The Epic Development Platform AKA UnBrickable Mod

Search This thread

Fatonuseni

Senior Member
Sep 5, 2010
298
39
Well...after visiting about 3 corporate Sprint stores in my area, I was still unable to obtain a bricked device donated/sold to me. They explained to me any and all devices that are returned are immediately shipped back to the manufacturer (which I say is BS) so they didn't have any (bricked) devices in stock at all. They also explained that even if they had such a device lying around, they would have to charge me for it like any other Sprint customer. They said they couldn't even give me a device even if it were physically broken, with a bad ESN, and it being bricked :\ I'll keep bugging tho, someone's bound to break soon n just give one up

Sent from my SPH-D700 using xda premium

Don't we have sprint store employees in the forum? Maybe one them can stepup and donate a phone?

Otherwise, I pledge $20 toward getting a test phone for Adam!

Sent from my SPH-D700 using xda premium
 

squshy 7

Senior Member
Dec 6, 2010
1,414
450
Well...after visiting about 3 corporate Sprint stores in my area, I was still unable to obtain a bricked device donated/sold to me. They explained to me any and all devices that are returned are immediately shipped back to the manufacturer (which I say is BS) so they didn't have any (bricked) devices in stock at all. They also explained that even if they had such a device lying around, they would have to charge me for it like any other Sprint customer. They said they couldn't even give me a device even if it were physically broken, with a bad ESN, and it being bricked :\ I'll keep bugging tho, someone's bound to break soon n just give one up

Sent from my SPH-D700 using xda premium

That policy is not BS. What do you think we do, horde piles of bricked phones?

The official policy is we have inventoried boxes with 50-slot cardboard separators inside that we fill up. Once full, we ship them to a central warehouse. I work in only a mild traffic service shop, and we still typically fill up a box in less than a week (you wouldn't believe the amount of charging ports people break).

Another thing you need to consider is that all of those phones are in inventory. The only way for someone to give you one of those phones is if they were to adjust it out; adjusting out, however, means that we take a hit on points come audit time.

So, don't hold your breath. No ones gonna put their job at risk.

Sent from my SPH-D710 using xda premium
 

ThrIsNoSpork

Senior Member
Jun 28, 2010
143
26
Agreed. I work at best buy and if we don't ship anything within 15 days of receiving the product it becomes a loss to our store revenue and people don't take that **** lightly.

If I could help I would but its not worth losing my job.

Sent from my SPH-D700 using XDA App
 

WhiteWidows

Senior Member
Jul 27, 2009
839
240
I have one im willing to let him use. The screen is cracked and waiting for a fellow member to send me a new one. The screen works its just cracked on the outer layer. If Adam just needs to use it to mod it then return it id be glad to donate it for a lil while for the community. Adam pm me if ur interested.
 

nubecoder

Inactive Recognized Developer
Dec 5, 2010
569
556
I have one im willing to let him use. The screen is cracked and waiting for a fellow member to send me a new one. The screen works its just cracked on the outer layer. If Adam just needs to use it to mod it then return it id be glad to donate it for a lil while for the community. Adam pm me if ur interested.
Yes, do this, that would be super!

Thanks in advance.

=]
 

GucciPilot

Senior Member
Nov 22, 2007
85
2
I think what we should do, is tell all the new-B's who shouldn't hack their phones, that their bootloop is a permabrick and they should send their phone to Adam!

Sent from my SPH-D700 using Tapatalk
 

zman519

Senior Member
Oct 27, 2010
2,240
255
the Land of Beer & Cheese
We should all check the recycling bins at best buys & target. I found an iPod in one & got a new screen for $9.87


Sent from the Drivers Seat of my Suby txting and Driving doing 100MPH+ in a school zone! Ha.
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
So we have software now? :D and does anyone else have a spare epic to send Adam to write a detailed guide for us?

