[HW][OT] E:V:A's Discussion Thread

[E:V:A]

This is my own completely Off Topic Discussion thread.

A place where I will bring HW related discussions, that do not fit into
specific threads or discussions.

Please, do not post here with general questions or other junk that I have not initiated myself.

Also do not ask where to find files/programs mentioned in this thread, because if I have not linked to them, I don't know!

They will be removed. (Thanks for understanding.)

See you.

 

[E:V:A]

<< Better reserve for more dragons >>

 

[bedwa]

Didn't see that anyone mentioned it and I'm not sure if the S4 modems are as well, but the initial container that the modems are in on the HTC used S3 chips is a fat16 format. I saw that with a simple hex editor showed it and I was able to see the modem file structure as well. I'll snag a few S4 modems later today and take a look. Couldn't unpack and repackaged though, which is probably the EFS formatting with it.

 

[orb3000]

Off topic goes in off topic

 

[bedwa]

Sorry it took so long

I had intended to do this at least a week ago, but had not the chance. Both the S3 HTC Radios and the S4 HTC Radios are fat 16 imgs.

As you see in the Rezound screenshot, in the first few lines of the HEX table in the bottom left mentions no volume label and a fat 16 label on the type. in addition when I use IMG viewers it shows the same with both the MDM9K image and the main IMG. This should theoretically enable us to possibly use amss imgs or other parts of the radios with other devices or even cross the modem over to other Samsung devices with the same modem chips.

In addition as per the Ville screenshot, this is the One S modem for one of the European basebands. Again the HEX shows Fat 16 as the file type, but the file structure and amount of files are much more plentiful. If this can become of any use, great. If not, oh well... but it is good food for thought either way.

On other notes, I did try to copy files from the LTE baseband (MDM9k) from the Vivid and move them to the MDM9k IMG for the rezound, but the IMG bloated. I haven't had enough time to try and mount the images in my Ubuntu environment, but doing it in Winblows caused the IMG to bloat up too much and caused radio issues and IMEI unknown blanks.

Happy perusing and happy hunting!

 

[E:V:A]

Very nice, but I doubt you'll be able to mix modem files (between different devices) unless you're absolutely sure that the device modem and AP HW is the same. Apparently from another recent conversation, it seem that HTC and Qualcomm are both moving to unified source code for their devices. So it can still be true that many of those files are the same across devices.

Could you write a few lines on how you go about this extraction and do it for the HTC One X (LTE)?
Also don't forget that US HTC One X (or S, or whatever) is not the same hardware and the European one!

On second thought, I think this is what you got..right?

 

[bedwa]

Pretty much. Seems like another situation where I should have spoke up when I first saw it with Qualcomm S3 modems in May. On moving files though, I was planning to stay in family. S3 w/ S3 ect.

 

[E:V:A]

^^ BTW. Could you tell if there are any structural differences (content wise) between files of same prefix, but sequential postfix? What is strange is that they are all very different sizes, which indicate they probably have very different content...

If it was just one solid piece of firmware, it would just have been chopped up into equal sized pieces...

 

[bedwa]

I'll look closer on that. I do remember that most of the sequential pieces were the same size minus either the first or the last, holding with your theory.

 

[joederp]

Maybe not the right place, but have you looked at the pit files?

COM_TAR2MSM8960
MODEM non-tlos.bin
sbl1.mbm
sbl2.mbm
sbl3.mbm
aboot.mbm
rpm.mbm
BOOT boot.img
TZ
PAD
PARAM
EFS efs.img (ext4)
MODEMST1 nvrebuild1.bin
MODEMST2 nvrebuild2.bin
system.img (ext4)
userdata.img (ext4)
persist.img (ext4)
cache.img (ext4)
recovery.img (ext4)
FOTA
BACKUP
FSG
SSD
GROW
PGPT pgpt.img
PIT MSM8960.pit
MD5 md5.img
SGPT sgpt.img

I know it is not really new, but I hadn't seen the img names.

 

[bedwa]

The ones I took screenshots of were for 3rd and 4th Gen Snapdragon processors, radio.imgs for HTC devices. The Samsung pit files may give good cross references though. I'll re-unbox my Amaze this evening and check the mounts to see any information on the single file broken into pieces theory.

 

[E:V:A]

"eMMC Partition tools usage for msm7x30/msm8x60"
(A repost from Anyclub...)

In the eMMC boot, there are some changes in eMMC partitioning.

[SIZE=2]partition.xml           - Everything begins with this file, which describes the number of 
                          partitions desired, and how many sectors each one should be.
PartitioningTool.py     - translates partition.xml into binary partitions
msp.exe                 - writes binary partitions to SD/eMMC cards using card reader
mjsdload.cmm            - writes binary partitions to SD/eMMC cards using Trace32
msp.py                  - writes binary partitions to a single image file
QPST                    - writes binary partitions to SD/eMMC cards on Target
[/SIZE]

Helper /Debug Tools:

[SIZE=2]parseBinaryPartitionFile.pl     - Decodes MBR partition tables. Run: 
                                  "Perl parseBinaryPartitionFile.pl partition.bin" 
                                  to generate the partition information
parseGPT.pl                     - Decodes GPT partition tables
[/SIZE]

partition.xml

These are the property entries that can be added in new partiton.xml to specify the configuration.

[SIZE=2]<parser_instructions>
  WRITE_PROTECT_BOUNDARY_IN_KB                = 0
  GROW_LAST_PARTITION_TO_FILL_DISK            = false
  ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY = false
</parser_instructions>[/SIZE]

WRITE_PROTECT_BOUNDARY_IN_KB: Typical boundaries are 64MB, i.e. 65536 KB. This
means that a 256MB eMMC card has 4 write protect boundaries. Any or all of
them can be marked as read-only. Different vendors allow for different sized
boundaries.

GROW_LAST_PARTITION_TO_FILL_DISK: In partition.xml the size of each partition
is specified. If this field is TRUE, then the last partition size is ignored
and set to 0. Then during patching this size is updated such that the last
partition extends to use all remaining space.

ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY: To allow total flexibility, it
could be that a partition that is currently writeable might need to be marked
as read-only. This can only happen *if* that partition begins on a write
protect boundary (i.e. 64MB). Thus if this field is TRUE, then all logical
partitions are positioned such that they begin on a write protect boundary.


PartitioningTool.py

Is a new tool used to generate the the partition.xml
When run, it will output following 5 files:

1. emmc_lock_regions.xml

This hold the sector ranges that need to be marked as read-only by the
operating system (this is from readonly="true" in partition.xml) i.e. modem
code and boot images are typically on read-only partitions Typical
Write-Protect boundary is 64MB = 131072 sectors = 0x20000 sectors. The file
below is protecting the very first 64MB region of the card,

Boundary #0
Starting at sector 0
Ending at sector 131071 (for a total of 131072 sectors)

[SIZE=2]<?xml version="1.0" ?>
<protect>
  <!-- NOTE: This is an ** Autogenerated file ** -->
  <!-- NOTE: Sector size is 512bytes, WRITE_PROTECT_BOUNDARY_IN_KB=0,   WRITE_PROTECT_BOUNDARY_IN_SECTORS=0 -->
  <!-- NOTE: "num_sectors" in HEX "start_sector" in HEX, i.e. 10 really equals 16 !! -->
  <program boundary_num="0" num_boundaries_covered="1" 
       num_sectors="20000" num_sectors_dec="131072" physical_partition_number="0"  
       start_sector="0"    start_sector_dec="0"/>
  <information WRITE_PROTECT_BOUNDARY_IN_KB="0"/>
</protect>
[/SIZE]

2. partition0.bin

This holds the partition tables, i.e. MBR followed by all EBRs. This is the
partition table in binary format. It is copied over to the storage device in a
1 to 1 manner. I.e. how it looks in partition0.bin is exactly how the
partition table will look on the storage device. partition0.bin is a "generic"
file meant to fit on *any* size SD/eMMC card, as a result, there are 0's that
need to be patched,such as EXT partition and last partition size.

3. patch0.xml

Contain the patching instructions to tailor each partition table
"partition0.bin" to a specific SD/eMMC card. I.e. the partition0.bin
partition tables can be applied to any size storage device As a result,
there are empty values (zeros) in the partition tables that must be filled
in with a specific cards sector size

There are two ways to apply this patch:
a) (patch before) When you patch the "zeros" in the partition tables held in the file partition0.bin, and then write it to the card
b) (patch after) When you write partition0.bin to the card (which still has "zeros" in it), and then patch the cards partition tables directly


4. rawprogram0.xml

precise sector details of all partitions and what files (if any) need to
be placed there. In addition to writing partition tables onto a device,
often times it is desired to write one or more files into the partition
area as well, The File has partition name (i.e. label), where it begins
(start_sector) and how big it is (num_partition_sectors). It also
describes what file(s) to write to this partition, as well as any
offsets.

Example:

[SIZE=2]<program file_sector_offset="0" filename="partition0.bin" label="MBR" 
       num_partition_sectors="1" physical_partition_number="0" 
       size_in_KB="0.5" start_sector="0"/>

<program file_sector_offset="1" filename="partition0.bin " label="EXT" 
       num_partition_sectors="2"  physical_partition_number="0" 
       size_in_KB="1.0" start_sector="779"/>
[/SIZE]

The 1st line describes taking the 1st sector from partition0.bin, and writing it to sector 0 of the card.
The 2nd line describes taking the 2nd and 3rd sector from partition0.bin and writing it to sector 779 of the card.
I.e. file_sector_offset = 2 and num_partition_sectors=2

5. loadpt.cmm

This is used by the mjsdload.cmm to flash the image.


msp.exe

This is used to apply the patches

This program will program a memory card (SD/eMMC) attached to the PC as USB mass storage device
Use -d to detect the path of the memory card if you are unsure what to do first

Commands list:

