yashsingh1/xdaforums huggingface dataset:
[EVO 4G Q&A, Help & Troubleshooting] evohack99:
Lol I feel the same way, when I read up on 8 plus hours on rooting for my evo for the first time, it was difficult, now its like you dl a apk and hit a button, they dumbed it down, which its good for some, but ppl that aren't computer geeks can do it now and then you get ppl that don't know what they are getting into doing it, but what ever. But to the op..... I'm running netarchy burnt droid 1.4.2. The newest one, I have come to like netarchy's work and I would put it in your pot of roms to try,

You have to flash it, but if your going to be getting into modding, you need to learn how to flash and get comfortable with it, nand back up and flash away...

Sent from my netarchy_toast, froyo beast of a machine evo!
[EVO 4G Q&A, Help & Troubleshooting] Maddball:
Myn's for sure!!!
[EVO 4G Q&A, Help & Troubleshooting] erik077:
Got Calculin rom. Thanks for help and support to all supportive members, others who ware just making coments so they can have more posts - no comments, but thank you too.
[EVO 4G Q&A, Help & Troubleshooting] kenvan19:
:/ I was hoping I had escaped all the acs drama when I got rid of my epic. Sigh.

To the op, just try them all until you find one you like. I flashed most of them and found that sense wasn't for me but others love it. I found an amazing dev for cm6 themes and I love it.

Sent from my Detoxed CM6.1.2 Evo 4G!
[EVO 4G Q&A, Help & Troubleshooting] loumoli:
I have the latest radios but my phone spends more time searching for signal than having one any help would be appreciated!!!
[EVO 4G Q&A, Help & Troubleshooting] sasscuba:
Is this at your house or everywhere?
[EVO 4G Q&A, Help & Troubleshooting] radiohead_freak:
move :D
[EVO 4G Q&A, Help & Troubleshooting] loumoli:
Everywhere
[EVO 4G Q&A, Help & Troubleshooting] loumoli:
Any help??
[EVO 4G Q&A, Help & Troubleshooting] craigbailey1986:
Just go back to the radio that worked for you
[Galaxy Tab General] Chopp87:
Delete Thread please
[Galaxy S I9000 Q&A, Help & Troubleshooting] remenis:
Browser wont work on 3g.... But can download feom market... Anyone know how to fix this...

Seems to do it on all custom roms ive flashed.. Help!!!!
[Galaxy S I9000 Q&A, Help & Troubleshooting] themate1987:
install droid wall and enable 3g for internet
[Android Apps and Games] stress_analyst:
Is there a launcher that has "home tabs" sliding the same way as sense ui. Dell's stage ui is attempting to do this but the widgets are crap and the launcher can't be customized sike adw or lp.

Thanks,
[Nook Color General] sasigns:
I know its silly but does the kindle app on the nook color only take .mobi formats

Also were do you put book files you already have dont see an import button on the app. DO i Just place them in the folder and they will show in the app.. Thanks in advance sorry for being a noob
[Nook Color General] WillCameron:
yes mobi and the other format I'm blanking on... pcs?!?

You drop them in the Kindle folder on the SD card.

So far its my primary reading app for the ability to change the backdrop to sepia

and alter the font sizes. It is a bit of a pain having to convert everything into Mobi format, having to deal with calibers sometimes wacky formatting issues (Although I just got Pocket Mobi Converter to try for conversions).

The only issues I have with it is the android app has problems with showing covers, and they really need to set it up to have 'shelves' within the program and directory, its a mess just dropping 50 or so books into one folder and having to slide through them all within the kindle app itself sometimes.

- Will.

Currently reading The Destroyer 104: Angry White Mailmen
[Nook Color General] paleh0rse:
If anyone figures out a way to get covers for side-loaded books to show in the Kindle app, please let me know!
[Nook Color General] WillCameron:
I got it to work once, and it was a royal pain in the but. basically I coped my entire Kindle folder off the NC to my hard drive, went through each mobi file in Caliber and hand set each cover to a jpeg, re-saved the mobi file, then dropped all the files back on the NC, and it worked (well it was actually maybe 75%, some still refused to show covers). Each jpeg was named the same as the mobi file just with the jpg extension.

- Will.
[Galaxy Tab General] b0ricuaguerrero:
i have reinstalled drivers and usb debugging is checked. i plug usb cable to computer and it just shows usb connected , anyone else experiencing this???
[Galaxy Tab General] rainbow ng:
It is normal in debug mode , use commond console, type adb devices and u will see device connected.
[Galaxy Tab General] b0ricuaguerrero:
idk . when it was working and i connectedmy tab to the pc it would get 2 notifications. usb connected and usb debugging

i cannot adb remount, i get device not found
[Galaxy Tab General] dhaddow:
I've got the same problem. If you drop down the notification and tap the usb connected entry, you can get the mount option for mass storage but no debug.:(
[Bada Software and Hacking General] adfree:
:D

In amss.bin you can find several AT Commands...

Few short tested by me:

AT+DEVEXTMEMINSCHK?

Hmmm. returns only 2 :confused:

No idea, I thought something for Memory...

AT+USERMEM

Returns 0k or maybe okay :confused:

AT+HEADERINFOSHOW?

Shows for instance the Memory name...

MemoryName:KAC007021M(S8500)

Btw... This is exact what we can read on Application Processor Chip. :)

1 hint that RAM is integrated with S5PC110 Processor...

Best Regards

TRY at your own risk. I have no idea what could happen.
[Bada Software and Hacking General] b.kubica:
s8500 support several types of at commands.

First type is common at commands set (70 commands), including AT+CPIN, AT+CMGR etc

the second (samsung specific, 171 commands) has many useful commands like etc

s8500 support 293 at commands (including common commands like AT+CPIN, AT+CMGR, and samsung specific like AT+IMEITEST, AT+CPU also)

complete list in attachment.

Do not use if you do not know what the command is for
[Bada Software and Hacking General] adfree:
AT+PRODUCTCODE?

Result:

AT+PRODUCTCODE? +PRODUCTCODE: GT-S8500BAADBT

If I enter:

AT+PRODCODE

Result:

Invalid Parameter

:confused:

Hmmm. I'm not up to date in using AT commands.

Is it maybe possible to change Product Code via AT Command?

How is the correct Syntax for AT+PRODCODE ?

There are more interesting Commands.

Best Regards

P.S.:

I was only in Kies Mode, maybe other results in Debug Mode possible...
[Bada Software and Hacking General] adfree:
AT+DEVCONINFO

MN(GT-S8500);BASE(GT-S8500);VER(S8500XXKK7/S8500OXAKK7);HIDVER(S8500XXKK7/S8500OXAKK7);PRD(GT-S8500BAADBT);SN();IMEI(3xxxxxx3);PN();TZVER(20111025);CON(AT,MTP);HVID(Osp:2097153,IntSys:2097154);LOCK(NONE);LIMIT(FALSE)

Oh, not realized before... few changes...

On previous bada 1.x... looks like this:

MN(GT-S8530);VER(S8530XXJL2/S8530OXFJK3);HIDVER(S8530XXJL2/S8530OXFJK3);PRD(GT-S8530BAASEB)

MN should be manufacturer I think... this is very funny text string. :D ;)

Best Regards

Edit 1.

My fault... MN is Model Name...
[Bada Software and Hacking General] duxxyuk:
Ooh, this reminds me of the days when I had a SonyEricsson T68 and K750.... Good ol days ... One thing missing from those days .. Our samsung wave telephones don't do the Bluetooth HID protocol...
[Bada Software and Hacking General] Rebellos:
How do you send these commands?

Can you post output from:

AT+DGLOCK

AT+LVOFLOCK

AT+DETALOCK

?
[Bada Software and Hacking General] adfree:
You can choose... there are hundrets of Tools, or write your own Terminal...

Few Tools I've used for this...

Revskills very often...

WinComm

QuB...

.

.

I'm little wimpy old man as you know... :D

But as I have 0 info about this... I'm scared to lock something and brick my handset...

No idea how to unlock ...

I'll investigate more...

Google research etc. and report later more... I'll try to be on the safer site...

About DELTA files/FOTA...

http://www.megaupload.com/?d=Z53R1IVX

I have upload few of S8500.

Maybe we find Commands or way to install manually these *.cfg Deltas...

Maybe AT Command also work...

Best Regards

Edit 1.:

Found this... untested yet:

AT+FOTALOC
AT+FOTAREADY
AT+FOTASTART

Edit 2...

Or maybe more such DEV Commands...

GetFotaEngineVer

Get FOTA Engine Version

Edit 3...

Maybe for Update... beter search for something like this:

SML_DM_FUMO_STATE

Or SCOMO

SCOMO Download Complete go to ui event 1...

SCOMO...Warning!!!! Delta Over Size

DownloadAndUpdate...org.openmobilealliance.dm.firmwareupdate.devicerequest

http://www.openmobilealliance.org/t...ram/docs/ets/oma-ets-fumo-v1_0-20061215-c.pdf
[Bada Software and Hacking General] Rebellos:
I'm sure LVOFLOCK gets level of lock - doesn't overwrite anything

The same about DETALOCK (detailed lock)

Just don't remember what was the code for DGLOCK, so don't use it for now if u're scared. :P You won't find these in google I think, these are Samsung specific, maybe only Mocha specific.

//edit:

Btw, many of AT commands goes to AMSS, but only what AMSS do is calling Mocha function in AP corresponding to AT command and returning result. For eg LVOFLOCK make AMSS invoke Bada function (also accessible from QuB) GetLevelOfLock and get it's return value. Can you compare result of these 2 maybe?
[Bada Software and Hacking General] Tigrouzen:
http://electronix.ru/forum/index.php?act=attach&type=post&id=46875
[Bada Software and Hacking General] adfree:
Tested by me...

AT+FOTALOC?

: Others

This seems location... folder... Others

AT+FOTAREADY?

COPYRETRY

:confused:

But AT+FOTASTART seems correct...

Handset reboots... like if I delete *.cfg files...

Hmmmmmmmmm.

Will log with WinComm... maybe then more info...

Best Regards
[Bada Software and Hacking General] Tigrouzen:
At+preconfig=2,tmb

at+lvoflock=1,0

at+factrst=0,1

at+lvoflock=0,0

600 pages FOTA OTA Command with explain :

http://www.scribd.com/doc/63560940/47/FOTA-Commands

http://www.google.fr/url?sa=t&rct=j...sg=AFQjCNFTQzBSwRrZg82TEZSOleqClg4dbA&cad=rja
[Bada Software and Hacking General] adfree:
AT+FOTASTART 2400258.cfg

Error...

AT+FOTASTART after Download of package, not start downloaded update.

Maybe wrong syntax or FOTA of Qualcomm part only... amss.bin... :confused:

I can't see anything with WinComm... maybe next try with QXDM... if amss related...

@ Tigrouzen

Many thanx for helpfull Links. :cool:

Best Regards
[Bada Software and Hacking General] Tigrouzen:
But i remember some time Samsung change this thing like not AT+FOTAUIMODE but

AT&FOTAUIMODE

Now its work but no Carrier

In our wave AT+CPIN doesnt work but AT&CPIN works
[Bada Software and Hacking General] adfree:
AT+FOTALOC?
AT+FOTAREADY?
AT+FOTASTART

Short tried on bada 1.0... JE7 Firmware...

All 3 output was Error...

Okay, not included in amss...

2400258.cfg also as text String in apps_compressed...

Will play little bit with Delta... then move to XXJL2...

Best Regards
[Bada Software and Hacking General] adfree:
Little progress...

AT+DEVCONINFO

MN(GT-S8600);VER(S8600XXKJC/S8600DBTKJ4);HIDVER(S8600XXKJC/S8600DBTKJ4)...

My S8500... :D ;)

Best Regards
[Bada Software and Hacking General] mylove90:
Did you get S8600 fw on your S8500 !!!!

Man this JTAG playing could kill your phone :D

Best Regards
[Bada Software and Hacking General] Rebellos:
Nah, he got FW ID from S8600 on S8500, while S8600 ShpApp & RC may be possible to run on S8500 and vice versa, rather no way about other things. ;P
[Bada Software and Hacking General] adfree:
Many thanx to S8600 user for nice info. :cool:

Best Regards
[Bada Software and Hacking General] adfree:
AT+SECUKEY +SECUKEY:"DXDxxxxxxxxxxxx=="

OK

AT+AUTHKEY +AUTHKEY:FAIL

OK

AT+DEVAUTH +DEVAUTH:SUCCESS

OK

AT+CERTKEY +CERTKEY:"X5Mxxxxxxxxxxx=="

OK

AT+PASSWORDINPUT +PASSWORDINPUT:SUCCESS

OK

Found Commands in WsSyncml.so, see here:

http://xdaforums.com/showpost.php?p=21541765&postcount=4

No idea yet, what it is. :o

Best Regards
[Bada Software and Hacking General] al_t:
Nice post b.kubica

Are you aware of the Qualcomm commands?

AT+CLAC lists these extra commands:

$QCSIMSTAT

$QCCNMI

$QCCLR

$QCDMG	- Diagnostic Mode initiation.

$QCDMR	- Diagnostic Mode (Baud) Rate. at$qcdmr=? shows available baud rates, at$qcdmr? shows current baud rate

$QCDNSP

$QCDNSS

$QCTER

$QCSLOT

$QCPINSTAT

$QCPDPP	- Packet Data Protocol authentication Parameters - see w w w . shapeshifter . se/2008/04/30/list-of-at-commands/

$QCPDPLT

$QCPWRDN

$QCDGEN

$BREW

$QCSYSMODE

$QCCTM

$SUSBC

$NWMDCHNG

$SHPSLEEP

Not sure what they do. All I've found so far is at$qcsysmode restarts the phone with what looks like a file list coming out on the serial port. BREW is the Qualcomm application language.

Does AT_OWANCALL exist in the ROM? That is sometimes used to set up UMTS/HSDPA connections.
[Bada Software and Hacking General] Tigrouzen:
Mail Syncronis
[Bada Software and Hacking General] adfree:
AT+KEY=

This seems usefull.

http://xdaforums.com/showpost.php?p=33361660&postcount=18

Other kind of Commands are in apps_compressed.bin... like:

[B]FmSecureMode[/B] off

Soon I will attach list...

NOT all tested or complete clear for me...

Best Regards
[Bada Software and Hacking General] matheo1010:
Hello,

I want to know how to send AT Commands.

Is it necessary to activate something on the phone ?

What software to use to send commands ?

Finally, I would like to know if there is an AT Command to switch the phone to "mass storage" or "samsung kies"

Sorry for my english

thank you
[Bada Software and Hacking General] adfree:
If Wave is in Download Mode...

Multiloader for instance send some Command... and handset answers with something like this:

~.pNOHPd[B]LISMORE[/B].........................address...Number...............IMEINUM...............................`...p.....................OOHPDownloader..............ZOHP.... ............................................................C~

We see only Lismore...

This we can find in Bootloader...

Maybe Command is...

7E0370FF837E

Not sure exact now... :o

In theory it should be more possible... like bTerm for instance...

http://xdaforums.com/showthread.php?t=1298950

Best Regards

Btw...

Need Command to read Serial Number... :confused:

S/N under Battery...

Few Tools can do this... But I have no idea how... nor I have these Tools...
[Bada Software and Hacking General] adfree:
Maybe usefull.

Combine AT Commands...

*#8720#	Qualcomm Diag Port change

AT +KEY=14; +KEY=13; +KEY=8; +KEY=7; +KEY=2; +KEY=10; +KEY=13

Taken from here:

http://www.mysamsungwave.com/index.php?topic=85.0

Single Char looks like this:

http://xdaforums.com/showpost.php?p=33361660&postcount=18

More Codes are here:

http://xdaforums.com/showthread.php?t=1154945

I will add few more "AT combos"... because I need these often... and if Touch is dead like my broken Display...

Best Regards
[Bada Software and Hacking General] adfree:
Saw this today... :rolleyes:

http://forum.sgh.ru/wap/posts.php?tid=40677&s=5

From 2008 and U900... compared with this...

{ "CMD_USB_DUMP", 0x23 },
{ "CMD_USB_VERIFY", 0x24 },
{ "CMD_USB_DEBUG", 0x25 },
{ "CMD_USB_FULLDOWNLOAD", 0x50 },
{ "CMD_USB_DOWNLOAD_UNLOCK", 0x60 },
{ "CMD_USB_INFO", 0x70 },
{ "CMD_USB_SET_DBG_LVL", 0x71 },
{ "CMD_USB_SECURITY", 0x80 },
{ "CMD_USB_RESET", 0x90 },
{ "CMD_USB_UNLOCK", 0xA0 },
{ "CMD_USB_COPY", 0xB0 },
{ "CMD_USB_CSC_WRITE", 0xB2 },
{ "CMD_USB_SHPAPP_WRITE", 0xB3 },
{ "CMD_USB_PFS_WRITE", 0xB4 },
{ "CMD_USB_LOCK", 0xC0 },
{ "CMD_USB_VER_CHECK", 0xD0 },
{ "CMD_USB_READ", 0xDA },
{ "CMD_USB_WRITE", 0xDD },
{ "CMD_USB_ERASE", 0xEE },
{ "CMD_USB_ERASE_MC", 0xEF },
{ "CMD_USB_FORMAT", 0xF0 },

Taken from bTerm main.c

http://code.google.com/p/badadroid/source/browse/trunk/bterm/sources/main.c?r=360

For few own tests I can use SerialMon for instance...

Later more...

Best Regards

Edit 1.

CMD_USB_RESET

7E00900000B54F7E

With this Command handset reset... so you can leave from Download Mode.

Edit 2.

CMD_USB_INFO

7E0170FF837E

Handset answers with this on Wave II S8530...

~pNOHPd[B]WAVE37[/B]addressNumberIMEINUM0`OOHPDownloaderZOHP ~

Edit 3.

Erasing seems more complex... tried with FOTA on S8530...

CMD_USB_ERASE

7E02EE0000500938AF1B0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006FCB7E

00005009 is address for FOTA Little Endian...

But this Command alone, no success... :o
[Bada Software and Hacking General] adfree:
http://xdaforums.com/showpost.php?p=42714364&postcount=35

Commands in Upload Mode looks little bit easier...

In DL Mode I have problems to write and/or erase... :o :crying:

DL Mode seems harder... maybe timing or Commands are mandatory in strict order...

:o

For my tests FOTA... short file... and safer as play with Boot region...

Best Regards
[Bada Software and Hacking General] adfree:
If Port Search is pressed in Multiloader...

3 Commands are sent:

Command as HEX Value	Text or "Description"
[B]554D545320444F574E4C4F41444552[/B]	UMTS DOWNLOADER
[B]41542B4655533F0D0A[/B]	AT+FUS?
[B]7E0070FF837E[/B]	CMD_USB_INFO

1 answer... from S8500 for instance for CMD_USB_INFO:

~.pNOHPdLISMORE.........................address...Number...............IMEINUM...................................p.....................OOHPDownloader..............ZOHP.... ...........................................................Lw~

I will try again, if I can send erase/write Commands sniffed before for FOTA file...

Hopefully if I send all Commands correct, I got same result like with Multiloader.

I hope not. Timing in milliseconds are important... :o

For writing FOTA I can see 8 Commands, before Wave restart automatically...

Later more...

Best Regards

Edit 1...

Stupid me made few mistakes... :rolleyes:
[Bada Software and Hacking General] adfree:
Maybe I am closer or I made again mistake... :D

I have now send 11 lines of Commands via SerialMon... result is same like with Multiloader. :cool:

I will check again if I was dreaming...

Second step... maybe harder for me... because I don't know, how 2 Bytes CRC are generated... :o This seems mandatory for CMD_USB_ERASE and CMD_USB_WRITE...

Maybe I have luck and address is not involved...

Tested with S8530 XXLA1.

Now I'll try to confirm.

Best Regards

Edit 1.

Tested again to be sure...

Before XXLA1 booted normal.

Then I put it into Download Mode via Keys... and sent with Tool SerialMon 11 lines of Commands... after last Command Wave restart/reset and shows me:

FOTA engine is not installed

Bingo, this is exact what I have tried to achieve with sniffed Commands...

:cool: :good: :cool: :good: :cool:

Next step, is to try to erase other addresses... I hope this is not protected area at 0x1E800000...
[Bada Software and Hacking General] adfree:
:rolleyes:

I am not smart enough to use SnoopyPro.exe more then once correct...

:o

But all other Sniffer I found not catch whole data... :crying:

I am now back on bada 1.x on my S8530...

NAK_BAD_SEC_CODE

This is sent during my app_c tests... as Debug stuff...

CMD_USB_DEBUG...

NAK_INVALID_FCS
NAK_INVALID_DEST
NAK_INVALID_LEN
NAK_EARLY_END
NAK_TOO_LARGE
NAK_INVALID_CMD
NAK_FAILED
NAK_WRONG_IID
NAK_BAD_VPP
NAK_OP_NOT_PERMITTED
NAK_INVALID_ADDRNAK_VERIFY_FAILED
NAK_NO_SEC_CODE
NAK_BAD_SEC_CODE
NAK_FLASH_ERROR
NAK_INVALID_CONTENT

These I can find in boot_loader.mbn

NAK_INVALID_FCS for instance I can see here:

http://xdaforums.com/showpost.php?p=43097864&postcount=40

If I enter something wrong in WinComm...

Funny, it seems to generate CRC... maybe later usefull...

Best Regards
[Bada Software and Hacking General] adfree:
Found this Tool:

CmdChkTool V1.4_0820.exe

Clicking on your own risk.

Best Regards
[Bada Software and Hacking General] adfree:
With help of UART Log I can explain few Commands from here:

http://xdaforums.com/showpost.php?p=42684141&postcount=27

Log files:

http://xdaforums.com/showpost.php?p=49662339&postcount=25

Later more...

Short Version...

CMD_USB_SECURITY for instance WRITE into OneNAND...

PC name, Country, IP address and so on...

CMD_USB_LOCK seems to show summary after flashing...

lock_usb_cmd completed!!!
Nand Read ECC count 0, Retry total count 0

.

.

.

Later more...

Best Regards
[Bada Software and Hacking General] adfree:
:cowboy:

This Tool is nice to generate CRC16 for Commands + send correct and catch Debug message... with normal USB cable...

http://xdaforums.com/showpost.php?p=48117152&postcount=34

Will check later with S8600 ...

No idea what is different between DM and new DM... as S8600 answered Headerinfo with new DM...

Hmmm, but Platformdownloader ... later more...

Best Regards

Edit 1.

[BootShared_PrintPowerOnStatus : 132] wMagic= 0xb80f8aed
[BootShared_PrintPowerOnStatus : 136] pPowerOn[0]= 0xb1871fe2
[BootShared_PrintPowerOnStatus : 136] pPowerOn[1]= 0x82a00080
[BootShared_PrintPowerOnStatus : 136] pPowerOn[2]= 0x80000022
[BootShared_PrintPowerOnStatus : 136] pPowerOn[3]= 0x1
[BootShared_PrintPowerOnStatus : 136] pPowerOn[4]= 0x20802
[BootShared_PrintPowerOnStatus : 136] pPowerOn[5]= 0x28000002
[BootShared_PrintPowerOnStatus : 136] pPowerOn[6]= 0x8280400
[BootShared_PrintPowerOnStatus : 136] pPowerOn[7]= 0x12200800
[BootShared_PrintPowerOnStatus : 136] pPowerOn[8]= 0xb00020
[BootShared_PrintPowerOnStatus : 136] pPowerOn[9]= 0x8f00000
[BootShared_PrintPowerOnStatus : 136] pPowerOn[10]= 0xc04000
[BootShared_PrintPowerOnStatus : 136] pPowerOn[11]= 0x408
[BootShared_PrintPowerOnStatus : 136] pPowerOn[12]= 0x28000000
[BootShared_PrintPowerOnStatus : 136] pPowerOn[13]= 0x20aa8
[BootShared_PrintPowerOnStatus : 136] pPowerOn[14]= 0x28002080
[BootShared_PrintPowerOnStatus : 136] pPowerOn[15]= 0x80038400
[BootShared_PrintPowerOnStatus : 136] pPowerOn[16]= 0x90
[BootShared_PrintPowerOnStatus : 136] pPowerOn[17]= 0x20820008
[BootShared_PrintPowerOnStatus : 136] pPowerOn[18]= 0xa0000008
[BootShared_PrintPowerOnStatus : 136] pPowerOn[19]= 0x4000080
[BootShared_PrintPowerOnStatus : 136] pPowerOn[20]= 0x20002400
[BootShared_PrintPowerOnStatus : 136] pPowerOn[21]= 0x30000
[BootShared_PrintPowerOnStatus : 136] pPowerOn[22]= 0x8000
[BootShared_PrintPowerOnStatus : 136] pPowerOn[23]= 0x2982fee
[BootShared_PrintPowerOnStatus : 136] pPowerOn[24]= 0xcaaa2600
[BootShared_PrintPowerOnStatus : 136] pPowerOn[25]= 0x42a22b3a
[BootShared_PrintPowerOnStatus : 136] pPowerOn[26]= 0x2008002
[BootShared_PrintPowerOnStatus : 136] pPowerOn[27]= 0x200082
[BootShared_PrintPowerOnStatus : 136] pPowerOn[28]= 0x2040
[BootShared_PrintPowerOnStatus : 136] pPowerOn[29]= 0x802002
[BootShared_PrintPowerOnStatus : 136] pPowerOn[30]= 0x2000000a
SelectBootingMode: Boot Mode = 20...
dload_gÐ

My first S8600 output in DL Mode...

Will try few other things...
[Bada Software and Hacking General] adfree:
I can use for CMD_USB_DEBUG 7 Bytes... this match length of AT+FUS?

Now I can edit Multiloader.exe... for instance Debug Level 1:

7E027101D2F77E

instead sniffed Command:

7E027101[B]000000[/B]7BCD7E

3 Bytes after "Level" seems placeholder.... you can add more of them...

If Command is valid, I see this for instance. on UART:

DloadCmdUSBDebug (1)

If I made bul..hit, then I can see something like this:

NAK_[B]INVALID[/B]_FCS crc=54631

For instance it seems correct protocol/Tool is mandatory... for send successfully.

Best Regards