AMSS, Bootloader Questions

adfree · Jan 31, 2013

Someone tested short on Wave 2 (S8530)...
Thanx :good: :good:

So it seems "step 1" is not mandatory. So for S8500 1 package is enough to demonstrate RSA 1024 Check OFF in Bootloader Chain...

Same like 1 post before...

1.
Multiloader and choose ONLY Boot Change.

Expect no magic at the moment.
Its only Demonstration that Boot is now ready to modify.

Again.
At your own risk.

Modification to Boot is NOT without risk.

Only play if you have RIFF Box or other JTAG to reanimate...

Best Regards

franzest15 · Jan 31, 2013

adfree said:
Again.

Bootloader play is DANGEROUS.

Please read carefully and:
AT your OWN RISK!

Files for S8530 Wave 2... based on XXLA1 DBT Boot...

1.
See Screenshot.
ONLY Boot Change needed.

2.
Use at first this files content...
XXLA1_S8530_SecurityOFF.rar

Please unpack before.
You can see then folder:
BOOTSecurityOFF with 2 files...

3.
If handset start... and not explode... you could try second folder... Example from second_S8530_Example.rar

Good luck.

Now I will upload soon for S8500...

Best Regards

i already flash the two Boot file sir, now what will the new outcome of my wave 2? will it be faster sir? :fingers-crossed:

hero355 · Jan 31, 2013

Seems my S8500 is alive

Boot Binary Download Start Ch[0]
BootLoader 1703.9KB OK[0.7s]
Dbl 281.5KB OK[0.8s]
All files complete[2.0s]

adfree · Jan 31, 2013

If you now enter Download Mode...

You see something else then Download mode...
And in Multiloader you see something else then LISMORE.

Thank you very much for testing. :good:

Best Regards

Edit 1.

i already flash the two Boot file sir, now what will the new outcome of my wave 2? will it be faster sir?

NOT faster yet. But now it is an evidence that Bootloader is not more unmodifiable.

Remember why we have Limitations and why we have to use FOTA.
Because Bootloader was STRONG secured.

Now Security is removed in Bootloader... :angel:
Not all but the RSA 1024 Check of whole boot_loader.mbn...

Best Regards

hero355 · Jan 31, 2013

adfree said:
If you now enter Download Mode...

You see something else then Download mode...
And in Multiloader you see something else then LISMORE.

Thank you very much for testing. :good:

Best Regards

ehehe previously i flashed it kies-download mode

Now I see Download FREE

and ML Ready - [FREE@3!]

Nice progress

Good Luck and I'm here all time for testing

adfree · Jan 31, 2013

Now I see Download FREE

and ML Ready - [FREE@3!]

Its simple text Edit, but it was never seen before.
I have never seen this before.

Only oleg_k was able to use custom Bootloader... with RIFF JTAG...
I don't know any details about his work...

Now we could use knowledge about Boot to do some real tweakings...

WARNING again.

Bootloader is brain of handset...

If you edit wrong or other mistakes or accidents.. then handset dead... and only JTAG Hardware can help to renimate...

Be very carefully with own experiments.

Best Regards

hero355 · Jan 31, 2013

Just a little stupid question : If you breaked (removed) security in bootloader,then what we gain with this
f.e real android can be ? full ram without bada ?

adfree · Jan 31, 2013

In theory we could do now more then with FOTA.

Like S8000 JET used own Bootloader...

But we need more brain...

I have not enough brain...

Experts are:
b.kubica
mijoma
Rebellos

Alphabetical order... If I have someone forgotten. Sorry.

Also new experts are welcome.

Only hint again.
You can not play with Bootloader without RIFF or other JTAG to have Backup...

Otherwise 1 wrong move and you can not use your handset anymore...

Its dangerous.

Best Regards

franzest15 · Jan 31, 2013

adfree said:
Only hint again.
You can not play with Bootloader without RIFF or other JTAG to have Backup...

Otherwise 1 wrong move and you can not use your handset anymore...

