yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
This seems now really maximum for my RIFF + S8500 combination...

Success with these adresses:

128 MB

0x2000 0000 length 0x07FF FFF8

256 MB

0x4000 0000 length 0x0FFF FFF8

Failed with:

....FFF[COLOR="Red"][B]F[/B][/COLOR]
....FFF[B][COLOR="Red"]B[/COLOR][/B]
....FFF[B][COLOR="Red"]9[/COLOR][/B]

If failed then something like this:

Reading MCU address space from 0x000020000000 to 0x000027FFFFFA
[B]Failed[/B] to receive answer to READ command.

Reading MCU address space from 0x000020000000 to 0x000027FFFFF9
ERROR: [B]Failed[/B] to unpack received data. Terminating.

I have used Length as Input... but also I could use End address... but 7 Byte less I can survive... not test again in near future...

Best Regards
[Bada Software and Hacking General] adfree:
Found this...

So RIFF writes something or send Command into RAM... for Bootloader writing...

Best Regards
[Bada Software and Hacking General] Rebellos:
Of course it does. Actually, usually it does write pretty complicated payload to RAM that does contain oneNAND drivers and module able to communicate with RIFF. It's called "resurrector data". It's also possible that oneNAND driver is implemented in JTAG scripts, however it's not very likely and it would be much slower then.
[Bada Software and Hacking General] adfree:
Still unsolved XXJB6 Boot or any other Boot to write... :o :rolleyes: :(

Okay, XXJB6 Boot is unsigned...

But maybe it would be execute from RAM... :confused: :confused:

But how exactly...

Best Regards
[Bada Software and Hacking General] adfree:
:D :victory:

First success in CMM Script "Modding"...

Now my S8500 display

Download Mode

instead

Download mode

Next project is to modify device name, what Multiloader display...

Wave S8500 shows Lismore...

Best Regards
[Bada Software and Hacking General] adfree:
:D

Tried several combinations today...

I can do:

BL3_univ_s.elf use to load into RAM and do stupid things with this ELF...

XXJEB bada 1.x

Not possible, but I think I know why...

I can NOT perform bada 2 ELFs like XXLA1...

Reason should be... in my opinion...

CMM script is not for bada 2... "compatible"... I need correct addresses :o

SYStem.CPU CORTEXA8
SYStem.JC 4mhz

break

r.s cpsr 0xd3
d.s SD:0x[B]e2700000[/B] %LE %LONG 0x00000000
d.load.elf BL3_univ_s.elf

r.s PC 0x[B]42480000[/B]
go

enddo

Maybe some could help me please. To correct this Script to use bada 2 ELF...

Thanx in advance.

Best Regards

Edit 1.

Now I could try to change ELF in Script into Binary and check if I can find correct part from boot_loader.mbn... to upload...
[Bada Software and Hacking General] adfree:
Now I'm testing few ELFs... found in Firmware...

Failed with:

BOJE7

Will test more files...

But maybe this ELF is allready modified for this kind of action...

Best Regards

Edit 1.

Hmm...

It seems magic is:

CMM + exactly this ELF...

If I remember correct... it is allready modified... not Original anymore... will search Link...
[Bada Software and Hacking General] adfree:
Small progress...

1.

http://xdaforums.com/showpost.php?p=36999523&postcount=132

ONLY this package is working...

It seems modified ELF allready... need to confirmed... but I have NOT found other ELFs working with this CMM.

2.

Little progress in understand this Script... with my SMALL brain. :D

RIFF Box shows for instance RED marked stuff if wrong/ignored or comment...

So I have cleaned little bit...

For me this is also working... RIFF shows no RED marked text...

I have removed %LE %LONG 0x00000000

SYStem.CPU CORTEXA8
SYStem.JC 8mhz

break

r.s cpsr 0xd3
d.s SD:0xe2700000
d.load.elf BL3_univ_s.elf

r.s PC 0x42480000
go

enddo

3.

Removed 2 Lines and now more clear...

go

GO Command...

S8500 continue working...

If deleted. Script not jump to Download Mode...

r.s PC 0x42480000

Not 100 % clear for me. But if removed... ELF also is loaded...

So I think it is the Start address for the GO Command...

