Totally Revolutionary SDCard Bootloader For Galaxy S III

AdamOutler · 23rd December 2012, 03:20 AM

Totally Revolutionary SDCard Bootloader For Galaxy S III

Hey guys,

Tonight, Elite Recognized Developer Rebellos and myself managed two very major breakthroughs for Samsung Exynos based devices.

1. Stable implementation of the Open Galaxy Bootloader (based on Uboot)

Code:

��BL2                                                                           
                                                                                
                                                                                
                                                                                
U-Boot 2010.12-00051-g02bdbef-dirty (Dec 23 2012 - 01:53:11) for EXYNOS4_GALAXY 
                                                                                
                                                                                
CPU: S5PC220 [Samsung SOC on SMP Platform Base on ARM CortexA9]                 
APLL = 1000MHz, MPLL = 800MHz                                                   
DRAM:  1 GiB                                                                    
[I2C] CLK_GATE_IP_PERIL: 0xFFFFFFFF, enabling channel 7                         
[I2C] channel 7 initialised with freq 400000 and timeout 1000000.               
[I2C] ePrescaler: 16 nPrescaler: 15.                                            
                                                                                
[I2C->ERR] Timeout Slave Address                                                
pmic_s5m8767_init set reg 0xE to 0x6F with mask 0x0                             
pmic_s5m8767_init set reg 0x5A to 0x58 with mask 0x0                            
pmic_s5m8767_init set reg 0x5B to 0xB4 with mask 0x0                            
pmic_s5m8767_init set reg 0xA to 0xE with mask 0xE                              
pmic_s5m8767_init set reg 0x11 to 0xE with mask 0x0                             
pmic_s5m8767_init set LDO2 to enable 0x1                                        
pmic_s5m8767_init set LDO4 to enable 0x1                                        
pmic_s5m8767_init set LDO5 to enable 0x0                                        
pmic_s5m8767_init set LDO6 to enable 0x1                                        
pmic_s5m8767_init set LDO7 to enable 0x1                                        
pmic_s5m8767_init set LDO8 to enable 0x1                                        
pmic_s5m8767_init set LDO9 to V 1800                                            
pmic_s5m8767_init set LDO10 to enable 0x1                                       
pmic_s5m8767_init set LDO11 to V 1950 with enable 0x1                           
pmic_s5m8767_init set LDO12 to enable 0x1                                       
pmic_s5m8767_init set LDO13 to enable 0x0                                       
pmic_s5m8767_init set LDO14 to V 1950 with enable 0x1                           
pmic_s5m8767_init set LDO15 to enable 0x1                                       
pmic_s5m8767_init set LDO16 to enable 0x1                                       
pmic_s5m8767_init set LDO18 to enable 0x1                                       
pmic_s5m8767_init set LDO19 to V 1800 with enable 0x1                           
pmic_s5m8767_init set LDO20 to V 3300                                           
pmic_s5m8767_init set LDO21 to V 3300                                           
pmic_s5m8767_init set LDO22 to V 2800                                           
pmic_s5m8767_init set LDO27 to V 1500                                           
PMIC: S5M8767                                                                   
====================                                                            
S5M8767 PMIC registers                                                          
====================                                                            
ID = 0x05                                                                       
ONSRC = 0x01                                                                    
STATUS1 = 0x11                                                                  
STATUS2 = 0x11                                                                  
STATUS3 = 0x07                                                                  
IRQ1 = 0x09                                                                     
IRQ2 = 0x38                                                                     
IRQ3 = 0x00                                                                     
PWROFFSRC = 0x00                                                                
PMIC_RTC_WTSR_SMPL_REG = 0x80                                                   
S5M8767_REG_BUCHG = 0x6f                                                        
i2c_gpio_new_port virtual channel 0 registered                                  
max77693 charger PMIC rev = PASS2, REG_ID2: 0x4                                 
BL1 version: 20111128                                                           
                                                                                
