I took about 80 shots of the VZWGS3 mainboard. These are the best. Download the attached zip for high resolution images. I will be using these for annotation purposes.

Note the area between the processor and EMMC has scratches where I removed the conformal coating. The chips look wet because in order to attain a good shot, I had to wet them down.




















Please blame my cat for hair on the processsor! I blame my cat for everything.


In the above picture you can see some sort of communications points to the left and the processor resistors above and below

Delete

^^ Hi! Great detail in those photos, but the reflection is way too high. I can barely make out the chip markings on any of those chips. I suggest you use a very bright and slightly grey background mat, instead of the black. That will help your camera compensate for reflection. Then try to use daylight coming in from the sides. Any type of fluorescent light is terrible for this kind of thing. Perhaps you tought about all this already. Then please disregard. In any case, it is very nice someone posted some internal shots for another model.

I can't believe how smart you guys are. I'm in awe! Take this suggestion with a grain on salt, but do y'all think anyone would answer an email to that address in your dump Adam? Sorry for no quote, I'm mobile. I think the address was android.os@Samsung

Flame away cause i know the idea is kinda ridiculous.

Sent from my SCH-I535 using Xparent ICS Tapatalk 2

Im about to go to bed. However, I would like it if someone could pull the /dev/block/mmcblk0p10 from another GS3, like AT&T or any other unlocked carrier device.

adb shell
su
dd if=/dev/block/mmcblk0p10 of=/sdcard/emmcblk0p10 bs=4096

then grab the mmcblk0p10 file from the sdcard and post it up here.
I'm fairly confident we can flash that block without triggering a problem on the Chain-of-Trust

Originally Posted by ExodusC

Many people on the forums here have stated IMEI information is stored in a file within /efs (at least on GSM models?) but I can't confirm myself.

There are several threads about attempting to restore lost IMEIs that might have more info.

At least on the Verizon Galaxy Nexus, efs mounts as /factory. The MEID is at position 0x00202d8 in /factory/nv_data.bin. It would be easy to check if the GS3 does something similar.

---------- Post added at 10:52 PM ---------- Previous post was at 10:43 PM ----------

Originally Posted by alquimista

The PARAMS partition (from an adb dump) contains almost all 0's. Here are the first 32 bytes
(layed out in hex offsets of 0x00000000 && 0x00000010):

00000000  01 00 00 00 00 00 00 00  00 00 00 00 01 00 00 00
00000010  01 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00

From what I understand, each occurance of 01 indicates a boot_mode variable that the SBL reads*. The rest of the file, about 10,485,739bytes of data, can contain information for other variables such as debug_level and switch_sel and maybe more, but I have too look more into dissembling the SBL patition image (sbl2.img) to see what other variables there are. I'll report back as soon as I have any more info on that.

*See this link for more info on the param.blk:
http://epiccm.blogspot.com/p/stock-firmware.html

[ snip... ]

It would be funny if Samsung left that door wide open! The param is also where the Galaxy Nexus stores bootloader lock status, at offset 0x000007C. A 1 there means locked, and a 0 means unlocked. I have a root app out which sets/clears that bit to allow bootloader unlock/relock.

It would be absolutely hilarious if tweaking some bits in param on the SGS3 would unlock the bootloader... but Samsung can't have made it that easy, can they?

Originally Posted by segv11

At least on the Verizon Galaxy Nexus, efs mounts as /factory. The MEID is at position 0x00202d8 in /factory/nv_data.bin. It would be easy to check if the GS3 does something similar.

---------- Post added at 10:52 PM ---------- Previous post was at 10:43 PM ----------



It would be funny if Samsung left that door wide open! The param is also where the Galaxy Nexus stores bootloader lock status, at offset 0x000007C. A 1 there means locked, and a 0 means unlocked. I have a root app out which sets/clears that bit to allow bootloader unlock/relock.

It would be absolutely hilarious if tweaking some bits in param on the SGS3 would unlock the bootloader... but Samsung can't have made it that easy, can they?

I doubt it. The other problem besides the GNex being a different beast, is that the SGS3's bootloader was compiled with stuff like fastboot disabled and I have no idea what other mods were made to the source code before compilation.

On the other hand, it's worth a shot.

Originally Posted by alquimista

I'd post it in a code section here but it's just too long.
There's a few other interesting logs in that path as well.

You can always post your logs to Pastebin or Pastie ...

Originally Posted by alquimista

I doubt it. The other problem besides the GNex being a different beast, is that the SGS3's bootloader was compiled with stuff like fastboot disabled and I have no idea what other mods were made to the source code before compilation.

On the other hand, it's worth a shot.

You're right, it's a long shot. We collected several SGS3 param images, one T-Mobile, one AT&T, a VZW and another VZW.

They are large files, mostly NULLs. There are only two differences between the files:

• At 0x0000014, both VZW dumps have a 1, T-Mo dump has a 0, AT&T has a 0.
  
• From 0x09ffc00 to 0x09ffc0f all of the dumps have very different strings of 16 bytes (nothing in common between any of them). This leads me to believe that this is some kind of device-specific key, hash, or serial number.

If we could get a Sprint dump, we could confirm if 0x0000014 has to do with lock state, or GSM vs CDMA.

Alternately, would anyone care to test what happens to a VZW device if that 1 at 0x0000014 is changed to a 0? Be careful though it might brick the device if this partition is being checked by crypto.


EDIT: Now we have 3 param images. Edited description above.
EDIT 2: Now we have 4...

att param.img....

so why is 7zip making its filesize from 10mb to 2kb... i even unpacked it it was back at 10mb... im not so sure i trust that, ill get yall a dropbox link too...

http://dl.dropbox.com/u/85033560/param.img