FORUMS

XDA Recap: This Week In Android (May 17 – 23)

Another week, another recap. The Sunday tradition marches on this week with a fresh … more

Huawei To Sell Honor Smartphones Via Indian Retail Outlets

World’s fourth largest smartphone maker Huawei plans to now sell its … more

Sunday Debate: Are Smaller Bezels Better or Worth It?

Bezels have been getting smaller and smaller as the years go by, and while devices … more

LG G4 First Impressions and Unboxing – XDA TV

The latest in LG’s signature line of “G phones” has been released. … more
Thread Closed Subscribe to Thread Email Thread

Lets save some bricks...

2nd April 2011, 08:37 AM |#1  
OP Member
Thanks Meter: 24
 
More
I've been reading up on SGS hardware and bootloaders, and I feel like there's a very good chance that there's a way (within reach? ??) to to fix a totally bricked phone.

NOTE: I'm no expert on this stuff. If I'm missing something totally stupid, please forgive me. Anyways, here goes...


The user manual for the s5pc110 chip describes the booting process; it has 3 levels. On hw reset the cpu begins executing code that lives in ROM. The ROM code loads the primary bootloader from a source selected by external pin inputs. The PBL pretty much just loads the SBL, which does the major setup and loads the kernel.

The important thing, which I haven't seen anyone discuss, is that the initial ROM code includes the ability (poorly documented, of course) to load the PBL from UART or USB.

Repeat : non-eraseable code in our phones which is executed on hw reset can load a bootloader over serial or USB into memory and then execute it.

From other threads, we know that Samsung is able to restore a bricked phone without opening it up. Why should they have all the fun?

The first step is asserting the proper pins. This is done by connecting the proper resistance betw pins 4 & 5. The 'jig' thread describes using 301k to get into download mode, but this is happening in the SBL. Many other R values are desribed in the 'fun with resistors' thread and in the fsaXXXX-i2c.c kernel source. One of them does a reboot and connects a (3.3V) UART to the D+/D- pins.

One thing that is described in the docs is that the ROM code tries UART first and then fails over to USB. Since UART is so much simpler, I'd say that's where to begin.

We already learned in that thread that connecting at 115200 baud and banging on RETURN brings up a "SBL>" prompt with lots of cool commands available. But as TheBeano pointed out, that's not much use if the SBL is toast.

What I'm wondering is whether there's a way to interrupt the normal boot while its still running ROM code. There's no reason the ROM would set up the UART at the same baud rate as the SBL and kernel. Maybe just a lower baud and banging on RETURN is enough.

For anybody with the time and the hardware, that should be easy enough to try. TheBeano?

There's probably some handshake/protocol issues to figure out to get a bootloader loaded and executing, but we do have a known good one (the PBL) to play with.

If that can be made to work, it would be a huge step towards a working solution. There is code floating around (I saw it on the teamhacksung git) that ports u-boot bootloader to our phones. AFAIK, nobody around here has tried it. But if we are able to test bootloaders w/o flasing, then maybe we (someone with a clue about bootloaders,that is) can open the door to safe, open-source booting.


So that's it. Is this crazy-talk, or do you guys n gals think it just ... might ... work?
The Following 19 Users Say Thank You to js22 For This Useful Post: [ View ]
 
 
5th April 2011, 11:40 AM |#2  
Guest
Thanks Meter: 773
 
More
Thumbs up
I am actually very surprised that no one has replied to this, it is actually a very good idea and also very possible

I will add a little insight without giving too much away

Its also possible to start the phone via JTAG and pass the control over to USB or UART, even to enter DLM and flash the phone without repairing the current IBL/PBL/SBL within the phone which are damaged, e.g. the loaders are running in RAM this is done via CMM or JNAND ...

I have the full unstripped source code for the PBL and SBL and may consider releasing them if some input starts in this thread, its all too easy just to give them out without the scene thinking on its feet

Oh BTW: My dog spoke to another dog who's owner works for Samsung and he told him that the 2.3.3 release, will be released when its f**king ready and not 1 day before.
Last edited by Odia; 5th April 2011 at 11:45 AM.
The Following 5 Users Say Thank You to Odia For This Useful Post: [ View ]
5th April 2011, 12:00 PM |#3  
Senior Member
Thanks Meter: 202
 
More
Sorry I meant to post to this thread earlier. I looked at this a while ago but the main thing that baffled me was that according to the CPU data sheet, to enable booting from USB or UART you needed to set some bits on the processor OM pins, and I couldn't see how to do that without internal access to the hardware, unless they are wired up to, or switched by, the fsa9480 somehow?

