yashsingh1/xdaforums huggingface dataset:
[Galaxy Tab  Android Development] Chainfire:
Now I can understand you haven't been able to catch up with everything that has been said in every single page. However, the bmlunlock thing is mentioned even in the first post. Also, you could have tried "searching this thread" for bmlunlock, which would give you many references to it. As an FSM, both should have occurred to you. ( :P )

As for current status, nothing yet. There isn't much that I can do without an operational Tab.

Regarding resources, pooling, and people, there's enough people on the job. Right now it's just a bit of a waiting game for everyone to get their equipment in order to start testing. I'm still analysing a lot of dumps myself, trying to figure out some things about the BLs. Rotohammer is on the job and waiting for his RIFF BOX (JTAG unit) to arrive. Richthofen is waiting for a Tab + RIFF BOX to help figure this out (expected within days), and also going through the tech docs trying to figure out how to make a "factory mode" JIG (quite similar to the "download mode" JIG for SGS) which can possibly revive my Tab. In the meantime, Da_G has offered to ship his own JTAG unit + tools to me, and if Richthofen's "factory mode" JIG doesn't work out, I'll take Da_G up on this offer. Da_G and cmonex' expertise is also just an IRC connection away should I need them :)

Really, we have enough people on the job with enough knowhow to fix this, and I don't expect the fix is much more than a week or so away. Right now everyone is pretty much just waiting on the hardware to allow testing in a safe way.

I'm not sure what's wrong with the SBL, I've analysed one of these unsigned SBLs between signed PBL and kernel, and it does actually seem to be unsigned. Maybe it's sneakily using SBL2, or the bml dump got garbled (blocks out of order) which is also completely possible. There's some weird stuff still with the PBL dump as well, hopefully we'll figure out soon why/what/how.

I've looked a bit at redbend (not very extensively), do you know how to flash multiple parts without rebooting ? Also of course we do not know whether flashing through redbend involves the checks.

That's just a very elaborate way to flash a different ROM

without

replacing PBL, SBL and kernel. Has been discussed before in this thread.

The "Could not Find ..." is because the script deletes old files (if present) before transferring the new dumps. The first time you run it, there won't be any old files present, hence the error message trying to delete them.

Interesting. It has been attempted to flash both bml1 AND bml4, resulting in full bricks. Maybe both need to flashed in order to make any difference stick ?

But really people, STOP TRYING TO OVERWRITE BML1 AND BML4 IF YOU DO NOT HAVE A JTAG UNIT AND KNOW HOW TO USE IT. If you mess it up, only a JTAG unit (or possibly a "factory mode" JIG) will be able to revive your device.
[Galaxy Tab  Android Development] sprecker:
Wow! 22 pages of some hard working people. Keep it up guys! :)
[Galaxy Tab  Android Development] Ilia_Z:
Hi Happy New year!

Help me please, I brick my tab

I have T-mobile with JJB firmware version and try to load full(with PIT)

russian ver P1000XWJJ7 via Odin 1.7 (Im from Russia).

After start I wait long time with no result, then I power off my tab

and now see "PC -!- phone" pic only. No download mode,

but if I press both vol bat and plug USB I see

"Power rest or Unknown upload mode" and Odin see my tab.

What I sould do to unbrick my tab?

Help me please
[Galaxy Tab  Android Development] rotohammer:
Flash Roto-JME to get back to a working state, then decide what you really want after.
[Galaxy Tab  Android Development] joeearl13:
Thanks for all your hard work guys. Got my Tab a few a weeks back but held off flashing for a while to take some time to read up on it all. Thanks to your info I successfully flashed up to JMC from T-Mobile JJ3 (UK) a few days back without getting a signed boot.bin or sbl.bin, and am now going to flash Roto's JME.
[Galaxy Tab  Android Development] falan:
It's possible to use this, to install the ClockworkMod Recovery and come back to unsigned firmware with nandroid backup?
[Galaxy Tab  Android Development] Landroid:
what does it mean if sbl.bin isn't signed, but kernel and boot.bin are!

am i affected?
[Galaxy Tab  Android Development] pakalrtb:
It means that you are f...d . Kidding aside, your SecondaryBootLoader isn't signed , but as long as the Primary Bootloader (boot.bin) is signed you will not be able to flash unsigned kernels.

