ATIV S T899 Engineering Phone - COMPLETELY UNLOCKED - Useful? - Windows Phone 8 Development and Hacking

Hi guys,
I bought an ATIV S on eBay "AS-IS" and the guy said it stopped booting after he tried resetting it. I thought it'd probably be the i8750 and I could flash it with the ROMs available but it turned out to be a T899 engineering unit. I was able to get it to boot because one of the startup modes mounts as 29 partitions. I just formatted the user partition and it booted to the initial setup. It looks like this was originally destined for T-Mobile USA but that got cancelled.
Anyways, it runs an old pre-RTM build of WP8 and all files are fully accessible if you boot it up in disk mode (volume down + power). I can't find any T899 ROMs to flash so I cant get it to stock. It looks like secure boot is disabled and some efuses on the SoC haven't been blown according to a file I found meant for pre-shipping tests.
There is also a telnet server running (you can telnet in and get the windows command prompt) and also an FTP server is running, allowing you to access any file on the device.
When in disk mode you can mount the registry hives on your desktop and modify the registry all you want.
Would this device be of any use to any developers here? If not I think I'm just going to re-sell it on eBay.

@GoodDayToDie, what do you think of this?

I'd like some screenshots/pictures first. It would be helpful to see exactly what's on it first.
Also, is there a way to make a dump of what's on it?
Sent from my RM-860 (Lumia 928) using the OFFICIAL Tapatalk app.

If some developer here wants it then I'll sell it for what I paid ($190) + shipping paypal personal transfer.

You can do all sorts of stuff with this! Someone really might be able to use it to jailbreak WP8!
Code:
C:\windows\system32>sc query
SERVICE_NAME: Audiosrv
DISPLAY_NAME: Windows Audio
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: BFE
DISPLAY_NAME: Base Filtering Engine
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: bnsvc
DISPLAY_NAME: BNS Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: Bootsh
DISPLAY_NAME: Bootsh
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: BtConnMgr
DISPLAY_NAME: Bluetooth Connection Manager Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: bthserv
DISPLAY_NAME: bthserv
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CellManager
DISPLAY_NAME: CellManager
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CmService
DISPLAY_NAME: CmService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CommsAPHost
DISPLAY_NAME: Communications Account Providers Host Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CommsMessageSvc
DISPLAY_NAME: CommsMessageService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: ContactsTokenSvc
DISPLAY_NAME: ContactsTokenService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CoreUINavigation
DISPLAY_NAME: CoreUI Navigation
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CoreUIRegistrar
DISPLAY_NAME: CoreUI Registrar
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: CryptSvc
DISPLAY_NAME: Cryptographic Services
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: DcomLaunch
DISPLAY_NAME: DCOM Server Process Launcher
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: dcpsvc
DISPLAY_NAME: DataCollectionPublishingService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: DebugOutput
DISPLAY_NAME: DebugOutput
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: DFTSvc
DISPLAY_NAME: DFTSvc
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: Dhcp
DISPLAY_NAME: DHCP Client
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: dmwappushsvc
DISPLAY_NAME: dmwappushsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: DnsCache
DISPLAY_NAME: DNS Client
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: DpuSvc
DISPLAY_NAME: DpuSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: dssvc
DISPLAY_NAME: dssvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: execmanservice
DISPLAY_NAME: execmanservice
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: FCRouter
DISPLAY_NAME: FCRouter
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: FontCache
DISPLAY_NAME: Windows Font Cache Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: InputService
DISPLAY_NAME: InputService
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: IpOverUsb
DISPLAY_NAME: IpOverUsb
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: KeyIso
DISPLAY_NAME: CNG Key Isolation
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: LanmanWorkstation
DISPLAY_NAME: Workstation
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: LassSvc
DISPLAY_NAME: LassSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: LaunchAppSvc
DISPLAY_NAME: LaunchAppSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: lfsvc
DISPLAY_NAME: WPLocationService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: lmhosts
DISPLAY_NAME: TCP/IP NetBIOS Helper
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: MITsSvc
DISPLAY_NAME: MITsSvc
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: MMCSS
DISPLAY_NAME: MMCSS
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: MsgSmsTransport
DISPLAY_NAME: Messaging SMS
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: MtpSvc
DISPLAY_NAME: MtpSvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: NetCFMSvc
DISPLAY_NAME: CFMService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: nsi
DISPLAY_NAME: Network Store Interface Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: pacmanservice
DISPLAY_NAME: pacmanservice
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: PerfXService
DISPLAY_NAME: PerfXService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: Phone
DISPLAY_NAME: Telephony state management
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: PhoneAudioSrv
DISPLAY_NAME: Phone Audio Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: PimIdxMaint
DISPLAY_NAME: PimIndexMaintenance
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: Power
DISPLAY_NAME: Power
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: powernotif
DISPLAY_NAME: powernotif
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: ProfSvc
DISPLAY_NAME: User Profile Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: ProximitySvc
DISPLAY_NAME: ProximitySvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: ProxySvc
DISPLAY_NAME: ProxySvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: pushsvc
DISPLAY_NAME: pushsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: QcGnssSvc
DISPLAY_NAME: QCGnssHelperService
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: QcShutdownSvc
DISPLAY_NAME: QcShutdownSvc
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: qctestSrvc
DISPLAY_NAME: qctestSrvc
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RCD
DISPLAY_NAME: RCD
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RemoteAtSrvc
DISPLAY_NAME: RemoteAtSrvc
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RILAdaptation
DISPLAY_NAME: RILAdaptation Service
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RILRouter
DISPLAY_NAME: RILRouter
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RpcEptMapper
DISPLAY_NAME: RPC Endpoint Mapper
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: RpcSs
DISPLAY_NAME: Remote Procedure Call (RPC)
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: SamSs
DISPLAY_NAME: Security Accounts Manager
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: SRUMHost
DISPLAY_NAME: SRUM
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: StorageSvc
DISPLAY_NAME: StorageSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: TaskSchedulerSvc
DISPLAY_NAME: TaskSchedulerSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: telmonsvc
DISPLAY_NAME: Telemetry SQM Sampler
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: TestSirepSvc
DISPLAY_NAME: Sirep Test Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: TneSvc
DISPLAY_NAME: TneSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: tws
DISPLAY_NAME: Tellme Windows Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: UnistoreService
DISPLAY_NAME: Unified Store
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: UserDataService
DISPLAY_NAME: Comms user data
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: UtkService
DISPLAY_NAME: UtkService
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: VaultSvc
DISPLAY_NAME: Credential Manager
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: WiFiConnSvc
DISPLAY_NAME: WiFiConnSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: WininetCacheSvc
DISPLAY_NAME: WininetCacheSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: Wlansvc
DISPLAY_NAME: WLAN AutoConfig
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: WLIDSvc
DISPLAY_NAME: WLIDSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: WpAbSvc
DISPLAY_NAME: WPAdaptiveBrightnessSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
SERVICE_NAME: zmedialib
DISPLAY_NAME: Zune Media Library Service
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

There is a file "setx.exe" in the Windows folder
Code:
SetX has three ways of working:
Syntax 1:
SETX [/S system [/U [domain\]user [/P [password]]]] var value [/M]
Syntax 2:
SETX [/S system [/U [domain\]user [/P [password]]]] var /K regpath [/M]
Syntax 3:
SETX [/S system [/U [domain\]user [/P [password]]]]
/F file {var {/A x,y | /R x,y string}[/M] | /X} [/D delimiters]
Description:
Creates or modifies environment variables in the user or system
environment. Can set variables based on arguments, regkeys or
file input.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which
the command should execute.
/P [password] Specifies the password for the given
user context. Prompts for input if omitted.
var Specifies the environment variable to set.
value Specifies a value to be assigned to the
environment variable.
/K regpath Specifies that the variable is set based
on information from a registry key.
Path should be specified in the format of
hive\key\...\value. For example,
HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\TimeZoneInformation\StandardName.
/F file Specifies the filename of the text file
to use.
/A x,y Specifies absolute file coordinates
(line X, item Y) as parameters to search
within the file.
/R x,y string Specifies relative file coordinates with
respect to "string" as the search parameters.
/M Specifies that the variable should be set in
the system wide (HKEY_LOCAL_MACHINE)
environment. The default is to set the
variable under the HKEY_CURRENT_USER
environment.
/X Displays file contents with x,y coordinates.
/D delimiters Specifies additional delimiters such as ","
or "\". The built-in delimiters are space,
tab, carriage return, and linefeed. Any
ASCII character can be used as an additional
delimiter. The maximum number of delimiters,
including the built-in delimiters, is 15.
/? Displays this help message.
NOTE: 1) SETX writes variables to the master environment in the registry.
2) On a local system, variables created or modified by this tool
will be available in future command windows but not in the
current CMD.exe command window.
3) On a remote system, variables created or modified by this tool
will be available at the next logon session.
4) The valid Registry Key data types are REG_DWORD, REG_EXPAND_SZ,
REG_SZ, REG_MULTI_SZ.
5) Supported hives: HKEY_LOCAL_MACHINE (HKLM),
HKEY_CURRENT_USER (HKCU).
6) Delimiters are case sensitive.
7) REG_DWORD values are extracted from the registry in decimal
format.
Examples:
SETX MACHINE COMPAQ
SETX MACHINE "COMPAQ COMPUTER" /M
SETX MYPATH "%PATH%"
SETX MYPATH ~PATH~
SETX /S system /U user /P password MACHINE COMPAQ
SETX /S system /U user /P password MYPATH ^%PATH^%
SETX TZONE /K HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\TimeZoneInformation\StandardName
SETX BUILD /K "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\CurrentBuildNumber" /M
SETX /S system /U user /P password TZONE /K HKEY_LOCAL_MACHINE\
System\CurrentControlSet\Control\TimeZoneInformation\
StandardName
SETX /S system /U user /P password BUILD /K
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\CurrentBuildNumber" /M
SETX /F ipconfig.out /X
SETX IPADDR /F ipconfig.out /A 5,11
SETX OCTET1 /F ipconfig.out /A 5,3 /D "#$*."
SETX IPGATEWAY /F ipconfig.out /R 0,7 Gateway
SETX /S system /U user /P password /F c:\ipconfig.out /X

Someone on this forum needs to get this phone to help IU unlock WP8. I do not know enough to be of any use and Snickler or GTTD would be perfect but not sure they would pay for this.

SETX and SC are standard Windows NT commands, but it's still very cool that the phone has them.
Hmm... are the binaries signed? If so, do they chain to a signature trusted by the stock OS? If so, it *might* be possible to invoke them on a stock ROM, and use them for extra permissions. For example, is there any on-device debugger, or any way you can see to attach a debugger to an arbitrary app?
The way the WP7 policy engine worked (and possibly the same for WP8), a native app needs to be installed to a certain path (usually under System32) for its elevated permissions to be applied, which is really awkward for us. However, it's worth looking into using the binaries on that dev image here; if they are trusted, there might be something usable there. The standard phone image doesn't even have things like cmd.exe.

@GoodDayToDie and/or @reker, do you guys find that phone usefull to make some real progress in the WP 8 jailbreak goal? If you do, we could start a fundraise to buy it....USD 190 it´s not too much...
Sorry for my english.

GoodDayToDie said:
SETX and SC are standard Windows NT commands, but it's still very cool that the phone has them.
Hmm... are the binaries signed? If so, do they chain to a signature trusted by the stock OS? If so, it *might* be possible to invoke them on a stock ROM, and use them for extra permissions. For example, is there any on-device debugger, or any way you can see to attach a debugger to an arbitrary app?
The way the WP7 policy engine worked (and possibly the same for WP8), a native app needs to be installed to a certain path (usually under System32) for its elevated permissions to be applied, which is really awkward for us. However, it's worth looking into using the binaries on that dev image here; if they are trusted, there might be something usable there. The standard phone image doesn't even have things like cmd.exe.
Click to expand...
Click to collapse
I'm not really sure man. I barely know what I'm doing. When I'm in the command prompt and try to run some binaries they work. Some of them are command line based programs so they return data in the command line but some are GUI programs and they launch the program on the phone. Others say "Access is denied'.
I posted the whole image of the phone. You can download it and see all the files on the phone.

Looks like no one wanted it and some dude on eBay did. ROM will stay up but the phone is changing hands.

petard said:
Looks like no one wanted it and some dude on eBay did. ROM will stay up but the phone is changing hands.
Click to expand...
Click to collapse
hah, you did it too soon - I haven't seen your post until now (vacations...) but I could easily buy it with probably bigger price

ultrashot said:
hah, you did it too soon - I haven't seen your post until now but I could easily buy it with probably bigger price
Click to expand...
Click to collapse
Are you someone who might be able to use it to unlock WP8?

petard said:
Are you someone who might be able to use it to unlock WP8?
Click to expand...
Click to collapse
Well, yes, it is something I am currently looking at.

ultrashot said:
Well, yes, it is something I am currently looking at.
Click to expand...
Click to collapse
I and other Windows phone user can donate

Ultrashot is The Man* for this kind of stuff - better reverse engineer than I am, and very familiar with the OS internals. He's one of the obvious candidates (I am not) for who "should" get the phone. Yes, he might be able to figure out an unlock from tinkering with it, and could certainly test anything we find.
* Apologies if the masculine terminology is incorrect here; I really don't know.

Mattemoller90 said:
I and other Windows phone user can donate
Click to expand...
Click to collapse
Don't worry, I don't need donations

Great progress. If we can take a vote (or a few), I'd say ultrashot, xbmod or Dark Forces Team.

