yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
Maybe damaged Blocks is not really easy to handle, if full erase...

http://forum.gsmhosting.com/vbb/f634/solved-s8500-error-pls-help-1089879/

I have this at 0x07100000...

I've tried several hours... :o :(

Only 1 success... then I've killed again my S8500... :)

Damaged Blocks Counter is visible on Bluescreens, if Debug Level is higher then Low...

Only number is reported as I saw, not where... will check next my Screenshots...

Best Regards
[Bada Software and Hacking General] adfree:
10 hours later... my S8500 is alive again.

No idea how exactly, maybe more luck then method...

1.

- I have erased full 512 MB Flash---------ignored 1 damaged Block

- I have taken my last Full Dump---ignored 1 damaged Block

- after successfully finish, I have read again and compared, result 1:1

So may damaged Block at 0x07100000 in theory no affect..

But no chance to power on, no PC detect... :confused: :mad:

Then step 2.

- It seems Bootcycle... I have first pressed Resurrection Button...

Tried few times... but if finished, then handset more stable...

Then step 3.

- via Script execute CMM to load BL3 into RAM...

After that I have removed JTAG cable and damn S8500 powers on...

Ready for Multiloader...

Now I fight with this ...

Anyway, S8500 powers on... more chance to restore...

Best Regards
[Bada Software and Hacking General] Tigrouzen:
My brain smoke but congratulation !!!
[Bada Software and Hacking General] adfree:
My brain is explode now. :D

As I facing next problem... like this:

http://xdaforums.com/showthread.php?t=1315165

:D :D :o :(

Maybe I have choosen wrong Dump... but I have "few" more. :D

Next 1 hour...

Best Regards
[Bada Software and Hacking General] Rebellos:
How about using resurrector on empty oneNAND, then flashing using Multiloader and after flash 0x1E0000000-0x1FFFFFFFF area with your image using JTAG? Or last 2 operations in reverse order. Tried that?
[Bada Software and Hacking General] adfree:
This is strange...

Without execute CMM Script, my S8500 NOT powers on...

I have tried 2 different BL3_univ_s.elf...

1 from RIFF...

The other from JE7...

It seems to erase my prior proper flashed Image... :confused: :eek:

After this f. Bootcycle I have again used JTAG to read memory, as I thought all is okay.

But at 0x1FFC5000 is empty...

Will check this again... after FULL read...

Also funny. As I can see Blue Screen if Boot Cycle... Debug Level High...

Bad Black (my damaged Block) is not marked...

Theory... BL3_univ_s.elf makes "FULL Reset"... and erase my NAND...

I'll try then to flash only 0x1E0000000-0x1FFFFFFFF via JTAG.

But I don't understand how this work... Maybe there are more areas like iROM, where we have no access... ((((with JTAG))))

Best Regards
[Bada Software and Hacking General] adfree:
:p

Yeah, damn digits...

Anyway. I have tried this... wrote this 32 MB... no idea...

Then I did other things... cooking, eating... :)

But now I have working S8500 back. No idea how exactly... :o

Maybe BOJE7 with Bootloader XXJEE has lower Security... I was able to bypass Boot cycle :confused:

But IMEI and many other NV items are gone...

Strange was. BT address different... Wi-Fi same as in Original :confused:

Were is damn WiFi stored... in WiFi Hardware?

Anyway... Used QPST for Backup...

Only 60 items available... so I think empty...

Then my old Backup... :cool:

Over 306 NV items were successfully restored by QPST. :cool:

Now I'm ready to do other stupid things with my S8500 again. :D

Best Regards
[Bada Software and Hacking General] Rebellos:
WiFi MAC is for sure stored in AMSS NvData next to BT MAC, though it's possible WiFi chipset does also store MAC internally.
[Bada Software and Hacking General] adfree:
New year... new attempt. :D

I am missing users with JTAG (+ experience with S8500/S8530).

Also Broadcom users are welcome... S5230, S7230 and so on...

I have only 1 device for JTAG + only 1 brain at same time...

Its time consuming... :o

Maybe for faster progress we can work together.

I have MANY questions left... :) ;)

Goals.

In theory we are now closer to manipulate Bootloader... to remove some security...

