yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] adfree:
First success as it seems.

With modified Boot my DEcrypted apps_c now starts at 0x1BCC0000

:cool: :cool:

Now no time to check more...

Later more if I dream or I am closer...

Only this...

Short test to download XXLG1 apps ... then my XXLA1 not more start... so end.bin is mandatory... last 1024 Bytes do some magic...

I hope this is no problem later for full DEcompress...

Best Regards
[Bada Software and Hacking General] adfree:
Tested again...

Now I have 2 x apps_compressed.bin in my S8500

1 Original unmodified at 0x1100000

And the second one is Security disabled and marked with XXMA1...

Now with modified boot_loader.mbn my second apps_compressed.bin (decrypted allready and flashed as RC1... (combined with RC1 content...))

At 0x1BCC0000

:cool::cool::cool:

Now step 2...

Decompressed apps_compressed.bin... 50 MB instead 25 MB...

For this I have to shrink RC1, but this is no real problem... My smallest RC1 are under 10 MB... :D

I hope S8500 work with decompressed 50 MB without further modification...

For now this means.

I can play with apps_compressed.bin direct in HEX Editor, WITHOUT using Wave_Remaker to encrypt again before I can try... :angel:

Best Regards
[Bada Software and Hacking General] adfree:
New day... new attempt... :D

Prepared RC1 with DEcrypted + DEcompressed apps_compressed.bin...

= 50 MB + 7 MB RC1...

In OneNAND my apps_c is now at offset:

0x19B80000

Little Endian... reverse order...

0000B819

Now I will edit my boot_loader.mbn...

Later report...

Best Regards

Edit 1.

:crying: :(

I will check all things again... But this seems too much for S8500 handle now uncompressed apps_compressed.bin...

It expect QMD compressed blocks... or reserved Space in RAM or...

:eek: :o

Edit 2.

Debug Level not work in RC2 as apps_c not started...

My checklist...

1.

Now Fulldump with RIFF JTAG to control addresses again... maybe stupid me has not 0x0000B819 as new address...

Edit 3.

My address is correct...

Short checked older RAM dump... apps_c is written compressed into RAM without ELF Header...

Will check again about ELF Header... maybe other position stored...
[Bada Software and Hacking General] adfree:
Now my test with S8530...

XXLA1 DBT...

Step 1.

RC1 + DEcrypted apps_compressed.bin = 64 MB

Multiloader flashed without problems.

Download Start Ch[0]
Rsrc1 65273.9KB OK[24.8s]
All files complete[25.3s]

Step 2.

RC1 starts at:

0x[B]3600000[/B]

My apps_c somewhere behind...

If I find correct address now... then I will edit boot_loader.mbn.

And I hope 0x001177FC is correct place to edit... :D

Otherwise I have maybe an problem, as my S8530 not "JTAG enabled" yet...

Best Regards
[Bada Software and Hacking General] adfree:
Aha...

In last 1024 Byte aka end.bin are mandatory Info in 64 Byte...

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673AE0B0544F3A4D323130532B4B522B4C433100000000000000

As string:
"
" Samsung: TO:M21"
"0S KR LC1 "
" "

This is from M210S Firmware and the reason, why big problem with S8530...

Btw.

Again RSA Security :rolleyes:

this time RSA 512...

Public Key is also available...

Later more...

Best Regards

Edit 1.

S8500 XXLA1

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673AC579054F3A53383530302B58582B4C413100000000000000

As string:
"
" Samsung: y O:S85"
"00 XX LA1 "
" "

S8530 XXLA1

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673AD579054F3A53383533302B58582B4C413100000000000000

As string:
"
" Samsung: y O:S85"
"30 XX LA1 "
" "

S8600 XXLD1

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673ACD80824F3A53383630302B58582B4C443100000000000000

As string:
"
" Samsung: O:S86"
"00 XX LD1 "
" "

S8500 XXJB6

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673A5631844B3A53383530302B58582B4A423600000000000000

As string:
"
" Samsung:V1 K:S85"
"00 XX JB6 "
" "

Also this encrypted Signature is in boot_loader.mbn...