4.

d.s SD:0xe2700000

This is the Destination address for ELF

d.s SD:0x[COLOR="Red"][B]00000000[/B][/COLOR]

This is not possible... :confused:

But this was possible for writing... (means not working for DL Mode...)

d.s SD:0x40000000

5. Later... :D

Best Regards
[Bada Software and Hacking General] Rebellos:
Please read my post there: http://xdaforums.com/showpost.php?p=37077451&postcount=136

About 0xe2700000 - this is watchdog control register address, and original script was writing 0x00000000 there to disable it. In theory you won't need it as bootloaders does already disable watchdog, but it's always good practice to do it ;).

You can aswell remove this line completely, than leaving d.s sd:0xe2700000 only.

Bootloader loading address are stored in .ELF, so you don't have to worry about it.

d.s <addr> <data info> <data value> = DATA.SET under specifiec address, maybe RIFF doesn't recognize LE or LONG switches, maybe try without %LE and with %DWORD instead %LONG or what.

r.s <reg> <value> = REGISTER.SET, setting PC (Program Counter) to certain value is actually forcing CPU to jump without branching into given address.
[Bada Software and Hacking General] adfree:
Thanx for help.

Working results...

SYStem.CPU CORTEXA8
SYStem.JC 8mhz

break

r.s cpsr 0xd3

d.load.elf BL3_univ_s.elf

r.s PC 0x42480000
go

enddo

My fault, I thought 0x27... is address for upload...

So I have no idea where ELF is uploaded... :confused: :(

Anyway... This work. :good:

Playing with Binary... but here I am also not smart enough to find correct address... :rolleyes: :eek:

This is what work, because 0x0000 0000 or nothing is wrong...

SYStem.CPU CORTEXA8
SYStem.JC 8mhz

break

r.s cpsr 0xd3

d.load.b boot.bin 0x[B]b[/B]0000000

r.s PC 0x42480000
go

enddo

or

SYStem.CPU CORTEXA8
SYStem.JC 8mhz

break

r.s cpsr 0xd3

d.load.b boot.bin 0x[B]8[/B]0000000

r.s PC 0x42480000
go

enddo

RIFF upload, but I can not find... :D :confused: :o

Otherwise this:

Executing Script: [8500_test888mhz_binary1.cmm]

Target is halted at PC = 0x42480250
INFORMATION (Line 9, File: [8500_test888mhz_binary1.cmm]): Upload BIN file [boot.bin] 1704960 bytes into target...
ERROR (Line 9, File: [8500_test888mhz_binary1.cmm]): Memory at given address cannot be Written.

Also no success with other ELFs :o :o :confused:

I am not 100 % sure, but I think this BL3_univ_s.elf from RIFF is maybe modified... as no Original source exist... ehm I have not found...

Best Regards
[Bada Software and Hacking General] adfree:
Found this info here...

http://forum.gsmhosting.com/vbb/f634/samsung-wave-s8500-not-sale-1208480/

Best Regards
[Bada Software and Hacking General] adfree:
:D

Now I prepare my S8530 for JTAG...

Step 1.

Remove damn green Color...

First test with Screwdriver... :angel:

S8500 is really perfect for use with JTAG... only solder wires...

Nothing to remove or to disassemble...

Best Regards
[Bada Software and Hacking General] adfree:
Found this...

Not tested yet...

Best Regards

Edit 1.

Short tested with S8500 and RIFF...

dram_L2.cmm is not 100 % compatible with RIFF... need some modififcation or something...

:o

Later I will check BL3_univ_s.elf XXJF4 work with the known CMM...

Edit 2.

Same BL3_univ_s.elf...

Will check again, if I can find XXJF4 Boot ELFs, to be sure it is unmodified...
[Bada Software and Hacking General] adfree:
Not sure, because long time ago...

Today I was able to read with RIFF under JTAG TAB iROM at 0x0000 0000

Then I saw again this text... about

Insert an [B]OTG[/B] cable into the connector

Found this via Google... not tested yet... nor ...

http://forums.androidcentral.com/go...iy-making-your-own-otg-cable-image-heavy.html

Also checked again about ELF and CMM Script... but still no idea why I can't execute other BL3 ELF correctly ...

Found valid ELF at pos:00000000
------------------
Type : 0002
Machine : 0028
Version : 00000001
[B]Entry : 42480000[/B]
Arch flags : 05000002
Hdr size : 00000034
ProgHdr offset : 004BC27C
ProgHdr size : 00000020
ProgHdr entries : 00000001
SectHdr offset : 004BC29C
SectHdr size : 00000028
SectHdr entries : 00000014
SectNameStrings : 00000013

ProgHdr:
--------
Type:0x00000001 Offset:0x00000034 VAddr:0x42480000 PAddr:0x42480000 Filesize:0x0017FF80 Memsize:0x00476C7C Flags:0x80000007 Addralign:0x00004000

BOJE7 has minor differences... and should start at 0x42480000

But only RED Screen... like if Bootchange between bada 1 and 2 ...

