Resources for Samsung Galaxy TAB A 7.0 (2016) SM-T285

[gian20]

the build you suggested, the Alarm Clock problem persists.whenever I try to set the alarm clock the device will reboot and reboot and reboot ........ Still trying to find more bugs. I am attempting to try the 'Encrypt Phone" functionality.

 

[osm0sis]

@ashyx - Reversed engineered the 280 header and came up with the following notes:

The header is 512 bytes long.
First 8 bytes consists of magic - 0x44 0x48 0x54 0x42 0x01 0x00 0x00 0x00 - DHTB
This is followed by a sha256sum of the payload. Note that the "payload" starts with the start of the ANDROID header until the first 20 bytes of the SEANDROIDENFORCE header
Followed by 4 bytes which I think is unused and then followed by a 32-bit unsigned integer consisting of the size of the payload.
After that it is mostly empty bytes as far as i can tell.

This is true for both boot and recovery headers.

Below is the sample header of the DHTB header of the T280:

< 00000000: 4448 5442 0100 0000 4b40 f348 e206 7672 [email protected]
< 00000010: 8fe4 72c2 06ed 0fdd 9df7 16d7 80d0 fc64 ..r............d
< 00000020: 17bd 6594 5881 07b2 0000 0000 0000 0000 ..e.X...........
< 00000030: 1498 d600 0000 0000 0000 0000 0000 0000 ................


We can see that payload is 14063636 long, original boot.img is 14064808 long, the seandroid header is 680 bytes long so we do the math
14064808 - 512 (Size of the DHTB header) - 680 (seandroid header) - 20 (we include the SEANDROIDENFORCE magic string)
=
14063636 = 0x00d69814 , then swivel to account for endianess 0x1498d600

afterwhich I computed the sha256sum of the 14063636 byte payload and got 4b40f348e20676728fe472c206ed0fdd9df716d780d0fc6417bd6594588107b2
which matched the checksum value.

Hope with this information, T280 users can get what they deserve so much

@jedld @ashyx Is anything at all actually required in the DHTB header? Lineage's repo seems to suggest otherwise: https://github.com/samsung-sc8830/lineage_device_samsung_gtexswifi/tree/cm-13.0/boot

 

[jedld]

@jedld @ashyx Is anything at all actually required in the DHTB header? Lineage's repo seems to suggest otherwise: https://github.com/samsung-sc8830/lineage_device_samsung_gtexswifi/tree/cm-13.0/boot

I don't have the SM-T280 so most of my knowledge comes from results obtained by other developers, if I remember another developer @_mone (who managed to build twrp for this device btw) might have said that the actual content of the DHTB header may not matter as long as it exists. Though a properly formed DHTB header prevents various flashing errors from showing up as tested by @ashyx. The SM-T285 which I have uses a pretty standard boot.img format and does not require a DHTB header.

 

[ashyx]

@[email protected] Is anything at all actually required in the DHTB header? Lineage's repo seems to suggest otherwise: https://github.com/samsung-sc8830/lineage_device_samsung_gtexswifi/tree/cm-13.0/boot

I'm a bit sketchy on the procedure now, memory not what it used to be, but IIRC to flash the boot.img with ODIN the DHTB header is needed plus padding and the sha256 checksum created from the boot.img +SEandroid enforcing header. Also the size of the boot.img is included in the header.

For flashing via any other means, DD, TWRP etc., I think it was just the DHTB header required.

I would need to consult my notes to confirm, however I've just moved home and haven't got a working PC at the mo, so can't check the procedure.

However I can test an image built by your excellent AIK kitchen, assuming that's what the info is for?

Just for info though, custom kernels won't boot stock TouchWiz as yet. Still working on that one.

 

[osm0sis]

I'm a bit sketchy on the procedure now, memory not what it used to be, but IIRC to flash the boot.img with ODIN the DHTB header is needed plus padding and the sha256 checksum created from the boot.img +SEandroid enforcing header. Also the size of the boot.img is included in the header.

For flashing via any other means, DD, TWRP etc., I think it was just the DHTB header required.

