Develop Bugs

[DEVs ONLY] Flash Galaxy S without computer : introducing redbend_ua

Hello there
This is a surprise, but software able to flash the phone without any computer intervention was already on it, since the beginning.
Searching for a way to install my future lag fix easily, I remember that there was an "OTA" boot mode.
I know, today nobody saw an OTA on any Galaxy S smartpone (except maybe One on the AT&T Captivate?), but the software is still there.
How does this work :
Basically Linux boots a ramdisk, loading kernel modules and running an init process who start the whole Android experience (bootmode=) or just the recovery mode (bootmode=2).
Other bootmodes are used for battery loading only and Over The Air updates.
In this case, init.rc ask init to start "/sbin/redbend_ua all".
By default this software search for software updates in /data/fota and on similar places in the /sdcard.
It could prove useful another day, but you still have to be root to ask your device to reboot in a specific bootmode
The nice part is that we can use redbend_ua manually too, to do many impossible things before :
command list, pretty comprehensive.
Code:
img [partition name] [delta file] [device node] [temp path]
fs [partition name] [delta file] [mount point] [temp path]
all
dump <source dev> <dest file>
restore <source file> <dest dev>
compare <dev1> <dev2>
png [png file name]
all
Possible usages :
- Flashing the kernel without Odin or any computer
- Backuping and Restoring a whole firmware, including stock one
- Doing more than one operation before automatic reboot through a list of commands in /data/fota/command (not tested yet)
- Messing with bootloaders and bricking your phone for good
Yeah, you must be really carefull this time. Samsung made some partitions read-only for a reason
Hopefully this new tool will be used by most ROM cooker, CyanogenMod, and ClockWorkMod
I'll make a update.zip + redbend_ua template soon if nobody comes up with one.
My Twitter for next news
Joined to this post : redbend_ua working binary. (some firmware ship a new binary that does not accept command line parameters)
-----
Old post, for the record :
Our Galaxy S in Eclair firmwares come with software able to provide update Over The Air.
This firmware is in /sbin directory, which means that it's in the kernel ramdisk.
Look at the output when running the binary without argument or appropriate file:
Code:
# redbend_ua
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
UA/(MakeBMLNodes): mknod path=/dev/block/bml4, dev_no=35076
UA/(MakeBMLNodes): mknod path=/dev/block/bml5, dev_no=35077
UA/(MakeBMLNodes): mknod path=/dev/block/bml7, dev_no=35079
UA/(MakeBMLNodes): mknod path=/dev/block/bml8, dev_no=35080
UA/(MakeBMLNodes): mknod path=/dev/block/bml11, dev_no=35083
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
UA/ check_existence: /data/fota/delta.Sbl
UA/(update_all): Check Delta : path_idx(0), part_idx(0), file_path((null)), cnt(0)
UA/ check_existence: /data/fota/delta.zImage
UA/(update_all): Check Delta : path_idx(0), part_idx(1), file_path((null)), cnt(0)
UA/ check_existence: /data/fota/delta.modem
UA/(update_all): Check Delta : path_idx(0), part_idx(2), file_path((null)), cnt(0)
UA/ check_existence: /data/fota/delta.platform
UA/(update_all): Check Delta : path_idx(0), part_idx(3), file_path((null)), cnt(0)
UA/ check_existence: /sdcard/Android/data/temp.fota.delta/delta.Sbl
UA/(update_all): Check Delta : path_idx(1), part_idx(0), file_path((null)), cnt(0)
UA/ check_existence: /sdcard/Android/data/temp.fota.delta/delta.zImage
UA/(update_all): Check Delta : path_idx(1), part_idx(1), file_path((null)), cnt(0)
UA/ check_existence: /sdcard/Android/data/temp.fota.delta/delta.modem
UA/(update_all): Check Delta : path_idx(1), part_idx(2), file_path((null)), cnt(0)
UA/ check_existence: /sdcard/Android/data/temp.fota.delta/delta.platform
UA/(update_all): Check Delta : path_idx(1), part_idx(3), file_path((null)), cnt(0)
fail!
Open /data/fota/fota.status
fsync after write: 0
And here is the result when you provide a fake zImage delta file:
Code:
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
UA/(MakeBMLNodes): mknod path=/dev/block/bml4, dev_no=35076
UA/(MakeBMLNodes): mknod path=/dev/block/bml5, dev_no=35077
UA/(MakeBMLNodes): mknod path=/dev/block/bml7, dev_no=35079
UA/(MakeBMLNodes): mknod path=/dev/block/bml8, dev_no=35080
UA/(MakeBMLNodes): mknod path=/dev/block/bml11, dev_no=35083
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
UA/ check_existence: /data/fota/delta.Sbl
UA/(update_all): Check Delta : path_idx(0), part_idx(0), file_path((null)), cnt(0)
UA/(update_all): Check Delta : path_idx(0), part_idx(1), file_path(/data/fota/delta.zImage), cnt(1)
UA/(update_all): Check Delta : path_idx(0), part_idx(1), file_path(/data/fota/delta.zImage), cnt(1)
UA/ check_existence: /data/fota/delta.modem
UA/(update_all): Check Delta : path_idx(0), part_idx(2), file_path((null)), cnt(1)
UA/ check_existence: /data/fota/delta.platform
UA/(update_all): Check Delta : path_idx(0), part_idx(3), file_path((null)), cnt(1)
page_msize: 4096, phy_unit_size: 262144
UA/ Sbl delta does NOT exist! Skip.
page_msize: 4096, phy_unit_size: 262144
UA/ check_existence: /data/fota/fota_zImage
page_msize: 4096, phy_unit_size: 262144
dev: /dev/block/bml8 partition size: 0x780000
40180008: ffff ffff ffff ffff ffff ffff ffff ffff ................
40180018: ffff ffff ffff ffff ffff ffff ffff ffff ................
40180028: ffff ffff ffff ffff ffff ffff ffff ffff ................
40180038: ffff ffff ffff ffff ffff ffff ffff ffff ................
signature: 0xffffffff
page_msize: 4096, phy_unit_size: 262144
common mark dev : /dev/block/bml8 partition size: 0x780000
0xffffffff
page_msize: 4096, phy_unit_size: 262144
page_msize: 4096, phy_unit_size: 262144
UA/(backup_devbml) src: /dev/block/bml7 partition size: 0x780000
UA/(backup_devbml) dst: /dev/block/bml8 partition size: 0x780000
UA/(backup_devbml) backup 128KB at 0x0
UA/(backup_devbml) backup 128KB at 0x40000
UA/(backup_devbml) backup 128KB at 0x80000
UA/(backup_devbml) backup 128KB at 0xc0000
UA/(backup_devbml) backup 128KB at 0x100000
UA/(backup_devbml) backup 128KB at 0x140000
UA/(backup_devbml) backup 128KB at 0x180000
UA/(backup_devbml) backup 128KB at 0x1c0000
UA/(backup_devbml) backup 128KB at 0x200000
UA/(backup_devbml) backup 128KB at 0x240000
UA/(backup_devbml) backup 128KB at 0x280000
UA/(backup_devbml) backup 128KB at 0x2c0000
UA/(backup_devbml) backup 128KB at 0x300000
UA/(backup_devbml) backup 128KB at 0x340000
UA/(backup_devbml) backup 128KB at 0x380000
UA/(backup_devbml) backup 128KB at 0x3c0000
UA/(backup_devbml) backup 128KB at 0x400000
UA/(backup_devbml) backup 128KB at 0x440000
UA/(backup_devbml) backup 128KB at 0x480000
UA/(backup_devbml) backup 128KB at 0x4c0000
UA/(backup_devbml) backup 128KB at 0x500000
UA/(backup_devbml) backup 128KB at 0x540000
UA/(backup_devbml) backup 128KB at 0x580000
UA/(backup_devbml) backup 128KB at 0x5c0000
UA/(backup_devbml) backup 128KB at 0x600000
UA/(backup_devbml) backup 128KB at 0x640000
UA/(backup_devbml) backup 128KB at 0x680000
UA/(backup_devbml) backup 128KB at 0x6c0000
UA/(backup_devbml) backup 128KB at 0x700000
UA/(backup_devbml) backup 128KB at 0x740000
page_msize: 4096, phy_unit_size: 262144
common mark dev : /dev/block/bml8 partition size: 0x780000
0xffffffff
page_msize: 4096, phy_unit_size: 262144
common mark dev : /dev/block/bml8 partition size: 0x780000
0xffffffff
UA/(RB_ImageUpdateMain): ++
UA/(RB_ImageUpdateMain) uPartitionName[zImage]
RB_GetBlockSize: returning 0x40000 (262144)
UA/(RB_UpdateImage): ++
UA/(RB_UpdateImage): Delta file name-/data/fota/delta.zImage
unicode_to_char : zImage
pDeviceDatum.pFirstPartitionData->partition_name: zImage
pDeviceDatum.pFirstPartitionData->partition_type: 0
pDeviceDatum.pFirstPartitionData->file_system_type: 0
unicode_to_char : /data/fota/delta.zImage
RB_OpenFile: Path:/data/fota/delta.zImage | Mode: RDONLY
Successful open() *pwHandle:4
[RB] Illegal field in the delta, or that the given delta is invalid
UA/(RB_UpdateImage) return value from RB_vRM_Update: 0x80000539
UA/(RB_UpdateImage): -- ret=-2147482311
UA/(RB_ImageUpdateMain) pCustomerPartData.updated = -1, rest = -1
UA/(RB_ImageUpdateMain): -- ret=-2147482311
page_msize: 4096, phy_unit_size: 262144
common mark dev : /dev/block/bml8 partition size: 0x780000
0xdeade002
UA/(update_all) Kernel update fail
fail!
Open /data/fota/fota.status
fsync after write: 0
Promising ! This software definitely has the ability to write on protected bml partitions.
Now wee need to find how to produce the .delta files

Sounds great Lets hope you guys can figure it all out.

I just send a message to Red Bend Software through their site.
Actually it may help to find any other delta file for their software. Without sample we won't go anywhere...
I hope they will be kind and answer!

