yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] iuss:
Your assertion seems correct. Refer to modemctl_p.h from crespo's kernel source.

#define MODEM_MSG_SBL_DONE 0x12341234
#define MODEM_CMD_BINARY_LOAD 0x45674567
#define MODEM_MSG_BINARY_DONE 0xabcdabcd

Unfortunately I'm hardly familiar with the inner workings of dpram message passing (my modem apparantly boots itself and my dpram driver 'just worked'). It seems to rely on a specific address space layout for message data and semaphores/'interrupts'/magic values. You may want to confirm that Spica and Jet actually use the same address layout (if you reused the Spica dpram driver), because the modem firmwares for both devices could very well differ. This might be a problem for Spica RIL reuse later on (that's just a guess, you never know).

Next I'd suggest to disassemble the Spica and/or Jet RIL, to make sure you've got the uploading procedure right. Also ensure your dpram driver doesn't accidentally tap a reset GPIO. Does Spica upload both the low-level bootloader and amss upon initializing the RIL? Then you might opt to do the same..

By all means, feel free to post anything baseband-related here. There's too little community research of Samsung's baseband interface(s). For Android-shipped devices people seem to rely on hacks to be able to reuse the proprietary RILs.

An open source alternative could ease porting self-built Android distributions and allow adding missing functionality (eg. WiFi calling on Nexus S, provided the modem firmware supports the calls not present in the Nexus S RIL).

As for the RIL, I've got some code done. Far from fully-featured, but in it's current state it supports (for my device) proper network registration status (gsm and gprs), calling, SMS (sending is a hack though), SIM I/O, STK and basic lock handling (SIM unlocking and select facility lock status queries).

The RIL needs some cleanup, once that's done I'll push it to my Github. The code to access the IPC interface is already available at https://github.com/ius/libsamsung-ipc

I've recently rewritten the IPC library to support multiple devices, another individual succeeded in writing a backend for Nexus S, next we will be investigating the IPC protocol differences between our devices, with the goal of making the RIL work for both devices. So far I've spotted a handful of additional message types for Nexus S, plus some minor changes in the format of some messages. I hope it stays that way - I'll be able to tell once we've taken a closer look.
[Android Software/Hacking General [Developers Only]] KB_JetDroid:
Thank you for your answers.

There is no guaranteed way of determining the address layout of the Jet dpram since its datasheet is not available. I have assumed they are same, since after loading the dpram driver, I could read valid values from onedram_mailboxAB and onedram_semaphore locations.

What could be the effect of tapping the reset GPIO? Actually for Jet, the MSM reset pin is controlled by PMIC and not by the AP. Unfortunately the datasheet for PMIC MAX8906 is not available. Hence we don't have a direct control of MSM reset. For Power ON/OFF and Reset I am actully turning ON/OFF the PMIC regulators. Don't know if it can have adverse effects.

Anyway, since half of the MSM initialization is done in the bootloader itself, I was thinking that I'll always skip the MSM reset part and directly jump to rest of the initialization. Do you think its possible?

This is what basically I was searching for and brought me here :) . I just want to skip the libsec-ril and spica dpram driver.

Even though your RIL has very basic things, I might still be able to use it. Please let me know where is your dpram driver and basic RIL which I can customize for Jet.

- KB
[Android Software/Hacking General [Developers Only]] iuss:
The layout wouldn't be documented anyway, apart from a handful of defines in the kernel source. I actually meant verifiying by means of reverse engineering the original dpram kernel driver, but its feasibility entirely depends on whether it has symbols/debug info, so you can easily locate the offsets.

Sure.

If anything in the kernel (power management or dpram driver) shortly disables the regulator or toggles the reset GPIO the modem *might* fall back to a state where it requires the low-level bootloader to be uploaded again (depending on the implementation..).

That scenario is just a wild guess, but it would mean that even if you read back 0x12341234, the baseband would actually be expecting a low-level bootloader upload again. That's why I suggested attempting a 'hard' reset, so you're 100% sure about the state the baseband is in.
[Android Software/Hacking General [Developers Only]] KB_JetDroid:
Ok. But are you talking about the Jet's original dpram driver? Then unfortunately it is not available. Jet is actually not a smartphone hence doesn't have any standard OS on it. It has Samsung's proprietary OS hence we do not have access to any of drivers in it :(. Its firmware also comes in some proprietary format from which we cannot extract the driver. Hence we have to rely on spica's drivers which has almost identical hardware.