Will check later if 1:1 same...

Best Regards

Edit 2.

M410K

Decrypted signature :
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673ADBB9F34F3A4D3431304B2B4B522B4C463200000000000000

As string:
"
" Samsung: O:M41"
"0K KR LF2 "
" "
[Bada Software and Hacking General] hero355:
@adfree how to change flash adress of apps_c ? all flash adress changing from bootloader or how ?
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=38088383&postcount=68

In last 1024 Byte Footer aka end.bin address is stored as Little Endian...

BUT Bootloader controls reserved area...

You could use in Multiloader for instance ETC... and possible here to change easily address...

S8500 is "Standardaddress"

0x1100000

Select apps_compressed.bin via ETC in Multiloader... change then

0x110000[COLOR="Red"][B]1[/B][/COLOR]

This is 1 Byte later... but handset not allow... checked by Bootloader...

Best Regards
[Bada Software and Hacking General] adfree:
:D

This seems interessting...

RSA 512 public key is NOT in compressed area/block... :D

64 Byte long public key to decrypt for instance 64 Byte Signature from "end.bin"

BF1834F775B9861F13E15BA3E01F91CED970B76F2E9D5767EC39C5C1DAD7A8AF9F2A60F131E1D3715E15FDE4B07AC04BF5FC148D95BFF180E9F675D6211F76F1

According to this...

http://xdaforums.com/showpost.php?p=38051731&postcount=188

I could now make tests with apps_compressed.bin AND boot_loader.mbn to replace pub key...

Best Regards

Edit 1.

Test 1...

Nuked 64 Byte public key with FF...

Multiloader flash success, but apps_c not start...

Test 2.

Replaced public key with my own...

Multiloader flash success, but apps_c not start...

Test 3.

Replaced public key with my own... and replaced Signature in Footer...

Multiloader Error : Apps Write [0.1s]

Test 4.

I think I have to do this also in boot_loader.mbn...

Own pubkey + own Sig...

Result later...

Edit 2.

Bootloader replace pubkey + flashed successfully...

Only possible if Sig in Footer is ORIGINAL... but now damn sideffect because Securitycheck is in chain...

Wave is alive but I have now BIG problem to go back to Original state...

So I think I have to use RIFF JTAG... repair my Signature pubkey missmatch...
[Bada Software and Hacking General] b.kubica:
hi,

i need a list of firmwares DisableBadaIntegrity won't work

of course not all just few of them
[Bada Software and Hacking General] hero355:
S8500 - All bada 2.0 firmwares supported

S8530 - All bada 2.0 firmwares supported

S8600 - Only this option skipped : CheckAppIntegrity not found (skipping)! --- http://xdaforums.com/showthread.php?t=1372861&page=27

S7230E - All bada 2.0 firmwares supported

BTW removing operator name not work properly,Example blabla3G when used with script it is show blabla just removing only 3G word

And my problem with TriX on Windows 8.Previously it worked on win8 and now i reinstalled Win8 and when i open it says TriX has stopped,What can be problem :/ I don't want to reinstall Windows for this

Thanks
[Bada Software and Hacking General] b.kubica:
did you try troubleshoot compatibility option?

maybe win8 has own VC10 CRT
[Bada Software and Hacking General] hero355:
Yes tried all option troubleshoot compatibility Win /XP all not work

Previosly also win 8 installed and worked well.But in this one it is annying me

How to know VC10 CRT ?
[Bada Software and Hacking General] b.kubica:
copy that 2 files to trix main folder, i hope this help
[Bada Software and Hacking General] hero355:
Unfortunately this also not helped :confused:

Same issue Trix.exe has stopped
[Bada Software and Hacking General] adfree:
@ b.kubica

Please, any idea what is checked/compared from apps_compressed.bin?

Example XXLA1 from RSA 512 Signatures from 1024 Byte Footer... decrypted content:

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0053616D73756E673AC579054F3A53383530302B58582B4C413100000000000000

Especially these 4 Bytes looks like CRC...

C579054F

Second decrypted ... looks like SHA1...

