Creating correct cfg

Search This thread

bobbywan30

Senior Member
Nov 18, 2017
125
8
Inside is the promised
SM-G975F,FD,X BIT U3 FLASH COMBINATION WITHOUT ETOKEN SOLUTION.rar

A

CFG is 1:1 same... so IMHO you waste your time with this...

B

I Filename I see U3... will check what your sboot .bin is...

Later more...

Edit 1.

Your sboot Bootloader from first post is:
N975FXXS8HVJ1

Version from repair package... the splittet BL stuff
FA90_N975FXXU1ASJ1


IMHO you need to split your sboot.bin...


Ehm not impossible... but hard...

bl should be the same IMHO... so you have 1 of 6 files...

Now only 5...
Code:
bl2.bin
dram_el3mon.bin
dram_train.bin
epbl.bin
s-boot.bin

Best Regards
hello and thank you for your interest. I had the U8 on the Samsung Note 10 Plus when it killed me.
look at the firmware that was on the phone in the picture
and this is the sboot.bin extracted from the firmware that was on the phone
 

Attachments

  • sboot.rar
    1.1 MB · Views: 1
  • 20230205_081359.jpg
    20230205_081359.jpg
    3.4 MB · Views: 9

bobbywan30

Senior Member
Nov 18, 2017
125
8
@adfree splitting sboot is not a big deal, we have the offsets (except for dram_train.bin) see posts #12, #28 between all the garbage.
(no thanks to @bobbywan30 for pointless spamming repeatedly same info again and again)

But I don't understand the differences between the CFG files, nor the meaning of these numbers 200 20.

for example
Code:
DNW_STORE e5250 fwbl1 200 20 bl1.bin
e5250: is the SoC
fwbl1: is the label
200: ?
20: ?
bl1.bin: is file extracted from sboot

but this CFG file looks different
Code:
DNW_STORE exynos down 200 20 bl1
exynos: some kind of "broad" SoC?
down: ?
200: ?
20: ?
bl1: is file extracted from sboot

also there is no DNW_WAIT maybe we should add?
@adfree splitting sboot is not a big deal, we have the offsets (except for dram_train.bin) see posts #12, #28 between all the garbage.
(no thanks to @bobbywan30 for pointless spamming repeatedly same info again and again)

But I don't understand the differences between the CFG files, nor the meaning of these numbers 200 20.

for example
Code:
DNW_STORE e5250 fwbl1 200 20 bl1.bin
e5250: is the SoC
fwbl1: is the label
200: ?
20: ?
bl1.bin: is file extracted from sboot

but this CFG file looks different
Code:
DNW_STORE exynos down 200 20 bl1
exynos: some kind of "broad" SoC?
down: ?
200: ?
20: ?
bl1: is file extracted from sboot

also there is no DNW_WAIT maybe we should add?
sorry alecxs. but I don't know the rules of the site and it wasn't on purpose
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
IMHO in CFG "Running Gag"...

You need in main only file list... which are pushed to device...


I have at the moment limited time and energy... so ehm... I come back laaaater...

Best Regards

Edit 1.

Found my old success...
it doesn't work with the files you sent me
does not go beyond bl1
see in the photo
 

Attachments

  • 20230205_083317.jpg
    20230205_083317.jpg
    3.2 MB · Views: 8

bobbywan30

Senior Member
Nov 18, 2017
125
8
thats wrong. you must not select everything from the top.