Here is a list of interesting strings found in the binary :
Code:
UA/ Platform delta does NOT exist! Skip.
Can not open src file : %s
Can not open dst file : %s
UA/(%s) write %dbytes
UA/(%s) copy file %s->%s
fsync failed with return value: %d
fsync after write: %d
UA/ %s: %s
/dev/block/bml4
/data/fota/dump_sbl
/dev/block/bml7
/data/fota/dump_kernel
/dev/block/bml12
/data/fota/dump_modem
FOTA : Make Block Device Nodes
UA/(%s): mknod path=%s, dev_no=%u
Failed to open %s: %s
Open %s
lseek failed with return value: %d
read failed with return value: %d
success!
DONE
fail!
FAIL
FOTA
UA/ modem delta does NOT exist! Skip.
/data/fota/backup.modem
UA/ zImage delta does NOT exist! Skip.
/dev/block/bml8
UA/ Sbl delta does NOT exist! Skip.
UA/ERROR(%s) get dual sbl siginfo fail!!
/dev/block/bml5
UA/ERROR(%s) can't find vaild Sbl partitions
UA/ERROR(%s) SBL RAM partition alloc fail
UA/ERROR(%s) RB_ImageUpdateMain Fail ret=(0x%d)
/data/fota/command
/sdcard/Android/data/temp.fota.delta/command
UA/(%s) cache download
/cache/recovery
UA/(%s) create /cache/recovery directory
/cache/recovery/command
reboot recovery
UA/(%s): Check Delta : path_idx(%d), part_idx(%d), file_path(%s), cnt(%d)
SBL update fail
UA/(%s) %s
Kernel update fail
Modem update fail
Platform update fail
Post update fail
WARNNIG
Delta Not Exist
/data/fota
/sbin/images/fota.png
UA/(%s) test
Update Fail!!
/data/fota/fota.status
/data/fota/delta.Sbl
/data/fota/delta.zImage
/data/fota/delta.modem
/data/fota/delta.platform
/sdcard/Android/data/temp.fota.delta/delta.Sbl
/sdcard/Android/data/temp.fota.delta/delta.zImage
/sdcard/Android/data/temp.fota.delta/delta.modem
/sdcard/Android/data/temp.fota.delta/delta.platform
RedBend Update Agent %s
commands:
img [partition name] [delta file] [device node] [temp path]
fs [partition name] [delta file] [mount point] [temp path]
all
dump <source dev> <dest file>
restore <source file> <dest dev>
compare <dev1> <dev2>
png [png file name]
all
unknown
/data/fota/fota_Sbl
/data/fota/fota_zImage
Modem
/data/fota/fota_modem
/data/fota/fota_platform
/dev/block/bml11
OFNI
main
update_all
post_update
update_platform
update_modem
update_zImage
update_Sbl
file_copy
check_existence
MakeBMLNodes
UA/(%s): +
UA/(%s): %s (%lx %x)
UA/(%s): -
UA/(%s): %s (%lx %lx)
UA/(%s): memcpy(0x%x, 0x%x, 0x%x)
%07x:
%02x
%02x
BML_GET_DEV_INFO
page_msize: %d, phy_unit_size: %d
open device file
%s: bmldevice_open failed!
%s: bmldevice_info failed!
src: %s
dst: %s partition size: 0x%x
part_size: 0x%x
failed to read from %s (%s)
read finished
read %d bytes
src: %s partition size: 0x%x
dst: %s
failed to write to %s (%s)
done
UA/(%s) src: %s
UA/(%s) dst: %s partition size: 0x%x
UA/(%s) part_size: 0x%x
UA/(%s) read finished
UA/(%s) read %d bytes
UA/(%s) src: %s partition size: 0x%x
UA/(%s) dst: %s
UA/(%s) signature: 0x%x
*WARN* %s partition is already marked as invalid!
UA/(%s) done
page at 0x%x differ!
UA/(%s) backup 128KB at 0x%x
UA/(%s): ++
UA/(%s) 0x%x
UA/ERROR(%s) Valid partition signature is not invalid
UA/(%s): --
%s, invalide magic key(%x)!!
common mark dev : %s partition size: 0x%x
dev: %s partition size: 0x%x
signature: 0x%x
UA/(%s) dev: %s partition size: 0x%x
UA/ERROR(%s) Signature is not validate (%x)
UA/(%s) SBL, SBL2 partition are diffierent size, check your bml device node name
UA/ERROR(%s) Both partition has valid or invalid signature
UA/(%s) Valid Partition-%s, Update Partition-%s
restore_file
backup_block_file
restore_devbml
backup_devbml
store_dualsbl_partition
load_partition
mark_common_recovery
find_valid_partition
check_dualpartition_validation
ram_write_block
ram_read_block
nand_write_block
nand_read_block
bmldevice_get_size
Image size is bigger than partition!
reading NAND page
BML_UNLOCK_ALL
writing NAND page
6,1,14,1
RB_GetBlockSize
%s: returning 0x%x (%d)
RB_ReadBackupBlock
UA/(%s): %s: offset 0x%lx(%ld), size 0x%lx(%ld)
UA/ERROR(%s) open file %s failed.
UA/ open %s file success
UA/ERROR(%s) error in read size
RB_WriteBackupBlock
UA/(%s): offset 0x%lx(%ld), size 0x%lx(%ld)
UA/ERROR(%s) error in write size
RB_ImageUpdateMain
UA/(%s): ++
UA/(%s) uPartitionName[%s]
UA/(%s) pCustomerPartData.updated = %d, rest = %d
UA/(%s): -- ret=%d
RB_UpdateImage
UA/(%s): Delta file name-%s
pDeviceDatum.pFirstPartitionData->partition_name: %s
pDeviceDatum.pFirstPartitionData->partition_type: %d
pDeviceDatum.pFirstPartitionData->file_system_type: %d
UA/(%s) return value from RB_vRM_Update: 0x%x
unicode_to_char
%s : %s
RecursiveFolderCreater
%s path: %s
temppath: %s
mkdir result: %d errno: %d
RB_CopyFile
%s: %s -> %s
NULL file name find. Abort.
Open %s ENOENT %d
Open %s failed. Abort.
read %d, but write %d, abort.
RB_DeleteFile
%s: %s
unlink value: %d, errno: %d
RB_DeleteFolder
rmdir value: %d, errno: %d
RB_CreateFolder
%s: %s, mode:0x%x
RDONLY
WRONLY
RDWR
Unknown
RB_OpenFile
%s: Path:%s | Mode:
First open() with error %d
copy dir[]=%s
remove dir[]=%s
Fail create folder, Leave RB_OpenFile
After successful creating folder, fail open() with error %d
Successful open() *pwHandle:%ld
RB_ResizeFile
%s: handle %ld, dwSize %d
%s: ret %d handle %ld %d
RB_CloseFile
%s: wHandle = %ld
RB_WriteFile
%s: Handle:%ld , Pos:%ld , Size: %ld
lseek failed with return value: %d
Failed with return value: %d
Bytes Write: %d
fsync Failed with return value: %d
fsync after write: %d
RB_ReadFile
%s: Handle:%ld , Pos:%ld , Size: %ld
read failed with return value: %d
RB_GetFileSize
%s: %ld
lseek errno: %d
Returning Size = 0x%x
RB_Unlink
unlink failed with return value: %d
unlink with return value: %d
RB_Link
symlink failed with return value: %d, errno: %d
symlink with return value: %d
RB_VerifyLinkReference
readlink failed with return value: %d
not same linked path
same linked path
RB_GetFileType
stat failed with return value: %d errno: %d
sbuf.st_mode: %d
S_ISREG(sbuf.st_mode): %d
S_ISLNK(sbuf.st_mode): %d
stat->st_mode = symbolic link file
stat->st_mode = regular file
failed to lstat, err : %d
a2ch
%s : %d
Wrong attribute value: %d
a2ch : %c
chtoa
RB_SetFileAttributes
stat failed with return value: %d
sbuf.st_mode value: %d
ui8pAttribs value: %s
ui32AttribSize value: %ld
attrib_user value: %d
attrib_group value: %d
attrib_other value: %d
att_type value: %d
sbuf.st_mode | attrib: %d
chmod failed with return value: %d
chmod with return value: %d
pUserId value: %s
user_id value: %d
aGroupId value: %s
pGroupId value: %s
group_id value: %d
failed chown %d
success chown %d
RB_FSUpdateMain
UA/(%s) Partition name(%s), mount point(%s)
UA/(%s) pCustomerPartData.updated = %ld, rest = %ld
pDeviceDatum.pFirstPartitionData->partition_name: %s
pDeviceDatum.pFirstPartitionData->partition_type: %d
pDeviceDatum.pFirstPartitionData->file_system_type: %d
return value from RB_vRM_Update: 0x%x
%s/flagsFile
return value from unlink(%s): 0x%x
Installing software
Don't turn off the
phone and
connect the power
cable as possible.
System updated &
reboot now
gui_progress
UA/(%s): ++ uPercent(%d%), gv_delta_count=(%ld)
UA/(%s): -- Print Percent(%d%)
%3d %%
lcd_init
%s(%d): start!
/dev/graphics/fb0
%s(%d): fb0 open fail
%s(%d): fb0 open success
%s(%d): width = %d, height = %d
%s(%d): ioctl set info fail
%s(%d): Error: failed to map framebuffer device to memory.
%s(%d): ioctl start fail
Allocation error-
Current start: %d
Current finish: %d
Requested size: %d
Allocation error:
Current start: %d
Current finish: %d
Requested size: %d
It may accept commands somehow, like those :
img [partition name] [delta file] [device node] [temp path]
fs [partition name] [delta file] [mount point] [temp path]
all
dump <source dev> <dest file>
restore <source file> <dest dev>
compare <dev1> <dev2>
png [png file name]
all
I tried writing commands in /data/fota/command and /cache/recovery/command but the program does not follow my orders

ok it works when i flashed zImage
Code:
# redbend_ua restore /sdcard/jm5.zImage /dev/block/bml7
redbend_ua restore /sdcard/jm5.zImage /dev/block/bml7
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/jm5.zImage
dst: /dev/block/bml7 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 247184 bytes
read finished

Wow, this is looking promising.

it seems like htc's flash_image,but much more difficult than it.

raspdeep said:
ok it works when i flashed zImage
Code:
# redbend_ua restore /sdcard/jm5.zImage /dev/block/bml7
redbend_ua restore /sdcard/jm5.zImage /dev/block/bml7
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: /sdcard/jm5.zImage
dst: /dev/block/bml7 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 247184 bytes
read finished
Click to expand...
Click to collapse
Nice raspdeep
How did you do ? Every attempt fails here (in recovery or standard mode).
Which initramfs version do you use ?

Code:
redbend_ua restore zImage /dev/block/bml7
RedBend Update Agent 6,1,14,1
FOTA : Make Block Device Nodes
lcd_init(498): start!
lcd_init(507): fb0 open success
lcd_init(514): width = 480, height = 800
page_msize: 4096, phy_unit_size: 262144
src: zImage
dst: /dev/block/bml7 partition size: 0x780000
part_size: 0x780000
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 262144 bytes
read 247184 bytes
read finished
Ok yo don't respond but it works here to, booting on your OC kernel. Now i'll find what is different between our setups

supercurio, you are rapidly becoming one of my Android heros...

distortedloop said:
supercurio, you are rapidly becoming one of my Android heros...
Click to expand...
Click to collapse
Don't know if I can live with that
Code:
ll */*
-rwxr-xr-x 1 root curio 313888 2010-08-26 21:14 oc128uv1/redbend_ua*
-rwxr-xr-x 1 curio curio 314004 2010-08-26 21:16 XWJM5/redbend_ua*
md5sum */*
74f5793536c3cdc902ec269c3f51a165 oc128uv1/redbend_ua
b1ba258a5d673c537a95167267afd6b8 XWJM5/redbend_ua
Different binaries !
Edit : attached working redbend_ua

