Looking for documentation about Qualcomm bootloader/download mode - Android Software/Hacking General [Developers Only]

I own an LG Optimus Elite phone, which is based around the qualcomm msm7k. This phone, like many other qualcomm devices, has a Download mode you can enter where you can send commands over USB and send commands to the phone for reading/writing RAM and ROM and stuff like this. After some messing around, I found the second stage bootloader (osbl.mbn) on the second partition of the phone. I reverse engineered some stuff and got the bootloader loaded up in ida and a good bit of it figured out, including where the implement the download mode.
I already wrote some code that can talk to the download mode, and I can send commands and receive the replies, and I have already made myself a list of all the supported commands and subcommands and started documenting what they do. I also found the implementation for some of their crypto stuff and some hardcoded keys/hashes. What I'm looking for now is some sort of documentation about the bootloader and/or the download mode. It would be really awesome if somebody could point me to some documentation about what sort of things you can do with this one, or similar bootloaders. Some of the commands look like they are for writing to the internal rom, and I would like to avoid messing with those that might brick my phone if used wrong. And any documentation about the logic for the booting process would really help. I see code here for booting secure elfs and stuff like that that will take a bit of effort to reverse.

gianptune said:
I own an LG Optimus Elite phone, which is based around the qualcomm msm7k. This phone, like many other qualcomm devices, has a Download mode you can enter where you can send commands over USB and send commands to the phone for reading/writing RAM and ROM and stuff like this. After some messing around, I found the second stage bootloader (osbl.mbn) on the second partition of the phone. I reverse engineered some stuff and got the bootloader loaded up in ida and a good bit of it figured out, including where the implement the download mode.
I already wrote some code that can talk to the download mode, and I can send commands and receive the replies, and I have already made myself a list of all the supported commands and subcommands and started documenting what they do. I also found the implementation for some of their crypto stuff and some hardcoded keys/hashes. What I'm looking for now is some sort of documentation about the bootloader and/or the download mode. It would be really awesome if somebody could point me to some documentation about what sort of things you can do with this one, or similar bootloaders. Some of the commands look like they are for writing to the internal rom, and I would like to avoid messing with those that might brick my phone if used wrong. And any documentation about the logic for the booting process would really help. I see code here for booting secure elfs and stuff like that that will take a bit of effort to reverse.
Click to expand...
Click to collapse
i am interested to in this subject
i am trying to do the same thing but i lack the experience.
i have a tablet that has an msm8255 which is made in china, in europe it is sold without the phone capabilities, in rusia there is the same tablet that has the phone capabilities, i flashed the firmware from the rusian tablet, but still, no phone function, so i think i need some ideas on how to download some stuff from the rusian model and flash`it on the european version.
i will do some reasearch at the uni because i have acces to more academical resources.

Are you the same guy from the Wii scene? Anyway I don't know much to help you myself, but you may want to check out revolutionary.io and unlimited.io. they have hacked bootloaders on phones

Related

Which ROM, if at all, is this hybrid?

I live in Korea and have a nice little Samsung.
It's a Samsung SCH-M450 or also called AnycallFX. I have stripped out all the Korean MUI stuff and am currently trying to get an English version of "MITS", a proprietary application loader that also runs on Blackjacks.
The best English info I can find on it is the following...
http://www.mobileisgood.com/phone_spec.php?phone_id=492&manufacturer_id=45
I am wondering how to ID this and possibly play around with the ROM.
First and foremost I would like to make a dump so I can keep it working in case of errors. I have some update programs from Samsung that ship with the phone for writing to it when they release updates but I don't know if there are plans for any in the future.
Could someone ID what device it falls under or help me figure out how to get info from the phone? Does someone know of a utility that will allow me to get version numbers, hardware IDs, etc?
"ID what device it falls under"
if you mean who makes it then samsung make their own devices they dont oem from htc or others
Thanks very much. I have been picking away at this phone piece by piece with registry edits, testing apps, etc trying to get it the way I want it. Thought maybe some of the content in here might speed the process up.

GUIDE: In the beginning... There was ROOT

So you’ve got a nice, shiny, new G1 and you’ve been hearing about all the amazing things you can do with it but you “MUST HAVE ROOT”. As far as you know, you’re not a plant (although you may feel as smart as one at this point) and beyond that, you have no clue what any of the terms or concepts mean in context.
Well, I’m bored so I’m going to try and clear some things up.
There are a lot of threads that cover each of these things but I’m going to try and put as many basics into one post as possible. Hopefully it can be a perfect start for n00bs and good reference in lieu of search for others. Please feel free to correct any semantic (or blatant) mistakes I make.
I’ll keep the glossary here and update terms as I add to this post:
Android OS - Like Windows Mobile but based on Linux, using a Java based front end.
Linux - Open Source operating system used instead of Windows XP/Vista, Mac OSX etc... it's free (as in beer).
Open Source (From Wiki) – Free and open source software, also F/OSS, FOSS, or FLOSS (free/libre/open source software) is software which is liberally licensed to grant the right of users to study, change, and improve its design through the availability of its source code.
Root (as in access)- root is like the administrator account on a windows machine (also referred to as su, or superuser). It allows you to have complete access to the underlying OS of a linux or *nix based machine. For the G1, it allows for the use of themes, native backup functionality, manually selecting which apps can utilize root access, auto-rotate screen, multi-touch in browser, moving applications/caches to the sd card etc...
Root (as in location)- the 'root' of a folder or drive is the top most area of that location. In windows, C:\ is the 'root' of your hard drive. The 'root' of your SD card just means you haven't moved into any subfolders.
Shell – (also heard as terminal, bash, command line) This is a loose definition, but it’s basically a command line to run specific actions against the OS.
Bootloader – the SPL and IPL of a flash based device. See jashu’s description here.
SPL (Secondary Program Loader) - You get to the SPL by holding the camera button while powering on your phone. This is where you flash NBH images. See bootloader above.
Recovery Mode - Holding the 'Home' key while while powering on the G1 will take you into Recovery Mode. From here you can perform a NANDroid backup, wipe your phone, access a command line and of course, flash your phone with an update.zip file.
RC## (or release candidate) – In context to the G1, it is an official release of Android from T-Mobile meant specifically for the G1 (not ADP).
ADP (Android Developer Phone) – A Google specific (or carrier non-specific) version of the G1/Dream that has root access by default and is meant for developers writing apps for the G1, or Android in general.
ADP vs. RC## - Neither RC’s or ADP versions are tied to their respective hardware. With the right bootloader, you can flash an ADP image to a G1 or an RC image to an ADP.
JFV1.## - Is a specific Version of a JesusFreke ROM. JesusFreke is a developer on this website that has graciously spent his time to modify the G1 OS to allow us to have root access to our phones. This gives us the ability to explore and modify our phones via a command line.
Cupcake – a development branch of the Android OS that contains many improvements that was merged into the master build of Android and is currently being released to new phones as Android 1.5.
Nandroid – a utility, accessible through Recovery Mode, that allows you to backup your phone and restore to the exact condition at backup.
Apps2SD – Applications moved to your SD card instead of internal memory. Some people like the extra room, some people don’t want to hassle with the partitioning.
Partition – just like the partitions that separate cubicles in an office, a partition separates parts of a drive.
File system – there are many. It’s basically a specific way of organizing data on a partition. FAT(32) is generally windows, ext2 is generally linux. This is not a hard and fast rule, just most common in context with what you’ll see here.
Scripts – scripts are text files that contain a list of commands to perform. Instead of typing each command out multiple times, a script can be run that will initiate all steps listed in the script.
Android SDK (System Developer’s Kit) – This includes all tools (sans fastboot) that a developer needs to create applications for the G1. It also has tools for interacting with the phone via a command line (ADB).
ADB - is a part of the SDK that allows you to run commands against the G1 in lieu of using the terminal on the phone itself.
Fastboot - is a tool used to flash system images (.img files) to the G1 from a command line on your pc. IMG files are created when you do NANDroid backups and official images can be downloaded from HTC as well. To get to fastboot mode on your phone, hold the back button while powering on.
When T-Mobile first released the G1, they left a bug in the Android OS that allowed anything typed on the keyboard to be passed on to a root shell running in the background. This really was a major flaw and needed to be patched. Unfortunately, when they patched it, they really patched it. RC29 was the last version that still had root. With all versions RC30 on, it was removed. It completely denied us any hope at modding our “open-source” phone.
Somehow, the base image for RC29 (dreaimg.nbh) was leaked and some enterprising developers were able get access to the bootloader and return an updated G1 (RC30+) to RC29 and use this to regain root.
Somewhere along this road, Google released the ADP (Android Developer Phone), which has root enabled and uses a specific SPL (EngineeringSPL) that was the base for the modified HardSPL that most of us use now. Nandroid was included to allow us to back up our phones and shortly after, JesusFreke modified RC30 to keep root and still provide the fixes and improvements that came with it.
I’m not sure where it all started, but eventually, LucidREM released a modified version of JesusFreke’s ROM. This made moving applications to SD painless and freed up system storage and now we can have 32 flashlights and 62 tip calculators installed all at once.
Apps2sd has been the bane of many peoples existence. It requires you to partition your SD card in to separate file systems (FAT32 to remain compatible with windows computers as a mass storage device and ext2 to maintain compatibility with the underlying linux OS of the G1). It also requires you to move your apps to the SD card and then create symbolic links (similar to a windows shortcut) from the internal location pointing to the SD card. Lots can go wrong in this process and that’s why LucidREM, MartinFick, MarcusMaximus04 and others have created tools to help simplify the process.
Now of course, to achieve any of the things you want to do with the G1, you have to interact with it. There are at least 2 main ways to do this. Some prefer to do everything from the phone itself using a terminal, while some prefer to use their PC with the phone connected via USB. Others avoid both of these, as best they can, and use other peoples apps or scripts anywhere they can get away with it. This is why you may find many different explanations of the same goal.
In order to interact with your phone from a pc, you need the Android SDK, which includes ADB. ADB is basically a linux shell that communicates with the G1. It is easier to copy and paste from threads and insert commands without worrying about making typos. It also requires it’s own bit of hoops to jump through (unless you use a mac or linux ;-)) and sometimes scares people away. It is highly recommended if you plan on hacking at your phone with any regularity.
Of course, there are some sadists (I once was one) that like to type line after line of code on a tiny keyboard and use the terminal directly from the phone. This is fun and it makes you feel 1337, but it also leaves a lot of room for error. Remember, you are a root user now, and any mistake you make can be potentially huge.
Well, that’s all for now folks. Please feel free to add, subtract, reorganize, correct anything I’ve said, in the comments. Also, I’ve tried to add links to any relevant threads and sources that I used in making this… this, whatever you wanna call it.
Thanks to everyone in this community for doing what you do. We are all geeks and enjoy doing this stuff. It's good to have so many talented people taking an interest in Android and the G1 in general. It is open source communites that keep technology interesting and exciting.
Thanks to Haykuro, TheDudeofLife, all the theme devs, and all the big players that I didn't reference in this post. Oh, and SolemWishing for the Timeline! It helped, thanks!
Reserved for future posting
Awesome post for nuubs. This should be permanently stickied!
Very cool. a couple terms you should add:
Fastboot
SPL
Recovery mode
(including what key strokes you need to hit to get into spl and recov. modes)
Thanks for the feedback!
I added SPL and Recovery... let me get my facts straight on fastboot and I'll add that tomorrow.
I don't know if it is the right place for it, but there seem to have been lots of question about "radio" or more specifically "radio update".
I feel smarter already.
I particularly found the file system explanation useful, i put it together that fat32 and the other were the two partitions but didnt realize which was for cpu. Not ready to attempt but definitely closer (although Im not even sure if I want to partition i have no need for all that space at this point) It doesnt affect performance does it?
Agreed. Good stuff. Definitely noob required reading material.
Yes, indeed a very nice guide for the beginners. Hell we ALL started that way...i remember when I first got this phone ~6 months ago (no root), and there was almost nothing about it, no support, no add-ons, no hacks, nothing. It was boring, and for me I was coming from a motorola (motomodders?), so going to something that was far superior but didnt have community support made me almost cry.
Though look now, 3 months later the market was filling up and being abundent of new stuff to play with (I didnt even try rooting for a while, until it became a lot more well-known [fixes and the likes], and themes became a necessity because they started to get really good), and now 6 months later people are hacking away figuring out soo much stuff about it. Amazing work everyone, seriously.
Something good: It all starts at the roots .