[SIZE=2]-h      (Print this help message)                                               Ex. msp -h
-d      (Detect which storage device ID is active)                              Ex. msp -d
-p      (Print partition information)                                           Ex. msp -p /dev/sdb
-pp     (Print partition information - DETAILED)                                Ex. msp -pp /dev/sdb
-x      (Write files as outlined in rawprogram.xml)                             Ex. msp -x rawprogram.xml /dev/sdb
-xx     (Write files as outlined in rawprogram.xml - DETAILED)                  Ex. msp -xx rawprogram.xml /dev/sdb
-s      (Write SINGLE IMAGE "singleimage.bin" as outlined in rawprogram.xml)    Ex. msp -s rawprogram.xml 8192
-v      (Verify file written correctly as outlined in rawprogram.xml)           Ex. msp -v rawprogram.xml boot.img /dev/sdb
-f      (Program single file as outlined in rawprogram.xml)                     Ex. msp -f rawprogram.xml boot.img /dev/sdb
[/SIZE]

To program the SD/eMMC with msp.exe in mass storage mode:

[SIZE=2]STEPS                           Complete example (patch after)
-------------------------------------------------------------
parse partition.xml             python PartitioningTool.py partition.xml 
Detect your device              msp -d
Program your device             msp -x rawprogram0.xml /dev/sdb
Patch your device               msp -xx patch0.xml /dev/sdb


STEPS                           Complete example (patch before)
-------------------------------------------------------------
parse partition.xml             python PartitioningTool.py partition.xml 
Detect your device              msp -d
Patch your files                msp xx  patch0.xml 15758336 (patch the 8GB card offline,this will change the partition0.bin)
Program your device             msp x   rawprogram0.xml /dev/sdb
[/SIZE]

The msp.py program can also used to patch the files.

For example:
python msp.py patch0.xml 15758336

This will patch the 8GB card offline, and change the partition0.bin.

 

[E:V:A]

Qualcomm DBL format (source Anyclub)

DBL is combined by three images.

1. dbl.bin - the raw DBL image
2. dbl.hd - the dbl header image
3. dbl_preamble.mbn - the preamble image with following format:
   

   [SIZE=2]+------------+
   |Dbl-preamble| 
   +------------+ 
   |Dbl-header  |
   +------------+ 
   |Dbl.bin     | 
   +------------+ 
   [/SIZE]

PBL is using the dbl_preamble to detect the NAND page size. The NAND controller
can detect 512 byte and 2 Kbyte page size automatically, but for NAND page size
more than 2K, PBL needs preamble to determine the page size, so for 512/2K
NAND,eMMC,eSD,oneNAND , the preamble is optional.

For the dbl_preamable, the first two words are same as dbl header, they are
codeword and magic,

ref image_header.c

data_ptr = autodetectpage; 
*data_ptr = sbl_header.codeword; 
data_ptr++; 
*data_ptr = sbl_header.magic; 
data_ptr++; 
*data_ptr = AUTODETECT_PAGE_SIZE_MAGIC_NUM;

the third one is auto page size detection magic number.

The usage of the auto detection magic number is as below description To
understand this more clearly, for example ,if the dbl_preamble is 8KB. When we
detect the NAND page size > 2KB, we will set the default page size as 2K, then
try to read the preamble image from NAND flash, in case the page size is 4KB,
when read, can get 2 magic number in 8K size because page size will increase
with 4K byte steps, so page size is detected and that is 8K/2 = 4. For the 8K
page NAND, 1 magic number is read from the 8K size preamble image, so the page
size will be 8K/1 = 8K.

Dbl_preamble layout:

[SIZE=2]+-------------------------------------------------+
| codeword|magic|autodetection_ magic|............| 
2K------------------------------------------------|
| codeword|magic|autodetection_ magic|............| 
4K------------------------------------------------|
| codeword|magic|autodetection_ magic|............| 
6K------------------------------------------------|
| codeword|magic|autodetection_ magic|............| 
8K------------------------------------------------|
| codeword|magic|autodetection_ magic|............| 
+-------------------------------------------------+ 
[/SIZE]

 

[dviguha]

parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Program your device msp -x rawprogram0.xml /dev/sdb
Patch your device msp -xx patch0.xml /dev/sdb

Hello, where i can find these files, i have qpst but there are no such files.

 

[joederp]

So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)

 

[E:V:A]

Hello, where i can find these files, i have qpst but there are no such files.

I think it could be part of the Qualcomm Development Acceleration Resource Toolkit (QDART), as it supersedes QPST. But I'm not sure...

So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)

Where do you find these references?
I don't know, so if you find out let us know.

 

[joederp]

http://forum.xda-developers.com/showthread.php?t=1848267

If you dump the pit file you can see the references if you open in hex editor. Since it defines partition locations it appears they are either after last partition.. I haven't looked into technical pit stuff.

Sent from my SGH-T999 using xda app-developers app

 

[E:V:A]

Photo Place Holder Post

All images that I have not yet posted goes here...

 

[vache]

Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?

 

[E:V:A]

Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?

You tell me!