I look forward to progress with this...I hope something can come out of it.... I just want my custom colors for my tiles again like I had with WP 7.8
I would donate something if it is needed for Ultrashot to get his hands on it...

DavidinCT said:
I look forward to progress with this...I hope something can come out of it.... I just want my custom colors for my tiles again like I had with WP 7.8
I would donate something if it is needed for Ultrashot to get his hands on it...
Click to expand...
Click to collapse
Well, with the Native Toast Launcher by @cpuguy, someone could take his source and add a feature to save a URI or app:// to a live tile. Then add some image to it. The only thing is that the toast would still need to be clicked on -_-

Related

SGS Service Menu

Not sure if it's been posted anywhere here (google didn't show anything) so I thought I'd post the service menus and my configuration. It may come in handy for someone, right?
Note that it's not all the menus but the most interesting ones at least.
Code:
*#197328640#
hhh = hexadecimal
nnn = decimal
MAIN MENU
[1] DEBUG SCREEN
[1] BASIC INFORMATION
UMTS : HOME(CS+PS)
RRC State: IDLE
WCDMA 2100 Band 1
Reg PLMN 240-2, IsPCS? 0
FREQ DL:10737
FREQ UL:9787
CELL_ID:0xhhhhhh <- Disappears when 3G is not available
LAC: 0xhhhh
PSC:hhh
RSCP:-94, ECIO:-5 <- Changing
[2] MM INFORMATION
MM state: IDLE
Reg state: INDEP_REGISTRATION
IMSI attatch status: 1
LU Rej: Norm=0, Period=13
T1312=11, Count=9
T32(10,11,12,13)=0010
T32(20,30,40)=000
Att Rej Cause=0
RAU Rej Cause=9
[3] RR INFORMATION
[4] NEIGHBOUR CELL
[5] GPRS INFORMATION
[6] SIM INFORMATION
[7] HANDOVER
[8] PHONE CONTROL
[9] ANTENNA/ADC
[2] VERSION INFO.
[1] SW VERSION
[1] READ IMEI
IMEI : nnnnnnnnnnnnnnnnn
[2] READ IMSI
"Don't Support it in GSM mobile!"
[3] READ SW VERSION
CP SW VERSION : I9000XXJF3
CP SW COMPILE DATE : Jun 3 20
CP SW COMPILE TIME : 11:25:05
[4] READ FTA SW VERSION
FTA SW VERSION : I9000.012
[5] READ ALL SW VERSION
CP SW VERSION : I9000XXJF3
HW VERSION : MP 0.800
FTA SW VERSION : I9000.012
FTA HW VERSION : REV1.2
RF CAL DATE : 2010.6.15
CSC CODE :
[6] READ CSC CODE
CP SW VERSION : I9000XXJF3
HW VERSION : MP 0.800
FTA SW VERSION : I9000.012
FTA HW VERSION : REV1.2
RF CAL DATE : 2010.6.15
CSC CODE :
[2] HW VERSION
[1] READ HW VERSION
HW VERSION : MP 0.800
[2] WRITE HW VERSION
NOT SUPPORTED
[3] READ FTA HW VERSION
FTA HW VERSION : REV1.2
[4] READ CAL DATE
CAL DATE : 2010.6.15
[5] WRITE CAL DATE
NOT SUPPORTED
[3] UMTS RF NV
[1] RF NV READ
NOT SUPPORTED
[2] RF NV WRITE
MENU NOT EXIST
PRESS BACK KEY
Current Command is 32
[4] GSM RF NV
[1] RF NV READ
NOT SUPPORTED
[2] RF NV WRITE
MENU NOT EXIST
PRESS BACK KEY
Current Command is 42
[5] AUDIO
[1] HANDSET
[1] Volume
[1]SRC Speech RX Volume
[0]0_lvl : 72
[1]1_lvl : 76
[2]2_lvl : 80
[3]3_lvl : 84
[4]4_lvl : 88
[5]5_lvl : 92
[2]DST I2S1 TX Volume
[0]0_lvl : 68
[1]1_lvl : 72
[2]2_lvl : 76
[3]3_lvl : 80
[4]4_lvl : 84
[5]5_lvl : 88
[3]SRC I2S1 RX Volume : 88
[4]DST Speech TX Volume : 88
[5]Sidetone : 0x0
[6]I2S1 Rx Gain : 0x1fff
[7]I2S1 Tx Gain : 0x2000
[2] HandsFree
[1]Gain Analog: 0x7fff
[2]NrCoeffs Real: 0x64
[3]NrCoeffs Complex 1: 0x64
[4]NrCoeffs Complex 2: 0x64
[5]LdAddGain: 0x0
[6]LdAddGainMax: 0x0
[7]LdAddGainMin: 0x1400
[3] NR
[1]UL NR
[1]AttenFactorMinVal : 0x1000
[2]OvEstFacBandZero : 0x2000
[3]OvEstFacBandNoZero : 0x2000
[2]DL NR
[1]AttenFactorMinVal : 0x1000
[2]OvEstFacBandZero : 0x1000
[3]OvEstFacBandNoZero : 0x1000
[4] DRP
[1]UL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -15360
[2]LB : -5120
[3]Gcomp : 0x0
[4]RinfA : 0x700
[5]RAB : 0x100
[6]RB0 : 0xb3
[2]DL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -16640
[2]LB : -5120
[3]Gcomp : 0x0
[4]RinfA : 0x700
[5]RAB : 0x100
[6]RB0 : 0x99
[5] SER
[1]beta : 31000
[2]overest : 700
[3]thplout : 70
[6] CNI
[1]Rx CNI gain : 20
[2]Tx CNI noise_gain : 16384
[3]Tx CNI noise_floor : 2048
[4]Tx CNI noise_gain_drp : 0
[9] Diamond Solution
[1]DYVE(OFF)
[1]DYVE OnOff : OFF
[2]mic_sensitivity : 5
[3]stepgain 1
[1]Step Gain 1 : 0
[2]Step Gain 2 : 0
[3]Step Gain 3 : 0
[4]Step Gain 4 : 0
[5]Step Gain 5 : 0
[4]stepgain 2
[1]StepGain 6 : 6
[2]StepGain 7 : 8
[3]StepGain 8 : 10
[4]StepGain 9 : 12
[5]StepGain 10 : 14
[6]StepGain 11 : 16
[5]clarity : 8
[6]noise_level : 0x800
[2]Swing Free(OFF)
[1]SF OnOff : OFF
[2]
[3]Voice Booster(OFF)
[1]VB OnOff : OFF
[2]hpf_cutoff : 4
[3]harmonic_level : 8192
[4]boostgain : 6
[5]limit_level : 21
[4]Acoustic Shock Free(OFF)
[1]ASF OnOff : OFF
[2]rms_mode : 2
[3]limit_level : 24
[5]Comport Noise Generator(OFF)
[1]CNG OnOff : OFF
[2]level : 1
[6]1Mic TX(OFF)
[1]1Mix TX OnOff : OFF
[2]Fir_Coeff Table
[1]fir_coeff 0 : 0xffffff49
[2]fir_coeff 1 : 0xfffffce6
[3]fir_coeff 2 : 0xfffffab3
[4]fir_coeff 3 : 0xfffffccb
[5]fir_coeff 4 : 0xfffff0e9
[6]fir_coeff 5 : 0xffffffc7
[7]fir_coeff 6 : 0x3e4a
[3]AEC Table 1
[1]rxmode_onoff : OFF
[2]delay_onoff : OFF
[3]delay : 0
[4]aec_onoff : OFF
[5]aec_rxgain : 0x200
[6]aec_mu : 0x0
[4]AEC Table 2
[1]dtrxg_onoff : OFF
[2]post_onoff : OFF
[3]post_min : 11
[4]post_gain : 11
[5]dtgc_onoff : OFF
[6]rxdet_onoff : OFF
[5]AEC Table 3
[1]rxdet_th_1st : -38
[2]rxdet_hangmax_1st : 6
[3]dtgc_gain_1st : 0x4000
[4]rxdet_th_2nd : -38
[5]rxdet_hangmax_2nd : 6
[6]dtgc_gain_2nd : 0x4000
[7]txdet_onoff : OFF
[6]NS Table 1
[1]iir_onoff: OFF
[2]ns_onoff : ON
[3]rxtx_agc_tbl : 13
[4]weight_ss_ns : 20
[5]ss_gain_ns : 11
[6]ns_gain_ns : 11
[7]NS Table 2
[1]tx_filter_onoff : ON
[2]tx_agc_onoff : ON
[3]in_txgain : 0x400
[4]out_txgain : 0xe40
[5]tx_cng_onoff : OFF
[6]noise_th_bits : 16
[2] HEADSET
[1] Volume
[1]SRC Speech RX Volume
[0]0_lvl : 75
[1]1_lvl : 78
[2]2_lvl : 81
[3]3_lvl : 84
[4]4_lvl : 87
[5]5_lvl : 90
[2]DST I2S1 TX Volume
[0]0_lvl : 75
[1]1_lvl : 78
[2]2_lvl : 81
[3]3_lvl : 84
[4]4_lvl : 87
[5]5_lvl : 90
[3]SRC I2S1 RX Volume : 100
[4]DST Speech TX Volume : 100
[5]Sidetone : 0x0
[6]I2S1 Rx Gain : 0x2d34
[7]I2S1 Tx Gain : 0x2000
[2] HandsFree
[1]Gain Analog: 0x7fff
[2]NrCoeffs Real: 0x32
[3]NrCoeffs Complex 1: 0x6e
[4]NrCoeffs Complex 2: 0x6e
[5]LdAddGain: 0x0
[6]LdAddGainMax: 0x0
[7]LdAddGainMin: 0xa8c
[3] NR
[1]UL NR
[1]AttenFactorMinVal : 0xfa0
[2]OvEstFacBandZero : 0xfa0
[3]OvEstFacBandNoZero : 0x1f40
[2]DL NR
[1]AttenFactorMinVal : 0x1000
[2]OvEstFacBandZero : 0x1000
[3]OvEstFacBandNoZero : 0x1000
[4] DRP
[1]UL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -15360
[2]LB : -7680
[3]Gcomp : 0xc00
[4]RinfA : 0x500
[5]RAB : 0x133
[6]RB0 : 0x80
[2]DL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -12800
[2]LB : -3840
[3]Gcomp : 0x0
[4]RinfA : 0x500
[5]RAB : 0x100
[6]RB0 : 0x0
[5] SER
[1]beta : 31000
[2]overest : 4000
[3]thploud : 70
[6] CNI
[1]Rx CNI gain : 20
[2]Tx CNI noise_gain : 0
[3]Tx CNI noise_floor : 0
[4]Tx CNI noise_gain_drp : 200
[9] Diamond Solution
[1]DYVE(OFF)
[1]DYVE OnOff : OFF
[2]mic_sensitivity : 5
[3]stepgain 1
[1]Step Gain 1 : 0
[2]Step Gain 2 : 0
[3]Step Gain 3 : 0
[4]Step Gain 4 : 0
[5]Step Gain 5 : 0
[4]stepgain 2
[1]StepGain 6 : 6
[2]StepGain 7 : 8
[3]StepGain 8 : 10
[4]StepGain 9 : 12
[5]StepGain 10 : 14
[6]StepGain 11 : 16
[5]clarity : 8
[6]noise_level : 0x800
[2]Swing Free(OFF)
[1]SF OnOff : OFF
[2]
[3]Voice Booster(OFF)
[1]VB OnOff : OFF
[2]hpf_cutoff : 4
[3]harmonic_level : 8192
[4]boostgain : 6
[5]limit_level : 21
[4]Acoustic Shock Free(OFF)
[1]ASF OnOff : OFF
[2]rms_mode : 2
[3]limit_level : 24
[5]Comport Noise Generator(OFF)
[1]CNG OnOff : OFF
[2]level : 1
[6]1Mic TX(OFF)
[1]1Mix TX OnOff : OFF
[2]Fir_Coeff Table
[1]fir_coeff 0 : 0xffffff49
[2]fir_coeff 1 : 0xfffffce6
[3]fir_coeff 2 : 0xfffffab3
[4]fir_coeff 3 : 0xfffffccb
[5]fir_coeff 4 : 0xfffff0e9
[6]fir_coeff 5 : 0xffffffc7
[7]fir_coeff 6 : 0x3e4a
[3]AEC Table 1
[1]rxmode_onoff : OFF
[2]delay_onoff : OFF
[3]delay : 0
[4]aec_onoff : OFF
[5]aec_rxgain : 0x200
[6]aec_mu : 0x0
[4]AEC Table 2
[1]dtrxg_onoff : OFF
[2]post_onoff : OFF
[3]post_min : 11
[4]post_gain : 11
[5]dtgc_onoff : OFF
[6]rxdet_onoff : OFF
[5]AEC Table 3
[1]rxdet_th_1st : -38
[2]rxdet_hangmax_1st : 6
[3]dtgc_gain_1st : 0x4000
[4]rxdet_th_2nd : -38
[5]rxdet_hangmax_2nd : 6
[6]dtgc_gain_2nd : 0x4000
[7]txdet_onoff : OFF
[6]NS Table 1
[1]iir_onoff: OFF
[2]ns_onoff : ON
[3]rxtx_agc_tbl : 13
[4]weight_ss_ns : 20
[5]ss_gain_ns : 11
[6]ns_gain_ns : 11
[7]NS Table 2
[1]tx_filter_onoff : OFF
[2]tx_agc_onoff : OFF
[3]in_txgain : 0x400
[4]out_txgain : 0xe40
[5]tx_cng_onoff : OFF
[6]noise_th_bits : 16
[3] SPEAKER
[4] BLUETOOTH
[5] HANDSET VT
[6] HEADSET VT
[7] SPEAKER VT
[8] BLUETOOTH VT
[6] COMMON
[1] FTM
[1] FTM : ON
NOT SUPPORTED
[2] FTM : OFF
NOT SUPPORTED
[2] DEBUG INFO
[1] MM REJECT CAUSE
CS Reg State: 0x0
CS Reg Reject Cause: 0x11
CS Net Reject Cause: 255
PS Reg State: 0x0
PS Reg Reject Cause: 0x11
PS Net Reject Cause: 255
[2] LOG DUMP
NOT SUPPORTED
[3] PCM LOGGING(OFF)
[1] Disable
[2] Enable
[3] RF SCANNING
[1] SETTING
[1] WCDMA THRESHOLD
[2] GSM THRESHOLD
MENU NOT EXIST
