yashsingh1/xdaforums huggingface dataset:
[Galaxy Tab  Android Development] paulshields:
Summary of my adventures with trying to get from the JMx firmware to a stock release:

Initial state:

pda: p1000xxjmd
phone: p1000xxjm6
csc: p1000xajmd

uname: Linux localhost 2.6.32.9 #1 Thu Dec 23 13:08:03 KST 2010 armv7l GNU/Linux

Created dd file of bml1 and bml4

cksum bml1.bin
3117839084 262144 bml1.bin

# cksum bml4.bin
3126301213 1310720 bml4.bin

Flashed modem.bin from P1000XXJI4 via Odin.

Result:

PHONE: P1000XXJI4

Flashed rest of the files (cache.rfs, factory.rfs, param.rfs, zImage via heimdall (using Heimdall's USB driver). Didn't have the boot.bin or Sbl.bin files from this release.

Result:

[b]phone ---!---- computer display[/b]

Oops!

Then tried out the tricks already [url=http://xdaforums.com/showpost.php?p=9628555&postcount=35]posted by Sidde[/url].

Reinstalled samsung usb driver and flashed pit file P1_EURO.pit via Odin (had to dig out a Windows box for this bit...).

Result: Device recovered :).

PDA: P1000XXJI4
PHONE: P1000XXJI4
CSC: P1000XAJI4

uname: Linux localhost 2.6.32.9 #1 Thu Dec 23 13:08:03 KST 2010 armv7l GNU/Linux

# cksum bml1.bin
3117839084 262144 bml1.bin

# cksum bml4.bin
3126301213 1310720 bml4.bin

So just as has been stated already by Chainfire, the kernel doesn't look to have been restored, but at least the device could be recovered to a working state. I obviously didn't attempt to flash the bootloaders so they've not changed at all based on checksums. Even so, it does take the device down to a previous firmware release - at least on paper :). When doing a firmware upgrade via Kies it came back with no updates found (though not sure if P1000XXJI4 is behind the current release for the Euro tab).

Anyway, going to play around a bit more as I'm fairly confident that the device can be recovered one way or another (or the third option - return to vendor...). for Chainfire - don't know if you've tried the reflash pit file trick via Odin when in "modem---!----pc" mode but may be worth a stab? I realise you've been playing with bootloaders too so that may not be an option...

[edit]

Had some issues with the downgraded firmware, but was easy enough to reflash with JM6 and move back up again to latest leaked FW, so back in original position, but cest la vie - my current setup is rocking fast (ADW-EX FTW :)) and not missing anything at the moment...;).
[Galaxy Tab  Android Development] jastorino:
robohammer, where can I find your roms?

thanks
[Galaxy Tab  Android Development] infamouskid:
would jtagging be a workaround for this protected bootloader?
[Galaxy Tab  Android Development] Monrad:
Yes but im pretty sure someone will come out with a much easier solution.
[Galaxy Tab  Android Development] Chainfire:
Thanks. Your PBL seems to match acolwill's JK5's PBL. Your SBL doesn't match anything I have at the moment.

All 5 points are correct. As for the adb commands, yes please. The more files I get, the better.

Thanks for the info, it is I had suspected.

Could you also do the ADB commands and post the files, but in your case also including the zImage?

adb shell su -c "dd if=/dev/block/bml7 of=/sdcard/zImage bs=4096"
adb shell su -c "dd if=/dev/block/bml8 of=/sdcard/zImage_recovery bs=4096"

Re: my Tab, if it would turn on, I could do that. modem---!---pc after all is just download mode with a different image. However, my Tab does absolutely nothing due to an interrupted bootloader flash. The only thing that can revive it is a JTAG unit.

Well yes. But there is probably a much easier solution.
[Galaxy Tab  Android Development] rotohammer:
I agree. Heres my thoughts based on what I think I know:

Id think the pbl is too small to do anything crafty, like check signatures on the Sbl, perhaps checksums though. Its job is just is to load the Sbl or, in the case thats hosed, load the Sbl2.

The Sbl is what presents you with download mode, so its in charge of flashing new firmware. In theory we can use redbend to write a new Sbl, and if it fails, Sbl2 should kick in and allow us to still flash back the protected Sbl.

If we can get a new Sbl installed, then we can flash anything back. Still, this is not something I'd ferk around with unless I had a jtag box sitting next to me.

I think its time to order a jatg box for myself and chainfire :)
[Galaxy Tab  Android Development] Chainfire:
I mostly agree. I am not quite sure what sort of checking PBL does, and wether or not SBL really needs to be signed for PBL to load it.

As SBL is in charge of download mode, it could well be the only real checks are in SBL and not anywhere else. However I do disagree that the PBL is too small to do advanced signature checks. At +- 256kb, that is more than enough space for native code to be doing stuff like that. You can fit the native code required to do RSA cryptography in probably 10 kb or less, if you cut the useless cruft usually present in common libraries, and it only needs to do one algorithm.

I'm still divided on the JTAG box. I'd love to have one, and use it on the Tab, but it has to be ordered abroad and I doubt it would arrive before the end of the first week of January. There also doesn't seem to be any JTAG connectors for the Tab available, and with my two left hands I don't trust myself to build one.

Also, as I stated my car broke down, I don't know what thats going to eat from my budget - and even worse - until it's fixed I can't actually drive to the repair center 200 miles away (great timing, breaking at the same time, shees, and during the holidays so both are hard to get fixed quickly :D)

Fully agree a JTAG unit would be needed before messing with this stuff, though!

Wouldn't redbend go through SBL to flash, though? Been wondering at this. The problem with writing BML4 directly is that we don't know for sure if the blocks are properly aligned (right?) and we can't write to STL4. Strangely enough, some of the BML4 dumps I've received do match completely with SBL.BINs I have (though not all), but not a single BML1 dump I've seen matches any BOOT.BIN I have, and no two BML1 dumps I have match eachother either.
[Galaxy Tab  Android Development] eitama:
I have read the whole thread with great interest, I don't own a tab, but the situation is intriguing.

Chainfire,

I hope you get your TAB fixed.

I'm a little alarmed by this happening, What's to prevent Samsung from release the next Galaxy S firmware with these so called protected bootloaders?

I think many people actually do buy android phone to be capable and play with the core software - Why would they do such a petty thing?
[Galaxy Tab  Android Development] sanderh:
Hi,

I ve been on vacation for a couple of weeks and just came back home and read this topic. I would like to know if I have a problem/not and how to find out if I m in trouble:

My Tab is a SIM-lock free EU (Netherlands) tab with JM6 installed on it. This was installed 'the old way' with Odin 1.7.

PDA: P1000XXJM6

PHONE: P1000XXJM6

CSC: P1000OXAJM7
[Galaxy Tab  Android Development] Unimaginative:
I suggest you read all of the OP...

...as well as the rest of the thread.
[Galaxy Tab  Android Development] Landroid:
I have another idea:

If u flash JM6/A/C/D/E without repartitioning, wouldnt there be not enough space on the sbl and pbl partition, and the protected bl's aren't flashed?
[Galaxy Tab  Android Development] Technomancer:
No.

Signed and unsigned PBL and SBL are the same size.

Most likely after repartition SBL is wiped out and booting defaults to backup copy of SBL (which is never changed during any flashing and) which allows flashing of unsigned PBL, SBL and kernel.
[Galaxy Tab  Android Development] FredBE:
Thanks ChainFire ;)

I wanted to post such warning for JM* Bios a long time ago but like others I didn't bother...

Another warning is maybe:

If you have Kies compatibility (it says your firmware is the latest already or you can upgrade, ...) and want to keep this compatibilty -> Do not flash any Bios at all. Only use Kies to upgrade your firmware or you won't be able to upgrade using Kies anymore.
[Galaxy Tab  Android Development] Jesterz:
@chainfire

You have to excuse me, as i'm coming from years of HTC hacking, and i'm getting up to speed with this samsung stuff, however I noticed that the tab can use update.zip to update the firmware.

