JTAG with S8500/S8530, S8600 ... - Bada Software and Hacking General

I have some experience with JTAG.
Segger J-Link with PSAS.
I have "Testdevice"... broken Display... soon I will try to connect.
Testpoints and JTAG dump floating somewhere in Internet.
My Questions:
1.
Someone tried Segger with S8500?
2.
Many more Questions to come.
Best Regards
P.S.:
http://www.gsmupload.com/beta-test-thread-samsung-wave-s8500-repair-here/
Edit 1:
Tried to edit Thread title...
...and not yet attached my S8500 to JTAG

oh yeah !!! sachinsud an indian guy bought a riff box... and he tried...
i thnik that you are in the right way...
btw have you tried to connect the wave with broken display to a external monitor?
the wave have video output!
cheers!

At the moment my damaged S8500 is good enough for training.
Only glass is broken...
I have an 512 MB dump from S8500 via JTAG... NOT my. But interesting for study.
I play as long as I can with Multiloader. With AMSS and maybe soon with Bootloaders... and only if I brick this S8500, I will try my Segger JTAG...
About TV out.
I bought Original Samsung AV cable, because normal AV cable seems to have other Pins connected.
But very impressive to see some Games or Videos from my handset on TV.
Never seen before...
my last handset is from 2006.
Best Regards

Nice. Found today S8530 JTAG dump from ORT JTAG.
Thanx.
http://srimeenakshimobiles.com/foru...t-s8530-wave-ii-unbrick-repair-dead-boot.html
Nice:
http://www.ort-jtag.com/blog/
About S8500:
http://www.ort-jtag.com/blog/?e=10
Best Regards

Hope I could get one of that ORT Plus software for free!

Today I saw this:
http://www.segger2.com/index.php?page=Thread&postID=1786&highlight=s5pc100#post1786
Found 1 JTAG device, Total IRLen = 0:
#0 Id: 0x1BA00477, IRLen: 04, IRPrint: 0x1, CoreSight JTAG-DP (ARM)
Cortex-A8 identified.
Click to expand...
Click to collapse
So maybe my J-Link will work...
I'll try next month... but started today.
With removing Label.
I can see now Testpoints are big enough for my solder skills.
And easy in 2 rows, with enough space between.
Maybe I'll play solderless... but lonoooog time ago my MSM6250 experiences.
Best Regards
Edit 1.
Or for 8 Euro from Poland:
http://www.multi-com.pl/index.php/en_US,details,id_pr,8047,menu_mode,categories.html
Edit 2.
I hope you see difference between pro stuff.
1 of these 3 Pics is not my...

need some info about connect to Samsung Cortex-A8 S5PC110 and dump internal memory.
what software need with my JTAGs:
- TI XDS560PCI;
- SpectrumDigital XDS510USB;
- Blackhawk USB2000;
- Altera USB-Blaster;
- Altera ByteBlaster2 (LPT);
- Wiggler (LPT);
- Luminary Micro Development Board;
- NXP LPCXpresso LPC1114 Development Board.

According to this:
http://www.segger2.com/index.php?page=Thread&postID=1786&highlight=s5pc100#post1786
...we are able to recognized the cpu type as cortex A8, but all the memory content are zero...
Click to expand...
Click to collapse
The proper Software for S8500 is mandatory and much more important as Hardware.
Few of the JTAG Masters are able to make own JTAG Hardware for less then 20 Euro.
But the Software...
If Bootloader alive, then higher chance to have connection with any JTAG Hardware and CPU only... memory is something different...
But if Bootloader is erased, then CPU Bootcycle... and it is nearly impossible to halt CPU without proper Software to have access to memory... RAM or NAND.
Next week I can maybe answer, if I had success with my J-Link... now I must wait for my second S8500 compatible JTAG.
Best Regards

Try OpenOCD, may (but dont have to) work. It should support A8. Btw in s5pc110 manual we can read about some new debugging interface except jtag, anyone ever seen this?

Last time I checked OpenOCD did not have the driver for writing NAND through s5pc110. Is it available now?

Gah, it isn't, i confused something. :/
Btw.
Why do you want to make full internal memory dumps, while these seems to be ones you're looking:
http://forum.gsmhosting.com/vbb/f665/share-full-flashes-1245293/
Compared S8530 FULL_RAW posted there with boot_loader.mbn, first bytes are exactly the same
Of course these could be RAM images, but why would them be called "full flashes"? ;d

@ Rebellos
Very good Link.
S5250 + S8500 + S8530 JTAG Dump.
And meanwhile ... I9000 Dump for study.
Thank you very much.
Best Regards

First attempt.
I have soldered 8 wires...
Anyone found Pictures of soldered wires in S8500...
Please post.
Any hints/tips are welcome. As I have at the moment no idea if I can insert Battery... or I have to hold... maybe I have to insert something to protect wires...
Thanx in advance.

Battery pins are quite big, try to use ac/dc 3-4V converter stabilised by some capacitor and clips on pins.

This is my wires for JTAG. Used standart battery for power.
and pinout for JTAG.

Thanks, how are you powering Wave? does battery fits together with cables or have to wire DC too?

In theory you can use USB cable to power on...
I have only used battery and pressed Button.
Now my S8500 is alive again.
Next attempt is to prepare my XXJB6 Bootloader... I will see if Wave is then dead again or Bootloader is usable...
Best Regards

Seems I'll need 30 minutes for 256 MB reading...
So 512 MB complete 1 hour...
Ehm, I'm tooo dumb to dump OneNAND.
Can someone please help me.
What I need to set/enter/press...
This is what I did... See Screenshot. I can read something from 0x42480000... but this is not what I want.
Please correct settings needed.
Thanx in advance.
Best Regards

It isn't "Memory reading" for sure, not directly at least.
Probably oneNAND reading isn't possible by some clicks and you need driver for oneNAND in script. oneNAND is controlled by modifying special registers under 0xB000_0000 address space. If you want oneNAND dumps you have to find driver for that or do it through FOTA using BL3 function Flash_Read_Data and rebell_memdump from our SVN repo.