PRESS BACK KEY
Current Command is 63112
[3] RF SCANNING TIMER
[4] DISPLAY BAND[0~12]
[2] START RF SCANNING
[3] RESULT TO PC
[4] RESULT TO SCREEN
[4] DIAG CONFIG
[1] LOG VIA USB [*]
[2] LOG VIA UART
[3] LOG VIA IPC
[4] SPEED 115200 [*]
[5] SPEED 921600
[6] DBG MSG ON
[7] DBG MSG OFF [*]
[8] RAMDUMP ON
[9] RAMDUMP OFF [*]
[5] WCDMA/GSM SET CHANNEL
[6] NV REBUILD
[7] FACTORY TEST
[1] VBATT
[1] VBATT READ
[2] VBATT WRITE
[2] RTC
[3] AUDIO LOOPBACK
[4] GPRS SETTING
[5] AMR
[6] AUTO ANSWER
[7] SELLOUT SMS
[8] FM RADIO
[9] TOTAL CALL TIME
[8] FORCE SLEEP
[1] AP ONLY SLEEP
[2] CP ONLY LPM
[9] GPS
GPS MODULE IS IN AP SIDE
great this is exactly what I was looking for. Now can you tell me which setting under volume is the ear-piece volume?
Is yours really that quiet?? man.. u deaf?
ah thanks for this. Some new tweaks to try...
BTW anybody knows what "DIAMOND SOLUTION" means? There are some nice potential tweaks under that menu
Anyone already know more about what all these settings do (or some explanation on the terms?).
Trying to find out if I can change something here to improve the audio part of the video recording.
Diamond solution is the settings the phone uses when a headphone is plugged in. It is essentially your music settings of the phone. Lots of tweaks exist in there and yes it has a HARDWARE EQUALIZER right in there. It's called "Fir_Coeff Table".
Nice
Thank you VERY MUCH for this listing antzen !
Did you grab it manually or using some tool ?
supercurio said:
Thank you VERY MUCH for this listing antzen !
Did you grab it manually or using some tool ?
Click to expand...
Click to collapse
I manually typed the whole thing... ;-)
More SGS service menu entries ...
Remembered that I'd not completed the documentation of this and here's a bit more of the service menu. (I've updated the original post as well)
I'm not sure if my changes done to the device has affected the service menu in any way but bear that in mind as this device is not 100% default as it was shipped any longer. I've documented my changes here: endoid.wordpress.com/2010/08/08/my-sluggish-samsung-galaxy-s/ (could a moderator perhaps remove the url-restriction?)
Code:
[5] AUDIO
[2] HEADSET
[1] Volume
[1]SRC Speech RX Volume
[0]0_lvl : 75
[1]1_lvl : 78
[2]2_lvl : 81
[3]3_lvl : 84
[4]4_lvl : 87
[5]5_lvl : 90
[2]DST I2S1 TX Volume
[0]0_lvl : 75
[1]1_lvl : 78
[2]2_lvl : 81
[3]3_lvl : 84
[4]4_lvl : 87
[5]5_lvl : 90
[3]SRC I2S1 RX Volume : 100
[4]DST Speech TX Volume : 100
[5]Sidetone : 0x0
[6]I2S1 Rx Gain : 0x2d34
[7]I2S1 Tx Gain : 0x2000
[2] HandsFree
[1]Gain Analog: 0x7fff
[2]NrCoeffs Real: 0x32
[3]NrCoeffs Complex 1: 0x6e
[4]NrCoeffs Complex 2: 0x6e
[5]LdAddGain: 0x0
[6]LdAddGainMax: 0x0
[7]LdAddGainMin: 0xa8c
[3] NR
[1]UL NR
[1]AttenFactorMinVal : 0xfa0
[2]OvEstFacBandZero : 0xfa0
[3]OvEstFacBandNoZero : 0x1f40
[2]DL NR
[1]AttenFactorMinVal : 0x1000
[2]OvEstFacBandZero : 0x1000
[3]OvEstFacBandNoZero : 0x1000
[4] DRP
[1]UL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -15360
[2]LB : -7680
[3]Gcomp : 0xc00
[4]RinfA : 0x500
[5]RAB : 0x133
[6]RB0 : 0x80
[2]DL DRP
[1]Hi Band
[1]LA : -11520
[2]LB : -6144
[3]Gcomp : 0x0
[4]RinfA : 0x100
[5]RAB : 0x100
[6]RB0 : 0x100
[2]Low Band
[1]LA : -12800
[2]LB : -3840
[3]Gcomp : 0x0
[4]RinfA : 0x500
[5]RAB : 0x100
[6]RB0 : 0x0
[5] SER
[1]beta : 31000
[2]overest : 4000
[3]thploud : 70
[6] CNI
[1]Rx CNI gain : 20
[2]Tx CNI noise_gain : 0
[3]Tx CNI noise_floor : 0
[4]Tx CNI noise_gain_drp : 200
[9] Diamond Solution
[1]DYVE(OFF)
[1]DYVE OnOff : OFF
[2]mic_sensitivity : 5
[3]stepgain 1
[1]Step Gain 1 : 0
[2]Step Gain 2 : 0
[3]Step Gain 3 : 0
[4]Step Gain 4 : 0
[5]Step Gain 5 : 0
[4]stepgain 2
[1]StepGain 6 : 6
[2]StepGain 7 : 8
[3]StepGain 8 : 10
[4]StepGain 9 : 12
[5]StepGain 10 : 14
[6]StepGain 11 : 16
[5]clarity : 8
[6]noise_level : 0x800
[2]Swing Free(OFF)
[1]SF OnOff : OFF
[2]
[3]Voice Booster(OFF)
[1]VB OnOff : OFF
[2]hpf_cutoff : 4
[3]harmonic_level : 8192
[4]boostgain : 6
[5]limit_level : 21
[4]Acoustic Shock Free(OFF)
[1]ASF OnOff : OFF
[2]rms_mode : 2
[3]limit_level : 24
[5]Comport Noise Generator(OFF)
[1]CNG OnOff : OFF
[2]level : 1
[6]1Mic TX(OFF)
[1]1Mix TX OnOff : OFF
[2]Fir_Coeff Table
[1]fir_coeff 0 : 0xffffff49
[2]fir_coeff 1 : 0xfffffce6
[3]fir_coeff 2 : 0xfffffab3
[4]fir_coeff 3 : 0xfffffccb
[5]fir_coeff 4 : 0xfffff0e9
[6]fir_coeff 5 : 0xffffffc7
[7]fir_coeff 6 : 0x3e4a
[3]AEC Table 1
[1]rxmode_onoff : OFF
[2]delay_onoff : OFF
[3]delay : 0
[4]aec_onoff : OFF
[5]aec_rxgain : 0x200
[6]aec_mu : 0x0
[4]AEC Table 2
[1]dtrxg_onoff : OFF
[2]post_onoff : OFF
[3]post_min : 11
[4]post_gain : 11
[5]dtgc_onoff : OFF
[6]rxdet_onoff : OFF
[5]AEC Table 3
[1]rxdet_th_1st : -38
[2]rxdet_hangmax_1st : 6
[3]dtgc_gain_1st : 0x4000
[4]rxdet_th_2nd : -38
[5]rxdet_hangmax_2nd : 6
[6]dtgc_gain_2nd : 0x4000
[7]txdet_onoff : OFF
[6]NS Table 1
[1]iir_onoff: OFF
[2]ns_onoff : ON
[3]rxtx_agc_tbl : 13
[4]weight_ss_ns : 20
[5]ss_gain_ns : 11
[6]ns_gain_ns : 11
[7]NS Table 2
[1]tx_filter_onoff : OFF
[2]tx_agc_onoff : OFF
[3]in_txgain : 0x400
[4]out_txgain : 0xe40
[5]tx_cng_onoff : OFF
[6]noise_th_bits : 16
dagrim1 said:
Anyone already know more about what all these settings do (or some explanation on the terms?).
Trying to find out if I can change something here to improve the audio part of the video recording.
Click to expand...
Click to collapse
Same here...I'm interested in how to adjust the recording volume or to make the mic less sensible.
Not sure tweaking some of these settings will enable both side voice recording?
pmtan666 said:
Not sure tweaking some of these settings will enable both side voice recording?
Click to expand...
Click to collapse
What do you mean by that? Full Duplex? I am also interested in knowing that... Want to record my calls sometimes.
Also, as of now, I am desperately trying to ENABLE SERVICE MODE as it does not work in DDGJ4 firmware.
Can someone help?
EDIT: GOTCHA!
I found a way to get inside the service mode which does not work otherwise using the usual *#197328640# code. You could follow this on DDGJ4 to get inside:
Use the network info code *#0011#, you reach the below menu:
MAIN MENU
[1] DEBUG SCREEN
[1] BASIC INFORMATION
UMTS : HOME(CS+PS)
RRC State: IDLE
WCDMA 2100 Band 1
Reg PLMN 240-2, IsPCS? 0
FREQ DL:10737
FREQ UL:9787
CELL_ID:0xhhhhhh <- Disappears when 3G is not available
LAC: 0xhhhh
PSC:hhh
RSCP:-94, ECIO:-5 <- Changing
Now just hit the menu button, back (twice) and voila! you are at the ServiceMode home page! hope this helps.
Noticed, no "Audio" menu and hence no "Diamond Solution" in ServiceMode. Seems no hardware tweaks on this firmware with sound (good for me).
I'm also almost sure we could tweak audio recording with this section but we need someone who knows what settings mean what, I've tried playing with some of them to no effect at all.
I think there's an app in the market that you can easily access the sevice menu with a tap. check it out.
Service mode DIAG CONFIG
what's the relevance for the SPEED 115200 and 921600 I changed mine to 921600 long ago and I don't think it matters? I know they're baud rates but for what? Data or? I get the same data streams either way so what's it for?
NV Rebluid
Anyone try this.
[6] COMMON
[6] NV REBUILD
I have some hope that command resolve my IMEI problema, but... no success.
I have JPC firmware. As anyone with an 2.1 firmware try it?
help phone app not producing sound via handset
so I went into the service menu and changed some things and now my phone app doesn't work right....it is fine in speakermode or with a headset attached, but by default it now produces no sound nor does it capture any sound.
I've tweaked gain and volume in the 5.1.1 menu to no avail...
so I was hoping I could understand more about what those menus do.
am I correct in assuming that the phone app would use handset->volume for calls that use the built-in earpiece and speaker? what's partly puzzling to me is that sipdroid, using the same devices, works fine....
I also just generally don't know what a lot of the items are for (I didn't change any of the things I didn't know about, but it would be nice to have a clue).
NR, DRP, SER, and CNI are just acronyms to me. I assume NR is for noise reduction but I have no idea what the others are...
does anyone have a complete list of how it comes out of the box?
thanks...
-alan
same thing :S
@chekovma:
I'm suffering the same problem, did you happen to get your hands on a solution to this?
Does anyone have any feedback on how to solve this problem?
Any assistance would be appreciated.
-aehlayel
I dialed *#197328640# but nothing is happening. My SGS is NON-ROOTED
My FW Info:
PDA: I9000DDJP6
PHONE: I9000DDJP2
CSC: I9000ODDJP5
Build Info: 2010,11
my headset/earphones.only one speaker works
my headset/earphones.only one speaker works out of 2 and in a very low volume.Can i use any service menu selections for this?

