Related
Has anybody just worked on getting U-boot working on the Gen 8's without all the crap from Archos?
omappedia.org/wiki/Bootloader_Project
omappedia.org/wiki/Zoom_Flashing
And then just using Debian\Fedora or other ARM Linux distro working again without all the stinking .AOS, Archos permissions and signature checking?
Is there an in circuit flasher for the firmware flash for firmware development and recovery? Did they leave the JTAG pins accessible?
2ShedsJackson said:
Has anybody just worked on getting U-boot working on the Gen 8's without all the crap from Archos?
omappedia.org/wiki/Bootloader_Project
omappedia.org/wiki/Zoom_Flashing
And then just using Debian\Fedora or other ARM Linux distro working again without all the stinking .AOS, Archos permissions and signature checking?
Is there an in circuit flasher for the firmware flash for firmware development and recovery? Did they leave the JTAG pins accessible?
Click to expand...
Click to collapse
I don't think anybody's really bothered to. With the SDE, you can flash anything you want without any AOS or signature interference.
Archos gave us a developer boot loader, so why replace it? I know there are some benefits to custom ones, especially MagLDR, but you could just make a bootloader that runs through Developer mode anyways.
Ah, I must have been misinformed. Is there a working kernel config somehwere for the Gen 8 (omap3360) ?
2ShedsJackson said:
Ah, I must have been misinformed. Is there a working kernel config somehwere for the Gen 8 (omap3360) ?
Click to expand...
Click to collapse
Here's the kernel git repositories from Archos: http://gitorious.org/archos/archos-gpl-gen8-kernel
Here's the master repository: http://gitorious.org/archos/archos-gpl-gen8-kernel
There's also alot of google code pages and git repositories by independent devs. Google "gen8 git" and "gen8 google code" to find them.
By the way, why are you called Two Sheds when you only have one shed, Arthur?
Thanks! I noticed all the custom kernels in other posts. Not many post their configs.
I'll still need to look into u-boot for the gen8's since I'd like to be able to see all the source for the bootloader for security reasons.
2ShedsJackson said:
Thanks! I noticed all the custom kernels in other posts. Not many post their configs.
I'll still need to look into u-boot for the gen8's since I'd like to be able to see all the source for the bootloader for security reasons.
Click to expand...
Click to collapse
Technically, I think the source code for the Archos bootloader is buried in that repository I linked, if it helps.
msticninja said:
Technically, I think the source code for the Archos bootloader is buried in that repository I linked, if it helps.
Click to expand...
Click to collapse
I haven't found a bootloader in there yet.
My desire is to just replace what Archos used with u-boot
lists.denx.de/pipermail/u-boot/2010-June/073167.html
Plus have a resore util to resore the flash back to factory new.
Then you won't have to worry about the signature checking
forum.xda-developers.com/showthread.php?t=1018260&highlight=signature+check
The current firmware is a train wreck IMHO. Why does it have to be so clumsy to multiboot or install a new OS or UrukDroid?
2ShedsJackson said:
I haven't found a bootloader in there yet.
My desire is to just replace what Archos used with u-boot
lists.denx.de/pipermail/u-boot/2010-June/073167.html
Plus have a resore util to resore the flash back to factory new.
Then you won't have to worry about the signature checking
forum.xda-developers.com/showthread.php?t=1018260&highlight=signature+check
The current firmware is a train wreck IMHO. Why does it have to be so clumsy to multiboot or install a new OS or UrukDroid?
Click to expand...
Click to collapse
Well, that's Archos' style, and we don't have good enough android developers here to make the corrections.
The Recovery Menu in Urukdroid 1.1RC1 is pretty damn good, but it's obviously a second layer bootloader, and all the multi-boot OSes must use the same kernel. Backup/Restore has everything I need though.
"Archos gen8 boots using OMAP boot ROM from internal eMMC card. Primary bootloader ("boot0") is in 0x20000 bytes after the first sector of internal flash (i.e. at 0x200) and secondary bootloader is written into rawfs, /mnt/rawfs/avboot. boot0 contains image size and loading address in first 8 bytes."
Here's the thread on unlocking it:
http://forum.xda-developers.com/showthread.php?t=1018260&
msticninja said:
"Archos gen8 boots using OMAP boot ROM from internal eMMC card. Primary bootloader ("boot0") is in 0x20000 bytes after the first sector of internal flash (i.e. at 0x200) and secondary bootloader is written into rawfs, /mnt/rawfs/avboot. boot0 contains image size and loading address in first 8 bytes."
[/URL]
Click to expand...
Click to collapse
Anyone know what hardware/flash device they used for the internal eMMC?
I found this interesting as well:
omappedia.org/wiki/E-MMC_boot
You can boot omap3630 without x-loader
Step-1 : Copy the following settings(512+8 bytes) in front of u-boot.bin file;
This is the TOC settings for Clock and SDRAM. And say new file name as u-boot.bin.ift
A0 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 48 53 45 54 54 49 4E 47 53 00 00
F0 00 00 00 5C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 48 52 41 4D 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C1 C0 C0 C0 01 01 00 00 FD 01 00 05 40 00 00 00 03 00 00 00 02 00 00 00 0A 13 00 00 15 00 00 00
07 00 37 00 00 00 00 00 00 0C C8 08 11 00 00 00 00 00 00 00 0C B0 41 04 09 00 00 00 37 00 00 00
00 00 00 00 0C 2C 11 00 01 00 00 00 00 00 00 00 C2 C0 C0 C0 01 00 00 00 00 00 02 00 00 01 00 00
0A 00 00 00 00 00 00 00 85 00 00 00 03 00 00 00 99 80 58 03 32 00 00 00 00 00 00 00 C6 B4 E1 A2
1C 13 02 00 01 E6 05 00 03 00 00 00 99 80 58 03 32 00 00 00 00 00 00 00 C6 B4 E1 A2 1C 13 02 00
01 E6 05 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C0 D5 02 00 00 00 E8 80
----------- -----------
4-byte-size 4byteLoadAddr
====> Step-1 can be done automatically using the http://code.google.com/p/omap-u-boot-utils/ utility.
a. Download the code (git tree)
b. make
c. copy the u-boot.bin in same location.
d. ./gpsign -c configs/sample-3630.cfg -l 80000000 -f u-boot.bin
e. output file u-boot.bin.ift
Step-2: Copy the image(say, u-boot.bin.ift) in MMC/SD card
Step-3: Boot from MMC/SD card and follow the steps as below to flush image in eMMC
#mmcinit 0
#mmcinit 1
#fatload mmc 0 90000000 u-boot.bin.ift
#mmc write.i 1 90000000 0 ${filesize}
Step-4: Remove the MMC/SD card and reboot the system.
[Change the dipswitch settings for SDP only for eMMC boot.]
Too much info there for me to absorb. But the UART pins were just posted on openaos if you want to get serial access. I know it can access the upstream kernel, not sure what else.
http://www.openaos.org/archives/692
Yes. We've been using the serial debug using a FTDI 3V serial to USB adapter. The firmware actually outputs to serial from pretty early on. I just need to be able to recover the flash via jtag or other method in-circuit flasher etc
http://wiki.meego.com/ARM/N900/Install/U-Boot_from_scratch
The Nokia N900 uses a similar OMAP 3430 ARM Cortex A8 to the Gen8 omap3630.
Once I get a working flash util (or find one) u-boot should come together pretty quickly. We just need a way to recover from broken firmware.
coreboot is also just coming up on ARM. So far it's working in qemu for the ARM versatile platform.
flashrom is also being ported to ARM.
So it's possible that we will have u-boot, coreboot and flashrom support soon.
This would be really cool!
2ShedsJackson said:
http://wiki.meego.com/ARM/N900/Install/U-Boot_from_scratch
The Nokia N900 uses a similar OMAP 3430 ARM Cortex A8 to the Gen8 omap3630.
Once I get a working flash util (or find one) u-boot should come together pretty quickly. We just need a way to recover from broken firmware.
coreboot is also just coming up on ARM. So far it's working in qemu for the ARM versatile platform.
flashrom is also being ported to ARM.
So it's possible that we will have u-boot, coreboot and flashrom support soon.
Click to expand...
Click to collapse
I have alot of experience with modules, kernel building, and scripting. And big gaps in my knowledge too. Especially in this low-level stuff you're working on. Even so, please let me know if there is a way I can help.
I'm working on getting kexec to work on the sde kernel. If I can get it working, I'm just going to try to chainload uboot. I feel that replacing the stock bootloader may not benefit the community, because they will brick their device if something goes wrong.
To recover from bad firmware, usb booting is close to working. https://github.com/swetland/omap4boot and https://patchwork.kernel.org/patch/10718/
https://www.droid-developers.org/wiki/Main_Page has lots of bootloader and recovery info for the omaps as well.
They also have a forum on XDA Motorola Droid and Milestone
http://forum.xda-developers.com/forumdisplay.php?f=667
brick recovery...