Maybe I've found my mistake...
Now I can read something at 0... will see in an hour what it is.
Best Regards
Edit 1.
Okay, I have my 512 MB Dump.
But under DCC Red/Write Tab... and need to set few things... so not only press 1 Button.
Less then 30 minutes for 512 MB Reading...
Now I have to learn how to write safe.
As I don't need Full 512 MB write, only 4 MB at Start...
to prevent erase full 512 MB

Related

Htc Universal Memory Upgrade.

Hi
I Need Information About Upgrading The Ram Memory Of My Xda Exec.i'll Realy Appreciate A Do It Yourself Info.along With The Actual Tipe Of Memory And How Much Would Be The Maximum I Can Upgrade It To.any Info Will Be Well Appreciated!
Thanks!
the only thing I can think of is, that the Universal has some empty places for memory on the pcb.
if you are good in soldering SMD mounted memory you can check, if this is possible and where you must solder them in the universal by looking in the service manual (which also explains how to take apart the device).
the service manual you can find in the ftp of xda-developers.com.
if you do not know what is SMD etc. then just forget it as you will for sure screw up your device.
for what do you need more memory?
it has been tried, and you can find a forum post on this site about 8 - 10 months old.
there is a spare slot on the main board. it was done and added, but the OS didnt recognise the extra addition.
i find it odd. it was proposed that M$ OS limited its use, however, my wife has an IPAQ running WM5, and she has about 130mb of program memory (cant check she isnt here). Sure its not a phone, doesnt have 3G or GPRS etc, but as PDA, its fast, never runs out of memory, and has more than what mine does. So it isnt M$, it must be HTC manufacturer.
In summary, no matter how good you solder, it aint gonna work.
I also remember reading somwhere that with the extra memory the battery will drain way to fast thus rendering the upgrade utterly useless
Bro u shld really forget this thght coz as it is mentioned above dat even v know dat there is an empty slot provided by the hardware manuf. but there is no support recognized by our M$ OS .
So let's get this straight once and for all:
I've read through a lot of threads regarding this, and some ppl say that the limitation lies with WM, some say that it does NOT lie with WM, some say that you have to get the hardware correctly hooked up, some say that the soldering has to be correct.........
It seems nobody has been able to settle the issue conclusively one way or the other.
so, does a pocketpc device exist that:
a) is based on the same CPU as the uni
b) has more than 64MB of RAM (128/256)
c) has WM5/6 and it sees all of the RAM??
If such a device exists, then in theory no ROM change should be necessary, and the answer should lie with hooking up the additional/replacement chips correcctly.
Thoughts along this road?
D.
Develo said:
So let's get this straight once and for all:
I've read through a lot of threads regarding this, and some ppl say that the limitation lies with WM, some say that it does NOT lie with WM, some say that you have to get the hardware correctly hooked up, some say that the soldering has to be correct.........
It seems nobody has been able to settle the issue conclusively one way or the other.
so, does a pocketpc device exist that:
a) is based on the same CPU as the uni
b) has more than 64MB of RAM (128/256)
c) has WM5/6 and it sees all of the RAM??
If such a device exists, then in theory no ROM change should be necessary, and the answer should lie with hooking up the additional/replacement chips correcctly.
Thoughts along this road?
D.
Click to expand...
Click to collapse
it cant be a limitation of the "os" as atena has 128 mb ram
Think most if not all the WM6 models are now 128mb at least aren't they? Would seem to point towards HTC issue...
the universal was originally a wm2003se device with 128mb ram, they made it down to 64mb with the release of wm5, this is why the slots remain. If you can solder bga (needs an x-ray machine to verify the connections) and also find out how to get the memory noticed by the motherboard then it's a simple hex edit to make wm5/6 use it.
Interesting. Suppose I get the bga chips soldered on correctly.
1) What has to be done to wm5/6 so that the added ram gets seen?
2) I read someqhere that soldering just the bga chips is not enough. It seems that some additional parts are required. How about we get a detailed explanation going here?
Or is there a thread somewhere else about this already? I've searched around but haven't seen an explanation...
D.
Edit: while using an xray really insures that the connections are correct, I've soldered bgas before using more traditional methods (i.e.: hot plate + hot air gun). Doing this can damage the bga chips you;re trying to solder, but it is not that hard to do. Plus, I think the risk of damaging a few of the new chips you just bought is worth getting the final reward of doubling the RAM of the Uni...
BlackICE said:
for what do you need more memory?
Click to expand...
Click to collapse
That's the only reason I want to sell mine, because it has too little memory. I cannot start Navigon Mobile Navigator 6. Well I can start it but as soon as I want to search for a route to my Destination it lacks memory.
I found out that with PDAViet's ROM (one of the older Crossbow ones) where it has about 30 MB free it works, but I normaly have only about 22-24 MB left after syncing with no Program running. That's too little. This is why I wait for the Ultimate 7150 from IMATE.
simon_darley said:
i find it odd. it was proposed that M$ OS limited its use, however, my wife has an IPAQ running WM5, and she has about 130mb of program memory (cant check she isnt here). Sure its not a phone, doesnt have 3G or GPRS etc, but as PDA, its fast, never runs out of memory, and has more than what mine does. So it isnt M$, it must be HTC manufacturer.
Click to expand...
Click to collapse
That's why I'm awaiting the new ones from IMate. Perhaps they are fast as they are supposed to be. My MDA III (That's the BlueAngel) was much faster than the MDA Pro (Universal)
NiTeSHiFT said:
That's why I'm awaiting the new ones from IMate. Perhaps they are fast as they are supposed to be. My MDA III (That's the BlueAngel) was much faster than the MDA Pro (Universal)
Click to expand...
Click to collapse
yes but that was because Storage Memory was also in RAM...
Develo said:
1) What has to be done to wm5/6 so that the added ram gets seen?
Click to expand...
Click to collapse
Nothing should be done. Device would detect 128Mb automatically if RAM is correctly soldered. The RAM detection code is identical to the code used in BlueAngel ROM, so it should be working.
I even made a patched ROM on which device always think that 128Mb RAM is installed. So the problem is in soldering
2) I read someqhere that soldering just the bga chips is not enough. It seems that some additional parts are required. How about we get a detailed explanation going here?
Click to expand...
Click to collapse
There are 2 resistors that need to be shifted. Search forum, we've published the fotos.
But that is not enough, the whole RAM is not accessible, so something else should be soldered.
Does anyone know if the new imate ultimate series will recognize an sd / mini sd card greater than 2mb??
Midget_1990 said:
the universal was originally a wm2003se device with 128mb ram, they made it down to 64mb with the release of wm5, this is why the slots remain. If you can solder bga (needs an x-ray machine to verify the connections) and also find out how to get the memory noticed by the motherboard then it's a simple hex edit to make wm5/6 use it.
Click to expand...
Click to collapse
Does anyone have one of these 2003SE Uni's, to compare hardware? Has anyone seen one of these?
It was never released as a WM2003 device though before it was changed to run WM5. Finding one is pretty much impossible if anything.. I do recall a year or two ago a chinese user of the device soldered the ram on the device and got it to detect the full 128mb. His work was never posted here though, I came across it on google a long time ago. If I find the page I'll post it here.
good god please do that!!!!!!!! I've been racking my brains out reading datasheets and googling and reading stuff about this, and I've been wondering for the longest time how come nobody has done it yet!!
Hope you find that page again!!!! I sure haven't!
D.
Has anyone tried looking for FCC or Patent Diagrams?
I've been trying emailing reviewers who had pre-production ones, especially the ones who's articles said 128mb of ram
Sounds very good all this,
Hopefully someone finds out how this is to be done.
Oh and i am willing to try it out too (hmm man too bad i cannot solder bga chips)