UART Output / Bootloader Hacking / Kernel Debuging

Hey guys, I set up my Arduino Mega to communicate via UART with my Infuse4g.
The UART output comes out of the USB port at 115200kbps on the D+ and D- lines when you connect a 619kOhm resistor to USB Pins 4 and 5. It can be used for kernel debugging or general hacking around.
Here's some pics of my setup.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This emulates the "Test Board" from the KIT-S5PC110 which is used to develop the Aeries platform
You can make it do all kinds of crazy stuff....
Typical boot with battery just inserted.
Code:
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 4
MAX8893_REG_LDO1 return val e
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val 10
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x9, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 3797mV, soc = 57
check_quick_start_condition- Voltage: 3797.50000, Linearized[45/60/75], Capacity: 59
init_fuel_gauge: vcell = 3797mV, soc = 57, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x20
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x0
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 400, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0xffffffff)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=hex value hex value
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
0xF8
AST_POWERON
BOOTING COMPLETED
held enter while booting UART
Code:
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val 2
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val e
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x9, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 3777mV, soc = 48
check_quick_start_condition- Voltage: 3777.50000, Linearized[41/56/71], Capacity: 49
init_fuel_gauge: vcell = 3777mV, soc = 48, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x30
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x0
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 400, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop Autoboot aborted..
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL>
SBL Prompt
Code:
SBL> printenv
PARAM Rev 1.3
SERIAL_SPEED : 7
LOAD_RAMDISK : 0
BOOT_DELAY : 0
LCD_LEVEL : 97
SWITCH_SEL : 65
PHONE_DEBUG_ON : 0
LCD_DIM_LEVEL : 0
LCD_DIM_TIME : 6
MELODY_MODE : 1
REBOOT_MODE : 0
NATION_SEL : 0
LANGUAGE_SEL : 0
SET_DEFAULT_PARAM : 0
PARAM_INT_13 : 0
PARAM_INT_14 : 0
VERSION : I9000XXIL
CMDLINE : console=ttySAC2,115200 loglevel=4
DELTA_LOCATION : /mnt/rsv
PARAM_STR_3 :
PARAM_STR_4 :
SBL> setenv SWITCH_SEL 6543
argv[0] : setenv
argv[1] : SWITCH_SEL
argv[2] : 6543
value : 6543
SBL> reboot
command_loop: parse command error! (reboot)
SBL> reset
Rebooting...
SB1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 31
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val e
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val 10
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 31
MAX8893_REG_ONOFF new val 31
MAX8893_REG_ONOFF return val 31
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x9, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 3768mV, soc = 48
check_quick_start_condition- Voltage: 3768.75000, Linearized[40/55/70], Capacity: 49
init_fuel_gauge: vcell = 3768mV, soc = 48, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x0
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x0
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 400, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0xffffffff)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=serial number.....
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
0xF8
AST_POWERON
BOOTING COMPLETED
All commands available at SBL Prompt.
Code:
SBL> help
Following commands are supported:
* setenv
* saveenv
* printenv
* help
* reset
* boot
* kernel
* format
* open
* close
* erasepart
* eraseall
* loadkernel
* showpart
* addpart
* delpart
* savepart
* nkernel
* nramdisk
* nandread
* nandwrite
* usb
* mmctest
* keyread
* readadc
* usb_read
* usb_write
* fuelgauge
* pmic_read
* pmic_write
To get commands help, Type "help <command>"
SBL> help setenv
* Help : setenv
* Usage : setenv [name] [value] . .
Modify current environment info on ram
SBL> help saveenv
* Help : saveenv
* Usage : saveenv
Save cuurent environment info to flash
SBL> help printenv
* Help : printenv
* Usage : printenv
Print current environment info on ram
SBL> help reset
* Help : reset
* Usage : reboot
Reboot system
SBL> help boot
* Help : boot
* Usage : boot [kernel options]
Boot Linux with optional kernel options
SBL> help kernel
* Help : kernel
* Usage : kernel hex_adr
Change the Linux kernel base
SBL> help format
* Help : format
* Usage : format
format device
SBL> help open
* Help : open
* Usage : open
open device
SBL> help close
* Help : close
* Usage : close
close device
SBL> help erasepart
* Help : erasepart
* Usage : erasepart partition_id
erase part of units
- ex) erase 0x9(temp partition)
SBL> help eraseall
* Help : eraseall
* Usage : eraseall
erase all units
SBL> help loadkernel
* Help : loadkernel
* Usage : loadkernel
load kernel image
- loadkernel 0x80A00000 from kernel partition
SBL> help showpart
* Help : showpart
* Usage : showpart
show partition information
SBL> help addpart
* Help : addpart
* Usage : addpart <id> <attr> <unit>
add partition information
- ex) addpart 0x(id) 0x1(attr) 0x10(units)
SBL> help delpart
* Help : delpart
* Usage : delpart
delete last partition information
SBL> help savepart
* Help : savepart
* Usage : savepart
save partition information
SBL> help nkernel
* Help : nkernel
* Usage : nkernel command
* Usage : nkernel
read kernel from flash to DDR
SBL> help nramdisk
* Help : nramdisk
* Usage : nramdisk command
* Usage : nramdisk
read ramdisk from flash to DDR
SBL> help nandread
* Help : nandread
* Usage : * Usage : nandread <PARTID> <SIZE>
read partition from flash to SDRAM(0x80000000)
SBL> help nandwrite
* Help : nandwrite
* Usage : * Usage: nandwrite <PARTID> <SIZE>
write partition from SDRAM(0x80000000) to flash
SBL> help usb
* Help : usb
* Usage : usb download command
SBL> help mmctest
* Help : mmctest
* Usage : *Usage : mmctest
SBL> help keyread
* Help : keyread
* Usage : *Usage : keyread
SBL> help readadc
* Help : readadc
* Usage : *Usage : readadc <channel>
SBL> help usb_read
* Help : usb_read
* Usage : usb_read reg
Read the usb ic register
SBL> help usb_write
* Help : usb_write
* Usage : usb_write reg, val
Read the usb ic register
SBL> help fuelgauge
* Help : fuelgauge
* Usage : *usage : fuelgauge
SBL> help pmic_read
* Help : pmic_read
* Usage : pmic_read reg
Read the pmic register
SBL> help pmic_write
* Help : pmic_write
* Usage : pmic_write reg, val
Read the pmic register
SBL> printenv
PARAM Rev 1.3
SERIAL_SPEED : 7
LOAD_RAMDISK : 0
BOOT_DELAY : 0
LCD_LEVEL : 97
SWITCH_SEL : 65
PHONE_DEBUG_ON : 0
LCD_DIM_LEVEL : 0
LCD_DIM_TIME : 6
MELODY_MODE : 1
REBOOT_MODE : 0
NATION_SEL : 0
LANGUAGE_SEL : 0
SET_DEFAULT_PARAM : 0
PARAM_INT_13 : 0
PARAM_INT_14 : 0
VERSION : I9000XXIL
CMDLINE : console=ttySAC2,115200 loglevel=4
DELTA_LOCATION : /mnt/rsv
PARAM_STR_3 :
PARAM_STR_4 :
SBL> showpart
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
SBL> mmctest
Enable Movinand
[set_mmc_ocr] Sector Mode
[hsmmc_init] MMC card is detected
Product Name : MAG4FA
<display_card_info:935> ext_csd
<display_card_info:937>card_size: 15264
Total Card Size: 15265 MByte
SBL> keyread
keyread: row(0) col(0) read key value = 0x1
keyread: row(1) col(0) read key value = 0x2
SBL> pmic_read
---------read pmic register : multiple
(0x0 : 0x0), (0x1 : 0x0), (0x2 : 0x0), (0x3 : 0x0),
(0x4 : 0x0), (0x5 : 0xf0), (0x6 : 0x0), (0x7 : 0x0),
(0x8 : 0x40), (0x9 : 0x0), (0xa : 0xff), (0xb : 0xff),
(0xc : 0xa), (0xd : 0x80), (0xe : 0xff), (0xf : 0xff),
(0x10 : 0x3f), (0x11 : 0xef), (0x12 : 0x78), (0x13 : 0x10),
(0x14 : 0xbb), (0x15 : 0x12), (0x16 : 0x12), (0x17 : 0x12),
(0x18 : 0x12), (0x19 : 0xe), (0x1a : 0xe), (0x1b : 0x2),
(0x1c : 0x4), (0x1d : 0x86), (0x1e : 0x11), (0x1f : 0xc),
(0x20 : 0x2), (0x21 : 0x2), (0x22 : 0x30), (0x23 : 0xac),
(0x24 : 0x4), (0x25 : 0x14), (0x26 : 0x6), (0x27 : 0x10),
(0x28 : 0x2), (0x29 : 0xe), (0x2a : 0x31), (0x2b : 0x17),
This is what happens when you go into download mode... this occurs near the end of the SBL.
Code:
SBL> usb
reading nps status file is successfully!.
nps status=0x504d4f43
==> Welcome to ARIES!
==> Entering usb download mode..
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Really man...have you already taken this thing apart?
Sent from my SGH-I897 using XDA Premium App
and here's the kernel debugging.... in case the kernel locks up during boot and Android will not function correctly, it provides a shell. Authorize ahead of time so that you can use Super User.
The settings in SBL prompt are
Code:
setenv SWITCH_SEL 6543
setenv PHONE_DEBUG_ON 1
saveenv
This can be very useful for kernel devlopers
Code:
Starting kernel at 0x32000000...
Uncompressing Linux...................................................................................................................................................................................
[ 0.000000] copy: bad source 0
[ 0.000000] mout_audss: bad source 0
[ 0.090142] KERNEL:kernel_sec_get_debug_level_from_boot=0x574f4c44
[ 0.094877] KERNEL:magic_number=0x0 DEBUG LEVEL low!!
[ 0.099895] (kernel_sec_set_upload_cause) : upload_cause set 0
[ 5.833835] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
sh: can't access tty; job control turned off
$ [ 11.433364] init: no such service 'bootanim'
[ 24.851663] init: sys_prop: permission denied uid:1000 name:wifi.interface
[ 35.227503] init: no such service 'bootanim'
[ 38.484304] init: sys_prop: permission denied uid:1000 name:dpm.allowcamera
su
sh: can't access tty; job control turned off
# dmesg|tail
<4>[ 47.443068] [email protected]
<4>[ 51.363390] mook - wm8994 TTY Off
<4>[ 51.666438] eth0: SIOCSIWSCAN : ISCAN
<4>[ 51.667822] +++: Set Broadcast ISCAN
<4>[ 53.013468] [email protected]
<4>[ 54.447852] Send Event ISCAN complete
<4>[ 54.448053] eth0 wl_iw_iscan_get_scan buflen_from_user 8192:
<4>[ 54.448067] eth0: SIOCGIWSCAN GET broadcast results
<4>[ 54.448111] wl_iw_iscan_get_scan return to WE 803 bytes APs=3
<4>[ 84.445803] wl_iw_set_ss_cache_timer_flag called
#
Looks like samsung has an autorun to reflash the recovery partition at /system/etc/install-recovery.sh
bulletproof1013 said:
Really man...have you already taken this thing apart?
Sent from my SGH-I897 using XDA Premium App
Click to expand...
Click to collapse
No, and I don't plan on it unless I have a problem that requires me to take it apart. Apparently this phone does not have bricking problems with people porting bootloaders from other devices.
I can see this being very handy indeed. Running kernels blind, having to get to at least ADB is a real pain. At least we now know this method works for the Infuse.
No bricking problems? Really?
Sent from my SGH-I897 using XDA Premium App
AdamOutler said:
No, and I don't plan on it unless I have a problem that requires me to take it apart. Apparently this phone does not have bricking problems with people porting bootloaders from other devices.
Click to expand...
Click to collapse
No bricking problems b/c we can't flash bootloaders haha. Well actually there is a way, but the only person to try said way bricked.
That's because the bootloaders are lock. well not motorola lock. I've read some where in the Galaxy tab 10.1 forum that Samsung had to lock the bootloaders because of copyright issues with media hub. if thats true Roger infuse don't offer media hub and the bootloaders for that phone are not lock. we got an update for the tab 10.1 that lock the bootloaders and the tab offer media hub could be true since Samsung are not known for locking them. I could be wrong.
Sent from my SAMSUNG-SGH-I997 using XDA Premium App
gtg465x said:
No bricking problems b/c we can't flash bootloaders haha. Well actually there is a way, but the only person to try said way bricked.
Click to expand...
Click to collapse
*raises hand* hehe
But I'm wondering if accessing the phone via UART would work with a device that's hardbricked as bad as that was? Too late to test now, it's already in the mail. ... unless I were to try flashing bootloaders like we did before? hehe
Aou said:
*raises hand* hehe
But I'm wondering if accessing the phone via UART would work with a device that's hardbricked as bad as that was? Too late to test now, it's already in the mail. ... unless I were to try flashing bootloaders like we did before? hehe
Click to expand...
Click to collapse
I have JTAG capabilities if you want to test.
You can get into download mode as long as you have SBL.
I've worked on and developed a way to turn Captivate into KIT-S5PC110 (the aeries development platform)... http://forum.xda-developers.com/showthread.php?t=1206216 It may be possible on this device.... I'm still working on my captivate.
AdamOutler said:
I have JTAG capabilities if you want to test.
You can get into download mode as long as you have SBL.
I've worked on and developed a way to turn Captivate into KIT-S5PC110 (the aeries development platform)... http://forum.xda-developers.com/showthread.php?t=1206216 It may be possible on this device.... I'm still working on my captivate.
Click to expand...
Click to collapse
Thanks, but the dead phone is gone and in the mail. I'd rather not void a warranty on this device by using JTAG. That device would not even go to download mode when using a JIG. Even the battery charging screen was gone. It was a hard brick.
AdamOutler said:
I have JTAG capabilities if you want to test.
You can get into download mode as long as you have SBL.
I've worked on and developed a way to turn Captivate into KIT-S5PC110 (the aeries development platform)... http://forum.xda-developers.com/showthread.php?t=1206216 It may be possible on this device.... I'm still working on my captivate.
Click to expand...
Click to collapse
Since you have JTAG capabilities there should be no risk of bricking. Maybe you can experiment with bootloader flashing on this phone. I can link you to gb bootloaders and custom bmlwriter flashing program if you're interested.
gtg465x said:
Since you have JTAG capabilities there should be no risk of bricking. Maybe you can experiment with bootloader flashing on this phone. I can link you to gb bootloaders and custom bmlwriter flashing program if you're interested.
Click to expand...
Click to collapse
Did you ever get a copy of BML5 from a Rogers device?
Aou said:
Did you ever get a copy of BML5 from a Rogers device?
Click to expand...
Click to collapse
Yes, but there's a bit of a problem with that. The dump of bml5 was blank. We aren't entirely sure what's going on with our bootloaders, thus the need for someone with a JTAG to test crazy ass shiz.
edit: Although it's not a pressing issue now that we have a kernel workaround for no GB bootloaders.
gtg465x said:
Since you have JTAG capabilities there should be no risk of bricking. Maybe you can experiment with bootloader flashing on this phone. I can link you to gb bootloaders and custom bmlwriter flashing program if you're interested.
Click to expand...
Click to collapse
I just gave you 1001 thanks! lol.
Just because you have a JTAG writer does not mean it's easy to JTAG a device. I would test with bootloaders if something required it, however it's not a good idea to go flashing random bootloaders ever... Only if required.
The proper way is to rework the kernel like you did.
Well, thanks to your original post, I was able to get something from the UART on my Infuse. Unfortunately, it's all garbage. Are you using a standard RS-232 connection, or TTL 5v connection? If using TTL 5v, would it be possible to use a TTL 3.3v? This is what I'm getting in putty:
½^ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZÚ¯¿¿¿Y=%#1¿_¿{!!'!=7/¿¯y*¿Y=%#1¿u'59¿y!£§¿g7£¿¥ë奥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ëåëåj¤t4õ5ý¿¿¿¿¿¿¿ëåj¤Ê_5')¿¿¿¿¿ëåµ--!#¯*£ëåßg
(repeats). I get a whole new set of garbage when I put int he battery. It all looks like your video on youtube with the captivate, but it's just all garbage. I tracked down another forum post where you were getting garbage also, but then never posted the resolution.
Any help would be awesome. Thanks!
gtg465x said:
Since you have JTAG capabilities there should be no risk of bricking. Maybe you can experiment with bootloader flashing on this phone. I can link you to gb bootloaders and custom bmlwriter flashing program if you're interested.
Click to expand...
Click to collapse
I don't think he's got JTAG capabilities on the phone yet, and probably won't until he REALLY needs them.
Getting JTAG capability requires soldering a connector to the board permanently or semi-permanently, or soldering individual wires to the board only for the flash process. No one has been able to figure out any compression-spring/pogo-pin contact approach, the connector pad pitch is just too damn small.
Otherwise I'd probably have JTAG capability too. If not for the connector issue I'd be experimenting with a Bus Blaster v2.
Entropy512 said:
I don't think he's got JTAG capabilities on the phone yet, and probably won't until he REALLY needs them.
Getting JTAG capability requires soldering a connector to the board permanently or semi-permanently, or soldering individual wires to the board only for the flash process. No one has been able to figure out any compression-spring/pogo-pin contact approach, the connector pad pitch is just too damn small.
Otherwise I'd probably have JTAG capability too. If not for the connector issue I'd be experimenting with a Bus Blaster v2.
Click to expand...
Click to collapse
I can put the connector on.. assuming its 12 pin plus 4 mounting pads? I have them in stock. Its not a problem for me to solder them. I can do it.
Does anyone have some tech porn of this board, or disassembly instructions?

GT-I5800/GT-I5801 Apollo Device Information

I wish to post this information so that I will be helpful for all the developers.
Device Information
Board - s5p6442
CPU - armeabi-v6 / armeabi / armv6-vfp / arm1176jzf-s
GPU - FIMG-3DSE (rev. 1.5.3)
Audio - wolfson microelectronics wm8994
Touchscreen - ATMEL mXT224(AT42QT602240)
TFT LCD PANEL - Samsung S6D04D1
Camera - s5k4ca
Compass / Magnetometer Sensor - AK8973B
Accelerometer Sensor - BMA020
Proximity sensor - GP2A
WiFi - bcm4329
Bluetooth - bcm4329
FM Radio - si4709
USB switch - FSA9480
LCD controller - ???
PMIC chip(s) - MAX8998
Modem - ???
Click to expand...
Click to collapse
Mount Points
Code:
kernel /dev/block/bml5
modem /dev/block/bml10
/cache /dev/block/stl8
/data /dev/block/stl7
/system /dev/block/stl6
/sdcard /dev/block/mmcblk0p1 and /dev/block/mmcblk0
Partition Layout
==== PARTITION INFORMATION ====
ID : IBL & PBL (0x0)
MOUNT POINT : N/A
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 0
NO_UNITS : 1
POSITION : 0x00000000-0x00040000
SIZE : 0x00040000
===============================
ID : SBL (0x1)
MOUNT POINT : N/A
ATTR : RO ENTRYPOINT SLC BOOTLOADING PREWRITING (0xd402)
FIRST_UNIT : 1
NO_UNITS : 5
POSITION : 0x00040000-0x00180000
SIZE : 0x00140000
===============================
ID : PARAM (0x2)
MOUNT POINT : N/A
ATTR : RW SLC (0x1001)
FIRST_UNIT : 6
NO_UNITS : 2
POSITION : 0x00180000-0x00200000
SIZE : 0x00080000
===============================
ID : EFS (0x18)
MOUNT POINT : /dev/block/stl4
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 8
NO_UNITS : 32
POSITION : 0x00200000-0x00a00000
SIZE : 0x00800000
===============================
ID : KERNEL (0x4)
MOUNT POINT : /dev/block/bml5
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 40
NO_UNITS : 30
POSITION : 0x00a00000-0x01180000
SIZE : 0x00780000
===============================
ID : FACTORYFS (0x15)
MOUNT POINT : /dev/block/stl6
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 70
NO_UNITS : 880
POSITION : 0x01180000-0x0ed80000
SIZE : 0x0dc00000
===============================
ID : DATAFS (0x16)
MOUNT POINT : /dev/block/stl7
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 950
NO_UNITS : 810
POSITION : 0x0ed80000-0x1b800000
SIZE : 0x0ca80000
===============================
ID : CACHE (0x17)
MOUNT POINT : /dev/block/stl8
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1760
NO_UNITS : 152 (*mismatch* 152 should be 150)
POSITION : 0x1b800000-0x1de00000
SIZE : 0x02600000
===============================
ID : TEMP (0x3)
MOUNT POINT : N/A
ATTR : RW SLC (0x1001)
FIRST_UNIT : 1912
NO_UNITS : 28 (*mismatch* 28 should be 30)
POSITION : 0x1de00000-0x1e500000
SIZE : 0x00700000
===============================
ID : MODEM (0x5)
MOUNT POINT : /dev/block/bml10
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 1940
NO_UNITS : 64
POSITION : 0x1e500000-0x1f500000
SIZE : 0x01000000
===============================
Click to expand...
Click to collapse
I also request all developers to contribute for the missing information. If devs like to add some more information please let me know, I will add it.
Hope this also helps all developers.
Thanks in advance for the support.
camera : s5k4ca
sensors : akm8973
Got first reply from the creator. Thank you very much marcellusbe.
Updated first post.
marcellusbe said:
camera : s5k4ca
sensors : akm8973
Click to expand...
Click to collapse
What about the sound chip? WM8994 DAC
Maybe that belongs to be on your list.
Wiggierip said:
What about the sound chip? WM8442 DAC
Maybe that belongs to be on your list.
Click to expand...
Click to collapse
it's wolfson microelectronics wm8994
marcellusbe said:
it's wolfson microelectronics wm8994
Click to expand...
Click to collapse
I edited my post allready acctually , Thanks anyway
Run the voodoo report app by supercurio to get some more info
https://play.google.com/store/apps/details?id=org.projectvoodoo.report
Also, /dev/block/bml5 is the kernel, and modem's bml10
A partition table (without the entries for the first and second stage bootloader, param and efs partitions is available here :
https://github.com/chirayudesai/cd.kernel-apollo/blob/cd-2.6.32/drivers/mtd/onenand/samsung_apollo.h
The GPU is called FIMG-3DSE (rev. 1.5.3), so maybe it's better to use this name in the first post.
I would also add information about USB switch - FSA9480 and try to find the model of LCD controller, PMIC chip(s), modem and other sensors (akm8973 is only the compass/magnetometer).
For partition table, there should be a file in /proc listing the complete partition map with exact offsets and sizes, in case of Spica it's /proc/rfs/bmlinfo.
tom3q said:
The GPU is called FIMG-3DSE (rev. 1.5.3), so maybe it's better to use this name in the first post.
I would also add information about USB switch - FSA9480 and try to find the model of LCD controller, PMIC chip(s), modem and other sensors (akm8973 is only the compass/magnetometer).
For partition table, there should be a file in /proc listing the complete partition map with exact offsets and sizes, in case of Spica it's /proc/rfs/bmlinfo.
Click to expand...
Click to collapse
Or you can just go through /proc/last_kmsg
You did post a boot log sometime back, layout's this :
Code:
==== PARTITION INFORMATION ====
ID : IBL & PBL (0x0)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : SBL (0x1)
ATTR : RO ENTRYPOINT SLC BOOTLOADING PREWRITING (0xd402)
FIRST_UNIT : 1
NO_UNITS : 5
===============================
ID : PARAM (0x2)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 6
NO_UNITS : 2
===============================
ID : EFS (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 8
NO_UNITS : 32
===============================
ID : KERNEL (0x4)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 40
NO_UNITS : 30
===============================
ID : FACTORYFS (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 70
NO_UNITS : 880
===============================
ID : DATAFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 950
NO_UNITS : 810
===============================
ID : CACHE (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1760
NO_UNITS : 152 (*mismatch* 152 should be 150)
===============================
ID : TEMP (0x3)
ATTR : RW SLC (0x1001)
FIRST_UNIT : 1912
NO_UNITS : 28 (*mismatch* 28 should be 30)
===============================
ID : MODEM (0x5)
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 1940
NO_UNITS : 64
===============================
You should change the title itns GT-I5800(1) not G3
Sent from my GT-I5800 using xda premium
All changes updated. I got some information from #cat /proc/LinuStoreIII/bmlinfo . Please confirm the information's are correct. Please provide me the missing info. Once I got all the information I will update the main post.
# cat proc/LinuStoreIII/bmlinfo
FSR VERSION: FSR_1.2.1p1_b129_RTM
minor position size units id name
1: 0x00000000-0x00040000 0x00040000 1 0
2: 0x00040000-0x00180000 0x00140000 5 1
3: 0x00180000-0x00200000 0x00080000 2 2
4: 0x00200000-0x00a00000 0x00800000 32 24
5: 0x00a00000-0x01180000 0x00780000 30 4
6: 0x01180000-0x0ed80000 0x0dc00000 880 21
7: 0x0ed80000-0x1b800000 0x0ca80000 810 22
8: 0x1b800000-0x1de00000 0x02600000 152 23
9: 0x1de00000-0x1e500000 0x00700000 28 3
10: 0x1e500000-0x1f500000 0x01000000 64 5
==== PARTITION INFORMATION ====
ID : IBL & PBL (0x0)
MOUNT POINT : ?????
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 0
NO_UNITS : 1
POSITION : 0x00000000-0x00040000
SIZE : 0x00040000
===============================
ID : SBL (0x1)
MOUNT POINT : ????
ATTR : RO ENTRYPOINT SLC BOOTLOADING PREWRITING (0xd402)
FIRST_UNIT : 1
NO_UNITS : 5
POSITION : 0x00040000-0x00180000
SIZE : 0x00140000
===============================
ID : PARAM (0x2)
MOUNT POINT : ????
ATTR : RW SLC (0x1001)
FIRST_UNIT : 6
NO_UNITS : 2
POSITION : 0x00180000-0x00200000
SIZE : 0x00080000
===============================
ID : EFS (0x18)
MOUNT POINT : /dev/block/stl4
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 8
NO_UNITS : 32
POSITION : 0x00200000-0x00a00000
SIZE : 0x00800000
===============================
ID : KERNEL (0x4)
MOUNT POINT : /dev/block/bml5
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 40
NO_UNITS : 30
POSITION : 0x00a00000-0x01180000
SIZE : 0x00780000
===============================
ID : FACTORYFS (0x15)
MOUNT POINT : /dev/block/stl6
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 70
NO_UNITS : 880
POSITION : 0x01180000-0x0ed80000
SIZE : 0x0dc00000
===============================
ID : DATAFS (0x16)
MOUNT POINT : /dev/block/stl7
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 950
NO_UNITS : 810
POSITION : 0x0ed80000-0x1b800000
SIZE : 0x0ca80000
===============================
ID : CACHE (0x17)
MOUNT POINT : /dev/block/stl8
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1760
NO_UNITS : 152 (*mismatch* 152 should be 150)
POSITION : 0x1b800000-0x1de00000
SIZE : 0x02600000
===============================
ID : TEMP (0x3)
MOUNT POINT : ????
ATTR : RW SLC (0x1001)
FIRST_UNIT : 1912
NO_UNITS : 28 (*mismatch* 28 should be 30)
POSITION : 0x1de00000-0x1e500000
SIZE : 0x00700000
===============================
ID : MODEM (0x5)
MOUNT POINT : /dev/block/bml10
ATTR : RO SLC PREWRITING (0x9002)
FIRST_UNIT : 1940
NO_UNITS : 64
POSITION : 0x1e500000-0x1f500000
SIZE : 0x01000000
===============================
Click to expand...
Click to collapse
pmanian said:
All changes updated. I got some information from #cat /proc/LinuStoreIII/bmlinfo . Please confirm the information's are correct. Please provide me the missing info. Once I got all the information I will update the main post.
Click to expand...
Click to collapse
It is indeed the correct, and the partitions you've marked as ??? (for the mount points) aren't mounted in the android system, they contain the Samsung bootloaders which are used only to initialize the phone and then load the kernel, and then complete control is passed to the kernel
Also, might wanna remove the / in front of kernel and modem in the first post, as they are directly accessed from the block device's location
Updated the main post. Thanks for the information. Thanks you very much.
cdesai said:
It is indeed the correct, and the partitions you've marked as ??? (for the mount points) aren't mounted in the android system, they contain the Samsung bootloaders which are used only to initialize the phone and then load the kernel, and then complete control is passed to the kernel
Also, might wanna remove the / in front of kernel and modem in the first post, as they are directly accessed from the block device's location
Click to expand...
Click to collapse
TFT LCD PANEL: Samsung S6D04D1
ALL THE INFO U NEED! dharam made this thread long back..... keep scrolling down... info on our devices hardware and software....
we owe u dharam
http://forum.xda-developers.com/showthread.php?t=1156243
I am not aware of that, So I created this thread. Thanks for the info.
unreal3000 said:
TFT LCD PANEL: Samsung S6D04D1
ALL THE INFO U NEED! dharam made this thread long back..... keep scrolling down... info on our devices hardware and software....
we owe u dharam
http://forum.xda-developers.com/showthread.php?t=1156243
Click to expand...
Click to collapse
unreal3000 said:
TFT LCD PANEL: Samsung S6D04D1
ALL THE INFO U NEED! dharam made this thread long back..... keep scrolling down... info on our devices hardware and software....
we owe u dharam
http://forum.xda-developers.com/showthread.php?t=1156243
Click to expand...
Click to collapse
S6D04D is the LCD controller chip inside the LCD module. The exact manufacturer and model of the screen itself might vary, but it doesn't matter, because the chip handles it itself.
Modem is a Qualcomm.
Not sure which.
hillbeast said:
Modem is a Qualcomm.
Not sure which.
Click to expand...
Click to collapse
oh yeah... i saw somewhere.... time for a bit of research...
---------- Post added at 03:36 AM ---------- Previous post was at 03:06 AM ----------
found it.... modem- QSC6270
datasheet- http://pdf1.alldatasheet.com/datasheet-pdf/view/186573/QUALCOMM/QSC6270.html
pic of the inside of the phone-
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
anyone recognize the other chips?
1 more useful link-
http://forum.xda-developers.com/showthread.php?t=1260551
unreal3000 said:
oh yeah... i saw somewhere.... time for a bit of research...
---------- Post added at 03:36 AM ---------- Previous post was at 03:06 AM ----------
found it.... modem- QSC6270
datasheet- http://pdf1.alldatasheet.com/datasheet-pdf/view/186573/QUALCOMM/QSC6270.html
pic of the inside of the phone-
anyone recognize the other chips?
1 more useful link-
http://forum.xda-developers.com/showthread.php?t=1260551
Click to expand...
Click to collapse
Just pulled my phone apart. I'll tell you what all the chips are:
The big one with SAMSUNG on it is the CPU. The black one to the right is the MAX8998 chip. Below it the big one is the modem (Qualcomm QSC6270), and to the right of that is the WM8998 audio codec. Still trying to find the USB switch chip...
EDIT: The one in the bottom right corner is the FM radio.
hillbeast said:
Just pulled my phone apart. I'll tell you what all the chips are:
The big one with SAMSUNG on it is the CPU. The black one to the right is the MAX8998 chip. Below it the big one is the modem (Qualcomm QSC6270), and to the right of that is the WM8998 audio codec. Still trying to find the USB switch chip...
EDIT: The one in the bottom right corner is the FM radio.
Click to expand...
Click to collapse
Now that you've popped your phone apart, could you take some HD pics and upload somewhere?
I talked to AdamOutler once about getting the unbrickable mod working on our devices, HD pics of the board would help with that

