[guide] repair hard bricked devices with deleted bootloader (sboot)

Search This thread

zogu

Senior Member
May 5, 2011
689
368
Belgrade
Xiaomi Poco F3
I'm writing this in android development section because this is only section for both models, i hope this is not a problem.

Also i want to say thanks to sataccount from gsmhosting, he found working map at the end.

This guide is for hard bricked phones, where bootloader is destroyed and there is no any tools which recognize phone.
When you connect phones without bootloader Windows detects them as exynos7420 in other devices in device manager.

All this is achieved using trial/error method and I still don't know real sboot map and where is what in sboot.bin.

What i found till now is that sboot consist from this parts:

1. fwbl1 bl1
2. bl2 bl2
3. el3_mon el3
4. bootloader bootloader
5. tzsw tzsw

I repaired my g925a and have files only for this model, but i will try to explain how to prepair files for any other model.

We have to use same version of bootloader which was previosly in phone, or if you are unsure use latest sboot.bin.

Download tools: http://www.mediafire.com/file/sg5m2ti3k6a63z5/USB_Down_Load_32bit.zip
In folder USB_DownLoad_Tool there is a folder Disk1
Connect phone and hold power button.
Windows will detect exynos7420 device, install Driver:
click manually,
com and lpt ports,
have disk,
point to data1 folder.
Don't run setup from Data1 folder!!!

Now we have to copy

WinDNWApi.dll
WinDNWApi.lib
in:
c:\Program Files\SAMSUNG\Exynos USB Driver\Drivers\
Probably there is no this folder, just create it and copy 2 files.
Don't copy WinDNWApi.dat as it is written in original manual, this file is for older exynos chip and procedure will not work, everything works without this file (it only has maps for 5250 and some other cpu)

Now we have to create boot files.

Download sboot.bin for your device, as i wrote best to find same bootloader which was in device before brick.

In some hex editor create 4 files (i'm using frhed, just click copy, enter offset, new file, paste, save and over again for all four files) with this map (again thanks to sataccount):

Novi1.bin 0..0x1FFF (size 0x2000 or 8192 )
Novi_2.bin 0x2000..0x31FFF (size 0x30000 or 196608)
Novi_3.bin 0x32000..0x3dfff (size 0xC000 or 49152)
Novi4.bin 0x3E000..10EFFF (size 0xD1000 or 856064)

This is all without tzsw. If phone still does not enter to odin mod, make last file from 0x3E000 to the end of the file (18F10F) and try again.

Start multiuploader.exe

Connect phone and hold power button.
Browse and find SH-usb-booting.cfg (in attached file proba folder, that is where you will probably prepare all boot files)
click start and phone will enter odin mode.
Start odin and flash sboot and everything else.
 
Last edited:

zogu

Senior Member
May 5, 2011
689
368
Belgrade
Xiaomi Poco F3
I'm not sure about downgrading.
When i tried to repair my phone, first i tried with 5.1 sboot (eng and normal). It hangs on second file. It checks somethings before start to load real bootloader. Maybe to fill whole device with zeros with dd command (deleting pit can be enough, but also maybe it ignores PIT and read some specific bytes on sda) and then restoring phone as it is just builded in factory. Of course first to make backup of EFS etc...
Even with downgraded sboot, i'm not sure can we use 6.0 and 7.0 roms?
Best way is someone with IDA knowledge to find bytes for unlocking and we can write them to sboot with dd if="something" of =/dev/sdb bs=xx count=xy
At least it is now repairable if it is bricked after that ;)
 
Last edited:
  • Like
Reactions: duttyend

zogu

Senior Member
May 5, 2011
689
368
Belgrade
Xiaomi Poco F3
Dd if=sboot_from_925f of=/dev/block/sdb
I had engineering boot (kernel) with adb root access. And after that phone is dead.
On 925a sboot is on sdb (just sdb without numbers), cm.bin on sdc. Probably same on all variants.
 
Last edited:
  • Like
Reactions: duttyend

NasirJaved

Member
May 16, 2016
5
1
G928c dont know version inside.
I tried 7.0 but tool hang after novi1 transfer.

with android 6 sboot all 4 files transfer succeed but no download mode :(
if I do 0x3E000 to the end of the file, tool hang after 1st file.

according to customer 7.0 was inside before brick.
 

NasirJaved

Member
May 16, 2016
5
1
ok I tried different 7.0 which take me to on display usb recovery mode.
but phone not detected by pc after reset by keys now phone completely dead.
no exynos mode, no download mode nothing.
PC not sensing phone anymore.
 

NasirJaved

Member
May 16, 2016
5
1
yes I open phone and re-insert battery. Now exynos mode.
(novi4 should be from 0x3E000 to the end of sboot.bin) give me USB Recovery Mode. but as previous post no detection.
do sboot contain tzsw ?
if so what is address for tzsw ?
 

zogu

Senior Member
May 5, 2011
689
368
Belgrade
Xiaomi Poco F3
tzsw is from 10F000 to the end of file. But you added it and phone loaded when you made novi4 from 0x3E000 to the end of sboot.bin.

I think it is still problem with different sboot version, it must be same as version previously in phone. Try few more sboot bin.

You don't have to pull out battery, just press volume down and power for more then 20 seconds, it is same like you reinsert battery.
 

NasirJaved

Member
May 16, 2016
5
1
I reconfirmed version form client and he said he is sure about 7.0 version.
this variant have only 3 files of 7.0 and I tried all sboot from 3 available versions.

You don't have to pull out battery, just press volume down and power for more then 20 seconds, it is same like you reinsert battery.
yes this is the way but in my condition not reset after 30sec and I feel phone heat too. thats why I decide to open phone.
 