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00[B]C7FCC446B410CC5529FFA53645FB6E44BF899DD5[/B]

In JTAG dump we can find 512 Byte Info Block at:

0x1E808000

Here are stored all 4 RSA 512 Sigs... 2 from Boot, 2 from apps_c

From Boot I can find decrypted SHA1 at:

0x00482200

Looks like 400 Byte Info Block...

Thanx in advance.

Or disable whole RSA 512 Check in Boot is "easier"... :confused:

http://xdaforums.com/showpost.php?p=38178347&postcount=193

Thanx in advance.

Best Regards
[Bada Software and Hacking General] b.kubica:
no idea

i have neither wave device nor free time but imho disabling is easier than trying figure out how signature checks work.

the most safe method of playing with apps/BL is to use fota module

edit.

fota has sd card support, why not to load modified apps from sd/moviNAND?
[Bada Software and Hacking General] adfree:
1.

I know only 3 user...

mijoma who has found FOTA Power..

You

Rebellos

I have NEVER seen other user with FOTA knowledge...

This exceeed complete my knowledge/skills...

2.

FOTA is not for S8600...

So I can not use this for my M410K/M410S project...

Also, this exceed complete my knowledge...

3.

Please remember I am an user. I can use something... but not develop nor compile undocumented "sources" from FOTA...

4.

Their are ever more then 1 way... in German.

Es gibt mehrere Wege nach Rom...

5.

Ich möchte gar nicht wissen, wie lange ihr das schon wusstet. Das man die RSA 1024 Checks einfach mit Copy&Paste im Boot disable kann.

Ich fühle mich leicht va., weil das soviel Zeit gekostet hat... JTAG Allergie...

Und jetzt 3 Experten, wovon der eine eh keinen Bock hat auf bada... Und die anderen keine Zeit mehr haben... :good:

6.

RSA Check is old... used more then 10 years in mobile World... Also will be used in future... all Manufacturer, not only Samsung...

FOTA is limited to Samsung only...

It's okay.

That's life...

Best Regards
[Bada Software and Hacking General] adfree:
Handset detect in 0,3 Seconds if apps_compressed.bin is valid/allowed or not...

With Screencap I can see what is uploaded into handset...

32768 Bytes

If I look into decrypted apps_compressed.bin... then I see this in this area...

Type : Unofficial Version
Number : 1243
Builder : superuser
Host : S1-AGENT08
Date : 2012/01/05
Time : 19:21:46
Size : 42730876 bytes
[B]CheckSum[/B] : 0xf4e364eb
View

Checksum no idea what exactly is checked...

I will compare few apps_compressed.bin, maybe then clear what is checked...

Maybe then easy copy&paste possible...

Best Regards
[Bada Software and Hacking General] adfree:
Maybe good idea to compare XXLA1 DBT S8500 and S8530...

Sig 1 from S8500 contain:

C579054F

Now look here:

CheckSum : 0x[B]f4[/B]e364eb

Sig 1 from S8530 contain:

D579054F

CheckSum : 0x[B]f4[/B]ed916f

Will compare more apps_c and then I will try few tests...

Best Regards

Edit 1.

S8500 XXKL6 XEO seems good to compare...

Changes not in ELF Header... only after 0x150... will check now 2 Sigs...
[Bada Software and Hacking General] adfree:
Hmmm... maybe magic is in 1024 Byte Footer...

http://xdaforums.com/showpost.php?p=38088383&postcount=68

Not clear what is in end.bin... need more details.

Next try if ELF Header is signed... so from 0x0 to 0x150...

But this could not not be true...

0x150 length between XXKLA1 and XXKL6 are 1:1 same, but Sigs differ in Footer...

Screenshot is taken from XXLA1, after I have overwritten with Zeros... 183 Byte at offset:

0x156

So text strings are taken from somewhere else...

Best Regards
[Bada Software and Hacking General] hero355:
Downloaded Trix V0.8 now seems to be working Thanks
[Bada Software and Hacking General] adfree:
Need help about Seed Key and how it works exactly... :D

It seems difference between Key(s) in Boot and apps_c...