Checking Boot Mode... EMMC4.41                                                  
REVISION: 1.1                                                                   
[ERROR] response timeout error : 00000104 cmd 1                                 
FAIL: waiting for status update.                                                
MMC Device 0: 0 MB                                                              
MMC Device 1: 7580 MB                                                           
MMC Device 2 not found                                                          
FAIL: waiting for status update.                                                
FAIL: waiting for status update.                                                
mmc read failed                                                                 
*** Warning - using default environment                                         
                                                                                
Hit any key to stop autoboot:  0                                                
GALAXY #                                                                        
GALAXY #

What's this mean? We can now work INSIDE the Samsung TrustZone on production devices! This means some serious debugging of bootloaders is possible.

2. fastboot on the Galaxy Camera

Code:

adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot devices
SMDKEXYNOS-01	fastboot
adam@adam-Desktop:~/Desktop/GCAMBoot$ sudo fastboot boot ./BOOT.bin 
downloading 'boot.img'...
OKAY [  1.642s]
booting...
OKAY [  0.217s]
finished. total time: 1.859s
adam@adam-Desktop:~/Desktop/GCAMBoot$

What does this REALLY mean? It means that not only do we have a way to get away from Samsung closed source bootloaders, but we can now boot TOTALLY from SDCard on the Galaxy Camera and the Galaxy S3.... What's that mean? We can fix brick-bugged Galaxy S3 devices!

I need a Galaxy S3 to work with. Anyone have a brick or a GS3 they're not using? I need it.

I will be performing the following:
1. EMMC Disable hardware mod (can be undone later)
2. UART hookups for debugging and working in fastboot mode.
3. attempting to rework GS3 Ramdisk for SDCard boot.
4. recreating the proper partition structure on a 16 gig.

From the current track record, i'm guessing that just about everyone will need this in a year or so. We hope to have this ready fairly quickly so anyone can just open their device, drop a bead of solder over a resistor, insert an SDCard and boot up again.

The further implications of this are: directly booting ubuntu, Chrome OS, WebOS or just about anything else... This tool will make it easy!

I estimate this will take 3-6 weeks of research. If you can donate a GS3 or do an extended loan, it will help out many people with bricked EMMCs. The device can even be bricked.

qbking77 · 23rd December 2012, 03:38 AM

Very good news. Great work Adam

Akshay (Aky) · 23rd December 2012, 04:01 AM

Great waiting for somebody to donate his dead s3

Sent from my GT-I9300 using xda app-developers app

JJEgan · 23rd December 2012, 10:53 AM

Thanks for all your hard work .

jje

bapsack · 23rd December 2012, 11:14 AM

brilliant.....

loking foreward to experimental roms to boot from my separate sd card

like cyanogen, ubuntu and so on!!!

Good news just before x-mas

semantsen · 23rd December 2012, 12:22 PM

Thanks

Thank god! Adam,
at least there is now hope for 'to be dead' S3s
+1

Puenos · 23rd December 2012, 12:29 PM

AWESOME!

Ty for your great work guys!

so in theory we could not only boot any ROM from SD to unbrick, but also boot Linux natively from our SD card instead of chrooting in?

wwjoshdew · 23rd December 2012, 04:44 PM

Leave it to Adam and other Elite Developers to find such awesomeness! It's great to know that you can't truly hard brick a phone. And running ANY rom you want from the sdcard? That sounds freaking awesome!

coolhof · 23rd December 2012, 05:18 PM

Great news.
Good job.:thumbup:

Verzonden door mijn GT-I9300 met xda premium

theq86 · 23rd December 2012, 10:28 PM

Just some questions to get the picture.

1. EMMC Disable hardware mod (can be undone later)

This would be a semi-permanent resistor shortening (same as we would do when following the instructions of the official samsung unbrick guide) or am I wrong?

3. attempting to rework GS3 Ramdisk for SDCard boot.
What ramdisk do you mean? do you want to boot a rom from sd or a custom bootloader from sd?