jtag pinout

Hello, does someone have the jtag pinout for the uni?
Or at least the circuit diagram...
I thought the whole point of jtag was that it was a standardised interface connector:
http://www.interfacebus.com/Design_Connector_JTAG_Bus.html
or am I misunderstanding your question?
Cheers,
yes, I know what is jtag but probably my question was misplaced.
what I would know is where are jtag testpoints on universal.
my phone is bricked and the only hope of resurrection is restore the bootloader through jtag
ah right, I'm with you now. have you checked out the universal reference manual? is it mentioned in there?
-edit- no just checked doesnt appear to have any mention or picture of one.
sadly true: the service manual doesn't mention it.
does someone has got schematics for the universal?
sigh! i'm going to believe that my uni will be forever a nice paperweight...
any news?
Hello, I'm still stuck with my uni bricked. Anyone have new suggestions or jtag pinout?
Thanks!
I payed about 50USD to have my bootloader chip replaced here in China.
cant find any other solution for the same brick here. I'v heard someone here fixed his dead bootloader by jtag DOC reflash.good luck.
Hi champro, then does you have got the bootloader chip replaced and not reflashed?
Does you could contact someone to get jtag pinout for the universal?
Thanks a lot.
Any success for bootloader solutions ? I also have a bricked universal.
Thanks
Still nothing...
Hi, I haven't debricked my uni yet. But in the meantime I'm looking for a dead mainboard (or a whole dead phone) in the way I'll could desolder the cpu to trace the jtag pins. When I'll have this pinout I'll count on the support of this forum to find a pal that will dump a working phone to restore mine.
roglio said:
Hi, I haven't debricked my uni yet. But in the meantime I'm looking for a dead mainboard (or a whole dead phone) in the way I'll could desolder the cpu to trace the jtag pins. When I'll have this pinout I'll count on the support of this forum to find a pal that will dump a working phone to restore mine.
Click to expand...
Click to collapse
we are allready doing this no need to break two phones
Great!!!!!!!!
Fantastic! May I participate? I'm a average experienced user with jtag interfaces and a dead M5000 to work on!
Please is a lot of time that I'm waiting for the jtag pinout!
ok Lt.Cmdr.Ivan is going to trace the JTAG points from under the CPU of his dead Universal, last I heard he was about to put it in a toaster to get it off
You say you have JTAG experiance? When we find the points could you work out the best/only method etc to fix a broken Universal
Yes, I've already debricked a toshiba e740 pda last year. A complete success!
The best way to desolder a bga is to use a heater gun like those used to remove paint from walls. It is very cheap 15~20$. If you aim to the motherboard with this gun, surface mounted components literally fly away or fall down if is it in vertical position.
I'll wait anxiously for news!!!
i suppose who can afford a digital multimeter, can afford a hot-air soldering station as well. (well under $100 now)
anyway, you can just use a 300W infrared bulb and several hours and the work is done as well.
just pick off the plastic items before applying this heat.
Hi, any news? The number of bricked universal is growing!!!
roglioWhat software you used and what adapter LPT (wigler )or another?
If you know the points jtag as you will write in DOC (DiskOnChip) SPL and IPL ?
Just fyi progress ont he JTAG project can be found here:
The Universal JTAG Project
We found them

