yashsingh1/xdaforums huggingface dataset:
[Galaxy Tab  Android Development] Khoral:
Let's admit all you say works.

When you get to Samsung, what do you think they will give you as a replacement :D Obviously another Tab with a modified bootloader ^^

@paulshields : Well, I don't like to go as loser from the start :D

1 year ago I was already looking into the TomTom (GPS, for those who don't know about it) bootloaders to see if I could modify the settings by modifying bytes in it ^^ And I achieved to do some work on it after many tries :D

But I have to admit, this here is a really big job. There are many data to deal with, and not much knowledge about it (on my side at least).
[Galaxy Tab  Android Development] abuser0815:
Hi guys, l'm quite a bit confused now.

Ok, i actually noticed, that Kies is not able to reinstall my tab even with the registry hack on (guess its for the bootloaders).

But in any case i was able to put any firmware on using heimdall.

The repartitioning i had to do with odin, but firmware were no problem.

So i still can flash another firmware out of jm"x". Its just not possible with odin or kies. But heimdall works great for me.

sent by sgt
[Galaxy Tab  Android Development] paulshields:
I think the question is - can you flash a none-JMx firmware? i.e. one of the stock firmwares with the stock bootloaders and the stock kernel? The warning in this thread is that if you're on a JMx release with the JMx bootloaders then currently you won't be able to flash a stock release, which may be a problem when an official upgrade comes out (for example Froyo 2.2.1 or Gingerbread), and even more of a pain if and when custom ROMs from CM and the like ever get produced.
[Galaxy Tab  Android Development] amf:
Are the files found here safe to use?: http://xdaforums.com/showpost.php?p=9468220&postcount=1

I think they don't have the boot/sbl bin files.
[Galaxy Tab  Android Development] Jackson5:
This is the problem which i now have:

I have flashed my Tab with a Rom, but Odin says "failed".

Now my Tab is dead. No respond in any case.

Is Samsung Service Center the only way to reanimate my Tab?
[Galaxy Tab  Android Development] Khoral:
If they are not present, and if the zImage file is < to 7800kb, then according to CF you have great chance (but not 100%) that it's safe.
[Galaxy Tab  Android Development] Technomancer:
I think somebody would have to start from disassembling the bootloaders and discovering how the signature is verified. From the discussion it looks like the bootloader is responsible for communication with odin/heimdall and it rejects attempts to flash unsigned bootloaders, kernels and possibly other partitions.

If the signature is done properly it will not be possible to reverse engineer it because there will be secret key that only Samsung knows. On the other hand it may be just a checksum designed to ensure file transfer integrity and in that case it may be possible to discover method of checksumming the files.
[Galaxy Tab  Android Development] Khoral:
I don't think it's something as simple as a MD5 or SHA-1, sadly :/

More of the bad (for us ^^) part like a private key signing.

What bothers me is that it's a 128-bytes signing (and not 128-bit). That's quite huge :/

Edit : I said **** I think. If there were a secret key, Odin must know it. So it's not possible. Looking at RSA-1024 now.

Are protected bootloaders flashable via Heimdall ? If yes, then there's no such thing as secret key.
[Galaxy Tab  Android Development] Chainfire:
My own roots never have adbd in automatic root mode either, always through SU. It's not supposed to work this way. Most programs you download should be able to perform through SU. It just doesn't feel right putting adbd in root mode. There really is no reason you should be doing this, IMHO.

You are probably having an USB driver issue for the drivers Kies/Odin use, but heimdall's own drivers are working fine. Either way, if you can flash - even if it is through heimdall - non-JMx firmwares, you do NOT have the protected bootloaders.

If it doesn't turn on at all, if literally nothing happens, the screen remains black, pressing the power button has the same effect as not having pressed it, then you need to go to Samsung Service Center.

Actually, if the zImage included < 7800 kb (and the ROM is actually flashable) then the ROM itself is safe - as a signed zImage is always 7800 kb. Obviously it wont work if you already have protected bootloaders, though.

That may be unclear from the first post. If the zImage == 7800 kb then that DOES NOT guarantee the image contains a signature. But if it < 7800 kb, it DOES guarantee the image does not contain a signature :) In other words, < 7800 kb NEVER has a signature, == 7800 kb MAY have a signature.
[Galaxy Tab  Android Development] Chainfire:
I didn't forget to put an original zImage it in there, XDA wouldn't let me upload with it in there. Sorry but I'm remoting in from a crappy laptop, and everything is a hassle to do :D All important files are included. Just take any zImage from any non-JMx ROM that is around 4500-5500 kb if you want to look at a normal zImage.

