossing of random objects on my desk i managed to pop it into download mode. I did it by pressing and holding some buttons at this screen then it booted into download mode. I have NO idea what i pressed but i managed to reflash with odin. It doesnt help anyone i know but hopefully someone can try it out after they brick their phone to at least give it a shot before they send it in.

I know for sure that i can't get into download or recovery from power off as i have tried every combo known to man.
[Galaxy S I9000 Android Development] mike.sw:
Well, if not the order of the clicks, can you at least try to remember what buttons did you press?
[Galaxy S I9000 Android Development] MKVFTW:
I believe it was just the power and vol down button. It was quick too, like right from the brick screen to the download screen quick. No bootup or anything. This was also while connected to odin.
[Galaxy S I9000 Android Development] mike.sw:
heh that's interesting. some secret combo we don't know?
[Galaxy S I9000 Android Development] j7899:
Holding volume down and the power button is the combo I use on my captivate to get into download mode. That's even after flashing to JM2 or JM5, and flashing the captivates stock kernel back.
[Galaxy S I9000 Android Development] MKVFTW:
But this wasn't from a power off state. This was at the brick screen. It doesnt not work from a power off state
[Galaxy S I9000 Android Development] astralmind:
What I find interesting is how some people managed to get the recovery/download mode by using some random techniques on top of the regular 3 button press. In some instances it sounds like a partially working feature. Unless those reports were just people who actually have a working one, that would mean that the function might not be clearly disabled but somehow partially implemented ?
[Galaxy S I9000 Android Development] MKVFTW:
Im inclinded to think that perhaps you still might be able to enter the downloading mode via button combination only if your phone is in a bricked state. That would explain how i was able to get into it and recover my phone.

I know for sure this feature is disable from an off state. This is my second phone, i was able to get into downloading mode just fine with the first one. So its not my method or timing.

I just dont want to risk bricking it just to test it out haha.
[Galaxy S I9000 Android Development] celtichazard:
what about us with AT&T captivate Rom bricked our download mode?
[Galaxy S I9000 Android Development] kanemari:
partially implemented is right.

i have an AU optus galaxy s and the 3 button combo doesnt work from the normal boot screen, but when flashing previously i had an interruption while repartitioning and i ended up with the yellow excalamation pic above.

when in that screen i managed to get the 3 button download mode to work after trying it for about half an hour... basically i held down the down volume button and the home key, then held the power button until the power reset, then had to time it perfectly so that right on the instant the exclamation picture is going to appear, i let go of the power button and pressed it again straight away (while still holding the other buttons).

if i hadnt tried for 30 mins i would have had to take my phone in for a service reflash, but luckily the persistence paid off... since fixing it, i havent managed to get into download mode again through the same method. and believe me i have tried every timing possible. so it looks like it only works when the phone is stuffed, which is really the only time you need it.
[Galaxy S I9000 Android Development] andreev2001:
I was wondering is the bml5 causing the problem with neutered phones.

Bml5 should have second boot loader for recovery according to http://xdaforums.com/wiki/index.php?title=Samsung_Galaxy_S

On my phone bml5 is blank /everything is filled out with 0xFF/.

If the primary boot loader /bml1/ tries to load secondary boot loader /bml5/ and senses it is blank it may fail back to the first one /bml4/ and start phone in normal mode.

Is it possible some with working 3 buttons mode to confirm is the secondary boot loader blank or not?
[Galaxy S I9000 Android Development] j7899:
I am dumping bml0!c through 7 right now, 3 button combo does NOT work on my GT-19000m.

EDIT: bml5 is all FF's, while in my captivate it isn't. Also bml4 mentions the SBL.
[Galaxy S I9000 Android Development] phoenixdigital:
BML5 is also blank on some phones with 3 button recovery working. Check this post earlier on in this thread.

http://xdaforums.com/showthread.php?t=756002&page=2

Also from other investigations BML4 is not directly involved as well. Wang1chung managed to update his BML4 by flashing a european firmware with boon.bin and spl.bin. The 3 button mode didn't come back at all.

Latest thoughts are it is a setting that the bootloader checks to see if 3 button mode is active. If it is then it allows 3 button mode to work.