Minigoals...

Rebuild Firmware JB6 :cool: :o

Also I have NOT managed. To write my whole JTAG dump back. :o

After stupid erase memory tests... :D :o

Maybe someone can enlight my little brain, what I have missing...

My S8500 is working and okay. :cool:

But I wished I could write my old dump back...

Thanx for reading.

Best Regards
[Bada Software and Hacking General] adfree:
I have NEVER managed to write Bootarea... without Ressurection Button.

Today I saw this:

GT-S8500 Repair Guide.txt

Please, can someone upload for me S8500_0x00000000_2M.bin.

So maybe I can find my fault...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] comcio:
Hello,

for the link try to register here:

h t t p: // forum.shaarpmind.com/showthread.php/51188-S8500-ORT-Jtag-repair-method?

Greets
[Bada Software and Hacking General] adfree:
Thanx.

I'm not sure, it looks like nearly the same like I have found on GSM-FORUM...

I have found few chinese sites...

S8500_0x00000000_2M.zip

Around 400 KB...

But same "problem", not registered...

Maybe someone who has access can upload this 400 KB file for me. :)

So I can download without register...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] chetto106:
I've registered in chinese websites, but i can't download it.

Links broken and i've been sent to pay for download sites.

I'll try tomorrow again :)

[EDIT] Tried to ask but I need like bonus to do so. Chinese methods.... what to say? :(
[Bada Software and Hacking General] adfree:
Thank you very much for trying chetto106.

:cool:

Best Regards
[Bada Software and Hacking General] marcin205:
http://www.ort-jtag.com/blog/?e=10
[Bada Software and Hacking General] adfree:
It seems RIFF supports now S8600 too...

Detected an Initialized FLASH1 Chip, ID: 0x0045/0x0000 (SEM04G, 0x0000EC000000 Bytes = 3.69 GB)
Detected an Initialized FLASH2 Chip, ID: 0x0045/0x0000 (SEM04G, 0x000000100000 Bytes = 1.00 MB)

Best Regards
[Bada Software and Hacking General] adfree:
http://www.ebay.de/itm/UJK-Universa...UK_Mobiles_Accessories_RL&hash=item43b3d974b5

This looks funny.

But I am no pro to need all of them...

Best Regards

Edit 1...

Wow, many interesting solutions available...

http://www.ebay.de/itm/Medusa-Box-J...552644?pt=PDA_Accessories&hash=item2321f4e404
[Bada Software and Hacking General] adfree:
Somebody knows, if RIFF has Resurrection DLLs for bada 2... :confused:

I am only able to reanimate with bada 1 XXJEB... from RIFF DLL...

I never successfully wrote Bootloader in alternate method...

But now I have 1 S8500 with little problem...

It seems Bootlader is now "locked"... :confused:

Multiloader write succesfully without Error messages... but black... no power on...

I have tried 2 Bootloader with Boot change only in Multiloader...

XXJL2 bada 1 = no

same for bada 2

XXLA1 = no

Now I think it is maybe locked by Command... maybe something like this...

UnlockSecBoot
PrtSecBoot

... :confused:

Wished I can find solution.

Easiest I caould write XXLA1 Boot via JTAG or other bada 2 Boot...

Thanx in advance.

Best Regards

P.S.: This time it is not my own S8500 ...
[Bada Software and Hacking General] adfree:
I think Security check is in apps_compressed.bin instead Bootloader...

Because short Power ON OFF Animation...

If I use RC2 MIDle to set Debug Mode higher... I see Blue Screen...

On alive S8500 I can see something like this with UnlockSecBoot:

BoAn4370 (L)

or

BoAn4406

But now BoAn seems 3868... what ever this means...

...

I'm trying to bypass Security to have access again to write my NV items back... IMEI...

S.O.S

Best Regards
[Bada Software and Hacking General] Rebellos:
Could you upload your apps image, uncompressed already + could you get all the info from ASSERT screen (it's being cut on stack trace)

It's possibly damaged SysSec area on oneNAND, but usually with damaged SysSec data it hangs on BL3 level, so it's quite original case.

Can't you rewrite your oneNAND dump?
[Bada Software and Hacking General] adfree:
This message is because. oneNAND complete erased...