This is a food for thought... :confused:. I will once again trace the flow in kernel and see by any chance if the modem in resetted. Also I will try to hard reset the modem for uploading the low level bootloader. Will update you with the result after trying.

Thanks,

-KB
[Android Software/Hacking General [Developers Only]] KB_JetDroid:
Hi iuss,

Here is an update from my side.

I traced the code to check if by any chance the baseband is getting resetted.

But I didn't find any such code.

Also I observed that when I try to write a command to onedram_mailboxBA, the onedram_checkBA flag is set.

This generates the interrupt for MSM indicating a command has been issued.

After few msec, the flag is reset to 0 indicating the baseband has read the command. This behavior is as per the Samsung's OneDRAM specifications.

I believe the bootloader won't have the code to handle the OneDRAM, this indicates that the baseband is not resetted by the android kernel and in proper state.

Also I digged into the Sasmung's proprietary OS for Jet and managed to disassemble the complete code for it.

It doesn't have separate drivers it is just one binary for the entire code with no debug symbols :(

To my surprise I found that the intialization routine in the bootloader actually completely initializes the baseband.

In fact it loads the amss.bin in baseband and starts its execution as well.

This I have also confirmed by taking the dpram dump and checking few location values in it as per the disassembled code.

So I believe the baseband is properly initialized and ready to communicate over the IPC.

Here again I'm stuck. Jet's disassembled code doesn't have any debug info hence it is difficult to understand the IPC implementation.

I tried to use the libsec-ril.so from spica, but since it starts the initialization routine again including a baseband reset, it can't be used as is.

I tried to patch it to skip the initialization. But still it didn't work.

Probably it needs to be patched at many places to make it work.

Here I think I could use your implementation of RIL.

I tried to use the currently available IPC library and ran the "ipc-test" utility but it stucks in ipc-recv.

I think it won't work without the proper RIL implementation which will also configure the baseband.

Can you pleae guide me in using your RIL and IPC implementaion to access the baseband?

Or if you can suggest any patch work which can help me in using the spica's libsec-ril will also be useful.

Currently I just managed to patch to libsec-ril to skip the dload_test routine.

Thanks,

-KB
[Android Software/Hacking General [Developers Only]] iuss:
You should at least be able to see some messages. Check whether the ioctls defined are correct for your dpram driver, they may very well be different. If the reset ioctl is right, I *think* you should be able to reset the modem without having to reupload the firmware (that's the way it works for Nexus S I believe).

Regardless, if you think the modem is properly initialized:

- You *should* get IPC_DISP_ICON_INFO messages every once in a while

- Try modifying test.c to make it send the IMEI request right away (instead of waiting for a powerup notification, which you'll never get if the modem is already initialize)

Do you see any traffic over the dpram device with that libsecril?
[Android Software/Hacking General [Developers Only]] KB_JetDroid:
This is quite a possibility. Unfortunately the Jet doesn't have separate dpram driver. Still I'll try to find out the ioctls from Jet's disassembled code.

Is the reset ioctl resets the modem through a software command and not using a gpio? If it is resetted through gpio then that's where the problem is. Jet doesn't have a direct gpio to reset baseband. It is done though PMIC for which we don't have a proper driver.

Do you mean as soon as amss.bin gets started, it will start sending the IPC_DISP_ICON_INFO message periodically without any other initialization/configuration in baseband? (sorry!!! I'm a newbie when it comes to Samsung's baseband IPC :( ).

How do I check it?

I just observed the radio log using "logcat -b radio". It shows some initializations, connection to RIL socket, then shows RADIO_UNAVAILABLE error and stops.

And thanks for the quick reply :)

- KB
[Android Software/Hacking General [Developers Only]] erikcas:
Question

Hi,

don't know if I am in the right section, but I came across this thread in my quest to make things work on my phone.

In short: I am trying to make omnia2droid for Omnia i8000 work on Omnia Pro B7610. Both are natively WM devices. More info and kernel source on h_t_t_p://o2droid.phj.hu/index_en.php and h_t_t_p://code.google.com/p/omnia2droid

For I8000, the modem part from I6500 is used. This is working, but not for B7610. I8000 uses IC- modem MSM6290, B7610 uses MSM6246 (both have ARM s3c6410, and mostly same hardware on slightly different GPIO's)

So I am trying modem.bin + libsec-ril.so (+ dependent files, ) from spica since it uses the same IC-modem on s3c6410 as B7610 does.

