yashsingh1/xdaforums huggingface dataset:
[Bada Software and Hacking General] Tigrouzen:
Im confused but maybe you know about that PVRTextTool find it on BADA SDK

That seem compression algo with any image

Also samsung gdb tools

this is all bin you can use and its works on win and you see "arm-nucleuse"!!!

C:\bada\2.0.1\Tools\Toolchains\ARM\bin
[Bada Software and Hacking General] b.kubica:
decompressed bada 2 apps :)

http://nokix.sourceforge.net/trix/bada/S8500XPKH3_APPS.7z
[Bada Software and Hacking General] ho1od:
Thank you very much

You're a great man

Now I can debug routine decompression :)
[Bada Software and Hacking General] adfree:
I want for instance upload dumped apps_compressed from S8500...

KK6 ready for Multiloader

Dumped via JTAG...

Now I have some problems to identify correct end of file. :confused:

Bigger file is no problem. TriX decompressed only valid data... :cool:

How TriX know where it ends?

Filesize?

Size : 42730876 bytes
CheckSum : 0xf4f72020

:confused:

Thanx in advance.

Best Regards

Edit 1.

It seems now static filesize...

42730876 bytes... since KJ1...

Maybe because easier for FOTA...

The FFFFFFFFFFFFFFFFFFF at end of file from decrypted apps only, seems only as filler... to overwrite memory...

Multiloader seems not erase this area... only overwrite
[Bada Software and Hacking General] adfree:
http://www.megaupload.com/?d=I66QLIQ7

FOTA KK6 dumped via JTAG from S8500...

Caution!

It is decrypted in memory... NOT decompressed.

It is valid, but I have not found correct end of file... maybe 30 KB nude pics from me... ehm I mean something else :D

It seems FOTA use this area also as temp during install FOTA. :confused:

Decompressed size seems now ever:

42730876 bytes

This seems not mean also compressed size is ever same... :confused:

Best Regards
[Bada Software and Hacking General] ho1od:
Struct from b.kubica

typedef struct
{
unsigned int magic; // MAGIC_QMD
unsigned int data_offset; // data offset, 0x40000
unsigned char version[4]; //
unsigned int unk0; // 1
[B][COLOR="Red"]unsigned int decomp_len;[/COLOR][/B] // decompressed length
[B][COLOR="Red"]unsigned int comp_len;[/COLOR][/B] // compressed length (with header)
unsigned int unk1; // SBZ
unsigned int decomp_len2; // decomp_len
unsigned int unk2; // SBZ
unsigned int page_offset; // page table offset ;)
unsigned int page_size; // page table length ( 0x40000 - page_offset )
unsigned int unk3; // 0x0F000000
unsigned char unk4[0x10]; // 0
unsigned int unk5; // differ, CBZ?
unsigned int comp_len2; // comp_len
unsigned int unk6; // SBZ
unsigned int header_size; // 0x40000
unsigned int header_size2; // header_size
unsigned int header_size2_1; // header_size
unsigned int page_len; // 0x1000
unsigned int unk7; // SBZ
unsigned int page_len2; // page_len
unsigned char unk8[0x20]; // 0
unsigned int tab[8][4]; //
t_qmd_entry entry[]; // (page_offset - 0x100) / sizeof(t_qmd_entry)
} t_qmd_header;
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=18489184&postcount=40

:o

Sorry, I did not understood. That apps_compressed is also minimum since XXJL2 bada 1.2 secured...

:o

Amazing how powerfull protection from Bootloader is... :eek:

I was playing again with JL2 and were wondering why no success with my confirmed stuff...

This is the most reason, why I "never" change Bootloader... Sometimes I forget this.... :D :o

Now I can soon go back to my bada 2.0 tests...

Best Regards
[Bada Software and Hacking General] adfree:
Hmmm...

MBUKI seems last one, where apps_c mod is possible...

Tried KJ1, KK5, KK7... no chance...

Success on KG5... and MBUKI...

Wiil try if I can find Bootloader compatible with KK5... KK7...

Will check FOTA Bootloader... KKV...

Best Regards
[Bada Software and Hacking General] b.kubica:
no need for research

downgrade BL to xxjee in my case, modify apps_compressed. use ML to dload it using xxjee BL. after all upgrade bootloader to current one (from 2.0)
[Bada Software and Hacking General] adfree:
This time I have understand, but with this method I have failed on KJ1, KK5, KK7...

