The opening of the Wave bootloader through FOTA

Hi everyone,

Many people have complained about the Wave bootloader being closed and that being major problem for the development of alternative OS.

I had a closer look at the booting process and would like to contribute my observations to the community. I shall have little time (next to none) to work on it further, so I'd like someone to take it from this point.

OK, that said I can introduce you to what I found:
The booting process starts with initialization of the hardware, interrupts, etc. and gets to the selection of the booting mode. This is the place that checks the key combination, JIG and possible problems. Basing on this the bootloader will run the phone in either normal boot mode, go to dowload or upload mode.

Normal boot shall start with checking the FOTA module. If you already tried flashing your phone you probably noticed that some versions of the FW include a file with *.fota extension. The file is unencrypted and not signed. It's about 2MB, but the bootloader reserves exactly 3MB for it. FOTA is intended to be used for firmware update over the air, but I know nothing about it being used for Wave. You may read something about the design and get a concept of that process here:
http://www.freepatentsonline.com/pdfb/documents/usapp/patent_pdf/2010/017/US20100175062/pdf/US20100175062.pdf
Basically, it is possible that boot would need to perform some actions that are a result of FOTA. Therefore, during the normal boot it reads the FOTA module from the NAND (0xC600000) and checks whether the module exists and is in the right version. That is done by checking a magic (text "FOTA_ENGINE_VER_INFO_2.0") under the 0xC600100. If it is found missing or incorrect you will end up with the message "FOTA Engine is not intalled" or "FOTA Engine version mismatch" on the screen and you will need to restart your phone in the download mode to load it.
After that, the code checks for additional magic values at 0xC880000. In case it is "BPDZ" it jumps to the code in the FOTA file. The contents of the file is loaded to RAM location 0x43800000 and executed from there.

I've made an experiment as a proof-of-concept and have a confirmed that the above is true and valid information. I crafted a FOTA file longer that the usual attached (to be bigger than 2,5 MB). In case you want to repeat that, remember that last 1024 bytes are not loaded and insert additional data before that. My file had two magic values:
"FOTA_ENGINE_VER_INFO_2.0" at 0x100 offset and "BPDZ" at 0x280000. At offset 0 I've placed my code that started with several NOPs (just in case) and code that called original bootloader functions to display text on the screen.
After loading the file with Multiloader, the message appeared on the screen as expected. Reloading of the original FOTA file made the phone boot normally.

The discovery opens wide area of possibilities starting with replacing bootloader without signing it or using JTAG, multiboot, etc.
As the original bootloader is in the memory as well, we can use it, but I would not recommend that approach as we would need additional version control and changing original routines and data addresses for each version.

OK. I hope I made it clear enough to understand, but I can clarify what I might have omitted in the description. The idea is that someone here would pick that up from where I finished and develop a decent loader leaving the original files (apart from FOTA) untouched.

Best Regards,
mijoma


-----------------------------------
Edit: Added proof-of-concept FOTA file (based on XXJL2 FOTA). Use wisely - remember you take full responsibility for what you load on your phone. Works ONLY with XXJL2 bootloader.

Thanks guys, but I don't think it's necessary.
I do it for fun - don't need any other gratification. Wave got me interested with the effort the manufacturer put trying to keep it closed. I don't need a handset to disassemble the bootloader.

kakashibg said:

mijoma, along with Oleg_k you are working to complete the project for the bada and android research to launch the s8500 by mode FOTA? would like to ask what progress?
ps: sorry for the stupid question of my little
I use google translate

Click to expand...

Click to collapse

Quite honestly, I haven't got enough time for this. I've done attempts to mount the SD through FOTA, but with little success. It's not that hard, but seems I'm missing some detail.

As for the Android porting project I extracted some LCD handling code and made some modifications to SGS bootloader to match the GPIO in Wave, but that's all.

In the first post of the thread I've already stated I hope somebody can take if from here. The method is served on a plate - has almost no limitations - full memory and devices access, original BL loaded in DRAM (may think about patching). All you need is to write some pieces of the code and test that. What I don't get is how Samsung Jet community gathered bright enough guys to do all that stuff and Wave owners wait for somebody else do that job for them offering donations for everybody asking, even without the skills. You won't ever finish your porting projects if you're planning to base them on 2-3 guys. Better find yourselves some reverse engineers and developers.

I've helped as I could and I'm already reaching my time limit for next several months.

Then, obviously i did something wrong, done manual single-byte conversion, works well too.

Mwahahah!
Sorry if my code looks like cow's ****, it's my first own asm code.

Remember to include proper addresses and modify multiloader header if you want to test it on S8500.

//edit:
Okay, any1 wanted to do real file explorer and manager for Wave? Touchscreen handling and some ops left todo.

//edit2:
SD Card doesn't seem to be mounted by default, so a year of struggles ahead!

After a week of research I found it!
We haven't loaded PBL as we thought it is unnecessary. But it has got very important role. It does complete reinitialization of DDR controller MPC0, mapping chip0 to 0x30 address space (by default it is under 0x20) and chip1 under 0x40 (it does some kind of switching, because before that chip1 is being controlled by MPC1 as chip0)

For now I've copied parts of PBL code to FOTA, now waiting for Serg to do some tests. Of course I'd be very surprised if that would be enough to boot kernel, but we're closer for sure!