1. have you tried downgrading use this to see if it "just works"

2. on the HTC devices they protected these kinds of downgrades later on (with CID/SPL protection, sounds like SPB ;) however we bypassed this by using what is called a goldcard, basically a specially prepared SD card which bypasses the SPL protection.

More reading on my old thread here:

http://xdaforums.com/showthread.php?t=572683

and if you really like your history:

http://xdaforums.com/showthread.php?t=285346

Edit:

At some time there even was this tool created to prepare a goldcard without too much messing around.
[Galaxy Tab  Android Development] sanderh:
kan en van de heren uit Nederland actief in dit topic mij op weg helpen hoe te checken of ik met een probleem zit ja/nee?

Ik heb de beginpost al doorgenomen maar mijn Engels is niet goed genoeg en zeker niet het technische verhaal uit de startpost waar ik niets van begrijp.

Wellicht kan iemand me stap voor stap uitleggen hoe te checken of ik met een probleem zit.

Ik heb momenteel een Nederlands model Tab met daarop geinstalleerd JM6 welke ik volgens de 'oude' manier heb geinstalleerd via Odin 1.7. (er zijn naar verluid 2 manieren in omloop en ik heb het volgens de eerste manier gedaan).
[Galaxy Tab  Android Development] Chainfire:
Are you sure about that ? I don't think repartition touches PBL and SBL at all. Though I am by no means sure if that is the case.

I'm not an expert on update.zip's, but normally these just contains files that update /system and such. Update.zip's that actually flash stuff I think just use redbend to do it. But someone will likely correct me on this. But no, I have not tried.

As for goldcards, I don't think there is an equivalent on these Samsungs. We can write to the flash blocks where SBL and PBL are located already though... Just not in a way that boots yet :)
[Galaxy Tab  Android Development] Kamaal:
Can we succesfully flash, with heimdall, all except boot.bin sbl.bin and hidden.rfs avoiding to fix the Galaxy Tab on the flashed firmware? :confused:
[Galaxy Tab  Android Development] Joao Oliveira:
Hello,

I have successfully downgrade from jm6 to jk5, so I guess it mean my device didn't have the protected bootloaders :D i

Installed jj4 first which is a full rom. this contained bootloader inside but I'm guessing these are unprotected and also make a full system reset including formating the internal sd card (I'm glad had done a full backup to dropbox with titanium :P) then installed jk5 and everything is working fine.

I will stay with this version until everything is sorted out.

all the best and keep up the good work.
[Galaxy Tab  Android Development] weichei:
Xxjid -> xxjm6 -> xxjk5 -> XX???

So my EU-Tab came with XXJID to me out of the box

Read some stuff about flashing new roms and so decides to flash JM6 via ODIN1.7. Using "repatition ON".

Everything went well. My tab booted full reseted with all three parts under *#0000# set to jm6.

Than heard about, that there was an regular "update" for unbranded EU-tabs via kies to JK5 for all tabs having older official roms. So flashed JK5 manual via ODIN1.7 with repatition OFF. than had a fully flashed JK5 with all apps installed on JM6. Kies than says "you have already latest firmware".

So far I am glad that I could went back to JK5 even I would love to flash JMD/JME!
[Galaxy Tab  Android Development] sanderh:
I ll ask it again because I ve read the starting post a few times now but for a noob like me I can t figure out how to exactly handle correct in order to flash back to the original JK5.

I m on JM6 at this moment and I did this the following way:

1.

First I had my EU original Tab which came with XXJID

2.

I flashed it to JJ4 through Odin 1.7. More specific I did this with:

*Select PIT file: P1_add_hidden.pit

*PDA: P1000XWJJ4-REV03...md5

*PHONE: MODEM_P1000XXJID.tar.md5

*CSC: GT-P1000-CSC-SERJJ2.tar.md5

*Kept checkboxes next to pda,phone,csc crossed

*Selected Repartition, Auto Reboot and F.Reset Time

3.

I flashed it to JK5 through Odin 1.7. More specific I did this with:

*Only selected the PDA file: P1000OXAJK5.tar checked the box next to it on

*Did not selected Pit,pda,phone,csc files

Selected Auto Reboot and F.Reset Time. Did *not* selected re-partition

4.

I flashed it to JM6 through Odin 1.7. More specific I did this with:

*Hard resetted (factory reset)

*Used Odin 1.7 with NO repartition and flashed P1000OXAJM6_PAR_.tar

*Once the flash was done, the device booted into download mode. Then I flashed dbdata.rfs.tar through Odin, again with NO repartition

*Did another factory reset

5.

After the JM6 upgrade my PDA and CSC field (checking with *#1234#) where empty, only PHONE showed XXJM6.

So,

6.

A solution for this empty PDA and CSC came from user risq:

http://xdaforums.com/showpost.php?p=9482192&postcount=106

After this I am where I am at this moment:

PDA: P1000XXJM6

PHONE: P1000XXJM6

CSC: P1000XAJM6

So what are the steps I need to do now?
[Galaxy Tab  Android Development] Jesterz:
@sanderh

the JM6 your flashed P1000OXAJM6_PAR_.tar

comes with the checksum check bootloader (boot.bin & sbl.bin)

so welcome to the club, you are "stuck" with this bootloader and kernel until we find a way around this.

you can still change firmware/modem/csc but you are stuck with the kernel (zimage) and bootloader
[Galaxy Tab  Android Development] sanderh:
thxz voor je reactie ;)

what do you mean by ''can still change firmware/modem/csc''?

and how do I check my kernel and bootloader?
[Galaxy Tab  Android Development] jnutz:
I think the best option is to just brick it and take it back for a new one. I know that sounds sleazy but then again sneaking a locked bootloader in there was also sleazy. I wonder what the best way to brick this TAB is so it doesn’t turn on or go into download mode anymore. Just fubar the bootloader? I want to make sure there is no way they can tell it has a non standard ROM on it so it needs to be bricked good.
[Galaxy Tab  Android Development] pakalrtb:
CF, these are the files from my ADB commands. I am on JM6 coming from JJ4>>JK5>>JM6. Note that PBL and SBL are from JJ4 , since both JK5 and JM6 PDA archive did NOT contain them.

P_
[Galaxy Tab  Android Development] lux209:
For the moment it is not really a problem to have a protected bootloader, we can use the latest and most stable release. We will see if future official release will be compatible with the bootloader or if somebody find a way to bypass it.
[Galaxy Tab  Android Development] jnutz:
I would like to have Clockwork working at some point and that won't be possible with this locked bootloader.
[Galaxy Tab  Android Development] paulshields:
For now I think you're right. May as well enjoy using the device even if it has a JMx firmware and bootloader. Personally I'm loving it, and don't need to change things that much (apart from the obvious like install a good launcher (ADW-EX) and browser (Miren)). This device rocks :).

There will probably come a time when devs produce new rom's and kernels that will be tempting, but that's a marginal issue for me at the moment. I suspect that Samsung may well encrypt future bootloaders officially so we may all be in the same boat soon enough. I'd be surprised if they've done it just for the test roms that have been found on fus... In which case, a general method of either decrypting or bypassing these bootloaders would be necessary for any future custom roms.
[Galaxy Tab  Android Development] Chainfire:
It is a problem for me... A device without ClockWorkmod is... ARGH ! :)

CWM from the CF-Root thread is fully functional, btw, in contrast to the ones from Koush himself (last I checked).

As for future ROMs, interestingly enough, the latest Chinese JL2 does have a kernel that can be flashed on protected bootloaders, but the bootloaders included themselves are not protected.

Might be the case that these are tests for carrier-based ROMs, in other words, that carriers want their Tabs locked down, and that the international non-branded versions will never see the locked bootloader in official releases. It's all just guesswork right now, though.
[Galaxy Tab  Android Development] a1jatt:
Looks like we will need a patched HSPL to bypass sign checking like good old windows mobile.

On WM we had to load SSPL in memory and execute that to temporarily bypass sign checking to load patched HSPL.

if on android we can patch/edit files (spl, boot.bin ) flashed in memory then it should be much easier.
[Galaxy Tab  Android Development] Chainfire:
SGTBootloaderCheck

Added SGTBootloaderCheck to the first post. This Windows tool will help you determine what sort of bootloader and kernel you have, but does require root and an ADB connection.

Hope it works :)
[Galaxy Tab  Android Development] paulshields:
Useful tool Chainfire - thanks :).

My output:

========================================================
= Samsung Galaxy Tab Bootloader Check v1.0 =
= Copyright (C) 2010 Chainfire =
= =
= Please make sure your device is connected, rooted, =
= and USB debugging is enabled ! =
= =
= Accept the SuperUser prompt when it shows up ! =
========================================================

Press any key to continue . . .

========================================================
= Dumping PBL, SBL and kernel ... =
========================================================

su
rm /sdcard/bml1.bin
rm /sdcard/bml4.bin
rm /sdcard/bml7.bin
dd if=/dev/block/bml1 of=/sdcard/bml1.bin bs=4096
dd if=/dev/block/bml4 of=/sdcard/bml4.bin bs=4096
dd if=/dev/block/bml7 of=/sdcard/bml7.bin bs=4096
exit
exit
$ # # # # 64+0 records in
64+0 records out
262144 bytes transferred in 0.011 secs (23831272 bytes/sec)
# 320+0 records in
320+0 records out
1310720 bytes transferred in 0.050 secs (26214400 bytes/sec)
# 1920+0 records in
1920+0 records out
7864320 bytes transferred in 0.298 secs (26390335 bytes/sec)
# $
========================================================
= Retrieving files ... =
========================================================

5817 KB/s (262144 bytes in 0.044s)
5953 KB/s (1310720 bytes in 0.215s)
5009 KB/s (7864320 bytes in 1.533s)

========================================================
= Here come the results ... =
========================================================

SGT-BootloaderCheck v1.0 - Copyright (C) 2010 Chainfire

boot.bin: SIGNED !
sbl.bin: Unsigned
zImage: SIGNED !

Assessment:
-- Bootloaders: Protected, can only flash signed bootloaders and kernels
-- Kernel: Signed, can be flashed on all bootloaders

Press any key to continue . . .
[Galaxy Tab  Android Development] Chainfire:
Very interesting that your SBL appears to be unsigned. Can you post boot.bin and sbl.bin (which are now in the SGTBootloaderCheck folder) ?

Also, can you try flashing CF-Root for your kernel and see if Odin produces the error ?
[Galaxy Tab  Android Development] paulshields:
Attached are my boot.bin and sbl.bin files. Will look into the CF-Root stuff later...
[Galaxy Tab  Android Development] Chainfire:
Thanks. Very interesting!
[Galaxy Tab  Android Development] paulshields:
ok -just for you :) I flashed the CF-Root kernel (JMD-c1.4) via Odin.

Result:

<ID:0/005> Added!!
<ID:0/005> Odin v.3 engine (ID:5)..
<ID:0/005> File analysis..
<ID:0/005> SetupConnection..
<ID:0/005> Initialzation..
<ID:0/005> Get PIT for mapping..
<ID:0/005> Firmware update start..
<ID:0/005> zImage
<ID:0/005>
<ID:0/005> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

After that I ended up with the "modem----!----computer" screen. Luckily I've been there before, so just flashed my Euro pit file and the device came back as it was before with everything as it was before. Rerun your bootloadercheck script and it was as before.
[Galaxy Tab  Android Development] RWOLUPO:
i'm ****ed ... everything is signed :/

scheiss neugier :D
[Galaxy Tab  Android Development] paulshields:
Look at it another way - you're running the latest firmware which imho is better than stock, and as there's currently no custom alternative you're actually in the best situation :D.
[Galaxy Tab  Android Development] jnutz:
Until you want to use Clockwork that is.
[Galaxy Tab  Android Development] paulshields:
Clockwork is screwed for me anyway. I'll avoid that for now thanks :).
[Galaxy Tab  Android Development] patomas:
Me too

Everything signed here too....:(
[Galaxy Tab  Android Development] pakalrtb:
-Unsigned

-Unsigned

-Signed

As expected, I am good to go.