Dependent files for libsec-ril.so (opened in IDA pro) I use from Spica:

liblog.so, libcutils.so, libutils.so, libril.so, libnetutils.so, libsqlite.so, libc.so, libstdc++.so, libm.so

Dpram loads the spica phone image, but does not work. No GSM, no data. Now I am stuck :confused:. Been searching for days (without almost no time because of my just born daughter but so willing to make this work).

Maybe somebody with knowledge in this forum can make me see the light?

Attached dmesg and output of logcat -b radio.

Additional info: I've been reading about problems with nv_data.bin and IMEI. Some of the I8000 users are reporting issues with this. Might be that this has got something to do with this?

Thanx in advance.
[Android Software/Hacking General [Developers Only]] Rebellos:
It send command to file, described by struct pointer passed in R0. I guess it's handle to UART device (ttySAC), or to virtualised device which points to oneDRAM share. Rather the first one.
[Android Software/Hacking General [Developers Only]] tdcfpp:
Hi, do you know replicant project?

http://replicant.us/

Edit: Seems that replicant forked repository from iuss.
[Android Software/Hacking General [Developers Only]] justforfunfun:
can 'libsecril' support this AT command "AT+CBST=134,1,0" ?

hi friend, can 'libsecril' support this AT command "AT+CBST=134,1,0" ?
[Android Software/Hacking General [Developers Only]] sziegu:
I9100 unlock by reversing RIL to recover nv_data.bin information

Hello everyone,

I've been trying to do some reversing on libsec-ril.so myself for the last couple of days, but my assembly skillz cannot evolve over night, so I'm a bit of a noob.

My goal is to extract the encryption key used to AES encrypt the hashes corresponding to the network unlock code on my SGS2 I9100, that can be found within nv_data.bin at offset 0x18146e and the salt of the hashes if it is different than 16 bytes equal to 0.

There is a method SUB_319BC that reads the entire content of nv_data.bin to memory, and there are others that "magically" (i'm joking here, I have a lot to learn about ARM instructions) get access to the data.

The method called to remove the simlock is "requestNPersoUnlock".

If any of you have time to spend on this it would be great, as it could basically unlock all/most of our samsung phones if I'm not mistaken...

Cheers.

Stefan.
[Vibrant General] krayziebydaflesh:
a day ago i rooted my Vibrant, then i flashed to the rom nero-5-voodoo

Everything worked fine.

Couple hours later i decided to boot into recovery and restore to factory settings

before i did i came across an option to format my internal storage to add additional app space so i did

Then i deleted cache, deleted all user data and tried to restore to factory settings.

Upon boot up my screen was stuck on the "vibrant" splash logo and would go any further

So i came across sticky in this forum to help fix bricked devices

I download ODIN T959UVJFD.tar, and the s1_odin_20100512.pit and the correct samsung drivers which i found after an hour of searching online.

I followed the tutorials and like magic my Vibrant was fixed and able to start up again.

I then proceeded to root my vibrant again and download Rom Manager from the market place.

The root went well but when i tried to download Rom Manager from the Market i was given the message "Sorry, there's not enough space to install this item."

Now im thinking "how is this possible" i just did a factory restore and the only apps on my phone are the ones samsung preinstalled. So i navigate to "SD Card and Phone Storage" i read that i now have 11.26GB of total space under phone storage and 3.66GB of available space under Application storage.

I then format my phone storage and reset all cache and user data removing the root i performed earlier.

I then navigate back to the SD and phone storage and still read i have only 11.26GB of total/availble space and 3.66GB of free app space.. I go the the market and try to download an app and i still get the message "Sorry, there's not enough space to install this item."…even tried to install an app from an SD and got the same message, . Also removed my external SD just incase the system was confused between the external sd and the internal storage and i got the same message.

So now im stuck in Samsung's Factory settings unable to download even a single app.. The most i can do i root the device and load the "recovery-update.zip" from a backup folder named "Clockworkmod" that i had backed up on my computer from when i initially had nero-5 installed. If i try to restore to any of my backups the vibrant goes into a loop booting into recovery mode…

Does anyone have any idea on how i can

1. Revert to my original Phone storage space

2. Revert to my original app space.

3. Download apps again without being told that there is no space left when there clearly is.

Thanks for your time
[Vibrant General] chikin:
Is your vibrant connected to the computer? Maybe it is mounted on the computer which is why you can't access the sd.