Its dangerous.

Best Regards

yeah ur right at first i maid a mistake,. then my phone stock with bootlogo.. i re-flash it and do it again :laugh:

hero355 · Jan 31, 2013

franzest15 said:
yeah ur right at first i maid a mistake,. then my phone stock with bootlogo.. i re-flash it and do it again :laugh:

Then it is not compatible with your firmware,which firmware is currently you are running on phone

oleg_k · Jan 31, 2013

adfree said:
:victory:

Bingo.

I got it. Now I can modify boot_loader.mbn and simple flash via Multiloader.

First stupid test again... text change...

My DL Mode now display:
Download FREE
instead
Download Mode

2 f. years later...

XXJEB...

Now I will check if I can play with XXLA1 Boot...

Best Regards

P.S.:

Need user with RIFF Box to confirm working solution.

I can provide all necessary steps...
Simple ask me.

WARNING!
CMM Script seems needed and no idea if safe for enduser...

But for me it work.

If this for s8600-i'm ready for test!send manual

adfree · Feb 1, 2013

Code:

/ f /   / g /   / h /   / d e v / m s 0   / d e v / m s 1   / d e v / m s 2   / f / C S C   / S y s t e m F S / I S O   / f / S y s t e m F S I S O   / h / b a d a   / S y s t e m F S / M e d i a   / f / S y s t e m F S M e d i a   / S y s t e m F S / P o w e r O n O f f   / f / S y s t e m F S [B]P o w e r O n O f f[/B]   / g   / O s p   / f / M a s s   / U s e r / M a s s   / S y s t e m F S / M e d i a S e t   / f / S y s t e m F S M e d i a S e t   / A p p E x   / h / a p p e x   b t f s   d e v f s

This is funny...
If I rename P o w e r O n O f f folder in boot_loader.mbn...
After init of Full Flash... this folder is empty... no files...
Power ONOFF Animation not played...

Will do some tests...

Best Regards

Edit 1.

Strange.
I can not find my renamed folder 1 o w e r O n O f f...
Folder in STune is empty... I can create folders, but it is removed by "Ghost" after Restart...

Maybe my fault was both text strings "Power" to edit...

princepsp · Feb 1, 2013

adfree said:
Code:

/ f / / g / / h / / d e v / m s 0 / d e v / m s 1 / d e v / m s 2 / f / C S C / S y s t e m F S / I S O / f / S y s t e m F S I S O / h / b a d a / S y s t e m F S / M e d i a / f / S y s t e m F S M e d i a / S y s t e m F S / P o w e r O n O f f / f / S y s t e m F S [B]P o w e r O n O f f[/B] / g / O s p / f / M a s s / U s e r / M a s s / S y s t e m F S / M e d i a S e t / f / S y s t e m F S M e d i a S e t / A p p E x / h / a p p e x b t f s d e v f s

This is funny...
If I rename P o w e r O n O f f folder in boot_loader.mbn...
After init of Full Flash... this folder is empty... no files...
Power ONOFF Animation not played...

Will do some tests...

Best Regards

Edit 1.

Strange.
I can not find my renamed folder 1 o w e r O n O f f...
Folder in STune is empty... I can create folders, but it is removed by "Ghost" after Restart...

Maybe my fault was both text strings "Power" to edit...

Atention: Following answer is soo much noobish and stupid.

Maybe it doesnt support big letter ? like "P"ower

Tigrouzen · Feb 1, 2013

look at slash /

adfree · Feb 2, 2013

Code:

/f/
/g/
/h/
/dev/ms0
/dev/ms1
/dev/ms2
/f/CSC
/SystemFS/ISO
/f/SystemFSISO
/h/bada
/SystemFS/Media
/f/SystemFSMedia
/SystemFS/PowerOnOff
/f/SystemFSPowerOnOff
/g
/Osp
/f/Mass
/User/Mass
/SystemFS/MediaSet
/f/SystemFSMediaSet
/AppEx
/h/appex
btfs
devfs

look at slash /

But this seems normal as other folders also without...
Looks like some kind of "convert"...