I've looked at the schematic fragments from the service manual but they weren't much help. If anyone has a schematic that shows what is connected to the application processor OM pins that would be a big help. Obviously the bootloader sources would be great too!
5th April 2011, 05:52 PM |#4  
Guest
Thanks Meter: 773
 
More
Quote:
Originally Posted by TheBeano

Obviously the bootloader sources would be great too!

Come on guys, lets have some input here, and I will give out snippets of info to help, just in case anyone is in any doubt to what I said, take a look at the attached screendump
Attached Thumbnails
Click image for larger version

Name:	sbl.jpg
Views:	4549
Size:	107.5 KB
ID:	561285  
The Following User Says Thank You to Odia For This Useful Post: [ View ]
5th April 2011, 06:49 PM |#5  
Senior Member
Flag Heraklion,Crete
Thanks Meter: 9
 
Donate to Me
More
Quote:
Originally Posted by Odia

I am actually very surprised that no one has replied to this, it is actually a very good idea and also very possible

Maybe this thead has to move to Rom development not many devs in general

If you have the sources then its possible to make our own bootloaders and dual boot whatever we want maybe win 7 (it's a joke)
Last edited by manosv; 5th April 2011 at 06:52 PM.
The Following 2 Users Say Thank You to manosv For This Useful Post: [ View ]
6th April 2011, 12:48 AM |#6  
Senior Member
Thanks Meter: 15
 
More
TheBeano what service manual will help you? full one?
http://www.filesonic.com/file/305248...ice_manual.rar full one.

http://megaupload.com/?d=C0JHS7A8 - service training manual 01/2011
The Following 3 Users Say Thank You to Fuma For This Useful Post: [ View ]
6th April 2011, 08:22 AM |#7  
Account currently disabled
Flag XDA Sucks !
Thanks Meter: 2,023
 
Donate to Me
More
Quote:
Originally Posted by manosv

Maybe this thead has to move to Rom development not many devs in general

If you have the sources then its possible to make our own bootloaders and dual boot whatever we want maybe win 7 (it's a joke)

Hey, off topic here, but i have seen these phones on ebay, chinese own brand of course, but dual boot, runs both android and windows on one phone.

so it is possible for someone who knows how to.... would be very interested in seeing this develop

http://cgi.ebay.co.uk/W6000-Dual-Car...ht_3411wt_1139
The Following User Says Thank You to azzledazzle For This Useful Post: [ View ]
6th April 2011, 09:13 AM |#8  
Senior Member
Thanks Meter: 202
 
More
Quote:
Originally Posted by Fuma

TheBeano what service manual will help you? full one?
http://www.filesonic.com/file/305248...ice_manual.rar full one.

Thanks, there were some schematics in that first one named "Samsung GT-i9000 Schematics.pdf" that had me going for a while, but they are from a different phone! Some Mediatek thing. The service manual files only have excerpts from the full schematics.
6th April 2011, 01:04 PM |#9  
Senior Member
Thanks Meter: 15
 
More
Quote:
Originally Posted by TheBeano

Thanks, there were some schematics in that first one named "Samsung GT-i9000 Schematics.pdf" that had me going for a while, but they are from a different phone! Some Mediatek thing. The service manual files only have excerpts from the full schematics.


different phone? I9000B? sorry. thought it was all I9000.
well i tired...
6th April 2011, 01:31 PM |#10  
Senior Member
Thanks Meter: 202
 
More
Quote:
Originally Posted by Fuma

different phone? I9000B? sorry. thought it was all I9000.
well i tired...

It's the schematic for a cheap phone with the Mediatek MT6225 processor, the "CSL Blueberry" I think. They have an "i9000" model so maybe that's how it started.
Thread Closed Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Top Threads in Hardware Hacking General by ThreadRank