Any progress...
Just bought a bricked A101.
There's no response from the system anymore and no boot messages over UART. The eMMC structure seems completely borked
I guess i'll need some code to start the device from external sdcard and reflash the eMMC from scratch. At least that's the plan so far.
So i already did some investigations on the mainboard and it seems archos made a quite straight design for the A101. So it seems quite easy to tweak the hardware. I will open a new thread with my findings the next days.
Right now my starting point is the x-loader mainline repository.
Look here: http://gitorious.org/x-load-omap3/
I use the overo configuration as a base, because it's very similar to the things Archos put on the A101.
So any thoughts about it?
Anyone who started something related?
BTW, anyone who got dumps from boot0 and avboot of the gen8 devices?
Would be very helpful...
Best regards,
scholbert
Hi,
i know this is an old thread, but there's some news
So i thought it would be nice to leave a message here as well...
Made some progress on porting u-boot to Gen8, especially A101IT:
http://forum.xda-developers.com/showpost.php?p=23813784&postcount=117
Happy hacking
scholbert
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
Hello. I have a THL W100S. The processor is also MTK6582. I made a stupidity, trying to make repartition with meteos-mtk6589 and now my phone is dead
I did not even install CWM
Now I do not know if I can revive it. I tried with SP Flash Tool, but no reaction... Is there any solution to solve this problem?
1. Do a full backup of the current firmware in recovery
2. Install the application, run (on request Root rights answer - YES \ grant)
3. Choose the size of data partition (2.5GB or 2.77GB)
4. Select in the program restarts in recovery
5. Do wipe data
6. Restoring the backup firmware
7. Boot the system
I set 2.77GB, can this be a problem, maybe it was better to choose 2.5GB? After point 5 phone has rebooted and then show only one. This - gifti.me/i/6ylSuEc.gif
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
I have the same problem. My phone is a W450 mtk6582.
Many thanks
My phone is an Star W450 to...
@hat3ck
my first try was the meteos-mtk6589 but i have a cwm installed.. ... and the phone didn't boot at least
I fix it by flash all options without preloader
and it's like it was
try to flash again.
greetz TO
theoverfiend said:
My phone is an Star W450 to...
@hat3ck
my first try was the meteos-mtk6589 but i have a cwm installed.. ... and the phone didn't boot at least
I fix it by flash all options without preloader
and it's like it was
try to flash again.
greetz TO
Click to expand...
Click to collapse
Thanks for reply! I tried flashing, but nothing, maybe I don't have the need drivers? Can you make a screenshot of window manage without conected phone? Or how I can verify if my laptop sees the phone...
@hat3ck
try this Tutorial 4 Driver install
(under the red ATTENTION text)
http://forum.xda-developers.com/showthread.php?t=2160490
p.s. whats your home country / language?
Greetz TO
theoverfiend said:
@hat3ck
try this Tutorial 4 Driver install
(under the red ATTENTION text)
http://forum.xda-developers.com/showthread.php?t=2160490
p.s. whats your home country / language?
Greetz TO
Click to expand...
Click to collapse
Thanks, I will try now. Language Romanian, but I can understand and Russian.
okay i dont understand Romanian and Russian. it's like for me. :laugh:
if you run Windows 8 it's a little bit tricky to install the drivers.
Instructions for Win8:
1) Windows Key + X -> Start command prompt (administrator).
2) C: \ Windows \ System32 \ shutdown.exe / r / o
3) Select Troubleshooting
4) Advanced Options
5) Start Settings
6) Restart
7)Disable Driver Signature Enforcement.
Greetz TO
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
Hi, you must modify EBR1 and EBR2 like this:
1. EBR1 from:
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 20 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
to
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 50 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
2. EBR2 from:
00 00 83 00 00 00 00 24 3A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
to
00 00 83 00 00 00 00 24 6A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
Flash the files with SPFlashTool. Please make a backup before!! If something go wrong just reflash old EBR1 and EBR2.
Thanks!
mircam said:
Hi, you must modify EBR1 and EBR2 like this:
1. EBR1 from:
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 20 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
to
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 50 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
2. EBR2 from:
00 00 83 00 00 00 00 24 3A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
to
00 00 83 00 00 00 00 24 6A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
Flash the files with SPFlashTool. Please make a backup before!! If something go wrong just reflash old EBR1 and EBR2.
Thanks!
Click to expand...
Click to collapse
so, is it successfull? can you report it and make a n00b tutorial here? thx a lot!