So BML4 and BML5 are out... next suspects are BML6 or BML3 for a setting which the bootloader checks.

If you have a read back you will see what we have discovered so far. Will save you from trying something we already have done.
[Galaxy S I9000 Android Development] wang1chung:
just finished rooting and grabbing bml6 and bml3 off my gf's phone. going to grab mine in a minute and hex compare them.

EDIT: they are both different, but i forgot to update her phone to jh2.......going to try that now

EDIT2: damn woman gave me her phone with 26% battery. samsung kies won't let me upgrade........gonna have to wait till tomorrow. phoenixdigital, PM me if you want to see the bml's anyways and i'll send you them tonight. i have to work tomorrow, so it won't be till later in the night i compare them.
[Galaxy S I9000 Android Development] phoenixdigital:
Install JM5 first like you did with yours... it updated your BML1 and BML4... then go to JH2

JH2 doesn't contain bootloader updates.

Then compare.. BML3 will definitely be different as it has the IMEI inside somewhere.
[Galaxy S I9000 Android Development] andreev2001:
bml3 and bml6 are in fact file systems. You can access their files directly using adb.

bml3 is linked to /efs.

bml6 is linked to /mnt/.lfs

You may want to compare their files instead of the whole partitions. It may be easier that way.

I'd suggest to start with param.blk file because it is referenced in the SBL /bml4/
[Galaxy S I9000 Android Development] phoenixdigital:
I compared my phones param.blk with a non-neutered phone and it was the same unfortunately.

There is a reference in that file to /mnt/rsv but I couldn't find it on either phone
[Galaxy S I9000 Android Development] xtoad:
The work you are doing is encouraging.

I just came to this thread from the other one where people are discussing this being a defect. I realize you are working the reverse but has it been confirmed to lose the 3 button functionality by changing/upgrading the FW?

I ask this because I have 2 Bell SGS bought at the same time, I upgraded one through Kies to JH2 before I knew about all this stuff. The original has JG9 and 3 button works no problem, while JH2 doesn't. (I didn't test before I upgraded, as I wasn't following the issue...)
[Galaxy S I9000 Android Development] andreev2001:
I do believe /mnt/rsv is valid only in recovery mode.

I think the SBL is controlled by NVRAM variables. I don't know where are they.

And are they in plain text.

SBL passes additional parameter to the kernel to make it start in recovery mode.

The parameter is bootmode=2

Kernel parameters can be viewed using the following command

cat /proc/cmdline

You must be root to be able to view it.
[Galaxy S I9000 Android Development] MomijiTMO:
Thanks for all your hard work Phoenix!
[Galaxy S I9000 Android Development] phoenixdigital:
We have never heard of anyone losing the 3 button recovery mode functionality from a firmware update.

Samsung in Canada said they would be offering an update to restore this functionality so it either

a) Suggests it can be updated with a firmware update

b) The support person they were talking to had no idea what they were talking about.

I am still hopeful that it is possible to get these phones back to allowing 3 button recovery as it will give me more confidence to try other firmwares.
[Galaxy S I9000 Android Development] wang1chung:
well, just updated to jm5, then to jh2, and compared the bml3 and bml6...........i know bml3 is going to be different because of the IMEI and other specific info, the bml6 has a ****load of different parts too..........a lot of them seem to be 'ff' replaced with '00'. i gotta go to bed for work tomorrow, phoenix, lmk if you want me to send you the bml's to compare

edit: i guess it doesn't really matter since we have no way of flashing the bml's....yet
[Galaxy S I9000 Android Development] phoenixdigital:
wang1chung can you copy the contents of /mnt/.lfs from both phones and zip them up and send them to me?

That should be the entire contents of BML6.

As was mentioned previously it would be great to work out how to look at NVRAM to see if there are any settings inside there.
[Galaxy S I9000 Android Development] celtichazard:
Its any possible to start a bootloader from a microsd card when then phone turn on

this phone have any boot search secuence?
[Galaxy S I9000 Android Development] AllGamer:
the new phone (i9000m) i'm using has a working 3 button sequence

stock JH2

let me know if you need a dump.

i'm still waiting for the defective one to come back from repairs, so that i can do a coparison, unless they send me another unit with working 3 button combination
[Galaxy S I9000 Android Development] phoenixdigital:
Ok worked out how to get a copy of the NVRAM due to all the talk about the new Froyo release.

