S1 Flash Protocol Notes - XPERIA X10 Android Development

Code:
// PROTOCOL FMT
// ALL DWORDS ARE BIG ENDIAN
[DWORD] CMD
[DWORD] FLAGS ( 1 | 2 | 4 )
[DWORD] LEN
[BYTE] HDR CHECKSUM
[BYTE[LEN]] DATA
[DWORD] DATA CHECKSUM (CRC32)
To calculate header checksum:
byte calcHdrSum(byte* hdr)
{
byte cksm = 0;
if(header.length < 12) return 0;
for(int i = 0; i < 12; i++)
cksm ^= hdr[i];
return (byte)cksm+7;
}
FLAGS seems to always be either:
false true false ( 1 | 2 | 0 ) = 3
or
false true true ( 1 | 2 | 4 ) = 7
the 4 indicates whether the command has more data or not.
if the 4 bit is set to true, it means there is more data,
otherwise we are done with command.
COMMANDS:
0x01 - loader info?
0x04 -
0x06 - write SIN
0x07 -
0x09 -
0x0A -
0x0C - model/kit info?
0x0D - write TA
Generally, a writeBytes is followed by 2 or 3 readBytes, depending on the length of data in the first readBytes (if LEN = 0 then only 2...)
When calling readBytes, generally we read the header first (CMD, FLAGS, LEN, HDR CKSM), then the next readBytes contains data of length LEN and is the result of the command. Finally, the last readBytes is some strange CRC32 done on the data. I haven't quite figured this out yet.
Example:
Code:
//writeBytes cmd = 0x0000000C, flags = 0x00000003, len = 0x00000004, hdr cksm = 0x12
//data = 0x000008A2, data cksm = 0xF00148CC
<< 00, 00, 00, 0C, 00, 00, 00, 03, 00, 00, 00, 04, 12, 00, 00, 08, A2, F0, 01, 48, CC
//readBytes cmd = 0x0000000C, flags = 0x00000001, len = 0x00000005, hdr cksm = 0x0F
>> [00, 00, 00, 0C, 00, 00, 00, 01, 00, 00, 00, 05, 0F]
//data = X10a\0
>> X10a
//data cksm = 0x1879A4B8
>> [18, 79, A4, B8]

---

Nice, thanks =)
Regards

---

The CRC32 checks are also done on low S1 phones, but I lost all my documents regarding calculation of such checksums.

---

Hey guys,
I mind as well post all the information that I have. I will be posting the source to my flash tool later tonight probably, below is some of the primary code I have as well as the commands I'm aware of.
Cheers, Brett
------
Commands:
Code:
* Commands:
* 0 - ** Invalid Command
* 3 - ** Not Authenticated
* 8 - ** Not Authenticated
* 11 - ** Not Authenticated
* 12 - ** 4 BYTES - Cannot Read TA - Properties?
* 13 - ** X BYTES - Invalid Unit - TA Related?
* 14 - ** Not Authenticated
* 15 - ** Not Authenticated
* 16 - ** Not Authenticated
* 17 - ?? Authentication Command?
* 18 - ** 4 BYTES - TA not open.
* 19 - ** 4 BYTES - No Error
* 20 - ** Not Authenticated
* 21 - ?? MISC_ERROR - Misc TA not opened
* 22 - ?? MISC_ERROR -
* 23 - ** Invalid Command
* 24 - ** Not Authenticated
* 25 - ?? MISC_ERROR - Parameter
------
USBFlashWrapper.java->writePacket:
Code:
public void writePacket( S1Packet p ) {
int payload_size = ( p.payload == null ? 0 : p.payload.length );
byte[] data = new byte[13+payload_size+4];
Utils.writeArrayInt(data,0,p.cmd);
Utils.writeArrayInt(data,4,p.flags);
Utils.writeArrayInt(data,8,payload_size);
data[12] = CRCSE.calculate(data,0,12);
if( payload_size > 0 ) {
System.arraycopy(p.payload, 0, data, 13, payload_size);
Utils.writeArrayInt(data,13+payload_size,CRC32.calculate(p.payload));
} else {
Utils.writeArrayInt(data,13+payload_size,0);
}
try {
while( !writeBytes( data ) );
} catch (IOException e) {
e.printStackTrace();
}
}
------
CRCSE.java
Code:
package xflash;
public class CRCSE
{
public static byte calculate(byte[] data, int sindex, int length) {
byte csum = 0;
for( int i = sindex; i < sindex+length; i++ ) {
csum = (byte)(csum ^ data[i]);
}
csum = (byte)(csum + 7);
return csum;
}
public static byte calculate(byte[] data) {
return calculate(data,0,data.length);
}
}
------
CRC32.java:
Code:
package xflash;
public class CRC32
{
private long csum;
private static long[] crctable;
static
{
crctable = new long[256];
for(int i = 0; i < 256; i++)
{
long l1 = i;
for(int j = 0; j < 8; j++)
{
if(l1 % 2L == 0L)
l1 = l1 >> 1 & 0xffffffffL;
else
l1 = (l1 >> 1 ^ 0xedb88320L) & 0xffffffffL;
crctable[i] = l1;
}
}
}
public CRC32()
{
reset();
}
public void reset()
{
this.csum = 0L;
}
private void add(byte byte0)
{
long l = 255L & (long)byte0 & 0xffffffffL;
long l1 = (csum ^ l) & 0xffffffffL;
csum = (csum >> 8 & 0xffffffffL ^ crctable[(int)(l1 & 255L)]) & 0xffffffffL;
}
public void add(byte[] abyte0)
{
for (int i = 0; i < abyte0.length; i++)
add(abyte0[i]);
}
public long result()
{
return this.csum & 0xFFFFFFFF;
}
public static long calculate(byte[] data) {
CRC32 c = new CRC32();
c.reset();
c.add(data);
return c.result();
}
}