Flash Counter not resetting itself!?

Hi, I had recently flashed the jellybean leak Ota for my tab(it's p3100), I had then flashed cwm. Now I tried resetting my flash counter but after rebooting it still stuck at 1 count. What should I do?
Sent from my GT-P3100 using XDA Premium HD app
Help anyone?
Sent from my GT-P3100 using XDA Premium HD app
Maybe flash back to ics. And reset the counter
Sent from my GT-I9100 using Tapatalk 2
Aditya16 said:
Hi, I had recently flashed the jellybean leak Ota for my tab(it's p3100), I had then flashed cwm. Now I tried resetting my flash counter but after rebooting it still stuck at 1 count. What should I do?
Sent from my GT-P3100 using XDA Premium HD app
Click to expand...
Click to collapse
have you tried "Triangule Away" ?
you can installed it from google play
but you need to root your device first
sapiterbang said:
have you tried "Triangle Away" ?
you can installed it from google play
but you need to root your device first
Click to expand...
Click to collapse
I resetted it with that only. Is it some bug in jb?
Sent from my GT-P3100 using XDA Premium HD app
Alvin Lai said:
Maybe flash back to ics. And reset the counter
Sent from my GT-I9100 using Tapatalk 2
Click to expand...
Click to collapse
Will try that.
Sent from my GT-P3100 using XDA Premium HD app
May be try installing supersu ( not superuser) from google play and give permissions to triangle away
Install latest version 1.95 of triangle away
Sent from Galaxy S2 or Galaxy Tab2
I confirm Triangle Away and SuperSU combination still work in JB.
So after rebooting and going to the download mode, even for me it is zero, but after exiting and booting back it goes back to 1 count.
Sent from my GT-P3100 using XDA Premium HD app
Aditya16 said:
So after rebooting and going to the download mode, even for me it is zero, but after exiting and booting back it goes back to 1 count.
Sent from my GT-P3100 using XDA Premium HD app
Click to expand...
Click to collapse
Post your issue in Triangle Away thread. Maybe someone can help you...
---------- Post added at 05:06 PM ---------- Previous post was at 05:06 PM ----------
Aditya16 said:
So after rebooting and going to the download mode, even for me it is zero, but after exiting and booting back it goes back to 1 count.
Sent from my GT-P3100 using XDA Premium HD app
Click to expand...
Click to collapse
Post your issue in Triangle Away thread. Maybe someone could help you
Waw... Back from recovery I got +1. This is not because JB but Sbl.bin updated (download mode in potrait position now). The second boot loader checkbit RECOVERY partition:
Code:
Secondary Bootloader v3.1 version.
Copyright (C) 2011 System S/W Group. Samsung Electronics Co., Ltd.
Board: GT-P3100 REV 04-REAL / Sep 17 2012 13:37:57
booting code=0x0
===== PARTITION INFORMATION =====
ID : X-loader (0x1)
DEVICE : MMC
FIRST UNIT : 0
NO. UNITS : 0
=================================
ID : EFS (0x4)
DEVICE : MMC
FIRST UNIT : 8192
NO. UNITS : 40960
=================================
ID : SBL1 (0x2)
DEVICE : MMC
FIRST UNIT : 49152
NO. UNITS : 4096
=================================
ID : SBL2 (0x3)
DEVICE : MMC
FIRST UNIT : 53248
NO. UNITS : 4096
=================================
ID : PARAM (0x5)
DEVICE : MMC
FIRST UNIT : 57344
NO. UNITS : 16384
=================================
ID : KERNEL (0x6)
DEVICE : MMC
FIRST UNIT : 73728
NO. UNITS : 16384
=================================
ID : RECOVERY (0x7)
DEVICE : MMC
FIRST UNIT : 90112
NO. UNITS : 16384
=================================
ID : CACHE (0x8)
DEVICE : MMC
FIRST UNIT : 106496
NO. UNITS : 1433600
=================================
ID : MODEM (0x9)
DEVICE : MMC
FIRST UNIT : 1540096
NO. UNITS : 40960
=================================
ID : FACTORYFS (0xa)
DEVICE : MMC
FIRST UNIT : 1581056
NO. UNITS : 2867200
=================================
ID : DATAFS (0xb)
DEVICE : MMC
FIRST UNIT : 4448256
NO. UNITS : 25280478
=================================
ID : HIDDEN (0xd)
DEVICE : MMC
FIRST UNIT : 29728734
NO. UNITS : 1048576
=================================
ID : GANG (0x0)
DEVICE : MMC
FIRST UNIT : 0
NO. UNITS : 0
=================================
loke_init: j4fs_open..success
<start_checksum:310>CHECKSUM_HEADER_SECTOR :42
<start_checksum:313>offset:42, size:1024
Not Need Movinand Checksum
load_lfs_parameters valid magic code and version.
switch_sel_str='1'
switch_sel_int='1'
load_debug_level: read debug level successfully(0x574f4c44)...LOW
init_ddi_data: usable ddi data.
Set charging current TA
omap_max17042_read_temp: FG Temp raw_data : 0x2723
read_temp_adc:adc_data : 772
read_temp_adc:adc_data : 763
read_temp_adc:adc_data : 765
read_temp_adc:adc_data : 759
read_temp_adc:adc_data : 758
check_battery_type: fg temp : 39136, adc_temp : 420
check_battery_type: Set BATTERY_TYPE_SDI
omap_max17042_set_model_data : Already fuel gauge initialized !!
max17042_compensate_soc: vcell(3840), rep_soc(43)
calculate_table_soc: charging status : 2, vcell(3840), table_soc(52)
[SBL] VFOCV MSB : 0xc0, LSB : 0x7
[SBL_CHARGER] SOC : 43, VCELL : 3840, VFSOC : 42, VFOCV : 3840
save param.blk, size: 5268
save param.blk successfully.
save switch_sel(1)...ok
reading nps status file is successfully!.
nps status=0x504d4f43
g_nRebootReason = 0x1
set_lcd_panel_id: panel_adc=142
*** ltn070nl01_power_on ***
lcd_pannel_id=2
Autoboot (1 seconds) in progress, press any key to stop .
boot_kernel: debug level low!
checkbit: find RECOVERY
checkbit (f55f0aa0)
Kernel @ 81808000 (0x3f715c bytes)
Ramdisk @ 82800000 (0x880aa bytes)
Starting kernel at 0x81808000...
Now I need Sbl.bin backup from ICS!
ketut.kumajaya said:
Waw... Back from recovery I got +1. This is not because JB but Sbl.bin updated (download mode in potrait position now). The second boot loader checkbit RECOVERY partition:
Code:
Secondary Bootloader v3.1 version.
Copyright (C) 2011 System S/W Group. Samsung Electronics Co., Ltd.
Board: GT-P3100 REV 04-REAL / Sep 17 2012 13:37:57
booting code=0x0
===== PARTITION INFORMATION =====
ID : X-loader (0x1)
DEVICE : MMC
FIRST UNIT : 0
NO. UNITS : 0
=================================
ID : EFS (0x4)
DEVICE : MMC
FIRST UNIT : 8192
NO. UNITS : 40960
=================================
ID : SBL1 (0x2)
DEVICE : MMC
FIRST UNIT : 49152
NO. UNITS : 4096
=================================
ID : SBL2 (0x3)
DEVICE : MMC
FIRST UNIT : 53248
NO. UNITS : 4096
=================================
ID : PARAM (0x5)
DEVICE : MMC
FIRST UNIT : 57344
NO. UNITS : 16384
=================================
ID : KERNEL (0x6)
DEVICE : MMC
FIRST UNIT : 73728
NO. UNITS : 16384
=================================
ID : RECOVERY (0x7)
DEVICE : MMC
FIRST UNIT : 90112
NO. UNITS : 16384
=================================
ID : CACHE (0x8)
DEVICE : MMC
FIRST UNIT : 106496
NO. UNITS : 1433600
=================================
ID : MODEM (0x9)
DEVICE : MMC
FIRST UNIT : 1540096
NO. UNITS : 40960
=================================
ID : FACTORYFS (0xa)
DEVICE : MMC
FIRST UNIT : 1581056
NO. UNITS : 2867200
=================================
ID : DATAFS (0xb)
DEVICE : MMC
FIRST UNIT : 4448256
NO. UNITS : 25280478
=================================
ID : HIDDEN (0xd)
DEVICE : MMC
FIRST UNIT : 29728734
NO. UNITS : 1048576
=================================
ID : GANG (0x0)
DEVICE : MMC
FIRST UNIT : 0
NO. UNITS : 0
=================================
loke_init: j4fs_open..success
<start_checksum:310>CHECKSUM_HEADER_SECTOR :42
<start_checksum:313>offset:42, size:1024
Not Need Movinand Checksum
load_lfs_parameters valid magic code and version.
switch_sel_str='1'
switch_sel_int='1'
load_debug_level: read debug level successfully(0x574f4c44)...LOW
init_ddi_data: usable ddi data.
Set charging current TA
omap_max17042_read_temp: FG Temp raw_data : 0x2723
read_temp_adc:adc_data : 772
read_temp_adc:adc_data : 763
read_temp_adc:adc_data : 765
read_temp_adc:adc_data : 759
read_temp_adc:adc_data : 758
check_battery_type: fg temp : 39136, adc_temp : 420
check_battery_type: Set BATTERY_TYPE_SDI
omap_max17042_set_model_data : Already fuel gauge initialized !!
max17042_compensate_soc: vcell(3840), rep_soc(43)
calculate_table_soc: charging status : 2, vcell(3840), table_soc(52)
[SBL] VFOCV MSB : 0xc0, LSB : 0x7
[SBL_CHARGER] SOC : 43, VCELL : 3840, VFSOC : 42, VFOCV : 3840
save param.blk, size: 5268
save param.blk successfully.
save switch_sel(1)...ok
reading nps status file is successfully!.
nps status=0x504d4f43
g_nRebootReason = 0x1
set_lcd_panel_id: panel_adc=142
*** ltn070nl01_power_on ***
lcd_pannel_id=2
Autoboot (1 seconds) in progress, press any key to stop .
boot_kernel: debug level low!
checkbit: find RECOVERY
checkbit (f55f0aa0)
Kernel @ 81808000 (0x3f715c bytes)
Ramdisk @ 82800000 (0x880aa bytes)
Starting kernel at 0x81808000...
Now I need Sbl.bin backup from ICS!
Click to expand...
Click to collapse
How will i get this sbl.bin file from?
Aditya16 said:
How will i get this sbl.bin file from?
Click to expand...
Click to collapse
From /dev/block/mmcblk0p2 and /dev/block/mmcblk0p3. Be careful, this is a critical part of boot process.
I really do not not know how to do it advice please?
Sent from my GT-P3100 using XDA Premium HD app
News update guy's. Chainfire pm'ed me saying that he will look into the matter. Now all we can do is cross our finger and wait.
Oh and also this download mode does not show +1 when I replaced CWM with stock recovery. I wonder why?
Sent from my GT-P3100 using XDA Premium HD app
UPDATE:
No warning when boot to stock JB XXCLI5 recovery:
Code:
g_nRebootReason = 0x2
set_lcd_panel_id: panel_adc=143
*** ltn070nl01_power_on ***
lcd_pannel_id=2
Autoboot (1 seconds) in progress, press any key to stop .
boot_kernel: debug level low!
checkbit: find RECOVERY
checkbit (f55f0aa0)
Kernel @ 81808000 (0x3f715c bytes)
Ramdisk @ 82800000 (0x135b4d bytes)
save param.blk, size: 5268
save param.blk successfully.
save switch_sel(1)...ok
Starting kernel at 0x81808000...
More investigation needed, when boot to unofficial recovery:
Code:
g_nRebootReason = 0x2
set_lcd_panel_id: panel_adc=143
*** ltn070nl01_power_on ***
lcd_pannel_id=2
Autoboot (1 seconds) in progress, press any key to stop .
boot_kernel: debug level low!
checkbit: find RECOVERY
checkbit (f55f0aa0)
Kernel @ 81808000 (0x39a7b0 bytes)
Ramdisk @ 82800000 (0x1e4fc6 bytes)
[WARNING] Current kernel is NOT official binary!!!
save param.blk, size: 5268
save param.blk successfully.
save switch_sel(1)...ok
Starting kernel at 0x81808000...
Normal boot to stock JB XXCLI5 kernel:
Code:
g_nRebootReason = 0x1
set_lcd_panel_id: panel_adc=142
*** ltn070nl01_power_on ***
lcd_pannel_id=2
Autoboot (1 seconds) in progress, press any key to stop .
boot_kernel: debug level low!
checkbit: find RECOVERY
checkbit (f55f0aa0)
Kernel @ 81808000 (0x3f715c bytes)
Ramdisk @ 82800000 (0x880aa bytes)
Starting kernel at 0x81808000...
Parsed above value from /proc/last_kmsg. From last_kmsg value (second boot loader message?), I can confirm my boot logo hack is safe. Sbl successfuly mount param.lfs:
Code:
loke_init: j4fs_open..success
<start_checksum:310>CHECKSUM_HEADER_SECTOR :42
<start_checksum:313>offset:42, size:1024
Not Need Movinand Checksum
load_lfs_parameters valid magic code and version.

