yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] b.kubica:
all file footer looks the same

typedef struct s_bada_footer // last 1024 bytes
{
unsigned int magic; // always 0xABCDABCD
unsigned int addr; // nand(?) address
unsigned int unk0; // SBZ (=Should Be Zero)
char name[32]; // e.g. S8500
char ext[8]; // e.g. mbn, ffs
unsigned int unk1[5]; // some flags, values, to be checked later
t_cert_info info; // crypto data ( zeroed if file is not crypted )
char md5sum[16]; // MD5 sum of image ( without footer )
char padd[424]; // padding bytes, SBZ
} t_bada_priv;

typedef struct t_cert_info // 512 bytes
{
unsigned int magic; // 0x79461379
char cert0[324]; // ...

unsigned int magic; // 0x79461379
unsigned int length; // crypted length ( without footer )
char cert1[16]; // exist in image also at ( length - 0x10 ) position
char publickey[64]; // ?
char name[64]; // e.g. S8500+XX+JEE
char tool[32]; // TkToolVer famous string ;)
}

headers are different. boot_loader, Apps, Rsrc1, Rsrc2, fota and CSC don't have header.

dbl and Amss have 0x200 bytes header.

ShpApp, Factory FS, Partial FS have 0x60 bytes header

typedef struct s_bada_object
{
unsigned int offset;
unsigned int length;
char name[24];
} t_bada_object;

typedef struct s_bada_hdr200
{
unsigned int magic; // 0x12345678
unsigned int count; // count of objects below
char padd[24]; // padding bytes
t_bada_object[15]; // not used SBZ
} t_bada_hdr200;

typedef struct s_bada_hdr60
{
wchar_t name[16]; // UCS-2 name
unsigned int unk0[14]; // unknown
char padd[8]; // FF FF FF
} t_bada_hdr200;

from my observations, unk0 fields in FS system header are not *SO* important - I just preserve original values, removed files I want from factory FS, and put file back to phone
[Bada Software and Hacking General] faenil:
CSC has got its header, it's just that there are more files into 1 ;)

after about half the file, we come back to the same plain structure :)
[Bada Software and Hacking General] b.kubica:
very simple ( 2KB ) partial file system in attachment, all values from header preserved :)

FileSystem Shell
---------------------------

<1.> List Files
<2.> Get File
<3.> Put File
<4.> Delete File
<5.> Rename File
<6.> Dump all files

<0.> Quit

Type Size Flags Name
DIR 0x00000000 0x00000000 /Arggh
FILE 0x00000000 0x00000000 /Arggh/it_works.txt
[Bada Software and Hacking General] adfree:
It seems complete folder Security is "invisible"... Extracted from ShpApp.app

Now I see all Certs with correct names and Structure. :cool:

EncryptedPrivKeyFile :p

Maybe there are more hidden files/folders we not seen before...

Maybe we could inject Certs... as Test the DEV Cert from SDK... as we know how to check, but not which folder...

Best Regards
[Bada Software and Hacking General] Skin1980:
Let me say.... guys you are awesome!!!!
[Bada Software and Hacking General] b.kubica:
adfree,

we can quickly overwrite system files with custom partial FS, (also in SystemFS folders and the others) - that one posted above is flashed in 2s to phone - so this is quite good start though :)

I uploaded new version of fmtBADA plugin with small bug fixed. To be sure you've the latest version just check the bada subdir - I moved all files to folder with current date (it will be replaced if I upload next version)
[Bada Software and Hacking General] naoentrar:
I dont undertand wtf you guys are talking about, but it seems awesome progress.

Keep the good work dudes, goodluck
[Bada Software and Hacking General] b.kubica:
new version is out with full support for FS. I decided to rewrite fs_shell script so only three options stay

List all files

Dump all files

Upload all files

after full dump of file system we can add rename delete files in system explorer, after that easly upload it back to FS file.

that way (explorer based) was proposed by faenil, thanks for explonation of dummy bytes :)
[Bada Software and Hacking General] sabianadmin:
Can you post a link to the new version?
[Bada Software and Hacking General] b.kubica:
check my home page link
[Bada Software and Hacking General] faenil:
no problem man :) we try to help as we can :)

I'll release my software when it's ready :) it builds 100% correct FFS :)
[Bada Software and Hacking General] timwave:
Hi, can somebody tell me what FFS is and what is the usage of this?Thanks...
[Bada Software and Hacking General] adfree:
I think we will make soon Thread for this...