I wrote up a new resurrector for this. Apparently the Epic has a S5PC111 processor, which is the same as the Galaxy Player. This requires a slightly different SBL. I've included this in the newest version of the resurrector.

resurrector.png


Select S5PC111 and hold the download mode key combination when you click the Resurrection button. It should work. I'm waiting for confirmation before I do a writeup and ask rebellos to modify the SBL for automatic mode without having to hold the button combination.

Someone with an UnBrickable device please test this.

You can get this new resurrector here: http://code.google.com/p/hummingbird-hibl/downloads/detail?name=UltimateUnBrickResurrectornew.jar

I don't have a device to test with, so please leave feedback.
 
  • Like
Reactions: ac16313

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
OK.. I have an Epic in my hands. I just performed the modification and could not get it to work. It says here that OM=0x29,
Code:
Communications established
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused version.
s5p_get_average_adc
s5p_get_average_adc: adc_arr = 2366
s5p_get_average_adc: adc_arr = 2359
s5p_get_average_adc: adc_arr = 2361                     
s5p_get_average_adc: adc_arr = 2330                     
s5p_get_average_adc: adc_arr = 2325                     
s5p_get_average_adc: adc_arr = 2362                     
s5p_get_average_adc: adc_arr = 2340                     
s5p_get_average_adc: adc_arr = 2488
s5p_get_average_adc: adc_arr = 2396
s5p_get_average_adc: adc_arr = 2400
s5p_get_average_adc: adc_max = 2488, adc_min = 2325
check_revision: REVISION_ADC_VALUE = 2294

-----------------------------------------------------------
   Samsung Secondary Bootloader (SBL) v3.0
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010

   Board Name: ARIES REV 02
   Build On: Oct 14 2010 07:13:43                                               
-----------------------------------------------------------                     
                                                                                
Re_partition: magic code(0xffffffff)                                            
[PAM:   ] ++FSR_PAM_Init                                                        
[PAM:   ]   OneNAND physical base address       : 0xb0000000                    
[PAM:   ]   OneNAND virtual  base address       : 0xb0000000                    
[PAM:   ]   OneNAND nMID=0xec : nDID=0x60                                       
[PAM:   ] --FSR_PAM_Init                                                        
fsr_bml_load_partition: pi->nNumOfPartEntry = 12                                
partitions loading success                                                      
board partition information update.. source: 0x0                                
.Done.                                                                          
read 1 units.                                                                   
==== PARTITION INFORMATION ====                                                 
 ID         : IBL+PBL (0x0)                                                     
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 0                                                                 
 NO_UNITS   : 1                                                                 
===============================                                                 
 ID         : PIT (0x1)                                                         
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 1                                                                 
 NO_UNITS   : 1                                                                 
===============================                                                 
 ID         : EFS (0x14)                                                        
 ATTR       : RW STL SLC (0x1101)                                               
 FIRST_UNIT : 2                                                                 
 NO_UNITS   : 40                                                                
===============================                                                 
 ID         : SBL (0x3)                                                         
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 42                                                                
 NO_UNITS   : 5                                                                 
===============================                                                 
 ID         : SBL2 (0x4)                                                        
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 47                                                                
 NO_UNITS   : 5                                                                 
===============================                                                 
 ID         : PARAM (0x15)                                                      
 ATTR       : RW STL SLC (0x1101)                                               
 FIRST_UNIT : 52                                                                
 NO_UNITS   : 20                                                                
===============================                                                 
 ID         : KERNEL (0x6)                                                      
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 72                                                                
 NO_UNITS   : 30                                                                
===============================                                                 
 ID         : RECOVERY (0x7)                                                    
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 102                                                               
 NO_UNITS   : 30                                                                
===============================                                                 
 ID         : FACTORYFS (0x16)                                                  
 ATTR       : RW STL SLC (0x1101)                                               
 FIRST_UNIT : 132                                                               
 NO_UNITS   : 1074                                                              
===============================                                                 
 ID         : DATAFS (0x17)                                                     
 ATTR       : RW STL SLC (0x1101)                                               
 FIRST_UNIT : 1206                                                              
 NO_UNITS   : 2056                                                              
===============================                                                 
 ID         : CACHE (0x18)                                                      
 ATTR       : RW STL SLC (0x1101)                                               
 FIRST_UNIT : 3262                                                              
 NO_UNITS   : 700                                                               
===============================                                                 
 ID         : MODEM (0xb)                                                       
 ATTR       : RO SLC (0x1002)                                                   
 FIRST_UNIT : 3962                                                              
 NO_UNITS   : 50                                                                
===============================                                                 
loke_init: j4fs_open success..                                                  
load_lfs_parameters valid magic code and version.                               
load_debug_level reading debug level from file successfully(0x574f4c44).        
init_fuel_gauge: vcell = 4166mV, soc = 91                                       
reading nps status file is successfully!.                                       
nps status=0x504d4f43                                                           
PMIC_IRQ1    = 0x28                                                             
PMIC_IRQ2    = 0x0                                                              
PMIC_IRQ3    = 0x0                                                              
PMIC_IRQ4    = 0x0                                                              
PMIC_STATUS1 = 0x40                                                             
PMIC_STATUS2 = 0x2c                                                             
get_debug_level current debug level is 0x574f4c44.                              
aries_process_platform: Debug Level Low                                         
keypad_scan: key value ----------------->= 0x0                                  
CONFIG_ARIES_REV:32 , CONFIG_ARIES_REV03:48                                     
aries_process_platform: final s1 booting mode = 0                               
AST_POWERON..                                                                   
DISPLAY_PATH_SEL[MDNIE 0x1]is on                                                
MDNIE setting Init start!!                                                      
vsync interrupt is off                                                          
video interrupt is off                                                          
[fb0] turn on                                                                   
MDNIE setting Init end!!                                                        
                                                                                