224000 - 263FFF = dram_el3mon.bin
start offset: 224000 (begin of el3mon)
end offset: 263FFF (end of el3mon)
Code:
     0 -   2FFF = bl1
  3000 -  15FFF = epbl.bin
 16000 -  67FFF = bl2.bin
   ...
 A4000 - 223FFF = s-boot.bin
224000 - 263FFF = dram_el3mon.bin
(refer to post #28)

as for the flashing, I don't know why it stuck. I don't know how to use this tool. I never used myself.
hi alecxs
I redid the files. as you said
now passes 3 cracks. 0 - 2FFF = bl1
3000 - 15FFF = epbl.bin
16000 - 67FFF = bl2.bin
but don't go any further
I think dram_el3mon.bin is to blame
I did as you said
start offset 224000 finish 263FFF
saved dram_el3mon.bin
look at the picture and the video
 

Attachments

  • 20230205_104943.mp4
    54.4 MB · Views: 0
  • 20230205_102830.jpg
    20230205_102830.jpg
    3.3 MB · Views: 9

bobbywan30

Senior Member
Nov 18, 2017
125
8
thats wrong. you must not select everything from the top.

224000 - 263FFF = dram_el3mon.bin
start offset: 224000 (begin of el3mon)
end offset: 263FFF (end of el3mon)
Code:
     0 -   2FFF = bl1
  3000 -  15FFF = epbl.bin
 16000 -  67FFF = bl2.bin
   ...
 A4000 - 223FFF = s-boot.bin
224000 - 263FFF = dram_el3mon.bin
(refer to post #28)

as for the flashing, I don't know why it stuck. I don't know how to use this tool. I never used myself.
did you see my last post alecxs??
it seems that 224000 - 263FFF = dram_el3mon.bin is wrong
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
@adfree splitting sboot is not a big deal, we have the offsets (except for dram_train.bin) see posts #12, #28 between all the garbage.
(no thanks to @bobbywan30 for pointless spamming repeatedly same info again and again)

But I don't understand the differences between the CFG files, nor the meaning of these numbers 200 20.

for example
Code:
DNW_STORE e5250 fwbl1 200 20 bl1.bin
e5250: is the SoC
fwbl1: is the label
200: ?
20: ?
bl1.bin: is file extracted from sboot

but this CFG file looks different
Code:
DNW_STORE exynos down 200 20 bl1
exynos: some kind of "broad" SoC?
down: ?
200: ?
20: ?
bl1: is file extracted from sboot

also there is no DNW_WAIT maybe we should add?
do you have any idea alecxs???
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
IMHO in CFG "Running Gag"...

You need in main only file list... which are pushed to device...


I have at the moment limited time and energy... so ehm... I come back laaaater...

Best Regards

Edit 1.

Found my old success...
Howdy
do you have any idea about my last posts
I think /dram_el3mon.bin is wrong
do you have any ideea??
 

alecxs

Forum Moderator
Staff member
Feb 17, 2016
4,262
7
2,999
gitlab.com
dram_el3mon.bin comes after s-boot.bin. Maybe you're mixing up with dram_train.bin? I don't know the offset for dram_train.bin. use the old dram_train.bin from U1 or U3.
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
dram_el3mon.bin comes after s-boot.bin. Maybe you're mixing up with dram_train.bin? I don't know the offset for dram_train.bin. use the old dram_train.bin from U1 or U3.
alecxs. when I killed the phone, I proceeded and took an example from this video
 

Attachments

  • SM-N975F BIT 2 Flash Combination Without Credits EToken Bypass.mp4
    28.4 MB · Views: 0

adfree

Senior Member
Jun 14, 2008
10,399
6,060
Samsung Galaxy Watch 4
Samsung Galaxy S22
Ouch... chaos...

Can you please upload RESULT of your NEW splitted files?

So I can compare what you have...

In theory Header should similar... minimum few Bytes...

In other words I like to see these NEW extracted Files:
Code:
bl2.bin
dram_el3mon.bin
dram_train.bin
epbl.bin
s-boot.bin

Thanx in advance...

Best Regards
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
Ouch... chaos...

Can you please upload RESULT of your NEW splitted files?

So I can compare what you have...

In theory Header should similar... minimum few Bytes...

In other words I like to see these NEW extracted Files:
Code:
bl2.bin
dram_el3mon.bin
dram_train.bin
epbl.bin
s-boot.bin

Thanx in advance...