P_
[Galaxy Tab  Android Development] Technomancer:
Sbl is responsible for flashing and loading kernel. And the signature detection for pbl is little flaky so some are reported as signed even if they are not. So he is just fine.
[Galaxy Tab  Android Development] sprecker:
Edit:

Finaly got it. Phew, that was a lesson. Thank god I don't do anything "real' with my tab. :) Thanks everyone for the info.

As it turns out I am all signed. :( Oh well. Just wait and see if the usual brains will get this fixed. Still glad I live in a time where I can worry about a 7" tablet and not how much food costs. :)
[Galaxy Tab  Android Development] cylent:
if you're in the market for a new tab and goto the store ... on the about screen what do you check for so its not this jm6 firmware?
[Galaxy Tab  Android Development] masterludo:
Happy New Year everyone!

Quick feedback on my output:

boot.bin: Unsigned

sbl.bin: Unsigned

zImage: SIGNED !

I flashed JM6 from samfirmware a couple weeks ago after receiving my tab. I'm just wondering why some people seem to have flashed the same firmware from samfirmware but have signed boot and spl and I don't...
[Galaxy Tab  Android Development] joeearl13:
None of the Tabs you can buy run JM6 or any other JM version. It's a development build.

But just dial *#1234# to see the firmware version.
[Galaxy Tab  Android Development] acolwill:
There were two leaks of the JM6 build.

I'm guessing the second leak had the signed bootloaders
[Galaxy Tab  Android Development] doloop:
some people use heimdall to flash rom, with this tool you can ignore completely sbl and pbl flash, amongst other reason for having jm6 and not being locked.
[Galaxy Tab  Android Development] heythorp:
Excuse my ignorance i realise jm6 is a dev build but what is on it? Honeycomb?

Thanks
[Galaxy Tab  Android Development] joeearl13:
Still 2.2, not even 2.2.1. Just a more optimized version of the currently available official ROMs really.
[Galaxy Tab  Android Development] crazylemon:
why would samsung sign the bootloaders in their dev builds? I'm guessing that some developpers, testers and reviewers are using dev builds to do their stuff, so they too would not be able to go back to an official fw. And if samsung releases an official build with gingerbred and without signed bootloaders, what about the following 2.3 dev builds, they must have the signed bl again, otherwise it makes no sense. or the official fw will get signed bl as well...

however, I know someone will figure out how to solve this problem. maybe we should collect money to motivate people ;)

***if you find spelling errors you can keep them :D***
[Galaxy Tab  Android Development] joeearl13:
Most likely Samsung is developing the feature for carriers - many carriers, especially US ones - would like to prevent the flashing of custom/unofficial ROMs or even official ROMs that are not for that specific carrier, in order to protect the integrity of their network (and also disable inbuilt OS features and then you charge you more for them - I hear some of you in the US have to pay extra to use that Hotspot feature on the Tab/other devices, luckily here in the UK it comes as standard).

So although these bootloaders will probably not make it onto unbranded, unlocked Tabs, they may well be included in carrier-specific firmware versions.

In some ways, the networks do have a point - just last week a few $9 Motorola phones with hacked firmware were used to crack the entire GSM standard.

However for our sakes, let's hope the signed bootloaders don't become widespread.
[Galaxy Tab  Android Development] Unimaginative:
We can always pray for a 'Nexus Tab'. oemunlock banzai.
[Galaxy Tab  Android Development] hobbit19:
during the study, I found that boot., sbl., zImage signed using RSA 1024
[Galaxy Tab  Android Development] Chainfire:
That is indeed we have suspected... how did you confirm this ?
[Galaxy Tab  Android Development] Volker1:
Not true, the A5/1 encryption used in GSM has been broken for at least 5 years. All thats new is that its now a bit cheaper to listen in on your neighbors.