Autoboot (0 seconds) in progress, press any key to stop                         
get_debug_level current debug level is 0x574f4c44.                              
get_debug_level current debug level is 0x574f4c44.                              
boot_kernel: Debug Level Low                                                    
Load Partion idx = (6)                                                          
Loading Partion idx = (6)                                                       
..............................done                                              
Kernel read success from kernel partition no.6, idx.6.                          
setting param.serialnr=0x34338528 0xe2f900ec                                    
setting param.board_rev=0xb                                                     
setting param.cmdline=console=ttySAC2,115200 loglevel=4                         
                                                                                
Starting kernel at 0x32000000...
so the mod was performed correctly, however the USB_PHY0 is not enumerating properly. It should be connecting up and we should have a device to work with, but we dont.

Can anyone list all of the hidden key combinations this device uses? Is there a keyboard key which will power on the device or something?
 
  • Like
Reactions: ac16313

Top Liked Posts

  • There are no posts matching your filters.
  • 18
    This modification will go like this: http://xdaforums.com/showthread.php?t=1206216

    After that, unbricking your Epic will be like this...

    See here for full instructions: http://xdaforums.com/showthread.php?t=1242466

    Of course I don't OWN an Epic so I will work with someone who does.

    introduction
    I'm not kidding when I say UnBrickable. Modifying the OM pins means you can boot from USB, UART or MMC. This makes the phone quite UNBRICKABLE. There is nothing you can do software wise to prevent the device from booting into this mode. We are communicating with the unrewritable, efused IROM on the processor. It's the thing that makes the system on a chip into a "system on a chip".I am here now to tell you how to turn your Samsung Droid Charge into a KIT-S5PC110 development board. The KIT-S5PC110 development board is the platform used to develop our phones. There are some differences between this mod and the official development platform. The S5PC110 has a removable internal SDCard and no touchscreen.

    Why would you want to do this? When you plug in the battery and connect it to the computer in "off" mode, it will become an S5PC110 board awaiting download of a program to run. This occurs long before anything like software or firmware enters the processor. This is the IROM of the device awaiting commands or a power on signal.

    Because it is accepting a memory flash, anything may be put onto the device to perform a boot sequence..... Apple iOS (iPhone4 has the same processor) WP7 (mango supports this processor).

