yashsingh1/xdaforums huggingface dataset:
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
I thought the two port do the same thing.....
[Galaxy S I9000 Q&A, Help & Troubleshooting] dagentooboy:
JTAG is usually a chain of devices... sometimes just one... On that Ipaq I seem to remember 4 different chips on the chain. If they use an encryption then that would be very unfortunate for us. My guess is that the encryption would only be for military/CIA/other three letter places hardware development. When this chip was developed it wasn't JUST for the SGS... they had to think about other applications. There are a lot of systems that have security built in that is just not enabled. I doubt they would give a guy in China their keys or anything to do with their encryption. I think someone needs to connect and see what the chain looks like.

My guess is that if you connect to one jtag port you will see CPU and other low level stuff... if you connect to the other port you will get access to things like the PLD that handles the accelerometer, camera, battery chip, and so on. Just some thoughts.... please let me know what you find.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
S8500 has two JTAG sets: One for Qualcomm QSC6270 baseband and one for Samsung S5PC110 AP.

The bootloader(s) on S8500 are programmed thru AP_JTAG, so I think the correct JTAG "port" for I9000 is not the one close to microUSB (as AP_JTAG is located in the lower right corner of the pcb).

I9000 uses Infineon X-Gold (XG616) baseband anyway.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
hmmm

then what is the photo at page 2 showing wires soldered?

Isn't that the JTAG we are looking for?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
Cannot locate the photo?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
this one

http://www.shareimages.com/image.php?47995-pZOfl5WenJyom5yVm6s-jtag_vibrant.jpg
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
The picture is not from I9000 atleast.

Says SHW-xxxx in the power key flex, so it might be M110S or M130L PCB.
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
Today I shipp My Unit to Benjamin To Start Dev. & Test

Good Luck to all and Keep Going!!
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
Great job and thanks for your effort

If your phone can get fix, so does mine ;)

I'll send mine too if any developer's near enough.....
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
You cannot get around the e-fuses. and you cannot write a whole filesystem to the nand.

Get those ideas out of your heads. Ive been jtaging devices for a long time. Using high end jtags.

we NEED the samsung CMM files. They are scripts that tell the trace32 what to do.

After seeing one. Perhaps we can make a funny version.

Even if you read the bootloader info. from bml0 and bml1 you will see info on E-fuses and other crc checks. This is not a game.

Anyways, Lets see what the other user has once he gets the phone. Whoever here posted that went to a thailand samsung shop. Shout be able to buy the files needed VERY cheap. Ive lived in asia and i know how it goes. 10 bucks to people gets you what you want :)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
It seems that Samsung included a AP JTAG SMD header in GT-I9000 PCB design...

But they did not include the header itself in production versions (to save huge amounts of money, naturally :rolleyes:)

The pads for the header are so small (and fragile) that it is probably easier to take off the silk screening and use the "jig" pads instead.

In production stages Samsung probably programs the AP´s before baking them and never uses JTAG.

HDC401 header pads and the AP_JTAG pads on the right.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
checked taobao again today

Found another 3 shop providing JTAG repair of i9000

Finally options other than mongolia.....
[Galaxy S I9000 Q&A, Help & Troubleshooting] jodue:
i hope he will get it fixed! would be very cool if we were able to unbrick phones! :)

good luck to all investing time in the jtag stuff!
[Galaxy S I9000 Q&A, Help & Troubleshooting] marty1976:
Interesting thread! I don't have enough knowledge nor is my phone bricked, but keep going guys! Great job so far!
[Galaxy S I9000 Q&A, Help & Troubleshooting] dagentooboy:
Have we confirmed that they are using the e-fuses? Do we know for a fact that they encrypt anything (again that seems rather stupid on their part)... I was not thinking of getting the bootloader info from bml0 and bml1... I was thinking of finding the hex location in the nand of the boot loader and simply copy it. The CMM files are just meant to make things easy enough that a repair guy can use it :D

I am not sure why a full FS NAND copy wouldn't work. If you can interface with this CPU like most other cpus on the market you can issue a the following commands

jtag

cable parallel 0x378 DLC5

detect

detectflash

flashmem 0 bootloader.bin

in the linux application I mentioned here

Trace32 is a much more graphical JTAG program. If we can get a connection with the linux application I think we could read and write to the flash.

BTW anyone know if ODIN just flashes binary files to memory locations? Also is there any rom that comes with the bootloader?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
I9000XWJM2 has primary and secondary boot loader included.

I really don't see any need for Trace32 either, OpenOCD should be fine for the most part.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
There are e-fuses 100% read the datasheet on the CPU/NAND.

Also, Take a lookat BML0 and BML1 and BML2. Trust me a normal jtag cable is not going to work.

and yes the CMM files do make it easier since its a script. But,it will tell us what to push. Remember if these phones wont even turn on. BML0/1/2 are dead. BML0 = Alloowes USB BML1 = Allows USB BML2 = Allows LCD.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Also, For those who do have an adb shell as root.

One person can try this. Dont you all do it.

Backup your bml0 . bml1 and bml2 and bml3 files. Get a copy of all 4 from a working phone. then flash those files over yours.

That will allow you to get into odin. Once you flash back. You will need to fix your IMEI + BT_MAC

Also, If any of you live in these asian counties and can get the CMM files. Please do so. Even if you need to pay them $20 to get it. We need the playback files.

The CMM is needed as it has JTAG command sequence and commands.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
Why would you want to copy the EFS?

It has nothing to do with the missing "3-button combos".

PBL is the issue and Odin atleast cannot write it.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Where did I say anything about efs.

I'm talking about the bootloaders.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Gad13:
I suspect Odin can write PBL if the supplied file is named "ries.pit".

I am not sure about the format of file. I mean is it includes some kind of check sum or anything like that.

And I already replaced the primary bootloader, secondary bootloader, PBL and modem partitions on my vibrant without success.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
BML3?

Odin atleast uses it for EFS.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
Whats the difference with PBL and primary bootloader?

Did you check the PBL was actually changed?

I did, and mine did not change.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Gad13:
Sorry, I meant a PIT partition, not a PBL.

I ended up with PBL, SBL, PIT and Modem partitions exactly the same as ones provided me by almyz125. I compared them after re-flashing.

And 3 button mode still doesn't work for me.

My phone is Vibrant from T-Mobile USA.

Partitions on my phone I compared and made sure are same as provided ones are bml1, bml2, bml4, bml5 and bml12
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
would rooting enable/disable the 3 button mode?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
No. If you had root access you could theoretically enable 3 button mode if we knew how, which unfortunately we don't yet.
[Galaxy S I9000 Q&A, Help & Troubleshooting] margusre:
Maybe this can help?

h ttp://rapidshare.com/files/418113418/S5PC100.zip.html
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
What phone is this for? And it does sort of help.

;;;;;;;;;; Secure JTAG setting ;

IF &JTAG==1

(

SYStem.Option enreset OFF

SYStem.Option trst OFF

;;; Secure JTAG open

print "Secure JTAG start"

d.s AHB:0xF4080024 %LE %LONG 0x00000001

print "Secure JTAG password"

d.s AHB:0xF4080020 %LE %LONG 0xc4d6edba

d.s AHB:0xF4080020 %LE %LONG 0xaef4136a

d.s AHB:0xF4080020 %LE %LONG 0x2c278959

d.s AHB:0xF4080020 %LE %LONG 0x11ad221b

d.s AHB:0xF4080020 %LE %LONG 0xf8d51722

d.s AHB:0xF4080020 %LE %LONG 0xb4ee8a02

d.s AHB:0xF4080020 %LE %LONG 0x513ced11

d.s AHB:0xF4080020 %LE %LONG 0x316f0d0f

d.s AHB:0xF4080020 %LE %LONG 0xee011800

d.s AHB:0xF4080020 %LE %LONG 0xb3078f19

d.s AHB:0xF4080020 %LE %LONG 0xcc050af3

d.s AHB:0xF4080020 %LE %LONG 0x95312f08

d.s AHB:0xF4080020 %LE %LONG 0xc9f4937e

;;; waiting 80 clocks to complete hashing

print "Secure JTAG hash polling"

wait 0.1s

print "Secure JTAG finish"

d.s AHB:0xF4080024 %LE %LONG 0x00000002

You can see the strings here for the trace32.