Regarding specific locations, see the README included. I can't give you specific locations as to where the checking code is - I don't know. As stated before I didn't have the chance to fully decompile the bootloaders (again, remoting in, @ family, I'm totally packed with family matters all week)

Regarding the signature, I'm not sure if it a cryptographic signature as of yet, or merely a checksum. It is way too long to be MD5 or SHA1. There are a few SHA3 contenders that might be (FNV maybe?) but somehow I doubt that's it. I'm indeed afraid it's key-based. I do know once you have a protected bootloader, the checksum is checked during the flash procedure, same with Odin, Heimdall, and Redbend.

Obviously the protected bootloaders are flashable FROM non-protected bootloaders, but not the other way around. The key checking is done by the bootloaders, not by the flash tools. Odin does not need to know the key at all. As you may have read, flashing actually goes _through_ SBL. EDIT: At least I think so... however with some saying it is possibly through Heimdall, this part may not be true.

Also, take note that not all 128 bytes need to be signature. It could be less with other bytes being pointers. Not saying it is, but I've seen Samsung using such methods before in zImage.

A possible area of attack is indeed just signing our own ROMs. But I'm 99% convinced we can flash the unsigned bootloaders back with a combination of bmlunlock and dd. That's why I asked rotohammer for both BML and STL dumps of x1 and x4 (still waiting). We can write those back, this method bypasses the checks. I'm convinced this is the easiest way and the way we should go.

HOWEVER, we will need somebody with a JTAG unit at the ready to be trying this out, as likely it will take a few tries to accomplish, and if this method fails, the device is a brick only revivable with JTAG. Better safe than sorry, my own Tab is already a brick, don't want to see others!

I would order a RIFF box right now if a Tab connector was available. I don't feel very confident doing it without one of these connectors, though. But I still may end up ordering one :) As I said before, if I had those tools in hand right now, the problem would already be fixed.

You are completely correct on all points. However you missed the bmlunlock/dd combo that may let us bypass all this nonsense, and simply flash back the old unprotected bootloaders.
[Galaxy Tab  Android Development] abuser0815:
Hi chain...

Previously i flashed jm6 as also jma from samfirmware. I have the issue, that i can flash any jm with odin. Any out of jm odin will not. Tried 20 times at least.

But i can flash every pit with odin. No problem at all.

So i used repartition with a propper pit and then flashed everything else with heimdall.

And i could do it with every firmware. I even was able to flash boot.bin and sbl.bin from another firmware to my device. After this in odin it got stacked with connecting to the device. A short unplug/plug reinitialized the tab connection and i was able to flash other fw's.

sent by sgt
[Galaxy Tab  Android Development] Technomancer:
I see, that could be a lifesaver.

I looked into the files. It seems there is 128 byte signature somehere 4K from the end of both bootloaders and at the end of zImage. 128 bytes is 1024 bits, so it could be 1024 bit RSA signature. Which is pretty much impossible to crack.
[Galaxy Tab  Android Development] Khoral:
I didn't know about that bmlunlock thing, just made a quick search and I'm now learning about BML and STL stuff :D (I really love learning about that kind of thing ^^)

@abuser0815 > Great thing you found there :D

Edit : Ok, stop me if I'm wrong (I probably am, but I don't understand where).

If this is indeed RSA-1024, there must be 2 private keys and 1 public key. Each private key must be known by each part (let's call them PrK1 and PrK2) and public key (PuK) known by both.

Here we know that parts are the PBL and SBL (considering only the start, not zImage by now). So PrK1 must be known in PBL, PrK2 in SBL, and PuK in both.

As we own both files, we're supposed to be able to find those keys somewhere (I don't say it's easy ^^), no ?

And another thing : I'm wondering if there isn't 2 checksums/sign things in zImage. Working on that.
[Galaxy Tab  Android Development] amf:
Thanks! It doesn't have the boot.bin files but zimage is 7.9mb.
[Galaxy Tab  Android Development] Chainfire:
FYI, flashing anything other than boot, sbl, zImage is possible through Odin with these bootloaders. That includes PIT. Can you attach the PIT you used (ZIP it first)

Can someone who has confirmed to be having the problem replicate this behaviour ?