'No GSM' repair trying. Direct programming K5D5657ACM

First of all, sorry if my english is not very good. I'm from spain and I have a Universal that suffered a power failure during gsm flashing and the gsm bootloader was corrupt. It shows the message 'No GSM' during startup and i couldn't find the way to repair... Not possible to reprogram gsm firm, didn't work trying to Unlock, no SuperCID and it seems that neither Jtag (i read that jtag on Universal isn't connected to the gsm chipset).
So... i thought about programming the ROM chip of the GSM module directly accesing it's pins in the PCB. The main problem: this SMD chip has its pins under its body, like a typical PC main processor and not along its borders, so, the only way to see what points on the PCB could give us access to the concerned pins in the ROM, would be unsoldering it... ufff... not an option, but... when I was having a look at the PCB's pictures for the JTAG from the wiki...... Bingo! A completely naked PCB picture! But... oops, the zoom square of the JTAG zone, is just over the conducting paths i want to see!!!
Please! It would be fantastic that the person who made that picture, make another one, where i can see the whole gsm module to track the paths... even better if i could see the opossite side. But doesn't matter if don't!
This ROM employs an electrical protocol very similar to other ROMs and I think It should't be dificult to program using a PIC or similar to drive signals, data and timigs, just to read or write it "as a whole", secuentially. Of course if i find the way I will pos it here with details for everyone.
Thanks in advance! I'm fascinated with your work!
JTAG for radio chipset? I tried to find it but no luck, old problem with hermes/universal. I tried reworking the qualcomm 6250 but nothing. Chip you are talking about is BGA not SMD, and it is very hard to remove it.