[GUIDE] Build AOSP for zerofltexx by Astrubale

DELETED
but there is some aosp build usable ( incall micro working on fine ) for galaxy s 6?
thanks for the guide Master
supera3 said:
but there is some aosp build usable ( incall micro working on fine ) for galaxy s 6?
thanks for the guide Master
Click to expand...
Click to collapse
Depend on what source zero-common, zerofltexx and kernel are based.
Very cool guide, I'll have to give this a shot later just for fun! Sorry for doubting you before.
If there are new commits, before ". build/envsetup.sh" tipe "repo sync" for upgrade.
Hi @Astrubale,
I tried to build cm-13.0 with your tutorial, but build fails non-stop on:
Code:
target SharedLib: libexpat (/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so)
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/lib/xmlparse.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so] Error 1
make: *** Waiting for unfinished jobs....
make[3]: Nothing to be done for 'dtbs'.
or
Code:
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/android_compat_hacks.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so] Error 1
make: *** Waiting for unfinished jobs....
make: Leaving directory '/home/sebek/android/system'
The solution is to remove xmlparse.o or android_compat_hacks.o and I guess it continues the build. Almost at the end of compilation (I presume) it throws out that very error and after a while I get:
Code:
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make[1]: Entering directory '/home/sebek/android/system/kernel/samsung/exynos7420'
INSTALL net/ipv4/tcp_htcp.ko
INSTALL net/ipv4/tcp_westwood.ko
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
DEPMOD 3.10.61
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make: Leaving directory '/home/sebek/android/system'
#### make failed to build some targets (26:29 (mm:ss)) ####
Maybe you'd be willing to give me some advice on how I could finish this build ? I am building on Ubuntu 16.04, dl'd the newest kernel from Brandon's git repo.
My best
djseban2 said:
Hi @Astrubale,
I tried to build cm-13.0 with your tutorial, but build fails non-stop on:
Code:
target SharedLib: libexpat (/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so)
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/lib/xmlparse.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so] Error 1
make: *** Waiting for unfinished jobs....
make[3]: Nothing to be done for 'dtbs'.
or
Code:
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/android_compat_hacks.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so] Error 1
make: *** Waiting for unfinished jobs....
make: Leaving directory '/home/sebek/android/system'
The solution is to remove xmlparse.o or android_compat_hacks.o and I guess it continues the build. Almost at the end of compilation (I presume) it throws out that very error and after a while I get:
Code:
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make[1]: Entering directory '/home/sebek/android/system/kernel/samsung/exynos7420'
INSTALL net/ipv4/tcp_htcp.ko
INSTALL net/ipv4/tcp_westwood.ko
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
DEPMOD 3.10.61
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make: Leaving directory '/home/sebek/android/system'
#### make failed to build some targets (26:29 (mm:ss)) ####
Maybe you'd be willing to give me some advice on how I could finish this build ? I am building on Ubuntu 16.04, dl'd the newest kernel from Brandon's git repo.
My best
Click to expand...
Click to collapse
Can you send me a screen of /android/system/kernel/samsung/exynos7420/ ?
Astrubale said:
Can you send me a screen of /android/system/kernel/samsung/exynos7420/ ?
Click to expand...
Click to collapse
Sure, it looks like this:
hxxp://imgur.com/M5sAjIo
@edit: I deleted exynos7420 dir and unzipped it (dl'd zip from github) once again, this time through Terminal. Turned out it was something wrong with that, therefore I succeded with building the ROM, but my S6 hangs on "Kernel is not seandroid enforcing", after flashing the ROM (tough luck, I guess). What's more I tried flahyboy's ROM, to see if it's maybe something wrong with my S6 - well, you can say flahyboy's ROM starts instantly, but in-call mic is not working. I'd be grateful for any hints on what might be wrong. One and only thing I noticed is flahyboy's ROM is slightly greater in size (~40MB) that mine.. maybe the build solution did not add something to my zip.. Anyway - great tutorial, thanks for that. Installing AOSP just made me even more anxious to wait for making this system stable :good:
djseban2 said:
Sure, it looks like this:
hxxp://imgur.com/M5sAjIo
@edit: I deleted exynos7420 dir and unzipped it (dl'd zip from github) once again, this time through Terminal. Turned out it was something wrong with that, therefore I succeded with building the ROM, but my S6 hangs on "Kernel is not seandroid enforcing", after flashing the ROM (tough luck, I guess). What's more I tried flahyboy's ROM, to see if it's maybe something wrong with my S6 - well, you can say flahyboy's ROM starts instantly, but in-call mic is not working. I'd be grateful for any hints on what might be wrong. One and only thing I noticed is flahyboy's ROM is slightly greater in size (~40MB) that mine.. maybe the build solution did not add something to my zip.. Anyway - great tutorial, thanks for that. Installing AOSP just made me even more anxious to wait for making this system stable :good:
Click to expand...
Click to collapse
Thank, but can you compile now?
Astrubale said:
Thank, but can you compile now?
Click to expand...
Click to collapse
Yeah, I compiled it at last, but if i flash the zip from out folder, then the phone hangs on first bootsplash ("Galaxy S6") with "Kernel is not seandroid enforcing"
djseban2 said:
Yeah, I compiled it at last, but if i flash the zip from out folder, then the phone hangs on first bootsplash ("Galaxy S6") with "Kernel is not seandroid enforcing"
Click to expand...
Click to collapse
Search for errors inside /proc/last_kmsg
Wow cool clean and easy Guide. Thanks for this.
Weil try myself on that.
Astrubale said:
Search for errors inside /proc/last_kmsg
Click to expand...
Click to collapse
Code:
Samsung S-Boot 4.0 for SM-G920F (Apr 22 2016 - 16:59:51)
EXYNOS7420 EVT 1.3 (Base on ARM CortexA53)
3048MB / 0MB / Rev 11 / G920FXXU3DPDP / (PKG_ID 0x0) / LOT_ID N3N1P / RST_STAT (0x10000)
__if_pmic_rev_init - MUIC API is not ready!
MON: 0x8(1)
MON[0] = (1)[0x1c, 0x7a]
MON[1] = (2)[0x1a, 0x56]
MON[2] = (3)[0x1a, 0x3d]
MON[3] = (4)[0x1c, 0x4e]
MON[4] = (5)[0x1a, 0x39]
MON[5] = (6)[0x1a, 0x30]
MON[6] = (7)[0x15, 0x44]
MON[7] = (0)[0x0c, 0x07]
pmic_asv_init
(ASV_TBL_BASE+0x00)[11:0] bigcpu_asv_group = 2184
(ASV_TBL_BASE+0x00)[15:12] bigcpu_ssa0 = 0
(ASV_TBL_BASE+0x00)[27:16] littlecpu_asv_group = 2457
(ASV_TBL_BASE+0x00)[31:28] littlecpu_ssa0 = 0
(ASV_TBL_BASE+0x04)[11:0] g3d_asv_group = 2184
(ASV_TBL_BASE+0x04)[15:12] g3d_ssa0 = 0
(ASV_TBL_BASE+0x04)[27:16] mif_asv_group = 2184
(ASV_TBL_BASE+0x04)[31:28] mif_ssa0 = 0
(ASV_TBL_BASE+0x08)[11:0] int_asv_group = 3276
(ASV_TBL_BASE+0x08)[15:12] int_ssa0 = 6
(ASV_TBL_BASE+0x08)[27:16] cam_disp_asv_group = 2184
(ASV_TBL_BASE+0x08)[31:28] cam_disp_ssa0 = 0
(ASV_TBL_BASE+0x0C)[3:0] dvfs_asv_table_version = 15
(ASV_TBL_BASE+0x0C)[4] asv_group_type = 0
(ASV_TBL_BASE+0x0C)[7:5] reserved01 = 0
(ASV_TBL_BASE+0x0C)[8] shift_type = 0
(ASV_TBL_BASE+0x0C)[9] ssa1_enable = 0
(ASV_TBL_BASE+0x0C)[10] ssa0_enable = 1
(ASV_TBL_BASE+0x0C)[15:11] reserved02 = 0
(ASV_TBL_BASE+0x0C)[16] asv_method = 1
(ASV_TBL_BASE+0x0C)[31:17] reserved03 = 0
(ASV_TBL_BASE+0x10)[3:0] main_asv_group = 0
(ASV_TBL_BASE+0x10)[7:4] main_asv_ssa = 0
(ASV_TBL_BASE+0x10)[11:8] bigcpu_ssa1 = 0
(ASV_TBL_BASE+0x10)[15:12] littlecpu_ssa1 = 0
(ASV_TBL_BASE+0x10)[19:16] g3d_ssa1 = 0
(ASV_TBL_BASE+0x10)[23:20] mif_ssa1 = 0
(ASV_TBL_BASE+0x10)[27:24] int_ssa1 = 0
(ASV_TBL_BASE+0x10)[31:28] cam_disp_ssa1 = 0
(ASV_TBL_BASE+0x14)[8:0] bigcpu_ssa_ema = 0
(ASV_TBL_BASE+0x14)[17:9] littlecpu_ssa_ema = 0
(ASV_TBL_BASE+0x14)[26:18] g3d_ssa_ema = 0
(ASV_TBL_BASE+0x14)[31:27] reserved04 = 0
chip_status = f, bin2_efuse = 0
muic_register_max77843_apis
muic_is_max77843 chip_id:0x43 muic_id:0xb5 -> matched.
MUIC rev = MAX77843(181)
init_multi_microusb_ic Active MUIC 0xb5
max77843_init_microusb_ic: MUIC: CDETCTRL:0x2d
max77843_init_microusb_ic: MUIC: CONTROL1:0x00
max77843_init_microusb_ic: MUIC: CONTROL2:0x3b
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
load Secure Payload done.
Chip ID : 060f4d16dd28 / 0x00007700
EL3 monitor information => Built : 16:48:28, Jan 18 2016
bConfigDescrLock: 1
sw_lock success
sw_lock success
sw_lock success
SCSI CMD : 55 11 00 00 00 00 00 00 14 00
SCSI Response(01) : Target Failure
SCSI Status(02) : max77843_set_muic_uart_early: MUIC: CONTROL1: 0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
[Debug Info.]
S-BOOT : VERSION_-+F0
SecureOS : 20 (MB)
- read_bl1
blk_bread_bootsector: LUN 1, from 0x0, size 0x10, buffer 0x45708000
Verify_Binary_Signature 0x45720120 [email protected], [email protected]
pit_check_signature (PIT) valid.
PARAM ENV VERSION: v1.0..
blk_bread_bootsector: LUN 1, from 0xffe, size 0x1, buffer 0x441204c0
initialize_ddi_data: usable! (3:0xf), warranty reason : (0x0303)
MAGIC_RAM_BASE: 4000000, MAGIC_RAM_BASE2: 100001, ompin: 2000a
[ldfw] Pass LDFW partition!
[ldfw] read whole CM partition from the storage
ldfw: 0th ldfw's version 0x20151027 name : CryptoManagerV20
ldfw: 1th ldfw's version 0x20151203 name : fmp_fw
