[HOW-TO]Set up a Captivate for Samsung Bootloader Development

Search This thread

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
OK, there's been quite a few unanswered questions on bootloader development.. I didn't want to clutter the Make your Own Bootloader thread with hardware stuff. I didn't want to clutter up the UnBrickable Mod thread with Bootloader development setup stuff. UnBrickable mod will be a one-stop shop thread for the Captivate eventually.

Introduction

This thread will get you started with bootloader development speciffic to the captivate, however the same techniques work on all GalaxyS devices with an adjustment to the RX/TX locations
We need to delve into the hardware, remove a resistor, attach a wire, and bring two wires outside of the phone. This is quite a bit more difficult then the typical UART over USB connection which we have used in the past. For bootloader development the UART Output described in this video will not work..
The external UART output with a 619Kohm jig between pins 4 and 5, monitoring 115200 8N1 serial output between pins 2 and 3 will not work because the USB hardware is initialised by the bootloaders. In order to test the bootloaders you are developing, you must go to a lower level.

Note:While the UART output in the video will not work for Bootloader development, itis absolutely unbeatable for Kernel level debug on nearly all Samsung devices.


Getting Started

You will need:
1. UnBrickable modded captivate (or other device)
2. A UART device (Android Acessory Development kit or Arduino Mega or a Bus Pirate or any other UART device)
3. A Soldering Iron
4. Flux
5. Solid core wire
6. A relay (For the wire contained within)
7. A Linux computer (get Ubuntu here and dual boot, or run in a virtual machine)

Instructions
1. Apply the UnBrickable Mod to your Samsung Captivate. See Here: http://forum.xda-developers.com/showthread.php?t=1206216
160zmty.jpg




2. Next we need to connect a relay wire to the internal JTAG UART points. We cannot use the external UART via USB as we have seen in the past for writing bootloaders because the chip which handles switching for UART has not been initialized yet. We need to go directly to the source off of the processor. You can connect to the internal JTAG UART RX and TX lines here on the JTAG pads:

9pxbvs.jpg


Using the JTAG header, you can connect to these points using this header: http://www.mouser.com/ProductDetail/Panasonic/AXT612124/?qs=2rFUEsTwVNwSdqVM5XnLHw==
and this Receptical: http://www.mouser.com/ProductDetail/Panasonic/AXT512124/?qs=2rFUEsTwVNy9TGVyeT43Dg==

They can be connected directly, or you can use a board from a guy named "K-WW" on the Hackaday.com forums
Here is a picture of my JTAG connector... This is optional and you will likely want to run wires directly for this project.
2011-05-09193502-1.jpg



Alternately you can get these same points here, next to the processor:
33y4bnp.jpg


3. Once you have the wires connected to the board, technically you're done and you can now connect up to your Android using your UART Device of choice. I decided to go the extra step and run those small wires to some solid core wire I bent and melted into the phone's case.

2011-08-14205337.jpg


The further one is RX and the closer one is TX. Using this low point allows me to close up the device properly and I can still use my SDCard slot.

2011-08-25183205.jpg



4. To do some debugging you can connect your Arduino at 8N1 using the same code from the video above...
Code:
void setup() {
  // initialize both serial ports:
  Serial.begin(115200);
  Serial1.begin(115200);
}

void loop() {
  // read from port 1, send to port 0:
  if (Serial1.available()) {
    int inByte = Serial1.read();
    Serial.print(inByte, BYTE); 
  }
  // read from port 0, send to port 1:
  if (Serial.available()) {
    int inByte = Serial.read();
    Serial1.print(inByte, BYTE);     
  }
}

2011-08-25181851.jpg


Or connect the Bus Pirate up to the device using the following options in a terminal:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)

(1)>3
Set serial port speed: (bps)
 1. 300
 2. 1200
 3. 2400
 4. 4800
 5. 9600
 6. 19200
 7. 38400
 8. 57600
 9. 115200
10. BRG raw value

(1)>9
Data bits and parity:
 1. 8, NONE *default 
 2. 8, EVEN 
 3. 8, ODD 
 4. 9, NONE
(1)>1
Stop bits:
 1. 1 *default
 2. 2
(1)>1
Receive polarity:
 1. Idle 1 *default
 2. Idle 0
(1)>1
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)

(1)>2
Ready
UART>
2011-08-25183102.jpg


4. Next you need some firmware. There is firmware in the Captivate Development Platform thread, and there is some in the Create Your Own bootloaders thread You can create your own.

