Develop Bugs

The opening of the Wave bootloader through FOTA

Hi everyone,
Many people have complained about the Wave bootloader being closed and that being major problem for the development of alternative OS.
I had a closer look at the booting process and would like to contribute my observations to the community. I shall have little time (next to none) to work on it further, so I'd like someone to take it from this point.
OK, that said I can introduce you to what I found:
The booting process starts with initialization of the hardware, interrupts, etc. and gets to the selection of the booting mode. This is the place that checks the key combination, JIG and possible problems. Basing on this the bootloader will run the phone in either normal boot mode, go to dowload or upload mode.
Normal boot shall start with checking the FOTA module. If you already tried flashing your phone you probably noticed that some versions of the FW include a file with *.fota extension. The file is unencrypted and not signed. It's about 2MB, but the bootloader reserves exactly 3MB for it. FOTA is intended to be used for firmware update over the air, but I know nothing about it being used for Wave. You may read something about the design and get a concept of that process here:
http://www.freepatentsonline.com/pdfb/documents/usapp/patent_pdf/2010/017/US20100175062/pdf/US20100175062.pdf
Basically, it is possible that boot would need to perform some actions that are a result of FOTA. Therefore, during the normal boot it reads the FOTA module from the NAND (0xC600000) and checks whether the module exists and is in the right version. That is done by checking a magic (text "FOTA_ENGINE_VER_INFO_2.0") under the 0xC600100. If it is found missing or incorrect you will end up with the message "FOTA Engine is not intalled" or "FOTA Engine version mismatch" on the screen and you will need to restart your phone in the download mode to load it.
After that, the code checks for additional magic values at 0xC880000. In case it is "BPDZ" it jumps to the code in the FOTA file. The contents of the file is loaded to RAM location 0x43800000 and executed from there.
I've made an experiment as a proof-of-concept and have a confirmed that the above is true and valid information. I crafted a FOTA file longer that the usual attached (to be bigger than 2,5 MB). In case you want to repeat that, remember that last 1024 bytes are not loaded and insert additional data before that. My file had two magic values:
"FOTA_ENGINE_VER_INFO_2.0" at 0x100 offset and "BPDZ" at 0x280000. At offset 0 I've placed my code that started with several NOPs (just in case) and code that called original bootloader functions to display text on the screen.
After loading the file with Multiloader, the message appeared on the screen as expected. Reloading of the original FOTA file made the phone boot normally.
The discovery opens wide area of possibilities starting with replacing bootloader without signing it or using JTAG, multiboot, etc.
As the original bootloader is in the memory as well, we can use it, but I would not recommend that approach as we would need additional version control and changing original routines and data addresses for each version.
OK. I hope I made it clear enough to understand, but I can clarify what I might have omitted in the description. The idea is that someone here would pick that up from where I finished and develop a decent loader leaving the original files (apart from FOTA) untouched.
Best Regards,
mijoma
-----------------------------------
Edit: Added proof-of-concept FOTA file (based on XXJL2 FOTA). Use wisely - remember you take full responsibility for what you load on your phone. Works ONLY with XXJL2 bootloader.

Very interesting ... great job

My little knowledge/experiments...
1.
Before I NEVER updated manually FOTA. I never seen any Errors like other user... with FOTA not installed or something similar.
Maybe reason is, because my testdevice has NO active SIM card, so no network...
2.
I've tested examples from mijoma. On XXJL2 Boot...
Simple only flash FOTA with Multiloader.
At your own risk. Not all sideeffects known.
I had NO problems.
3.
Results... I can't see any special after Flashing. But I can go through internal menu, see Pictures.
http://forum.xda-developers.com/showthread.php?t=906966
Normally I have more messages... but with modified FOTA Wave restarts. So the way is correct.
4.
Delta files are sometimes in Firmware also with Boot... I will add next Link to what I found about Delta files...
Delta Files are part of FOTA concept...
5.
Depend on Firmware... Software update... but sometimes is this point removed and I can't login, because no network...
In other words, I have to start FOTA over this internal menu to see that it is doing something.
Best Regards

@adfree
I think you are testing the previous version. Could you confirm you are using mod version 2?
Best Regards,
mijoma

bplib_S8500OpEuro_XXJL2_mijoma_mod2.zip
You are right, not tested yet. Only prior Version.
I will test today mod2 and report later.
I have to flash back to XXJL2... as I play actual on Orange JE7.
Thank you.
Best Regards

YT: watch?v=A35k3E1F1O4
It's working....
Best regards.

Amazing job dude. It seems like this could help us to change booting stuff

Nice work mijoma !!!

I can confirm it works.
Now I see the same like on this Video:
http://www.youtube.com/watch?v=A35k3E1F1O4
Thanx jedil1 for Link.
Sorry mijoma.
I have no idea where I made mistake...
This time my first Test was Full Flash (without Boot)...
Second only FOTA and it works too... Original, then yours...
If you flash "Full", then you interrupt the Index process at Start, where Blue Screen shows...
Best Regards

Great job!!!
And my opinion,this is a single way to starting full working android on s8500,
because we need to initialize the modem at bootloader stage for fuel gauge.
i temporary use modem from m130k without fuel gauge.

Few Firmware packages have Delta files:
Code:
delta.bin
delta_AP.bin
delta_CFS.bin
delta_CP.bin
delta_CRSRC.bin
delta_FS.bin
delta_LFS_01.bin
delta_LFS_02.bin
delta_RSRC2.bin
Around 16 MB...
If I use Google for "Delta Files FOTA"... then I can also find this:
http://www.faqs.org/patents/app/20100175062
Theory/ideas
What we also can do with this Security hole:
- maybe "move" folder System to SD or internal Memory, to have no more problems with RC1
- maybe someone is smart enough, to integrate Dump Function for Dump whole RAM or moviNAND... like JTAG
See Upload function...
Best Regards

adfree said:
- maybe someone is smart enough, to integrate Dump Function for Dump whole RAM or moviNAND... like JTAG
See Upload function...
Best Regards
Click to expand...
Click to collapse
I think that Samsung have thought of that already. I had not analysed that as so far, but there's UPLOAD option in the bootloader (handled by a bit separate code from DLOAD). I haven't got the wave, so I never tested it.
You can make a patch on my mod and place a direct jump to that code. I've made a quick patch so you can try it out. I don't know whether there's any software that can handle that mode. I've made a look and there are several funny commands that can be used:
"PrEaMbLe"
"AcKnOwLeDgMeNt"
"PoStAmBlE"
"PoWeRdOwN"
"DaTaXfEr"
Remember that this time we're dealing with some real functionality of the bootloader and that may have some consequences so use on your own risk.
Best Regards,
mijoma
----------------------
Edit: Sorry if anyone tried loading it. By mistake I've used addressing from XXJEE. I've changed the name to represent what it was and added a correct file for XXJL2 bootloader

Upload to PC is in combination with Debug Mode higher then Low...
After you see Bluescreen with very interesting infos you can press Button, then Upload to PC on Screen. But I don't know how to catch Data, as no COM Port is visible.
Btw...
Now I know where I made big mistake.
First tests I used XEKC2 Firmware with XXJL2 Bootloader, as I thought its only Bootloader related. Sorry.
My fault.
So there must be more then Bootloader from XXJL2 in handset, to run successfully FOTA Mod2.
About new Mod with Upload, I will investigate this time better, before I'll report.
Thank you.
Best Regards

We need to get this guy a wave to test stuff on! Who wants to donate theirs ha

sabianadmin said:
We need to get this guy a wave to test stuff on! Who wants to donate theirs ha
Click to expand...
Click to collapse
It may have sounded like a joke, but I second that....
He's seems trustworthy and very capable of being sucessful Just like adfree, oleg_k and other guys over there.

I have my paypal account limited but in 1 month I'll b able to donate maybe 20€

Thanks guys, but I don't think it's necessary.
I do it for fun - don't need any other gratification. Wave got me interested with the effort the manufacturer put trying to keep it closed. I don't need a handset to disassemble the bootloader.

The question is more would you like a wave for you're efforts as otherwise you really won't be able to benefit from you're own work when we have meego, android, webOS etc booting on the Wave. Theres no extra pressure, sure you have already done the trickiest part of the work.

No, I'm being completely honest here. I find this rather a weird form of relax than work.
Wave is a nice phone and I think I'm going to get myself one, but I don't expect a gift.

mijoma said:
Wave is a nice phone and I think I'm going to get myself one, but I don't expect a gift.
Click to expand...
Click to collapse
You are a champ, buddy
Good luck !
Sent from my GT-I9003 using XDA App

[Q] Boot loader after every phone start, can´t run phone

Hi, I have a problem with my defy and I really short to deal with that. First my defy stopped on red M logo and done proceed to system start. So I go to service menu, set clear cache- cache were cleared for 30mins so I take out batery, then I set - format/factory reset. same problem, it goes without end so after batery goes off, I make McGiver style for bring pnone to life and go to boot loader, run firmware flash over RSD lite and wait......after that RSD give me this message - Phone [0000] Error verifiing code group 33 Checksums. File:0x8BAC,Phone:0x4805 . RSD do nothing, on phone were instaling. after our when I suppose this is and I take out batery from phone and try run it. Every time start boot loader with message :
Code Corrupt
Battery OK
OK to Program
Conect USB
Data Cable
I cant launch android recovery, and If i flashed firmware again a have the same and. Can you please somebody help me with that??
Thanks,
ps. sorry for my english I think is not perfect

new thing, new error mesage from RSD. he pass Checksums errors, than give me message - restarting device ( that is not happend, device were still on), afted while there is new message : Failed flashing proces. Failed plashing proces. phone [0000] Error geting subscriber unit checksum. Device API error: 0xe003003F Command : (RQRCS 0xe403203f); phone conected
result FAIL
I am really desperate.. anyone have experience with this??
Thanks for any advice.
NoDi

As I see probably nobody had this issue like I had. Tomorrow I try bring phone to seller (Vodafone), and than I have to pray for reflashing it from them. Anywhere I will post result from them after I get some, If somebody have the same problem in future like I had.
NoDi

Difrent SFB
try usuing difrent sfb f.
have similar problem at some time...
just try using another sfb and do factory reset each time

yea.. some sbf have higher or lower on img version which might prevent your phone from fully flashed.

I tried various different FW from here. Everytime the same results. Today I was bring phone to Vodafone, I wonder on verdict

you said you tried all firmware versions, can you try diffrent RSD Lite version, may be RSD lite having problem. I am using " RSD Lite 4.9.msi ".

so phone is back. In report from service were Changed bad SWAP module. In used parts were 1pcs of RF board. Anyway I brought phone back to Vodafone because he cant sign in other than 3G network, and many places in our country are sill only 2G.

Lost IMEI after flashing stock ROM

I know that many people are having this problem and I hope we can find a solution here together.
I've already tried many things to restore my IMEI, a little background:
- Lost my IMEI when I flashed stock rom to unroot the phone.
- Tried flashing different firmwares (LATAM, RETBR, I think they are the same).
- I don't have an EFS Backup.
When I dial *#06#* my IMEI is shown as "0", when I use "mfastboot getvar all" or "mfastboot getvar imei" I can still see my correct IMEI (as shown on the phone box).
On CQATest the only error that I can see is right on the IMEI tab:
Phone ICCID Compare with SIM ICCID: ERROR
Anyone can suggest something that might correct this problem? I don't think anything could make it worse and I'm willing to try everything...
EDIT: Obviously, I can't connect to my mobile network.

This is why I didn't even unlock mine so far.seems many have had this issue

I've seen some people saying that this can occur after flashing fsg and modem plus erasing modemst1 and modemst2.
If I knew that before I could have flashed the stock rom without touching on this images, I don't think it would make any difference.

rfameli said:
I've seen some people saying that this can occur after flashing fsg and modem plus erasing modemst1 and modemst2.
If I knew that before I could have flashed the stock rom without touching on this images, I don't think it would make any difference.
Click to expand...
Click to collapse
From my past moto experience always avoid flashing bootloaders & modems, system files can be flashed without any issues in most circumstances. The only change would be if there's a major update that requires bootloaders and modem images.
As a rule, wait before flashing firmware on a moto phone, I've witnessed people hard bricking their devices flashing bootloaders, downgrading from a updated bootloader is playing with fire in my past experience.
Sent from my XT1635-02 using XDA-Developers Legacy app

flashallthetime said:
From my past moto experience always avoid flashing bootloaders & modems, system files can be flashed without any issues in most circumstances. The only change would be if there's a major update that requires bootloaders and modem images.
As a rule, wait before flashing firmware on a moto phone, I've witnessed people hard bricking their devices flashing bootloaders, downgrading from a updated bootloader is playing with fire in my past experience.
Sent from my XT1635-02 using XDA-Developers Legacy app
Click to expand...
Click to collapse
I've flashed the entire room including the bootloader and modems more than a hundred times (no joke here) trying to fix my problem, only to realize I had lost my IMEI.
What make me think that I can still recover my lost IMEI is that on the fastboot if I write "mfastboot getvar imei" it's still there with the same number that came on the box.

rfameli said:
I've flashed the entire room including the bootloader and modems more than a hundred times (no joke here) trying to fix my problem, only to realize I had lost my IMEI.
What make me think that I can still recover my lost IMEI is that on the fastboot if I write "mfastboot getvar imei" it's still there with the same number that came on the box.
Click to expand...
Click to collapse
Obviously something went wrong, my past experience with flashing the full firmware package you are playing with fire.
Sent from my XT1635-02 using XDA-Developers Legacy app

Did you fix it?

IMEI 0
My phone also stucked at imei 0, wat to do is there any solution

Solution for IMEI 0 caused by broken efs partition is easy: Restore your backup of efs partition.
For the case not the efs partition is damaged but the reading process does not get the efs contents right, do a backup of current efs before any further action if there is any small chance the contents is not damaged.
If you don't have a backup of efs and it is still empty/broken after flashing a standard stock rom, you can contact Lenovo for help. May get expensive, they usually replace the mainboard. They should have the possibility to generate a new key for the efs partition, but my guess is that they are afraid doing so may harm security of that key. It probably is cheaper to replace the mainboard than buying a new device, but not by much. You may consider using the device with IMEI 0 as mediaplayer/small tablet without mobile functionality, and buy a new one.
Are you aware of any change you did to the efs partition?

My imei is 0 but still i can connect to mobile data. Hmmm i dont know what is happening here

Same problem here!
Any solution?

I think without the EFS Backup the only way to restore is send to authorized assitance to change the mother board. Sorry for bad news

I have been doing some research lately and discovered some interesting things that may help you in a way or another, the imei value state is written at efs partition, value which can be located from RV_NV_Manager tool (this one is part from QPST suite from Qualcomm), since this tool is known for having the IMEI changing property, i can't post the link, but Google maybe is a good place to start looking for it.
Here are the steps you can do to recover your imei:
-Write down your imei.
-Start some computer with internet, using windows.
-Find, download and install QPST and Qualcomm HS-USB Drivers.
-Once installed, you must turn off your phone and restart it in the bootloader
-Select QCOM tab and select, then wait until it boots completely, then plug your phone at your computer, some drivers must be starting to install, let it finish (it isn't necessary to reboot after this).
-Open QPST Configuration and go to Ports > Add new port...
-Open Device Manager and look for Qualcomm COM ports connected, then in QPST Ports screen write the COMXX in both fields and close, you should see a connected unknown phone and some ? At some fields, that's just normal.
-Open RV_NV_Manager without closing QPST Configuration, some downloading bar should appear with a screen, just let it finish, and then head down to line number 5xx, it says some IMEI_NV or something like that, if you press 9 text fields in boxes should appear at right hand, select hex values at some checkbox there.
-Look to where you written the imei and now it's the tricky part:
Your imei looks like 874356324678338 (just an example), then you must split them by pairs in this way:
x8 | 74 | 35 | 63 | 24 | 67 | 83 | 38 (since imei has 15 numbers, the first one will go alone with an unknown value)
Then just switch numbers by pairs:
8x | 47 | 53 | 36 | 42 | 76 | 38 | 83
Then start filling the boxes in this way:
1st.- 8 (always)
Then put the numbers in pairs in order and replace the 'x' with an 'a':
2nd.- 8a
3rd.- 47
4th.- 53
And so on...
I hope this can help you, let me know if you recover your imei.