No idea if this is maybe iRAM stuff... :confused: red Display and Reboot...

I need bigger brain... :D

Best Regards
[Bada Software and Hacking General] adfree:
http://www.ebay.de/itm/HANDY-ADAPTE...E_Handy_PDA_Kabel_Adapter&hash=item35c238a5c2

Maybe this Original Samsung OTG cable ? :confused:

Not tested...

Via Google I saw this:

SMDK6410 # dnw

Insert a OTG cable into the connector!

[B]OTG cable Connected![/B]

Now, Waiting for DNW to transmit data

Download Done!! Download Address: 0xc0008000, Download Filesize:0x38000

Checksum is being calculated.

Checksum O.K.

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

I was able to flash 02_live _after_CMM.bin and after execute CMM Script...

Wave start...

I have used ELF from BOJE7... but it seems in this way NV items like IMEI not work...

Type : Unofficial Version
Number : 1243
Builder : superuser
Host : S1-AGENT08
Date : 2012/01/05
Time : 19:21:46
Size : 42730876 bytes
CheckSum : 0xf4e364eb
View :

S/W version:S8500+XX+LA1
Modem:Q6270B-KPRBL-1.5.45T
SHP:VPP R5 2.1.1
Build Host:S1-AGENT08
BuildAt:2012/01/05 19:21:46

App Debug Level : 0
ASSERTION_ASSERT:0 failed. (fi
le SysSecureBoot.c, line 4189)
BoAn4189
<Callstack information>
PC = 4031B42B OemDumpRegister
LR = 4031B42F OemDumpRegister
<Mocha Task Callstack>
_SysAssertReport
__SysSecBootReadNetLockInfoFro
mFile

Will check now the other FULL Flashs again... all are 512 MB...

But it seems useless to use whole 512 MB, because NV items...

I saw somewhere Samsung_M210S_32MB.bin

But also this is maybe too much... as it is not able to dump moviNAND 2 GB...

FFS etc. inside...

So 1:1 Clone with all private data impossible... (for me)

For me it is FIRST time, that 1 Fullflash is awaken... :victory:

Will check if now Headerinfo is back...

Best Regards

Edit 1.

01_dead _after_write_dll.bin

and

02_live _after_CMM.bin

1:1 same file... :rolleyes:

Compared with Total Commander...

Next try.

03_live _after_write_boot_with_downlaoder.bin

s8500 nas.bin

Edit 2.

03_live _after_write_boot_with_downlaoder.bin has visible damaged Boot, because at 0x0 wrong...

But it seems, now I can start handset without valid Boot written at 0x0 ... :D

Will test now Samsung_M210S_32MB.bin, because bada 1.x and I never saw Bootfiles...
[Bada Software and Hacking General] adfree:
Little progress...

After I have realized, that JTAG dumps of OneNAND (512 MB) are only 50 % of Firmware + "Settings"... because CSC + FFS + ShpApp.app are written into moviNAND ( "2000" MB)...

It seems impossible to restore moviNAND via JTAG (with my knowledge) and RIFF Box...

All floating around Fulldumps of S8500 which I have tested... can NOT start, because missing IMEI...

NV item 550 seems not in OneNAND stored or secured heavily by using other unknown memory areas or something is in moviNAND...

Also erase whole OneNAND kills IMEI... then you have little problem. Because apps_compressed.bin do selfcheck... and not start normally without IMEI...

Old trick was to use CMM Script... then something is disable IMEI check... and Wave start without IMEI...

New Tricks for me seems:

1.

It seems if I dump my IMEI free working S8500, I can later restore this Backup via JTAG and S8500 start again without IMEI... :D

2.

[B]F[/B]actory [B]P[/B]roduction [B]M[/B]ode

http://xdaforums.com/showpost.php?p=41670635&postcount=5

It seems I can backup and restore this with JTAG...

So I can work with QPST... to restore my NV items...

This mode I know from Qualcomm as FTM... Factory Test Mode...

Now I will investigate, if it is possible by "simple" Copy and Paste, all JTAG dumps I have to force to bypass IMEI selftest or to force to start in FPM with Qualcomm Mode... :angel:

Best Regards

P.S.:

Reason is because I am too dumb to use other Tools for IMEI restore...