We mean this file from Firmware packages:

FactoryFs_S8500_Tmobile.ffs

So I think FFS stand for Factory File System...

File Sytem...

If you access System folders via sTune, PSAS or other Tools...

Best Regards
[Bada Software and Hacking General] b.kubica:
hi, i prepared short howto so it should help a bit :)

fmtBADA plugin support now CSC images so we can dump files from them also:

another script does a very simple amss modification - change_modem_name, so it will be displayed with new name

maybe later will come some more advanced patches :)

br,

ndt
[Bada Software and Hacking General] lasentenza:
Can we use it to name S8500 to S8530 and install firmware from S8530?
[Bada Software and Hacking General] _3mpty_:
it's MD5 on data[:-0x400]

----

Here's a python script to extract the files in ShpApp.app and *.ffs (actually it could extract files from all the "DCB" blocks in the fw, but the application "as-it-is" works only on ShpApp.app and *.ffs): hxxp://pastebin.com/4gyHNspt

Another really simple script to extract the ELF file contained into

hxxp://pastebin.com/9XZvPr01 amss.bin
[Bada Software and Hacking General] b.kubica:
actually,

md5 ( ALIGN64 ( length - 0x400) )

where ALIGN64 - align to 64 bytes

padding bytes needs to be zeroed
[Bada Software and Hacking General] faenil:
thanks man, even though we already solved this problem as I wrote in another post in this thread :)

it's md5 on FW-last1024bytes :)
[Bada Software and Hacking General] adfree:
After several hours of brainstorming... with only 1 AMSS from T-Mobile BOJE...

The MD5 never fits... :o :(

Then also problems to save changes with TriX... :confused: :o

Today lucky day. :D

1.

New TriX saves my modified amss. :cool: :cool: :cool: :cool: :cool:

2.

I understand why my amss not so easy...

3.

I checked other AMSS... and surprise... You can disable MD5 check.

:D:cool::cool::cool::cool::D

62696E0000000000000000000200000002000000

MD5 check is activated

62696E0000000000000000000100000002000000

Byebye MD5 :D :D

I overwrite MD5 with 00... no idea if important...

Checked short in Multiloader 5.62 as MD5 check is immediatly.

Now I will flash my amss and look if it will explode. :p

Best Regards
[Bada Software and Hacking General] b.kubica:
@adfree, md5 doesn't fit because of one reason - TriX does not rebuild amss exactly you put into - it removes e.g some debug data (never used), so the output amss is different - so the md5 is different also

about disabling md5 - I think this is not a good idea - we don't know in that case that amss is corrupted. TriX does md5 hash correctly, just try

btw - if you rebuild some FS image (csc, FFS, PFS etc) output file is identical - no data overhead to remove :)
[Bada Software and Hacking General] b.kubica:
once again i don't agree

ok, it works when we're working with FS images - they're aligned to 4000h

amss are only word aligned, and md5 hash is genearted from the data aligned to 40h, with padding bytes cleared
[Bada Software and Hacking General] faenil:
sure man you know I know that :)

but I created this thread for FFS checksum, so I did not care about amss :)
[Bada Software and Hacking General] adfree:
My fault to start with AMSS... but now I can confirm that disable MD5 check works for (all) files.

Tested by me:

amss.bin

CSC_***.csc

FactoryFs_***.ffs

Rsrc2_S8500(Low).rc2

ShpApp.app

:cool:

Step 1:

Search for HEX String at End of file. Should be only 1 hit:

020000000200000000080000000002

Change into:

010000000200000000080000000002

Step 2:

I overwrite the MD5 Hash at End of file with Zeros (16 Bytes). Not tested if mandatory...

Best Regards
[Bada Software and Hacking General] faenil:
nice :) even if it's almost useless given that we know how to calculate it :)

well, one less thing to calculate :D
[Bada Software and Hacking General] adfree:
PfsDeleteList.txt

I found this in *.PFS file...

Maybe we can delete folders... or delete/replace protected files...

I will soon test, if I can use *.pfs to install Dev signed Apps like bada SDK examples... or for instance the Flash example. :D

Or only *.swf files to replace... see here:

http://xdaforums.com/showthread.php?t=904555

I have compiled this stuff... now brainstorming how to add this into package...

as bada SDK or Broker.exe and Batch is too much hard for some user. :D

Best Regards

Edit 1.