Well, I added info on fastboot and exceeded my 10000 character limit. Now I understand why so many people reserve the second post. lol...
I'll make some changes so I can add info about the radio, however the link to fastboot explains the radio fairly well.
Thanks for the feedback everybody, I hope this helps some people out.
skri11a said:
So you’ve got a nice, shiny, new G1 and you’ve been hearing about all the amazing things you can do with it but you “MUST HAVE ROOT”. As far as you know, you’re not a plant (although you may feel as smart as one at this point) and beyond that, you have no clue what any of the terms or concepts mean in context.
Click to expand...
Click to collapse
When i read those lines i knew that this post would be worth reading
It was a really nice n00b guide, though ive done some WiMo flashing so some of the terms sounded familliar i certanly learned a thing or two
I would say it should be stickied and put on the wiki - oh and perhaps list it in alphabetic order, it would make it more usefull as a "I dont understand this term so ill just look it up"-thread...
Perhaps you can get a mod to give you post #2 & #3
//M
DMaverick50 said:
I feel smarter already.
I particularly found the file system explanation useful, i put it together that fat32 and the other were the two partitions but didnt realize which was for cpu. Not ready to attempt but definitely closer (although Im not even sure if I want to partition i have no need for all that space at this point) It doesnt affect performance does it?
Click to expand...
Click to collapse
I'm glad it helped. As far as performance issues, I've had none. In fact, when I was skating along with 12-19MB of free space, my phone would crall and cause me all sorts of grief. Since I've moved the apps and dalvik-cache, it's been very responsive and reliable. That being said, get a GOOD sd card. I see a lot of people having problems using cheap or < class4 sd cards.
m.klinge said:
When i read those lines i knew that this post would be worth reading
It was a really nice n00b guide, though ive done some WiMo flashing so some of the terms sounded familliar i certanly learned a thing or two
I would say it should be stickied and put on the wiki - oh and perhaps list it in alphabetic order, it would make it more usefull as a "I dont understand this term so ill just look it up"-thread...
Perhaps you can get a mod to give you post #2 & #3
//M
Click to expand...
Click to collapse
lol... I'm glad you liked it.
And thanks for the tips. I'm gone for the weekend, but I'll alphabetize it when I get back. Not sure what I can do about getting it stickied but I'll look into the wiki on monday too.
can you add busybox
in the nandroid instructions it requires busybox but I didnt see an explanation for what busybox is. Thanks and this thread has already been very helpful for me
speaking of stickying this....
who is in charge of stickies? A lot of stickable topics aren't stickied and a lot of topics that should be unstickied are still stuck...
DMaverick50 said:
in the nandroid instructions it requires busybox but I didnt see an explanation for what busybox is. Thanks and this thread has already been very helpful for me
Click to expand...
Click to collapse
Hey sorry for the late reply... Been pretty busy since Friday.
I'll try and add this to the first post shortly. I may have to remove some of the history lesson if I can't get a mod to give me the second/third post.
BusyBox - This is a single executable utility that contains many common Linux commands, instead of having an individual executable for each command. As far as I know this is built into all of the JF releases, as well as Dude's. It is also usable in the JF recovery console by hitting alt-x. To use busybox, just type "busybox" in front of the command you want to use (i.e. #busybox ls -L --to get a list of your directory).
AbsoluteDesignz said:
speaking of stickying this....
who is in charge of stickies? A lot of stickable topics aren't stickied and a lot of topics that should be unstickied are still stuck...
Click to expand...
Click to collapse
If you figure this out, let me know. I haven't tried to PM a mod or anything but I'd still be curious to know what the magic requirements are.
This will definitely help a lot of newcomers. Thanks for taking the time to make it.
Way to get stickied! Now I can stop copying pasting updates worrying I might not be able to find the post...
skri11a:
BusyBox - This is a single executable utility that contains many common Linux commands, instead of having an individual executable for each command. As far as I know this is built into all of the JF releases, as well as Dude's. It is also usable in the JF recovery console by hitting alt-x. To use busybox, just type "busybox" in front of the command you want to use (i.e. #busybox ls -L --to get a list of your directory).
Click to expand...
Click to collapse
Wouldn't "Unix utilities" be more correct than "Linux commands"?
And saying Android is "like windows mobile" is blasphemy! You can't compare Unix to Micro$oft Windoze (Yes, that's a very sophisticated and mature way to express my hatred of the OS )! >:|
Anyway, it's good that you wrote this, theres probably a lot around here not having a clue about how things work in the world of unix