The A5/3 successor is still not the default (no thanks to the carriers here). And the friendly people at the NSA have been chuckling about what you say on the phone all the time...
[Galaxy Tab  Android Development] Infos3c:
You've got this exactly backward - if the phones hadn't been flashable with custom firmware, the uber-hackers would not have been able to prove that the GSM Alliance and networks were naive and lying when they said that a GSM hack was not practical for joe hacker.

The networks should be natively protecting their networks (not my equipment) from illegal (and only illegal) activity - not just stuff they don't like. They should not be locking down the phones except for general users to prevent malicious viruses and inbound attacks; an easy root that requires local access and specific intent like is available for the n1 or sgs should be mandatory by law - in order for owners of equipment to be able to fully utilize said equipment.

The US Supreme Court just ruled that it is NOT illegal in the US to jailbreak/root, but unfortunately they didn't go so far as to REQUIRE the ability.
[Galaxy Tab  Android Development] johan8:
(maybe it is OT)

I would like to crack the Ti code from Comp128V2/3 and USIM....

Just want to clone my own Simcard.

But no such equipment available in the market.

Back to the topic..

For those signed firmware, is it possible to flash w/o the signed new bootloader ?
[Galaxy Tab  Android Development] Chainfire:
Yes, the firmware itself does not need the boatloaders. Roto's releases simply have the bootloaders removed -> away goes the problem.
[Galaxy Tab  Android Development] joeearl13:
What I meant was - without the ability to put custom firmware on devices, such as the Moto phones, it would still cost somewhere near $5000 or so it used when the researchers released their original crack.

Hacked/custom firmware didn't make it possible, I agree, just easier. So stopping hacked firmware doesn't stop the problem, but it does make it more expensive and less-used and hence less visible to the general public which is all the carriers care about.

But the firmware hacking was a good thing, I agree, because now hopefully they will upgrade their encryption. Was just coming at it from the carriers POV ^^.

However you have to see that it is *impossible* to fully secure their end (although moving to a useful encryption algorithm is something they can do), and thus it's not ridiculous to attempt to ensure that all devices that connect are forced to obey certain restrictions and security protocols by preventing their hacking.

Back on topic: anyone noticed any new firmwares out there?
[Galaxy Tab  Android Development] julianLo:
Well thats exactly the kind of thinking that led to those insecure networks in the first way.
[Galaxy Tab  Android Development] msgfromside3:
Actually, I would ask if anyone has figured out hacking/disabling/overwriting this signed bootloader. :)
[Galaxy Tab  Android Development] hal:
@Chainfire

As discussed in PM please find the following

- Boot.bin from JJ4

- SBL.bin from JJ4

- zImage from JM6

My upgrade path was JJ4 -> Jk5 -> JM6 without BL.

Hope this helps,
[Galaxy Tab  Android Development] pakalrtb:
Any update ? Roto said he received his JTAG ? Did any of you cracked the device open yet ?!?!? :D:D:D

P_
[Galaxy Tab  Android Development] rotohammer:
No, the jtag manufacturer now has a problem restoring Tabs, so I have to wait for them to fix that before I brick my tab.

Once again, not being hasty has saved my Tab.
[Galaxy Tab  Android Development] Monrad:
Roto, what's the first step you're going to try on your tab?
[Galaxy Tab  Android Development] rotohammer:
Flash back a dumped sbl

Flash back a dumped pbl

Flash a protected sbl, and try to overwrite it by any means

Flash a protected pbl, and try to overwrite it by any means
[Galaxy Tab  Android Development] MecoMan:
Rotohammer, very thanks for sharing your work with all of us, are grateful! :)
[Galaxy Tab  Android Development] Monrad:
I wonder what would happen if I try to force an update through KIES. The problem is that I need a device with an available upgrade in order to export data from the registry and import it to mine.
[Galaxy Tab  Android Development] Landroid:
What does it mean if my pbl is signed but my sbl not? The zimage is signed too!

