Totally Revolutionary SDCard Bootloader For Galaxy S III

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Hey guys,

Tonight, Elite Recognized Developer Rebellos and myself managed two very major breakthroughs for Samsung Exynos based devices.

1. Stable implementation of the Open Galaxy Bootloader (based on Uboot)
Code:
��BL2                                                                           
                                                                                
                                                                                
                                                                                
U-Boot 2010.12-00051-g02bdbef-dirty (Dec 23 2012 - 01:53:11) for EXYNOS4_GALAXY 
                                                                                
                                                                                
CPU: S5PC220 [Samsung SOC on SMP Platform Base on ARM CortexA9]                 
APLL = 1000MHz, MPLL = 800MHz                                                   
DRAM:  1 GiB                                                                    
[I2C] CLK_GATE_IP_PERIL: 0xFFFFFFFF, enabling channel 7                         
[I2C] channel 7 initialised with freq 400000 and timeout 1000000.               
[I2C] ePrescaler: 16 nPrescaler: 15.                                            
                                                                                
[I2C->ERR] Timeout Slave Address                                                
pmic_s5m8767_init set reg 0xE to 0x6F with mask 0x0                             
pmic_s5m8767_init set reg 0x5A to 0x58 with mask 0x0                            
pmic_s5m8767_init set reg 0x5B to 0xB4 with mask 0x0                            
pmic_s5m8767_init set reg 0xA to 0xE with mask 0xE                              
pmic_s5m8767_init set reg 0x11 to 0xE with mask 0x0                             
pmic_s5m8767_init set LDO2 to enable 0x1                                        
pmic_s5m8767_init set LDO4 to enable 0x1                                        
pmic_s5m8767_init set LDO5 to enable 0x0                                        
pmic_s5m8767_init set LDO6 to enable 0x1                                        
pmic_s5m8767_init set LDO7 to enable 0x1                                        
pmic_s5m8767_init set LDO8 to enable 0x1                                        
pmic_s5m8767_init set LDO9 to V 1800                                            
pmic_s5m8767_init set LDO10 to enable 0x1                                       
pmic_s5m8767_init set LDO11 to V 1950 with enable 0x1                           
pmic_s5m8767_init set LDO12 to enable 0x1                                       
pmic_s5m8767_init set LDO13 to enable 0x0                                       
pmic_s5m8767_init set LDO14 to V 1950 with enable 0x1                           
pmic_s5m8767_init set LDO15 to enable 0x1                                       
pmic_s5m8767_init set LDO16 to enable 0x1                                       
pmic_s5m8767_init set LDO18 to enable 0x1                                       
pmic_s5m8767_init set LDO19 to V 1800 with enable 0x1                           
pmic_s5m8767_init set LDO20 to V 3300                                           
pmic_s5m8767_init set LDO21 to V 3300                                           
pmic_s5m8767_init set LDO22 to V 2800                                           
pmic_s5m8767_init set LDO27 to V 1500                                           
PMIC: S5M8767                                                                   
====================                                                            
S5M8767 PMIC registers                                                          
====================                                                            
ID = 0x05                                                                       
ONSRC = 0x01                                                                    
STATUS1 = 0x11                                                                  
STATUS2 = 0x11                                                                  
STATUS3 = 0x07                                                                  
IRQ1 = 0x09                                                                     
IRQ2 = 0x38                                                                     
IRQ3 = 0x00                                                                     
PWROFFSRC = 0x00                                                                
PMIC_RTC_WTSR_SMPL_REG = 0x80                                                   
S5M8767_REG_BUCHG = 0x6f                                                        
i2c_gpio_new_port virtual channel 0 registered                                  
max77693 charger PMIC rev = PASS2, REG_ID2: 0x4                                 
BL1 version: 20111128                                                           
                                                                                
Checking Boot Mode... EMMC4.41                                                  
REVISION: 1.1                                                                   
[ERROR] response timeout error : 00000104 cmd 1                                 
FAIL: waiting for status update.                                                
MMC Device 0: 0 MB                                                              
MMC Device 1: 7580 MB                                                           
MMC Device 2 not found                                                          
FAIL: waiting for status update.                                                
FAIL: waiting for status update.                                                
mmc read failed                                                                 
*** Warning - using default environment                                         
                                                                                
Hit any key to stop autoboot:  0                                                
GALAXY #                                                                        
GALAXY #
What's this mean? We can now work INSIDE the Samsung TrustZone on production devices! This means some serious debugging of bootloaders is possible.


2. fastboot on the Galaxy Camera
Code:
adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot devices
SMDKEXYNOS-01	fastboot
adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot boot ./BOOT.bin 
downloading 'boot.img'...
OKAY [  1.642s]
booting...
OKAY [  0.217s]
finished. total time: 1.859s
adam@adam-Desktop:~/Desktop/GCAMBoot$


What does this REALLY mean? It means that not only do we have a way to get away from Samsung closed source bootloaders, but we can now boot TOTALLY from SDCard on the Galaxy Camera and the Galaxy S3.... What's that mean? We can fix brick-bugged Galaxy S3 devices!

I need a Galaxy S3 to work with. Anyone have a brick or a GS3 they're not using? I need it.

I will be performing the following:
1. EMMC Disable hardware mod (can be undone later)
2. UART hookups for debugging and working in fastboot mode.
3. attempting to rework GS3 Ramdisk for SDCard boot.
4. recreating the proper partition structure on a 16 gig.

From the current track record, i'm guessing that just about everyone will need this in a year or so. We hope to have this ready fairly quickly so anyone can just open their device, drop a bead of solder over a resistor, insert an SDCard and boot up again.

The further implications of this are: directly booting ubuntu, Chrome OS, WebOS or just about anything else... This tool will make it easy!

I estimate this will take 3-6 weeks of research. If you can donate a GS3 or do an extended loan, it will help out many people with bricked EMMCs. The device can even be bricked.
 

bapsack

Senior Member
Feb 22, 2008
55
5
brilliant.....

loking foreward to experimental roms to boot from my separate sd card

like cyanogen, ubuntu and so on!!!

Good news just before x-mas
 

Puenos

Senior Member
Aug 20, 2010
150
15
AWESOME!

Ty for your great work guys! :)


so in theory we could not only boot any ROM from SD to unbrick, but also boot Linux natively from our SD card instead of chrooting in?
 

wwjoshdew

Inactive Recognized Contributor
Dec 30, 2008
1,389
1,400
Seattle
tinyurl.com
Leave it to Adam and other Elite Developers to find such awesomeness! It's great to know that you can't truly hard brick a phone. And running ANY rom you want from the sdcard? That sounds freaking awesome!
 

theq86

Senior Member
Jan 6, 2009
951
728
37
Nuremberg
Nothing Phone 2
Just some questions to get the picture.


1. EMMC Disable hardware mod (can be undone later)

This would be a semi-permanent resistor shortening (same as we would do when following the instructions of the official samsung unbrick guide) or am I wrong?

3. attempting to rework GS3 Ramdisk for SDCard boot.
What ramdisk do you mean? do you want to boot a rom from sd or a custom bootloader from sd?
 

colang

Senior Member
Sep 4, 2011
288
77
Love your work guys think u will be going down in The History Of The Galaxy S3 lol
Keep up the goods

Sent from my GT-I9300 using Tapatalk.Siyah Kernel Rules The Galaxy
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,827
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Just some questions to get the picture.


1. EMMC Disable hardware mod (can be undone later)

This would be a semi-permanent resistor shortening (same as we would do when following the instructions of the official samsung unbrick guide) or am I wrong?

3. attempting to rework GS3 Ramdisk for SDCard boot.
What ramdisk do you mean? do you want to boot a rom from sd or a custom bootloader from sd?

Yes and the ramdisk needs to be reworked for uboot and booting from SDCard.

I'd appreciate it if you guys kept the "thanks" to a minimum.. I need a device to work with. Nothing has been done for GS3 yet and nothing will until we get a device. Extra posts make people think that something's already happened. It hasn't. I need a device.
 

drraptor

Senior Member
Mar 9, 2012
1,353
293
Thanks, hopefully somebody loan a device :)


Please make out a sticky too
Sent from my GT-I9100 using xda app-developers app
 

drraptor

Senior Member
Mar 9, 2012
1,353
293
Great work!
I suggest crowd funding. Add a donate button, i will give 10 $. 49 sponsors needed left.

Sent from my GT-I9300 using xda app-developers app

+1 :good:

I'll pledge to this as well. Perhaps we dont need 500, because a used s3 can be obtained for less, and if I understood correctly adam can even work with a "sudden death" victim?

He requires a SDS(sudden death syndrome) Galaxy S3. We can even ask a SDS victims to sell his device to adam instead of sending it for a repair. The money can for this can be generated through crowd funding . :)
 
  • Like
Reactions: HassanM

thegh0sts

Senior Member
Aug 16, 2011
1,061
123
Toronto
i like the idea and hope it will be turned into a tool kit for those situations as the S3 SDS can potentially affect any S3.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 250
    Hey guys,

    Tonight, Elite Recognized Developer Rebellos and myself managed two very major breakthroughs for Samsung Exynos based devices.

    1. Stable implementation of the Open Galaxy Bootloader (based on Uboot)
    Code:
    ��BL2                                                                           
                                                                                    
                                                                                    
                                                                                    
    U-Boot 2010.12-00051-g02bdbef-dirty (Dec 23 2012 - 01:53:11) for EXYNOS4_GALAXY 
                                                                                    
                                                                                    
    CPU: S5PC220 [Samsung SOC on SMP Platform Base on ARM CortexA9]                 
    APLL = 1000MHz, MPLL = 800MHz                                                   
    DRAM:  1 GiB                                                                    
    [I2C] CLK_GATE_IP_PERIL: 0xFFFFFFFF, enabling channel 7                         
    [I2C] channel 7 initialised with freq 400000 and timeout 1000000.               
    [I2C] ePrescaler: 16 nPrescaler: 15.                                            
                                                                                    
    [I2C->ERR] Timeout Slave Address                                                
    pmic_s5m8767_init set reg 0xE to 0x6F with mask 0x0                             
    pmic_s5m8767_init set reg 0x5A to 0x58 with mask 0x0                            
    pmic_s5m8767_init set reg 0x5B to 0xB4 with mask 0x0                            
    pmic_s5m8767_init set reg 0xA to 0xE with mask 0xE                              
    pmic_s5m8767_init set reg 0x11 to 0xE with mask 0x0                             
    pmic_s5m8767_init set LDO2 to enable 0x1                                        
    pmic_s5m8767_init set LDO4 to enable 0x1                                        
    pmic_s5m8767_init set LDO5 to enable 0x0                                        
    pmic_s5m8767_init set LDO6 to enable 0x1                                        
    pmic_s5m8767_init set LDO7 to enable 0x1                                        
    pmic_s5m8767_init set LDO8 to enable 0x1                                        
    pmic_s5m8767_init set LDO9 to V 1800                                            
    pmic_s5m8767_init set LDO10 to enable 0x1                                       
    pmic_s5m8767_init set LDO11 to V 1950 with enable 0x1                           
    pmic_s5m8767_init set LDO12 to enable 0x1                                       
    pmic_s5m8767_init set LDO13 to enable 0x0                                       
    pmic_s5m8767_init set LDO14 to V 1950 with enable 0x1                           
    pmic_s5m8767_init set LDO15 to enable 0x1                                       
    pmic_s5m8767_init set LDO16 to enable 0x1                                       
    pmic_s5m8767_init set LDO18 to enable 0x1                                       
    pmic_s5m8767_init set LDO19 to V 1800 with enable 0x1                           
    pmic_s5m8767_init set LDO20 to V 3300                                           
    pmic_s5m8767_init set LDO21 to V 3300                                           
    pmic_s5m8767_init set LDO22 to V 2800                                           
    pmic_s5m8767_init set LDO27 to V 1500                                           
    PMIC: S5M8767                                                                   
    ====================                                                            
    S5M8767 PMIC registers                                                          
    ====================                                                            
    ID = 0x05                                                                       
    ONSRC = 0x01                                                                    
    STATUS1 = 0x11                                                                  
    STATUS2 = 0x11                                                                  
    STATUS3 = 0x07                                                                  
    IRQ1 = 0x09                                                                     
    IRQ2 = 0x38                                                                     
    IRQ3 = 0x00                                                                     
    PWROFFSRC = 0x00                                                                
    PMIC_RTC_WTSR_SMPL_REG = 0x80                                                   
    S5M8767_REG_BUCHG = 0x6f                                                        
    i2c_gpio_new_port virtual channel 0 registered                                  
    max77693 charger PMIC rev = PASS2, REG_ID2: 0x4                                 
    BL1 version: 20111128                                                           
                                                                                    