5. In order to debug the firmware it has to be uploaded. You can use the SMDK Download tool attached in this post. Uncompress to your desktop

6. To prepare the phone for debug, remove the battery, insert the battery attach USB and run the following program in a new terminal (not the one you are monitoring USB Output)

Upon plugging in the USB, you should see
Code:
�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
Uart negotiation Error

Then you execute this in a new window
Code:
sudo ~/Desktop/dltool/smdk-usbdl -f ~/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin  -a D0020000
you will see this in the same window
Code:
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <[email protected]>

S3C64XX Detected!
=> found device: bus 002, dev 011
=> loaded 24576 bytes from /home/adam/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum ffb7
=> usb_bulk_write() returned 24586
[email protected]:~$

And upon upload of the primitive bootloader, you will see this in the UART window
Code:
Welcome to the S5PC110 resurrector by Rebellos!

Calling SGS IBL Stage2, pray so it wont hang...

DONE!

Testing if BL3 area is R/W

DONE!
                                                                                                                  
Please prepare USB dltool with BL3 (SBL)                                                                          
                                                                                                                  
Starting downloader in...                                                                                         
9                                                                                                                 
8
7
6
5
4
3
2
1
0

7. Unplug the USB cable. As soon as the USB cable is removed all executing commands stop and the device awaits you to push the power on button.

2011-08-25191040.jpg



Some notes:
PBL execution automatically occurs at 0xD002000 (this is with a 0x10 signature in front so the actual code begins at 0xD002010)
SBL is in DRAM at 0x40244000

Conclusion

So, there you have it. This is how to set up your Captivate to be a bootloader development kit. You don't have to develop a bootloader to load it up using this method.. You can simply stop at step 1 of this guide, UnBrickable mod, and be able to test results without UART output.


If anyone would like to give me one of the following devices' mainboard I will make a UnBrickable Mod/Development Platform for each device.
Samsung Devices: I9000 S8500, S8530, SGH-897, SGH-i896, SGH-i997, T959, SGH-T849, GT-P1000, GT-i9010, GT-i8350, GT-I917
Google Nexus S, Odroid T,
Apple iPhone4
Any new Samsung WP7

Further reading
Create your own bootloader: http://forum.xda-developers.com/showthread.php?t=1233273
The Captivate Development Platform: http://forum.xda-developers.com/showthread.php?t=1206216
Lets save some bricks: http://forum.xda-developers.com/showthread.php?t=1018862
 

Attachments

  • dltool.zip
    18.5 KB · Views: 1,538
Last edited:

Aou

Senior Member
Aug 4, 2008
794
777
Arizona
Samsung Infuse (SGH-i997) Owners:

We've got it much easier when it comes to the JTAG header. As you can see in the picture below, the header is already attached to the PCB, and all we need is the connector board from "K-WW".

2a9s7qx.png


The large metallic thing on the left is the SIM card slot. The connector for the display (at the bottom of the picture) might be in the way. If it isn't we'll be able to connect to the JTAG and UART2 ports without doing any soldering or even disconnecting a single cable on the device.

We need someone to donate an Infuse to AdamOutler. He needs to remove the processor from the PCB to be able to find the xOM5 pad. This means destroying the phone, so it doesn't matter what the condition is. If it's bricked with a smashed screen and water damage, it doesn't matter! If you can help us with this, please speak up on this thead: http://forum.xda-developers.com/showthread.php?t=1221064
 

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
You don't NEED the board. The receptical itself with wires attached will attach to the header and you could close up the device with it attached. With the socket breakout board, the device would need to remain open. I would be searching for alternate UART points as well so the JTAG header would remain available.

Like I said.... I need device mainboards... they need not work. I'm not gaining anything directly from this except fruits of firmware development.... alternate OSs and open source bootloaders
 

Rebellos

Senior Recognized Developer
May 13, 2009
1,353
3,427
Gdańsk
Or, try to find 5 OM resistors while phone is being powered up.
3 should be 100.3kOhm resistance and connected to GND
2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.
 
  • Like
Reactions: mediaon

AdamOutler

Retired Senior Recognized Developer
Feb 18, 2011
5,224
9,809
Miami, Fl̨̞̲̟̦̀̈̃͛҃҅͟orida
Or, try to find 5 OM resistors while phone is being powered up.
3 should be 100.3kOhm resistance and connected to GND
2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.
On my device, all resistors are 100.3kohm.
 
