[25.01.2011] WARNING! Do not flash JM,KA... README! [Patch released, L/N supported]

NGP · Dec 30, 2010

rotohammer said:
Looks like my jtag box will be in next week, so let me do the flashing to bml1, bml4 and bml5 as I will be able to recover from bricking.

Don't do that! I know the man who get a brick this way...

Sparkle1975 · Dec 30, 2010

Chainfire said:
If you are flashing a CODE/MODEM/CSC combo, boot and sbl are in the CODE file. You can just rename this file to .tar (if it is named .tar.md5 instead of .tar) and open them with WinRAR to check, by the way.

Thanks for the idea - got my Tab back alive again. However, I did not follow this suggestion. Instead, I just tried a CODE/MODEM/CSC combo, and... IT WORKED!

I used this:
Odin3 v. 1.0 (don't know if Odin 1.3 or Odin 1.7 is better, but I used the old one)
909.pit
P1000OXAJM6(PAR).tar (JM6 firmware)
MODEM_P1000XXJID.tar.md5 (from XXJID firmaware)
GT-P1000-CSC-SERJJ2.tar.md5 (from XXJID firmaware)

And now the beast is alive.
Baseband version P1000XXJID
Kernel 2.6.32.9 root@sep-53 #1
Build: FROYO.XXJM6

EDIT:
Worked, booted, but just one small problem: The backlight won't turn off automatic. But then I flashed these files:
http://xdaforums.com/showpost.php?p=9468220&postcount=1
And now it works perfect - backlight turns off, it's quite snappy.

I don't know if the firmware (boot/kernel) are signed or not, so right now I don't know which firmwares I am able to flash.

Next step: Is there any point in rooting the device? And are there no signs of custom ROM's ?

blacklevel · Dec 30, 2010

abuser0815 said:
you should definitely be able to flash jk5 kernel, because i have the same constellation, and it works like this:

EDIT: I´m not responsible if it fails, as this is just decribing what I did...

1. backup everything.

2. factory reset and formatting internal sd

3. repartition with odin (just pit file which is adecuate for jk5)

4. don´t reboot go straight back to downloading screen by holding vol down after flashing pit

5. heimdall graphical frontend (sorry geeks, it works and its comfortable) everything from jk5; but i would go to a former firmware as jk5 which includes all, also boot.bin and sbl.bin; put in heimdall everything from your firmware you like to flash except pit and recovery-->

6. press start in heimdall; the process on the computer should go without any error

AND NOW

7. your tab get stucked at aproximately 87 % update process; NO Panic

8. disconnect your device from your pc and start it, you should come to a very basic bootscreen "tab---warning---computer"

9. start odin and do just the step 3 again

10. while rebooting hold volup to make sure it starts installing the rest

11. voila, you should have your wished firmware installed.

ATTENTION, it might show again that the primary bootloader and kernel is still signed, but .....

12. flash your dbdata and install your tab new

that was how i made it working, can somebody confirm it please??

Now, that is interesting. If your procedure can be reproduced it would show at least one thing.

The failure to flash an unsigned kernel is because somehow the partitioning does not work for an unsigned kernel. Thus the flashing fails.

According to your procedure the flashing of an unsigned kernel works if the Tab is first repartitioned to a layout which matches the unsigned kernel.

I still have my doubts whether this procedure also allows to downgrade/replace the PBL to an unsigned version (or works at all for that matter).

If that is indeed the result of your procedure

ATTENTION, it might show again that the primary bootloader and kernel is still signed, but .....

it simply means that the flashing of the PBL (boot.bin) and the kernel were both unsuccessful, even if the flashing of the other parts worked okay.

I will check and post my findings.

psxsnake · Dec 30, 2010

if I have all signed (flashed with samfirmware JMD) what's mean?

NGP · Dec 30, 2010

It means you can't flash unsigned boot, sbl and kernel (from JK5 and older)

abuser0815 · Dec 30, 2010

@blacklevel,

Heimdall is not stating an error on flashing those parts as kernel, pbl and sbl.

Sent from my GT-P1000 using XDA App

m.tom59 · Dec 30, 2010

abuser0815 said:
you should definitely be able to flash jk5 kernel, because i have the same constellation, and it works like this:

EDIT: I´m not responsible if it fails, as this is just decribing what I did...

1. .....

6. press start in heimdall; the process on the computer should go without any error

AND NOW

7. your tab get stucked at aproximately 87 % update process; NO Panic

.....

11. voila, you should have your wished firmware installed.

