UnBrickable SD necromancy- Totally restore your device.

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Hi guys. Ralekdev, Rebellos and Myself have become quite good at hacking the extra roxor out of Samsung devices. We started with The UnBrickable Mod which now spans 15 total devices on the Samsung Galaxy S series. The UnBrickable Mod turned the Galaxy S into a development board. So we moved on to sucessfuly hacking the Qualcomm bootloaders on the Verizon Galaxy S3 and while our exploits for this device have not yet been needed, we have them ready to deploy on several devices and we've learned alot. Today we would like to present to you:

UnBrickable SD-The ultimate in Exynos Necromancy
The UnBrickable SD allows for total resurrection of an otherwise hard-bricked and dead device. It takes a device-specific SDCard, and a jumper to be placed across a tiny resistor. This triggers the device to silently boot at which point it will count to 10 and reload the device's bootloaders. This uses Samsung Official firmware unlike UnBrickable SD Mod (unreleased as of the time of this post) which allows for dual-booting of custom and official.

Why would I need this?
The processor has a small bit of ROM called IROM that tries to initialize the EMMC to load SBOOT. SBOOT then fully initializes the EMMC(Internal and soldered down MMC chip) where it pulls boot parameters, partition tables and all other information for the device to boot. if the SBOOT is damaged, the device will no longer boot and Odin/Factory modes are destroyed and the device is hard-bricked. This failed boot means the device cannot function and is locked up.

How does UnBrickable SD work?
The UnBrickable SD works because the processor is configured to attempt to load SBOOT from EMMC and then fail-over to SD, and finally UART. We've prepared an SDCard via the sdcard command in SBOOT below. By disabling the EMMC during the IROM sequence, this device will automatically fail-over to SDCard boot, check the signatures, see a valid image, and reload the SBOOT onto the EMMC thus enabling Odin.

Instructions
You will need:

Once you have the required tools, we can begin the procedure.
  1. Create your UnBrickable SD.
    • Unzip the SDCard Image file from the zip.
    • Write it to an SDCard
      • Linux:
        Code:
        sudo dd if=GCAM-bootable-odin-from-sd-60mb-DDimg.img of=/dev/MYDEVICE
        where MYDEVICE is the sdcard (usually SDB or SDC
      • Windows: use this tool https://launchpad.net/win32-image-writer/ . I'm not going to explain because I use Linux.
  2. Disassemble the device
    I've prepared this video which shows how to disassemble the device. You can stop after you remove the LCD. Just pull the EM shields off after that so you can access the resistor.
  3. Insert the SDCard
    If you need instructions, you should have stopped long ago :)
  4. Short the EMMC Resistor
    You can use a pair of tweezers or a piece of wire, really anything to conduct electricity from one side of the resistor to the other. Below you can see some needles connected by a piece of wire which I use to short this resistor.
    attachment.php
  5. Press the power button wait a couple of seconds and release the short
    While booting, the device provides a 10 second countdown on the UART2 port. during this 10 second countdown, the EMMC needs to become enabled in order to write the bootloaders back to the device. The entire process takes 30 seconds and you will see nothing on the screen.
  6. Flash with Odin
    This procedure is the same as shown in the video below, however you will put the firmware from above in the PDA section instead of CF-AutoRoot and put the PIT from above into the PIT section

Conclusion
You have sucessfully restored your device to stock condition. Please hit the thanks button below this post.

Additional Resources
[R&D] Port SDCard Recovery to Other Exynos4412 Devices: http://xdaforums.com/showthread.php?t=1986887

Would you like to see the UnBrickable SD on your Exynos4 device (GS2, GNote, Gnote2)? I need a working device and a broken device to develop and test.
 