I've tried heimdall as well, it should be using the Odin protocol thus not make a difference. However I cannot be sure that I tested this exact same procedure you did (the brick kinda stopped me working on it). I did try the exact same way as somebody else posted that is very similar to your method, but it didn't work for me, and it didn't work for a number of others.

I'd suggest trying to flash the full JJ4 (including unprotected bootloaders) afterwards (through ODIN) to make certain it worked.

EDIT: In theory, flashing only PBL (boot) and SBL (sbl) through heimdall - if this method works - should be enough to enable ODIN to flash everything again.
[Galaxy Tab  Android Development] paulshields:
Very interesting! Can you flash a stock firmware including bootloaders now?
[Galaxy Tab  Android Development] abuser0815:
Not with kies and not with odin.

But heimdall no problem.

I had nearly everything on now, jj4,jk5 and all jmx, also i tried several provider fw's. All what i found on samfirmwar.

Edit: chain and all, i'm on travel now, i will not be able to attach some zip until tomorrow night when i'm back home. Anyway, it worked with every pit from samfirmware
[Galaxy Tab  Android Development] Chainfire:
Actually, both PBL and SBL only need one public key.

If it is indeed RSA-1024, the signature is probably a XOR-checksum ( or something simple ) encrypted with a private key. The bootloaders can decrypt this by only by knowing the public key, then compare the stored checksum with a checksum they run on the flash contents.
[Galaxy Tab  Android Development] Chainfire:
Can you try flashing a Roto-JMx from Rotohammer (they do not include the protected bootloaders), then flash the CF-Root version for that version ?

EDIT: Through ODIN, obviously, not through Heimdall :)
[Galaxy Tab  Android Development] abuser0815:
Yes, rotos versions works perfect with odin for me.

Just as all jmx.

sent by sgt
[Galaxy Tab  Android Development] Technomancer:
From http://en.wikipedia.org/wiki/RSA

Signing messages

Suppose Alice uses Bob's public key to send him an encrypted message. In the message, she can claim to be Alice but Bob has no way of verifying that the message was actually from Alice since anyone can use Bob's public key to send him encrypted messages. In order to verify the origin of a message, RSA can also be used to sign a message.

Suppose Alice wishes to send a signed message to Bob. She can use her own private key to do so. She produces a hash value of the message, raises it to the power of dmod n (as she does when decrypting a message), and attaches it as a "signature" to the message. When Bob receives the signed message, he uses the same hash algorithm in conjunction with Alice's public key. He raises the signature to the power of emod n (as he does when encrypting a message), and compares the resulting hash value with the message's actual hash value. If the two agree, he knows that the author of the message was in possession of Alice's private key, and that the message has not been tampered with since.

Note that secure padding schemes such as RSA-PSS are as essential for the security of message signing as they are for message encryption, and that the same key should never be used for both encryption and signing purposes[8].

Anyway, since there is no chance we will ever have resources (compute time) to crack 1024-bit RSA I dont think we should waste time on it, especially if alternatives exist.
[Galaxy Tab  Android Development] geek78:
i have tried the redbend_ua tool to flash the old boot.bin and sbl.bin on bml1/bml4 blocks : bricked [lol]

Will try to change the unit later today ....
[Galaxy Tab  Android Development] Chainfire:
Told you not to do it without a JTAG unit present!

You probably wanted to use STL1/4 instead... though not 100% sure on that.
[Galaxy Tab  Android Development] geek78:
I wanted to test what is used with the galaxy S ;) Never mind, this is only my 2nd bricked unit .... Hard to learn ;)
[Galaxy Tab  Android Development] Monrad:
JTAG for Galaxy TAB:

Quite easy if you ask me.

Exchange is not working for me either with JMC, but it could be a problem with my server, I have to test a little more.
[Galaxy Tab  Android Development] rotohammer:
Thats sweet, all inline. I was dreading having to find test points all over the board :)
[Galaxy Tab  Android Development] sedde:
Lets hope we wont have to open the device in order to downgrade our bootloaders, although that i see that not really a lot of dev's are interested in the device yet so progress is a bit slow.
[Galaxy Tab  Android Development] Chainfire:
Any chance some sort of standard connector would work on this ?
[Galaxy Tab  Android Development] Chainfire:
Don't worry, you wont have to open the device to fix this. Either the Heimdall method described a few posts back will work, or we'll figure out a method using bmlunlock/dd (which will turn out to be just a script to run).