I have a Thl W100S but I can't root it a 100% ! Framaroot says success but after reboot no root access, other software don't root a 100% any suggestions guys? Its the 2nd day I have it latter I will try again, thanks in advance
Sent from my W100 using XDA Premium 4 mobile app
matrix0807 said:
so, is it successfull? can you report it and make a n00b tutorial here? thx a lot!
Click to expand...
Click to collapse
Hi
My ebr1 and ebr2 matches this. I will definintly try this and let you know the result.
My phone is Symphony W128.
Can u root symphony w128
Sent from my Symphony W128 using xda premium
can you post edited files?
Was repartitioning for MTK6582 successful?
Sent from my NOA H42 using Tapatalk
Sargos76 said:
I have a Thl W100S but I can't root it a 100% ! Framaroot says success but after reboot no root access, other software don't root a 100% any suggestions guys? Its the 2nd day I have it latter I will try again, thanks in advance
Sent from my W100 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Hi
try kingroot this version rooted my mtk6582
the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
showjechar said:
the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
Click to expand...
Click to collapse
hello ~
showjechar said:
the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
Click to expand...
Click to collapse
sudo java -jar ./sgs2toext4.jar system.img system_ext4.img
Hello everyone, I am the developer of OpenFit a alternative to the Gear Fit Manager as it doesnt run officially on non-samsung roms. I have implemented various features (see the original post for feature list) and I am at the point where I want to attempt getting heart rate data. I am on CM and cannot use S Health. I was wondering for those who have used S Health with touchwiz, does the app show you heart rate? and pedometer etc? If it does I think I may be able to reverse engineer it, I just need the raw BT data. for this I would need someone who is able to run S Health and log BT data. In CM its under Settings>Developer Options>Enable Bluetooth HCI snoop log . This will capture all the BT traffic between the phone and gear fit.
If anyone is able to do this, please comment below. I would like to reverse engineer this and have it able to sync with google fit, and other fitness apps.
Requirements?:
Stock Samsung Rom with S Health
Root?
Please check out my app and my progress of OpenFit. Download available: http://forum.xda-developers.com/gear-fit/themes-apps/openfit-source-gear-fit-application-t3005697
I am also thinking of releasing it on the Google play store. thoughts?
I have access to a galaxy s5 mini with stock rom,shealth, gearfit and adb. Might worth a try?
see PM for my log file from a samsung s5 mini
Perhaps this is something usefull? syncing GF steps with S-Health. It will synchronise to 185 steps, 0.13km, 6kcal (i am not lazy, its a development GF)
Phone:
0000 0b ff 15 01 02 05 00 00 00 00 0f 00 00 00 86
GF:
0000 09 ff c3 01 02 5c 00 00 00 04 00 00 00 10 00 00
0010 00 ff 04 01 00 00 00 f0 39 cb 55 1a 00 00 00 5b
0020 8f 8a 41 c2 f5 68 3f 00 01 00 00 00 45 b5 c8 55
0030 23 00 00 00 00 00 2a 43 00 00 82 42 35 e6 02 00
0040 cd 7f cf 12 f1 49 02 00 d1 fb 01 00 11 98 02 00
0050 22 bf 02 00 01 01 00 00 00 cf 3b cb 55 10 27 00
0060 00 00 00 00 00 5c
Phone:
0000 0b ff 62 01 01 02 ac 00 00 00 02 10 00 00 00 ff
0010 08 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00
0020 00 ed a2 e1 21 4f 01 00 00 ff ff ff ff 00 00 00
0030 00 00 00 00 00 ff ff ff ff ff ff ff ff ff 00 00
0040 00 00 00 00 00 00 0a 00 00 00 02 00 00 00 c0 b7
0050 c8 55 00 00 00 00 0a 00 00 00 00 00 00 00 00 00
0060 3b 40 00 00 00 00 48 3c cb 55 00 00 00 00 aa 00
0070 00 00 00 00 00 00 00 40 5f 40 00 00 00 00 01 00
0080 00 00 46 b5 c8 55 10 27 00 00 00 00 00 00 45 b5
0090 c8 55 23 00 00 00 00 00 2a 43 00 00 82 42 35 e6
00a0 02 00 f1 49 02 00 d1 fb 01 00 11 98 02 00 22 bf
00b0 02 00 cd 7f cf 12 86
GF:
0000 02 0c 20 16 00 12 00 44 00 09 ff 1b 01 02 08 00
0010 00 00 03 00 00 00 10 00 00 00 5c
Thank you @thijsnl I will look at this data once I get home and have access to wireshark. Im hoping It contains good data
After looking trough the log, i found a message with the text, "HELLOCUP". Im wondering if this is some way to "authenticate" with the gear fit saying it is indeed a samsung phone. Im also seeing a pattern, or a Heart beart the app is sending to the gear fit, each with its number incrementing, shown below:
02050000000001000000
// seems to send the same command here lets call it getData command
02050000000002000000
// getData
02050000000003000000
// getData
etc...
Im wondering if this a way the App tells gear fit to perform an operation. @thijsnl was the data you sent me for heart rate or pedometer? or some other function? thanks!
Sorry, the HELLOCUP was actually a little app i wrote with the cups library. It shows up in 'App Connect'. The 4 packets i posted are for pedometer sync i believe.. I did like start bluetooth hci snoop, switch back to shealth, hit the sync button... Synced, en then adb pulled the hci log.
Sent from my D5803 using XDA Free mobile app
I don't think I ever used the S Health feature, so I do not know what to expect on your behalf. One thing I would test, Is turning on exercise mode, like walking or running which dont seem to need the phone, but, and I know cycling/ hiking wants gps. All this data would be helpful to see what is going on.
Is there a way to get Heart rate and pedometer displayed on the phone? If so, could you re-run these few more tests and capture the log as well?
Based on the log provided above, I was able to send the gear fit to what i think is a fitness sync, and got overwhelming amounts of data. Its a big mess and its going to be near impossible to parse 13384 bytes of information. Not looking forward to this. maybe i got some other information.
Haha, 13K to notice a heart rate value (Uint8? as >256 bpm would be insane) is finding a needle in a haystack.
I checked the hexfile from the firmware update, and wingtip_in.bin showed up some test functions. Another post on xdadev showed an
UART mode, which may can get handy to see dataflow, commands, etc when enabled.
I will keep you updated
i just got some minor results.
Somehow i set my Gf in kind of debug mode HIGH with uart to PDA mode?
However i managed to install the Samsung Serial port driver for the CDC device connecting.
It allows me to enter AT commands
Not support
AT
OK
At+help
The AT Cmd is Error!
AT+VERSNAME
+CME Error:NA
OK
AT+VERSNAME?
+CME Error:NA
OK
AT+VERSNAME=?
+CME Error:NA
OK
AT+VERSNAME=1,1,0
+VERSNAME:1,MP 0.800
OK
I see some AT commands showing up in wingtip_ex.bin (from the firmware). so i might be able to enable a higer debug mode.
Mathijs
I'm also able to mount my GF as two partitions in windows and able to grab data, and log files from the GF
[ 45.414] [ _MUX_SEND_] ^ 49208 1677969760 Sending... 18 bytes
[ 45.417] [ BTU] ^ 49212 1685040424 Sended completed : 18 bytes.
[ 45.420] [ BTU] ^ 49214 1685040424 pop OK. current size : 0 bytes
[ 45.421] [ UI_Task] ^ 49217 268466020 [APP][StatusManager] SendData: 11
[ 45.423] [ UI_Task] ^ 49218 268466020 [APP][StatusDataExchanger] SendData, datatype = 11
[ 45.424] [ UI_Task] [CM]1[12:37:57]>>>> GetConnectionState state(11) (3)
[ 45.424] [ UI_Task] ^ 49220 268466020 channel 4 sending 3 bytes.
[ 45.426] [ _MUX_SEND_] ^ 49221 1677969760 Sending... 8 bytes
[ 45.429] [ BTU] ^ 49224 1685040424 Sended completed : 8 bytes.
[ 45.432] [ BTU] ^ 49227 1685040424 pop OK. current size : 0 bytes
[ 45.434] [ UI_Task] ^ 49230 268466020 [APP][StatusManager] SendData: 4
[ 45.436] [ UI_Task] ^ 49231 268466020 [APP][StatusDataExchanger] SendData, datatype = 4
Perhaps this is usefull when debugging?
wow, I didn't know you had access to such low level info. Though it may be helpful to see what data is sends out when a sync request is being made. I am also thinking the reason I have 13k bytes was because I have history for yesterday exercise which was 1.5hr of using the running feature, and if it saves the heart rate, gps, for each minute or so I can see how this data adds up. But I'm still uncertain what that data is. Maybe its not even related to fitness, but I'm almost certain it is based on the first byte of the message which is '02'(HEX) and all the other commands related to fitness also start with '02'(HEX), which is why I assume its fitness data. What I will try to do is clear my history and have a very small sample set. no more than 1 minute of exercise, and see what data that returns. I'm hoping to see much less data, If i don't then these suspicions go out the door.