xaskasdf said:
I have been doing some research lately and discovered some interesting things that may help you in a way or another, the imei value state is written at efs partition, value which can be located from RV_NV_Manager tool (this one is part from QPST suite from Qualcomm), since this tool is known for having the IMEI changing property, i can't post the link, but Google maybe is a good place to start looking for it.
Here are the steps you can do to recover your imei:
-Write down your imei.
-Start some computer with internet, using windows.
-Find, download and install QPST and Qualcomm HS-USB Drivers.
-Once installed, you must turn off your phone and restart it in the bootloader
-Select QCOM tab and select, then wait until it boots completely, then plug your phone at your computer, some drivers must be starting to install, let it finish (it isn't necessary to reboot after this).
-Open QPST Configuration and go to Ports > Add new port...
-Open Device Manager and look for Qualcomm COM ports connected, then in QPST Ports screen write the COMXX in both fields and close, you should see a connected unknown phone and some ? At some fields, that's just normal.
-Open RV_NV_Manager without closing QPST Configuration, some downloading bar should appear with a screen, just let it finish, and then head down to line number 5xx, it says some IMEI_NV or something like that, if you press 9 text fields in boxes should appear at right hand, select hex values at some checkbox there.
-Look to where you written the imei and now it's the tricky part:
Your imei looks like 874356324678338 (just an example), then you must split them by pairs in this way:
x8 | 74 | 35 | 63 | 24 | 67 | 83 | 38 (since imei has 15 numbers, the first one will go alone with an unknown value)
Then just switch numbers by pairs:
8x | 47 | 53 | 36 | 42 | 76 | 38 | 83
Then start filling the boxes in this way:
1st.- 8 (always)
Then put the numbers in pairs in order and replace the 'x' with an 'a':
2nd.- 8a
3rd.- 47
4th.- 53
And so on...
I hope this can help you, let me know if you recover your imei.
Click to expand...
Click to collapse
I have only RF NV [Items only] and COM3 and COM 5 is connected. I select port 5 and read all items but I can't find NV_IMEI only under "read supported RF NV Items" at Number 550 is a NV_UE_IMEI_I ... but is this the right?
Have Moto Z

Another hard brick ?

So i got one of these vs985s. and nothing. screen lit up but nothing else.
so i had a unknown or damaged usb device .long story short
got it in 9008 i follow all the guides emmc and ap test past.
but when i to the sd ram test i get a error of
========DDR TEST START
Test level = 0(check data/address line)
sbl1 partition write FAIL.. senctor 0x28000
WRITE FAIL During ddr test..
Aborted..........
Also everytime i click a restore boot image in any version of board diag tool whatever partition im trying to restore write fails....
Now i remeber back on my g2 i got the 9006 mode i was able to zero all the partitions in linux when it mounted 30 somthin drives.
Is there any info any one could give me as i have followed all the guides.. But might be missing something somewhere.
any help is greatly appreiciated

I have the exact same problem here with my father in law's D852. The phone was never rooted. I was trying to unbrick it but it didn't reboot after flashing sbl1. So I decided to try a stock rom form another source and that's when this happened. Trying to go back to the first rom didn't work, even after erasing the entire emmc. My guess is somehow, we activated permanent paper weight mode. I hope someone more qualified than us can help us, or at least confirm our phones are good for recycling...

Need back modem or partition help me

GOOD MORNING GOOD AFTERNOON GOOD NIGHT
I NEED SOMEONE TO TAKE ME BACKUP OF MODEM
AFTER FLOATING XPOSED IN THE OREO
MY DEVICE GAVE LOOP AND BLOCKED THE FRP
SO I GOT FLASHEAR ROM WITH DC PHOENIX PQ MY FRP TAVA LOCKED
WHEN MY DEVICE WENT BACK I HAD TO RECORD THE THINGS VIA HCU
(IMEI, SN, PCB SN, COUTRY, VENDOR)
THIS SN PCB MAKES AN IDEA OF WHAT IT WAS
I'M NOT GETTING ANYWHERE ...
MY APPLIANCE HAS RETURNED JA PASSED VARIOUS ROMS BUT IT DOES NOT REGISTER NETWORK
IN TRUTH HE REGISTERS VERY RARELY AND FOR A LITTLE TIME
In HCU IT DID ERASE ANY PART OF THE PROCESS ....
60 EUROS PURCHASING CREDITS IN THE APPLICATION
I BELIEVE THAT I CORRUPTED ANY FOLDER RELATED TO MODEM IMEI ETC ....
DC PHOENIX HAS 2 OPTIONS MARKED
RELATED TO DELETE THE OEM AND OTHER NV
I BELIEVE I TURNED OFF THE MODEM PARTITION
IF SOME CAN GIVE A STRENGTH
THANK YOU

nvram folder is empty twooo....did u try to flash system again?

Yes
Yes several times I believe that only with a physical box, I would like to try to restore this folder to see

Filipehuawei said:
Yes several times I believe that only with a physical box, I would like to try to restore this folder to see
Click to expand...
Click to collapse
this folder is empty bro... i tried to see what's contain try to know what u really need in order that i can help you

Thank you
Thank you for your willingness.
I need the particao that makes the communication between modem and imei
Everything related to this
My phone does not pick up a signal after what happened