Wave S8500/S8530 Development Platform Mod AKA UnBrickable Mod

This modification will go like this:
http://forum.xda-developers.com/showthread.php?t=1206216
note: this modification seems to look slighty different on S8500 than S8530 (slighty different board layout) - please check this post - http://forum.xda-developers.com/showthread.php?p=17724584#post17724584 (still needs testing)
This can be applied to a bricked phone and unbrick it without JTAG.
After that, unbricking your Wave will be almost as easy like this is (need kinda different soft, as following movie been made with SGS series phone):
See here for more info about unbricking Captivate:
http://forum.xda-developers.com/showthread.php?t=1242466
(Unbricking Wave tools are on its way)
I haven't tested it by myself but it will work. I did teardown of mine S8530 damaged mainboard.
Introduction
I'm not kidding when I say UnBrickable. Modifying the OM pins means you
can boot from USB, UART or MMC. This makes the phone quite UNBRICKABLE.
There is nothing you can do software wise to prevent the device from
booting into this mode. We are communicating with the unrewritable,
efused IROM on the processor. It's the thing that makes the system on a
chip into a "system on a chip".I am here now to tell you how to turn
your Samsung Wave into a KIT-S5PC110 development board. The
KIT-S5PC110 development board is the platform used to develop our
phones. There are some differences between this mod and the official
development platform. The S5PC110 has a removable internal SDCard and
no touchscreen.
Why would you want to do this? When you plug in the battery and
connect it to the computer in "off" mode, it will become an S5PC110
board awaiting download of a program to run. This occurs long before
anything like software or firmware enters the processor. This is the
IROM of the device awaiting commands or a power on signal.
Because it is accepting a memory flash, anything may be put onto the
device to perform a boot sequence..... Apple iOS (iPhone4 has the same
processor) WP7 (mango supports this processor).
This will be a replacement for JTAG once we are able to make some
firmware. How could it possibly be better then JTAG? Let's count the
ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the
computer via USB and await commands. Otherwise it will pretty much act
like a Droid Charge. See the Special Instructions section.
Modification
You will need:
1. Get someone who knows what they're doing with a soldering
iron. If they don't know what flux is, then they don't know what
they're doing. You can speak to AdamOutler or
Connexion2005(aka MobileTechVideos.com). I don't know who from Europe region is able to perform this mod, I still need some more soldering practice, probably in month or two I will be also able to perform this.
2. soldering iron - make sure it's sharp, if it's not sharp, then
sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (possibly- for the wire within to use as a bridge)
Performing the modification:
1. tear apart your phone... Make sure to take out your SIM and external
SDCard before you do this.
1A. Remove the mainboard (you can see on the movie how to do it)
S8500 disassembly movie (S8530 looks basically the same):
Mainboard picture:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Closer picture:
xOM resistors mapping:
2. Perform the mod by removing the xOM5 resistor and connecting its active (CPU) side to the active side of xOM0 or xOM3 resistor (so it become pull-up instead of pull-down).
3. Reassemble the phone.
Special Instructions
This may change battery charging sequency, or even disable it when the phone is turned off (it may be needed to turn on the phone first) <-- needs some tests
To turn on the device, and operate in normal mode, you must hold the
power button for 5 seconds.
3 button Download mode works as usual, however you must not have the
S5PC110 drivers installed on the computer. 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 iROM dload mode.
Conclusion
Congratulations. You now have a device which works like a KIT-S5PC110
with an OM Value of 29. Now get to developing some serious custom
software. See here for setting up the UART output
http://forum.xda-developers.com/showthread.php?t=1235219
Reading material
Creating your own Samsung Bootloaders:
http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW:
http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example:
http://www.boardset.com/products/mv6410.php
ODroid dev center:
http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Drivers and utilities
This will be an ever expanding list
Windows Drivers
http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW:
http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line Download Tool:
http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility:
http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Firmware
One-Click Resurrector (made for SGS series):
http://forum.xda-developers.com/attachment.php?attachmentid=705515&d=1314762609
Bootloader Hello World by Rebellos
http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
Please note that we are not yet able to rebuild Wave's NV_Data, so if you damage your IMEI (by trying to flash SGS stuff before dumping your oneNAND through Badadroid) you have to deal with it on your own.
Thanks to Adam Outler.
Please message me or simply make post here if you perform this mod and need any additional info.
Already done MODs:
Captivate (the first one): http://forum.xda-developers.com/showthread.php?t=1206216
Droid Charge: http://forum.xda-developers.com/showthread.php?t=1245391
It is important to note that this modification has never been performed on a S8500 before. Rebellos is very competent and will work out the details of the firmware portion. His HIBL allows insecure code to be loaded to the device and it is extremely likely that this modification will lead to easy development of alternate firmwares for your device. This mod enables a special download mode which will allow you to experiment freely as long as you have a backup of your EFS and critical data.
Once Rebellos is able to get the firmware operational, and he will likely work with you directly and remotely if you're willing, recovery of the S8500 will be this easy:
We are fully confident in this modification and if you have a bricked S85**, please send a PM to Rebellos. He will develop a firmware rather quickly to resurrect the device and then everyone will have an UnBrickable Wave!
Bonus - have you been ever wondering how does PoP BGAs or S8530 mainboard without CPU does look?
http://i53.tinypic.com/xlf8rt.jpg
From the left to right:
- oneNAND+oneDRAM+DRAM package
- Hummingbird CPU
- S8530 Mainboard