Attachments

  • GalaxyCameraUnBrickableSD.JPG
    GalaxyCameraUnBrickableSD.JPG
    356.4 KB · Views: 41,327
Last edited:

mfsr98

Senior Member
Nov 26, 2011
1,231
291
Porto
What kind of image do you use for restoring the device? Just the stock one? 'Cause I (think) I saw you using a Ubuntu image on the Nexus 7...
 

pratik_s

Senior Member
May 29, 2012
342
174
32
Mumbai
u mentioned in the post that 15 devices of galaxy s series support this unbrickable mod which are those 15 devices? is Samsung Galaxy S i9003 included in this list or support this unbrickable mod and does all the the devices have the same procedure to use the unbrickable mod? :)
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
What kind of image do you use for restoring the device? Just the stock one? 'Cause I (think) I saw you using a Ubuntu image on the Nexus 7...
I made the image using the working device using a UART connection. It consists of an official, Samsung signed SBOOT image that reloads SBOOT onto the EMMC.

u mentioned in the post that 15 devices of galaxy s series support this unbrickable mod which are those 15 devices? is Samsung Galaxy S i9003 included in this list or support this unbrickable mod and does all the the devices have the same procedure to use the unbrickable mod? :)
Nope. We only support Samsung Processors. Not OMAP or even Qualcomm for that matter.
 
  • Like
Reactions: Androssama

pratik_s

Senior Member
May 29, 2012
342
174
32
Mumbai
I made the image using the working device using a UART connection. It consists of an official, Samsung signed SBOOT image that reloads SBOOT onto the EMMC.


Nope. We only support Samsung Processors. Not OMAP or even Qualcomm for that matter.

is there any chance of getting this mod for i9003 in future?
 

terminal 7

Senior Member
Jan 27, 2008
469
45
exeter, uk.
great

i had to use this method on my Mk1 Galaxy Tab, worked like a dream..
ill be honest it stretched my hardware altering skills to the limit, always goot to keep learning.

Now i just need to actually buy a Galaxy Camera.. suppose i should make sure its a good shooter first !!

Thanks for your endless skills Adam.
 

Guzup

Member
Nov 25, 2012
24
1
Awsome! But do i just put the GCAM-UnBrickable zip file on my sd card? but how will it work if i brick my SG3 and i cant turn anything on? im sorry if its a dumb question, but i dont understand lol ;)
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
i had to use this method on my Mk1 Galaxy Tab, worked like a dream..
ill be honest it stretched my hardware altering skills to the limit, always goot to keep learning.

Now i just need to actually buy a Galaxy Camera.. suppose i should make sure its a good shooter first !!

Thanks for your endless skills Adam.
Are you talking about UnBrickable Mod? This is a bit different. This is a temporary mod and uses SDCard instead of USB.

Awsome! But do i just put the GCAM-UnBrickable zip file on my sd card? but how will it work if i brick my SG3 and i cant turn anything on? im sorry if its a dumb question, but i dont understand lol ;)

follow the instructions. you need to image the card with the image file in the zip.
 

BABAK236

Senior Member
Jan 27, 2011
83
34
Hi Adam...
Thank you for your idea,,,,,
But,This is released for officially use samsung service centers.....So.I Think no news here
I Know Your Topic is for Exynos4412 But if you want,i can send you any other SW method for repair many phone witout jtag,
like P7500,P7510,P5100,P5110,P3xxx.,Also I9300 SD_Method....I9250,I9100G,I9020,I9023,etc

Anyway,Thanks for help other pepole
But,Possible for bad understand me? can you explain me for more detail..?


Thank you
(i have any phone in my shop,"work and dead",so if you want,just tell me),Also i'm Product Supporter of "RIFF-BOX"...So,I can check everyting(Possible and supported CPU) with Jtag,,,,
 
Last edited:

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Hi Adam...
Thank you for your idea,,,,,
But,This is released for officially use samsung service centers.....So.I Think no news here
I Know Your Topic is for Exynos4412 But if you want,i can send you any other SW method for repair many phone witout jtag,
like P7500,P7510,P5100,P5110,P3xxx.,Also I9300 SD_Method....I9250,I9100G,I9020,I9023,etc

Anyway,Thanks for help other pepole
But,Possible for bad understand me? can you explain me for more detail..?


Thank you
(i have any phone in my shop,"work and dead",so if you want,just tell me),Also i'm Product Supporter of "RIFF-BOX"...So,I can check everyting(Possible and supported CPU) with Jtag,,,,
This isn't i9020/9023, which I designed the UnBrickable Resurrector for repair. This is an undocumented procedure. This isn't NVFlash from those Tegra based devices. This isn't the i9250 and i9100 which use the OMAP specific tool. This isn't JTAG either, I have a box.

The most similar method was released for i9300 but the T-Flash method has never worked properly for myself or others. This is something which did not exist before the first post in this thread.

Keep this in your repair bookmarks for when you need it along side your Riff box. Riff takes 6 wires generally. Every one of the 16 solutions I've come up with has been 1 or less.
 
Last edited:

Guzup

Member
Nov 25, 2012
24
1
How do I image a sdcard? And If my device gets bricked I just pop the card in and power it on? when I image the card will it do something special to the card? Or can i still use it to store stuff on.

Sent from my GT-I9300 using xda premium
 

theq86

Senior Member
Jan 6, 2009
951
728
37
Nuremberg
Nothing Phone 2
How do I image a sdcard? And If my device gets bricked I just pop the card in and power it on? when I image the card will it do something special to the card? Or can i still use it to store stuff on.

Sent from my GT-I9300 using xda premium

Most of your questions are already answered in the OP. (commands, revive instructions etc.)

Can the sd still be used? No. There is ARM code and a boot image copied to the beginning of your SDCard. This procedure will destroy the file system metadata although, physically, all the files are still present but not accessable anymore.

@Adam

By disabling the EMMC during the IROM sequence, this device will automatically fail-over to SDCard boot
Is this what shorting the resistors actualy does?

We've prepared an SDCard via the sdcard command in SBOOT below
So the T-Flash Option in Odin basically uses this sdcard command to create the bootloader sd?
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Is this what shorting the resistors actualy does?


So the T-Flash Option in Odin basically uses this sdcard command to create the bootloader sd?
Yes. Shorting the resistor disables the EMMC. The TFlash works differently.

This is different from TFlash. Using TFlash you insert a boot loader from your computer and flash it to the device with Odin. The TFlash is supposed to create a boot loader from an sboot.bin.tar.md5. It has problems and seems not to work... Like ever..
 
  • Like
Reactions: theq86

andybfmv96

Senior Member
Nov 19, 2012
518
42
I know the first few posts said the mod will work on the s3.. but since the US versions don't have exynos, I have to ask will this work on the US versions? Including Verizon?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 51
    Hi guys. Ralekdev, Rebellos and Myself have become quite good at hacking the extra roxor out of Samsung devices. We started with The UnBrickable Mod which now spans 15 total devices on the Samsung Galaxy S series. The UnBrickable Mod turned the Galaxy S into a development board. So we moved on to sucessfuly hacking the Qualcomm bootloaders on the Verizon Galaxy S3 and while our exploits for this device have not yet been needed, we have them ready to deploy on several devices and we've learned alot. Today we would like to present to you:

    UnBrickable SD-The ultimate in Exynos Necromancy
    The UnBrickable SD allows for total resurrection of an otherwise hard-bricked and dead device. It takes a device-specific SDCard, and a jumper to be placed across a tiny resistor. This triggers the device to silently boot at which point it will count to 10 and reload the device's bootloaders. This uses Samsung Official firmware unlike UnBrickable SD Mod (unreleased as of the time of this post) which allows for dual-booting of custom and official.

    Why would I need this?
    The processor has a small bit of ROM called IROM that tries to initialize the EMMC to load SBOOT. SBOOT then fully initializes the EMMC(Internal and soldered down MMC chip) where it pulls boot parameters, partition tables and all other information for the device to boot. if the SBOOT is damaged, the device will no longer boot and Odin/Factory modes are destroyed and the device is hard-bricked. This failed boot means the device cannot function and is locked up.

    How does UnBrickable SD work?
    The UnBrickable SD works because the processor is configured to attempt to load SBOOT from EMMC and then fail-over to SD, and finally UART. We've prepared an SDCard via the sdcard command in SBOOT below. By disabling the EMMC during the IROM sequence, this device will automatically fail-over to SDCard boot, check the signatures, see a valid image, and reload the SBOOT onto the EMMC thus enabling Odin.

    Instructions
    You will need:

    Once you have the required tools, we can begin the procedure.
    1. Create your UnBrickable SD.
      • Unzip the SDCard Image file from the zip.
      • Write it to an SDCard
        • Linux:
          Code:
          sudo dd if=GCAM-bootable-odin-from-sd-60mb-DDimg.img of=/dev/MYDEVICE
          where MYDEVICE is the sdcard (usually SDB or SDC
        • Windows: use this tool https://launchpad.net/win32-image-writer/ . I'm not going to explain because I use Linux.
    2. Disassemble the device
      I've prepared this video which shows how to disassemble the device. You can stop after you remove the LCD. Just pull the EM shields off after that so you can access the resistor.
    3. Insert the SDCard
      If you need instructions, you should have stopped long ago :)
    4. Short the EMMC Resistor
      You can use a pair of tweezers or a piece of wire, really anything to conduct electricity from one side of the resistor to the other. Below you can see some needles connected by a piece of wire which I use to short this resistor.
      attachment.php
    5. Press the power button wait a couple of seconds and release the short
      While booting, the device provides a 10 second countdown on the UART2 port. during this 10 second countdown, the EMMC needs to become enabled in order to write the bootloaders back to the device. The entire process takes 30 seconds and you will see nothing on the screen.
    6. Flash with Odin
      This procedure is the same as shown in the video below, however you will put the firmware from above in the PDA section instead of CF-AutoRoot and put the PIT from above into the PIT section

    Conclusion
    You have sucessfully restored your device to stock condition. Please hit the thanks button below this post.

    Additional Resources
    [R&D] Port SDCard Recovery to Other Exynos4412 Devices: http://xdaforums.com/showthread.php?t=1986887

    Would you like to see the UnBrickable SD on your Exynos4 device (GS2, GNote, Gnote2)? I need a working device and a broken device to develop and test.
    5
    So similar procedure will also work on Galaxy S3 ?
    Yes. the same procedure will work on the S3. I'm also working on bringing this to other devices as well.
    1
    What kind of image do you use for restoring the device? Just the stock one? 'Cause I (think) I saw you using a Ubuntu image on the Nexus 7...
    I made the image using the working device using a UART connection. It consists of an official, Samsung signed SBOOT image that reloads SBOOT onto the EMMC.

    u mentioned in the post that 15 devices of galaxy s series support this unbrickable mod which are those 15 devices? is Samsung Galaxy S i9003 included in this list or support this unbrickable mod and does all the the devices have the same procedure to use the unbrickable mod? :)
    Nope. We only support Samsung Processors. Not OMAP or even Qualcomm for that matter.
    1
    Is it working on galaxy S 2 ?

    Sent from my GT-I9100 using xda app-developers app

    Nope. I need a device. read the inital post.
    1
    Is this what shorting the resistors actualy does?


    So the T-Flash Option in Odin basically uses this sdcard command to create the bootloader sd?
    Yes. Shorting the resistor disables the EMMC. The TFlash works differently.

    This is different from TFlash. Using TFlash you insert a boot loader from your computer and flash it to the device with Odin. The TFlash is supposed to create a boot loader from an sboot.bin.tar.md5. It has problems and seems not to work... Like ever..