This will backup your NVRAM

su

cat /efs/nv_data.bin >> /sdcard/nv_data.bin

cat /efs/nv_data.bin.md5 >> /sdcard/nv_data.bin.md5

For those people with access to two phones one with and one without 3 button recovery make a copy of those files and compare them.

DO NOT post them up here as I think they contain some encrypted IMEI information.

Might be a good idea to back it up for anyone regardless so if you ever flash something dodgy which messes with your NVRAM you can get it back again. In my searching I did hear from people that successfully restored their nv_data.bin by just copying it back.
[Galaxy S I9000 Android Development] celtichazard:
can you upload the dump file please?
[Galaxy S I9000 Android Development] wang1chung:
phoenix, the files in .lfs are the same between the two, except for one byte in the param.blk file.

instead of "09" it's "05"............05 is from the phone with a working 3button.

if you still want it, i'll send

edit: also grabbed copies of the nv_ram, and there are a lot of differences, but i don't know how you're going to know what is related to the 3button thing as some of the differences could be just encrypted imei data.

maybe since you can successfully re-load your nv_ram data from a backup, we should try loading a copy of a 3button enabled nv_ram......shouldn't matter if the imei is different as that is only important when trying to register on the network, correct? we just need it for the first 5 seconds of booting or whatever.
[Galaxy S I9000 Android Development] phoenixdigital:
I pm'd you about the param.blk file..

As for the nvram file uploading another phones nvram will possibly work and as you mentioned will stuff the imei up. On reading the other thread what happens when that file is doesn't match what it expects with regards to the phones actual IMEI you get given a 'dev' IMEI which works for some people but doesn't for others when making calls.

If your feeling game replace the neutered phones nvram with the non-neutered one... (probably should do the .md5 as well) I will not be responsible for what happens though ;) It seems though people are able to copy their original back based on posts today with regards to the Froyo update...but I have no first hand experience if it is possible.
[Galaxy S I9000 Android Development] wang1chung:
i'll read through the other thread tomorrow and maybe give it a shot once i am confortable with the method.
[Galaxy S I9000 Android Development] phoenixdigital:
Here is a post with how people are fixing their froyo updates

http://xdaforums.com/showpost.php?p=7921548&postcount=724

So instead here you want to back them up.... swap them with the a 3 button recovery phones files... test 3 button recovery....then swap them back... if no change then this is not the file we are interested in.

There is limited space on the /efs partition so backups should be stored on the internal sdcard

/sdcard

Make sure if your phone is plugged into the computer the sdcard is mounted on the phone not the computer.

If you want to see partition mapping and sizes run this command from a terminal or via adb

df

Backup

adb shell

su

cp /efs/nv_data.bin.md5 /sdcard/nv_data.bin.md5.bak

cp /efs/nv_data.bin /sdcard/nv_data.bin.bak

Copy the 3button recovery ones over to the /sdcard on the neutered phone and name them nv_3button.bin.bak and nv_3button.bin.md5.bak

Backup & Swap (At your own risk)

adb shell

su

cp /efs/nv_data.bin.md5 /sdcard/nv_data.bin.md5.bak

cp /efs/nv_data.bin /sdcard/nv_data.bin.bak

mv /sdcard/nv_3button.bin.md5.bak /efs/nv_data.bin.md5

mv /sdcard/nv_3button.bin.bak /efs/nv_data.bin

reboot

Restore & Keep Original Copy (At your own risk)

adb shell

su

cp /sdcard/nv_data.bin.md5.bak /sdcard/nv_data2.bin.md5.bak

cp /sdcard/nv_data.bin.bak /sdcard/nv_data2.bin.bak

mv /sdcard/nv_data2.bin.md5.bak /efs/nv_data.bin.md5

mv /sdcard/nv_data2.bin.bak /efs/nv_data.bin

reboot

Based on what you sent me previously too the param.blk file is not involved in the neutering either...