A diff between strings included in binaries (raw infos, not analyzed yet ^^)
Code:
--- not-working 2010-08-26 21:22:39.594984596 +0200
+++ working 2010-08-26 21:22:20.370634450 +0200
@@ -4,7 +4,6 @@
@F2A
bB,2
H{DYX
-/Q{;
/Qs;
/Qk;
/Qc;
@@ -452,71 +451,52 @@
%mB(
@ #!
!1C "
-reboot
-UA/ Platform delta does NOT exist! Skip.
-Can not open src file : %s
-Can not open dst file : %s
-UA/(%s) write %dbytes
-UA/(%s) copy file %s->%s
- fsync failed with return value: %d
- fsync after write: %d
-UA/ %s: %s
+/data/fota/delta.Sbl
/dev/block/bml4
-/data/fota/dump_sbl
+/dev/block/bml5
+/data/fota/fota_Sbl
+/data/fota/delta.zImage
/dev/block/bml7
-/data/fota/dump_kernel
+/data/fota/backup.zImage
+/data/fota/fota_zImage
+Modem
+/data/fota/delta.modem
/dev/block/bml12
+/data/fota/backup.modem
+/data/fota/fota_modem
+/data/fota/delta.platform
+/data/fota/backup.platform
+/data/fota/fota_platform
+platform delta does NOT exist! Skip.
+existence: s1[%d].existence; %d
+%s: %s
+/data/fota/dump_sbl
+/data/fota/dump_kernel
/data/fota/dump_modem
FOTA : Make Block Device Nodes
-UA/(%s): mknod path=%s, dev_no=%u
Failed to open %s: %s
Open %s
lseek failed with return value: %d
read failed with return value: %d
+ fsync failed with return value: %d
+ fsync after write: %d
success!
DONE
fail!
FAIL
FOTA
-UA/ modem delta does NOT exist! Skip.
-/data/fota/backup.modem
-UA/ zImage delta does NOT exist! Skip.
+modem delta does NOT exist! Skip.
+zImage delta does NOT exist! Skip.
/dev/block/bml8
-UA/ Sbl delta does NOT exist! Skip.
-UA/ERROR(%s) get dual sbl siginfo fail!!
-/dev/block/bml5
-UA/ERROR(%s) can't find vaild Sbl partitions
-UA/ERROR(%s) SBL RAM partition alloc fail
-UA/ERROR(%s) RB_ImageUpdateMain Fail ret=(0x%d)
-/data/fota/command
-/sdcard/Android/data/temp.fota.delta/command
-UA/(%s) cache download
-/cache/recovery
-UA/(%s) create /cache/recovery directory
-/cache/recovery/command
-reboot recovery
-UA/(%s): Check Delta : path_idx(%d), part_idx(%d), file_path(%s), cnt(%d)
-SBL update fail
-UA/(%s) %s
-Kernel update fail
-Modem update fail
-Platform update fail
-Post update fail
-WARNNIG
-Delta Not Exist
-/data/fota
-/sbin/images/fota.png
-UA/(%s) test
-Update Fail!!
+Sbl delta does NOT exist! Skip.
+get dual sbl siginfo fail!!
+can't find vaild Sbl partitions
+reboot
+gv_delta_count[%d]
+dump
+restore
+compare
/data/fota/fota.status
-/data/fota/delta.Sbl
-/data/fota/delta.zImage
-/data/fota/delta.modem
-/data/fota/delta.platform
-/sdcard/Android/data/temp.fota.delta/delta.Sbl
-/sdcard/Android/data/temp.fota.delta/delta.zImage
-/sdcard/Android/data/temp.fota.delta/delta.modem
-/sdcard/Android/data/temp.fota.delta/delta.platform
RedBend Update Agent %s
commands:
img [partition name] [delta file] [device node] [temp path]
@@ -527,29 +507,7 @@
compare <dev1> <dev2>
png [png file name]
all
-unknown
-/data/fota/fota_Sbl
-/data/fota/fota_zImage
-Modem
-/data/fota/fota_modem
-/data/fota/fota_platform
-/dev/block/bml11
OFNI
-main
-update_all
-post_update
-update_platform
-update_modem
-update_zImage
-update_Sbl
-file_copy
-check_existence
-MakeBMLNodes
-UA/(%s): +
-UA/(%s): %s (%lx %x)
-UA/(%s): -
-UA/(%s): %s (%lx %lx)
-UA/(%s): memcpy(0x%x, 0x%x, 0x%x)
%07x:
%02x
%02x
@@ -568,71 +526,67 @@
dst: %s
failed to write to %s (%s)
done
-UA/(%s) src: %s
-UA/(%s) dst: %s partition size: 0x%x
-UA/(%s) part_size: 0x%x
-UA/(%s) read finished
-UA/(%s) read %d bytes
-UA/(%s) src: %s partition size: 0x%x
-UA/(%s) dst: %s
-UA/(%s) signature: 0x%x
-*WARN* %s partition is already marked as invalid!
-UA/(%s) done
page at 0x%x differ!
-UA/(%s) backup 128KB at 0x%x
-UA/(%s): ++
-UA/(%s) 0x%x
-UA/ERROR(%s) Valid partition signature is not invalid
-UA/(%s): --
+signature: 0x%x
+*WARN* %s partition is already marked as invalid!
+backup 128KB at 0x%x
+backup 128KB at 0x%x without signature
+clear mark dev : %s partition size: 0x%x
%s, invalide magic key(%x)!!
-common mark dev : %s partition size: 0x%x
dev: %s partition size: 0x%x
-signature: 0x%x
-UA/(%s) dev: %s partition size: 0x%x
-UA/ERROR(%s) Signature is not validate (%x)
-UA/(%s) SBL, SBL2 partition are diffierent size, check your bml device node name
-UA/ERROR(%s) Both partition has valid or invalid signature
-UA/(%s) Valid Partition-%s, Update Partition-%s
-restore_file
-backup_block_file
-restore_devbml
-backup_devbml
-store_dualsbl_partition
-load_partition
+%s:clear:%s partition size: 0x%x
+%s : write and clear signature done
+%s:write:%s partition size: 0x%x
+%s: Signature is not validate (%x)
+%s signature: 0x%x
+%s +
+%s: SBL, SBL2 partition are diffierent size, check your bml device node name
+Both partition has valid or invalid signature
+Valid Partition-%s, Update Partition-%s
+Siginfo error partition $s (0x%x, 0x%x)
mark_common_recovery
+clear_dualpartition_signature
+write_dualpartition_signature
find_valid_partition
check_dualpartition_validation
-ram_write_block
-ram_read_block
-nand_write_block
-nand_read_block
bmldevice_get_size
Image size is bigger than partition!
reading NAND page
BML_UNLOCK_ALL
writing NAND page
6,1,14,1
+RB_Progress
+%s: (%lu %%)
+RB_GetDelta
+%s: offset 0x%lx(%ld), size 0x%lx(%ld)
+%s: open file %s failed.
+%s: error in read size
RB_GetBlockSize
%s: returning 0x%x (%d)
+RB_ReadImage
+%s: node-%s (%lx %lx)
+RB_WriteBlock
+%s: node-%s (%lx %x)
RB_ReadBackupBlock
-UA/(%s): %s: offset 0x%lx(%ld), size 0x%lx(%ld)
-UA/ERROR(%s) open file %s failed.
-UA/ open %s file success
-UA/ERROR(%s) error in read size
+%s: offset 0x%lx(%ld), size 0x%lx(%ld)
+%s: open file %s failed.
+%s: error in read size
RB_WriteBackupBlock
-UA/(%s): offset 0x%lx(%ld), size 0x%lx(%ld)
-UA/ERROR(%s) error in write size
+%s: error in write size
+RB_ImageUpdateCommon
+uPartitionName[%s]
+%s: pCustomerPartData.updated = %d, rest = %d
RB_ImageUpdateMain
-UA/(%s): ++
-UA/(%s) uPartitionName[%s]
-UA/(%s) pCustomerPartData.updated = %d, rest = %d
-UA/(%s): -- ret=%d
-RB_UpdateImage
-UA/(%s): Delta file name-%s
+%s: backup_file is %s
+%s: size of %s(%s) is %d bytes
+RB_ImageUpdateDualPartition
+%s: backup file(%s) / Valid Partition(%s) / Update Partition(%s)
+%s : RB Image Update Fail
+%s : RB Image Update Done %s
pDeviceDatum.pFirstPartitionData->partition_name: %s
pDeviceDatum.pFirstPartitionData->partition_type: %d
pDeviceDatum.pFirstPartitionData->file_system_type: %d
-UA/(%s) return value from RB_vRM_Update: 0x%x
+return value from RB_vRM_Update: 0x%x
unicode_to_char
%s : %s
RecursiveFolderCreater
@@ -726,8 +680,7 @@
failed chown %d
success chown %d
RB_FSUpdateMain
-UA/(%s) Partition name(%s), mount point(%s)
-UA/(%s) pCustomerPartData.updated = %ld, rest = %ld
+%s: pCustomerPartData.updated = %ld, rest = %ld
pDeviceDatum.pFirstPartitionData->partition_name: %s
pDeviceDatum.pFirstPartitionData->partition_type: %d
pDeviceDatum.pFirstPartitionData->file_system_type: %d
@@ -741,9 +694,9 @@
cable as possible.
System updated &
reboot now
-gui_progress
-UA/(%s): ++ uPercent(%d%), gv_delta_count=(%ld)
-UA/(%s): -- Print Percent(%d%)
+Update is ok.
+Update is failed.
+Restoring...
%3d %%
lcd_init
%s(%d): start!
@@ -962,12 +915,6 @@
insufficient memory
buffer error
incompatible version
-RB_Progress
-%s: (%lu %%)
-RB_GetDelta
-%s: offset 0x%lx(%ld), size 0x%lx(%ld)
-%s: open file %s failed.
-%s: error in read size
Pure virtual function called. Are you calling virtual methods from a destructor?
libc-abort
abort() called in pid %d
@@ -1120,6 +1067,7 @@
/dev/log/main
/dev/log/radio
/proc/self/exe
+unknown
/dev/urandom
stack corruption detected: aborted
ANDROID_PROPERTY_WORKSPACE

Whilst we're talking about retrieving information from binaries...
Does anyone know any good disassembly tools. I managed to compile objdump for ARM (ELF) and run it on the Galaxy S secondary bootloader but it only partially works. It doesn't look like it is handling the binary layout correctly. It's unsure how much of the binary is data and how much is actual instructions so it ends up converting the whole thing to instructions (most of which are obviously bogus).

Benjamin Dobell said:
Whilst we're talking about retrieving information from binaries...
Does anyone know any good disassembly tools. I managed to compile objdump for ARM (ELF) and run it on the Galaxy S secondary bootloader but it only partially works. It doesn't look like it is handling the binary layout correctly. It's unsure how much of the binary is data and how much is actual instructions so it ends up converting the whole thing to instructions (most of which are obviously bogus).
Click to expand...
Click to collapse
Under Linux i use the minimalist tool named "strings". You can learn so much just by reading strings extracted ^^.
Otherwise you have IDA Pro (Windows), which is very powerful.
Benjamin, like you i found objdump quite challenging to use.. and.. not that fun.

supercurio said:
Under Linux i use the minimalist tool named "strings". You can learn so much just by reading strings extracted ^^.
Otherwise you have IDA Pro (Windows), which is very powerful.
Benjamin, like you i found objdump quite challenging to use.. and.. not that fun.
Click to expand...
Click to collapse
Unfortunately IDA Pro doesn't seem to work either. IDA Pro Free doesn't support ARM at all and I tried with IDA Pro Advanced but it seemed to have similar issues to objdump, it couldn't determine the entry point etc.
If I could just get the assembler with comments next to it that indicate which pieces of data (strings in particular) are being referenced that would make my day.