I created Test PFS but I made something wrong... :o

As template I used this one:

http://xdaforums.com/showpost.php?p=10388645&postcount=20

Again Thank you very much. :cool:

Attached is my file...

Goal is to remove created folder under /Osp/1234567

Folder is created with PSAS.

But my file PfsDeleteList.txt is empty... 0 Byte. So I made mistake. :o

Please, can someone correct my attached file?

Thanx in advance.

Best Regards
[Bada Software and Hacking General] faenil:
already knew that, but thanks for posting, and keep posting ;)
[Bada Software and Hacking General] b.kubica:
@adfree, you do not need to use template - you can use your original PFS file. I tested it on my own and all looks fine. Just upload once again PfsDeleteList.txt file to image
[Bada Software and Hacking General] astrotom:
hey kubica!

I need a bit of help in using trix. After dumping FFS and editing them, when I uplad files back, there is no change in the FFS file. Could u please post in detail how to build back ffs files. Here is what I did:

1. Loaded the input file.

2. Loaded the fs_shell script in editor tab since when I load it in scripts tab, there is error: Trix does not know what to do..... But pfs files work properly in script tab.

3. Chose "3" for upload. Entered directory. It uploads the files.

4. Then chose "4" for quit.

But after checking the built ffs file, no change. Same as earlier. It seems the new files dont overwrite the old files :( Please help.

Thanks.
[Bada Software and Hacking General] mylove90:
you should choose 0 for quit not 4

after seeing the stop button is no longer available to press you can close trix and use your customized ffs file
[Bada Software and Hacking General] astrotom:
My bad. Actually I did enter 0 and not 4. After pressing 0, the stop button is disabled. But when I reopen trix and input the new FFS, its the same as the earlier one.
[Bada Software and Hacking General] astrotom:
Never mind. Sorted it out. Didn't know I had to provide an output file :P
[Bada Software and Hacking General] arjaylzo:
Trix plug-in request for the GT-S5620/Monte

I hope this is not too much to ask from you guys, Trix+FmtBADA is really a breakthrough. Unfortunately, I have been failing to PORT BADA to My Samsung Monte.

Please consider this, the BADA FW is very much alike to Monte GT-S5620 and the rest of the Non-Bada phone undfer TWUI 2.0 platform. Please consider creating a revision for the FmtBADA plugin. The plug-in as well as the script does not work for Monte. I got "No FS File" Error: -1. I'm hoping I would be able to edit SHP CSC and the rest as well.

Though somehow, Loading the .ffs file via WINIMAGE is the easiest way to manipulate and edit it on the fly, and simply remove the MD5 string from 02** to 01**

Manipulation of the FFS in monte enable to us to replace and remove Preset images and tones. As well as Widgets and JAVAs. BTW, the BADA FFS also can be loaded to the WINIMAGE as I was trying to salvage some widgets and JAVAs tones and Images from S533. I have a screenshot using WinImage.

Thank you in advance.
[Bada Software and Hacking General] adfree:
Short Video...

Maybe it helps to learn more about MD5...

This example is from S8600 file...

Best Regards
[Bada Software and Hacking General] hero355:
I checked your video.But really not understand that how to disable MD5 on S8600

Is it possible little explain ?
[Bada Software and Hacking General] adfree:
Value 02 is on same position like on S8500...

See Video... change first visible 02 into 01... (after I have marked CD AB CD AB)...

or

Second part of Video is, how to create MD5 Hash via WinHex...

Replace last 16 Byte.

Best Regards

---------- Post added at 07:45 PM ---------- Previous post was at 07:01 PM ----------

Btw.

S8600 seems really store file size into last 1024 Byte??

Compare end.bin/name.bin from different S8600 Firmware...

Maybe we can find position of filesize...

LEN means maybe Length...

Best Regards

---------- Post added at 08:02 PM ---------- Previous post was at 07:45 PM ----------

RC1 from S8600

XXKJC

40371200 Byte

2680400 (HEX)

XXLD1 bigger

41157632 Byte

2740400 (HEX)

Now we can compare end.bin/name.bin to find position of file size/length...