If you want I can take better macro photos of these. Also if someone want to try reballing of memory package (CPU has got burned core) I can donate it to him. However it has got like 0.1mmx0.1mm size balls. Maybe if I ever get rich and smart and I get bionic hand, I'll make a board under this package.
So Adam Did you try this with the Wave S8500/S8530 ??? or you still need a Wave for donation ???
I am very interested in this but i won't do it because i heard about some stability problems after removing the resistor
Also i have a question...Can i put the resistor back after unbricking my device or it will be totally fried??
Best Regards
You can put the resistor back if you manage to. SMD elements are usually high-temp resistable.
There is no stability problems if you connect it to some other pullup or pulldown resistor.
CPU will become unstable only if you remove resistor and leave xOM5 line unconnected to anything as it'll take electrostatic charges and induce voltage from other elements and electromagnetic field causing noise inside of CPU when not grounded or HIGHed.
you mean it will act like a really tiny capacitor (i am electrical engineering student)
Do you think that mod will reach the mobile repairing shops?
i mean if you could write a good bootloader that will dual boot android and bada (yes i think you are genius enough) then this can go to mobile shops to get it done by experts hands that will be awsome(i've never opened up my Wave and don't have much experience to do this)
You will get donations for this for sure
Best Regards
mylove90 said:
So Adam Did you try this with the Wave S8500/S8530 ??? or you still need a Wave for donation ???
I am very interested in this but i won't do it because i heard about some stability problems after removing the resistor
Also i have a question...Can i put the resistor back after unbricking my device or it will be totally fried??
Best Regards
Click to expand...
Click to collapse
Rebellos performed the destructive inspection on his own device. The work is complete, you may modify your device according to the specs above. This will allow you to boot from USB.
You may be able to put it back, but it's not likely, and you will never need to.
MobileTechVideos.com is already offering this service for Captivates as the mod is finished and we have it working fully on Linux platform. All thats left for Wave is for Rebellos to work with someone who has a working Wave (maybe 1 hour via google talk). Modify your device and PM Rebellos.
If your device is broke this will resurrect it. If your device is not broken, this will allow you to flash Android ROMs without fear of permanent damage.
I think Rebellos already has worked out the changes needed to the bootloaders to run Android on Bada with the BadaDroid project.
mylove90 said:
you mean it will act like a really tiny capacitor (i am electrical engineering student)
Click to expand...
Click to collapse
No. Rather like tiny not-grounded antenna or induction coil, which transforms all magnetic field jitters into small, noisy voltage current, which are very annyoing for CPU.
(thats why in electronic chips all pins should be connected to something which can provide stable LOW or HIGH state, if they doesn't support internal PUD mechanism)
mylove90 said:
Do you think that mod will reach the mobile repairing shops?
Click to expand...
Click to collapse
That would be awesome. Writing dual-boot bootloader isn't a huge deal, but needs some work and designing, for example problem is that oneNAND (the fastest flash memory we can use) size is only 512MB, so it can hold only like 150% of 1 OS files. That could be solved by moviNAND repartitioning and modifying bada kernel properly to not wipe Android partitions.
AdamOutler said:
I think Rebellos already has worked out the changes needed to the bootloaders to run Android on Bada with the BadaDroid project.
Click to expand...
Click to collapse
Yup, got these files ready. But I don't want to release something completely untested.
//edit:
Here you have links to modified S8530 and S8500 BL3 images.
Original, decrypted and extracted and ones can be used aswell, but needs dload-mode key combination to be hold. The modified ones does enter DLoad mode immediately.
Entrypoint for both is 0x42480000
http://hummingbird-hibl.googlecode.com/svn/trunk/HummingBirdInterceptorBootloader/S8500_BL3.bin
http://hummingbird-hibl.googlecode.com/svn/trunk/HummingBirdInterceptorBootloader/S8530_BL3.bin
I'm not seeing any action here. If you bricked your device, this will resurrect it.
Rebellos, you want me to start working on the Ultimate One-click resurrector? I don't feel motivated since Boone has put your work of proper pin identification to work... maybe the Bada guys don't DIY, or they just rather pay for JTAG?
Using this mod you can get Android on your device. You can load other device's firmware. Its very powerful and allows you to revert all changes.
AdamOutler said:
I'm not seeing any action here. If you bricked your device, this will resurrect it.
Rebellos, you want me to start working on the Ultimate One-click resurrector? I don't feel motivated since Boone has put your work of proper pin identification to work... maybe the Bada guys don't DIY, or they just rather pay for JTAG?
Using this mod you can get Android on your device. You can load other device's firmware. Its very powerful and allows you to revert all changes.
Click to expand...
Click to collapse
Maybe it's just because Wave users groups is much smaller than Cappy, also it isn't Android device, so people aren't flashing it so often as Cappy. Or they are just scared the crap out of DIY. ;d
it is not like that
Wave is not easily bricked (thank Samsung for that)
Until now i saw people with out knowledge who bricked it
Rebellos , you know bootloader is flashed in nearly 2 seconds and the phone will be bricked only if you did something wrong in these 2 seconds
i promise if my Wave bricked i'll try that method but where is the software stuff ?!
Please complete what you started Adam , Rebellos
Best Regards
mylove90 said:
it is not like that
Wave is not easily bricked (thank Samsung for that)
Until now i saw people with out knowledge who bricked it
Rebellos , you know bootloader is flashed in nearly 2 seconds and the phone will be bricked only if you did something wrong in these 2 seconds
i promise if my Wave bricked i'll try that method but where is the software stuff ?!
Please complete what you started Adam , Rebellos
Best Regards
Click to expand...
Click to collapse
Under Linux-- The HIBL gets loaded with this command:
Code:
sudo smdk-usbdl -f ./HIBL.bin -a D0020000
the SBL gets loaded very similarly
Code:
sudo smdk-usbdl -f ./S8500_BL3.bin -a 42480000
You should boot at this point. The HIBL is standard, the BL3 is provided in post 8 http://forum.xda-developers.com/showpost.php?p=17311448&postcount=8