Now EFS is missing... better IMEI...

Last time with my Wave I was able to boot BOJE7 T-Mobile Firmware and then restored my NV Backup with QPST...

I have no idea, why last year success... after several tries...

Maybe "magic" was with SIM...

I need only way to restore IMEI or to bypass Security Check in apps_compressed...

But I'm 100 % sure last time with unmodified Firmware...

Again. This is not same Wave... it's an new "victim"... :o

Best Regards
[Bada Software and Hacking General] adfree:
It seems EFS with NV items start at address:

0x1E700000

with

ABEFCDABF4

Now I'll try to find correct end...

Best Regards

Edit 1.

My first Backup from new Wave contain this as Header...

ABEFCDABC0

Maybe this was the reason, why Bootloader change was not possible...

Will check other Dumps...
[Bada Software and Hacking General] Rebellos:
It's so called "NV backup", there's IMEI, MAC addresses and other data, used in certain cases by CP (CP does request reading this area during bootup) but I dont think this area is needed for APPS to bootup. More likely something else around is damaged.

TEXT1:421732A4 guSecBootDataAddress DCD 0x1E720000
TEXT1:421732A8 guSecBootOtpBaseAddress DCD 0x1E780000
TEXT1:421732B0 guSecBootSysOldNvInfoAddress DCD 0x1E760000
TEXT1:421732B8 guSecBootVerInfoAddress DCD 0x1E780800
TEXT1:421732BC guSecBootVerTempStorageAddress DCD 0x1E7A0000
TEXT1:421732C0 guSecBootEncryptedSystemInfoAddress DCD 0x1E7C0000
TEXT1:421732C4 guSecBootNCKUnlockInfoAddress DCD 0x1E7E0000
TEXT1:421732C8 guSecBootSecuritDataStartAddress DCD 0x1E720000
[Bada Software and Hacking General] adfree:
Summary...

This is known problem as RIFF Box not easy support "IMEI repair" for S8500/S8530... :(

If ERASE is used... whole accessable Memory goes 0...

Complete empty...

Now u can't write Full Image Back... ever NV part goes to Nirvana... :confused:

I were never able to write own Bootloader.

All I have is Bootloader in S8500 DLL... XXJEB...

I am not willing to buy again Box for 100 Euro... :D

Normally it should be able to fix this with brain...

Last time I have bypass this problem by BIG luck...

BOJE7 starts complete...

Then access to QPST was possible

Then I have written my NV items back (*.qcn)...

This time I need more brain. :o

Maybe magic was SIM card inserted...

Best Regards
[Bada Software and Hacking General] adfree:
"Magic" is Script... to Boot in NON secured Mode...

This is what I have forgotten or not realized...

Then again access to S8500 and Restore with QPST is possible...

Again used BOJE7... NO SIM inserted...

So I think no difference SIM yes or no...

:cool:

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showthread.php?t=1773757

I found this...

system.option resbreak on
system.up
g 0x7ce8 /o /cmd "r.s r0 0x0" ;0x0 for disabling the secure boot authentication
wait 1ms
g

NOT tested by me...

Next search leads to this...

http://xdaforums.com/showthread.php?t=1769411

...

Best Regards
[Bada Software and Hacking General] hero355:
One user could able to fix his bricked wave 525 with this method ---- >http://droidangel.blogspot.com/2011/05/how-to-make-samsung-galaxy-s-download.html

Maybe work on upper waves

http://d1210.hizliresim.com/12/c/dv4gc.jpg
[Bada Software and Hacking General] adfree:
Never tested self...

But maybe helpfull if Hardware problems... Keys damaged to get into Download Mode...

Maybe also for other things usefulll...

Again, not tested by me.

I can confirm 100 % "JTAG" with RIFF Box working for Bootloader on S8500... :D

Best Regards
[Bada Software and Hacking General] k8500:
Well, that was one of my first ideas, too, the "USB Jig". I have read some stuff about this and it seems to work on almost all Samsung Devices. But it also only seems to be an alternate way to enter Download Mode (if keys are damaged, for example).