My steps...

I have reduced apps_c to 16 Byte + 1024 Footer... end.bin...

http://xdaforums.com/showpost.php?p=38088383&postcount=68

Need complete explanation...

Thanx...

Best Regards
[Bada Software and Hacking General] adfree:
This is example to show how SEED work...

Taken from XXLA1 apps_compressed... first 16 Byte + reduced end.bin 1024 Byte Footer...

Wave_Remaker_0_0_8.exe

I have totally forgotten about Modification for apps_c... :o

So I use better older Wave_Remaker to prevent false result...

You can see decryption and encryption is possible with these 128 Bytes in Footer...

Last 16 Bytes are FF... this is different to boot_loader.mbn...

Will try to understand how exact Seed work...

For now I think 2 keys... 112 + 16 Byte... will try.

Best Regards

Edit 1.

My fault... Keys seems also 16 Byte...

http://tools.ietf.org/html/rfc4269
[Bada Software and Hacking General] b.kubica:
standard seed algo was modified a bit by s*msung
[Bada Software and Hacking General] adfree:
I have tried to understand source from Wave_Remaker... but small brain... :o

I am not sure what else is in 1024 Footer... 80 Byte Block complete unclear for me... :o

What is this? Taken from XXLA1 after 16 Byte FFFF...

94A9BDA62C4640BB1C02CD04E2C7C6390FACBD41DB14DCD13FDBBF855C023F626F0751161566B5C4CF1801F855C04F50616C012DF5F53F477357D4E88D1C98B56D7CE8D1C95E78B7F215726DA7017A0053383530302B58582B4C4131

Maybe also SEED encrypted ?

Thanx in advance.

Best Regards

Edit 1.

Seems mandatory for apps_compressed.bin ... I have removed this 80 Byte block... result.

Error : Apps Write [6.2s]
[Bada Software and Hacking General] b.kubica:
what about method i described here

http://xdaforums.com/showthread.php?p=21356850#post21356850

there is explained what is at 0x198 offset of footer

0x198 - 0x10 bytes - last 0x10 bytes of encrypted data are stored in footer at offset 0x198

0x1A8 - 0x40 bytes - rsa signature taken from sha1 hash of 0x160 bytes (in footer 0x48-0x1A7)

that's all

what key is used to sign that RSA? not sure, for me easier was to bypass it in method described above

edit..

another thing is that apps length (stored in footer at 0x194) is sha1'ed, then signed so it really complicate changing apps length... i will try to look to BL tonight
[Bada Software and Hacking General] adfree:
:good:

Thank you very much, this was the missing part. So not 80 Byte Block... but 16 + 64 Byte...

64 Byte again RSA 512... decrypted with public key:

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00[B]E2AA6FF53205E4567037BFF334077A00D85E07ED[/B]

So Footer 1024 Byte contains 3 x 64 Byte... = 3 RSA 512 Sigs...

We can decrypt them...

I can see SHA1, but don't understand where, what...

In theory I think.

Multiloader upload FIRST Footer 1024 Byte...

Bootloader checks Footer by decrypt and compare SHA1... of only 16 Byte... :confused:

This sounds funny...

Best Regards

Edit 1.

For me now only last 64 Bytes from Footer not clear... XXLA1 S8500 apps_c at 0xD0, before SEED keys...

5F9D7274AA4C25ED2625CC149ECA0702C3DD028FFD6DC4AAB129C182D5DB02C5EACEDF7ADAD5EF45EF6FDF56072B9F51E286F4680DEF1753166CB2F5201D1525CC5F7004F82E9804800A5E060E3A6030

Seems also mandatory... if removed from Footer, again this Result..

Error : Apps Write [6.2s]

Edit 2.

Short tested to add last 16 Byte again and corrected in Footer Lengths...

[B]1[/B]0009801

Also corrected MD5 Hash... but Multiloader "... hash check"...
[Bada Software and Hacking General] adfree:
:rolleyes:

64 Byte BEFORE SEED keys is SEED encrypted data... :rolleyes:

Little bit text + 2 x 4 Byte CRC/Checksum it seems...