    Checking Boot Mode... EMMC4.41                                                  
    REVISION: 1.1                                                                   
    [ERROR] response timeout error : 00000104 cmd 1                                 
    FAIL: waiting for status update.                                                
    MMC Device 0: 0 MB                                                              
    MMC Device 1: 7580 MB                                                           
    MMC Device 2 not found                                                          
    FAIL: waiting for status update.                                                
    FAIL: waiting for status update.                                                
    mmc read failed                                                                 
    *** Warning - using default environment                                         
                                                                                    
    Hit any key to stop autoboot:  0                                                
    GALAXY #                                                                        
    GALAXY #
    What's this mean? We can now work INSIDE the Samsung TrustZone on production devices! This means some serious debugging of bootloaders is possible.


    2. fastboot on the Galaxy Camera
    Code:
    adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot devices
    SMDKEXYNOS-01	fastboot
    adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot boot ./BOOT.bin 
    downloading 'boot.img'...
    OKAY [  1.642s]
    booting...
    OKAY [  0.217s]
    finished. total time: 1.859s
    adam@adam-Desktop:~/Desktop/GCAMBoot$


    What does this REALLY mean? It means that not only do we have a way to get away from Samsung closed source bootloaders, but we can now boot TOTALLY from SDCard on the Galaxy Camera and the Galaxy S3.... What's that mean? We can fix brick-bugged Galaxy S3 devices!

    I need a Galaxy S3 to work with. Anyone have a brick or a GS3 they're not using? I need it.

    I will be performing the following:
    1. EMMC Disable hardware mod (can be undone later)
    2. UART hookups for debugging and working in fastboot mode.
    3. attempting to rework GS3 Ramdisk for SDCard boot.
    4. recreating the proper partition structure on a 16 gig.

    From the current track record, i'm guessing that just about everyone will need this in a year or so. We hope to have this ready fairly quickly so anyone can just open their device, drop a bead of solder over a resistor, insert an SDCard and boot up again.

    The further implications of this are: directly booting ubuntu, Chrome OS, WebOS or just about anything else... This tool will make it easy!

    I estimate this will take 3-6 weeks of research. If you can donate a GS3 or do an extended loan, it will help out many people with bricked EMMCs. The device can even be bricked.
    21
    There's development going on... just nothing to report yet. I borrowed a device and made some progress.

    In the video below, in the description, you will find clickable links for the highlights of the video. So, open this video and click the links.

    https://www.youtube.com/watch?v=tQ-Fbfl94cI&feature=youtube_gdata_player

    So far, we have the OGBootloader running, but it cannot boot the kernel due to TrustZone (secure element) issues. We are working on it. I don't have a i9300 so it will be extremely slow to get to i9300. however, i'm developing on the similar Galaxy Camera and just set up a github repo last night for it.
    21
    I just received a dead i9300. It will facilitate work on this project but I can't work alone and Rebellos is a bit busy. So, we will be looking into this soon enough.
    15
    Just some questions to get the picture.


    1. EMMC Disable hardware mod (can be undone later)

    This would be a semi-permanent resistor shortening (same as we would do when following the instructions of the official samsung unbrick guide) or am I wrong?

    3. attempting to rework GS3 Ramdisk for SDCard boot.
    What ramdisk do you mean? do you want to boot a rom from sd or a custom bootloader from sd?

    Yes and the ramdisk needs to be reworked for uboot and booting from SDCard.

    I'd appreciate it if you guys kept the "thanks" to a minimum.. I need a device to work with. Nothing has been done for GS3 yet and nothing will until we get a device. Extra posts make people think that something's already happened. It hasn't. I need a device.
    13
    Device donation.?

    Sent from my GT-I9100 using xda app-developers app

    Yep :) Donated to Adam :)