EDIT: Even XDA has an article about the Samsung USB jig now: http://www.xda-developers.com/android/need-a-samsung-usb-jig-build-your-own/. The article also says that using the jig will reset the internal flash counter...

EDIT2: I'd aalso never build one of those myself. You get these for 2€ on eBay.
[Bada Software and Hacking General] adfree:
Now funny part unsoldering... :D

My soldering skills not the best, but for JTAG working... :angel:

Second S8500

"Other" wires used...

Same behavior...

Sometimes 8 MHz freezed... So best result for me is 2 MHz for writing...

Best Regards
[Bada Software and Hacking General] adfree:
:o

Uupsi... need more practice with Desoldering...

Will try again...

Best Regards
[Bada Software and Hacking General] adfree:
:o

Uupsi... need really more practice with Desoldering...

Will try again... next time... :D

Best Regards
[Bada Software and Hacking General] adfree:
Oh... wonder.

After 100 years I was able to find this file...

http://www.upload.gen.tr/d.php/www/a1534he1/S8500_0x00000000_2M.rar.html

Requested here...

http://xdaforums.com/showpost.php?p=22805055&postcount=50

Now maybe I can check/understand... what here is wrong:

http://xdaforums.com/showpost.php?p=12131413&postcount=15

:D

Different length is clear...

Need time for study...

Best Regards
[Bada Software and Hacking General] adfree:
Summary, if Wave not start after ERASE with JTAG...

Hang on Logo... Power On Animation...

http://xdaforums.com/showpost.php?p=32611984&postcount=59

Reason is f. Security check IMEI... If IMEI is gone...

Yes, Erase means killing NV item 550... :rolleyes:

To bypass Secure Boot... CMM Script is helpfull... then Firmware starts without IMEI and you can repair it...

By writing NV item 550 with QPST for instance... or better, restore your NV items Backup... *.qcn

Code to see IMEI is:

*#06#

I will check if maybe 1 special FOTA file is also helpfull...

I have forgotten to test it... :o

But CMM works 100 %...

Tested on 2 Waves with different Firmware...

bada 1 and 2...

Best Regards
[Bada Software and Hacking General] adfree:
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0446g/BABJABCG.html

Found this about CMM Script...

Maybe we could make an kind of workshop for JTAG. :D

Not solved yet.

1.

Access RAM via JTAG :confused: :o

2.

Bootloader writing as Binary without Resurrection... :confused: :confused:

3.

How to write XXJB6 via JTAG ? :confused:

Maybe via CMM it is possible to write XXJB6 Boot into RAM... :confused:

Best Regards
[Bada Software and Hacking General] adfree:
CMM Script...

To use Binary instead ELF... this could work:

d.load.binary

Best Regards
[Bada Software and Hacking General] adfree:
little info...

If 0 - 0x3FFFFF is valid (not damaged or modified or empty)

Then easy possible to hold CPU after press "End Button" on Wave...

This I can see in RIFF Software...

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.23, JTAG Manager Version: 1.29
Selected Resurrector: [Samsung S8500]

Halting target...OK
STATUS: Target is halted.

R0 = 0xFFF20090 R6 = 0xFFF20090 R12 = 0x0000A6F0
R1 = 0xD0037600 R7 = 0x00000000 R13 = 0x420233B8
R2 = 0x00000014 R8 = 0x00000001 R14 = 0x0000A748
R3 = 0x42023380 R9 = 0x00000001 R15 = 0x42000128
R4 = 0x00000001 R10 = 0x0000006C CPSR = 0xA00001D3
R5 = 0xD0037580 R11 = 0x00000000

Best Regards
[Bada Software and Hacking General] Rebellos:
R15 (PC) does point to infinite_loop (this is supposed to hang) in BL2_2 - it does enter infinite loop if BL3 signature check doesn't pass (so potentially non-authorized modification of BL3 occured). This is already after setting PS_HOLD register by BL2_2, so it won't bootloop, it'll just hang inifitely till battery drains out. ;)
[Bada Software and Hacking General] adfree:
Here is "magic" how to write Boot...

I can see it start at 0...

Then last address visible 3C0000...

Bootloader from XXJEB is included in RIFF own protected DLL (file for Resurrection)...

Several times asked for... :crying: :( :eek:

How this work?