If the sbl checks the signatures, and it isnt signed, why cant i flash unsigned zImages? Does the pbl maybe the checking?
[Galaxy Tab  Android Development] t0dbld:
@Roto

hay which site did you order yours from i think im going to order one so i can work on a aosp honeycomb rom as htc said sdk and source will be out in few weeks today, i also imagine that i will brick my tab a few times in this process so.. anyhow noticed your in jersey and im in detroit so where ever sent you one could prob get it this far as well :-)
[Galaxy Tab  Android Development] dbma:
Screen resolution

Hi guys, after my update for jm6 my screen définition is very very ugly, the definition or the docks icon like a 16 million colors... i am alone with this problem?

now i'am on jk5 after downgrade from jm6.

jm6 to jk4 to jk5
[Galaxy Tab  Android Development] abuser0815:
Kies will fail if you have signed bootloaders.

I tried it a lot of times and it stops for the same reason odin stops.
[Galaxy Tab  Android Development] Landroid:
any answers for this?
[Galaxy Tab  Android Development] maxtcee:
federaly f**ked
[Galaxy Tab  Android Development] rotohammer:
I ordered the RiffBox from ipmart in Malaysia. Impressive service, I had it in 3 days shipped from China. The only problem is that their GT-P1000 support is broken in that you can flash their "bundled" bootloader to the Tab, but it wont boot because I think the included bootloaders are the wrong ones. They don't let you specify the bootloader file externally, they include it locked away in an app dll file, which is lame. As soon as I feel they have the issue worked out, I'll brick my spare tab and restore it, then post my results. Until then, hang tight.
[Galaxy Tab  Android Development] Chainfire:
Still unsure, every answer to this is still speculation. We'd have to find somebody with an unsigned PBL and signed SBL to make sure which checks which.

Also keep in mind it may be the case that the dumps have blocks garbled around (in other words, the dumped bytes are not 100% sure to be guaranteed to be in the right order) so that may be the reason the tool does not detect it being signed.

Frankly we're just not sure at the moment, so far it appears that if either if the bootloaders is signed, you can't flash unsigned kernels.

However, from the strings extracted from the bootloaders, they do indeed seem to say that PBL checks SBL, and SBL checks zImage. Maybe SBL checks PBL as well, and then checks for signed zImage if PBL is signed, even if SBL itself is NOT signed ?
[Galaxy Tab  Android Development] daemonstar:
Hi Everyone, and dbma, you're not alone, I'll confirm !

I can't post links to show the horrible quality of my screen ...

But I feel like from 24 bits to 16 bits.

And colors became very dark, even all the parameters maximum

But I had no worries or JJ3 JK5.

Only after the update JM6.

And more strange, many App ang Games have no resolution problem.

I'm really disappointed !

(sorry for this "ninja" link, but its to see the problem)

img52.imageshack.us/img52/5722/sc20110105025716.png

In addition, my battery drains at incredible speed!

About 5% every 10 minutes in "normal" use ...

My GT infos:

PDA: P1000XXJME (by roto)

PHONE: P1000XXJMA

CSC: P1000XXJME

Modèle: GT-P1000

Version: 2.2

Kernel: 2.6.32.9 root@SEI-28 #1

N° de Version: FROYO.XXJME

I tried the ROM following: JM6 / JMA / JME (by Roto)

and the problem is the same everywhere...

Anyone have a idea?

PS. Sorry for my ugly english .... :(
[Galaxy Tab  Android Development] RWOLUPO:
not really, but: this thread seems not to be the correct thread for your question, isnt it?
[Galaxy Tab  Android Development] daemonstar:
As my problem was common to versions JMA JM6 JME, I thought it was the right thread to post ... I may be wrong!