Oh and if you want to get the original phone storage space, you should try to odin the same way you did before, except this time, also check "re-partition" along with the other two options that are already checked.
[Vibrant General] oka1:
Ok, Well, ONE THING TO REMEMBER, once you custom rom the phone, do not use or hit the buttons that say "factory update or settings" until you really know more about the phone an d the operating system.

1. You will need to Odin back 1st to the Froyo that does not brick (do not check repartition), make sure to pull the sd and sim out before starting, Then:

2. Odin back to stock JFD rom. REPARTITION this time

3. Then after it comes up into the stock boot, let it go all the way through until you try the phone and make sure you can call on it.

Then, root the phone, download Clockwork Mgr, make sure this is all good, THEN you can reflash and you will be on your way

MAKE SURE TO CHECK THE STICKIES IN GENERAL AND DEV FORUMS.

Member s15274n has a very good sticky look in that for additional info,

Good luck
[Vibrant General] krayziebydaflesh:
Thanks,This worked perfectly. :)
[Streak 5 General] patsjourney:
Hey guys.

I just unlocked my phone and am now looking to root it. My problem is that I have read so many different methods and none of the downloads are for my particular build. So I was wondering if any of you could point me in the right direction.

Build number is 7921

Running stock 1.6

Thanks guys.

Cheers,

Pat
[Streak 5 General] slaydog:
When I had 1.6 installed, I used universal androot from the market. You may have to do it a couple times... With 2.2, use SuperOneClick. It runs on your computer while connected via USB.
[Streak 5 General] patsjourney:
I can't find the app in the Market. Do I have to side load it?
[Streak 5 General] slaydog:
SuperOneClick you get from XDA, just search. Its not in the market because it runs on your computer, not on the phone. Universal Androot is in the market, but I think if you have a stock ATT ROM many apps are blocked so you wont even find them. That is a whole different problem...
[Streak 5 General] patsjourney:
Yeah that must be the case. I have searched the Market for Universal Androot and I can't find it. So as you said, it's probably blocked by Rogers Stock Rom.

One thing I know for sure is I want to root my phone. So if I can't do it through Universal Androot I guess I have to go with SuperOneClick.

I'll keep searching for a solution. There's gotta be a way I can get Universal Androot on my phone.
[Streak 5 General] Streakr:
Go to your Streak browser. Bring up Google page. Copy paste or type in "How to root and unroot the Dell Streak with one click". The website is Streaksmart. Open the thread and select the link. Follow the instructions and you're done.
[Streak 5 General] patsjourney:
Thanks man. I got my phone Rooted. Now if only I can figure out how to get dj Steve's Froyo on there...:D

Can anyone point me in the right direction?
[Streak 5 General] Streakr:
You're welcome. Here's the link that will get it done. One thing though, there is no back-up rom for our build. So if you do it you won't be able to go back to the Rogers 1.6 build. So no warranty if something happens.

http://xdaforums.com/showthread.php?t=905791&highlight=rogers

That's what's stopping me from doing it.
[Streak 5 General] cplhornby:
If I want to do what patsjourney did, but i have rogers 2.2.2, can i go back if I dont like it? I want to customize my phone but want to go back to stock if i have to. ive been told to use streakmod but is there an easier way?
[myTouch 4G Q&A, Help & Troubleshooting] footloaf:
I am about ready to take the plunge and PermaRoot my MT4G. I do not believe I would be flashing every single type of rom out there - my intention is to install CM7 (one of the unofficial nightlies - i.e. grids 55 - or a variant of CM7). I have read both guides and threads to get PermaRoot and I am still unclear as to which of the two procedures that I need to do (the ULTIMATE guide seems like it has the potential to really brick the phone permanently - maybe I read that wrong?):

"Guide to permaroot, s=off AND s=on!!!!!"

-- or --

"TRUE PermaRoot and the ULTIMATE S=Off!!! Check this out even if you're rooted!!!"
[myTouch 4G Q&A, Help & Troubleshooting] osugsxr:
perm rooting

http://xdaforums.com/showthread.php?t=858996

would follow these steps plus the engineering hboot, thats what I ended up doing and have no problems flashing roms.
[myTouch 4G Q&A, Help & Troubleshooting] Mac33:
I rooted via theunlockr.com. I have s =off too. No problems flashing roms. Great how to videos also.
[myTouch 4G Q&A, Help & Troubleshooting] lalab0y:
i've done it both ways, and they both worked...the ultimate is of coz the best, as it gives u the eng hboot, and also unlocks the phone so you can use it with other sim card..it's a little deep, if you dont know what to do..but once you figure it out, it really is pretty routine..
[myTouch 4G Q&A, Help & Troubleshooting] footloaf:
Thank you all. Rooted and happily running cm7 9.
[Captivate Themes and Apps] whiteguypl:
First - I did not in any way shape or form create this theme. All credit goes to

dena994

in the I9000 Forums. It was just so nice that i couldn't help but port it. :)

[THEME]::ANDRODENA:::TEK::GALAXY:

Please Please Please go and thank them if you like this awesome theme.