Best Regards
[Bada Software and Hacking General] hero355:
Then I got difference on end.bin

First window is edited .rc1 end

Second one is Unmodified XXLC3 .rc1 end

Now question if i change Orginial end file with modified then multiloader will accept or not ?
[Bada Software and Hacking General] adfree:
Sorry, my brain is at the moment "OFFLINE"...

I will collect few more RC1 and compare... then maybe I can answer... later...

Best Regards

Edit 1...

RC1 files taken from:

RC1	complete size	in HEX	name.bin ([B]visible[/B] differences)
XXKJC	40371200	2680400	00;68
M410K	40633344	26C0400	--;6C
M410S	40895488	2700400	10;70
XXLD1	41157632	2740400	0C;74

Now compare name.bin...

File size is Little Endian, without 1024 Byte...

- 0x400 ....

In end.bin 2 times filesize visible...

Again Little Endian...

Short summary... 3 x filesize is stored in RC1... Little Endian

Maybe later I will do some tests...

At the moment only theory...
[Bada Software and Hacking General] adfree:
Will check now UNCOMPRESSED RC1 WITHOUT Modification from XXLD1...

File is 50 MB + ...

Check this out for maximum sizes...

http://xdaforums.com/showpost.php?p=20188325&postcount=369

I have marked 2 position of filesize in end.bin aka 1024 Byte end... Little Endian

Wave_Remaker only generate filesize in name.bin... in Start Header...

So you have to do it by hand...

Or maybe we could use template... :D

Later more...

Best Regards

Edit 1.

First try with 50 MB failed... I have changed sizes in 2 postions to 00001003...

Next attempt is with smaller 40 MB like Original RC1 size...

Edit 2.

Wave_Remaker_NEW_0_2_9_5_1.exe and smaller then 40 MB success... :D

Without modification by hand...

Will check if somewhere bigger S8600 RC1 available as template...
[Bada Software and Hacking General] adfree:
S8600 RC1

Use these 2 files as template

Tested with Wave_Remaker_NEW_0_2_9_5_2.exe

1.

Dump with Wave_Remaker your RC1...

2.

Then replace!

Use attached files.

3.

Wave_Remaker_NEW_0_2_9_5_2.exe

Save as non compress .rc1

Now ready for Multiloader. :D

Caution!

Be sure not to use more then 51 MB.

http://xdaforums.com/showpost.php?p=20188325&postcount=369

Template allow few more Bytes... but maybe dangerous...

Successfully tested, without Modification... ALL files from XXLD1 =

51381248 Bytes

Big thanx Gunter33

Best Regards
[Bada Software and Hacking General] adfree:
@ hero355

:D

Greetings from User Gunter33

He created some S8600 Firmware files for study.

Maybe helpfull.

http://www.mobilenations.de/bastelecke/topic4282.html?sid=2fd5254a992e63346ed5de0276357c50

http://www.handy-faq.de/forum/samsu...custom_roms_fuer_wave_3_a-12.html#post2303787

Best Regards
[Bada Software and Hacking General] adfree:
Thanx Gunter33 :cool:

Templates for S8600...

MAXimum filesize...

For CSC also...

Caution. Use at your own risk...

I can at the moment only RC1 successfully confirm.

Too lazy to try the other files... :o

I will do now some experiments with RC2...

Btw. MD5 Hash check disable is SAME position... known from S8500 and S8530...

S8500/S8530 shows this in last 1024 Byte aka end.bin

MD5 enabled... normal use by Samsung

060000000[B]2[/B]00000002

Now change Value 02 into 01 to disable MD5 check...

060000000[COLOR="Lime"][B]1[/B][/COLOR]00000002

Now open eyes for S8600.

0[COLOR="Red"]0[/COLOR]0000000[B]2[/B]0000000[COLOR="Red"][B]4[/B][/COLOR]

Again, it is same postion only few Values different...

To disable MD5 for S8600...

000000000[B]1[/B]00000004

For S8600 it makes only sense in few cases...

But in general Wave_Remaker can generate complete valid files... :good:

Best Regards
[Bada Software and Hacking General] hero355:
Okay.