Don't mind us :)
[Galaxy Tab  Android Development] Chainfire:
Interesting news, the Chinese JL2 (JL1) just posted on FUS does have new bootloaders, but these are not signed. The zImage however IS signed. Weird.
[Galaxy Tab  Android Development] Khoral:
So they shouldn't be installable (is it even an english word ? xD) over signed bootloaders ?

Or is it possible ? (if yes, how ? :o)

Edit : The smiley for : o sucks :'(
[Galaxy Tab  Android Development] Chainfire:
Well, obviously I can't be 100% sure, but using Odin, I think the bootloaders themselves should not install over the signed bootloaders, but the rest of the ROM - including kernel - will.

Attached the Chinese bootloaders. Guess someone who has the issue could try flashing them (as PDA, no repartition), but it is not without danger.

BTW khoral, could you try this on your rooted Tab and post the result files ? Do you have signed or unsigned bootloaders ?

adb shell su -c "dd if=/dev/block/bml1 of=/sdcard/bml1.bin bs=4096"
adb shell su -c "dd if=/dev/block/bml4 of=/sdcard/bml4.bin bs=4096"
adb shell su -c "dd if=/dev/block/stl1 of=/sdcard/stl1.bin bs=4096"
adb shell su -c "dd if=/dev/block/stl4 of=/sdcard/stl4.bin bs=4096"

adb pull /sdcard/bml1.bin .
adb pull /sdcard/bml4.bin .
adb pull /sdcard/stl1.bin .
adb pull /sdcard/stl4.bin .
[Galaxy Tab  Android Development] Khoral:
Fact is I don't even own a tab xD Only a SGS.

I came here through the XDA portal and got interested in the subject :D
[Galaxy Tab  Android Development] martincm:
Just a quick question, I flashed JM6 through clubtech's post, opened de data file and zImage in that one is 7677kb. Theoretically this means I should be "save" , although I flashed the whole pack (repart, csc, modem, data). Now the thing is don't really need to flash backwards, but future stock updates I really would like be able to flash.

Given the size of the zImage, I can suppose I'm not affected with a signed bootloader? Also I dind't flash any newer JMx over that one, just JM6. Couldn't find any boot.bin either in the .tar files.
[Galaxy Tab  Android Development] Chainfire:
No this is actually a +- 7800 kb zImage... It all depends on how you round it. Unprotected zImage's are around 4500 - 5500 kb.

However if it doesn't include boot.bin and sbl.bin (and I think it doesn't), you're safe.

If you have root, though, can you try adb shell commands posted a few posts above and post the resulting files ?
[Galaxy Tab  Android Development] martincm:
Clubtechs pack in his first post doesn't contain boot.bin or sbl.bin files in the tar file. Although there's modem.bin in the modem.tar but I don't think that's affecting it. I compared to the JM6 from samfirmware.com and this one actually DOES include them, which means imo that Clubtechs JM6 flash should be safe concerning the bootloaders, am I right on this one?

As far as the adb shell commands, I guess I could perform that action (I rooted JM6 with OneClick method and manual install of BusyBox), as soon as I get to a pc which can adb connect me, I'm away from that now. First opportunity will be tommorow after work..... (for my interest, what does adb pull from there then? in other words, which data are you getting outof them blocks ?)
[Galaxy Tab  Android Development] Chainfire:
Yes you are completely right :) Yet another reason to not use SamFirmware (the endless list continues).

The dd commands dump the raw bootloader from your flash chips and saves them to SD card, the pull commands copies them from SD card to computer. We might be able to use those files to flash the originals back :) I could make script a right now to do that, but I want to look at that data first, to make sure I'm doing the right commands. Then it's still the question if it will work, though! Others have tried this method to write them but so far I think all bricked.

If anybody else can run these commands earlier, please do!
[Galaxy Tab  Android Development] rmanaudio:
Great work guys...good progress!