Hi, first of all, sorry for my bad english, i'm spanish.
I bricked my wave more than one month ago. I have disassembled the phone but the xOMS mapping isn't the same. I have tried to modify the xoms but no results. Here are one photo of the xoms mapping, if you know who is the mod than i must to do, i'll try to do.
Here are the photo: h**p://i51.tinypic.com/wk1x52.jpg
This is my first post, i cant post links, change ** for tt.
jomadeto said:
Hi, first of all, sorry for my bad english, i'm spanish.
I bricked my wave more than one month ago. I have disassembled the phone but the xOMS mapping isn't the same. I have tried to modify the xoms but no results. Here are one photo of the xoms mapping, if you know who is the mod than i must to do, i'll try to do.
Here are the photo: h**p://i51.tinypic.com/wk1x52.jpg
This is my first post, i cant post links, change ** for tt.
Click to expand...
Click to collapse
Sorry. I assumed that S8500 board is the same, because schema in service manual is the same. However, it seems that there are differences.
Also see your mistake.
You connected some pulled up line straight to GND, you just made some resistor (I haven't traced it, it doesn't seem to be xOM, if order is the same) pull-down.
I'm sure the upper-left row of 3 are pull-ups, the bottom-right row of 3 are pull-downs. So resistors order should be the same.
All X resistors are pull-ups, with VCC on the upper side.
VCC line is marked purple
part of GND is marked by red spray - you can see it is big baseline, going through whole board.
second and third X resistors counting from the left should be xOM0 and xOM3.
1, 5, 2, 4 correspond to the xOM lines, they have CPU and GND sides arranged the same as on my picture from S8530 - 1,5,2 has GND on the downside, 4 has got GND on the upside.
The easiest way is connecting some VCC side of any X resistor with CPU side of xOM5 resistor, IF xOM5 resistor is 100kOhm or higher (should be around 100kOhm). If it is not - you should unsolder xOM5 resistor.
You can also connect CPU side of any X resistor with CPU side of any xOM5 resistor (theoretically the safest way, however mentioned above - short circuiting VCC with GND through 100kOhm resistor - is used on Samsung's dev board) IF you can find X resistor with resistance few times smaller than xOM5.
I'm sure this will work if done properly.
Remember to remove the soldering you've done already. Also remember to not leave xOM5 line not-connected to GND nor VCC - this will cause CPU to hang often.
Your board:
My board:
Can you see similiarities? I hope so.
After that just try ModeDetect by AdamOutler http://forum.xda-developers.com/showthread.php?t=1257434
And you should see UnBrickable Debug.
Thanks for the info Rebellos, later i'll try and post the results.
I can't unbrick my phone, after disassemble the phone and mod another time, obtain the same result, no answer on the phone and can't find the device in linux. Probably the reason is that the mod that i have done are incorrect (i haven't the tools necesary). For more info, i used Ubuntu 11.04 under virtualbox and under livecd. Thanks for all, and sorry but my experience can't help you in the development of this tool.
jomadeto said:
I can't unbrick my phone, after disassemble the phone and mod another time, obtain the same result, no answer on the phone and can't find the device in linux. Probably the reason is that the mod that i have done are incorrect (i haven't the tools necesary). For more info, i used Ubuntu 11.04 under virtualbox and under livecd. Thanks for all, and sorry but my experience can't help you in the development of this tool.
Click to expand...
Click to collapse
If you simply remove the resistor, about 1/2 of the time it should enumerate properly with the battery removed from the device. Once you have unbricked, jumper the xOM5 to something (high or low) so that it's not free floating.
hmmm Port Android easier, i see, but i am always asking myself why putting so much energy in a device that is after 2 years surely gone from market? (Only a question)
The energy could be put in other directions but everyone has his special hobby...
Seeying this android port will be maybe finished when everyone gets new device, for personal it has no sense to put the free time in such projects.
I know what i am talking about, i developed slyfer 3 months, hacked their server got for 9 months all firmwares, but what i have now from this? Nothing, i am very sad that i put so much time in such a project with no future, maybe you guys understand what i mean. So much skills can be on other site usefuller.
@Rebellos, why you dont try a "jailbrake" like for bada? You have the skills for that, but it seems that all of your energy will go in the bootloader for android, so around more than 50% (cause a lot arent on forums) will not have benefits from it. But anyway its your work and decision. And as we all know a not possible for bada doesnt exists.
Everything is possible.
But think about it the life is short, maybe things that helps all would make you also happy as me, but if you already know that your work will be in nearly a year for nothing it would be better to search another thing to kill time. Slyfer now is a dead program with no sense, it only shows me that i made it some day but uselesser it cannot be like this:
http://www.youtube.com/watch?v=UkgoSOSGrx4
Only my thinking.
You have the skills for that, but it seems that all of your energy will go in the bootloader for ...
Click to expand...
Click to collapse
Why not improve Reversing skills...
Bootloader knowledge is mandatory for deeper research/develop of Hardware or Software solutions...
Not everyone need it or understand it.
Anyway.
Its free decision.
@ larioteo
You are interested in Software ...
Others are interested in Hardware... like me...
Rebellos for instance like to learn more about Hardware + Software.
@Rebellos, why you dont try a "jailbrake" like for bada?
Click to expand...
Click to collapse
You know the answer...
Compression Algo of apps_compressed.bin (same for RC1 and CSC Languages... aka QMD compressed stuff) is not complete hacked...
Bootloader contains Algo for QMD...
Best Regards
Jomadeto, sorry for that it didn't worked
Larioteo, that movie is awesome. Thank you.
Excuse me little offtopic, but... maybe someone can PM me this
What exactly is jailbreak?
According to first phrase of this definition:
http://en.wikipedia.org/wiki/IOS_jailbreaking
We do already have jailbreak. Through modified FOTA we can force BL to load any ARM binary, any modified bada apps and so on. Just gimme practic target and I can try to achieve it someway. (I hope I'll have dev board soon )
But, beggining studies in 3 days, so ain't sure how much time I'll have for various hobby R&D.

