• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[DEV] i9000 Development Platform, AKA UnBrickable Mod and Software Based Resurrection

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,812
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Introduction
Some of you will, remember lets save some bricks? Well, it's taken a long time to perfect this on the i9000, which is ironic because this is where it started, but we finally have a way! You can perform this mod on a bricked device and resurrect it, or you can apply it as a protective measure.

The way this works is we change the OM value in the processor by modifying an individual electronic binary signal. The signal we are interested in is xOM5. This line is normally grounded, causing the overall OM value to equal 0x9. When we bring this line high, the OM value becomes 0x29. This reverses the booting order and ensures you will always have boot from USB available before the device starts.

This is a better option than JTAG for resurrecting a device. How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.

After performing this mod:
Remove the battery, replace the battery, plug in USB, your phone will connect to the computer via USB and await commands for 2 seconds. Otherwise it will pretty much act like a i9000. See the Special Instructions section.


Part 1: Hardware Modification
You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing.
2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (for the wire contained within)

getting started:
You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 5cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.

Take the 5cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.

1. Tear apart your device. Remove battery cover, battery, 6 screws, the back case and 4 connectors from the board.
ei8lfq.jpg


2. remove the EM shield from the board to expose the resistors

3. Replace the xOM5 resistor from the top to the bottom or remove the xOM5 resistor and connect either xOM5 center pad to either xOM3's or xOM0's center pads.
2qlbb0o.jpg


4. Reassemble the device


Special Instructions

This replaces the battery charging sequence for the first few seconds of being plugged in.
To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.

Part 2: Software Based Resurrection
6o1rbb.png


Connexion2005 (Mobiltechvideos) perfomed the very first resurrection on this device based on a Google+ post I made with a picture of the xOM pins. Usually I post two separate posts, but since the software resurrection was already ready already, I decided to include it in this post. The tools used are the same as every other GalaxyS device. The resurrector must be run within 2 seconds of plugging in the USB cable. Thanks Connexion2005!



Unbricking:
1. Apply UnBrickable Mod to your device: see Hardware Modification section
2. Run ModeDetect and plug in your i9000. (Not a requirment, but helpful)
When you see this image you are in S5PC110 SEC SoC mode. When you see this mode you must proceed to step 3.
t9waci.jpg


If it will only show this image, then you have not performed the modification correctly, or you have a hardware problem.
1zcmypi.jpg


If it shows this, regardless of what's on your screen, you're in download mode:
2qnurzn.png



3. Run UnBrickable Resurrector: Get it from the SVN repository here: http://code.google.com/p/hummingbird-hibl/downloads/list This will only work on linux. Install Linux or dual boot if you have windows.
14bo5s.png

On this device the resurrector must be run within 2 seconds of plugging in the device. So you must be quick. I find it's easiest to click Download Mode, type a password, plug in the device, then press enter.

4. Run Heimdall One-Click to flash firmware on your device. http://files.teamkomin.com/i9000SGS/i9000-XXJVT-One-Click.jar
2mdz5s.png


5. repeat steps 2, 3 and 4 with bootloader flashing enabled (Heimdall One-Click has a safety mechanism which requires you to flash once before flashing bootloaders).


Conclusion

Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.

reading material
Creating your own Samsung Bootloaders: http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example: http://www.boardset.com/products/mv6410.php
ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2


drivers and utilities
This will be an ever expanding list
Windows Drivers http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW: http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line tool: http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list
Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list

firmware
Bootloader Hello World by Rebellos http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
UnBrick tool http://forum.xda-developers.com/showthread.php?t=1242466
 
Last edited:

Rebellos

Senior Recognized Developer
May 13, 2009
1,353
3,427
Gdańsk
That's seems to be our alma mater of UB Mods. The first of whole family finally got UnBrickable. :)

Okay, so, what is Hummingbird Interceptor Boot Loader (HIBL)?

Basically: It allows to load any amount of data (limited by size of RAM block, the biggest one single block available is 256MB) through USB connection with PC under any specified address into memory and then execute it.

Technically: It does consist of 2 pieces fused together - BL1_stage1 and BL1_stage2.

Each stage starts from 16bytes (4 ARM WORDs) of secure boot header. In stage1 these are mandatory, in stage2 they can be random (nulled them in my code), so EntryPoint of each stage does start at its 0x10 offset.

BL1_stage1, loaded under 0xD0020000 address, is short code, digitally signed by Samsung. It has been released to break "Chain of Trust" and alter Secure Boot into Non-Secure Boot process. Literally stage1 just do some compare operations and then jumpout to BL1_stage2. (Yes, I also see no point of releasing hardware secured CPU version together with software which is bypassing it's security)

BL1_stage2, must be placed at 0xD0022000 address (it's fused together with stage1 into HIBL, so it's at 0x2000 offset of HIBL.bin) it is unsigned because Secure Boot Context, prepared by iROM (BL0) has been already ignored by stage1.
Its FASM_ARM sourcecode:
http://code.google.com/p/hummingbir...unk/HummingBirdInterceptorBootloader/HIBL.ASM
This is where the code start real work, it does begin with standard ARM core jump vector table (just to keep stick to standard, these aren't used anyway).
1. It does use I9000 BL1_stage2 functions (init_system) which I linked to it, these are used to init DMC controllers, as to this point code is executing in and working with very tiny, 96KB iRAM space, after calling this function it turns all 512MB of RAM available.
2. Make sure DMC is configured properly (write some value to address 0x40~~ memory space, then read it and compare with previously written)
3. Reinit iRAM heap to the BL0 initial state (to convince it USB dload mode haven't been called yet), by storing and restoring UART pointer only (to keep debug output flowing properly)
4. Call iROM usb_downloader function.
5. Read the address where downloaded data has been placed.
6. Jump into this address.

This, properly used provides similiar debug output (similiar, because its outdated testlog)
������������������������������������������������������������������������
Uart negotiation Error

----------------------------------------
Hummingbird Interceptor Boot Loader (HIBL) v1.0
Copyright (C) Rebellos 2011
----------------------------------------
Calling IBL Stage2
DONE!
Testing BL3 area
DONE!
iRAM reinit
DONE!
Please prepare USB dltool with BL3

Starting download...
0x00000000
Desired BL3 EP: 0x40244000
Download complete, hold download mode key combination.

Starting BL3...

//OUTPUT BELOW IS COMING FROM SBL

Set cpu clk. from 400MHz to 800MHz.
IROM e-fused - Non Secure Boot Version.

It opens infinite capabilities. Instead of SBL to unbrick, Uboot can be loaded, or any armlinux kernel. It's all up to you - XDA Developers.
 
Last edited:

simone201

Inactive Recognized Developer
Sep 21, 2010
4,756
4,896
Lecco
Yeeee! Thank u very much Adam!
I hope i can get soon again another SGS!!

Inviato dal mio GT-I9100 usando Tapatalk
 

simone201

Inactive Recognized Developer
Sep 21, 2010
4,756
4,896
Lecco
Noone will spend hundreds or even thousands of hours to port closed source system. So no. This is not start, this just opens such possibility.

That's true...but porting full Debian with LXDE and Kernel 3.1 would be good

Is one of my first project as soon as i get an unbrickable device... :(

Inviato dal mio GT-I9100 usando Tapatalk
 

bhu1

Senior Member
Aug 1, 2011
5,307
4,517
26
Jaipur
It's a Good mod, but I don't think I'll play with my phones hardware. It's unbrickable only when we don't play with bootloader and I don't.

Sent from my GT-I9000 using xda premium
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,812
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
That's true...but porting full Debian with LXDE and Kernel 3.1 would be good

Is one of my first project as soon as i get an unbrickable device... :(

Inviato dal mio GT-I9100 usando Tapatalk
I sent you a PM yesterday. You never responded. You came in second in the Fascinate contest. Send me a PM and I'll do UBM for your device.
 
  • Like
Reactions: simone201

simone201

Inactive Recognized Developer
Sep 21, 2010
4,756
4,896
Lecco
I sent you a PM yesterday. You never responded. You came in second in the Fascinate contest. Send me a PM and I'll do UBM for your device.