If so, I apologize!
[Galaxy Tab  Android Development] msewidan:
Would that work for the tab?
[Galaxy Tab  Android Development] mauwri37:
no boot signed!

:o bootloader : signed

kernel : signed :(
[Galaxy Tab  Android Development] bunny0007:
Yep have testet it.

We are able to do that, and have an working adb from recovery console :)
[Galaxy Tab  Android Development] sprecker:
What is the purpose of doing that BTW? Just curious.
[Galaxy Tab  Android Development] Landroid:
Does anyone have tried to restore an unsigned nandroid backup via this recovery method? If not, could anyone upload an unsigned nandroid, if we can get into recovry with this method i'll restore it immediatly!
[Galaxy Tab  Android Development] rmanaudio:
Does nandroid backup the bootloader and zimage?
[Galaxy Tab  Android Development] drno74:
unsigned nandroid

Is it possible a unsigned nandroid over the signed bootloader ?

I have the version before flashing a xxjp nandroid made from my original firmware (unsigned). Can I play this back again?
[Galaxy Tab  Android Development] Chainfire:
Tab CWM can restore kernel, but probably not on signed bootloaders. Also, Tab CWM needs a special kernel, which you can't flash. The SGS CWM that can be used by the recovery 2e trick, does not restore kernel.

So no, all of this will 99% sure not work.
[Galaxy Tab  Android Development] Landroid:
we should definately try, but in the nandroid backup, there is only a boot.img, which only contains the kernel (i think)! this would mean we'd need to release roms in form of a nandroid backup! this sucks...
[Galaxy Tab  Android Development] rmanaudio:
I really dont think there is a way to unsign a signed bootloader...just look at motorola...it is locked down pretty damn good.

I'm willing to pay or start a bounty for anyone that is able to unsign it somehow.

If we can get $10 from everyone that has a signed one...it might get something going!
[Galaxy Tab  Android Development] tmaurice:
Hey Roto - any further responses from the JTAG manufacturer? Just wondering if there's still hope for those of us who jumped the gun and have those nasy signatures, or if I need to brick my Tab and send it in for 'repair' :eek: Thanks for all your help with the Tab!! Much appreciated.
[Galaxy Tab  Android Development] gerazzo:
That's my situation:

boot.bin: SIGNED

sbl.bin: SIGNED!

zImage: SIGNED!

Assessment:

Bootloader: protected

Kernel: Signed

So i think i'm a new member of the club.

Now assumed that i could not be interested in flashing beta firmwares/ or custom firmwares may i return to the official Samsung ROM? if yes how?

Thanls
[Galaxy Tab  Android Development] rmanaudio:
No..you cannot flash anything other than signed firmware. If the firmware is not signed..no go. So previous JJ, JK firmware is out of the question. Only JM* firmware for now and im sure all future releases as samsung is doing what motorola has been doing.
[Galaxy Tab  Android Development] richardtrip:
@rotohammer: Update from riff.
[Galaxy Tab  Android Development] rotohammer:
Thanks for the heads up, got it!
[Galaxy Tab  Android Development] Landroid:
Is anyone able to tell me how exactly the GTab boots? Im sure the pbl is checking the signatures, because my sbl is unsigned, but i cant flash unsigned zImages!

Maybe its like this

pbl checks signatures from zImage! Boot if zImage is signed, sbl signature doesnt matter

or

if zImage is signed, pbl doesnt allow to flash unsigned zImages!