With MBUKI and lower is possible... success. :cool:

But higher then MBUKI not found working way...

It seems now Bootloader checks again integrity...

Bootloader from MBUKI not work on KK5...

Maybe you could confirm KK5, KK7 as working. :)

Please.

Sometimes I make mistakes... :o

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=20561830&postcount=96

Here I have attached 2 Bootloaders (JTAG dump)

Soon I'll rebuild them and make them Multiloader compatible...

Maybe KKV based on XXJL2 has less Security to bypass my changes to KK7 apps_c...

Best Regards
[Bada Software and Hacking General] adfree:
__smlEasySystemGetOpenApiVer: Open API Version (PlatformVersion) - [B]2.0.0[/B]
__smlEasySystemGetOpenApiVer: Open API Version (PlatformVersionString) -
[B]2.0-1111302137LISS8500XXKK7[/B]

This is from XXKK7...

Now I'll check XXJL2...
[Bada Software and Hacking General] Rebellos:
Looks like 2011 November 30 - 21:37, is it some debug string?
[Bada Software and Hacking General] adfree:
I need bada Version/API identification... :)

So priority is focused on 2.0.0

;)

Best Regards
[Bada Software and Hacking General] adfree:
Hmmm...

MBUKI is the last one, where Modding is possible... :confused:

I have tried few combinations but ever failed on higher Versions like:

KK5

KK7

PMKL2

Maybe only my Mod is higher secured... :confused:

Will try other positions... later...

We need compatible 2.0 Boot for apps_c Mod...

MBUKI Bootloader is not more compatible with higher Versions... :(

Best Regards
[Bada Software and Hacking General] b.kubica:
did you try change addresses for nand write? BL should be compatible (decrypt/decompress routines the same)

for KI1 we have:

RCS - 0x03A00000

RC1 - 0x05D00000

RC2 - 0x03600000

for KL6 we have:

RCS - 0x03600000

RC1 - 0x19800000

RC2 - 0x1D900000

change addresses for that files to oldest and try again
[Bada Software and Hacking General] Rebellos:
I know its abit offtop but...

I'm looking for S8530 Bada 2.0 pack with bootloader ELFs. Do you know any ROM like that?
[Bada Software and Hacking General] adfree:
You are welcome. :cool:

If I see ELFs for S8530, I will inform you.

Best Regards
[Bada Software and Hacking General] hero355:
For ELF File : You Can Find Both S8500/S8530 On Asian LD1 all firmwares
[Bada Software and Hacking General] hero355:
And Also have Turkish and Indian Firmwares :)

S8500/S8530 JVLC2

S8500/S8530 DDLC2
[Bada Software and Hacking General] hero355:
Latest S8530NELH2/S8530DRELH2 firmware also has ELF
[Bada Software and Hacking General] Rebellos:
Could you upload pack of ELFs please? :}
[Bada Software and Hacking General] coties:
Pack of ELFs S8530NELH2/S8530DRELH2

http://www.mediafire.com/?wmadhwcpqjz9sck

Best Regards
[Bada Software and Hacking General] mijoma:
Anybody have seen ELFs for S8600?
[Bada Software and Hacking General] hero355:
There is no much full firmware for s8600 and never seen elf file
[Bada Software and Hacking General] adfree:
Good question...

Maybe we could check few "sources"... like GSM... forum...

Maybe someone has these ELFs...

I have not seen yet.

If I can find them, I will report.

Best Regards

Edit 1...

If I rememeber correct... for S8530 via Google search algo like this:

BL1_univ_evt1.elf

So maybe stupid Question how ELFs name convention looks for instance for broadcom devices like S7250, S5380... :confused:

Any ELFs for S7250,S7230, S... found ? :confused:

Thanx in advance.

Best Regards
[Bada Software and Hacking General] adfree:
Theme contain Color Info...