Do you think Sbl.bin is a single unique binary ?
Considering everything that this Second Boot Loader is able to do, i would not be surprised if it's more complex than that.
Anyway I can't say much more about the tools, i'm just a rookie hacker

supercurio said:
Do you think Sbl.bin is a single unique binary ?
Considering everything that this Second Boot Loader is able to do, i would not be surprised if it's more complex than that.
Click to expand...
Click to collapse
It wouldn't be a very reliable boot loader if it depended on other binaries (other than data passed to it by the primary boot loader). However the information I'm after, the Loke protocol, is definitely in there cause I can see the handshake strings I send and receive with Heimdall.

working this into SRE RIGHT NOW!!!!
--edit
scripted, and working
release coming soon!!

designgears said:
working this into SRE RIGHT NOW!!!!
Click to expand...
Click to collapse
Nice
Remember being EXTRA careful manipulating raw bml partitions. You can easily brick your phone for good writing bad data in place of first and second bootloader.
NON-RECOVERABLE
please say that to every potential redbend_ua users
This was the required warning, now enjoy

supercurio said:
Nice
Remember being EXTRA careful manipulating raw bml partition. You can easily
brick your phone for good writing bad data in place of first and second bootloader.
NON-RECOVERABLE
please say that to every potential redbend_ua users
This was the required warning, now enjoy
Click to expand...
Click to collapse
I have borked bml17 before.. was able to go into download and restore stock.

Heimdall (Cross-Platform Flashing Tool) - Galaxy Tab?

I'm the creator of Heimdall the cross platform Galaxy S flashing tool. I was wondering if any one has attempted to flash a Galaxy Tab using my tool?
I suspect that the protocol for flashing the Galaxy Tab is identical. However, I don't have access to a Galaxy Tab so I'm unable to test myself. I would love to add the Galaxy Tab to the list of officially supported devices if someone can confirm it works.
EDIT: Just realised I never updated this post. Heimdall has officially supported the Galaxy Tab for a while now.

I might be able to do it if I find some better firmware to flash. Not sure yet.
Sent from my SCH-I800 using XDA App

I'll give it a try later today. I'm a Linux zealot.

Install notes for Linux + a question
sorry -- wrong thread. No clue how to delete, but I don't want to cross-post so just ignore this.

I compiled and tried using it to flash a modem.bin, but got an error. Heres the console output:
Code:
$ heimdall flash --pit P1_20100909.pit --modem modem.bin
Heimdall, Copyright (c) 2010, Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Claiming interface... Failed. Attempting to detach driver...
Claiming interface again... Success
Setting up interface... Success
Beginning session...
Handshaking with Loke... Success
Unexpected device info response!
Expected: 180 or 0
Received:3
Ending session...
Rebooting device...
Re-attaching kernel driver...

rotohammer, thanks for that. It seems as the initialisation process might be slightly different for the Galaxy Tab. Unfortunately the spot where it failed is the exact spot in the protocol that I have basically no clue about. The Galaxy S sends either 180 or 0, which is perhaps some sort of flags indicating the state of the device. Technically the flash could continue past there regardless of the value received but it's a bit of a safety net feature to stop right away.
I'll see if I can get my hands on a Galaxy Tab so I can get Heimdall working for Galaxy Tab users as well.

Works great
For those of you interested, I've modified the Heimdall source on Linux to accept the device info value of 3 and I have successfully flashed 2 different full firmwares on my T-Mobile Tab, as well as many individual files. It works much faster than Odin, and a lot less flaky. I let Benjamin know so he can include support in an upcoming release.

Thanks for the good work, Ben and Roto

Can Heimdall dump partititions from flash for backup?

Technomancer said:
Can Heimdall dump partititions from flash for backup?
Click to expand...
Click to collapse
It can dump, but the dumps, just like those from Odin, aren't very useful. Its a limitation on the exporting function of the phone software.

rotohammer said:
It can dump, but the dumps, just like those from Odin, aren't very useful. Its a limitation on the exporting function of the phone software.
Click to expand...
Click to collapse
I suppose the partitions are not mounted in the "downloading" mode, so any dumps from Heimdall should be better than dumps made using dd from the shell?

rotohammer said:
It can dump, but the dumps, just like those from Odin, aren't very useful. Its a limitation on the exporting function of the phone software.
Click to expand...
Click to collapse
Hi Rotohammer!
Great work again
What did you use as chip-type and chip-id for dumping? I.e.
Code:
heimdall dump --chip-type ??? --chip-id ??? --output <filename>

Volker1 said:
What did you use as chip-type and chip-id for dumping?
Click to expand...
Click to collapse
Code:
heimdall dump --chip-type NAND --chip-id 0 --output hdump.img

I wrote a simple too to display information about PIT files (attached). The factory-installed PIT (/dev/block/bml2) on my T-Mobile US tab is identical to the one known as P1_20100909.pit and reads:
Code:
$ ./PITinfo bml2.dump
Contents of PIT file:bml2.dump
---------------------------------------------------------------------------
file magic = 0x12349876 (expected value)
Unknown data: 0x135d800 0x1 0 0x1331e17 0x2cf560
Number of partitions = 14 (not the usual value)
Partition #1
Usual content: boot.bin, the primary boot loader (low-level hardware initialization)
partition entry type: 0 0 (normal partition)
ID = 0; flags = 0; unknown: 0
size = 1 blocks of 256 * 512 bytes = 131072 B = 128 kB = 0 MB
unknown string: [........]
partition name = [IBL+PBL.........................]
file name = [boot.bin........................................................]
Partition #2
Usual content: partition information table (PIT)
partition entry type: 0 0 (normal partition)
ID = 0x1; flags = 0; unknown: 0
size = 1 blocks of 256 * 512 bytes = 131072 B = 128 kB = 0 MB
unknown string: [........]
partition name = [PIT.............................]
file name = [................................................................]
Partition #3
Usual content: efs.rfs
partition entry type: 0 0 (normal partition)
ID = 0x14; flags = 0x2 (rfs file system); unknown: 0
size = 40 blocks of 256 * 512 bytes = 5242880 B = 5120 kB = 5 MB
unknown string: [........]
partition name = [EFS.............................]
file name = [efs.rfs.........................................................]
Partition #4
Usual content: Sbl.bin, the secondary boot loader (loads linux kernel)
partition entry type: 0 0 (normal partition)
ID = 0x3; flags = 0; unknown: 0
size = 5 blocks of 256 * 512 bytes = 655360 B = 640 kB = 0 MB
unknown string: [........]
partition name = [SBL.............................]
file name = [sbl.bin.........................................................]
Partition #5
Usual content: backup of secondary boot loader
partition entry type: 0 0 (normal partition)
ID = 0x4; flags = 0; unknown: 0
size = 5 blocks of 256 * 512 bytes = 655360 B = 640 kB = 0 MB
unknown string: [........]
partition name = [SBL2............................]
file name = [sbl.bin.........................................................]
Partition #6
Usual content: param.lfs /mnt/.lfs j4fs
partition entry type: 0 0 (normal partition)
ID = 0x15; flags = 0x2 (rfs file system); unknown: 0
size = 20 blocks of 256 * 512 bytes = 2621440 B = 2560 kB = 2 MB
unknown string: [........]
partition name = [PARAM...........................]
file name = [param.lfs.......................................................]
Partition #7
Usual content: zImage, the linux kernel
partition entry type: 0 0 (normal partition)
ID = 0x6; flags = 0; unknown: 0
size = 30 blocks of 256 * 512 bytes = 3932160 B = 3840 kB = 3 MB
unknown string: [........]
partition name = [KERNEL..........................]
file name = [zImage..........................................................]
Partition #8
Usual content: recovery.bin, the backup copy of zImage/initramfs
partition entry type: 0 0 (normal partition)
ID = 0x7; flags = 0; unknown: 0
size = 30 blocks of 256 * 512 bytes = 3932160 B = 3840 kB = 3 MB
unknown string: [........]
partition name = [RECOVERY........................]
file name = [zImage..........................................................]
Partition #9
Usual content: factoryfs.rfs
partition entry type: 0 0 (normal partition)
ID = 0x16; flags = 0x2 (rfs file system); unknown: 0
size = 1320 blocks of 256 * 512 bytes = 173015040 B = 168960 kB = 165 MB
unknown string: [........]
partition name = [FACTORYFS.......................]
file name = [factoryfs.rfs...................................................]
Partition #10
Usual content: dbdata.rfs
partition entry type: 0 0 (normal partition)
ID = 0x17; flags = 0x2 (rfs file system); unknown: 0
size = 348 blocks of 256 * 512 bytes = 45613056 B = 44544 kB = 43 MB
unknown string: [........]
partition name = [DBDATAFS........................]
file name = [dbdata.rfs......................................................]
Partition #11
Usual content: cache.rfs
partition entry type: 0 0 (normal partition)
ID = 0x18; flags = 0x2 (rfs file system); unknown: 0
size = 140 blocks of 256 * 512 bytes = 18350080 B = 17920 kB = 17 MB
unknown string: [........]
partition name = [CACHE...........................]
file name = [cache.rfs.......................................................]
Partition #12
Usual content: modem.bin
partition entry type: 0 0 (normal partition)
ID = 0x8; flags = 0; unknown: 0
size = 64 blocks of 256 * 512 bytes = 8388608 B = 8192 kB = 8 MB
unknown string: [........]
partition name = [MODEM...........................]
file name = [modem.bin.......................................................]
Partition #13
Usual content: Unknown
partition entry type: 0 2 (unknown value)
ID = 0; flags = 0x1; unknown: 0
size = 0 blocks of 0 * 512 bytes = 0 B = 0 kB = 0 MB
unknown string: [l.e. .(.]
partition name = [MOVINAND..)...*...p.i.t.........]
file name = [movinand.mst........D.:.\.2.4.....P.1.\.4... .S.M.D. .i.m.a.g.e.]
Partition #14
Usual content: Unknown
partition entry type: 1 1 (past-the-end marker)
ID = 0x8; flags = 0; unknown: 0
size = 0 blocks of 0 * 512 bytes = 0 B = 0 kB = 0 MB
unknown string: [........]
partition name = [................................]
file name = [................................................................]
I want to flash the Euro firmware (I'm back in Europe right now) by flashing P1000XWJJ4 (and then flash P1000XXJK5 on top). The P1_add_hidden.pit reads:
Code:
$ ./PITinfo P1_add_hidden.pit
Contents of PIT file:P1_add_hidden.pit
---------------------------------------------------------------------------
file magic = 0x12349876 (expected value)
Unknown data: 0x1 0 0x411e17 0x12fae0 0x43d800
Number of partitions = 15 (not the usual value)
Partition #1
Usual content: boot.bin, the primary boot loader (low-level hardware initialization)
partition entry type: 0 0 (normal partition)
ID = 0; flags = 0; unknown: 0
size = 1 blocks of 256 * 512 bytes = 131072 B = 128 kB = 0 MB
unknown string: [........]
partition name = [IBL+PBL.........................]
file name = [boot.bin........................................................]
Partition #2
Usual content: partition information table (PIT)
partition entry type: 0 0 (normal partition)
ID = 0x1; flags = 0; unknown: 0
size = 1 blocks of 256 * 512 bytes = 131072 B = 128 kB = 0 MB
unknown string: [........]
partition name = [PIT.............................]
file name = [................................................................]
Partition #3
Usual content: efs.rfs
partition entry type: 0 0 (normal partition)
ID = 0x14; flags = 0x2 (rfs file system); unknown: 0
size = 40 blocks of 256 * 512 bytes = 5242880 B = 5120 kB = 5 MB
unknown string: [........]
partition name = [EFS.............................]
file name = [efs.rfs.........................................................]
Partition #4
Usual content: Sbl.bin, the secondary boot loader (loads linux kernel)
partition entry type: 0 0 (normal partition)
ID = 0x3; flags = 0; unknown: 0
size = 5 blocks of 256 * 512 bytes = 655360 B = 640 kB = 0 MB
unknown string: [........]
partition name = [SBL.............................]
file name = [sbl.bin.........................................................]
Partition #5
Usual content: backup of secondary boot loader
partition entry type: 0 0 (normal partition)
ID = 0x4; flags = 0; unknown: 0
size = 5 blocks of 256 * 512 bytes = 655360 B = 640 kB = 0 MB
unknown string: [........]
partition name = [SBL2............................]
file name = [sbl.bin.........................................................]
Partition #6
Usual content: param.lfs /mnt/.lfs j4fs
partition entry type: 0 0 (normal partition)
ID = 0x15; flags = 0x2 (rfs file system); unknown: 0
size = 20 blocks of 256 * 512 bytes = 2621440 B = 2560 kB = 2 MB
unknown string: [........]
partition name = [PARAM...........................]
file name = [param.lfs.......................................................]
Partition #7
Usual content: zImage, the linux kernel
partition entry type: 0 0 (normal partition)
ID = 0x6; flags = 0; unknown: 0
size = 30 blocks of 256 * 512 bytes = 3932160 B = 3840 kB = 3 MB
unknown string: [........]
partition name = [KERNEL..........................]
file name = [zImage..........................................................]
Partition #8
Usual content: recovery.bin, the backup copy of zImage/initramfs
partition entry type: 0 0 (normal partition)
ID = 0x7; flags = 0; unknown: 0
size = 30 blocks of 256 * 512 bytes = 3932160 B = 3840 kB = 3 MB
unknown string: [........]
partition name = [RECOVERY........................]
file name = [zImage..........................................................]
Partition #9
Usual content: factoryfs.rfs
partition entry type: 0 0 (normal partition)
ID = 0x16; flags = 0x2 (rfs file system); unknown: 0
size = 1320 blocks of 256 * 512 bytes = 173015040 B = 168960 kB = 165 MB
unknown string: [........]
partition name = [FACTORYFS.......................]
file name = [factoryfs.rfs...................................................]
Partition #10
Usual content: dbdata.rfs
partition entry type: 0 0 (normal partition)
ID = 0x17; flags = 0x2 (rfs file system); unknown: 0
size = 348 blocks of 256 * 512 bytes = 45613056 B = 44544 kB = 43 MB
unknown string: [........]
partition name = [DBDATAFS........................]
file name = [dbdata.rfs......................................................]
Partition #11
Usual content: cache.rfs
partition entry type: 0 0 (normal partition)
ID = 0x18; flags = 0x2 (rfs file system); unknown: 0
size = 140 blocks of 256 * 512 bytes = 18350080 B = 17920 kB = 17 MB
unknown string: [........]
partition name = [CACHE...........................]
file name = [cache.rfs.......................................................]
Partition #12
Usual content: modem.bin
partition entry type: 0 0 (normal partition)
ID = 0x8; flags = 0; unknown: 0
size = 64 blocks of 256 * 512 bytes = 8388608 B = 8192 kB = 8 MB
unknown string: [........]
partition name = [MODEM...........................]
file name = [modem.bin.......................................................]
Partition #13
Usual content: Unknown
partition entry type: 0 2 (unknown value)
ID = 0x3; flags = 0x1; unknown: 0
size = 0 blocks of 0 * 512 bytes = 0 B = 0 kB = 0 MB
unknown string: [l.e. .(.]
partition name = [HIDDEN.D..)...*...p.i.t.........]
file name = [hidden.rfs.t........D.:.\.2.4.....P.1.\.4... .S.M.D. .i.m.a.g.e.]
Partition #14
Usual content: Unknown
partition entry type: 1 1 (past-the-end marker)
ID = 0x8; flags = 0; unknown: 0
size = 0 blocks of 0 * 512 bytes = 0 B = 0 kB = 0 MB
unknown string: [........]
partition name = [................................]
file name = [................................................................]
Partition #15
Usual content: Unknown
partition entry type: 0 2 (unknown value)
ID = 0; flags = 0x1; unknown: 0
size = 0 blocks of 0 * 512 bytes = 0 B = 0 kB = 0 MB
unknown string: [........]
partition name = [MOVINAND........................]
file name = [movinand.mst....................................................]
But it seems like I can't flash movinand.mst with heimdall. Note that it is present in the P1000XWJJ4 firmware file. So I guess I'm better off going the VirtualBox->Win32->Odin route?