Dafür geb ich doch kein Geld aus, um NV item 550 wieder herzustellen.
[Bada Software and Hacking General] adfree:
Now I have attached my S8530 with RIFF.

I have 2 damaged Blocks... :rolleyes:

My JTAG S8500 has only 1 damaged Block...

But I can remember. S8500 from user which I have repaired was without damaged Blocks.

Back to my S8530 experiences now with RIFF...

1.

Resurrection DLL writes XXJK2 Boot and something after 1FF... this is different to S8500 Resurrection DLL

2.

Oh surprice... :rolleyes:

Something starts with UPCH at 0x1FF00000

3.

Now I will check, if IMEI is mandatory...

I have erased whole NAND...

This time Resurrection DLL for S8530 restores enough for starting proper boot...

This time I don't need CMM Script like on S8500...

Later I will report...

Best Regards

Edit 1.

Nice, starts without IMEI... checked via *#06#

So for S8530 RIFF team combined feature of CMM Script + Boot

Will check later, if S8530 dump works as template for S8500... with S8500 Boot.
[Bada Software and Hacking General] adfree:
My solder skills are really terrible... :o :D

Anyway.

Photos from my S8530...

And this worked with RIFF.

I have used liquid... old Kolophonium... :D

Now I have desolder wires... because this Wave 2 is complete useless now...

Before Touch was halfdead, now more dead. Nearly no navigation possible...

Reason is broken glass... Display damaged. :(

Anyway. Because my other S8530... I am not able to fix my M210S Firmware problem. I will soon connect this Wave 2 also to RIFF to erase f. OneNAND...

So I can use again S8530 Firmware...

Meanwhile I can play again with RIFF and S8500... :angel:

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=43436279&postcount=6

I have attached file for study.

This is working on S8530 AND S8500... tested by me.

This seems minimum content for starting Download Mode from device... and use Multiloader...

No IMEI set... but working. ;)

Now I will try to understand, how I can replace 0-40000 by own Boot... not only XXKJ2.

55504348FE07FB070000FFFF010000000200000001000000010000000008000000080000

This is UPCH at 0x1FF00000

4C504348FE07FB070000FFFF010000000100000001000000010000000008000000080000

LPCH at 0x1FF40000

And little bit info block at:

0x1FFC5000

But this I can remember I have removed complete, so maybe not mandatory...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress.

Now I am able to use every Bootloader I can find with CMM Script also on totally empty 512 MB OneNAND. :victory:

1.

This means for me, I don't need Resurrection Button of RIFF... which restores XXJEB bada 1 only...

2.

I don't need modified BL3 for Download Mode, I can use Original unmodified stuff.

For DL Mode I have only to press fast enough Keys... so correct timing... nothing more.

3.

No I.EI no NV items needed...

I have attached BL3 as Example, from:

[B]XXJB6[/B] for Prototypes but only runs on Retail...
0x42380000
[B]XXLA1[/B] for bada 2...
0x42080000

Address for start you can find at:

0xA0

Best Regards

Edit 1.

Added XXJEB Boot...

XXJEB is Bootversion from RIFF Resurrection DLL...
[Bada Software and Hacking General] adfree:
Short tested CMM Script with SBL from SHW-M130K...

SBL taken from here:

http://xdaforums.com/showthread.php?t=994423

Thanx.

Address is 0x40246000

If I press Home Key fast enough, I'm in Download Mode... :D

Odin detect my S8500 with M130K Bootloader...

Later if I have again S8530 for JTAG tests... then maybe luck. And Display of S8530 is compatible with M130K Bootloader...

Best Regards

Edit 1.

Really funny... :D

Short tested I9000 SBL at 0x40244000...

Here I have to hold Volume down + Home + Power

My Wave is in DL Mode + Odin can detect.
[Bada Software and Hacking General] adfree:
http://www2.lauterbach.com/pdf/nandflash.pdf

http://www.kandroid.org/board/data/...Linux_Installation_Manual_for_U-Boot_v2.9.pdf

Found this via Google...

Best Regards
[Bada Software and Hacking General] adfree:
http://www.youtube.com/watch?v=0O2UEGLJeAI

Interesting Video.

I have Hotair station... maybe next time I will try to solder wires for JTAG with it...

Need more practice for S8600 and I9000 PCB...

Because much much smaller as S8500 and S8530 Testpoints...

Will try to find good Videos where I can see wires solder to little tiny Testpoints...