I think sbl does nothing like checking, only flashing! Pbl does all the checking imho!

but FFS, we dont know so we are screwed w/o rotohammer and chainfire and thei JTAG units!
[Galaxy Tab  Android Development] Loccy:
So I wasn't expecting this, because I flashed an early version of JM6 - it was a hacked version apparently by a chap called Richthofen. But:

boot.bin: unsigned

sbl.bin: unsigned

zImage: SIGNED! (but I'm running Roto's JME, so this makes sense, no?)

am I right in thinking I'm good here?
[Galaxy Tab  Android Development] professor_grn:
Euro Unbranded Galaxy Tab P1000

Not sure of the upgrade path, but I think it went something like

stock -> JMC -> JMD -> Roto-JME​

Only then did I find this thread!

Results are as follows:

SGT-BootloaderCheck v1.0 - Copyright (C) 2010 Chainfire

boot.bin: SIGNED !
sbl.bin: Unsigned
zImage: SIGNED !

Assessment:
-- Bootloaders: Protected, can only flash signed bootloaders and kernels
-- Kernel: Signed, can be flashed on all bootloaders

Just for the record...
[Galaxy Tab  Android Development] Landroid:
you wont be able to flash unsigned stuff, cause it looks the same at my tab and im not able to flash anything unsigned :(
[Galaxy Tab  Android Development] t0dbld:
ok ill hang in there ... well at least till sdk and or source is dropped :-P , what exactly do you mean by they have wrong bootloaders? was it just a complete mess up like they used galaxy s bootloaders? or is it maybe a regional issue and the bootloaders are from the far east tabs? im using a euro tab in the us on att
[Galaxy Tab  Android Development] humberos:
Another ROM Protected

I flashed this ROM P1000LVJJM9 for America devices (P1000L).

This ROM is protected!
[Galaxy Tab  Android Development] Chainfire:
Bad news!

Can you try to actually flash an older ROM, though? This to verify. It is not impossible the JM9 ROM is signed but allows unsigned ROMs to be flashed. Please try this and report back !
[Galaxy Tab  Android Development] humberos:
P1000LVJJM9 ROM Protected

Chainfire,

For my device (P1000L), there are only two firmwares (samfirmware.com).

P1000LVJJJ3

P1000LVJJM9

My original ROM was P1000LUTJJ4. So I installed the P1000LVJJJ3.

And now, after upgrade announced by Samfirmware, I installed P1000LVJJM9.

But I left checked the Odin option "re-partition". My tab stopped working.

So I decided to return to the previous version (P1000LVJJJ3) and it was where I discovered that P1000LVJJM9 was a protected ROM because I could not flash P1000LVJJJ3 back.

To fix my tab, I installed the Roto-JME, but its not compatible.

After fix my system files, again I installed the protected ROM P1000LVJJM9 and now works back.
[Galaxy Tab  Android Development] Landroid:
my galaxy tab is insuranced!

what would happen if it stops working beacause i drop it from too high and samsung needs to repair/replace it? would i get an unsigned bl?
[Galaxy Tab  Android Development] abuser0815:
Try it ;)

I don't know what happens if they find out that you did it on purpose.

But to your question, i guess sooner or later all tabs will get this bootloader. It's just the question how to get away from that lock.
[Galaxy Tab  Android Development] Landroid:
rotohammer and chainfire, any progress on this???
[Galaxy Tab  Android Development] silversubie:
As of 2 weeks ago, my AT&T replacement tablet doesn't have protected bl. I dropped the original one and Samsung sent me the new one. Prop to them for taking care of me nicely!

One thing i've noticed is the option to install software from unknown source is no longer there. I also could not root it using z4root. SuperOneClick works however.
[Galaxy Tab  Android Development] Chainfire:
Nope, I don't have the RIFF equipment Rotohammer does, and the man himself is on vacation :)
[Galaxy Tab  Android Development] ranblv:
You just saved me 100$, my tab went from not even powering up for more than 2 seconds to booting into the the os :-) ( the two seconds was all I needed to flash a pit file)

I am still stuck with the logo not ending but at least the battery charges now, so i can try other roms to fix it.
[Galaxy Tab  Android Development] rotohammer:
http://xdaforums.com/showpost.php?p=10572161&postcount=24