53312D4147454E5430380000000000004B6F7265610000000000000000000000546B546F6F6C5665723A312E382E3000A5D5B4BC00000000C579054F00000000

S1-AGENT08
Korea
TkToolVer:1.8.0

Best Regards
[Bada Software and Hacking General] b.kubica:
footer data at 0x48-0x248 is gpCertInfo writed to flash at 0x1DC40000

a will write here some functions related to that info (these are random funcs, i write here to not forget them ;)

dload_nand_write, SysSecBootDecryptCode
[Bada Software and Hacking General] adfree:
@ b.kubica

What is needed, to use FOTA to download apps_c like zImage...

:confused:

Thanx in advance.

Best Regards
[Bada Software and Hacking General] Rebellos:
Implementation of Multiloader flashing protocol in bTerm.
[Bada Software and Hacking General] adfree:
So complete Unpack routine for zImage is in FOTA file ?

Or gzip Standard Operation in Boot ? :o

I am asking, because FOTA file unpack/decrypt also unfinished... for me...

http://xdaforums.com/showpost.php?p=39959571&postcount=138

For instance to check M410S FOTA file for Bootfiles...

Best Regards
[Bada Software and Hacking General] Rebellos:
zImage is self extracting archive. FOTA just loads it into memory and executes it.
[Bada Software and Hacking General] adfree:
I have tried MANY things to bypass d&%$ 1024 Byte "Signature" Footer Security check...

Found no solution... :o

Also I don't understand Checksums...

1.

Type : Unofficial Version
Number : 1243
Builder : superuser
Host : S1-AGENT08
Date : 2012/01/05
Time : 19:21:46
Size : 42730876 bytes
[B]CheckSum : 0xf4e364eb[/B]

:confused:

Size shows 7 MB less, then our decompressed file is?

:confused: :confused:

2.

Damn RSA 512 Signatures...

53616D73756E673A[B]C579054F[/B]3A53383530302B58582B4C413100000000000000

C579054F What is this ? Where is this ?

Taken from first RSA 512 Sig in XXLA1 S8500...

Best Regards
[Bada Software and Hacking General] Rebellos:
Your approach makes me think of empiric scientists in 19th century, when noone had clear idea how molecular physics is working so they tried everything on anything and after experimentd proper theories were created. There is no need of doing like this when working with 100% human made stuff. The rules how it is working are clear, and you do not have to re-discover America here. Just do some reading, static analysis, make a-priori concept, and then just confirm it with some Proof of Concept. You are doing it wrong.
[Bada Software and Hacking General] adfree:
Now I've found correct Button... ;)

Best Regards

Edit 3.
[Bada Software and Hacking General] adfree:
Moved back to bada 1 for tests...

XXJEB

RC1 follows direct after apps_compressed.bin...

XXJEB Boot also allow logging in WinComm at "start"... for instance during loading Battery Animation if "offline"...

Hopefully XXJEB is lowest Security... :o Maybe more holes, because it seems FOTA is not enabled...

If I find RC1 start in Boot, maybe I have chance to merge/combine 2 partitions to 1 decompressed apps_compressed.bin...

Short tested writing apps_c with JTAG...

Also no success... 0x0110 0000 - 0x4800 0000 is not enough to change...

Damn Signature or Hashes stored somewhere else are mandatory to match apps_c...

If Boot detect wrong apps_c... Upload data to PC Mode is locked... no output for study possible...

Only 2 Pics from RC2 displayed... Logo... or Battery...

Hmmmmm. I have no idea if apps_c do selfcheck... :o

Or this is Bootloader function...

Because WITHOUT apps_c also FOTA tweaking has no effect...

About the 3 RSA 512 Keys...

DevelopPubModulus

This seems clear... this is f§% Sig in 1024 Byte Footer...

Other 2 I have removed from Boot... seems no big effect... accept not easy via Multiloader...

For study...

BL3_univ.map... other 2 RSA 512 keys:

MassProductPubModulus
FuturePubModulus

...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

Now I am able to upload via JTAG CMM Script...

SYStem.CPU CORTEXA8
SYStem.JC 4mhz

break

r.s cpsr 0xd3
d.s SD:0xe2700000 %LE %LONG 0x00000000
d.load.b apps_DeDe.bin 0x40000000

r.s PC 0x40000000
go

enddo

Info about start address I found via bada SDK...

Example for BATCH file...

C:\bada\bada_SDK_2.0.4_Common\Tools\Toolchains\ARM\bin\[B]arm-bada-

eabi-readelf.exe -h[/B] apps_DeDe.bin

Pause

Then you can see something like this:

ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
[B]Entry point address: 0x40000000[/B]
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x5000002, has entry point, Version5 EABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0

Here S8500 XXLA1... S8600 etc. deliver other addresses...

Best Regards

Edit 1...

If I dump at address 0x4000 0000 then it seems apps_c first 256 KB are only Info Block...

Hmmmmm, so I have to cut first 256 KB...
[Bada Software and Hacking General] adfree:
Progress about Security... :angel:

http://xdaforums.com/showpost.php?p=42435753&postcount=6

512 Byte Info Block stores info about Boot + apps_compressed.bin and few things more...

Will do some tests...

1. Successfully done.

Fixed my problem with M210S Firmware on my S8530... :good:

2.

Will check if any apps_compressed.bin is accepted. For instance from:

S8500 or

M210S

Or Boot alone checks if valid...

3.

If I have finished investigation of this 512 Byte, maybe then I am smart enough to flash XXJB6...

:D

Best Regards

Edit 1.

Second test success... if I erase this active 512 Byte Block, then I can flash M210S apps_compressed.bin... and start.

With S8530 Boot...

Will test again with S8500 apps_compressed.bin ... maybe for fun then S8600 apps_c ...
[Bada Software and Hacking General] adfree:
From M210S apps_c...

7E02[B]EE[/B]0000300100009C017913467921FE3CBFA78150058F1B1A17E00BFA859BE7515123705D7A3D7C54DB281FE2F96B5994D94D16E5E0E66EE66BC35E86649F80BD91D7418899C853B5D191B1A51E0E38AE8390326F37E8BA5F2D4BEBECD3881AC1AE83518CD775032C34335451A0E8D88BD1AB38F20CE1D6A7423981F935EC093100766832589089F6C644689735000090007560DE060DCDAF1794025712212E06E9A6B24B32C58F3AC1E5A84DA44A783173C8FDFA41CF0154156625ECBC782A33D43CECAA1515C22B11F21F043167645342F082AF0AA2CA0003E8784400FE15540146F69A0A0A3A740C35ABCC0A9064640D411B9C046FE1C219E44AFC01675A2600B0DE3A0FA1BB2B1BE0B8573888D08A0028211A0128246909386A1605887CA1188E2E831AF8E752064A980A1759F1EF0145658107E472840BA089C80520060B07FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7913467900009C016D4B3A90D3E1D280368B151FC42CEFF23A7FA9430CBDCB0F1973CDFAEF50F94C5359FFC3013C0D86A9AE0F9ADD83A95B917B22837752576970D29BE6D60F6617CE2EE19AC9DAE8ED9616DEAD84AF18604D323130532B4B522B4C433100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000546B546F6F6C5665723A312E382E300000000000000000000000000000000000B0D07E

According to my small knowledge about Flashing...

Multiloader sends 512 Byte from 1024 Footer in ERASE Command from apps_compressed.bin...

http://xdaforums.com/showpost.php?p=42684141&postcount=27

Then next Write Command contain 33023 Byte...

I can not fully sniff for now... but...

Compared with Original apps_compressed.bin... after 18 Bytes follows 2 Byte "CRC"...

In other words... Multiloader prepare/modify apps_compressed.bin on PC site... before send.

It seems handset interrupt before 0x8000 is reached...

Hmmm. But I have tried...

:confused: :confused:

Will check again, maybe mistake from my side...

Also I will try to sniff whole data... :o

Again I have problem to catch whole 32 KB... I have only 1 KB...

Maybe then more clear...

Best Regards