Compile on Mac OS X
I've just successfully compiled libusb and Heimdall on Mac OS X.
I needed to set an environment variable by hand so that the "configure" of Heimdall detected libusb:
export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
Oh, and of course this source code modification is necessary for the Galaxy Tab to be supported:
main.cpp line 252:
if (unknown != 180 && unknown != 0 && unknown != 3)
Disclaimer: I haven't had time to try flashing anything yet.

I finally found the courage to flash my T-Mo US tab to Euro version. I made my own Franken-rom by combining P1000XWJJ4 with P1000XXJK5. Specifically, I
1. decompressed P1000XWJJ4.rar
2. took boot.bin, Sbl.bin, and dbdata.rfs from P1000XWJJ4/P1000XWJJ4_SERJJ2_XXJID/P1000XWJJ4-REV03-ALL-CL639474.tar.md5 (a tar archive despite the wrong ending)
3. decompressed P1000XXJK5.rar
4. took zImage, cache.rfs, factoryfs.rfs, modem.bin, and param.lfs from P1000XXJK5/P1000OXAJK5.tar
5. P1_20100909.pit
Then I rebooted my tab in download mode, plugged it into my PC's USB, and then flashed
Code:
$ ./heimdall flash --pit P1_20100909.pit --factoryfs factoryfs.rfs --cache cache.rfs --dbdata dbdata.rfs --boot boot.bin --secondary Sbl.bin --param param.lfs --kernel zImage --modem modem.bin
Heimdall, Copyright (c) 2010, Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Claiming interface... Failed. Attempting to detach driver...
Claiming interface again... Success
Setting up interface... Success
Beginning session...
Handshaking with Loke... Success
Downloading device's PIT file...
PIT file download sucessful
Uploading factory filesytem
Factory filesytem upload successful
Uploading cache
Cache upload successful
Uploading data database
Data database upload successful
Uploading primary bootloader
Primary bootloader upload successful
Uploading secondary bootloader
Secondary bootloader upload successful
Uploading param.lfs
param.lfs upload successful
Uploading kernel
Kernel upload successful
Uploading modem
Modem upload successful
Ending session...
Rebooting device...
Re-attaching kernel driver...
I had my German SIM card in and after some booting I ended up with a perfectly working German-localized Euro tab. Switching the language back to US Englisch works fine, too.

Volker1 said:
But it seems like I can't flash movinand.mst with heimdall. Note that it is present in the P1000XWJJ4 firmware file.
Click to expand...
Click to collapse
It is also present in JK2. So I guess in the end you decided not to flash movinand.mst, right ? Unless you used Odin and Heimdall ?

daniel.weck said:
It is also present in JK2. So I guess in the end you decided not to flash movinand.mst, right ? Unless you used Odin and Heimdall ?
Click to expand...
Click to collapse
Alright it looks like you guys have found one more file that Heimdall is technically capable of flashing but doesn't implement. I presume I'm missing quite a few files that the protocol supports, at least that's what the following list of utilised file identifiers would seem to indicate:
Code:
enum
{
kFilePrimaryBootloader = 0x00,
kFileSecondaryBootloader = 0x03,
kFileKernel = 0x06,
kFileParamLfs = 0x15,
kFileFactoryFilesystem = 0x16,
kFileDatabaseData = 0x17,
kFileCache = 0x18
};
I can easily add support for movinand.mst if I can find out what file identifier it uses. Unfortunately I don't have a Galaxy Tab and I need access to one in order to find out.

It's zero, if we trust the output of the PIT reader utility:
http://forum.xda-developers.com/showpost.php?p=9471190&postcount=14
Benjamin Dobell said:
Alright it looks like you guys have found one more file that Heimdall is technically capable of flashing but doesn't implement. I presume I'm missing quite a few files that the protocol supports, at least that's what the following list of utilised file identifiers would seem to indicate:
Code:
enum
{
kFilePrimaryBootloader = 0x00,
kFileSecondaryBootloader = 0x03,
kFileKernel = 0x06,
kFileParamLfs = 0x15,
kFileFactoryFilesystem = 0x16,
kFileDatabaseData = 0x17,
kFileCache = 0x18
};
I can easily add support for movinand.mst if I can find out what file identifier it uses. Unfortunately I don't have a Galaxy Tab and I need access to one in order to find out.
Click to expand...
Click to collapse

Well 0 is the primary bootloader, so right now I'm not trusting it.
Does anyone have any idea what the contents of movinand.mst is? Because I just figured out how to flash the recovery partition directly.
EDIT: And the EFS.

Linux without chroot?