How writing other Boot then XXJEB?

With JTAG/RIFF...

How, where... Fragen über Fragen.

Maybe someone can enlight my little brain.

P.S.:

I am not total idiot...

I can use Multiloader...

Thanx.

Best Regards
[Bada Software and Hacking General] adfree:
Medusa Box seems to use repair file:

SAMSUNG_GTS8500_Re pair.mf

Result looks like this...

Write protection disabled. :confused:

Writting UPCH section. :confused: :confused:

Maybe I can find repair file for study...

SAMSUNG_GTS8500_Re pair.mf

But I think same like RIFF DLL... protected content...

Best Regards
[Bada Software and Hacking General] adfree:
Found Medus files... *.mf... but surprise... :rolleyes:

encrypted...

Interesting about filesize...

RIFF DLL is something 5 MB if I remember correct...

See S8000 less then 1 MB... then S8500 is 30 MB ...

Best Regards
[Bada Software and Hacking General] adfree:
Medusa Box...

Stage 1 would be interessting to see Screenshot...

http://forum.gsmhosting.com/vbb/f664/samsung-s8500-boot-dead-done-jtag-medusa-1358755/

Stage 2 is 2 MB writing...

Best Regards
[Bada Software and Hacking General] adfree:
WoW.

Amazing.

TPs defect before, he was able to find "other" TPs...

Amazing solder skills. :good:

http://forum.gsmhosting.com/vbb/f705/step-step-samsung-s8500-deadboot-imei-repair-1575857/

Best Regards
[Bada Software and Hacking General] adfree:
New day, new stupid ideas... :D

Short tried S8530 Resurrection DLL from RIFF with S8500.

After reading NAND I've realized that maybe other adresses used... but in general read + write work...

Now I have erased Mem and Resurrect again... now FULL dumb make full dump... :D

Later more...

Edit 1.

S8000 DLL

and

M9810 DLL

not work...

Will try M130K and I9000 for instance...

If RIFF Box accept these DLLs if S8500 is attached...
[Bada Software and Hacking General] adfree:
:confused:

Gremlin Zone ?

I9000 DLL

Maybe we have also something like this ?

I have tested first choice...

S8500 received something... now I'll check what...

Best Regards

Edit 1.

Fulldump of S8500 with I9000 DLL with 40204000... first choice...

Looks nice, but need I9000 Dump or something else to check if valid...

Reason is...

S8530 DLL writes something weired stuff... not crap but at 0x0 I see Header of AMSS :confused: :confused:

Edit 2.

Now I have tried other RAM Version... this seems no crap, as 106 times difference can be found...

I could try if S8500 is now recognized by Odin (or however I9000 Flasher is called...)

No idea yet, why S8530 DLL deliver such weird result... maybe later I could also upload...
[Bada Software and Hacking General] Rebellos:
S8530 has got different oneNAND block size AFAIR. This might be the reason, though doesn't make much sense if I think abit more about it. ;P

S8500 with I9000 bootloaders should get detected by Odin, but you might have no way to enter download mode.

Try to use Captivate_SBL.bin from there - http://code.google.com/p/hummingbird-hibl/source/browse/#svn/trunk/HummingBirdInterceptorBootloader

It was patched by me to enter download mode without any key combo.

I've got no bigger clues what Gremlin Zone might be. I guess this might be EFS, or OTP block of oneNAND. Instead of EFS we've got SysSecData on Wave, and we also have OTP block.
[Bada Software and Hacking General] adfree:
Thanx.

It seems the S8530 DLL write the "second 2 MB" at 0x0... and repeat...

So my 4 MB dump contain 2 x:

785634120300000000000000000000000000000000000000000000000000000000020000B44E000044424C000000000000000000000000000000000000000000B4500000D4D602004653424C000000000000000000000000000000000000000088270300FC2301004F53424C00000000

This is what comes first at 0x200000...

I will collect more RIFF DLLs...

Thanx for hint with SGH-I897...

Will try Captivate_SBL.bin + Odin... next days...

Maybe if drunken enough, I will try Gremlin Zone...

Best Regards
[Bada Software and Hacking General] adfree:
S8600 Full Dump... 4000 MB can be found here for instance...

https://www.boot-loader.com/eng/medusa_free_section

And few other JTAG dumps...