ATTENTION, it might show again that the primary bootloader and kernel is still signed, but .....

.....
that was how i made it working, can somebody confirm it please??

Have you compared the kernel?

I have done it as you have described it. But the kernel is still the same.

Here is what i think:
it is the same kernel as before, this is why it stucks at 87%, the kernel can not be flashed.
You can go easyer to an older firmware, remove the boot.bin, sbl.bin, and zImage from the firmwarefile, and flash it.
In my oppinion, is the way that you described a very dangerous way.

m.tom59

blacklevel · Dec 30, 2010

abuser0815 said:
Heimdall is not stating an error on flashing those parts as kernel, pbl and sbl

can you post the kernel info from the settings menu? Maybe heimdall does not recognize if the Tab has refused to accept the new kernel.

paulshields · Dec 30, 2010

abuser0815 said:
@blacklevel,

Heimdall is not stating an error on flashing those parts as kernel, pbl and sbl.

Sent from my GT-P1000 using XDA App

Heimdall doesn't really say anything one way or the other when flashing. These kinds of tools are always very blunt and "dumb" in information terms. I suspect like others that you're not flashing an equivalent kernel when rolling back to whatever previous version you're choosing. Simple way to tell is to run chainfire's script. If you've managed to get to an unencrypted kernel/bootloader then that is significant but we will need proof

.

abuser0815 · Dec 30, 2010

Paul...

I assumed also that its not really changed. But under*#1234# it shows me the firmware i flashed and i wanted. Kernel, pbl and sbl i do not really know wht heimdal is doing on it or not.

Sent from my GT-P1000 using XDA App

m.tom59 · Dec 30, 2010

I have try to flash an unsigned sbl with the foolowing command:
adb shell su -c "dd if=/sdcard/Sbl.bin of=/dev/block/bml4 bs=4096"
but with no working result. After reading the sbl again:
adb shell su -c "dd if=/dev/block/bml4 of=/sdcard/Sbl.bin bs=4096", it is still the same as before.
Also i have flashed an unsigned zImage in this way.
The kernel can flashed, but after flashing, the Tab don't start up.
I must flash an signed kernel again to reactivate the Tab.

m.tom59

xIllu · Dec 30, 2010

so my tab is SIGNED, what does that now actually mean ? which roms can be flashed and which can not ? tnx

Volker1 · Dec 30, 2010

abuser0815 said:
Heimdall is not stating an error on flashing those parts as kernel, pbl and sbl.

In order to get a useful log out of Heimdall, you need to flash from the command line and pass the --verbose option

Code:

[user@localhost]$ ./heimdall
Usage: heimdall <action> <arguments> [--verbose] [--delay <ms>]

action: flash
arguments:
    --repartition --pit <filename> --factoryfs <filename>
    --cache <filename> --dbdata <filename> --primary-boot <filename>
    --secondary-boot <filename> --param <filename> --kernel <filename>
    --modem <filename>
  or:
    [--pit <filename>] [--factoryfs <filename>] [--cache <filename>]
    [--dbdata <filename>] [--primary-boot <filename>]
    [--secondary-boot <filename>] [--secondary-boot-backup <filename>]
    [--param <filename>] [--kernel <filename>] [--recovery <filename>]
    [--efs <filename>] [--modem <filename>]
description: Flashes firmware files to your phone.

Chainfire · Dec 30, 2010

Jesterz said:
@chainfire,

What's the status of this? maybe we can pool resources with more people looking into this.

also, I assume (?) you played around with bmlunlock by koush ?

https://github.com/CyanogenMod/android_device_samsung_bmlunlock
Precompiled binary here: http://koush.tandtgaming.com//samsung/bmlunlock

After running bmlunlock on the samsung device, one can flash the kernel using the following command: dd if=/sdcard/zImage of=/dev/block/bml7 bs=4096

(yes i'm catching up, didn't read through 19 pages so excuse me if double posting )

Now I can understand you haven't been able to catch up with everything that has been said in every single page. However, the bmlunlock thing is mentioned even in the first post. Also, you could have tried "searching this thread" for bmlunlock, which would give you many references to it. As an FSM, both should have occurred to you. (

)

As for current status, nothing yet. There isn't much that I can do without an operational Tab.