Yeah sorry Adam, i haven't replied cuz i haven't got an SGS now (i have sold mine a month ago) so i cannot use your great offer now....

I am trying to search a bricked sgs to give it to you asap! ;)

Thanks for all Adam!

Inviato dal mio GT-I9100 usando Tapatalk
 

simone201

Inactive Recognized Developer
Sep 21, 2010
4,756
4,896
Lecco
Anyway, any idea if you can try to port the same mod to the SGS2 but it should be a completely different work....

It would be really good, as the work on I9100 is a lot!!

Inviato dal mio GT-I9100 usando Tapatalk
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,812
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Anyway, any idea if you can try to port the same mod to the SGS2 but it should be a completely different work....

It would be really good, as the work on I9100 is a lot!!

Inviato dal mio GT-I9100 usando Tapatalk

It would be a completely different task. Exynos Is a different processor. However, I know what needs to be done. I have the datasheets. Its a matter of locating the xOM pins, figuring out how they work, then rebellos can develop firmware and I can package a resurrector.

OMAP based devices like the Galaxy Nexus will be even easier.

There is no hope in sight for Qualcom devices like T-Mobile SGS2. All other SGS2 devices are ready. I just need one to work with.
 

simone201

Inactive Recognized Developer
Sep 21, 2010
4,756
4,896
Lecco
It would be a completely different task. Exynos Is a different processor. However, I know what needs to be done. I have the datasheets. Its a matter of locating the xOM pins, figuring out how they work, then rebellos can develop firmware and I can package a resurrector.

OMAP based devices like the Galaxy Nexus will be even easier.

There is no hope in sight for Qualcom devices like T-Mobile SGS2. All other SGS2 devices are ready. I just need one to work with.
Good to know!

I hope u can work on an I9100 soon as it would be much better to develop for a newer platform...

As soon as i brick my sgs2 i will give it to you! XD

As always, i really love your work Adam, i hope u can teach me something of ur knowledge! XD


Inviato dal mio GT-I9100 usando Tapatalk
 

rabiny

Senior Member
Feb 25, 2011
144
8
thank you

This is one post i was waiting for for long time now,

thx Adam love your work :D
 

Nitro_123

Senior Member
Feb 26, 2011
350
70
25
Sydney
Finally !
Adam, can this mod be performed by connecting the xOM pins only once and then flashing the HIBL ? I think we need to now develop something like MAGLDR for the SGS series. this will help greatly IMO. What do you think ?? :D
Is it too difficult ? i wish i knew linux etc :( :(
EDIT: sorry my mistake I don't think it can be done :(
 

netchip

Senior Member
Sep 2, 2011
1,154
630
I go search a bricked sgs, this is just AWESOME FOR KERNEL developers.

Sent from my GT-I9100
 

Top Liked Posts

  • There are no posts matching your filters.
  • 107
    Introduction
    Some of you will, remember lets save some bricks? Well, it's taken a long time to perfect this on the i9000, which is ironic because this is where it started, but we finally have a way! You can perform this mod on a bricked device and resurrect it, or you can apply it as a protective measure.

    The way this works is we change the OM value in the processor by modifying an individual electronic binary signal. The signal we are interested in is xOM5. This line is normally grounded, causing the overall OM value to equal 0x9. When we bring this line high, the OM value becomes 0x29. This reverses the booting order and ensures you will always have boot from USB available before the device starts.

    This is a better option than JTAG for resurrecting a device. How could it possibly be better then JTAG? Let's count the ways....
    1. The only part required is a wire.
    2. No shipping time.
    3. No cost for a box to interface the computer.
    4. Permanent.
    5. Can be done as a preventive measure.
    6. Gives the ability to test new Bootloaders temporarily.
    7. Allows development of the entire system.
    8. Removes worry about flashing and acts as a backup.

    After performing this mod:
    Remove the battery, replace the battery, plug in USB, your phone will connect to the computer via USB and await commands for 2 seconds. Otherwise it will pretty much act like a i9000. See the Special Instructions section.


    Part 1: Hardware Modification
    You will need:
    1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing.
    2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
    3. flux
    4. solder
    5. tweezers
    6. A relay (for the wire contained within)

    getting started:
    You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 5cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.

    Take the 5cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.

    1. Tear apart your device. Remove battery cover, battery, 6 screws, the back case and 4 connectors from the board.
    ei8lfq.jpg


    2. remove the EM shield from the board to expose the resistors

    3. Replace the xOM5 resistor from the top to the bottom or remove the xOM5 resistor and connect either xOM5 center pad to either xOM3's or xOM0's center pads.
    2qlbb0o.jpg


    4. Reassemble the device


    Special Instructions

    This replaces the battery charging sequence for the first few seconds of being plugged in.
    To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
    3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.

    Part 2: Software Based Resurrection
    6o1rbb.png


    Connexion2005 (Mobiltechvideos) perfomed the very first resurrection on this device based on a Google+ post I made with a picture of the xOM pins. Usually I post two separate posts, but since the software resurrection was already ready already, I decided to include it in this post. The tools used are the same as every other GalaxyS device. The resurrector must be run within 2 seconds of plugging in the USB cable. Thanks Connexion2005!



    Unbricking:
    1. Apply UnBrickable Mod to your device: see Hardware Modification section
    2. Run ModeDetect and plug in your i9000. (Not a requirment, but helpful)
    When you see this image you are in S5PC110 SEC SoC mode. When you see this mode you must proceed to step 3.
    t9waci.jpg


    If it will only show this image, then you have not performed the modification correctly, or you have a hardware problem.
    1zcmypi.jpg


    If it shows this, regardless of what's on your screen, you're in download mode:
    2qnurzn.png



    3. Run UnBrickable Resurrector: Get it from the SVN repository here: http://code.google.com/p/hummingbird-hibl/downloads/list This will only work on linux. Install Linux or dual boot if you have windows.
    14bo5s.png

    On this device the resurrector must be run within 2 seconds of plugging in the device. So you must be quick. I find it's easiest to click Download Mode, type a password, plug in the device, then press enter.

    4. Run Heimdall One-Click to flash firmware on your device. http://files.teamkomin.com/i9000SGS/i9000-XXJVT-One-Click.jar
    2mdz5s.png


    5. repeat steps 2, 3 and 4 with bootloader flashing enabled (Heimdall One-Click has a safety mechanism which requires you to flash once before flashing bootloaders).


    Conclusion

    Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.

    reading material
    Creating your own Samsung Bootloaders: http://forum.xda-developers.com/showthread.php?t=1233273
    KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
    how to use DNW: http://tinyurl.com/dnw-how-to
    Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
    another DNW example: http://www.boardset.com/products/mv6410.php
    ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2


    drivers and utilities
    This will be an ever expanding list
    Windows Drivers http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
    Windows Download Tool DNW: http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
    Windows Command Line tool: http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
    Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
    Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list
    Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list

    firmware
    Bootloader Hello World by Rebellos http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
    UnBrick tool http://forum.xda-developers.com/showthread.php?t=1242466
    2
    The new version of the Resurrector will display like this when you plug in a UnBrickable Modded device.
    k9cdgy.pn


    get it from our SVN server at googlecode here: http://code.google.com/p/hummingbird-hibl/

    For full instructions see here: http://rootzwiki.com/files/file/57-ultimate-unbrickable-resurrector-galaxy-infused-edition/
    1
    Such an important piece of information we have here!

    Congrats Adam and all the team, will write about this!!
    1
    is the start of porting another SO's to our i9000, like bada or wp?

    I hope so, WP7.5 would be really fast running in a SGS!

    Enviado desde mi GT-I9000 usando Tapatalk
    1
    Very impressive.
    my i9000 was reborn.
    But what a soldering act!!!!!! 2 lenses and a sacrified bit of my soldering station....
    Only a suggestion. don't act in a linux virtual machine!!! I've fight with authentication and usb discovery time...... Use a native Linux machine.....waiting for a windows version!!!!
    Thanks so much!!