  • Like
Reactions: darkkid85

bhundven

Inactive Recognized Developer
Aug 8, 2009
2,076
4,496
Seattle, WA
bhundven.github.io
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 9
    OK, there's been quite a few unanswered questions on bootloader development.. I didn't want to clutter the Make your Own Bootloader thread with hardware stuff. I didn't want to clutter up the UnBrickable Mod thread with Bootloader development setup stuff. UnBrickable mod will be a one-stop shop thread for the Captivate eventually.

    Introduction

    This thread will get you started with bootloader development speciffic to the captivate, however the same techniques work on all GalaxyS devices with an adjustment to the RX/TX locations
    We need to delve into the hardware, remove a resistor, attach a wire, and bring two wires outside of the phone. This is quite a bit more difficult then the typical UART over USB connection which we have used in the past. For bootloader development the UART Output described in this video will not work..
    The external UART output with a 619Kohm jig between pins 4 and 5, monitoring 115200 8N1 serial output between pins 2 and 3 will not work because the USB hardware is initialised by the bootloaders. In order to test the bootloaders you are developing, you must go to a lower level.

    Note:While the UART output in the video will not work for Bootloader development, itis absolutely unbeatable for Kernel level debug on nearly all Samsung devices.


    Getting Started

    You will need:
    1. UnBrickable modded captivate (or other device)
    2. A UART device (Android Acessory Development kit or Arduino Mega or a Bus Pirate or any other UART device)
    3. A Soldering Iron
    4. Flux
    5. Solid core wire
    6. A relay (For the wire contained within)
    7. A Linux computer (get Ubuntu here and dual boot, or run in a virtual machine)

    Instructions
    1. Apply the UnBrickable Mod to your Samsung Captivate. See Here: http://forum.xda-developers.com/showthread.php?t=1206216
    160zmty.jpg




    2. Next we need to connect a relay wire to the internal JTAG UART points. We cannot use the external UART via USB as we have seen in the past for writing bootloaders because the chip which handles switching for UART has not been initialized yet. We need to go directly to the source off of the processor. You can connect to the internal JTAG UART RX and TX lines here on the JTAG pads:

    9pxbvs.jpg


    Using the JTAG header, you can connect to these points using this header: http://www.mouser.com/ProductDetail/Panasonic/AXT612124/?qs=2rFUEsTwVNwSdqVM5XnLHw==
    and this Receptical: http://www.mouser.com/ProductDetail/Panasonic/AXT512124/?qs=2rFUEsTwVNy9TGVyeT43Dg==

    They can be connected directly, or you can use a board from a guy named "K-WW" on the Hackaday.com forums
    Here is a picture of my JTAG connector... This is optional and you will likely want to run wires directly for this project.
    2011-05-09193502-1.jpg



    Alternately you can get these same points here, next to the processor:
    33y4bnp.jpg


    3. Once you have the wires connected to the board, technically you're done and you can now connect up to your Android using your UART Device of choice. I decided to go the extra step and run those small wires to some solid core wire I bent and melted into the phone's case.

    2011-08-14205337.jpg


    The further one is RX and the closer one is TX. Using this low point allows me to close up the device properly and I can still use my SDCard slot.

    2011-08-25183205.jpg



    4. To do some debugging you can connect your Arduino at 8N1 using the same code from the video above...
    Code:
    void setup() {
      // initialize both serial ports:
      Serial.begin(115200);
      Serial1.begin(115200);
    }
    
    void loop() {
      // read from port 1, send to port 0:
      if (Serial1.available()) {
        int inByte = Serial1.read();
        Serial.print(inByte, BYTE); 
      }
      // read from port 0, send to port 1:
      if (Serial.available()) {
        int inByte = Serial.read();
        Serial1.print(inByte, BYTE);     
      }
    }

    2011-08-25181851.jpg


    Or connect the Bus Pirate up to the device using the following options in a terminal:
    Code:
    HiZ>m
    1. HiZ
    2. 1-WIRE
    3. UART
    4. I2C
    5. SPI
    6. 2WIRE
    7. 3WIRE
    8. LCD
    9. DIO
    x. exit(without change)
    