Best Regards

Edit 1.

http://www.youtube.com/watch?v=yjb_zEL7ro4&feature=player_embedded

Maybe I can find about solder wires...

Edit 2.

Need something like this... for small tiny wires

http://www.youtube.com/watch?v=R6lHKNa54cM

Edit 3.

This looks funny too:

http://www.youtube.com/watch?v=vIT4ra6Mo0s

Edit 4.

http://www.youtube.com/watch?v=wE-c6ccXnGk
[Bada Software and Hacking General] adfree:
Really "funny"...

I have removed spare data from RIFF Image, because I am paranoid and I thought this is only additional stuff... :o

http://xdaforums.com/showpost.php?p=43436279&postcount=6

But if this is written via RIFF... then result is same like empty memory...

SEC S5PC110 Test B/D

But I have compared... 0 - 0x2000 0000 is 1:1 same after reading again...

So Spare seems mandatory... :o

Maybe this is 1 reason, why I have failed sometimes...

Best Regards
[Bada Software and Hacking General] adfree:
:D

100 years later...

Found way to modify JTAG Fulldump... to start without IMEI...

On dump file remove "Info Block" where you can see text KAC007021M...

592 Bytes

On empty device... with IMEI not active ... I have realized in bada 1.x sysinfo file in Security folder...

+

Security/PlatformInfo/Imiation_IMEI.dat

So I have now 2 template files:

sysinfo
Imiation_IMEI.dat

These 2 files I have insert via WaveRemaker in FFS... then my restored Dump start... I have choosed XXJL2, because sysinfo in bada 2. is somewhere else...

I can for instance Backup now NV items from these Dumps for study...

Best Regards

P.S.:

Now I will check the other dumps...
[Bada Software and Hacking General] adfree:
Interesting... never seen before.

Maybe Pics from S8500 Pogo JIG somewhere available... :confused:

Best Regards
[Bada Software and Hacking General] adfree:
Tasks for 2014.

Solder wires to and JTAG with:

S8600

S8000 (maybe)...

Meanwhile I'm trying to improve my solderskills... as S8600 have very tiny Testpoints...

I have few U700 PCBs for tests...

First result... :o

Maybe I need new wires...

Will test 2 different types of wire...

Best Regards
[Bada Software and Hacking General] adfree:
Memo to me...

M110S Firmware... flashed to S8500

<ID:0/036> Added!!
<OSM> Enter CS for MD5..
<OSM> Check MD5.. Do not unplug the cable..
<OSM> Please wait..
<OSM> M110S-PDA-PHONE-MOVI-REV03-DG23-1409-USER.tar.md5 is valid.
<OSM> Checking MD5 finished Sucessfully..
<OSM> Leave CS..
<ID:0/036> Odin v.3 engine (ID:36)..
<ID:0/036> File analysis..
<ID:0/036> SetupConnection..
<ID:0/036> Initialzation..
<ID:0/036> Get PIT for mapping..
<ID:0/036> Firmware update start..
<ID:0/036> param.lfs
<ID:0/036> NAND Write Start!!
<ID:0/036> zImage
<ID:0/036> cache.rfs
<ID:0/036> dbdata.rfs
<ID:0/036> factoryfs.rfs
<ID:0/036> modem.bin
<ID:0/036> movinand.mst
<ID:0/036> RQT_CLOSE !!
<ID:0/036> RES OK !!
<ID:0/036> Completed..
<OSM> All threads completed. (succeed 1 / failed 0)
<ID:0/036> Removed!!

Minimum output...



1
AST_POWERON
HWREV:15
Load SBL(3)

It seems all Korean Versions are better protected... less UART output by default...

Less leaks...

I am playing now with boot.bin, PIT, etc. to learn more...

Not really easy... :o

Best Regards
[Bada Software and Hacking General] adfree:
Now I have my own S8600 RIFF JTAG expereinces... :victory:

1.

It was easier as I thought to solder wires to PCB...

So my solder skills are enough.

2.

Little bit different handling as with S8500/S8530 and for now I have no CMM Script... for RAM uploading of Bootloader...

Timing is mandatory for successfully detection...

3.

4 GB dump in more then 6 hours... :o

This I can see if I press Halt or Reset...

Open serial port...OK

Connecting to the RIFF Box...OK
Firmware Version: 1.34, JTAG Manager Version: 1.48
Selected Resurrector: [Samsung S8600 V1.0.4442.60704]

Resetting target...OK
STATUS: Target is halted.

R0 = 0x300B0455 R6 = 0x32414853 R12 = 0x000000E0
R1 = 0x30302037 R7 = 0x00003635 R13 = 0x8006FF50
R2 = 0x53203030 R8 = 0x80060FEC R14 = 0xFFFF6D58
R3 = 0x00314148 R9 = 0xFFFFC70C R15 = 0xFFFF03D4
R4 = 0x30203730 R10 = 0x00000004 CPSR = 0x800001D3
R5 = 0x20313030 R11 = 0x00000000

And here is info for JTAG Chain working...

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.34, JTAG Manager Version: 1.48
Selected Resurrector: [Samsung S8600 V1.0.4442.60704]

Connecting to the target...OK
Set I/O Voltage reads as 1.80V, TCK Frequency is RTCK

Following devices are found on the JTAG chain:
Device on TAP #0: ID = 0x27B360E1, IR Length = 0x05 bits
Total IR length: 0x0005 bits

Analizing IDCODE(s) of the JTAG scan chain:
1. 0x27B360E1: Qualcomm MSM8255, H/W Rev. #2
2. 0x27B360E1: Qualcomm MSM8255T, H/W Rev. #2
3. 0x27B360E1: Qualcomm SCORPION, H/W Rev. #2

4.

I can not assemble all parts of case, but I was able to find hole for my 8 wires...

I have removed Speaker part...

I hope now easier to press Buttons for Download Mode, without complete case...

Now charging battery... and later I will try to erase, Resurrection etc... and to write I9001 stuff...

Best Regards

Edit 1.

Uuupsi.

Erase seems not so easy (fast), as with S8500/S8530...

http://forum.gsmhosting.com/vbb/8448120-post2.html
[Bada Software and Hacking General] adfree:
Hmm...

Erase is really disabled... you can click and wait but nothing changed...

S8600 starts normal... so nothing is erased.

Detected an Initialized FLASH1 Chip, ID: 0x0045/0x0000 (SEM04G, 0x0000EC000000 Bytes = 3.69 GB)
Detected an Initialized FLASH2 Chip, ID: 0x0045/0x0000 (SEM04G, 0x000000100000 Bytes = 1.00 MB)

Erasing FLASH1 memory from 0x000000000000 to 0x0000EBFFFFFF...OK
Completed in 00:01:58.516 (Average Transfer Rate: 32625.33 kB/s)

Resurrection work...

First I've selected I9001...

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.34, JTAG Manager Version: 1.48
Selected Resurrector: [Samsung I9001 V1.00]

Connecting to the dead body...OK
Detected dead body ID: 0x27B360E1 - CORRECT!
Set I/O Voltage reads as 2.61V, TCK Frequency is RTCK
Adaptive Clocking RTCK Sampling is: [Sample at MAX]

Resurrection sequence started.
Establish communication with the phone...OK
Initializing internal hardware configuration...OK
Uploading resurrector data into memory...OK
Starting communication with resurrector...OK

Detected an Initialized FLASH1 Chip, ID: 0x0045/0x0000 (SEM04G, 0x0000EC000000 Bytes = 3.69 GB)

Flashing the dead body...OK
Resurrection complete!

S8600 not start, nor UART output nor I am able to enter DL Mode for I9001...

:confused:

But maybe my fault... later test again...

Then I have written S8600 stuff back, my S8600 is alive again.

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.34, JTAG Manager Version: 1.48
Selected Resurrector: [Samsung S8600 V1.0.4442.60704]

Connecting to the dead body...OK
Detected dead body ID: 0x27B360E1 - CORRECT!
Set I/O Voltage reads as 1.81V, TCK Frequency is RTCK
Adaptive Clocking RTCK Sampling is: [Sample at MAX]

Resurrection sequence started.
Establish communication with the phone...OK
Initializing internal hardware configuration...OK
Uploading resurrector data into memory...OK
Starting communication with resurrector...OK

Detected an Initialized FLASH1 Chip, ID: 0x0045/0x0000 (SEM04G, 0x0000EC000000 Bytes = 3.69 GB)
Detected an Initialized FLASH2 Chip, ID: 0x0045/0x0000 (SEM04G, 0x000000100000 Bytes = 1.00 MB)

Flashing the dead body...OK
Resurrection complete!

Hmm... I9001 seems not have second area with 1 MB...

Need some time to prepare 4 GB dummy file to overwrite eMMC... for more stupid tests... :D

Best Regards