I have a tab with JMC and signed image....let me know how i can help.
[Galaxy Tab  Android Development] J@r0d:
The result of adb shell commande

P1000, JM6 zimage= 7860Ko
[Galaxy Tab  Android Development] Ffej5647:
Hahahaha! Just like the eris leak Rom days. Ahhh we all learn at some point. Best of luck to you all!
[Galaxy Tab  Android Development] Chainfire:
Thanks! bml4 is identical to the protected sbl.bin .. bml1 is different, though. Doesn't seem equal to either org or prot boot.bin's. Will check some more different bootloaders I can find :)
[Galaxy Tab  Android Development] Landroid:
i did this and was able to revert back to JJ4!

I havent tried to flash a full firmware like JK5 but ithink it should work!
[Galaxy Tab  Android Development] Chainfire:
That method didn't work on my Tab, I've tried it. It did somewhat give me JJ4, but I still had the protected bootloaders and the JMD kernel. Who knows, maybe that was my fault, but it didn't work "fully".
[Galaxy Tab  Android Development] taggie:
Chainfire, I have a JMC at&t tab and it's got the same exact file sizes when I do the dumps as J@r0d got. In fact, my paste is letter for letter identical. If you want the files, let me know.

C:\android-sdk-windows\platform-tools>adb shell su -c "dd if=/dev/block/bml1 of=
/sdcard/bml1.bin bs=4096"
64+0 records in
64+0 records out
262144 bytes transferred in 0.020 secs (13107200 bytes/sec)

C:\android-sdk-windows\platform-tools>adb shell su -c "dd if=/dev/block/bml4 of=
/sdcard/bml4.bin bs=4096"
320+0 records in
320+0 records out
1310720 bytes transferred in 0.181 secs (7241546 bytes/sec)

C:\android-sdk-windows\platform-tools>adb shell su -c "dd if=/dev/block/stl1 of=
/sdcard/stl1.bin bs=4096"
/dev/block/stl1: cannot open for read: Invalid argument

C:\android-sdk-windows\platform-tools>adb shell su -c "dd if=/dev/block/stl4 of=
/sdcard/stl4.bin bs=4096"
/dev/block/stl4: cannot open for read: Invalid argument

C:\android-sdk-windows\platform-tools>adb pull /sdcard/bml1.bin .
1790 KB/s (262144 bytes in 0.143s)

C:\android-sdk-windows\platform-tools>adb pull /sdcard/bml4.bin .
2838 KB/s (1310720 bytes in 0.451s)

C:\android-sdk-windows\platform-tools>adb pull /sdcard/stl1.bin . remote object '/sdcard/stl1.bin' does not exist

C:\android-sdk-windows\platform-tools>adb pull /sdcard/stl4.bin .
remote object '/sdcard/stl4.bin' does not exist
[Galaxy Tab  Android Development] Jesterz:
@chainfire,

Silly question, did you try JJ2 with odin 1.3 ?
[Galaxy Tab  Android Development] lux209:
Hi,

I don't know if it helps but I did flash JMA and JMC from samfirmware (so as I understand I have the protected bootloader).

I just tried to flash roto JMC and it worked without any problems, does roto firmware contain signed Zimage ?
[Galaxy Tab  Android Development] Chainfire:
Yes please. Files wil always be the same size!

Nope. Edit: it IS worth a shot though!

zImage from Roto-JMC is the same as original JMC. Its flashable on both types of bootloaders.
[Galaxy Tab  Android Development] taggie:
Here you go Chainfire
[Galaxy Tab  Android Development] daniel.weck:
I suppose I will try this method next time a kernel flashing doesn't work for me (I haven't checked the status of my bootloader yet...but I'm running JMD, and I've probably flashed that nasty bootloader sometime around JM6...)
[Galaxy Tab  Android Development] pakalrtb:
CF please read my statements and tell me if they are all right . I am pretty much sure about # 1,2,3.4 but I am not too sure about #5 :

1) New signed bootloader will NOT allow to flash unsigned Bootloaders

2) New signed bootloader will NOT allow to flash unsigned Kernels

3) Old unsigned bootloader will allow to flash signed Bootloaders

4) Old unsigned bootloader will allow to flash unsigned Bootloaders

5) Old unsigned bootloader will allow to flash unsigned Kernel over a signed kernel

By the way, if it can be of any help I can publish the results of the adb commands to my JJ4/JK5 Tab

P_