Like this:

<[B]Style_B051[/B] color="0x5fa9ff" opacity="100"/>

In SamsungThemeTouchwiz3.xml

Now I see this in apps_compressed.bin

Style_A011 Style_A012 Style_A271L1 Style_A271L2 Style_A272L1 Style_A272L2 Style_A273L1 Style_A273L2 Style_A273L3 Style_A281 Style_A282 Style_A283 Style_A284 Style_A285 Style_A321 Style_A322L1 Style_A322L2 Style_A322L3 Style_A322L4 Style_A322L5 Style_A322L6 Style_A323 Style_A324 Style_A325L1 Style_A325L2 Style_A326 Style_A401L1 Style_A411L1 Style_A421L1 Style_A422L1 Style_A422L2 Style_A422L3 Style_A423L1 Style_A423L2 Style_A423L3 Style_A424L1 Style_A424L2 Style_A424L3 Style_A424L4 Style_A425L1 Style_A425L2 Style_A425L3 Style_A425L4 Style_A425L5 Style_A426L1 Style_A426L2 Style_A427L1 Style_A427L2 Style_A428L1 Style_A428L2 Style_A428L3 Style_A4310L1 Style_A431L1 Style_A432L1 Style_A432L2 Style_A432L3 Style_A433L1 Style_A433L2 Style_A433L3 Style_A434L1 Style_A434L2 Style_A434L3 Style_A434L4 Style_A435L1 Style_A435L2 Style_A435L3 Style_A435L4 Style_A435L5 Style_A435L6 Style_A436L1 Style_A436L2 Style_A437L1 Style_A437L2 Style_A437L3 Style_A438L1 Style_A439L1 Style_A439L2 Style_A439L3 Style_A439L4 Style_B011 Style_B021 Style_B031 Style_B032 Style_B033 Style_B034 Style_B034L1 Style_B034L2 Style_B035 Style_B041 Style_B042 Style_B043 Style_B051 Style_B052 Style_B071 Style_B072L1 Style_B072L1P Style_B072L2 Style_B072L3 Style_B073L1 Style_B073L2 Style_B073L3 Style_B074 Style_B075 Style_B081 Style_B081L1 Style_B081L2 Style_B082 Style_B083 Style_B083L1 Style_B083L1P Style_B083L2 Style_B084L1 Style_B085L1 Style_B085L1P Style_B085L2 Style_B085L3 Style_B085L4 Style_B091 Style_B092 Style_B093 Style_B094 Style_B101 Style_B102 Style_B103 Style_B104 Style_B105 Style_B111 Style_B121L1 Style_B121L2 Style_B121L3 Style_B121L4 Style_B121L5 Style_B121L6 Style_B131 Style_B132 Style_F011L1 Style_F011L1P Style_F011L2 Style_F011L3 Style_F011L4 Style_F011L5 Style_F011L6 Style_F011L7 Style_F021L1i Style_F021L1iP Style_F021L2i Style_F021L3i Style_F021L4i Style_F021L5i Style_F031L1 Style_F031L1d Style_F031L1p Style_F031L2 Style_F031L2d Style_F031L2p Style_F041i Style_F051L1 Style_F051L2 Style_F061 Style_F062 Style_F071 Style_F072 Style_F073 Style_F074 Style_F075 Style_F081 Style_F082 Style_W011 Style_W011d Style_W021 Style_W021d Style_W022 Style_W023 Style_W024L1 Style_W024L2 Style_W025 Style_W026 Style_W027 Style_W028L1 Style_W028L2 Style_W029 Style_W031 Style_W032 Style_W033L1 Style_W033L2 Style_W041 Style_W051 Style_W052 Style_W061 Style_W071 Style_W072 Style_W081L1 Style_W081L2 Style_W091 Style_W101 Style_W111 Style_W112 Style_W121L1 Style_W121L2 Style_W131L1 Style_W131L2 Style_W132 Style_W141 Style_W151 Style_W161

Best Regards
[Bada Software and Hacking General] adfree:
:confused: :D

SHW-M210S_SKT_1_20110725135129.zip

apps_compressed.bin is 50 MB ...

Will check something...

Best Regards
[Bada Software and Hacking General] hero355:
because it is bada 1.2 and it is normal :D
[Bada Software and Hacking General] adfree:
:o

Sorry, totally forgotten.

But, if bada 1.x compressed file is 50 MB...

For instance XXLA1 DEcompressed file is 48 MB...

2 MB smaller...

No idea if partition is changed... But maybe it is possible somehow to use decompressd apps_c. in bada 2.

Best Regards

Edit 1.

First attempt...

ERR : Apps Erase

Maybe no 50 MB reserved in bada 2

Will check in JTAG dump...

Edit 2.

http://xdaforums.com/showpost.php?p=20188325&postcount=369

My fault...

Only 33 MB reserved for apps in bada 2...
[Bada Software and Hacking General] adfree:
Something else...

It seems TriX Script is not impossible... to understand. :o

Thank you very much b.kubica :good:

I will try to change this String...

/System/Rsrc/Bmp/Black/

I have an idea...

First try I could use 10 or 12 Bytes...

Btw...

In apps_compressed also this can be found in XXLA1...

/System/Rsrc/Bmp/Blue(Base)/
/System/Rsrc/Bmp/Pink/

Best Regards
[Bada Software and Hacking General] b.kubica:
yes it simply ask you about "Which address want to decompress (chunk type 8 is supported for now only)?"

so if you know at which address is something interesting in your apps (firstly decompressed) then you can use DecompressAppsChunk to unpack that chunk, but still the whole apps will be valid qmd file to flash
[Bada Software and Hacking General] adfree:
:o :(

Thanx for your info. Because my first tries failed...

I have only tried to replace "Search String".

"\x2F\x42\x6D\x70\x2F\x42\x6C\x61\x63\x6B"

For /Bmp/Black

Only as test... to have only 1 hit.

Next days I wil try to study little bit deeper... (but I think I need years to understand this script...)

Thanx.

Best Regards
[Bada Software and Hacking General] adfree:
Little small progress in understanding this TriX script file...

:eek:

I have reduced changes/area to 1 Byte ...

It's for study...

Second attempt was... 4 Byte...

Result is "-1" correct... :rolleyes:

I hope I will find before Christmas correct input...

At the moment I am playing in non compressed area...

But it's interessting to see changes...

Best Regards

Oh Idiot... during writing I have an idea... :D

If I need EE in first position... but at the moment I get EF...

So my Input Value has to be "-1"

ED :laugh:

Cool. So I can move to next step...

Edit 1.

Few tests later...

This is my mainproblem... after small brain... :D

Hmmmmmm. Maybe I have an idea.

My fault seems that my search area is in wrong "sector"...

Only 1 success ... near Original adress...

A06007DA00964B464246 as HEX Value... 1 hit in XXLA1...

"Translation" for TriX Script...

\xA0\x60\x07\xDA\x00\x96\x4B\x46\x42\x46

I have no idea whit it is, but I can create then "valid" apps_c...

Not tested on device but TriX finish job and I can proof with Wave_Remaker...

Mhhh...

Will test other Search Strings at adresses wit 0x0...0
[Bada Software and Hacking General] b.kubica:
i though end user has no need to edit that script by own, or am I missed something? pm me or write here what you want to modify and maybe I will try personally :)
[Bada Software and Hacking General] adfree:
My old model name patch is dirty... :o

XXLA1 in decrypted apps_c...

GT-S8500 at 0x16A750A

If I change into GT-S8600 few other Bytes also changed in decompressed part... 1 or 2 Positions also change Value 5 into 6...

Seems not deadly but I have no idea what it is for...

Clean change of String GT-S8500 would be really nice.

Second test would be... I need 1 Byte more to change

GT-S8500

into

SHW-M410K

In compressed apps_c it is impossible as more then 1 Byte affected...

Maybe last chance to find FOTA updates for M410K or M410S or M210S...

before Samsung kill FOTA Server complete for bada handsets...

Thanx in advance. :angel:

"Meanwhile" I can do few tests with S8000 Jet.

Here it seems chance to change path in compressed apps_c for tests.

/System/Rsrc/Bmp/Black/

Maybe I know tomorrow more if this is working on S8000...

Best Regards
[Bada Software and Hacking General] b.kubica:
afair,

2 files you need:

1st. decryptd apps

2nd decompressed apps

that string you found in 1st file at offset 0x16A750A is at 0x275C92C.

start trix with DecompressAppsChunk.trx, enter address 0x275C92C and wait. if everything is ok output should have that chunk (and strings in it) decompressed
[Bada Software and Hacking General] adfree:
Some tests with Jet S8000 failed during complexity of Compression... and my small brain.

Did some tests with text string... but it is compressed...

/System/Rsrc/Bmp/Black/

Best Regards
[Bada Software and Hacking General] b.kubica:
looks I forgot(?) publish that script...

sorry for that :D

my battle with crashed pc/hdd's almost end so i should prepare rest of my bada scripts to fix compatibility etc
[Bada Software and Hacking General] adfree:
:(

My XXLA1 S8500 input file...

"25 MB" decrypted apps_c

MD5 is 3E9BB5999F6728EDEA0DBE1A37AF70EB (included last 1024 Byte)...

If I enter 275C92C TriX crashes...

Seems no difference if I enter 275C92C or 0x275C92C.

If I enter 16A750A TriX generate valid file...

I did few other tests... but ever failed if I tried my adresses... :crying:

For instance text String:

/System/Rsrc/Bmp/Black

In decompressed apps_compressed.bin at 0x357148

In compressed apps_c only this is visible:

Rsrc/Bmp/Black/

at 0x2719B2

Both adresses crashes...

Here example for success:

[Plugin] - ARMulate - [STILL LOADED] - [OK]
----------------------------------------------------

address found at 0x0[B]16A750A[/B]
QMD header found at 0x00040000
Code hacked successfully at 0x00D9ECEA

What I make wrong? :confused:

Please help.

Main test is GT-S8500 String...

Thanx.

Best Regards
[Bada Software and Hacking General] b.kubica:
ok, i get it

for now script support chunks 8 type only. maybe later i'll add other chunks too
[Bada Software and Hacking General] adfree:
:o

No idea what exact this means... 8 bit :confused: :confused:

But I have something found...

Recorded Voice for Music Recogni...dingens :D

In XXLA1 S8500...

2 adresses from DEcompressed apps_c...

AB83A0

ABD094

Both work in TriX. :cool: :good:

address found at 0x00[B]AB83A0[/B]
QMD header found at 0x00040000
Code hacked successfully at 0x0060BD0C

address found at 0x00[B]ABD094[/B]
QMD header found at 0x00040000
Code hacked successfully at 0x0060F320

And it seems I can see more from String Recorded Voice...

Maybe few times more and I can see full/complete string... maybe...

Its like an puzzle.

Best Regards
[Bada Software and Hacking General] adfree:
Success... :good:

Few rounds later... :D

I have now seperate 2 x 2 text strings...

Recorded Radio

and

Recorded Voice

http://xdaforums.com/showpost.php?p=34820221&postcount=99

After short test I will upload my modified apps_compressed.bin

Best Regards

Edit 1.

Long time ago... I have forgotten Unicode Strings... :rolleyes:

So I have only 50 % managed yet...

Unicode String...

R e c o r d e d V o i c e

at address failed with TriX...

270BBDC

But now I have an idea... :D
[Bada Software and Hacking General] adfree:
New attempt for text string GT-S8500...

in DEcompresed 8x

in compressed only 3 hits left...

Will try 8 adresses in TriX... XXLA1 S8500 (this time my Music Mod file... first)

Later more...

Edit 1.

Adresses to check...

357A98--->fail

357ACC--->fail

370AE0--->fail

801DB2--->fail

1F24364

1F2440A

275C92C--->fail

276F305

Edit 2.

First luck...

address found at 0x01F24364
QMD header found at 0x00040000
Code hacked successfully at 0x012C2A64
[Bada Software and Hacking General] adfree:
http://www.mediafire.com/?tg24jmli991gk51

My result for today... :p

progress but not 100 % finished... :o

NOT for Multiloader Flashing... because decrypted... not encrypted again...

If you decompress this apps_c then 1:1 identical to Original DEcompressed apps_c.

But, now:

1 x GT-S8500 String more 4 from 8 possible...

For Music Recognition... text strings...

2 x Recorded Radio

2 x Recorded Voice

Best Regards
[Bada Software and Hacking General] Rebellos:
Chunks of type 0x08, there is few types of them, each other compressed in another way.
[Bada Software and Hacking General] adfree:
Small progress...

In XXLA1 it seems no big problem to change third

GT-S8500 string

into

SHW-M210K or S

Few other Bytes changed during Compression Algo seems not mandatory...

Length is an problem... for me...

Last Value is 00 in XXLA1... in decompressed apps_c it is offset:

0x275C934

Normally I could use my S8530 with M210K... but my Wave 2 runs smooth... :D :o

My S8600 is ready for tests, but M410K nor M410S are Full Firmware nor works on my S8600... :rolleyes:

:eek:

I found maybe 1 other type...

If I nuke string GT-S8500 (8 Byte) with FF... then result is not only FF in decompressed apps_c...

1 Byte is different...

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=37360209&postcount=158

Now I can also patch XXLA1 bada 2 Bootloader... :D

I wish to find way to download full uncompressed apps_c into Wave...

Need 50 MB ...

So different partition table is good idea...

Will check JTAG dumps again...

Best Regards
[Bada Software and Hacking General] adfree:
First idea...

XXJL2 bada 1 is "similar" from XXLA1 bada 2 Partition Table in OneNAND...

- both start at 0x1100000

- apps_compressed.bin from XXJL2 is bigger then full decompressed XXLA1 apps_c...