I would need to consult my notes to confirm, however I've just moved home and haven't got a working PC at the mo, so can't check the procedure.

However I can test an image built by your excellent AIK kitchen, assuming that's what the info is for?

Just for info though, custom kernels won't boot stock TouchWiz as yet. Still working on that one.

Yup, hoping to add repack support for DHTB headered images to AIK.

Considering you guys have basically reverse engineered everything for it already, would one of you be able to write a proper standalone tool to create the header?

 

[jedld]

Yup, hoping to add repack support for DHTB headered images to AIK.

Considering you guys have basically reverse engineered everything for it already, would one of you be able to write a proper standalone tool to create the header?

Maybe this repo can help. There is another dev trying to get the T280 working:

https://github.com/USA-RedDragon/gtexswifi/commit/2888bbf24074a071bd112f54cb27604c2f1eb4c6

 

[osm0sis]

Maybe this repo can help. There is another dev trying to get the T280 working:

https://github.com/USA-RedDragon/gtexswifi/commit/2888bbf24074a071bd112f54cb27604c2f1eb4c6

His GitHub mentions are what put me onto this, but he's still just working with mkbootimg to reappend the header, not build a fresh one, which is what we need.

 

[IngolfN]

Update LineageOS ?

Hello!
Nice work!
I have a question: If I have installed the inofficial LineageOS on my SM-T285, how I can update it to a newer (inofficial) version without losing my data? Booting in Download-Mode and reinstalling the new version via Odin/Heimdall without flashing before?

Best regards!

 

[jedld]

Hello!
Nice work!
I have a question: If I have installed the inofficial LineageOS on my SM-T285, how I can update it to a newer (inofficial) version without losing my data? Booting in Download-Mode and reinstalling the new version via Odin/Heimdall without flashing before?

Best regards!

You can flash over the boot.img and system.img and leave your data partition intact. You might also need to reflash your gapps or other mods if you did those. Do note that my LineageOS builds are still alpha and I do not test upgrade scenarios. Make sure you backup your data and have a copy of the previous images just in case things goes sideways.

 

[lovemytab]

where is the option to give a "thanks" to jedid for compiling these resources?

 

[osm0sis]

@jedld, @ashyx, any progress on a standalone tool to regenerate a proper header?

 

[ashyx]

@jedld, @ashyx, any progress on a standalone tool to regenerate a proper header?

Chiefwigms seems to have made progress with that:
https://forum.xda-developers.com/showpost.php?p=73579475&postcount=22

 

[osm0sis]

Chiefwigms seems to have made progress with that:
https://forum.xda-developers.com/showpost.php?p=73579475&postcount=22

Ooh. I had just gotten started on one myself, so this saves reinventing the wheel! I'm a better editor/debugger anyway.

@chiefwigms, would would you be willing to share your header generating utility? I'd like to include it in the next version of AIK.

 

[chiefwigms]

Ooh. I had just gotten started on one myself, so this saves reinventing the wheel! I'm a better editor/debugger anyway.

@chiefwigms, would would you be willing to share your header generating utility? I'd like to include it in the next version of AIK.

Yep - i'll upload it when i get home tonight :good:

 

[osm0sis]

Yep - i'll upload it when i get home tonight :good:

Do you have a GitHub account so I can pull, cross-compile and of course credit the source correctly?

 

[chiefwigms]

Do you have a GitHub account so I can pull, cross-compile and of course credit the source correctly?

Yep - same name on github.. Right now I just forked repos from @jedld & @_mone, but all the code is still local in my vm. Should be home in a few hours

 

[chiefwigms]

Yep - same name on github.. Right now I just forked repos from @jedld & @_mone, but all the code is still local in my vm. Should be home in a few hours

Alright - I pushed the utility to my fork (minimal error checking). feel free to modify/whatever - it's mostly @jedld/@ashyx/@_mone's work

 

[osm0sis]

Alright - I pushed the utility to my fork (minimal error checking). feel free to modify/whatever - it's mostly @jedld/@ashyx/@_mone's work

Awesome work! Since it's still part of mkbootimg my plan will be to turn it into a standalone utility, like I did with mkmtkhdr for MTK zImage/ramdisk signing.