Is it possible to run Linux without chroot? I got Archlinux up and running
Code:
[[email protected] ~]# hostname
galaxys
[[email protected] ~]# cat /proc/cpuinfo
Processor : ARMv7 Processor rev 2 (v7l)
BogoMIPS : 663.76
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc08
CPU revision : 2
Hardware : aries
Revision : 0030
Serial : 313423849c8b00ec
[[email protected] ~]# uname -a
Linux galaxys 3.1.10_IcyGlitch_V14-B6_I9K-T959D #1 PREEMPT Sat Mar 24 18:00:37 CET 2012 armv7l ARMv7 Processor rev 2 (v7l) aries GNU/Linux
[[email protected] ~]# pacman -Qs pacman
local/pacman 4.0.2-1.1 (base)
A library-based package manager with dependency support
local/pacman-mirrorlist 20120204-1 (base)
Arch Linux ARM mirror list for use by pacman
[[email protected] ~]# cat /proc/cmdline
console=ttySAC2,115200 loglevel=4 androidboot.serialno=313423849C8B00EC bootmode=0
[[email protected] ~]#
... but it would be nice to boot into Archlinux instead of ICS. I haven't compiled kernels for the phone before - is the root filesystem path hardcoded in the compile? The only thing I can find is this:
Code:
[[email protected] ~]# zcat /proc/config.gz |grep -i cmdline
CONFIG_CMDLINE="console=ttyFIQ0,115200 init=/init"
Of course, I would probably have to repartition whatever is the root partition. Perhaps I could repartition the internal SD card, give the partition a label and use that for root.
Any pointers? Thanks,
Edit: http://forum.xda-developers.com/showthread.php?t=999097#12206727
Aha. This might be difficult.