Ah yea. this is for our CPU. Nice find. I will have a friend check this out. If anyone else here can beat it. Post the info.

But, I think this is what we need.

Note: Fixed the link above. Thanks!
[Galaxy S I9000 Q&A, Help & Troubleshooting] margusre:
I believe i9000 has S5PC110 but i think the basics are same :)

Maybe i'm wrong, i dont have any knowledge about ROM programming or whatsoever.

Also i found this package h ttp://rapidshare.com/files/418177394/T32_S5PC110_Android_setup_v13.zip.html

If installed, the installation folder contains bunch of CMM scripts.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
I assume that CMM file is for the SMDKC100 development board.

Whilst the process is probably similar, if we do in fact need secure JTAG to flash then it's unlikely that password is the same.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Very nice find. Would you be soo kind to zip up the folder with the CMM and upload here? I dont have windows :)

Also here is the fixed link: http://rapidshare.com/files/418177394/T32_S5PC110_Android_setup_v13.zip.html
[Galaxy S I9000 Q&A, Help & Troubleshooting] margusre:
h ttp://rapidshare.com/files/418182652/T32.zip.html
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Thanks mate.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Well Guys, Its FAR beyond me. I dont know much about trace32. But, Just looking at these varios files. It looks complex as hell.

if anyone else can chime in. and maybe spread some light to this :)

please do. Because im out :) I have no clue. this is full samsung specs but its complex as hell.

As you can see from the CMM files, the jtag port is even protected and the efuese are protected as well.

Looks like trace32 is the only way to go. from my eyes.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Trace32 is just a program that automates some JTAG operations and greatly simplifies communication. Certainly if you had access to the previously mentioned script files and Trace32 then this whole thing would be quite easy. However in saying that I doubt anyone here has legal access to either of those two things at the moment.

I'm actually a bit confused about the legality of the User Manual though. I want to keep this whole thing legal and I originally assumed the User Manual was freely available (as it's all over the place). Although I just looked at Samung's site for the S5PC110 and apparently only those under NDA are meant to have access to the User Manual. I've already read the vast majority of the User Manual, I even asked Samsung a question via e-mail! Hopefully it's just the people who broke the NDA who did something wrong and not myself.

Anyway, the same JTAG flashing process Trace32 performs can definitely be done using OpenOCD, or even by sending each JTAG command manually (although that would be quite tedious). When I receive celtichazard's phone I'll definitely be giving it a shot.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
If you think you can come up with a solution based off all this info :)

Give it a go. Personally, I am lost looking at all those files :)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
The case is pretty much closed now, there is a working solution for I9000.

The solution is exactly the same one used for S8500 (no wonder because they both use S5PC110 AP).

At the moment because there is no CMM + ELF files available (to us) for I9000, a working phone is needed to revive dead phones.

Any working I9000 will do, but naturally one with working "3-button combos" (i.e non-neutered bootloader) is preferred.

The contents of AP NAND will be dumped from a working phone and it will be written to the dead one as it is. AP NAND does not contain any individualised data, it is fully generic.

Once the dump has been successfully written, the phone can be started to download mode normally and reprogrammed with desired firmware.

The AP NAND must be fully readed, and the data size will be around 580MB.

It will take around 40 minutes to read and another 40 minutes to write.

Also the JTAG pads used will be AP_JTAG, located near the battery connector.

To get access to the pads the silk screening on the top of them needs to be either scraped off or dissolved with paint stripper.

The fix is possible by using RIFF JTAG box.

It will cost around 150$.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
I think the RIFF JTAG box fix has been available for a while now.

Whilst it's cheaper than the Trace32 solution it's similar in that you have to purchase dedicated hardware and the exact procedure (JTAG command sequence) isn't publicly available.

What we really want is a community written tutorial that describes the process (similar to that for the HTC Magic/Dream) in a fashion that is cheap and accessible to anyone, although not necessarily recommended for those who can't solder. No JTAG solution can be totally free because it requires a JTAG adapter however purchasing a $150 piece of dedicated hardware might be pushing it for one-of use.

Ideally the tutorial would make use of OpenOCD, as it is free and it is compatible with a wide range of inexpensive JTAG adapters, including do-it-yourself parallel port Wiggler clones, which cost less than $10 to make.
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
You can dump the NAND from the device. Any device.

bml!0 in /dev/block is the FULL nand.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
The data we want to dump is on a different chip I was told (not located on the 8/16GB NAND).
[Galaxy S I9000 Q&A, Help & Troubleshooting] memo855:
Hi everyone, i bricked my phone too and will go monday to service to see what they can do . Dont you think that the Riff jtag + the correct dll would do the trick ???

Maybe but keep up the good works and hopfully well have soon a solution.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
RIFF JTAG certainly would do the trick

The Chinese guy in mongolia use it to provide fixing service
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
How you know that?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
Coz he bought that RIFF JTAG and left his contact at JTAGBOX.COM registering as a RIFF JTAG box user,I thought I mentioned that before.
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
hi eople of gsmhosting help me with this link of cmms files please take a look

http://anysvc.mobi/categories.php?cat_id=2706
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Sure if you want to drop 100 EURO on it :)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Okay I have access to celtichazard's JTAG pad and I've scratched away the cover. However, it's way too small to solder to. Does anyone know where I might be able to get a simple contact pad splitter?

EDIT: A really tiny ribbon of wires would work but I can't find anything small enough. To give you a clue of the kind of scale I'm talking about, from the left-most wire to the right-most wire including the gaps in between it seems to be almost exactly 5 mm.
[Galaxy S I9000 Q&A, Help & Troubleshooting] kew1701:
Dont know if those pads are in relation with microusb pads(they are both seven)?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Gad13:
If not why the microusb pads are seven? I wonder what other signals we have.
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
i you try with a micro SD Card pads or

With Micro SD Card Adapter the pads is large you can soldier the wires here and then inside in te card have smalls pads to contact with de pads on the phone obiously you need to open the micro sd adapter
[Galaxy S I9000 Q&A, Help & Troubleshooting] RIFFBox:
We still work on it. I do understand that $150 is a bit much for hobbyists, but this was best we could do with price. It's not possible to make it cheaper and get rich in same time. :D

As for connecting it via some cheap JTAG interface, well i am pretty unsure it would work, but who knows.

Simple cloning of NAND content will revive the phone, but it will lose it's IMEI and rest of NVM data. So far we could not manage to get any i9000 into hands, but since we have remote support (software which connects client's box to our dev server) we did some work on this phone. Basically, its same as s8500 which we support already.

Original CMM scripts and ELF from Samsung WILL NOT work ! Same was with S8500, so we had to modify it and use custom H/W init routines to get it started in phone.

__________________

Right now we can connect, read/write any part of AP NAND, and even right now it's being tested by one of our users. Maybe we will have working solution for public (this mean our users) even tomorow.

Here is the log from NAND reading :

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.13, JTAG Manager Version: 1.14
Selected Resurrector: [Samsung I9000]

Connecting to the dead body...OK
Detected dead body ID: 0x1BA00477 - CORRECT!
Set I/O Voltage reads as 2.82V, TCK Frequency is 8 MHz

Resurrection sequence started.
Establish communication with the phone...OK
Initializing internal hardware configuration...OK
Uploading resurrector data into memory...OK
Starting communication with resurrector...OK

Detected an Initialized FLASH1 Chip ID: 0x00EC/0x0050 (512MB)

Reading FLASH address space from 0x00000000 to 0x1FFFFFFF

________________

So, guys with bricked phones without possibility to repair it can have some hope, since our users base gets bigger and bigger.

Hobbyists - i can answer few questions, but not all, since i am not a developer, but only poor manager.

If it could be interesting, i can post few full dumps in next few days. Maybe even some other files. :)
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Wouldn't using them at all be highly illegal? I have no intention of using them at all given that we're clearly not meant to have access to them.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
MicroSD is still about 33% too large, I wish it were that big though!

I could try soldering with a magnifying glass but I'll leave that to a last resort cause I really want be careful with your phone!
[Galaxy S I9000 Q&A, Help & Troubleshooting] Gad13:
How about mini-pci card.

Or you can take a look at http://www.national.com/packaging/parts/ and find a package that fits the best.
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
ok is possible you config a usb on you computer to output exactly voltage to acces to processor phone without jtag connection and get in with hte stock data cable micro usb ?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Unfortunately no. We need access to the JTAG boundary scan circuit. I have spent the last couple of hours trying to fashion a connector out of some sticky tape and some thin copper wires. It's a real pain but I think I'll eventually get something that works.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Zetalai:
There's a kind of marker which write conductive ink

Can't we use that to improvise a adaptor just to give more room for soldering?
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Share the CMM files. and such for all of us.

And tell us how you got the jtag to work. commands etc.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Richthofen:
He is Rocker Team (RIFFBox) staff...
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
Any news dudes?
[Galaxy S I9000 Q&A, Help & Troubleshooting] i-render:
Hohoho, RIFF Box now support repair boot-loader on Samsung Galaxy S !!! :)
[Galaxy S I9000 Q&A, Help & Troubleshooting] aboad20:
by USB or we have to open the phone ?
[Galaxy S I9000 Q&A, Help & Troubleshooting] i-render:
only via JTAG connector
[Galaxy S I9000 Q&A, Help & Troubleshooting] RIFFBox:
Hi,

Thats the wrong pinout. This is just peripheral debug pinout, what is used for JTAG repair is AP pinout. :)

As for repairing, yes, we did released it, though there is much to do.

- Even after replacing boot and sbl in "3button locked" phones, it wont enter download mode anyway. This is np, since in such phones You cannot damage anything in any case, but would be usefull for debranding, though.

- In case where something is damaged during rooting or any other "hack" attempt this will work, by bringing recovery menu on first startup

We found way to manually start download mode using JTAG, but this will be released a bit later. There is still some things to be resolved, and right now i am too tired to explain it all, lol :D

Anyway - now is possible to unbrick phone from any state, though there is trouble in case calibration data get damaged.
[Galaxy S I9000 Q&A, Help & Troubleshooting] kew1701:
Good news,does it still needs riffbox for that?
[Galaxy S I9000 Q&A, Help & Troubleshooting] RIFFBox:
Yes, of course.
[Galaxy S I9000 Q&A, Help & Troubleshooting] mike.sw:
Hi RIFFBox,

small question - does this device require some electronics knowledge?

I mean not a total dummy (understanding what signals means and how to solder or take a part his device f.e) but just a normal guy I suppose?
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
What about benjamin dev.

Any news ?
[Galaxy S I9000 Q&A, Help & Troubleshooting] rhcp011235:
Yea, Id like to see someone do this with a non-jtag box.

Its too expensive for us end-users. to fix one phone. and ESP in the USA.

No one here does jtag.
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Sorry guys, I was away for the weekend so no real progress on my end. I'll be back at it tomorrow though.
[Galaxy S I9000 Q&A, Help & Troubleshooting] takato23:
and this could work on vibrant?
[Galaxy S I9000 Q&A, Help & Troubleshooting] takato23:
helppppppp
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
Any news Benjamin?
[Galaxy S I9000 Q&A, Help & Troubleshooting] Benjamin Dobell:
Sorry guys, I've been really hectic busy for the last week. Also I broke the JTAG adapter I built when I was moving it between computers so I need to go buy a couple of 56 ohm resistors to repair it.
[Galaxy S I9000 Q&A, Help & Troubleshooting] oleg_k:
This is the right pinout of JTAG for i9000 and Vibrant
[Galaxy S I9000 Q&A, Help & Troubleshooting] celtichazard:
Greate Thanks dude
[Galaxy S I9000 Q&A, Help & Troubleshooting] i-render:
what program to flash the phone or to fill a full dump through this interface?
[Galaxy S I9000 Q&A, Help & Troubleshooting] oleg_k:
Any JTAG-programmer that support s5pc110
[Galaxy S I9000 Q&A, Help & Troubleshooting] trashcan:
I am going to get the RIFF box. Will update when I have it on hand.:D