My noob question is : if I want to upgrade from my good JM6 config to JMC/D/E can I just strip the PBL and SBL out of the archive, and how do I do that ? Is it as simple as unpacking the archive and repacking it without the BLs ?

P_
[Galaxy Tab  Android Development] chinchikurin:
I am still running JK5 so, as expected, the boot loader check returned "unsigned" for all three components.

Interestingly though, my zImage file is 7864320 bytes. This deviates from a 4000-5000kb file that is deemed to be normal. Also, the last part of my zImage file is a bunch of FFs.
[Galaxy Tab  Android Development] elvitas:
Hi,

I have root my Tab and accept SuperUser but i get these message...why? :confused:

su

rm /sdcard/bml1.bin

rm /sdcard/bml4.bin

rm /sdcard/bml7.bin

dd if=/dev/block/bml1 of=/sdcard/bml1.bin bs=4096

dd if=/dev/block/bml4 of=/sdcard/bml4.bin bs=4096

dd if=/dev/block/bml7 of=/sdcard/bml7.bin bs=4096

exit

exit

$ # rm failed for /sdcard/bml1.bin, Read-only file system

# rm failed for /sdcard/bml4.bin, Read-only file system

# rm failed for /sdcard/bml7.bin, Read-only file system

# /sdcard/bml1.bin: cannot open for write: Read-only file system

# /sdcard/bml4.bin: cannot open for write: Read-only file system

# /sdcard/bml7.bin: cannot open for write: Read-only file system
[Galaxy Tab  Android Development] rotohammer:
That is because 7864320 is the size of the entire partition, which is what you get when you dump the Zimage. Its padded with FF's for the last 3kbytes or so.
[Galaxy Tab  Android Development] msgfromside3:
Did you mount your sdcard to windows?
[Galaxy Tab  Android Development] elvitas:
I dont know. How can i check / do this?

... Add by Tab with XDA-App ...
[Galaxy Tab  Android Development] WhoWithTheWhatNow?:
Hi all,

First off, just wanna thank you guys for all the hard work..especially for us who are either "noobs" and/or who flashed JM6 without really knowing what they were getting into (both choices, like myself)

Now, here is my situation:

Got a Euro Tab, the original FW was P1000BUJI4 (Vodafone Spain)

After wanting to get rid of all possible limitations due to be, as we say here in Spain, "Vodafonizado", I decided to check around and found a fourm here from Spain giving exact instructions on how to flash.

Unfortunately, I flashed what is now the dreaded JM6, meaning I can't flash back to a "original" FW (or I think it is, which is why I am posting here).

I must stress, I made a direct jump from P1000BUJI4 to JM6 (if this info helps anyone out)

Now, what the steps I used to flash were the following, using Odin3 1.7:

Marked the following checkboxes:

Auto Reboot and F. Reset Time

As well, I did not use PIT but loaded the following files in their respective sections:

PDA: CODE_P1000XXJM6.tar.md5

Phone: MODEM_P1000XXJM6.tar.md5

CSC: CSC_P1000OXAJM6.tar.md5

Everything went great, Tab is working perfectly fine.

Now my question is (and sorry for going on and on) is...

Can I downgrade and return to an official Tab FW or not?

I have read every page of this thread and , to be honest, too much scientific lingo going around and I don't understand a word of it, so if anyone can give me a shout out and leave my mind at ease one way or another, I would greatly appreciate it!

BTW, I never rooted my Tab, if it helps anyone out.

Thanks to anyone and everyone who can help me out here!