[GSM] P1000 GTab Dev Platform AKA UnBrickable Mod And Software Resurection

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
First Off, Huge thanks to F50+ This man sacrificed his tab to locate these resistors.

introduction
I'm not kidding when I say UnBrickable. Modifying the OM pins means you can boot from USB, UART or MMC. This makes the device quite UNBRICKABLE. There is nothing you can do software wise to prevent the device from booting into this mode. We are communicating with the unrewritable, efused IROM on the processor. It's the thing that makes the system on a chip into a "system on a chip".I am here now to tell you how to turn your Samsung P1000 into a KIT-S5PC110 development board. The KIT-S5PC110 development board is the platform used to develop our phones. There are some differences between this mod and the official development platform. The S5PC110 has a removable internal SDCard and no touchscreen.

Why would you want to do this? When you plug in the battery and connect it to the computer in "off" mode, it will become an S5PC110 board awaiting download of a program to run. This occurs long before anything like software or firmware enters the processor. This is the IROM of the device awaiting commands or a power on signal.

How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.

After performing this mod:
Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like a P1000. See the Special Instructions section.

Part 1:Hardware Modification

You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(or email my username@gmail.com) or Connexion2005(aka MobileTechVideos.com).
2. Soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. fFux
4. Solder
5. Tweezers
6. A relay (possibly- for the wire within to use as a bridge)
7. A #1 tri-blade driver


performing the modification:
1. tear apart your Galaxy Tab... Make sure to take out your SIM and external SDCard before you do this.
1A. Remove the screws.
1B. Separate the top case from the bottom case

****VIDEO OR PICTURES NEEDED*****

2. Perform the mod as follows: remove the xOM5 resistor and jumper the non-grounded pad of xOM5 to the same side of xOM0 or xOM3.

1zdxlpf.jpg


I will be able to give more detail after I have performed this modification myself.

3. reassemble the Tab.


Special Instructions

  • This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds, then plugging in the device, or you can use an authentic Samsung Charging Cable for charging the battery
  • To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.

Part 2: Software Based Resurrection
6o1rbb.png



The entire software resurrection can be summed up like this

Here is a Galaxy Tab specific video

Unbricking:
1. Apply UnBrickable Mod to your device: see Hardware Modification section
2. Run The Ultimate UnBrickable Resurrector. You can find the Resurrector here in our SVN repository http://code.google.com/p/hummingbird-hibl/downloads/list

When you see this image you are in S5PC110 SEC SoC mode. When you see this mode you must proceed to step 2.
k9cdgy.png


If it will only show this image, then you have not performed the modification correctly, or you have a hardware problem.
2qa4xas.png


If it shows this, regardless of what's on your screen, you're in download mode. Proceded to step 3.
730xm0.png



2. Click the Download Mode button (then click the one next to it). I find it's easiest to click Download Mode, type a password, plug in the device, then press enter.

3. Run Heimdall One-Click to flash firmware on your device. http://xdaforums.com/showthread.php?t=1323527
mmpxmv.png


4. repeat steps 2 and 3 with bootloader flashing enabled (Heimdall One-Click has a safety mechanism which requires you to flash once before flashing bootloaders).


Conclusion

Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.

reading material
Creating your own Samsung Bootloaders: http://xdaforums.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example: http://www.boardset.com/products/mv6410.php
ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2


drivers and utilities
This will be an ever expanding list
Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list
Windows Drivers http://xdaforums.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW: http://xdaforums.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line tool: http://xdaforums.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list


firmware
Bootloader Hello World by Rebellos http://xdaforums.com/attachment.php?attachmentid=698077&d=1314105521
UnBrick tool http://xdaforums.com/showthread.php?t=1242466

Conclusion

Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software. See here for setting up the UART output http://xdaforums.com/showthread.php?t=1235219
 
Last edited:

lambstone

Senior Member
Mar 27, 2008
1,693
300
Huawei P20 Pro
Redmi K20 Pro
Yeah this is a genius idea for our galaxy tabs. With this, I no longer have to worry about bricking my device via odin because of my ****ty faulty HP laptop. (it happened once and i had to send it overseas for warranty repairs, 2 months w/o my tab :( )
 

diagdave

Senior Member
Dec 31, 2007
139
36
how to

Looking forward to trying this on my tab. You mentioned firmware would need to be made,I assume stock boot loaders could be used right away?how do we know which is grounded pad? What is the relay for?