    (1)>3
    Set serial port speed: (bps)
     1. 300
     2. 1200
     3. 2400
     4. 4800
     5. 9600
     6. 19200
     7. 38400
     8. 57600
     9. 115200
    10. BRG raw value
    
    (1)>9
    Data bits and parity:
     1. 8, NONE *default 
     2. 8, EVEN 
     3. 8, ODD 
     4. 9, NONE
    (1)>1
    Stop bits:
     1. 1 *default
     2. 2
    (1)>1
    Receive polarity:
     1. Idle 1 *default
     2. Idle 0
    (1)>1
    Select output type:
     1. Open drain (H=Hi-Z, L=GND)
     2. Normal (H=3.3V, L=GND)
    
    (1)>2
    Ready
    UART>
    2011-08-25183102.jpg


    4. Next you need some firmware. There is firmware in the Captivate Development Platform thread, and there is some in the Create Your Own bootloaders thread You can create your own.

    5. In order to debug the firmware it has to be uploaded. You can use the SMDK Download tool attached in this post. Uncompress to your desktop

    6. To prepare the phone for debug, remove the battery, insert the battery attach USB and run the following program in a new terminal (not the one you are monitoring USB Output)

    Upon plugging in the USB, you should see
    Code:
    �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
    Uart negotiation Error

    Then you execute this in a new window
    Code:
    sudo ~/Desktop/dltool/smdk-usbdl -f ~/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin  -a D0020000
    you will see this in the same window
    Code:
    SMDK42XX,S3C64XX USB Download Tool
    Version 0.20 (c) 2004,2005,2006 Ben Dooks <[email protected]>
    
    S3C64XX Detected!
    => found device: bus 002, dev 011
    => loaded 24576 bytes from /home/adam/Desktop/dltool/s5pc110_test/s5pc110_sbl_loader.bin
    => Downloading 24586 bytes to 0xd0020000
    => Data checksum ffb7
    => usb_bulk_write() returned 24586
    [email protected]:~$

    And upon upload of the primitive bootloader, you will see this in the UART window
    Code:
    Welcome to the S5PC110 resurrector by Rebellos!
    
    Calling SGS IBL Stage2, pray so it wont hang...
    
    DONE!
    
    Testing if BL3 area is R/W
    
    DONE!
                                                                                                                      
    Please prepare USB dltool with BL3 (SBL)                                                                          
                                                                                                                      
    Starting downloader in...                                                                                         
    9                                                                                                                 
    8
    7
    6
    5
    4
    3
    2
    1
    0

    7. Unplug the USB cable. As soon as the USB cable is removed all executing commands stop and the device awaits you to push the power on button.

    2011-08-25191040.jpg



    Some notes:
    PBL execution automatically occurs at 0xD002000 (this is with a 0x10 signature in front so the actual code begins at 0xD002010)
    SBL is in DRAM at 0x40244000

    Conclusion

    So, there you have it. This is how to set up your Captivate to be a bootloader development kit. You don't have to develop a bootloader to load it up using this method.. You can simply stop at step 1 of this guide, UnBrickable mod, and be able to test results without UART output.


    If anyone would like to give me one of the following devices' mainboard I will make a UnBrickable Mod/Development Platform for each device.
    Samsung Devices: I9000 S8500, S8530, SGH-897, SGH-i896, SGH-i997, T959, SGH-T849, GT-P1000, GT-i9010, GT-i8350, GT-I917
    Google Nexus S, Odroid T,
    Apple iPhone4
    Any new Samsung WP7

    Further reading
    Create your own bootloader: http://forum.xda-developers.com/showthread.php?t=1233273
    The Captivate Development Platform: http://forum.xda-developers.com/showthread.php?t=1206216
    Lets save some bricks: http://forum.xda-developers.com/showthread.php?t=1018862
    1
    Or, try to find 5 OM resistors while phone is being powered up.
    3 should be 100.3kOhm resistance and connected to GND
    2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
    These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.
    1
    Or, try to find 5 OM resistors while phone is being powered up.
    3 should be 100.3kOhm resistance and connected to GND
    2 should be ~10.1kOhm resistance and connected to VCC PDA (most likely exactly 2.8V, but 1.8V and similiar is also possible option)
    These should be in row, or close to itselves. Then all whats left is guessing which one of the 3 is OM5. By some dangerous tests most likely, but with much smaller risk of damaging the board, comparing to complete CPU teardown.
    On my device, all resistors are 100.3kohm.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone