For investigation I'm searching for oldest Firmware...
At the moment I found "only".
S8500XXJB6.rar
Differences:
1.
Few adresses not same in Multiloader
2.
Not running on my handset... accept amss.bin
3.
TriX can't extract anything...
PSAS can't decrypt apps_compressed.bin
4.
Bootloader different
Best Regards
older firmware, like S8500XXJB6 is a bit different (is much closer in structure to S8000)
ad. 2, i assume you have newer bootloader in phone (it won't accept older one)
ad. 3, shp, csc file signature is a bit different (will be fixed soon). FS file is just fat16 image (TriX support fat images via FATe plugin, i have no idea fat images was used before, i will add FATe plugin in next build)
ad. 4, if someone still has that firmware in phone is very luky guy. I can bet with jet android port can be ported to it with any problem - JB6 bootloader is not crypted.
5.
Rsrc2_S8500(Low).rc2 works also in JI5 for instance...
Different Boot Pics... maybe this helps to identify location of each Pic.
Battery...
Samsung Logo...
.
.
.
Maybe we find out, which Format... maybe also QMG.
Best Regards
you can already extract rc2 files
use the same program that is used for older samsungs
this one if I'm not wrong
http://code.google.com/p/samsung-firmware-tools/
I've used Tool WinImage for extraction of *.FFS... renamed into *.img
Usefull also for FFS of other bada handsets like:
S5250
S5330
S5750
S7230
In CSC of S8500XXJB6 I navigate via 005C00 to see where folder/file is.
Best Regards
Still problem.
That I can't bypass Bootloader Security...
Not with Multiloader nor with JTAG...
My knowledge how Boot is correct written + activated... = 0
I saw some other Firmware from other models... it seems IMRC is still used...
Maybe someone found Algo or Tool to decode RC1.
Thanx.
Best Regards
Blub...
XXJB6 unfinished mission...
2 new Firmware good for research.
XXJEB as bada 1.x Firmware... nearly all Certs removeable...
Only Integrity check for *.so files left.
For bada 2.x
XPKG5 very interesting...
Only bad, I can't find where these 2 last Certs are stored?
Code:
SamsungSBRootCA.cer
Samsung_RootCA.crt
Best Regards
New attempt with JTAG... but again failed... :crying:
Magic is now CMM Script...
BUT I have only ELF from XXJEB...
Maybe this is the reason why Multiloader not flash XXJB6 Bootloader...
Now I could learn more about CMM...
To flash correct file to correct address...
Or maybe way to extract RC1 ... because old IMRC Algo...
Not sure if maybe broken for other Samsung handsets...
Best REgards
Hmm, I can see S8000 Jet use for RC1 also IMRC...
Maybe possible to flash RC1 XXJB6 to S8000, then copy content from handset...
Best Regards
Please help.
I am searching for friendly S8000 Jet User.
Can someone confirm working Command:
Code:
FmSecureMode off
And I wish content of S8000 folder System please.
See here what I mean:
http://forum.xda-developers.com/showpost.php?p=12436452&postcount=1
Thanx in advance.
Best Regards
http://forum.xda-developers.com/showpost.php?p=34508619&postcount=132
Now I have own S8000 Jet...
First try to flash RC1 from XXJB6 fail...
NAK_invalid_len
Need more knowledge about S8000...
Best Regards
Edit 1.
Maybe no chance... I have forgotten to check size...
Rsrc_S8000_Open_Benelux_OCE.rc1 is 80 MB
Rsrc_S8500_Open_Europe_Common.rc1 is 100 MB
Maybe S8000 not reserved 100 MB for RC1... :crying:
Edit 2.
I have removed 20 MB...
S8000 Jet start with reduced XXJB6 RC1
Now I copy System folder...
Maybe few files corrupted and over 20 MB missing...
But better then nothing. :victory:
http://forum.xda-developers.com/showpost.php?p=34518982&postcount=34
Okay, second attempt successfully read few files from XXJB2 RC1...
And I found limit for RC1 in S8000...
Code:
> FLASH_RSRC1_SIZE : [B]0X04B00000[/B]
> FLASH_RSRC1_START_ADDR : 0X03700000
> FLASH_RSRC1_END_ADDR : 0X08200000
So ""80 MB"" ...
Will check older Firmware, maybe more place in other Versions reserved...
Best Regards
http://www.mediafire.com/?um7dr5ufti7h0dx
Here is folder with RBMs from XXJB6.
Also not all are visible with Wave_Remaker...
Few are funny and interessting...
Later I will upload more... but again.
During small reservation of S8000 I was only able to flash 75 MB of 100 MB from RC1.
Maybe also few files are corrupt... Not checked all.
Best Regards
I'm trying to collect few other Firmware from other Samsung devices...
U700 IMRC seems other algo maybe...
Bluescreen ... on S8000
FmMountVolume
Fm_FS_LFS
FM_PARTITION_LFS_C
Next try is M8910 RC1...
Btw. I have forgotten XXJC5 is also IMRC and bigger then XXJB6...
Later more...
Best Regards
Edit 1.
M8910 RC1 without problems work on S8000...
Remember only end.bin last 1024 Byte have to be modified for correct addresses...
Edit 2.
S5620 RC1 tested...
It seems more compatible then U700 RC1 but also loop...
Maybe if I can disable Animation Power ON then chance to check next Error...
New Year... New attempt
Bootfiles Mixed with XXJEB...
boot_loader.mbn from XXJEB
dbl.mbn from XXJB6
Multiloader can flash this combination and it seems XXJEB then work...
I hope if I manage to understand how to use Binary instead ELF in CMM Script, then maybe I am 1 day able to flash Boot from XXJB6...
Best Regards
IMRC related... there are more Samsung devices with IMRC compressed RC1...
Code:
RC1(IMRC) compatible size
S8000 x 75/80
S8500 XXJB6 x 100+
M8910 x 75/?
S5620 -
U700 -
F480 -
S5510 -
S7350 -
G800
U900
I am not sure if different IMRC Versions... because mandatory few RBM files needed in System folder...
Best Regards
Edit 1.
Sometimes I can see Power ONOFF Animation...
Edit 2.
It seems IMRC different Versions... see first 8 Byte...
F480 for instance compared with S8500...
I think at 0x14 4 Bytes for DEcompressed size stored... Little Endian
yes, the header is different.
index - also. but it is clear.
the compression algorithm - still a mystery
PHP:
//magick //always1 //index_type //size??? //count //array of tail size or offset
G80LXEIE1 0x43524D49 0x00001000 0x0000000B 0x00000006 0x02464A38 0x00002466 0x00000000 0x00000338 0x000004A0 0x000007C8 0x00000924 0x00000BA4 0x00000CFC 0x00000F94 0x000010E4
U70BXEIF1 0x43524D49 0x00001000 0x0000000B 0x00000006 0x01E5BB48 0x00001E5D 0x00000000 0x00000338 0x00000498 0x00000774 0x000008B8 0x00000BC4 0x00000D28 0x00000EF8 0x00001028
F480XEHE1 0x43524D49 0x00001000 0x0000000C 0x00000006 0x01A55024 0x00001A56 0x00000170 0x0000030F 0x0000013A 0x000002F6 0x00000147 0x000002B6 0x000000E4 0x00000295 0x00000144
F48FXEID1 0x43524D49 0x00001000 0x0000000C 0x00000006 0x01EF4A6C 0x00001EF5 0x0000016C 0x000002E7 0x0000014B 0x00000335 0x0000012D 0x000002A1 0x000000E0 0x00000277 0x0000013F
S5510XEIJ1 0x43524D49 0x02000400 0x00001000 0x0000000C 0x00000006 0x01CC581C 0x00001CC6 0x00000165 0x00000358 0x000000AE 0x00000277 0x000000BD 0x00000284 0x0000015D 0x00000327 0x000000EC
S735EXEII2 0x43524D49 0x02000400 0x00001000 0x0000000C 0x00000006 0x02A74E80 0x00002A75 0x00000147 0x0000033A 0x000000D4 0x000002A0 0x000000B5 0x0000027E 0x00000125 0x00000315 0x00000111
S8500XXJB6 0x43524D49 0x02000400 0x00001000 0x0000000C 0x00000006 0x09BF64A0 0x00009BF7 0x00000141 0x000002DC 0x00000116 0x00000280 0x0000014B 0x000002FB 0x00000155 0x000002D4 0x00000124
U90UXEIE3 0x43524D49 0x00001000 0x0000000C 0x00000006 0x032BAF08 0x000032BB 0x00000168 0x0000030B 0x0000012F 0x000002C3 0x0000013F 0x000002D0 0x00000103 0x00000272 0x000000D0
I don't understand if RC1 is decompressed by Bootloader or by apps_compressed.bin...
QMD in Header is in later Firmware from S8500...
Short tested...
I can change this in RC1...
QAB
S8500 starts normal...
If I try to change all 3 letters... then short Bluescreen... But I can't see Error message fast enough... maybe later...
I have changed into 123 instead QMD...
Will check again... Maybe I can capture Bluescreen...
Video or something else...
Later I will try this with S800 and IMRC textstring...
I want to identify if Boot or apps_c task to decompress RC1...
Best Regards
Edit 1.
I hope Pic is readable... Tested with Debug Level high and on XXJEB S8500...
Looks like something like this...
Code:
QuramMduceRFlashInitM((void*)pFotaRsrcCompHeader[QURAM_RSRC_BIN_TYPE_LFS]
Found in apps_compressed.bin...
Hmmmmmmmmmmmm. In theory it seems I don't need Bootloader from XXJB6...
BUT... damn apps_compressed.bin is also secured by something ugly...
Last 1024 Byte... aka end.bin...
Anyway... will now check again IMRC Header in S8000...
Maybe here also possible to force Bluescreen in Debug Level High...
Best Regards
If I destroy IMRC Header on S8000... XPJA1... Debug Mid...
Later I will try to catch all 5 Bluescreens..
Here 1/5...
Best Regards
Code:
RC1(IMRC) compatible size
S8000 x 75/80
S8500 XXJB6 x 100+
M8910 x 75/?
S5620 -
U700 -
F480 -
S5510 -
S7350 -
G800 -
U900
S5600 -
B5310 -
Found few more devices...
It seems - not ever means incompatible... I can see sometimes Power ONOFF Animation... smaller Resolution then 480 x 800... So maybe reason is smaller *.rbm files force to Reboot... Will check "later" with Debug Mid...
Best Regards
Hi all
problem after flash with S8500XXJL2 bada 1.2
S/W version: S8500+AG+JF1
Modem: Q6270B-KPRBL-1.5.45T
SHP: VPP R5 2.1.1
Build Host: SCMHP05
Built At: 2010/06/01 20:39
App debug level:1
ASSERTION ON_ASSERT: 0 failed (File OemBootMgr.c, line 4251)
webkit Cheksum: cheksum failed !!!
Please Flash FFS if browse build is done
<Calla stack information>
PC= 4010B12F OemDumpRegister
LR= 4010B133 OemDumpRegister
<Mocha Task Call Stack>
_SysAssertReport
OemBmLpmLazyl ni tMochaTask
__WmEventHandl er Proc
__WmProcessEventInternal
WmMai nLoop
MochaTask
TCC_Task_Shell
Black screen
-------------------------------------------
UPLOAD data to pc
-------------------------------------------
We want to reflash and connection failed with Multiloader.
Thank s for your response.
Hello.
I'm not sure.
You tried Original JL2 or modified one?
As normal JL2 not show debug modes...
Best Regards
This nv_default.ini is taken from bada SDK... S8500.
Several interesting informations...
If you search for menu for example:
NV_SI_SCREEN_MENU_STYLE=3
NV_SI_SCREEN_MENU_ICON_TYPE=1
NV_SI_MAIN_MENU_BLOCK_COUNT=12
NV_SI_MAIN_MENU_BLOCK_01=37
NV_SI_MAIN_MENU_BLOCK_02=36
NV_SI_MAIN_MENU_BLOCK_03=20
NV_SI_MAIN_MENU_BLOCK_04=17
NV_SI_MAIN_MENU_BLOCK_05=33
NV_SI_MAIN_MENU_BLOCK_06=14
NV_SI_MAIN_MENU_BLOCK_07=6
NV_SI_MAIN_MENU_BLOCK_08=18
NV_SI_MAIN_MENU_BLOCK_09=65
NV_SI_MAIN_MENU_BLOCK_10=38
NV_SI_MAIN_MENU_BLOCK_11=13
NV_SI_MAIN_MENU_BLOCK_12=16
NV_SI_MAIN_MENU_WHEEL_01=37
NV_SI_MAIN_MENU_WHEEL_02=36
NV_SI_MAIN_MENU_WHEEL_03=20
NV_SI_MAIN_MENU_WHEEL_04=17
NV_SI_MAIN_MENU_WHEEL_05=33
NV_SI_MAIN_MENU_WHEEL_06=14
NV_SI_MAIN_MENU_WHEEL_07=6
NV_SI_MAIN_MENU_WHEEL_08=18
NV_SI_MAIN_MENU_WHEEL_09=65
NV_SI_MAIN_MENU_WHEEL_10=13
NV_SI_MAIN_MENU_WHEEL_11=38
NV_SI_MAIN_MENU_WHEEL_12=16
NV_SI_MENU_ENABLE_MAIN_MENU_STYLE=1
NV_SI_OPTION_MENU_ID_1=2
But there are more infos. Maybe changeable.
Please help for investigation.
Thanx in advance.
Best Regards
Not realized before, that in bada 2 in NV folder:
Code:
nv_psh.[B]map[/B]
nv_system.[B]map[/B]
Which contains such things...
Code:
NV_IMEI_TRACKER_DEST_NUM1
NV_IMEI_TRACKER_DEST_NUM2
Best Regards
Example Product Code...
Reading:
Code:
[B]NvGetStr[/B] NV_SI_PRODUCT_CODE_I
Writing:
Code:
[B]NvWriteStr[/B] NV_SI_PRODUCT_CODE_I GT-S8500BAADBT
Then NV item 10071 is changed...
Now its few years too late,
but for study...
No need to change in Qualcomm Mode...
Best Regards
Edit 1.
Code:
NvGetStr NV_SI_PHONELOCK_PASSWD
Edit 2.
Code:
NvGetStr NV_SI_UAGENT
These apps will help you dump a csc and make your own csc image!
1.convert Samsung org csc(Ra000FF) or CSC.D000FF to real csc file.
cmdline: CSCConverter.exe -d i917ATTJK2.csc.Ra000FF i917ATTJK2.csc
CSCConverter.exe -d CSC.D000FF CSC.csc
PS: if you dumped a CSC.D000FF file, app will show you CSC Max Block Count, remember this, we will use it!
2.dump csc file and have a csc script file.
cmdline: CSCBuilder.exe -d i917ATTJK2.csc i917ATTJK2.txt
3.edit files and script file, then build a new csc file.
cmdline: CSCBuilder.exe -b i917ATTJK2_new.csc i917ATTJK2.txt
4.convert csc file to D000FF.
cmdline: CSCConverter.exe -b i917ATTJK2.csc CSC_new.D000FF 42
PS: 42 is i917 CSC Partition Max Block Count, I think it's same as i8700.
5.have fun with custom csc!
PS:
UAInput.000 in CSC is like a copy file script.you can use CSCPackage.cab.pkg to do this, but make sure cab signed cert is in your custom rom.
samsung WP7 device first boot:
1.copy CSCPackage.cab.pkg to \OSRoot\UpdateBin\CSCPackage.cab.pkg.
2.run SLDR to update CSCPackage.cab.pkg to Rom.
3.boot.
USAGE:
CSCConverter -d <CSC.D000FF/CSC.Ra000FF> <CSC File>
CSCConverter -b <CSC File> <CSC.D000FF> <Max Block Count>
CSCConverter -br <CSC File> <CSC.Ra000FF> <Max Block Count> (*not completed!)
CSCBuilder -d <CSC File> <CSC Script>
CSCBuilder -b <CSC File> <CSC Script>
Best Regards
Ego Zheng
2012/02/11
thanks
4.convert csc file to D000FF.
cmdline: CSCBuilder.exe -b i917ATTJK2.csc CSC_new.D000FF 42
PS: 42 is i917 CSC Partition Max Block Count, I think it's same as i8700.
on omnia7 its the same "42"
thanks for the app's real cool
Edit:
4.convert csc file to D000FF.
cmdline: CSCConverter.exe -b i917ATTJK2.csc CSC_new.D000FF 42
PS: 42 is i917 CSC Partition Max Block Count, I think it's same as i8700.
your text was/wrong
thank you very much
Fantastic~~This reminds me of my research of Nexus S's CSC carrier info modification~
And you are Ego? I didn't recognize you yesterday in my thread...since your ID is different from DFT Forum~~sorry for that...
Good work!
GREAT! I think this is just what I wanted! If I am correct in my assumption, using CSC we can debrand our phone and make custom registry edits like interop-unlock and enable ICS without needing to build/flash a whole ROM, right?
EDIT: So I made a CSC to debrand the ATT Focus and stop the 'Now' xap from being pinned but... after sucessfully flashing it to the phone and hard-resetting nothing changed. So I guess that means the only way to apply is to build it into the ROM or send the update cab which also means you have to rebuild the ROM with your own cert...
new source file upload from Samsung (with new KERNEL and old PLATFORM) :
(2012/04) GT-I9000_Opensource_GB_Update2.zip (130 448 844 bytes)
list of previously released source files from Samsung:
(2011/09) GalaxyS_OpenSource_GB_Update2.zip (137 626 058 bytes)
(2011/06) GT-I9000_OpenSource_GB_Update.tar.gz (130 834 699 bytes)
(2011/04) GT-I9000_OpenSource_GB.zip (131 262 550 bytes)
Maybe the value pack source?
platform file is old
kernel file is new
comparing to previously released sources, we can see this is newer version with some fixes, like here:
Code:
diff -r GT-I9000_Kernel-old/drivers/gpu/pvr/pvrversion.h GT-I9000_Kernel-new/drivers/gpu/pvr/pvrversion.h
33,34c33,34
< #define PVRVERSION_BUILD 3947
< #define PVRVERSION_STRING "1.6.16.3947"
---
> #define PVRVERSION_BUILD 4131
> #define PVRVERSION_STRING "1.6.16.4131"
but difference is not big - 54 files updated, 2 new folders:
1) wifi driver sources (it was not included in previous kernel samsung release)
/drivers/net/wireless/bcm4329/src/
2) FSR (tfsr) driver source (previous kernel have only empty /driver/fsr folder)
/drivers/tfsr
list of updated 54 files
Code:
/arch/arm/configs/aries_eur_defconfig
/arch/arm/configs/aries_jpn_defconfig
/arch/arm/mach-s5pv210/mach-aries.c
/drivers/bluetooth/bthid/bthid.c
/drivers/gpu/pvr/bridged_pvr_bridge.c
/drivers/gpu/pvr/dbgdrv/hostfunc.c
/drivers/gpu/pvr/dbgdrv/main.c
/drivers/gpu/pvr/device.h
/drivers/gpu/pvr/hash.c
/drivers/gpu/pvr/Kconfig
/drivers/gpu/pvr/Makefile
/drivers/gpu/pvr/mem_debug.c
/drivers/gpu/pvr/mutils.h
/drivers/gpu/pvr/osfunc.c
/drivers/gpu/pvr/osfunc.h
/drivers/gpu/pvr/power.c
/drivers/gpu/pvr/pvrsrv.c
/drivers/gpu/pvr/pvrversion.h
/drivers/gpu/pvr/queue.c
/drivers/gpu/pvr/s3c_bc/s3c_bc.c
/drivers/gpu/pvr/s3c_bc/s3c_bc.h
/drivers/gpu/pvr/s3c_bc/s3c_bc_linux.c
/drivers/gpu/pvr/s3c_bc/s3c_bc_linux.h
/drivers/gpu/pvr/s3c_bc/s3c_bc_params.h
/drivers/gpu/pvr/s3c_lcd/s3c_displayclass.c
/drivers/gpu/pvr/s5pc110/sysconfig.c
/drivers/gpu/pvr/servicesext.h
/drivers/gpu/pvr/sgx/bridged_sgx_bridge.c
/drivers/gpu/pvr/sgxerrata.h
/drivers/gpu/pvr/sgxinfo.h
/drivers/gpu/pvr/sgx/sgxconfig.h
/drivers/gpu/pvr/sgx/sgxinit.c
/drivers/gpu/pvr/sgx/sgxpower.c
/drivers/gpu/pvr/sgx/sgxreset.c
/drivers/gpu/pvr/sgx/sgxtransfer.c
/drivers/gpu/pvr/sgx/sgxutils.c
/drivers/gpu/pvr/sgx/sgxutils.h
/drivers/gpu/pvr/syscommon.h
/drivers/input/touchscreen/qt602240.h
/drivers/Kconfig
/drivers/Makefile
/drivers/media/video/samsung/jpeg_v2/Kconfig
/drivers/media/video/samsung/mfc50/mfc_interface.h
/drivers/media/video/samsung/mfc50/mfc_memory.h
/drivers/misc/Kconfig
/drivers/net/wireless/Makefile
/drivers/rtc/rtc-s3c.c
/drivers/usb/gadget/s3c_udc_otg_xfer_dma.c
/drivers/usb/gadget/u_ether.c
/fs/Kconfig
/fs/Makefile
/fs/proc/base.c
/Makefile
/sound/s5p-rp/s5p-rp.c
Look at the diff from /arch/arm/mach-s5pv210/mach-aries.c and you'll see where the "new" memory is taken from
here i asked for them
Code:
[SAMSUNG OSRC COMMENTS DELIVERY NOTIFICATION]
Dear Customer,
We are pleased to provide you the source code of GT-I9000.
You can download the source code from the site below:
https://opensource.samsung.com (GT-I9000_Opensource_GB_Update2.zip)
Thank you.
Sincerely yours,
You may find the source code
what was your request about? release newer kernel sources or something more specific?