Edit: Oh wait, you did do it separately. Nice!

Edit 2: Okay, I think I know why it's not booting for you. The sha256sum needs to be generated from everything ANDROID! to SEANDROIDENFORCE + trailing 0xFFFFFFFF, without the trailing FFFFFFFF the sha256sum doesn't match the original.

 

[chiefwigms]

Awesome work! Since it's still part of mkbootimg my plan will be to turn it into a standalone utility, like I did with mkmtkhdr for MTK zImage/ramdisk signing.

Edit: Oh wait, you did do it separately. Nice!

Edit 2: Okay, I think I know why it's not booting for you. The sha256sum needs to be generated from everything ANDROID! to SEANDROIDENFORCE + trailing 0xFFFFFFFF, without the trailing FFFFFFFF the sha256sum doesn't match the original.

Hmm - it matched my original boot.img (from Samsung's AQA4 factory firmware). When I branched, I had to recompile unpack/mkbootimg, otherwise it gave me bad results:

[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/degas-unpackbootimg -i boot.img
Android magic found at: 512
BOARD_KERNEL_CMDLINE console=ttyS1,115200n8
BOARD_KERNEL_BASE 00000000
BOARD_RAMDISK_OFFSET 01000000
BOARD_SECOND_OFFSET 00f00000
BOARD_TAGS_OFFSET 00000000
BOARD_PAGE_SIZE 2048
BOARD_SECOND_SIZE 0
BOARD_DT_SIZE 380928
Before read
After read
Total Read: 14064384
[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/degas-mkbootimg -o boot_new.img --signature ../tools/seandroid_t280.img --base 0 --pagesize 2048 --kernel boot.img-zImage --cmdline "console=ttyS1,115200n8" --ramdisk boot.img-ramdisk.gz --dt boot.img-dt
[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/mkT280bootimg -i boot_new.img -o boot_t280.img
[email protected]:/gtaba/degas-mkbootimg/boot# diff boot.img boot_t280.img

 

[osm0sis]

Hmm - it matched my original boot.img (from Samsung's AQA4 factory firmware). When I branched, I had to recompile unpack/mkbootimg, otherwise it gave me bad results:

[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/degas-unpackbootimg -i boot.img
Android magic found at: 512
BOARD_KERNEL_CMDLINE console=ttyS1,115200n8
BOARD_KERNEL_BASE 00000000
BOARD_RAMDISK_OFFSET 01000000
BOARD_SECOND_OFFSET 00f00000
BOARD_TAGS_OFFSET 00000000
BOARD_PAGE_SIZE 2048
BOARD_SECOND_SIZE 0
BOARD_DT_SIZE 380928
Before read
After read
Total Read: 14064384
[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/degas-mkbootimg -o boot_new.img --signature ../tools/seandroid_t280.img --base 0 --pagesize 2048 --kernel boot.img-zImage --cmdline "console=ttyS1,115200n8" --ramdisk boot.img-ramdisk.gz --dt boot.img-dt
[email protected]:/gtaba/degas-mkbootimg/boot# ../tools/mkT280bootimg -i boot_new.img -o boot_t280.img
[email protected]:/gtaba/degas-mkbootimg/boot# diff boot.img boot_t280.img

Figured out the issue, mkT280bootimg expects the full signature to be there (per your "Assumption" note in the code), otherwise it doesn't hash correctly, even though only up to the FF FF FF FF is needed. Must be counting/subtracting from the end?

I was thinking something like this:

check for input file
- usage if not found

check for DHTB magic
- abort if found

check for ANDROID! magic
- abort if not found

check for SEANDROIDENFORCE
- add if not present

check for 0xFFFFFFFF
- add if not present

calculate sha256sum and size from full payload

write file with added header and additional 12 bytes 00 padding to trailing 0xFFFFFFFF​

I'll mess around and see what I can work out.