@thijsnl
in the data set you sent me, was the only data sync'd
185 steps, 0.13km, 6kcal
or was there more data? This will help me try to decipher the raw packets.
This is what snhealth showed up. I got a brilliant idea yesterday while running.. I can access the fit data files inside the gear fit. I think they must be quite the same when syncing, so if i can pass you these files and the bt hci log while syncing, there may be better chancesnto get the right data out.. Weel keep you updated
Sent from my D5803 using XDA Free mobile app
Here is some more data attached from my GF
A log file, and some other health related files i guess.
Good luck
Clear is that the GF uses embOS from SEGGER (RTOS) and that the embUSB support is built in (for mass storage device and terminal)
EDIT: hehe.. too much private information in the files .
Awesome. I'll take a look tomorrow. Can't wait
Sent from my SCH-I545 using XDA Free mobile app
jareddlc said:
Awesome. I'll take a look tomorrow. Can't wait
Sent from my SCH-I545 using XDA Free mobile app
Click to expand...
Click to collapse
I did some quick lookup on pedo_info.dat. There seem to be a kind of pattern, at offset 38d, every 20 bytes:
Code:
[[email protected]]$ ./stats 38
01 00 00 00 B8 C2 C5 55 07 00 00 00 F6 28 94 40 1F 85 6B 3E
02 00 00 00 C0 C9 C5 55 5F 00 00 00 1F 85 8D 42 3E 0A 57 40
03 00 00 00 18 CC C5 55 07 00 00 00 66 66 AE 40 00 00 80 3E
04 00 00 00 70 CE C5 55 5A 00 00 00 47 61 84 42 3D 0A 47 40
05 00 00 00 C8 D0 C5 55 08 00 00 00 8F C2 ED 40 9A 99 99 3E
06 00 00 00 80 DC C5 55 51 00 00 00 B8 1E 73 42 66 66 36 40
07 00 00 00 D8 DE C5 55 09 00 00 00 8F C2 B5 40 0A D7 A3 3E
08 00 00 00 38 E8 C5 55 4C 00 00 00 CD CC 76 42 1F 85 3B 40
09 00 00 00 90 EA C5 55 40 00 00 00 14 AE 4C 42 0A D7 13 40
0A 00 00 00 E8 EC C5 55 5A 02 00 00 12 2E E5 43 87 5C CF 41
0B 00 00 00 40 EF C5 55 86 02 00 00 AE 6E 00 44 D0 EB D9 41
0C 00 00 00 98 F1 C5 55 90 03 00 00 1C 15 33 44 CB 8F 18 42
0D 00 00 00 F0 F3 C5 55 6A 02 00 00 89 6B EB 43 65 D7 C7 41
0E 00 00 00 48 F6 C5 55 4D 00 00 00 D6 A3 5C 42 40 E1 4A 40
0F 00 00 00 A0 F8 C5 55 1F 01 00 00 B0 87 50 43 37 0A 3B 41
10 00 00 00 F8 FA C5 55 15 02 00 00 38 93 C6 43 06 29 B0 41
11 00 00 00 58 04 C6 55 24 00 00 00 F6 28 C6 41 5C 8F C2 3F
12 00 00 00 B0 06 C6 55 23 03 00 00 01 B0 02 44 00 00 03 42
13 00 00 00 08 09 C6 55 65 01 00 00 5B 4F 6A 43 98 99 69 41
14 00 00 00 60 0B C6 55 78 00 00 00 14 2E A3 42 29 5C 9F 40
the counter in the first byte and the C5 55 pattern in the middle...
Regards,
Mathijs
Ok, i decided to figure out how the StopWatchDB file works.
Not that this information is very useful, but it is more predictable than others.
So i start my stopwatch, and pressed the white button at 1s, then wait 2s, then wait 3 sec, wait 4sec, wait 5 sec, wait 6 and press stop.
I made a picture of it, it is in Dutch, but you get the point.
I analysed the code and see some repeating patterns, and even a number indicator:
Code:
52 33 35 30 58 58 55 30 42 4F 41 32 00 00 00 01
00 00 00 33 05 00 00 01 00 00 00 31 0D 00 00 01
00 00 00 CB 18 00 00 01 00 00 00 D9 27 00 00 01
00 00 00 1C 3C 00 00 01 00 00 00 E2 18 00 00 01
00 00 00 82 1A 00 00 01 00 00 00 7C 1B 00 00 01
00 00 00 DB 1C 00 00 01 00 00 00 39 1E 00 00 01
00 00 00 DA 1F 00 00 01 00 00 00 BD 21 00 00 01
00 00 00 0B 23 00 00 01 00 00 00 E4 23 00 00 01
00 00 00 9B 24 00 00 01 00 00 00 6E 26 00 00 01
00 00 00 79 27 00 00 01 00 00 00 62 28 00 00 01
00 00 00 7E 29 00 00 01 00 00 00 89 2A 00 00 01
00 00 00 2A 2C 00 00 01 00 00 00 44 2D 00 00 01
00 00 00 2F 2E 00 00 01 00 00 00 3E 2F 00 00 01
00 00 00 45 30 00 00 01 00 00 00 5F 31 00 00 01
00 00 00 2E 34 00 00 01 00 00 00 00 36 00 00 01
00 00 00 D1 37 00 00 01 00 00 00 95 39 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00 00 00 A2 52 00 00 01 00 00 00 05 00 00 00
Then i made a simple c program to decompile it:
[[email protected] gf]$ ./stop
DB Length: 831
Firmware: R350XXU0BOA2
Number of records: 5
Record 0: 00 00 01 00 00 00 33 05 Estimated time is 1331
Record 1: 00 00 01 00 00 00 31 0D Estimated time is 3377
Record 2: 00 00 01 00 00 00 CB 18 Estimated time is 6347
Record 3: 00 00 01 00 00 00 D9 27 Estimated time is 10201
Record 4: 00 00 01 00 00 00 1C 3C Estimated time is 15388
End time: 21154
Voila! 21.154 seconds.
The quick n dirty code is:
Code:
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
int main(int argc,char * argv[])
{
int fd;
unsigned char data[16*1024];
int x;
int i;
int a=13;
int len=0;
int numrec=0;
int time=0;
int endtime=0;
if (argc>1) { a=atoi(argv[1]); }
fd = open("stop5.dat",O_RDONLY);
len = read(fd,data,1024*128);
if (len == 0) { return 0; }
numrec = data[len-4] + 256*data[len-3] + 256*256*data[len-2] + 256*256*256*data[len-1];
printf("DB Length: %d\n",len);
printf("Firmware: %s\n",data);
printf("Number of records: %d\n",numrec);
for (i=0;i<numrec;i++)
{
printf("Record %d: ",i);
for(x=0;x<8;x++)
{
printf("%02X ",data[a++]);
}
time = data[a-2] + data[a-1]*256;
printf("Estimated time is %d",time);
printf("\n");
if (data[a+2] != 0x01) { break; }
}
endtime = data[len-12] + 256 * data[len-11] + 256*256*data[len-10] + 256*256*256*data[len-9];
printf("End time: %d\n",endtime);
return 0;
}
Lets see what other file's hide from us.
@jareddlc: I think more data is coming over when sync:
- sleep
- heartbeat
- pedometer
- stopwatch
- excercise
awesome work!
I also got some hopefully promising data. I ran the running mode yesterday for about 1 minute, but I don't get things like GPS etc so alot of info is blank, with exception of heart rate.
Here are my findings:
My watch reported back with: should be: Monday Aug 17 8:34 pm, running, 01:02 time, 0.00 km,0 cal, avg speed, 0.0kmh, max speed, 0.0kmh, avg pace - --km, max pace, - --, avg heart 88bpm, max 93 bpm so i found most time stamps, and now im looking for 88 (58 in HEX) and 93 (5D in HEX) seems i found the "summary" report.
Code:
5807D255 = Monday, August 17, 2015 9:10:00 AM
A8000000AE070F439A99D140
1013D255 = Monday, August 17, 2015 10:00:00 AM : 1439830800
CC0000000AD71743703DE240
D025D255 = Monday, August 17, 2015 11:20:00 AM : 1439835600
0901000046E14743F7281441
E033D255 = Monday, August 17, 2015 12:20:00 PM : 1439839200
//...
10A9D255 = Monday, August 17, 2015 8:40:00 PM : 1439869200
39000000CCCC3042D7A300400901000000D89FDF3E4F01000000000000000000000000000000000000040000000C01000000
D7A7D255 = Monday, August 17, 2015 8:34:47 PM : 1439868887
3E00000000000000 5800000000000000 0153460000000000 0000000000000000 00000000 00 5D00000000000000 000000000001000000 = 88bpm : 58 HEX 93bpm : 5D HEX
45B5C855 = Your time zone: Monday, August 10, 2015 7:29:25 AM : 1439216965
2300000000002A430000824235E60200CD7FCF12F1490200D1FB01001198020022BF02000101000000
A5AAD255 = Monday, August 17, 2015 8:46:45 PM : 1439869605
1027000000000000
hey guys i need ur help.i just flashed new firmware android marshmallow 6.0.1 on my D6502 and there was a file called simlock.ta and it just bricked my phone.