[Q] Microsoft Surface Pro Custom Boot Screen

Hello!
I am posting here, because I am new on forum, and I can not post on developers Microsoft Surface forum.
Here is the thing I want to do. I am user of Microsoft Surface and I want to change the boot (splash) screen (where it writes "Surface" and where the loading circle is) of my tablet to a custom image. So far I haven't found anything useful that would lead me to the my goal.
I know that this setting have to me changed in firmware (BIOS/UEFI). But is there any way to access to them? Maybe the right .ROM file, opened with MMtool would work?
That you very much for any information.
Regrads, Jerry
I've previously modified many BIOS/UEFI Firmwares, but as always, this requires research and reverse engineering. A good starting point would be either dumping the BIOS or use the UEFI.cap files which are packaged firmware (updates). I will try to do this, but there is a risk of bricking the board and unlike desktop boards I don't see a way to recover from a bad flash on the Surface. (UART might work, but you´d have to disassemble the device first, which isn't easy.)

List of phones with released drivers

Hi. I've been thinking that people who wants to buy a new phone should now first if there are free drivers, open recovery, etc.
Obviously, this info can be found in each smartphone forum, but maybe there should be a place where all this info collide.
I mean, a document (maybe in google docs) with:
Name of the phone --------------------- bootloader----------------Root---------------------Recovery--------------drivers (camera, processor).
This is a question that is constantly evolving and is dificult to be up to date.
For example, for the LG G3 D855, the bootloader is not open (but it is bumped, so we can achieve root, and use an open recover). However, AOSP roms aren't completely functional, because drivers for the camera aren't open.
Maybe this document is improvable, but my knowings aren't so vast. Let me know.
I think it could be useful to be following this document up.

Reading "register" information from my ZTE MF90+

Hi Folks, i read quite a bit in the XDA-dev forums in the last few years, but now it's time to change the status "from passive to active". :silly:
- I have a "ZTE MF90+" (a nifty little mobile 4G WiFi hotspot with battery). The Chipset should be based on a Qualcomm MDM9215.
- I bought it about 3 years ago and it is SIM-Locked (aka Provider-Locked iirc).
- I fiddled around a bit with it and am able to ADB into it (from my Ubuntu 18.04 machine and from my Raspberry Pi, too - e.g. to activate RNDIS/CDC mode for USB tethering)
- I have an unlock code, that should work "to tear down this SIM-Lock wall" without any hassle.
So far, so good ... but my interests are still not satisfied; i want to know what's up with the internals of this modem, when i enter the unlock code. I simply want to observe and understand what's going on under the hood.
To quote Ylvis from their song Stonehenge: "And i know i should be happy, but instead, there's question, i can't get out of my head!"
Maybe a year ago i did some internet research, where i found several clues that the "SIM-Lock" information might be stored inside some Section of a NV storage https://forum.xda-developers.com/showthread.php?t=1954029.
On some other russian hacker forum (that i can't find right now, unfortunately) according to google translate one of them seemed to be able to change one NV entry there to get rid of the Sim-Lock. The tabs are still open on my other Ubuntu 14.04 Laptop 250km away from here, so it might take some time to provide the "russian hacker forum link" here for further reference. I haven't tried it out back then as i heavily relied on this mobile hotspot back then and could neither afford to brick it nor had the time to fiddle around further.
What i remember was also this thread: https://forum.xda-developers.com/showthread.php?t=1804117, but this thread is from 2012 and e.g. the download link for the NV-items_reader_writer.rar don't work anymore, so i haven't tried it yet to get this program running.
So now i need your help:
-> What tools can i use (on my Ubuntu Linux machine, if necessary via WINE) to read out a "full image" of the (Android) system to flash back later (if necessary) and what tool can i use to read (and modify if necessary one day) the NV items to compare them "before and after" i unlocked it?
Any hints where to start and in which direction i could head from there? :cyclops:
Please help me to grow and rise :highfive:

Categories

Resources