Best Regards
here are the files
 

Attachments

  • IMAGES.rar
    959.6 KB · Views: 2
  • Like
Reactions: adfree

bobbywan30

Senior Member
Nov 18, 2017
125
8
to my understanding, according to your video, it fails on bl2.bin
[COM8]Write thread Start################## 2023_02_05-13_05_539
[COM8]Transfer Done : IMAGES/bl1 2023_02_05-13_05_648
[COM8]Transfer Done : IMAGES/epbl.bin 2023_02_05-13_05_779
[COM8]Transfer Done : IMAGES/bl2.bin 2023_02_05-13_05_217
[COM8]Write Fail 2023_02_05-13_05_275
 
  • Like
Reactions: alecxs

adfree

Senior Member
Jun 14, 2008
10,399
6,060
Samsung Galaxy Watch 4
Samsung Galaxy S22
Code:
bl1
bl2.bin
dram_el3mon.bin
dram_train.bin
epbl.bin
s-boot.bin

bl1 differ between your repair package and now...

bl2.bin is 1:1 same... will check later if this is true... in your sboot.bin

dram_el3mon.bin differ but IMHO looks good... will check in sboot.bin

dram_train.bin is 1:1 same... will check in your sboot.bin...

epbl.bin differ... will check in sboot.bin

s-boot.bin differ... will check in sboot.bin

Later more...

Edit 1.

Btw...

If bl2.bin is 1:1 same... why not take bl1 from Original... maybe increased Security crap...
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
Code:
bl1
bl2.bin
dram_el3mon.bin
dram_train.bin
epbl.bin
s-boot.bin

bl1 differ between your repair package and now...

bl2.bin is 1:1 same... will check later if this is true... in your sboot.bin

dram_el3mon.bin differ but IMHO looks good... will check in sboot.bin

dram_train.bin is 1:1 same... will check in your sboot.bin...

epbl.bin differ... will check in sboot.bin

s-boot.bin differ... will check in sboot.bin

Later more...

Edit 1.

Btw...

If bl2.bin is 1:1 same... why not take bl1 from Original... maybe increased Security crap...
I tried all the options. inverted leam. combined leam. leam extracted again.. still the same
[COM8]Write thread Start################### 2023_02_05-13_39_860
[COM8]Transfer Done : IMAGES/bl1 2023_02_05-13_39_970
[COM8]Transfer Done : IMAGES/epbl.bin 2023_02_05-13_39_102
[COM8]Transfer Done : IMAGES/bl2.bin 2023_02_05-13_39_540
[COM8]Write Fail
 

adfree

Senior Member
Jun 14, 2008
10,399
6,060
Samsung Galaxy Watch 4
Samsung Galaxy S22
Code:
DNW_WAIT

Yout tried also wait Command?

Original

Code:
BL1
DNW_STORE exynos down 200 20 IMAGES/bl1
; EPBL
DNW_STORE exynos down 200 20 IMAGES/epbl.bin
; BL2
DNW_STORE exynos down 200 20 IMAGES/bl2.bin
; DRAM TRAINING
;DNW_STORE exynos down 200 20 IMAGES/dram_train.bin
; S-BOOT
DNW_STORE exynos down 2000 20 IMAGES/s-boot.bin
; Dram EL3
DNW_STORE exynos down 200 20 IMAGES/dram_el3mon.bin

Idea/Dream/untested with your device...

Code:
BL1
DNW_STORE exynos down 200 20 IMAGES/bl1
; EPBL
DNW_STORE exynos down 200 20 IMAGES/epbl.bin
DNW_WAIT
; BL2
DNW_STORE exynos down 200 20 IMAGES/bl2.bin
; DRAM TRAINING
;DNW_STORE exynos down 200 20 IMAGES/dram_train.bin
; S-BOOT
DNW_STORE exynos down 2000 20 IMAGES/s-boot.bin
; Dram EL3
DNW_STORE exynos down 200 20 IMAGES/dram_el3mon.bin
DNW_WAIT

Edit 1.