First I thought this is about hidden folders or about write protection...

Will do some tests...

Maybe later more clear to me.

First try was this:

Code:

/SystemFS/[COLOR="Red"]1[/COLOR]owerOnOff
/f/SystemFS[COLOR="Red"]1[/COLOR]owerOnOff

Now I will test:

Code:

/SystemFS/[B]1[/B]owerOnOff
/f/SystemFSPowerOnOff

and then:

Code:

/SystemFS/PowerOnOff
/f/SystemFS[B]1[/B]owerOnOff

Maybe then I know what it is...

Best Regards

Edit 1.

Not realized that PowerOnOff is 4 x in boot_loader.mbn...
2 x Unicode
2 x "normal text" string...

adfree · Feb 2, 2013

Back to Partition Table or reserved area for Mulltiloader...

I want find this Value for startadress from apps_compressed.bin:
0x01100000

In ELF I can find this as text... in Binary seems not or I am blind...
Text string from ELF...

Code:

FLASH_CODE_START_ADDR 0x01100000

01100000 this I can't find as text nor Unicode...

01100000 as HEX Value I can find 6 x

Maybe XPKD6 can help me to identify correct area... here is at 01300000 OneNAND reserved...

Or if Little Endian... then I need to find correct:

Code:

0000100100

7x
Or maybe only 4 Byte

Code:

00001001

10x hits...

Sounds not much... I will check...

and compare with XPKD6... maybe then more clear to me...

Best Regards

Edit 1.
Maybe near text string LISMORE...

hero355 · Feb 2, 2013

adfree said:
Back to Partition Table or reserved area for Mulltiloader...

I want find this Value for startadress from apps_compressed.bin:
0x01100000

In ELF I can find this as text... in Binary seems not or I am blind...
Text string from ELF...

Code:

FLASH_CODE_START_ADDR 0x01100000

If you success then we can flash Korean models fw 's to S8530/S8600 ?

:highfive:

adfree · Feb 2, 2013

If you success then we can flash Korean models fw 's to S8530/S8600 ?

This could be 1 sideeffect. To solve problems like this:
http://xdaforums.com/showthread.php?t=2088981

S8530 and M210S...

But for S8600 and M410S and M410K other mechanism...
Partition Table is easier to find...
partition.bin

But more risk... as I have no solution nore tested...
S8600 is pure Qualcomm and JTAG with S8600 is much much harder... not tested yet...

Best Regards

adfree · Feb 3, 2013

Okay, this looks not wrong...
Little Endian and it makes sense...

S8500 XXLA1...

HEX

00001001

reversed order for apps_compressed.bin

Code:

00008019

RC1

Code:

0000901D

RC2

Code:

0000700B

No idea yet...

You can see these adresses also in Multiloader...

Time for few stupid tests...

Best Regards

Edit 1.
These adresses seems no effect... I have 16 Byte overwritten with 00000... S8500 not explode. Normal start...

No other addresses reserved in ML

Edit 2.
FLASH_BML_BL3_2ND_START_ADDR (0x0B700000)

adfree · Feb 3, 2013

I'm searching for boot_loader.mbn based on XXLA1 with minor differences...
perfect if addresses in Multiloader are different...

For instance Boot from chinese ZCLB4 this time 1:1 same reserved addresses...
Only Sigs and Date differ...

Will check my HDs...

Best Regards

Edit 1.
DTM BOLE1 maybe... but too many differences to compare easily... but ELFs included... seems no different adresses in ML
ERA LC2... with ELFs
INU DDLC2 with ELFs
MAX ... with ELF
TEN LG1 with ELF
THL LD1 with ELF

Edit 2.
Movistar_VM is also based on XXLA1 Boot... only date different and... GT-S8500L...
Will check M210S Firmware... if S8530 or ...

AMSS, Bootloader Questions

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Retired Recognized Developer

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Attachments

Senior Member

Similar threads

Top Liked Posts