is it safe to fullow this tutorial

i have a teclast M20 4G M3K4 and I would like to root it found a link on the internet that explains how to do this would like your opinions
canot post link because i have no rights
AIDA64 for Android v1.66 Repo
<<< System >>>
Device Model: Teclast M20 4G
Device Type: Tablet
Manufacturer: techain
Model: M20_4G
Brand: Teclast
Board: mt6797
Device: M20_4G
Hardware: mt6797
Platform: mt6797
Product: M20_4G
Installed RAM: 4 GB LPDDR3
Total Memory: 3682 MB
Available Memory: 1887 MB
Internal Storage Total Space: 53.43 GB
Internal Storage Free Space: 49.40 GB
External Storage Total Space: 29.80 GB
External Storage Free Space: 21.95 GB
Bluetooth Version: 4.0
Device Features: android.hardware.audio.low_latency
android.hardware.audio.output
android.hardware.bluetooth
android.hardware.bluetooth_le
android.hardware.camera
android.hardware.camera.any
android.hardware.camera.autofocus
android.hardware.camera.front
android.hardware.faketouch
android.hardware.location
android.hardware.location.gps
android.hardware.location.network
android.hardware.microphone
android.hardware.opengles.aep
android.hardware.screen.landscape
android.hardware.screen.portrait
android.hardware.sensor.accelerometer
android.hardware.telephony
android.hardware.telephony.cdma
android.hardware.telephony.gsm
android.hardware.touchscreen
android.hardware.touchscreen.multitouch
android.hardware.touchscreen.multitouch.distinct
android.hardware.touchscreen.multitouch.jazzhand
android.hardware.usb.accessory
android.hardware.usb.host
android.hardware.vulkan.level
android.hardware.vulkan.version
android.hardware.wifi
android.hardware.wifi.direct
android.software.activities_on_secondary_displays
android.software.app_widgets
android.software.autofill
android.software.backup
android.software.companion_device_setup
android.software.connectionservice
android.software.cts
android.software.device_admin
android.software.home_screen
android.software.input_methods
android.software.live_wallpaper
android.software.managed_users
android.software.midi
android.software.picture_in_picture
android.software.print
android.software.voice_recognizers
android.software.webview
<<< CPU >>>
SoC Model: MediaTek Helio X20 (MT6797)
Core Architecture: 4x ARM Cortex-A53 @ 1391 MHz
4x ARM Cortex-A53
2x ARM Cortex-A72
Manufacturing Process: 20 nm
Instruction Set: 64-bit ARMv8-A
CPU Revision: r0p1
CPU Cores: 10
CPU Clock Range: 221 - 1391 MHz
Core 1 Clock: 1118 MHz
Core 2 Clock: 1118 MHz
Core 3 Clock: 1118 MHz
Core 4 Clock: (sleeping)
Core 5 Clock: (sleeping)
Core 6 Clock: (sleeping)
Core 7 Clock: (sleeping)
Core 8 Clock: (sleeping)
Core 9 Clock: (sleeping)
Core 10 Clock: (sleeping)
Scaling Governor: interactive
Supported ABIs: arm64-v8a, armeabi-v7a, armeabi
Supported 32-bit ABIs: armeabi-v7a, armeabi
Supported 64-bit ABIs: arm64-v8a
AES: Supported
NEON: Supported
SHA1: Supported
SHA2: Supported
<<< Display >>>
Screen Resolution: 2560 × 1600
Technology: IPS LCD
Screen Size: 218 mm × 136 mm
Screen Diagonal: 10.1 inches
Pixel Density: 299 dpi (xhdpi)
xdpi / ydpi: 320 / 320 dpi
GPU Vendor: ARM
GPU Renderer: Mali-T880
Refresh Rate: 57 Hz
Default Orientation: Landscape
OpenGL ES Version: 3.2
GPU Version: OpenGL ES 3.2 v1.r20p0-01rel0.d174d1328b67c542941eec67baa38e6a
OpenGL ES Extensions: GL_EXT_debug_marker
GL_ARM_rgba8
GL_ARM_mali_shader_binary
GL_OES_depth24
GL_OES_depth_texture
GL_OES_depth_texture_cube_map
GL_OES_packed_depth_stencil
GL_OES_rgb8_rgba8
GL_EXT_read_format_bgra
GL_OES_compressed_paletted_texture
GL_OES_compressed_ETC1_RGB8_texture
GL_OES_standard_derivatives
GL_OES_EGL_image
GL_OES_EGL_image_external
GL_OES_EGL_image_external_essl3
GL_OES_EGL_sync
GL_OES_texture_npot
GL_OES_vertex_half_float
GL_OES_required_internalformat
GL_OES_vertex_array_object
GL_OES_mapbuffer
GL_EXT_texture_format_BGRA8888
GL_EXT_texture_rg
GL_EXT_texture_type_2_10_10_10_REV
GL_OES_fbo_render_mipmap
GL_OES_element_index_uint
GL_EXT_shadow_samplers
GL_OES_texture_compression_astc
GL_KHR_texture_compression_astc_ldr
GL_KHR_texture_compression_astc_hdr
GL_KHR_texture_compression_astc_sliced_3d
GL_KHR_debug
GL_EXT_occlusion_query_boolean
GL_EXT_disjoint_timer_query
GL_EXT_blend_minmax
GL_EXT_discard_framebuffer
GL_OES_get_program_binary
GL_OES_texture_3D
GL_EXT_texture_storage
GL_EXT_multisampled_render_to_texture
GL_OES_surfaceless_context
GL_OES_texture_stencil8
GL_EXT_shader_pixel_local_storage
GL_ARM_shader_framebuffer_fetch
GL_ARM_shader_framebuffer_fetch_depth_stencil
GL_ARM_mali_program_binary
GL_EXT_sRGB
GL_EXT_sRGB_write_control
GL_EXT_texture_sRGB_decode
GL_EXT_texture_sRGB_R8
GL_EXT_texture_sRGB_RG8
GL_KHR_blend_equation_advanced
GL_KHR_blend_equation_advanced_coherent
GL_OES_texture_storage_multisample_2d_array
GL_OES_shader_image_atomic
GL_EXT_robustness
GL_EXT_draw_buffers_indexed
GL_OES_draw_buffers_indexed
GL_EXT_texture_border_clamp
GL_OES_texture_border_clamp
GL_EXT_texture_cube_map_array
GL_OES_texture_cube_map_array
GL_OES_sample_variables
GL_OES_sample_shading
GL_OES_shader_multisample_interpolation
GL_EXT_shader_io_blocks
GL_OES_shader_io_blocks
GL_EXT_tessellation_shader
GL_OES_tessellation_shader
GL_EXT_primitive_bounding_box
GL_OES_primitive_bounding_box
GL_EXT_geometry_shader
GL_OES_geometry_shader
GL_ANDROID_extension_pack_es31a
GL_EXT_gpu_shader5
GL_OES_gpu_shader5
GL_EXT_texture_buffer
GL_OES_texture_buffer
GL_EXT_copy_image
GL_OES_copy_image
GL_EXT_shader_non_constant_global_initializers
GL_EXT_color_buffer_half_float
GL_EXT_color_buffer_float
GL_EXT_YUV_target
GL_OVR_multiview
GL_OVR_multiview2
GL_OVR_multiview_multisampled_render_to_texture
GL_KHR_robustness
GL_KHR_robust_buffer_access_behavior
GL_EXT_draw_elements_base_vertex
GL_OES_draw_elements_base_vertex
<<< Network >>>
<< Telephony >>
Phone Type: GSM
Network Operator Name: Oi
Network Operator Code: 72431
Network Operator Country: Brazil
SIM Provider Name: Oi
SIM Provider Code: 72431
SIM Provider Country: Brazil
SIM State: Ready
Network Type: EDGE
Data Connection State: Disconnected
Data Activity: None
Device Is Roaming: No
ICC Card: Present
<< Wi-Fi >>
State: Enabled
SSID: "casa1"
BSSID: ec:08:6b:e0:3e:e7
Hidden SSID: No
IPv4 Address: 192.168.1.102
IPv6 Address: fe80::200:3ff:fe22:28f9
Signal Strength: -70 dBm (Good)
Link Speed: 52 Mbps
Frequency: 2457 MHz
Network ID: 0
Gateway: 192.168.1.1
Netmask: 255.255.255.0
DNS1: 8.8.8.8
DNS2: 8.8.4.4
DHCP Lease Duration: 24 hours
5 GHz Band: Supported
Wi-Fi Aware: Not Supported
Wi-Fi Direct: Supported
<<< Battery >>>
Power Source: Battery
Level: 50 %
Status: Not Charging
Health: Good
Technology: Li-ion
Temperature: 25.0°C
Voltage: 3.765 V
Charge Counter: 6400 mAh
Discharge Rate: 533 mA
Capacity: 6600 mAh
<<< Android >>>
Android Version: 8.0.0 (Oreo)
API Level: 26
Android Security Patch Level: 2018-06-05
Rooted Device: No
Android ID: b640aeefa323aa7e
Baseband: MOLY.LR11.W1630.MD.MP.V67.2, 2018/04/02 17:50
Build ID: V1.02_20190223
Codename: REL
Fingerprint: CHUWI/Hi9Air/Hi9Air:8.0.0/O00623/1520042099:user/release-keys
ID: O00623
Incremental: 1520042099
Java Runtime Version: Android Runtime 0.9
Java VM Version: ART 2.1.0
Java VM Heap Size: 384 MB
Kernel Architecture: aarch64
Kernel Version: 3.18.60
Tags: release-keys
Type: user
Google Play Services Version: 19.6.29 (040406-278422107)
Huawei Mobile Services Version: < Not Present >
OpenSSL Version: OpenSSL 1.0.2 (compatible; BoringSSL)
ZLib Version: 1.2.8
ICU CLDR Version: 30.0.3
ICU Library Version: 58.2
ICU Unicode Version: 9.0
Android Language: English (United States)
Configured Time Zone: Brasilia Standard Time (UTC-03:00)
UpTime: 01:08:50
<<< Devices >>>
<< Rear-Facing Camera >>
Resolution: 5.0 MP (2592 × 1944)
Focal Length: 3.50 mm
Focus Modes: auto, macro, infinity, continuous-picture, continuous-video
Video Stabilization: Supported
Zoom: Supported
Auto Exposure Locking: Supported
Auto White Balance Locking: Supported
Flash: Not Supported
<< Front-Facing Camera >>
Resolution: 2.1 MP (1920 × 1088)
Focal Length: 3.50 mm
Focus Modes: fixed, infinity
Video Stabilization: Supported
Zoom: Supported
Auto Exposure Locking: Supported
Auto White Balance Locking: Supported
Flash: Not Supported
<< Vulkan Device - Mali-T880 >>
Device Name: Mali-T880
Device Type: Integrated GPU
Device UUID: C5-18-34-CB-95-43-3E-BE-3B-53-73-BF-A4-4B-EC-E2
Device ID: 000013B5-08801008
Memory Size: 3768076 KB
Max 1D Image Size: 8192
Max 2D Image Size: 8192 x 8192
Max 3D Image Size: 4096 x 4096 x 4096
Max Cube Image Size: 8192 x 8192
Max Image Layers: 256
Max Texel Buffer Elements: 65536
Max Uniform Buffer Range: 65536
Max Storage Buffer Range: 134217728
Max Push Constants Size: 128 bytes
Buffer Image Granularity: 4 KB
Max Bound Descriptor Sets: 4
Max Per-Stage Descriptor Samplers: 128
Max Per-Stage Descriptor Uniform Buffers: 12
Max Per-Stage Descriptor Storage Buffers: 4
Max Per-Stage Descriptor Sampled Images: 16
Max Per-Stage Descriptor Storage Images: 4
Max Per-Stage Descriptor Input Attachments: 4
Max Per-Stage Resources: 44
Max Descriptor Set Samplers: 768
Max Descriptor Set Uniform Buffers: 72
Max Descriptor Set Dynamic Uniform Buffers: 8
Max Descriptor Set Storage Buffers: 24
Max Descriptor Set Dynamic Storage Buffers: 4
Max Descriptor Set Sampled Images: 96
Max Descriptor Set Storage Images: 24
Max Descriptor Set Input Attachments: 4
Max Vertex Input Attributes: 16
Max Vertex Input Bindings: 16
MaxVertex Input Attribute Offset: 2047
Max Vertex Input Binding Stride: 2048
Max Vertex Output Components: 128
Max Tesselation Generation Level: 64
Max Tesselation Patch Size: 32
Max Tesselation Control Per-Vertex Input Components: 64
Max Tesselation Control Per-Vertex Output Components: 64
Max Tesselation Control Per-Patch Output Components: 120
Max Tesselation Control Total Output Components: 2048
Max Tesselation Evaluation Input Components: 64
Max Tesselation Evaluation Output Components: 64
Max Geometry Shader Invocations: 32
Max Geometry Input Components: 64
Max Geometry Output Components: 128
Max Geometry Output Vertices: 256
Max Geometry Total Output Components: 1024
Max Fragment Input Components: 128
Max Fragment Output Attachments: 4
Max Fragment Combined Output Resources: 12
Max Compute Shared Memory Size: 32 KB
Max Compute Work Group Count: X: 65536, Y: 65536, Z: 65536
Max Compute Work Group Invocations: 256
Max Compute Work Group Size: X: 256, Y: 256, Z: 256
Subpixel Precision Bits: 8
Subtexel Precision Bits: 8
Mipmap Precision Bits: 8
Max Draw Indexed Index Value: 4294967295
Max Draw Indirect Count: 1
Max Sampler LOD Bias: 2.000000
Max Sampler Anisotropy: 1.000000
Max Viewports: 1
Max Viewport Size: 8192 x 8192
Viewport Bounds Range: -16384.000000 ... 16383.000000
Min Memory Map Alignment: 64 bytes
Min Texel Buffer Offset Alignment: 256 bytes
Min Uniform Buffer Offset Alignment: 16 bytes
Min Storage Buffer Offset Alignment: 256 bytes
Min / Max Texel Offset: -8 / 7
Min / Max Texel Gather Offset: -8 / 7
Min / Max Interpolation Offset: -0.500000 / 0.500000
Subpixel Interpolation Offset Bits: 4
Max Framebuffer Size: 8192 x 8192
Max Framebuffer Layers: 256
Framebuffer Color Sample Counts: 0x00000005
Framebuffer Depth Sample Counts: 0x00000005
Framebuffer Stencil Sample Counts: 0x00000005
Framebuffer No Attachments Sample Counts: 0x00000005
Max Color Attachments: 4
Sampled Image Color Sample Counts: 0x00000005
Sampled Image Integer Sample Counts: 0x00000001
Sampled Image Depth Sample Counts: 0x00000005
Sampled Image Stencil Sample Counts: 0x00000005
Storage Image Sample Counts: 0x00000001
Max Sample Mask Words: 1
Discrete Queue Priorities: 2
Point Size Range: 1.000000 ... 1024.000000
Line Width Range: 1.000000 ... 1.000000
Point Size Granularity: 0.062500
Optimal Buffer Copy Offset Alignment: 64 bytes
Optimal Buffer Copy Row Pitch Alignment: 64 bytes
Non-Coherent Atom Size: 64 bytes
Driver Version: 313.546.569
API Version: 1.0.52
Vulkan Library: /system/lib64/libvulkan.so
Alpha To One: Not Supported
Anisotropic Filtering: Not Supported
ASTC LDR Texture Compression: Supported
BC Texture Compression: Not Supported
Depth Bias Clamping: Supported
Depth Bounds Tests: Not Supported
Depth Clamping: Not Supported
Draw Indirect First Instance: Supported
Dual Source Blend Operations: Not Supported
ETC2 and EAC Texture Compression: Supported
Fragment Stores and Atomics: Supported
Full Draw Index Uint32: Supported
Geometry Shader: Supported
Image Cube Array: Supported
Independent Blend: Supported
Inherited Queries: Not Supported
Large Points: Supported
Logic Operations: Not Supported
Multi-Draw Indirect: Not Supported
Multi Viewport: Not Supported
Occlusion Query Precise: Supported
Pipeline Statistics Query: Not Supported
Point and Wireframe Fill Modes: Not Supported
Robust Buffer Access: Supported
Sample Rate Shading: Supported
Shader Clip Distance: Not Supported
Shader Cull Distance: Not Supported
Shader Float64: Not Supported
Shader Image Gather Extended: Supported
Shader Int16: Supported
Shader Int64: Not Supported
Shader Resource Min LOD: Not Supported
Shader Resource Residency: Not Supported
Shader Sampled Image Array Dynamic Indexing: Supported
Shader Storage Buffer Array Dynamic Indexing: Supported
Shader Storage Image Array Dynamic Indexing: Supported
Shader Storage Image Extended Formats: Not Supported
Shader Storage Image Multisample: Not Supported
Shader Storage Image Read Without Format: Supported
Shader Storage Image Write Without Format: Supported
Shader Tesselation and Geometry Point Size: Not Supported
Shader Uniform Buffer Array Dynamic Indexing: Supported
Sparse Binding: Not Supported
Sparse Residency 2 Samples: Not Supported
Sparse Residency 4 Samples: Not Supported
Sparse Residency 8 Samples: Not Supported
Sparse Residency 16 Samples: Not Supported
Sparse Residency Aliased: Not Supported
Sparse Residency Aligned Mip Size: No
Sparse Residency Buffer: Not Supported
Sparse Residency Image 2D: Not Supported
Sparse Residency Image 3D: Not Supported
Sparse Residency Non-Resident Strict: No
Sparse Residency Standard 2D Block Shape: No
Sparse Residency Standard 2D Multisample Block Shape: No
Sparse Residency Standard 3D Block Shape: No
Standard Sample Locations: Yes
Strict Line Rasterization: Yes
Tesselation Shader: Supported
Timestamps on All Graphics and Compute Queues: Not Supported
Variable Multisample Rate: Not Supported
Vertex Pipeline Stores and Atomics: Not Supported
Wide Lines: Not Supported
Device Extensions: VK_KHR_incremental_present
VK_GOOGLE_display_timing
VK_KHR_maintenance1
VK_KHR_shader_draw_parameters
VK_KHR_swapchain
Instance Extensions: VK_KHR_surface
VK_KHR_android_surface
VK_EXT_swapchain_colorspace
VK_KHR_get_surface_capabilities2
VK_EXT_debug_report
VK_KHR_get_physical_device_properties2
No USB devices found.
No OpenCL devices found.
No CUDA devices found.
No PCI devices found.
<<< Thermal >>>
Battery: 25.0°C
<<< Sensors >>>
ACCELEROMETER:
<<< Apps >>>
AIDA64: com.finalwire.aida64(v1.66)
AnimeDLR: net.android.adm(v6.0.1)
Dashlane: com.dashlane(v6.1946.2-arm64-v8a)
Firefox Nightly: org.mozilla.fenix.nightly(vNightly 191117 06:00)
Rastreador: app.rmayrink.Rastreador_de_Encomendas(v1.9.9)
TuneIn Radio Pro: radiotime.player(v23.2)
WhatsApp: com.whatsapp(v2.19.333)
<<< Codecs >>>
OMX.MTK.AUDIO.DECODER.MP3: audio/mpeg
OMX.MTK.AUDIO.DECODER.GSM: audio/gsm
OMX.MTK.AUDIO.DECODER.RAW: audio/raw
OMX.MTK.AUDIO.DECODER.G711.ALAW: audio/g711-alaw
OMX.MTK.AUDIO.DECODER.G711.MLAW: audio/g711-mlaw
OMX.MTK.AUDIO.DECODER.ADPCM.MS: audio/x-adpcm-ms
OMX.MTK.AUDIO.DECODER.ADPCM.DVI: audio/x-adpcm-dvi-ima
OMX.MTK.AUDIO.DECODER.APE: audio/ape
OMX.MTK.AUDIO.DECODER.ALAC: audio/alac
OMX.MTK.VIDEO.DECODER.HEVC: video/hevc
OMX.MTK.VIDEO.DECODER.MPEG4: video/mp4v-es
OMX.MTK.VIDEO.DECODER.H263: video/3gpp
OMX.MTK.VIDEO.DECODER.AVC: video/avc
OMX.MTK.VIDEO.DECODER.VPX: video/x-vnd.on2.vp8
OMX.MTK.VIDEO.DECODER.VP9: video/x-vnd.on2.vp9
OMX.MTK.VIDEO.DECODER.DIVX: video/divx
OMX.MTK.VIDEO.DECODER.DIVX3: video/divx3
OMX.MTK.VIDEO.DECODER.XVID: video/xvid
OMX.MTK.VIDEO.DECODER.VC1: video/x-ms-wmv
OMX.MTK.VIDEO.DECODER.MPEG2: video/mpeg2
OMX.MTK.VIDEO.ENCODER.MPEG4: video/mp4v-es
OMX.MTK.VIDEO.ENCODER.H263: video/3gpp
OMX.MTK.VIDEO.ENCODER.AVC: video/avc
OMX.MTK.VIDEO.ENCODER.HEVC: video/hevc
OMX.MTK.VIDEO.ENCODER.VPX: video/x-vnd.on2.vp8
OMX.google.mp3.decoder: audio/mpeg
OMX.google.amrnb.decoder: audio/3gpp
OMX.google.amrwb.decoder: audio/amr-wb
OMX.google.aac.decoder: audio/mp4a-latm
OMX.google.g711.alaw.decoder: audio/g711-alaw
OMX.google.g711.mlaw.decoder: audio/g711-mlaw
OMX.google.vorbis.decoder: audio/vorbis
OMX.google.opus.decoder: audio/opus
OMX.google.raw.decoder: audio/raw
OMX.google.aac.encoder: audio/mp4a-latm
OMX.google.amrnb.encoder: audio/3gpp
OMX.google.amrwb.encoder: audio/amr-wb
OMX.google.flac.encoder: audio/flac
OMX.google.mpeg4.decoder: video/mp4v-es
OMX.google.h263.decoder: video/3gpp
OMX.google.h264.decoder: video/avc
OMX.google.hevc.decoder: video/hevc
OMX.google.vp8.decoder: video/x-vnd.on2.vp8
OMX.google.vp9.decoder: video/x-vnd.on2.vp9
OMX.google.h263.encoder: video/3gpp
OMX.google.h264.encoder: video/avc
OMX.google.mpeg4.encoder: video/mp4v-es
OMX.google.vp8.encoder: video/x-vnd.on2.vp8
<<< Directories >>>
Data: /data
Root: /system
Java Home: /system
Download/Cache Content: /data/cache
<< External Storage >>
Primary External Storage: /storage/emulated/0
External Files #1: /storage/emulated/0/Android/data/com.finalwire.aida64/files
External Files #2: /storage/C2E0-1DEA/Android/data/com.finalwire.aida64/files
Alarms: /storage/emulated/0/Alarms
DCIM: /storage/emulated/0/DCIM
Downloads: /storage/emulated/0/Download
Movies: /storage/emulated/0/Movies
Music: /storage/emulated/0/Music
Notifications: /storage/emulated/0/Notifications
Pictures: /storage/emulated/0/Pictures
Podcasts: /storage/emulated/0/Podcasts
Ringtones: /storage/emulated/0/Ringtones
<< Mount Points >>
/: Device: rootfs
File System: rootfs
Read-Only
/dev: Device: tmpfs
File System: tmpfs
Read-Write
/dev/pts: Device: devpts
File System: devpts
Read-Write
/dev/cpuctl: Device: none
File System: cgroup
Read-Write
/dev/cpuset: Device: none
File System: cgroup
Read-Write
/dev/usb-ffs/adb: Device: adb
File System: functionfs
Read-Write
/proc: Device: proc
File System: proc
Read-Write
/sys: Device: sysfs
File System: sysfs
Read-Write
/sys/fs/selinux: Device: selinuxfs
File System: selinuxfs
Read-Write
/sys/kernel/debug: Device: debugfs
File System: debugfs
Read-Write
/sys/kernel/debug/tracing: Device: tracefs
File System: tracefs
Read-Write
/sys/fs/pstore: Device: pstore
File System: pstore
Read-Write
/system: Device: /dev/block/dm-0
File System: ext4
Read-Only
/vendor: Device: /dev/block/dm-1
File System: ext4
Read-Only
/acct: Device: none
File System: cgroup
Read-Write
/mnt: Device: tmpfs
File System: tmpfs
Read-Write
/mnt/runtime/default/emulated: Device: /data/media
File System: sdcardfs
Read-Write
/mnt/runtime/read/emulated: Device: /data/media
File System: sdcardfs
Read-Write
/mnt/runtime/write/emulated: Device: /data/media
File System: sdcardfs
Read-Write
/mnt/media_rw/C2E0-1DEA: Device: /dev/block/vold/public:179,129
File System: vfat
Read-Write
/mnt/runtime/default/C2E0-1DEA: Device: /mnt/media_rw/C2E0-1DEA
File System: sdcardfs
Read-Write
/mnt/runtime/read/C2E0-1DEA: Device: /mnt/media_rw/C2E0-1DEA
File System: sdcardfs
Read-Write
/mnt/runtime/write/C2E0-1DEA: Device: /mnt/media_rw/C2E0-1DEA
File System: sdcardfs
Read-Write
/config: Device: none
File System: configfs
Read-Write
/cache: Device: /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/cache
File System: ext4
Read-Write
/protect_f: Device: /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect1
File System: ext4
Read-Write
/protect_s: Device: /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/protect2
File System: ext4
Read-Write
/nvdata: Device: /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvdata
File System: ext4
Read-Write
/nvcfg: Device: /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvcfg
File System: ext4
Read-Write
/data: Device: /dev/block/dm-2
File System: ext4
Read-Write
/storage: Device: tmpfs
File System: tmpfs
Read-Write
/storage/emulated: Device: /data/media
File System: sdcardfs
Read-Write
/storage/C2E0-1DEA: Device: /mnt/media_rw/C2E0-1DEA
File System: sdcardfs
Read-Write
/storage/self: Device: tmpfs
File System: tmpfs
Read-Write
<<< System Files >>>
Buddy Info: /proc/buddyinfo
Build Properties: /system/build.prop
Character & Block Devices: /proc/devices
Command Line: /proc/cmdline
CPU Information: /proc/cpuinfo
Default Properties: /default.prop
Execution Domains: /proc/execdomains
File Systems: /proc/filesystems
Frame Buffer Devices: /proc/fb
Hosts: /system/etc/hosts
Interrupts: /proc/interrupts
Input Devices: /proc/bus/input/devices
I/O Ports: /proc/ioports
Kernel Version: /proc/version
Load Average: /proc/loadavg
Locked Files: /proc/locks
Memory Information: /proc/meminfo
Memory Map: /proc/iomem
Misc Drivers: /proc/misc
Partitions: /proc/partitions
Statistics: /proc/stat
Swap Spaces: /proc/swaps
serial number:SN811SN8112H184641652

Question Which partition is loaded first? in Oneplus 9 pro

I extracted the ops file from onepluscommunityserver.
Now I have a copy of our partition of my oneplus phone.
Which partition is loaded first.
list partition (file *)
DRIVER.ISO: ISO 9660 CD-ROM filesystem data '20150310_103042'
abl.elf: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, no section header
aop.mbn: ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, no section header
cpucp.elf: ELF 32-bit LSB executable, UCB RISC-V, version 1 (SYSV), statically linked, no section header
multi_image.mbn: ELF 32-bit LSB no file type, ARM, version 1 (SYSV)
qupv3fw.elf: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), statically linked, no section header
shrm.elf: ELF 32-bit LSB executable, Tensilica Xtensa, version 1 (SYSV), statically linked, no section header
storsec.mbn: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, no section header
uefi_sec.mbn: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, no section header
apdp.mbn: ELF 64-bit LSB no file type, ARM, version 1 (SYSV)
devcfg.mbn: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, no section header
featenabler.mbn: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, no section header
hypvm.mbn: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, no section header
km41.mbn: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, no section header
mdcompress.mbn: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, no section header
prog_firehose_ddr.elf: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, no section header
prog_firehose_lite.elf: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, no section header
rtice.mbn: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, no section header
sec.elf: ELF 64-bit LSB no file type, ARM, version 1 (SYSV)
xbl.elf: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, no section header
xbl_config.elf: ELF 64-bit LSB executable, AT&T WE32100, version 1 (SYSV), statically linked, no section header
tz.mbn: ELF 64-bit LSB executable, ARM aarch64, version 1 (GNU/Linux), statically linked, no section header
dspso.bin: Linux rev 1.0 ext4 filesystem data, UUID=af32c008-2a39-7e5b-a5dc-201456d93103, volume name "dsp" (extents) (large files)
metadata.img: Linux rev 1.0 ext4 filesystem data, UUID=c2f8585a-08b5-4d20-b07c-60b309998030 (extents) (large files) (huge files)
persist.img: Linux rev 1.0 ext4 filesystem data, UUID=1dac5d81-33ca-4a59-9947-9cd94eb010fd (extents) (large files) (huge files)
#Partitions in super.img
odm.img: Linux rev 1.0 ext2 filesystem data, UUID=77ca2d3f-a5c4-5835-bda8-1b80c49c79b9, volume name "odm" (extents) (large files) (huge files)
product.img: Linux rev 1.0 ext2 filesystem data, UUID=e5979201-03d0-5d06-bfe6-2f22e88acda2, volume name "product" (extents) (large files) (huge files)
system.img: Linux rev 1.0 ext2 filesystem data, UUID=81cb80e9-4499-5b28-af79-a719c3610a45 (extents) (large files) (huge files)
system_ext.img: Linux rev 1.0 ext2 filesystem data, UUID=e21cf01c-3cd4-55ad-b8b5-50a3403283ae, volume name "system_ext" (extents) (large files) (huge files)
vendor.img: Linux rev 1.0 ext2 filesystem data, UUID=3bc1e464-718e-5437-a242-1e28a67b800d, volume name "vendor" (extents) (large files) (huge files)
gpt_main0.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
gpt_main1.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
gpt_main2.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
gpt_main3.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
gpt_main4.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
gpt_main5.bin: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
spunvm.bin: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 3, sectors/track 63, heads 255, sectors 16384 (volumes > 32 MB), serial number 0xbc614e, unlabeled, FAT (16 bit)
logfs_ufs_8mb.bin: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, root entries 512, sectors 1280 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 1, sectors/track 1, heads 1, hidden sectors 16, serial number 0xd27355ea, unlabeled, FAT (12 bit)
BTFM.bin: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 3, sectors/track 63, heads 255, sectors 16384 (volumes > 32 MB), serial number 0xbc614e, unlabeled, FAT (16 bit)
NON-HLOS.bin: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", Bytes/sector 4096, sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 11, sectors/track 63, heads 255, sectors 84480 (volumes > 32 MB), serial number 0xbc614e, unlabeled, FAT (16 bit)
opluslog.img: Android sparse image, version: 1.0, Total of 65536 4096-byte output blocks in 10 input chunks.
oplusreserve2.img: Android sparse image, version: 1.0, Total of 32768 4096-byte output blocks in 4 input chunks.
boot.img: Android bootimg, kernel (0x1060e7c), ramdisk (0x62c)
carrier.img: Android sparse image, version: 1.0, Total of 12288 4096-byte output blocks in 4 input chunks.
super.img: Android sparse image, version: 1.0, Total of 2732032 4096-byte output blocks in 331 input chunks.
vm-bootsys.img: Android sparse image, version: 1.0, Total of 65917 4096-byte output blocks in 30 input chunks.
userdata.img: Android sparse image, version: 1.0, Total of 11796480 4096-byte output blocks in 30 input chunks.
abl_log.bin: data/Unknown
android_log.bin: data/Unknown
devinfo.bin: data/Unknown
dtbo.img: data/Unknown
emmc_fw.bin: data/Unknown
engineering_cdt.img: data/Unknown
frp.bin: data/Unknown
gpt_backup0.bin: data/Unknown
gpt_backup1.bin: data/Unknown
gpt_backup2.bin: data/Unknown
gpt_backup3.bin: data/Unknown
gpt_backup4.bin: data/Unknown
gpt_backup5.bin: data/Unknown
hyp_log.bin: data/Unknown
imagefv.elf: data/Unknown
kernel_log16M.bin: data/Unknown
misc.bin: data/Unknown
ocdt.bin: data/Unknown
oem_stanvbk.bin: data/Unknown
oplus_sec.mbn: data/Unknown
param.bin: data/Unknown
qweslicstore.bin: data/Unknown
qsee_log.bin: data/Unknown
splash.img: data/Unknown
vbmeta.img: data/Unknown
vbmeta_system.img: data/Unknown
vbmeta_vendor.img: data/Unknown
vendor_boot.img: data/Unknown

What are you trying to achieve?

I'm trying to understand how it works.
Like windows, it starts from the fat32 partition and loads the c drive.
I just want information on how it starts.

I'm trying to understand how it works.
Like windows, it starts from the fat32 partition and loads the c drive.
I just want information on how it starts.

Can anyone answer me these questions? What does this mean? DOS / MBR boot sector; partition 1: ID = 0xee, start-CHS (0x0,0,1), end-CHS (0x3ff, 255,63), start sector 1, 4294967295 sectors, extended partition table (last)