Thread for: S8500 Restarting ITSELF

Hello.
This is thread for these who have seriously problem with their Samsung Wave s8500.
PROBLEM
- Restaring itself after some use.
- Charging problem ( No charger connected, but it say that phone is connected and charging )
- Other weird things happening with Samsung Wave S8500
SOLUTIONS THAT DIDNT FIX PROBLEM
- Software ( Bada 1.0, Bada 1.2, Bada 2.0 )
- Factory Reset
- Master Reset
- Memory Card OUT
- SIM Card OUT
MAYBE SOLUTION
- Android ( i dont have USB to try this )
- Firefox OS by Tigrouzen
- Ubuntu Phone
MY COMMENT
- Lots of guys having these problem with their waves,, i just one day start do happening.. first i thinked that i was software problem, but i changed lots of other softwares ( Bada ) and same. Its working 3-4 minutes, then turn off itself, and waiting 15 sec to turn it on.
Everybody who know someting that we could try, or it can help, post here, so that other members with this problem can SEE
Cheers :laugh:
Galaxy3HELL said:
Hello.
This is thread for these who have seriously problem with their Samsung Wave s8500.
PROBLEM
- Restaring itself after some use.
- Charging problem ( No charger connected, but it say that phone is connected and charging )
- Other weird things happening with Samsung Wave S8500
SOLUTIONS THAT DIDNT FIX PROBLEM
- Software ( Bada 1.0, Bada 1.2, Bada 2.0 )
- Factory Reset
- Master Reset
- Memory Card OUT
- SIM Card OUT
MAYBE SOLUTION
- Android ( i dont have USB to try this )
- Firefox OS by Tigrouzen
- Ubuntu Phone
MY COMMENT
- Lots of guys having these problem with their waves,, i just one day start do happening.. first i thinked that i was software problem, but i changed lots of other softwares ( Bada ) and same. Its working 3-4 minutes, then turn off itself, and waiting 15 sec to turn it on.
Everybody who know someting that we could try, or it can help, post here, so that other members with this problem can SEE
Cheers :laugh:
Click to expand...
Click to collapse
Mine isn't restarting.
problem is auto switch off.
and this problem comes 1 time per 15days ,
and problem remains about 1 hour.
kktkaran said:
Mine isn't restarting.
problem is auto switch off.
and this problem comes 1 time per 15days ,
and problem remains about 1 hour.
Click to expand...
Click to collapse
Yeah, that how my problem start...
It was one restart in one week, then it started all day.
Its same problem.
- Android ( i dont have USB to try this )
Click to expand...
Click to collapse
If you can use Multiloader or Kies for Update, then same cable to flash/copy files for Android.
Or why you can't test Android?
Or how you flash Firmware with Wave?
Best Regards
Edit 1.
- Charging problem ( No charger connected, but it say that phone is connected and charging )
Click to expand...
Click to collapse
I know this also from old Siemens Qualcomm handsets... if USB itself was damaged or parts of Resistors or some other SMD parts damaged or missing complete...
= HARDWARE damage/defect
- Other weird things happening with Samsung Wave S8500
Click to expand...
Click to collapse
Maybe something like Input without pressing something? Or close Application?
My damn S8600 has damaged Touch... autoshut down off Apps... damn End key...
Also Hardware damaged/defect...
S8600 was bought as damaged handset from Ebay...
So maybe you bought also damaged S8500...
Sorry.
Again, I have no idea why you create again new Thread...
GT-S8500 | Wave - Restarting Problem
GT-S8500 Restarting ITSELF EVERY 30MIN
Thread for: S8500 Restarting ITSELF
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=2343067
http://forum.xda-developers.com/showthread.php?t=2294795
Best Regards
adfree said:
If you can use Multiloader or Kies for Update, then same cable to flash/copy files for Android.
Or why you can't test Android?
Or how you flash Firmware with Wave?
Best Regards
Edit 1.
I know this also from old Siemens Qualcomm handsets... if USB itself was damaged or parts of Resistors or some other SMD parts damaged or missing complete...
= HARDWARE damage/defect
Maybe something like Input without pressing something? Or close Application?
My damn S8600 has damaged Touch... autoshut down off Apps... damn End key...
Also Hardware damaged/defect...
S8600 was bought as damaged handset from Ebay...
So maybe you bought also damaged S8500...
Sorry.
Again, I have no idea why you create again new Thread...
http://forum.xda-developers.com/showthread.php?t=2343067
http://forum.xda-developers.com/showthread.php?t=2294795
Best Regards
Click to expand...
Click to collapse
i know you will post you answer.
I cant try Android becaouse i dont have USB, i was use friend USB.
I created this thread for other members who have same problems.
Touch screen is working great.
I mean I have damaged devices, because they are damaged.
I've bought them because the are damaged... = cheaper...
HARDWARE DEFECT.
I don't know how to write in your language...
In German:
kaputt
In your Language:
сломљен, неисправан
You need professional help of skilled guys to repair handset, or buy next time handset WITHOUT Hardware damage.
I don't know, if it is an good idea for you, to change self PCB...
Better buy complete handset for 20 $...
Sorry for you, that your Wave is damaged and nearly unusable...
But it is IMPOSSIBLE to fix your problem by Software...
Das kann doch nicht so schwer zu verstehen sein...
Best Regards
adfree said:
I mean I have damaged devices, because they are damaged.
I've bought them because the are damaged... = cheaper...
HARDWARE DEFECT.
I don't know how to write in your language...
In German:
kaputt
In your Language:
сломљен, неисправан
You need professional help of skilled guys to repair handset, or buy next time handset WITHOUT Hardware damage.
I don't know, if it is an good idea for you, to change self PCB...
Better buy complete handset for 20 $...
Sorry for you, that your Wave is damaged and nearly unusable...
But it is IMPOSSIBLE to fix your problem by Software...
Das kann doch nicht so schwer zu verstehen sein...
Best Regards
Click to expand...
Click to collapse
Dead Adfree, we all know that new motherboard is solution.
Im started this thread, because i wanted to help other guys, just post something that could try.
I have nothing to lose, i will opet my phone and remove every thing what you think thats solution.
Give people hope, dont say that.
we all know that new motherboard is solution
Click to expand...
Click to collapse
This is not 100 % correct.
PCB is only 1 part...
It is possible, after PCB change SAME problem...
And PCB change is not easy... sometimes risk to damage more then before...
Connectors etc...
Easy/easier would be to test Android, if same Problem persists...
But you are not willing or USB cable or no idea...
And 3 Threads for 1 problem is hard to understand...
Dead Adfree..
Click to expand...
Click to collapse
Sorry, I am alive.
Best Regards
adfree said:
This is not 100 % correct.
PCB is only 1 part...
It is possible, after PCB change SAME problem...
And PCB change is not easy... sometimes risk to damage more then before...
Connectors etc...
Easy/easier would be to test Android, if same Problem persists...
But you are not willing or USB cable or no idea...
And 3 Threads for 1 problem is hard to understand...
Sorry, I am alive.
Best Regards
Click to expand...
Click to collapse
that should be DEAR ADFREE.
2 thread is opened.
First it was my problem.
Second is for other to help.
Why you cant understand that?
Why you cant understand that?
Click to expand...
Click to collapse
Because important/interesting details are spread over 3 Threads...
Your summary is "incomplete"...
I hope you will not open 4. Thread with same problem or more.
Technical discussion...
Click to expand...
Click to collapse
You can read this in Forum title...
So you have open your Wave and check for VISIBLE damages?
Little inspiration, read this document.
http://forum.xda-developers.com/showpost.php?p=43867955&postcount=28
Disassemble Docs are in same Thread... also Videos available for open Wave...
If you are scared... to open handset. Then ""new"" idea is to try Android...
Maybe Android more stable... because SECOND CPU not used... nearly...
Maybe Qualcomm CPU is damaged or parts of CP....
I don't know...
USB cable you can take from your friend.
USB cable is minimum requirement if you really want solution.
Repair has nothing todo with hope, dream...
Only with skills and money.
Only skills also work :good: :good:
But no skills, no money and no will = NO repair.
It's NO shame to have no money.
Maybe sell your Wave as defect/damaged on Ebay.
And use other handset.
Best Regards
Maybe it's only the damn samsung automatic reboot.
If you keep the power button (on all samsung devices i tested s1,s2, s3, other bada, next) for 10-15 seconds it reboot itself.
I found this while i keep my wave2 in my pocket and i found it at pin screen.
Bye
Thank you all for help, but u sold this phone and buy motorola milestone 2
i think i made good chooise.
bye
hello
i had the same problem (wave restarting himself)
it was a 3g problem (umts) and no problem in 2g (gsm)

Categories

Resources