Regarding resources, pooling, and people, there's enough people on the job. Right now it's just a bit of a waiting game for everyone to get their equipment in order to start testing. I'm still analysing a lot of dumps myself, trying to figure out some things about the BLs. Rotohammer is on the job and waiting for his RIFF BOX (JTAG unit) to arrive. Richthofen is waiting for a Tab + RIFF BOX to help figure this out (expected within days), and also going through the tech docs trying to figure out how to make a "factory mode" JIG (quite similar to the "download mode" JIG for SGS) which can possibly revive my Tab. In the meantime, Da_G has offered to ship his own JTAG unit + tools to me, and if Richthofen's "factory mode" JIG doesn't work out, I'll take Da_G up on this offer. Da_G and cmonex' expertise is also just an IRC connection away should I need them

Really, we have enough people on the job with enough knowhow to fix this, and I don't expect the fix is much more than a week or so away. Right now everyone is pretty much just waiting on the hardware to allow testing in a safe way.

kromosto said:
or the mechanism to determine if sbl is signed or not not working well. also can be a nethod for forceing flash that might be our solution if we can find it.

I'm not sure what's wrong with the SBL, I've analysed one of these unsigned SBLs between signed PBL and kernel, and it does actually seem to be unsigned. Maybe it's sneakily using SBL2, or the bml dump got garbled (blocks out of order) which is also completely possible. There's some weird stuff still with the PBL dump as well, hopefully we'll figure out soon why/what/how.

Jesterz said:
I've played with dd fun before in the "old" days, somewhat scary, however bml7= kernel, which should be still reflashable using odin etc. bml1&2 is the scary part as that contains the bootloaders.

Edit:

Maybe a better way is to use the samsung OTA tool, redband_ua, didnt have time to dig in, however its in heavy use on the Galaxy S, might work on Tab
http://xdaforums.com/showthread.php?t=765724&page=2

However i'm assuming ChainFire is this far and I don't want to duplicate work, but detailing what is done already is useful

I've looked a bit at redbend (not very extensively), do you know how to flash multiple parts without rebooting ? Also of course we do not know whether flashing through redbend involves the checks.

abuser0815 said:
you should definitely be able to flash jk5 kernel, because i have the same constellation, and it works like this:

EDIT: I´m not responsible if it fails, as this is just decribing what I did...

1. backup everything.

2. factory reset and formatting internal sd

3. repartition with odin (just pit file which is adecuate for jk5)

4. don´t reboot go straight back to downloading screen by holding vol down after flashing pit

5. heimdall graphical frontend (sorry geeks, it works and its comfortable) everything from jk5; but i would go to a former firmware as jk5 which includes all, also boot.bin and sbl.bin; put in heimdall everything from your firmware you like to flash except pit and recovery-->

6. press start in heimdall; the process on the computer should go without any error

AND NOW

7. your tab get stucked at aproximately 87 % update process; NO Panic

8. disconnect your device from your pc and start it, you should come to a very basic bootscreen "tab---warning---computer"

9. start odin and do just the step 3 again

10. while rebooting hold volup to make sure it starts installing the rest

11. voila, you should have your wished firmware installed.

ATTENTION, it might show again that the primary bootloader and kernel is still signed, but .....

12. flash your dbdata and install your tab new

that was how i made it working, can somebody confirm it please??

That's just a very elaborate way to flash a different ROM without replacing PBL, SBL and kernel. Has been discussed before in this thread.

KarlMarsh said:

Here is the output from a stock ATT ROM. Probably no surprises here.

Edit: Noob question: Why does the output say it transfered the file successfully but then says it can't find the files? Did I do something wrong?

Code:

========================================================
= Samsung Galaxy Tab Bootloader Check v1.0             =
= Copyright (C) 2010 Chainfire                         =
=                                                      =
= Please make sure your device is connected, rooted,   =
= and USB debugging is enabled !                       =
=                                                      =
= Accept the SuperUser prompt when it shows up !       =
========================================================

Press any key to continue . . .

========================================================
= Dumping PBL, SBL and kernel ...                      =
========================================================

su
rm /sdcard/bml1.bin
rm /sdcard/bml4.bin
rm /sdcard/bml7.bin
dd if=/dev/block/bml1 of=/sdcard/bml1.bin bs=4096
dd if=/dev/block/bml4 of=/sdcard/bml4.bin bs=4096
dd if=/dev/block/bml7 of=/sdcard/bml7.bin bs=4096
exit
exit
$ # # # # 64+0 records in
64+0 records out
262144 bytes transferred in 0.050 secs (5242880 bytes/sec)
# 320+0 records in
320+0 records out
1310720 bytes transferred in 0.171 secs (7665029 bytes/sec)
# 1920+0 records in
1920+0 records out
7864320 bytes transferred in 0.699 secs (11250815 bytes/sec)
# $
========================================================
= Retrieving files ...                                 =
========================================================

Could Not Find C:\Documents and Settings\Karl\My Documents\Android\SGTBootloader
Check-1.0\boot.bin
Could Not Find C:\Documents and Settings\Karl\My Documents\Android\SGTBootloader
Check-1.0\sbl.bin
Could Not Find C:\Documents and Settings\Karl\My Documents\Android\SGTBootloader
Check-1.0\zimage
331 KB/s (0 bytes in 262144.000s)
384 KB/s (0 bytes in 1310720.003s)
374 KB/s (0 bytes in 7864320.020s)

========================================================
= Here come the results ...                            =
========================================================

SGT-BootloaderCheck v1.0 - Copyright (C) 2010 Chainfire

boot.bin: Unsigned
sbl.bin: Unsigned
zImage: Unsigned

Assessment:
-- Bootloaders: Unprotected, can flash all bootloaders and kernels
-- Kernel: Unsigned, can only be flashed on unprotected bootloaders

Press any key to continue . . .

The "Could not Find ..." is because the script deletes old files (if present) before transferring the new dumps. The first time you run it, there won't be any old files present, hence the error message trying to delete them.

m.tom59 said:
I have try to flash an unsigned sbl with the foolowing command:
adb shell su -c "dd if=/sdcard/Sbl.bin of=/dev/block/bml4 bs=4096"
but with no working result. After reading the sbl again:
adb shell su -c "dd if=/dev/block/bml4 of=/sdcard/Sbl.bin bs=4096", it is still the same as before.
Also i have flashed an unsigned zImage in this way.
The kernel can flashed, but after flashing, the Tab don't start up.
I must flash an signed kernel again to reactivate the Tab.

m.tom59

Interesting. It has been attempted to flash both bml1 AND bml4, resulting in full bricks. Maybe both need to flashed in order to make any difference stick ?

But really people, STOP TRYING TO OVERWRITE BML1 AND BML4 IF YOU DO NOT HAVE A JTAG UNIT AND KNOW HOW TO USE IT. If you mess it up, only a JTAG unit (or possibly a "factory mode" JIG) will be able to revive your device.

sprecker · Dec 31, 2010

Wow! 22 pages of some hard working people. Keep it up guys!

Ilia_Z · Jan 1, 2011

Hi Happy New year!

Help me please, I brick my tab
I have T-mobile with JJB firmware version and try to load full(with PIT)
russian ver P1000XWJJ7 via Odin 1.7 (Im from Russia).
After start I wait long time with no result, then I power off my tab
and now see "PC -!- phone" pic only. No download mode,
but if I press both vol bat and plug USB I see
"Power rest or Unknown upload mode" and Odin see my tab.
What I sould do to unbrick my tab?
Help me please

rotohammer · Jan 1, 2011

Ilia_Z said:
Hi Happy New year!

Help me please, I brick my tab
I have T-mobile with JJB firmware version and try to load full(with PIT)
russian ver P1000XWJJ7 via Odin 1.7 (Im from Russia).
After start I wait long time with no result, then I power off my tab
and now see "PC -!- phone" pic only. No download mode,
but if I press both vol bat and plug USB I see
"Power rest or Unknown upload mode" and Odin see my tab.
What I sould do to unbrick my tab?
Help me please

Flash Roto-JME to get back to a working state, then decide what you really want after.

joeearl13 · Jan 1, 2011

Thanks for all your hard work guys. Got my Tab a few a weeks back but held off flashing for a while to take some time to read up on it all. Thanks to your info I successfully flashed up to JMC from T-Mobile JJ3 (UK) a few days back without getting a signed boot.bin or sbl.bin, and am now going to flash Roto's JME.

falan · Jan 1, 2011

It's possible to use this, to install the ClockworkMod Recovery and come back to unsigned firmware with nandroid backup?

Landroid · Jan 1, 2011

what does it mean if sbl.bin isn't signed, but kernel and boot.bin are!

am i affected?

[25.01.2011] WARNING! Do not flash JM*,KA*... README! [Patch released, L/N supported]

Senior Member

Member

Member

Senior Member

Senior Member

Senior Member

New member

Member

Senior Member

Senior Member

New member

Member

Senior Member

Moderator Emeritus / Senior Recognized Developer

Senior Member

Member

Senior Member

Senior Member

Member

Senior Member

Similar threads

Top Liked Posts

[25.01.2011] WARNING! Do not flash JM,KA... README! [Patch released, L/N supported]