ldfw: init ldfw(s). whole ldfws size 0x204110
[ldfw] try to init 2 ldfw(s). except 0 ldfw 2 ldfw(s) have been inited done.
[mobi_drv] add: 0x43e71940, size: 11401
MobiCore IDLE flag = 0
MobiCore Driver loaded and RTM IDLE!
[OTP] 27 bit read: 0x5
[OTP] 22 bit read: 0x0
[OTP] 21 bit read: 0x0
[OTP] 23 bit read: 0x1
[OTP] 26 bit read: 0x1
[OTP] NANTIRBK0 bit reading: start
[OTP] NANTIRBK0: 3 bit
[OTP] 28 bit read: 0x1
[OTP] 29 bit read: 0x0
[OTP] 30 bit read: 0x1
[OTP] 25 bit read: 0x1
[OTP] ETC value: 0
[EFUSE] SMC Read the 0x0 ...
[EFUSE] SMC Read Count value: 3
[EFUSE] SMC Read the 0x1 ...
[EFUSE] SMC Read Count value: 1
[EFUSE] SMC Read the 0x2 ...
[EFUSE] SMC Read Count value: 0
[EFUSE] SMC Read the 0x3 ...
[EFUSE] SMC Read Count value: 1
(1,5) vs (1,5)
[EFUSE] This is commercial device.
set_tzpc_secureport: successfully protected 0
eSE Protection!!
Authenticated data read request (Swapped)
Authenticated data read response (Swapped)
RPMB: get hmac value: success
HMAC compare success !!
update_rpmb_version skip.
initialize_secdata_rpmb: usable! (0x52504d42)
DDR SIZE: 3G (0xc0000000)
LPDDR4 manufacturer : Micron
bin2_efuse = 0
[TMU] 52, 53, 51, 51
UFS vendor: SAMSUNG
FW rev : 0200
product : KLUBG4G1BD-E0B1
UFS size (GB) : 32
UFS ID : XXXXXXXXXXXXXXXX
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
dNumAllocUnits error at LU7 0 0
PROVISION : FAIL
PROVISION : FAIL
max77843_muic_api_print_init_regs: INTMASK[1:0x00, 2:0x00, 3:0x00]
max77843_muic_api_print_init_regs: MUIC: CDETCTRL:0x2d
max77843_muic_api_print_init_regs: MUIC: CONTROL1:0x00
max77843_muic_api_print_init_regs: MUIC: CONTROL2:0x3b
max77843_muic_api_print_init_regs: MUIC: CONTROL3:0x00
max77843_muic_api_print_init_regs: MUIC: CONTROL4[0x16]:0xb2
init_ific : MAX77843(0)
init_ific : MAX77843(0)
set_float_voltage: max77843 battery cv voltage 0x9c
set_charger_state: buck(1), chg(1), reg(0x05)
max77843_get_charger_status: Invalid charger
set_auto_current: get_charger_status(0)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_auto_current: unknown_state, curr(475)
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_charger_current: chg curr(137), in curr(0)
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
fuelguage : wpc_status(0)
set_charger_state: buck(1), chg(0), reg(0x04)
init_fuel_gauge: Start!!
init_fuel_gauge : MAX77843(0)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
adc_read_temp temp_adc = 1852
init_fuel_gauge temp = 25
init_fuel_gauge : MAX77843(0)
init_fuel_gauge: Battery type : SDI, capacity: 5177, status: 128
init_fuel_gauge: Already initialized (0x1439, SDI type)
check_validation_with_tablesoc: Start!!
fuel_gauge_read_soc: SOC(32), data(0x209a)
fuel_gauge_read_ocv: VFOCV(3774), data(0xbcba)
calculate_table_soc : low(0) high(6) mid(7) table_soc(0)
calculate_table_soc : low(4) high(6) mid(3) table_soc(0)
calculate_table_soc : low(6) high(6) mid(5) table_soc(0)
calculate_table_soc : low(7) high(6) mid(6) table_soc(0)
calculate_table_soc: vcell [3774] table_soc [31]
differ(1), table_soc(31), RepSOC(32)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
fuel_gauge_read_vcell: VCELL(3716), data(0xb9d8)
vcell(3716),soc_diff_limit(50), low_temp_reset(0)
fuel_gauge_read_ocv: VFOCV(3774), data(0xbcba)
fuel_gauge_read_vcell: VCELL(3716), data(0xb9d8)
fuel_gauge_read_soc: SOC(32), data(0x209a)
fuel_gauge_read_vfsoc: VFSOC(30), data(0x1ef3)
init_fuel_gauge : OCV(3774), VCELL(3716), SOC(32), VFSOC(30)
AP_PMIC_SDA = 1
PMIC_ID = 0x12
OTP:0x78 PWR_SEQ:1 G3D_OCP:1 PSoff:1 INT_Volt:1
PMIC_STATUS1 = 0x2f PWRON JIGONB ACOKB MR2B PWRON1S
PMIC_STATUS2 = 0x11 RTC60SE RTC1SE
PMIC_PWRONSRC = 0x08 MRST
PMIC_OFFSRC = 0x00
PMIC_INT1 = 0xc3 PWRONF PWRONR PWRON1S MRB
PMIC_INT2 = 0x11 RTC60S RTC1S
PMIC_INT3 = 0x80 RSVD
PMIC_RTC_CTRL = 0x02
PMIC_RTC_SMPL = 0x83
RTC TIME: 2016-08-13 07:27:29(0x40)AM
s5p_check_keypad: 0x10110000
s5p_check_keypad: recovery mode
set_oneshot_recovery: recovery mode set! sys_bootm=0x80000
s5p_check_reboot_mode: INFORM3 = 0 ... skip
ATLAS_PLL = 1200MHz APOLLO_PLL = 1200MHz MIF_PLL = 3104MHz
MFC_PLL = 468MHz CCI_PLL = 532MHz
BUS0_PLL = 1600MHz BUS1_PLL = 668MHz
board_uart_rustproof ifc_sense: 0
-user build & not FAC
-rustproof mode Enabled
s5p_check_upload: MAGIC(0x4000000), RST_STAT(0x10000)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
s5p_check_upload: debug level is LO! (mask: 0x220)
max77843_ific_set_mrstb: TOPSYS: MAINCTRL1[0x02]: [0x07]+[0x07]->[0x07]
s5p_check_upload: disable dump_gpr
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
s5p_check_download: 0
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
check_pm_status: charger is not detected
fuel_gauge_read_vcell: VCELL(3718), data(0xb9ea)
check_pm_status: voltage(3718) is ok
check_pm_status: 7 sec reset, continue.
scr_draw_image: draw 'logo.jpg'...
read 'logo.jpg'(112504) completed.
board_set_dev_pm: s2mpb02 enable for display
42, 0, 13, 0x420013
DETECTED LCD TYPE : S6E3HA2
mipi-dsi driver(CMD mode) has been probed.
decon-int: ver0, max win7, command mode, hw trigger
single dsi mode
decon0 registered successfully
afw flag is Unknown [afw flag : 00 00 00 00]
secure info base: 45720000 and SMC Num = 0x83000013
secure smc success!!! [ret = 0]
Set debug level to low(4f4c)
DMV: Successfully informed TZ of boot mode: Recovery
load_kernel: loading boot image from 139264..
kernel size = 0x114f000, ramdisk size = 0x5fc000
dt_size:1454080, dt_actual:1454080
Verify_Binary_Signature 0x45720120 [email protected], [email protected]
Kernel Image
Verify_Binary_Signature: failed.(-18022398)
pit_check_signature (RECOVERY) invalid.
[TIMA trusted boot]: SEANDROID ENFORCING
Set invalid sign flag
No need to update kernel type.
[EFUSE] warranty bit is already set.
ace_hash_sha_digest: passed.(0)
tboot ctx base: 45720248
SMC Num = 0x83000001
mobismc success!!! [ret = 0]
SMC Num = 0x83000007
mobismc for tima info success!!! [ret = 0]
Pass. DTBH size is smaller than a page.
<dtbh_header Info>
magic:0x48425444, version:0x00000002, num_entries:0x00000008
<device info>
chip_id: 0x00001cfc
platform_id: 0x000050a6
subtype_id: 0x217584da
hw_rev: 0x0000000b
dt_entry[06]
chip_id: 0x00001cfc
platform_id: 0x000050a6
subtype_id: 0x217584da
hw_rev: 0x0000000a
hw_rev_end: 0x0000000b
offset: 0x0010a000
dtb size: 0x0002c800
Selected entry hw_ver : 11
dt_entry of hw_rev 10 is loaded at 0x4a000000.(182272 Bytes)
[EFUSE] RB count: device(0x3), binary(0x3)
[OTP] SW LOCK Success
DDI value :0x0000000f
sw_lock success
sw_lock success
Forced Enable KAP
Warranty Bit Set - Blowing KAP_VIOLATION_FUSE
KAP status = 5afe0003
ATAG_CORE: 5 54410001 0 0 0
ATAG_MEM: 4 54410002 20000000 40000000
ATAG_MEM: 4 54410002 20000000 60000000
ATAG_MEM: 4 54410002 20000000 80000000
ATAG_MEM: 4 54410002 20000000 A0000000
ATAG_MEM: 4 54410002 20000000 C0000000
ATAG_MEM: 4 54410002 1E800000 E0000000
ATAG_SERIAL: 4 54410006 XXXXXXXX XXXXXXXX
ATAG_INITRD2: 4 54420005 43000000 5fbd8f
ATAG_REVISION: 3 54410007 b
check_rustproof [0,0] On
ucs flag is Unknown
ucs flag : 00 00 00 00
ATAG_CMDLINE: f0 54410009 'console=ram loglevel=4 bootmode=2 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.hardware=samsungexynos7420 androidboot.debug_level=0x4f4c ess_setup=0x46000000 [email protected] [email protected] charging_mode=0x3000 s3cfb.bootloaderfb=0xe2a00000 sysscope=0x6b090719 lcdtype=4325395 consoleblank=0 lpj=239616 sec_debug.reset_reason=5 ehci_hcd.park=3 oops=panic pmic_info=35 cordon=c34c0eba5576148dc662cf43a6352c3b connie=SM-G920F_OPEN_EUR_c3811d70601ea690b7b0b2afca80be2c fg_reset=0 androidboot.emmc_checksum=3 androidboot.boot_salescode= androidboot.odin_download=1 androidboot.bootloader=G920FXXU3DPDP androidboot.selinux=enforcing androidboot.security_mode=1526595585 androidboot.ucs_mode=0 androidboot.hw_rev=11 androidboot.warranty_bit=1 androidboot.hmac_mismatch=0 androidboot.sec_atd.tty=/dev/ttySAC1 androidboot.serialno=XXXXXXXXXXXXXXXX snd_soc_core.pmdown_time=1000 zero_sdchg_ic=0 androidboot.fmp_config=0'
ATAG_NONE: 0 0
pack_atags: ramdisk size start 0x43000000, size 0x5fbd8f
Updating device tree @0x4a000000: done
Starting kernel at 0x40205000...
SWITCH_SEL(3)
BOOTING TIME : 2895
Here it is, mate. I can't seem to find anything suspicious besides
Code:
dNumAllocUnits error at LU7 0 0
PROVISION : FAIL
PROVISION : FAIL
but I can only guess
Hi I am having problems compiling due to the kernel. Which kernel source should I use? How should I configure it? Help pleaase
Added "extract files" guide.
Whenever I try to download the CyanogenMod repo, I get this error:
error: Exited sync due to fetch errors
I've tried using: repo sync -f and: repo sync --force-sync
I'm trying to download the CM13 repo.
I've also followed the steps exactly as they were written.
I'm trying to build cm-14.0. Fails at
HTML:
Starting build with ninja
ninja: Entering directory `.'
ninja: error: '/home/julian/android/system/out/target/product/zerofltexx/obj_arm/SHARED_LIBRARIES/libsecril-client_intermediates/export_includes', needed by '/home/julian/android/system/out/target/product/zerofltexx/obj_arm/SHARED_LIBRARIES/audio.primary.universal7420_intermediates/import_includes', missing and no known rule to make it
build/core/ninja.mk:151: recipe for target 'ninja_wrapper' failed
make: *** [ninja_wrapper] Error 1
make: Leaving directory '/home/julian/android/system'
.
Any ideas what could be wrong?
/android/system/kernel/samsung/exynos7420 contains github.com/CyanogenMod/android_kernel_samsung_exynos7420 cm-14.0.
Thanks for the great guide anyway

Categories

Resources