1.my phone is working fine but no simcard is valid and my network is completely bricked,
from menu services
bootloader status:unknown
hwconfig:unknown
2.simlock.ta file inside the firmware that i flashed :silly::silly:
Code:
// [SIMLOCK S1]
02
000007DA 0141 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 02 00 05 0A 02 00 00 00 0A 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 4D 4F 50
5F 49 44 3D 22 38 35 38 37 22 3B 4F 50 5F 4E 41
4D 45 3D 22 43 75 73 74 6F 6D 69 7A 65 64 20 4D
41 41 22 3B 43 44 41 5F 4E 52 3D 22 31 32 39 31
2D 34 36 37 35 22 3B 52 4F 4F 54 49 4E 47 5F 41
4C 4C 4F 57 45 44 3D 22 31 22 3B 00 00 00 09 00
07 30 30 31 30 31 2D 2A 00 00 00 00 00 00 00 00
00 00 00 00 02 00 00 00 0A 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 0A 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 02 00 00 00 0A 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00
3.please avoid telling repeated answers i know all of them .i flashed any firmware from other region but not fixed.i flashed other simlock.ta file from other firmwares but i couldnt find the right simlock.ta and i wanna know what is the correct simlock.ta for my device cause this file inside android 6.0.1 completely reset my network and bootloader status.
4.i was in bootloader unlocked phone but now i cant unlock or relock it when i try to unlock or relock in flashtool or command prompt it says this command is not allowed
5.i can go to flash mode via volume- and power button but my fast boot (volume+ and power button) is not allowed.fastboot damaged and i cant flash any kernel via fastboot or use a recovery mode.
adb mode is not accessible cause no fast boot for my phone.i cant get adb shell from my phone so restoring ta backup is not allowed however i dont have any backup from ta partition.
6.the only solution left that i think it works and that was working for older devices is flashing a simlock.ta on sonyerricson arc,arc s,x10,neo, xperia play or older devices there was a unbrick simlock.ta called "TA brick fix" that we can fix this by flashing but on z2 its not working.please gimme any simlock.ta file that u think it is working for d6502 or tell me a working guide line to fix this issue.
7.i contact my support area but they told me i have to change my main board cause they cant fix it.i know guys there is only problem with simlock.ta only this file damaged my phone and i wanna make the own working simlock.ta back.
8.i am a developer and i know enough about coding and hex editing if u have a deep idea about how simlock.ta hex file works tell me to test it.i dont know what is the right algorithm for simlock.ta on Z2
9.please if u have D6502(L50w)/D6503 Z2 backup ur .ta partition and send it here ill check for solution (Im aware that flashing any other .ta partition from another device can lead me to hard brick,i only want to analyse .ta partitions to find a solution).
.ta partition backup guidehttp://forum.xda-developers.com/showthread.php?t=2292598 :highfive::highfive::fingers-crossed::good:
http://www.4shared.com/zip/aLCY46Xoce/TA-backup-20160423101131.html
Xperia Z2(D6502)
I have same problem with my Xperia U, i have flashed the simlock.ta, after that no network no simcard, bootloader unlock allowed : no
Can't boot to fastboot mode.
Do you find the way fix the problem mind to share with me？
riclim said:
I have same problem with my Xperia U, i have flashed the simlock.ta, after that no network no simcard, bootloader unlock allowed : no
Can't boot to fastboot mode.
Do you find the way fix the problem mind to share with me？
Click to expand...
Click to collapse
No,i contact the sony Co and they said the only way is changing the motherboard with a broken lcd or damaged phone.but still trying to find a way to hack into trim area like 2011 series mobiles
untraceablezing said:
No,i contact the sony Co and they said the only way is changing the motherboard with a broken lcd or damaged phone.but still trying to find a way to hack into trim area like 2011 series mobiles
Click to expand...
Click to collapse
I think this problem hard to hack and fix it, i found the answer is every phone have a unique simlock.ta code, if you didn't back up it, after flash the .ta file, the phone will half brick, don't know how to find back the phone .ta file code, every phone is different