Thanks you adfree and also for Gunter33

Now firmware fully modified

Edited:

apps_compressed

ShpApp

FactoryFS

Rsrc1

CSC

Only Bug : Polaris office :D

Boot Binary Download Start Ch[0]
Pbl 24.6KB OK[0.2s]
AppsBoot 338.7KB OK[0.6s]
OemSbl 1757.7KB OK[2.9s]
Dbl 229.4KB OK[0.4s]
Wait reset !!
Download Start Ch[0]
FOTA 2883.6KB OK[4.4s]
Amss 16654.3KB OK[28.4s]
Apps 29622.3KB OK[43.5s]
DSP1 5650.5KB OK[9.3s]
Rsrc1 52428.8KB OK[76.4s]
Rsrc2 2980.3KB OK[4.4s]
FFS 60096.5KB OK[153.9s]
SHPAPP 151961.6KB OK[345.1s]
CSC 31940.6KB OK[58.0s]
All files complete[727.7s]
[Bada Software and Hacking General] adfree:
Gunter33 wrote something about flash second time as update or something similar...

Not tested nor confirmed...

But maybe someone can check with WinComm.

Maybe then more clear why Polaris fail...

Not tested by me. No time yet for S8600... :o

Best Regards
[Bada Software and Hacking General] hero355:
and here we go : http://xdaforums.com/showthread.php?t=2025567
[Bada Software and Hacking General] hero355:
Templates for S723X...

MAXimum filesize...

Caution. Use at your own risk...

Best Regards
[Bada Software and Hacking General] adfree:
Strange, never realized before...

But S8530 checks sizes in last 1024 Byte (end.bin) also for apps_compressed.bin...

Example:

http://xdaforums.com/showpost.php?p=37535236&postcount=16

Maybe we could explain this year, where all filesizes stored...

Next few days I will try to make example what I mean...

Best Regards
[Bada Software and Hacking General] Taxidriver05:
Create CFW version, where ShpApp.app has some more Bytes...

Maybe it works...

Currently for internal testings...

If it works, I'll post new file size limit...
[Bada Software and Hacking General] hero355:
Max bytes for ShpApp is from Chinese firmware
[Bada Software and Hacking General] Taxidriver05:
Well...

Didn't work...
[Bada Software and Hacking General] adfree:
"Something else" but same direction...

apps_compressed.bin... other FW files too...

In last 1024 Byte Footer aka end.bin are 2 x filesize stored... Little Endian.

Filesize means whole file WITHOUT last 1024 Byte...

Example... M210S LC and LF1... bigger then reserved space for S8530...

Reversed Order aka Little Endian...

00009C01

Hmmmm. Btw...

Maybe not 2 x lengths... maybe 1x lengths and same Value is Startaddress for Footer... last 1024 Byte aka end.bin aka Footer aka ugly Security Crap aka su...

:confused:

Best Regards
[Bada Software and Hacking General] adfree:
Little description...

I will start with boot_loader.mbn and apps_compressed.bin...

XXLA1 S8500 / S8530

Other bada like S8600 maybe differ more...

Value	Address	at:	Description	size
CDABCDAB	0x0	Header	4 Byte
00000000	0x4	Address MLoader	4 Byte
00000000	0x8	???	4 Byte
"modelname"	0xC	4example S8500	5 Byte
"empty" 00	0x11	???	27 Byte
fileextension	0x2C	4example mbn/bin	4 Byte
0000000006000000 0x30	"Header" ???	8 Byte
0200000002000000 0x38	MD5 Check ML ON/OFF	8 Byte
0008000000000200 0x40	???	8 Byte
79134679	0x48	"Header" Signature 1+2	4 Byte
"RSA 512 Sig"1	0x4C	4example enc modelname	64 Byte
"RSA 512 Sig"2	0x8C	Looks like enc SHA1	64 Byte
00000000	0xCC	???	4 Byte
0xD0	???	64 Byte
0x110	SEED KeyS for Crypto	128 Byte
79134679	0x190	"Header"	4 Byte
00001A00	0x194	Address CDABCDAB/size	4 Byte
0x198	COPY of last 16 Byte	16 Byte
"RSA 512 Sig"3	0x1A8	Looks like enc SHA1	64 Byte
"model"	0x1E8	Device + Version String 12 Byte
"empty" 00	0x1F4	???	52 Byte
"TkToolVer"	0x228	Version of DecryptAlgo	15 Byte
"empty" 00	0x237	???	17 Byte
0x248	MD5 Hash of file	16 Byte
"empty" 00	0x258	???	- end	424 Byte

Later more... maybe someone can help to explain whole 1024 Byte...