Cheers
david
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Looking forward to trying this on my tab. You mentioned firmware would need to be made,I assume stock boot loaders could be used right away?how do we know which is grounded pad? What is the relay for?

Cheers
david
Until I'm able to actually perform this mod on a device, I can't tell you anything. I don't know any more than what's in the first post.
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
A bit of an update... Someone contacted me via PM to let me know that they bricked their device in the rare S5PC110 mode. This can happen if you damage your IBL from the IBL+PBL partition, or if the device realizes it cannot boot before attempting to do so. They were able to get their tab into download mode using the Linux Resurrector from the first post.

So, we've got the software part verified. Now, we need confirmation that the hardware mod will allow the device to enumerate as a "S5PC110 SEC SoC" on a Linux based system.

Someone please confirm that after the modification the device shows "S5PC110 debug mode" in Linux with the ModeDetect utility here: http://code.google.com/p/hummingbird-hibl/downloads/list
 
  • Like
Reactions: devilng

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
A bit of an update... Someone contacted me via PM to let me know that they bricked their device in the rare S5PC110 mode. This can happen if you damage your IBL from the IBL+PBL partition, or if the device realizes it cannot boot before attempting to do so. They were able to get their tab into download mode using the Linux Resurrector from the first post.

So, we've got the software part verified. Now, we need confirmation that the hardware mod will allow the device to enumerate as a "S5PC110 SEC SoC" on a Linux based system.

Someone please confirm that after the modification the device shows "S5PC110 debug mode" in Linux with the ModeDetect utility here: http://code.google.com/p/hummingbird-hibl/downloads/list

I pinged you on IRC, but ModeDetect shows "S5PC110 UnBrickable Debug"
 

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
Great.. Can you run the resurrector and verify that it goes into download mode?

yep, it does, only difference is that it is not a bootloader designed for this device, it turns the LED flash on, and doesn't bring the screen up, but in any case, heimdall can communicate, although I have not tried flashing from it yet
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
yep, it does, only difference is that it is not a bootloader designed for this device, it turns the LED flash on, and doesn't bring the screen up, but in any case, heimdall can communicate, although I have not tried flashing from it yet

Awesome. Try running a heimdall print-pit or a close-pc-screen to verify everything works. Ill get a one-click back to stock and a one-click CWM prepared for testing later tonight if that works.
 
  • Like
Reactions: devilng

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,826
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
If you have the tools available, it would be good to probe around for the UART output from the device. UART is the first step to porting other OSs to a device.

My setup is an Arduino Mega. For probing I connect the RX line to a small piece of wire with a sewing needle attached. I ground the ground on the Arduino to the ground on the board. I then run minicom -D /dev/ttyUSB0. Set the options to 8n1 flow control off. Then probe around on the board while repeatedly pressing the power button so as to trigger UART transmission without turning on the device. Once you find a point with weird question marks, hold the power button, take a picture and annotate it.


The most common points are on the JTAG port. Usually they are opposite of the processor 's pin 0 dot. The RX and TX are always side-by-side. This would help people develop this device.
 
  • Like
Reactions: devilng

devilng

Senior Member
Jun 29, 2010
60
5
39
KIEV
guys, you're **cking best! I was waiting for that! so, I have 2 questions:
1) if I disassemble my tab I will lose my warranty any way, isn't it?
2) I'm not sure with my english so can anybody translate it in russian (please no google translate, I don't want to loose my beutiful device).
thanks for answers
p.s. is there any disassemble instuctions?
 
Last edited:

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
Awesome. Try running a heimdall print-pit or a close-pc-screen to verify everything works. Ill get a one-click back to stock and a one-click CWM prepared for testing later tonight if that works.

I did that before posting it worked, that was part of my confirmation

---------- Post added at 10:34 AM ---------- Previous post was at 10:30 AM ----------

If you have the tools available, it would be good to probe around for the UART output from the device. UART is the first step to porting other OSs to a device.

My setup is an Arduino Mega. For probing I connect the RX line to a small piece of wire with a sewing needle attached. I ground the ground on the Arduino to the ground on the board. I then run minicom -D /dev/ttyUSB0. Set the options to 8n1 flow control off. Then probe around on the board while repeatedly pressing the power button so as to trigger UART transmission without turning on the device. Once you find a point with weird question marks, hold the power button, take a picture and annotate it.


The most common points are on the JTAG port. Usually they are opposite of the processor 's pin 0 dot. The RX and TX are always side-by-side. This would help people develop this device.

UART is pin 20 (RX) and 21 (TX) on the docking port, we have actually had this for a while, The jtag port is different on this device, it is along the edge of the board and coated so you need to scrape them back to get access.

---------- Post added at 10:38 AM ---------- Previous post was at 10:34 AM ----------

guys, you're **cking best! I was waiting for that! so, I have 2 questions:
1) if I disassemble my tab I will lose my warranty any way, isn't it?
2) I'm not sure with my english so can anybody translate it in russian (please no google translate, I don't want to loose my beutiful device).
thanks for answers
p.s. is there any disassemble instuctions?

yeah you will lose your warranty when opening the device,

before getting someone to translate I would really make sure you know how to solder, I needed to use liquid flux to aid getting this done, and I don't normally use it ever, the points where you need to solder are fairly small.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 36
    First Off, Huge thanks to F50+ This man sacrificed his tab to locate these resistors.

    introduction
    I'm not kidding when I say UnBrickable. Modifying the OM pins means you can boot from USB, UART or MMC. This makes the device quite UNBRICKABLE. There is nothing you can do software wise to prevent the device from booting into this mode. We are communicating with the unrewritable, efused IROM on the processor. It's the thing that makes the system on a chip into a "system on a chip".I am here now to tell you how to turn your Samsung P1000 into a KIT-S5PC110 development board. The KIT-S5PC110 development board is the platform used to develop our phones. There are some differences between this mod and the official development platform. The S5PC110 has a removable internal SDCard and no touchscreen.

    Why would you want to do this? When you plug in the battery and connect it to the computer in "off" mode, it will become an S5PC110 board awaiting download of a program to run. This occurs long before anything like software or firmware enters the processor. This is the IROM of the device awaiting commands or a power on signal.

    How could it possibly be better then JTAG? Let's count the ways....
    1. The only part required is a wire.
    2. No shipping time.
    3. No cost for a box to interface the computer.
    4. Permanent.
    5. Can be done as a preventive measure.
    6. Gives the ability to test new Bootloaders temporarily.
    7. Allows development of the entire system.
    8. Removes worry about flashing and acts as a backup.

    After performing this mod:
    Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like a P1000. See the Special Instructions section.

    Part 1:Hardware Modification

    You will need:
    1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(or email my username@gmail.com) or Connexion2005(aka MobileTechVideos.com).
    2. Soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
    3. fFux
    4. Solder
    5. Tweezers
    6. A relay (possibly- for the wire within to use as a bridge)
    7. A #1 tri-blade driver


    performing the modification:
    1. tear apart your Galaxy Tab... Make sure to take out your SIM and external SDCard before you do this.
    1A. Remove the screws.
    1B. Separate the top case from the bottom case

    ****VIDEO OR PICTURES NEEDED*****

    2. Perform the mod as follows: remove the xOM5 resistor and jumper the non-grounded pad of xOM5 to the same side of xOM0 or xOM3.

    1zdxlpf.jpg


    I will be able to give more detail after I have performed this modification myself.

    3. reassemble the Tab.


    Special Instructions

    • This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds, then plugging in the device, or you can use an authentic Samsung Charging Cable for charging the battery
    • To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.

    Part 2: Software Based Resurrection
    6o1rbb.png



    The entire software resurrection can be summed up like this

    Here is a Galaxy Tab specific video

    Unbricking:
    1. Apply UnBrickable Mod to your device: see Hardware Modification section
    2. Run The Ultimate UnBrickable Resurrector. You can find the Resurrector here in our SVN repository http://code.google.com/p/hummingbird-hibl/downloads/list

    When you see this image you are in S5PC110 SEC SoC mode. When you see this mode you must proceed to step 2.
    k9cdgy.png


    If it will only show this image, then you have not performed the modification correctly, or you have a hardware problem.
    2qa4xas.png


    If it shows this, regardless of what's on your screen, you're in download mode. Proceded to step 3.
    730xm0.png



    2. Click the Download Mode button (then click the one next to it). I find it's easiest to click Download Mode, type a password, plug in the device, then press enter.

    3. Run Heimdall One-Click to flash firmware on your device. http://xdaforums.com/showthread.php?t=1323527
    mmpxmv.png


    4. repeat steps 2 and 3 with bootloader flashing enabled (Heimdall One-Click has a safety mechanism which requires you to flash once before flashing bootloaders).


    Conclusion

    Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.

    reading material
    Creating your own Samsung Bootloaders: http://xdaforums.com/showthread.php?t=1233273
    KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
    how to use DNW: http://tinyurl.com/dnw-how-to
    Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
    another DNW example: http://www.boardset.com/products/mv6410.php
    ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2


    drivers and utilities
    This will be an ever expanding list
    Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list
    Windows Drivers http://xdaforums.com/attachment.php?attachmentid=678937&d=1312590673
    Windows Download Tool DNW: http://xdaforums.com/attachment.php?attachmentid=678938&d=1312590673
    Windows Command Line tool: http://xdaforums.com/showpost.php?p=17202523&postcount=27
    Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
    Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list


    firmware
    Bootloader Hello World by Rebellos http://xdaforums.com/attachment.php?attachmentid=698077&d=1314105521
    UnBrick tool http://xdaforums.com/showthread.php?t=1242466

    Conclusion

    Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software. See here for setting up the UART output http://xdaforums.com/showthread.php?t=1235219
    4
    hi guys!!

    hi guys!

    I would help you! :)

    the theory:

    20syu0n.png


    this is the final work!

    20120331122118.jpg


    20120331113842.jpg


    senzatitolo2n.jpg



    This Debrickable mod (and mod Resurrection) works fine!

    what you need:

    1. a good friend (thanks Ivan DZ)
    2. great hands... (or friend's ones!)
    3. a tuning wire like this (enamelled copper coil)... thinner may be better but warm deforme it faster

    20120331125715.jpg


    4. remove the resistor xOM5
    5. bridge xOM5 to xOM0
    6. then mount your G Tab
    7. run the Ultimate UnBrickable Resurrector using Ubuntu
    8. connect G Tab to pc
    9. in UUBR appears "S5PC111 detect"
    10. click "Perform Resurection" in few seconds your Tab is in Download Mode (in pc's software appear the usual pic "download mode" that appear also in Android Devices, the Android that works in yellow, BUT in Tab it may not appear, in mine only the flash turned on and the screen was off!
    11. now your Tab is in Download Mode! Do not disconnect the Tab! The Download Mode is supported by software, if you disconnect the Tab it lost the Download Mode!
    12. run Heimdall One-Click
    13. click "Flash"
    14. re do points 10-13 until Heimdall One Click allow to check "Flash Bootloader"!
    15. check "Flash Bootloader"... wait...
    16. Here you are your resurrected TAB !!!! (it's running stock GB Rom!)



    special thanks to AdamOutler
    and to Ivan DZ!
    2

    Because there is no way to hard brick it exccept damging your emmc and ticking repartition in odin !!!
    1
    Congratulations~~~~~

    Its way too early for that... save that for the how-to thread.
    1
    This link and the HeimdallOneClick link redirect to github, what do I do with the zip to get HeimdallOneClick running?

    Here it comes. You are welcome.
    The github sources aren't very usable for mere humans :)