Look at my old crap:
 

bobbywan30

Senior Member
Nov 18, 2017
125
8
Code:
DNW_WAIT

Yout tried also wait Command?

Original

Code:
BL1
DNW_STORE exynos down 200 20 IMAGES/bl1
; EPBL
DNW_STORE exynos down 200 20 IMAGES/epbl.bin
; BL2
DNW_STORE exynos down 200 20 IMAGES/bl2.bin
; DRAM TRAINING
;DNW_STORE exynos down 200 20 IMAGES/dram_train.bin
; S-BOOT
DNW_STORE exynos down 2000 20 IMAGES/s-boot.bin
; Dram EL3
DNW_STORE exynos down 200 20 IMAGES/dram_el3mon.bin

Idea/Dream/untested with your device...

Code:
BL1
DNW_STORE exynos down 200 20 IMAGES/bl1
; EPBL
DNW_STORE exynos down 200 20 IMAGES/epbl.bin
DNW_WAIT
; BL2
DNW_STORE exynos down 200 20 IMAGES/bl2.bin
; DRAM TRAINING
;DNW_STORE exynos down 200 20 IMAGES/dram_train.bin
; S-BOOT
DNW_STORE exynos down 2000 20 IMAGES/s-boot.bin
; Dram EL3
DNW_STORE exynos down 200 20 IMAGES/dram_el3mon.bin
DNW_WAIT

Edit 1.

Look at my old crap:
I don't understand what you want to say
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    @bobbywan30 I think you may have some misconceptions on what XDA is all about.

    Firstly, you MUST obey the Forum Rules. Do not post the same message several times, do not keep posting the same files multiple times, and USE ENGLISH.

    Second, you and only you are responsible for the risks you take. If you don't know what you're doing, you shouldn't be doing it. No one is obligated to help you. This forum is an excellent resource to learn things, but we aren't a "software support" forum where you can beg and demand that people do things for you. You will often find that people are more willing to offer help when it's clear that you have a general idea of what you're doing, but no one here is going to want to spoon feed you and hold your hand every step of the way. If someone tells you that you're doing something wrong, or that you don't know what you're doing, that should be your indication to STOP and do some research to gather the information you need.

    It doesn't matter how big your problem is; you got yourself into this mess, and it's rude to expect other people to dig you out.
    2
    XDA at it's Finest!!!
    @alecxs and @adfree
    Awesome to see you two at it helping out!

    Thank you 💯
    2
    who needs the files
    can take them from here
    2
    this tool is undocumented, couldn't find any information about, except what is already linked in thread.
    for example don't know what the 200 means. guess it's a timeout counter.

    also I still don't understand how the location is determined where the files are written. my guess is, it parses the file name for determining the label.

    please wait for new information.
    thank you alecxs for your patience with me. you are a great gentleman.
    thank you for
    0 - 2FFF = bl1
    3000 - 15FFF = epbl.bin
    16000 - 67FFF = bl2.bin
    ...
    A4000 - 223FFF = s-boot.bin
    224000 - 263FFF = dram_el3mon.bin
    1 downloaded the latest firmware from the internet
    2 i extracted sboot.bin
    I rewrote the files
    3 boom
    [COM8]Write thread Start################### 2023_02_05-16_36_542
    [COM8]Transfer Done : IMAGES/bl1 2023_02_05-16_36_652
    [COM8]Transfer Done : IMAGES/epbl.bin 2023_02_05-16_36_783
    [COM8]Transfer Done : IMAGES/bl2.bin 2023_02_05-16_36_221
    [COM8]Transfer Done : IMAGES/s-boot.bin 2023_02_05-16_36_546
    [COM8]Transfer Done : IMAGES/dram_el3mon.bin 2023_02_05-16_36_677
    [COM8]Write thread Exit##################### 2023_02_05-16_36_697
    thank you from the bottom of my heart
    may god give you good health
    1
    you have just quoted me two times. find another person that can translate english into your language very well. try to understand what you just have quoted.