Maybe I need few things to change with Wave_Remaker like add Font to correct path... or path to *.rbm files...

In other words I will try to mix XXJL2 bada 1 Boot with XXLA1 Firmware...

Second idea is at the moment harder... to play with partition table in XXLA1 Boot...

This take an while... :o

Best Regards

Edit 1.

Short tested S8500 XPKG5 ... oldest bada 2 Firmware...

ERR : Apps Erase

So 50 MB is too big in this Version...

Will check if in XPKD6 for S8530 more luck...

Edit 2.

Tested XPKD6 Boot without luck...

Seems no existing bada 2 Boot reserved 50+ MB for apps_c...

Edit 3.

Tested also XPKG5 because RC1 and RC2 shows different addresses... but also no 50 MB reserved...
[Bada Software and Hacking General] b.kubica:
other options is to split apps. one segment afair 0x1C000000 will stay at 0x11... address and the rest segments that is 0x4..... will be moved to rc1 or somewhere else. modifying bl3 is quite easy to load 0x4... segment from different area. of course its only idea, i have no wave so far and cant test it furthermore
[Bada Software and Hacking General] adfree:
@ b.kubica

I can test nearly all combinations on my S8500...

I have whole 512 MB OneNAND for testing... and RIFF JTAG if something goes wrong.

I have only not enough brain. :o

If you can please show me the Offset in XXLA1 boot_loader.mbn where start for apps_compressed.bin is?

I can change now Boot. :angel: :victory:

S8530 XPKD6 is interesting, because reserved area is at 0x13... and if I flash XXLA1 Boot then XPKD6 Firmware starts... So Bootloader can find ELF first at 0x13... instead 0x11...

Thanx in advance.

Best Regards
[Bada Software and Hacking General] hero355:
You mean M210K firmware flashed on S8530 also apps_comp ?

:eek:
[Bada Software and Hacking General] adfree:
Sorry, I have no solution yet about M210S Firmware... :o

Real tests failed:

http://xdaforums.com/showpost.php?p=37145501&postcount=14

Best Regards
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=37693586&postcount=181

Progress...

Maybe apps_compressed in Boot XXLA1 is start at offset:

0x[B]00115720[/B]

Need few minutes now, to find way to download apps_c now to new adr. for test...

Tested and failed:

1.

Easy change in last 1024 Byte ... I can see changed adr. in Multiloader...

2.

ETC also not allow...

Ideas left...

Writing with RIFF JTAG... but before I will try to modify apps_c... and fill with FFFFFFF or something in this case.

To match new address (hopefully this is address)... :D

Best Regards
[Bada Software and Hacking General] adfree:
Maybe this is easiest way to find out if good or Bulls eye... :D

Prepared with Wave_Remaker... before TriX etc... blabla...

I have removed last 16 Byte... and added 16 Byte at start of apps_c....

So filesize is 1:1 same...

Now I need to change my address from:

00001001

into

10001001

I hope no mistakes... :D

Damn Little Endian and not enough brain...

Later I will post result.

Best Regards

Edit 1.

No success yet... maybe I made mistakes...

"New" idea...

RC1 has enough space reserved... 80 MB

http://xdaforums.com/showpost.php?p=20188325&postcount=369

Thank you very much for this. :good:

RC1 is not encrypted like apps_c...

Maybe I can combine RC1 + apps_c into 1 single file to flash via Multiloader...

But before I need few MORE tests... to be sure... apps_c is easier to start then Boot... or last 1024 Bytes are mandatory for start correct...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

Reserved space for RC1 in XXLA1 seems not 80 MB...

FLASH_RSRC1_SIZE ([B]65[/B]*1024*1024)

But 65 MB short tested...

First try with 80 MB RC1 failed in Multiloader...

I have created only fake RC1 file... addded 50 MB of emptyness...

Now my Template could be ready...

Next steps insert DEcrypted apps_compressed into this RC1 template...

Then dump via JTAG to be 100 % sure to use correct address then in Bootloader...

Rsrc_S8500_Open_Europe_Common.rc1 ends at 0x024BFFFF

I will insert Decompressed apps_c at 0x024C0000 ... then I will check if this is enough or I have to use shorter RC1... to fit reserved space...

Best Regards

Edit 1.

My testfile is ready...

Download Start Ch[0]
Rsrc1 [B]65[/B]273.9KB OK[24.8s]
All files complete[25.2s]