About included RSA 512 Signature, see here:

http://xdaforums.com/showpost.php?p=38042361&postcount=105

Best Regards
[Bada Software and Hacking General] adfree:
1024 Byte Footer contains 2 RSA 512 Signatures.

Each 64 Byte...

Decrypted with public key you can see this.

Sig 1 decrypted:

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673A9C76054F3A53383530302B58582B4C413100000000000000

You can see text:

Samsung:œvO:S8500+XX+LA1

Sig 2 decrypted:

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

Last 21 Byte... I think this is SHA1 (20 Byte)

No idea yet... maybe SHA1 from content of Sig1...

BOTH Sigs are mandatory and written into OneNAND... to seperate address...

This is from XXLA1 Boot.

Also apps_c Footer contain 2 Sigs... also written into OneNAND...

Also mandatory.

Later more...

Best Regards
[Bada Software and Hacking General] adfree:
Short summary...

1024 Byte Footer aka end.bin contain 4 x 64 Byte Blocks.

3 of them are RSA 512 Signatures and can be decrypted by public key.

64 Byte before SEED keys is SEED encrypted data... example XXLA1 S8500 app_compressed.bin.

S1-AGENT08
Korea
TkToolVer:1.8.0

This is boot_loader.mbn and apps_compressed.bin related for S8500/S8530...

Best Regards
[Bada Software and Hacking General] hero355:
Maximum Templates for S8600 Shpapp - 159 MB (167*604*224 bayt)
[Bada Software and Hacking General] hero355:
The minimum time for full flashing [Wave 3] :victory:
[Bada Software and Hacking General] adfree:
ERR : Diff Apps Nand Size 20000 4000

I have erased line where MD5 off is...

Later more...

Best Regards

Edit 1.

ERR : Diff Apps Nand Size 20000 [B]1[/B]0000

Edit 2.

ERR : Diff Apps Nand Size 20000 [B]9[/B]0000
[Bada Software and Hacking General] hero355:
WTF ?! Now possible to flash apps_compressed without modifiying bootloader ?

:eek:
[Bada Software and Hacking General] adfree:
:o

No sorry, I am trying to understand the last F§$ 1024 Bytes...

Best solution would be... find an way to ignore/disable complete last 1024...

But I have no F%)$$ idea... because tried many things... :crying:

Damn Bootloader stores Hashes + Signatures and compare them, if valid...

1 way would be FOTA... like this one... unsecdload.fota...

But this is not integrated I think... it disables something else...

Will try to study...

Best Regards
[Bada Software and Hacking General] adfree:
:D

Because little bit boring...

Only few textchanges... ASCII and/or Unicode... you can compare with Original MultiLoader V5.67.exe

But !

OWN RISK... not tested...

Maybe someone can easy remove from ML to write PRIVATE data to handset... like:

Windows User name
Country
[COLOR="Red"]your[/COLOR] IP address

Second wish... maybe Logfiles can be enabled... like in this Version...

http://xdaforums.com/showpost.php?p=36691747&postcount=13

Thanx in advance...

Best Regards
[Bada Software and Hacking General] adfree:
I need help, how ML send Command CMD_USB_SECURITY, to disable it...

ML 5.67

Childish test 1:

Search for 0x80

Found:

817 hits...

Search 2.

0x0380

Found 3 hits...

This would be nice... will try...

Search 3.

0x8003

Hits: 0

I hope after 3 tests...

Later more...

Best Regards
[Bada Software and Hacking General] Taxidriver05:
Maybe try to contact developer of MultiLoader? :confused: :silly:
[Bada Software and Hacking General] yakub234go:
About MultiLoader :p http://www.cpkb.org/wiki/Samsung_Multiloader
[Nook Color General] MkFly:
There's a few apps on the Android Market that I'd like to purchase. If I do that, and then later on restore my Nook to factory and re-root, will I have to purchase the apps again? Or is the purchase in some way linked to the serial number of my NC?
[Nook Color General] RoboRay:
I believe Market purchases are linked to your GMail account.
[Nook Color General] golfprorm:
Yes, Market purchases are linked to your account. For example, the apps I purchased for my Droid all show in my NC market as purchased, and I can download them for free.

Sent from my Nook Color