Also, this is not an exact replica of said theme. I am in no way skilled enough to port the exact theme over. It is very close at this point and ill keep working on it as i have time. :rolleyes: I just swapped artwork around.

Known issue:

- unlock screens not included

Installation Requirements:

Cognition v3.0+ "Rogers I896UXJL1"

FireFly v1.0 rogers jl1

Should work with most JL1 based roms - try at own risk.

Disclaimer: Flash at your own risk. I nor anyone else (other then yourself) is responsible for any damage you cause to your phone.

If you want the launcher icons to match you will need a suitable launcher replacement that lets you use custom icons. Like LauncherPro.

-LauncherPro Docks

-Optional LauncherPro Icons

---><---

Blank icon to use with custom dock

-Background

Blue

CWM install/revert zips

Cognition 3.0

-atgC3.0Themecwm.zip

-atgC3.0cwmRevert.zip

FireFly 1.0

-atgFF1.0Themecwm.zip

-atgFF1.0cwmRevert.zip

FireFly 1.5

-Problem with v1.5 install zip. Taken down until i have time to look into it more.

-atgFF1.5Themecwm.zip

-atgFF1.5cwmRevert.zip

Installation Instructions:

-Download atg"@"Themecwm.zip

-Move theme to the root of your sdcard

-Reboot into CWM recovery

-Select- install zip from sdcard (4th option)

-Select- choose zip from sdcard (2nd option)

-Select- atg"@"Themecwm.zip

-Select- Yes - Install atg"@"Themecwm.zip (8th option)

-Select- +++++Go Back+++++ (5th option)

-Select- reboot system now

Reverting Instructions:

-Download atg"@"cwmRevert.zip

-Move atg"@"cwmRevert.zip to the root of your sdcard

-Repeat installation instructions starting at "-Reboot into CWM recovery" and select the atg"@"cwmRevert.zip file for your rom instead of the atgThemecwm.zip.
[Captivate Themes and Apps] whiteguypl:
Held for Future proofing.
[Captivate Themes and Apps] mejori:
damn you all..stop making these bad ass themes and roms!!!!!!
[Captivate Themes and Apps] whiteguypl:
lol yeah some of these guys do some crazy work. Plus side to the CWM themes is if you store them on the root of your sd you can switch from one to the other in under a minute.. i love it.
[Captivate Themes and Apps] joeshmoe08:
Dude nice... I'll be sticking with this one for a while. Any chance that you can make a green version of this (green where the blue line) trying to make a green/blu version for myself. Already converted some icons but couldnt get glow effect on this one.
[Captivate Themes and Apps] whiteguypl:
Sorry cant help ya there. I only asked for permission to port it over. I dont really want to get into editing the colors, to time consuming. The port i can do fairly quickly.

Im going to be porting over a a completely different theme that is green based in the next few days if you want to hold out on what your doing and check it out. You might be able to swap some stuff around to your liking.
[Captivate Themes and Apps] kuherrm:
sick, keep em coming, i appreciate it... been trying to learn to port over themes
[Captivate Themes and Apps] PuffinNugz:
would you mind porting it over for Andromeda? Framework found in this post.

http://xdaforums.com/showpost.php?p=10686067&postcount=3

much thanks.
[Captivate Themes and Apps] jlsesler:
I tried this on firefly 1.5, and it went a into boot loop.
[Captivate Themes and Apps] diablo009:
Does/can this theme work on Gingerborg 7.5, a XXJPY Froyo 2.2.1 based ROM.
[Captivate Themes and Apps] whiteguypl:
Hmm it worked with 1. there must have been a change. to the framework. Ill update the post to reflect what you said.

No

Ill look into it.
[Captivate Themes and Apps] diablo009:
Omg!! I love the looks of this theme!! Wish it would *magically* work :cool:
[Captivate Themes and Apps] whiteguypl:
Check out the original authors post.

http://xdaforums.com/showthread.php?t=913733