    This will be a replacement for JTAG once we are able to make some firmware. How could it possibly be better then JTAG? Let's count the ways....
    1. The only part required is a wire.
    2. No shipping time.
    3. No cost for a box to interface the computer.
    4. Permanent.
    5. Can be done as a preventive measure.
    6. Gives the ability to test new Bootloaders temporarily.
    7. Allows development of the entire system.
    8. Removes worry about flashing and acts as a backup.

    After performing this mod:
    Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like an Epic. See the Special Instructions section.

    Modification

    You will need:
    1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can also speak to myself(my username @gmail.com) or Connexion2005(aka MobileTechVideos.com)
    2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
    3. flux
    4. solder
    5. tweezers
    6. A relay (possibly- for the wire within to use as a bridge)


    performing the modification:
    1. tear apart your phone... Make sure to take out your SIM and external SDCard before you do this.
    1A. Remove the screws.
    1B. Separate the top case from the bottom case
    1C. disconnect the display connector and free the camera and button assemblies from the case.
    1D. Remove the mainboard

    ****VIDEO OR PICTURES NEEDED*****

    2. Perform the mod as follows: Replace the xOM5 resistor from the right position to the left position.
    *OR: remove the xOM5 resistor and jumper the center pads of xOM5 to the center pads of xOM0.


    2hf86zc.jpg


    Thanks to pre2epic4g for donating the board for teardown!
    23msar5.jpg


    3. reassemble the phone.


    Special Instructions

    • This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds.
    • To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
    • 3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.


    Conclusion

    Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software. See here for setting up the UART output http://xdaforums.com/showthread.php?t=1235219

    reading material
    Creating your own Samsung Bootloaders: http://xdaforums.com/showthread.php?t=1233273
    KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
    how to use DNW: http://tinyurl.com/dnw-how-to
    Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
    another DNW example: http://www.boardset.com/products/mv6410.php
    ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2


    drivers and utilities
    This will be an ever expanding list
    Windows Drivers http://xdaforums.com/attachment.php?attachmentid=678937&d=1312590673
    Windows Download Tool DNW: http://xdaforums.com/attachment.php?attachmentid=678938&d=1312590673
    Windows Command Line Download Tool: http://xdaforums.com/showpost.php?p=17202523&postcount=27
    Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2

    firmware
    One-Click Resurrector: http://xdaforums.com/attachment.php?attachmentid=705515&d=1314762609
    Bootloader Hello World by Rebellos http://xdaforums.com/attachment.php?attachmentid=698077&d=1314105521
    10
    I have one im willing to let him use. The screen is cracked and waiting for a fellow member to send me a new one. The screen works its just cracked on the outer layer. If Adam just needs to use it to mod it then return it id be glad to donate it for a lil while for the community. Adam pm me if ur interested.
    5
    So did this ever work out?

    Sent from my SPH-D700

    Im sending it today...
    4
    Ive been in contact with Adam..Im not going to wait for the screen to come in but everything works. Ill probably sent it tomorrow if feel better.
    3
    I'd like to chime in here...

    The reference to someone already sending an Epic to Adam.
    That did already happen, it was for the initial tear down to figure the mod out.
    But we still need a device to actually be modded and confirmed that it's working as expected.
    This is again where Adam comes in, he's done this for a few devices already, and has the ability to get changes (if needed) done to the software used to get this fully working and tested.
    He's also right about how small this stuff is (smaller than video card components), I know I wont ever be doing it, I'd be sending it to someone I know can.
    Let's not let this turn into a negative discussion. ;]

    All that being said, I've also been on the lookout for a cheap Epic this mod could be applied to.
    So far I missed out on what seems to have been the perfect opportunity from lack of funds.
    But I still check on ebay every now and again.

    [edit]
    That's crazy...enough to work! I'm gna call up all the local Sprint stores in my area tomorrow morning and ask. I'll report back tomorrow to share how my "mission" went :p
    [/edit]
    Best of luck to you on your mission!

    =]