Best Regards
[Bada Software and Hacking General] adfree:
Moved to faster PC for RIFF Box... and upgraded to:

Firmware Version: 1.34, JTAG Manager Version: 1.48

After many months/years I have now access to RAM... more then before... :rolleyes:

No idea why I was soo dumb... :D

Maybe this year I am able to understand how to write Boot...

I have 11 months for study...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

With RIFF I can now access RAM "1" and RAM "2"...

RAM 256 MB

0x4000 0000 length 0x0FA0 0000

RAM 128 MB

0x2000 0000 length 0x07A0 0000

length is not correct enough... but for me for experiments... easier to change F in 7 ...

Now I am searching for moviNAND adress...

So many adresses... my brain is very small... :o

As help I look into *.map files... for instance:

BL1_univ_evt1.map

DRAM_BASE 0x40000000
ONENAND_BASEADDRESS 0xb0000000

Mehr später, auch wenns Euch egal ist. :D

Best Regards
[Bada Software and Hacking General] Rebellos:
You cannot dump moviNAND just like you're dumping RAM. RAM is directly accessible on CPU memory bus, moviNAND is accessible through MMC controller, and oneNAND is accessible through oneNAND controller, both needs reading them part by part, and that's what MMC/NAND drivers do. ;)

It's possible that some GalaxyS class repair tool would include MMC drivers.
[Bada Software and Hacking General] adfree:
Thanx for info.

Then I will better correct my adresses...

I know ...

256 MB = 1000 0000

128 MB = 0800 0000

But it was not possible to use Full length... like 0FFF FFFF...

With S5PC110_EVT1_UM10 processor manual.pdf I was able to find Chip ID... near 0xE000 0000

See 1.2 REGISTER DESCRIPTION...

My dump looks like this:

22[B]021143[/B]09000000000000001000000000000000B0079DF5F500000000000000

Best Regards
[Bada Software and Hacking General] adfree:
To access RAM instead 512 MB OneNAND you have to select Access MCU Address Space on DCC Read/Write Tab...

Tested with S8500 with XXLA1 Boot... (maybe depend also on Boot Version, what is readable)...

First step...

I have fully Boot XXLA1 and if ready... I go to JTAG Read/Write Tab.

128 MB Chip... last position 0 is maybe not maximum... but I am too lazy to check... length 07FF FFFF is not working.

But this I can confirm... :D

0x2000 0000 length 0x[B]07FF FFF[/B]0

Reading MCU address space from 0x000020000000 to 0x000027FFFFEF
Completed in 00:03:29.344 (Average Transfer Rate: 626.11 kB/s)

Later more... need few attempts for 256 MB ...

Best Regards

Edit 1.

This my maximum length for 256 MB RAM...

0x4000 0000 length 0x[B]0FFF FFF[/B]0

Reading MCU address space from 0x000040000000 to 0x00004FFFFFEF
Completed in 00:11:48.984 (Average Transfer Rate: 369.75 kB/s)
[Bada Software and Hacking General] Rebellos:
It's possible that RIFF does use burst read of 16 bytes at once or it does read 4 bytes at once, or it's just something wrong there, it should read whole address space easily. Are you able to use 0x07FFFFFA, or FC, or F4? or something? Just asking out of curiosity, nothing important there anyway.

Edit:

Oh yes, to check boundaries, you don't have to read whole chip at once, you can start reading from 0x4F000000 and then try with 0x00FFFFF0 for example. ;)
[Bada Software and Hacking General] adfree:
I have tried

0x1000 0000
0x0FFF FFFF

Both failed... later I will post Error output...

I could try:

0x0FFF FFFE
0x0FFF FFFD
0x0FFF FFFC
0x0FFF FFFB
0x0FFF FFFA
0x0FFF FFF9
.
.
.
0x0FFF FFF1

Later I will post result...

Best Regards

Edit 1.

Now checking 0x0FFF FFF4

Edit 2.

Success... now 0x0FFF FFF8

Edit 3.

Success... now 128 MB... 0x07FF FFF8

Edit 4.

Success... now 0x07FF FFFB