Last edited:

zogu

Senior Member
May 5, 2011
689
368
Belgrade
Xiaomi Poco F3
Phone enter download mode and pc does not detect it, it is really strange, like it hangs after entering mode. Maybe is phone (flash memory) broken?
try with jig cable, maybe this can help, it is only idea i have...
 

NasirJaved

Member
May 16, 2016
5
1
Phone enter download mode and pc does not detect it, it is really strange, like it hangs after entering mode. Maybe is phone (flash memory) broken?
try with jig cable, maybe this can help, it is only idea i have...


I also think this can be memory issue.
tried all possible ways but no success.
device returned to customer.

anyways thanks for this guide and your quick response.

:good:
 
  • Like
Reactions: zogu

dragoodwael

Member
May 27, 2015
12
22
I dd over sdb, BOTA0 BOTA1 RECOVERY CACHE and SYSTEM, am i sol on this one? Phone doesnt get detected by pc. Even tried unplugging the battery. For those curious why...I found out theres a partiton flag set on all of those partitions. Its SYSMAGIC X , X being a number. Lowering that number on the system by dd' ing sda18 and rebooting, results in a fw error, binary 3 device 4. Aka phone thinks system installed is lower then what it really is. I know u cant downgrade the bootloader using your method, but if u dump sdb, and edit the sysmagic line in a hex editor, dd it back. It will now be corrupt, I wonder if you can now downgrade to the version we faked. Anyone care to give it a trytry?
 
  • Like
Reactions: zogu

jhony352

New member
Sep 1, 2017
2
0
how i open multidownloder it giving massage mfc110u.dll missing when i try to install it said opreating sysytem not supported i have window 7 32 bit sp1 but its not working
 

jhony352

New member
Sep 1, 2017
2
0
cfg file for s6 sm-g920p

thx its working
Please can you help me from where i can download cfg file for S6 sm-g920p i have sboot.bin file it is in bin format and this file is not open and work in mfc multidownloader
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 28
    I'm writing this in android development section because this is only section for both models, i hope this is not a problem.

    Also i want to say thanks to sataccount from gsmhosting, he found working map at the end.

    This guide is for hard bricked phones, where bootloader is destroyed and there is no any tools which recognize phone.
    When you connect phones without bootloader Windows detects them as exynos7420 in other devices in device manager.

    All this is achieved using trial/error method and I still don't know real sboot map and where is what in sboot.bin.

    What i found till now is that sboot consist from this parts:

    1. fwbl1 bl1
    2. bl2 bl2
    3. el3_mon el3
    4. bootloader bootloader
    5. tzsw tzsw

    I repaired my g925a and have files only for this model, but i will try to explain how to prepair files for any other model.

    We have to use same version of bootloader which was previosly in phone, or if you are unsure use latest sboot.bin.

    Download tools: http://www.mediafire.com/file/sg5m2ti3k6a63z5/USB_Down_Load_32bit.zip
    In folder USB_DownLoad_Tool there is a folder Disk1
    Connect phone and hold power button.
    Windows will detect exynos7420 device, install Driver:
    click manually,
    com and lpt ports,
    have disk,
    point to data1 folder.
    Don't run setup from Data1 folder!!!

    Now we have to copy

    WinDNWApi.dll
    WinDNWApi.lib
    in:
    c:\Program Files\SAMSUNG\Exynos USB Driver\Drivers\
    Probably there is no this folder, just create it and copy 2 files.
    Don't copy WinDNWApi.dat as it is written in original manual, this file is for older exynos chip and procedure will not work, everything works without this file (it only has maps for 5250 and some other cpu)

    Now we have to create boot files.

    Download sboot.bin for your device, as i wrote best to find same bootloader which was in device before brick.

    In some hex editor create 4 files (i'm using frhed, just click copy, enter offset, new file, paste, save and over again for all four files) with this map (again thanks to sataccount):

    Novi1.bin 0..0x1FFF (size 0x2000 or 8192 )
    Novi_2.bin 0x2000..0x31FFF (size 0x30000 or 196608)
    Novi_3.bin 0x32000..0x3dfff (size 0xC000 or 49152)
    Novi4.bin 0x3E000..10EFFF (size 0xD1000 or 856064)

    This is all without tzsw. If phone still does not enter to odin mod, make last file from 0x3E000 to the end of the file (18F10F) and try again.

    Start multiuploader.exe

    Connect phone and hold power button.
    Browse and find SH-usb-booting.cfg (in attached file proba folder, that is where you will probably prepare all boot files)
    click start and phone will enter odin mode.
    Start odin and flash sboot and everything else.
    2
    First of all thanx this is a real sharing is caring thing.I'm seeing a way to downgrade bootloader here as tzsw gets separated well this can be done by daring dev who can take risks.
    2
    Yes, that's it :)
    Just compare with my files if unsure.
    2
    how i open multidownloder it giving massage mfc110u.dll missing when i try to install it said opreating sysytem not supported i have window 7 32 bit sp1 but its not working

    It worked for me on win 7 32 bit...
    Try to reinstall Visual C++ redistributable 2012

    https://www.microsoft.com/en-us/download/details.aspx?id=30679
    1
    My g925v is detected as "Exynos7420" in the Windows Device Manager.
    I have the multidownloader 32bit. But even after adding the drivers manually, the sample application does not pick my G925v device up in the com/lpt ports. Maybe it is because I am using a 64bit PC OS, or because I am using the wrong driver for Exynos USB. But I am doing everything the posts say to do.


    I had the same problem with driver , and is for sure because you are using 64 bit of OS . So your device to be recognised you must running 32bit of OS, you can run on Virtual Box or Machine 32 bit of OS and there do as the zogu user say.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone