Database Develop

OMAP4430 boot.rom dump

My purpose is to locate the fastboot system, and I thought that I would start from, well, the start. Boot-up on the OMAP4430 tries many places, one is an on-chip 48kb ROM. I initially tried to read /dev/mem, but no matter what address I tried to read it would say Bad Address, so I had to make a kernel module, in which I dumped the boot ROM to a file... and it worked.
The reversion of the ROM on my bionic is 0x03 0x19
(Please read Ch 27(.4.2.1) of OMAP4430_ES2.x_PUBLIC_TRM_vY.zip )
I am more handy with ia32 assembly, not arm...
So where is fastboot? I can see a few other addresses, but if I try to map some of them, the device will reboot.. The TRM spoke of 0x08000000 for a fast boot XIP but a reboot occurs (I think) ... any ideas where to look next?

After a day of digging around, I was able to find that "fastboot"(0x08000000) address at 0x28C18 (0x28000 is the base address of the boot.rom) ... just helping out anyone else interested in looking into this. I somehow don't think that this is what I am looking for though... but atleast I do know that I am making some headway
Edit: Confirm that I am unable to read even one byte from 0x08000000 .. reboots
Edit2: Polling from the Control Register (0x4A0022C4) returned 0x00000AEF ... which means that
1) This is not a GP(General Purpose) OMAP4430
2) SYS_BOOT[5:0] is b101111 which tells us
a) to use Memory, not Peripheral boot devices
b) 1st boot device is MMC2(1)(perm) (eMMC/eSD = GPMC pins)
c) 2nd= USB-ULPI (external transceiver)
... Does the MMC mean it boots from the onboard 16gb? If so, then this might be easier to trace through than I thought...
Has anyone dumped the entire contents of that memory? or just the known partitions?
Edit3: Reading the TRM more (pg 5240) tells me that SDMMC2 only Raw mode is supported, no file system (FAT12/FAT16/FAT32) support because the purpose of this approach is to avoid the boot time penalty of searching for a file system hierarchy when it is not always necessary.
Edit4: ...and Sure enough, dumping the first 512 bytes of /dev/block/mmcblk1 shows the Bootable signature (0x55AA) at the end (0x01FE)
... I thought I read that it would just try to read in RAW mode, which makes it not want to even have such a thing, but I knew it had all those other partitions, so I figured I might have been wrong there...
A proper dump of this soon enough.. atleast I gave you guys the boot.rom from the actual OMAP4430 that would have been otherwise hard to retreive... I only wasted one day on this, not bad and I learned some ARM ASM
Edit5: Maybe I am getting ahead of myself, it is of type 0x83 ... which is Linux, not any of the FAT FS which the boot.rom supports... ?
Edit6: Well, it has the file it's looking for, not sure if it's a FAT system like it's suppose to be though, and it looks like in a 1MB dump that fastboot is in the 2nd or maybe more, partition... I still want to try to dump this "MLO" bootup file... but i have to learn about FAT fs structure, ugh...

The implications of deep hardware hacking like this make me very excited for what could be possible with the Bionic. It contains some absolutely absurd hardware for a mobile device so the sky's the limit at this point. Fantastic work! I could only dream of being able to comprehend the things that guys like you can.
Also I wonder if this thread would end up getting proper attention in the dev section.

projektorboy said:
The implications of deep hardware hacking like this make me very excited for what could be possible with the Bionic. It contains some absolutely absurd hardware for a mobile device so the sky's the limit at this point. Fantastic work! I could only dream of being able to comprehend the things that guys like you can.
Also I wonder if this thread would end up getting proper attention in the dev section.
Click to expand...
Click to collapse
I only wish I could comprehend what he is talking about. I'm glad to see a vested interest is being taken!
Sent from my DROID BIONIC

Thanks so much, Noxz for making the effort to do this!

hey, thanks finally for the responses, a full day after the initial dump and no responses... I think because it's NOT in the dev section... but I can't post a thread there until I have 10 posts... maybe I can get that privilege now, moderators?
The bad part with disassembling is that when it computes an jump in code(in ARM it's called a branch) and doesn't give a specific address, it makes finding that code very hard.. I found the text "MLO", the bootable file, in the boot.rom but nothing of the code I know referenced it yet, unfortunate because that partition is not a standard FAT fs and thus is taking a while to read, but if I did have the disassemble of the ROM code where it looks for that, or even just the file search, then I could easily see what it is reading...
Obviously knowing that fastboot and such is in the second or third partition is quite a step forward, but I need to dump this MLO file so we can read from start to finish...
I'll keep everyone posted

So this partition isn't a correct FAT fs... I don't know if being identified as a Linux partition means anything and I'm just not reading into it right, but I am having some time trying to look into these files, you can easily see the MLO file, a KEYS file, and a PRIMAPP file right at the start, or I should say the file name, but there isn't much information on where they are mapped, etc etc...
Maybe partition2 will be better? It's also identified as a Linux partition
I still have a few days to waste...

Sorry to ask dumb. But what exactly does this benefit me when flashing it?
Sent from my DROID BIONIC using Tapatalk

The current fastboot does not have several commands that is in the original source... but really, I am just interested in the entire boot procedure.. there's a few things I might like to change... The good news is because everything but the boot.rom resides on the eSD, that means we should be able to write to it very easily, so we can change quite a bit

Noxz, I am along with these guys in I would understand more if I was just dropped in the middle of Ghana :\ but I would like you to know that you have given me my 1024th item on my 'to research' list. So once I get bored with what I'm doing now, I am going to try to learn a little bit about ARM and OMAP

Hah, I understand...
I've done a bit of x86 ASM and BIOS disassembly before.. so I figured I might as well peek into this and see what is being hidden and such...
I am seeking help right now... If you know anything about the FAT filesystem... you can start by doing "dd if=/dev/block/mmcblk1p1 of=/mnt/sdcard-ext/partition1"
.. It obviously has that MLO bootup file in it as mentioned in the OMAP4430 TRM but I can't seem to trace what cluster it might be in... I have to assume that it is in fact a FAT fs... but it doesnt seem to follow any of the structures/formats I've been reading... ???

The boot rom you've dumped is the ti omap itself; the only real purpose of that is to bootstrap the bootloader. You are correct in that it's not a GP; none of the Motorola phones are -- this boot rom is what verifies the signature of the bootloader.
http://www.droid-developers.org/wiki/Booting_chain
While not exact, the above diagram will give you an overview of the layout used by Motorola phone. The short version is boot rom -> mbmloader -> mbm -> lbl -> kernel, where mbmloader is the Motorola terminology for the MLO or X-LOADER referenced in the TRM. mbm is the bootloader (motorola boot manager) and controls all actions henceforth, including fastboot (which replaced an older sbf protocol).
The CDT acts as a partition table and lists the layout of the device, including marking where the signatures are located and how often they're checked.
http://blog.opticaldelusion.org/2011/10/bionic-development-notes.html

Sorry for late answer.
Here you can find example of reversing OMAP 3430 bootrom http://hg.droid-developers.org/reverse_engineering/src/b8b881184b5f/asm
As mentioned before droid-developers wiki contain a lot of info about bootrom.
Here you can find info about bootrom itself http://www.droid-developers.org/wiki/Application_Processor_Boot_ROM
Here you can find info about security model in omap http://www.droid-developers.org/wiki/Security http://www.droid-developers.org/wiki/Secure_Services
Here you can find info about my project - emulation of early OMAP booting (including bootrom debugging) http://www.droid-developers.org/wiki/QEMU

[Q] Capture image of a X8 internal memory

I am interested in creating a forensic image of a Xperia x8 internal memory (school purpose). When I connect the device with the USB cable I can only see the SD card partition. I tried with different tools: ProDiscoverer Basic, WinHex...
How can this be accomplished ?
I don't want to root, install a particular app or alter in any way the content of the internal memory, that will ruin the hole ideea of a forensic image..
Oh yeah.. on previous owned devices: SE Elm or SE Z520, after connecting the device I did have access to the internal memory.

Connecting the device in USB storage mode won't get you any far. That way, as you already worked out, you only gain access to the SD card contents.
You actually need to look into the "adb" commandline tool that comes as a part of the Android SDK (if you look around on XDA you will find adb.exe plus the two required DLLs so you don't need to install the whole SDK along with the Java JDK).
The problem you will face:
If the the phone isn't rooted you won't be able to gain access to all parts of the internal file-system (i.e. some directories may appear empty though there are files and directories inside).
Apart from that - that's not a approach fit for forensic analysis.
IF you would want to tap into a device that's up for forensic investigation the worst thing you can possibly do is to actually turn the device on, let alone boot it up. Chance are that this could destroy valuable evidence (don't take everything you see in CSI:Retards for real) or trigger a "killswitch" that could delete data.
To perform a real forensic analysis you would actually take the phone apart and tap into the system through the JTAG interface. There you are talking directly to the hardware without the phone being booted or even "turned on" (it'll just sit there in "standby-ish" mode).
From there you would then dump the contents of the NAND (the internal memory of the phone where the Android OS, data and installed apps reside) into a file on your computer to perform further analysis.
Once the content of the NAND is secured you can crack down on the SD card (to secure further data for investigation) by slapping it into a card reader being WRITE PROTECTED and do a dump of the SD into a image you can then later mount or hex-view on the computer.
In other words ... to "emulate" a forensic analysis (by ignoring the fact to break basic safety measures) you would actually need to ROOT the phone. Once you did that, and therefore have busybox and su in your ROM, you can then use "mtd_utils" to dump the nand into a file for further analysis.
EDIT:
MTD Utils (i.e. dump the content of the NAND)
These files need to go onto your phone! This are NOT executables for Windows or Linux desktop PCs!
ADB (Windows, Android Platform Tools r10 at the time of writing)
Download the ZIP and extract it ... you only need adb.exe, adbwinapi.dll and adbwinusbapi.dll
Do NOT forget that the Android drivers for your phone need to be installed!

Thanks for the answer. Do you know/have any links regarding what cables/connectors or other hardware tools I need to tap into the system through the JTAG interface.
I found a link:
gsm-technology.com/index.php/en_US,details,id_pr,8466,menu_mode,categories.html
.. dude has a lot o hardware equipment and cables... where can I get & buy stuff like that?

I would try eBay first - or look into finding online retailers selling you a RIFF Box plus required toolset.
Since you said it's for a study project I'm not sure if the equipment you need to really replicate a "professional forensic analysis" will match your budget. A RIFF Box usually goes for USD 150+ over the counter, and then you need some experience to get it to good use and also know a thing or two about electronics in general.
EDIT: Well, the link you posted is the JTAG Header adapter (for the X8 and possibly also W8). If you scroll down they also have the RIFF Box for EUR 119,00 enlisted. And it seems that's actually a online retailer where you could buy the stuff.
---------- Post added at 11:12 AM ---------- Previous post was at 11:02 AM ----------
Ok, to pull it together ...
Xperia X8/W8 is based on the MSM7227 CPU, hence you need ...
Medusa JTAG Box EUR 119,00 (w/o VAT)
Supports MSM7227 based devices. Cables come with the box.
JTAG Xperia X8 EUR 8 (w/o VAT)
That's the JTAG header adapter
Apart from that you may need some software and a good idea about how to wire the cable from the Medusa Box to the pins on the JTAG adapter. Chances are you may also need a power adapter to power the JTAG (if powering the phone through USB doesn't work).
EDIT: Forgot: While the Xperia phones aren't really listed at the RIFF Box that box should work as well.

UART and bootloader strap pinouts for recovery

I started looking into bootloader-level recovery tonight before messing with the file system too much and potentially getting into a bad state. I couldn't find this information anywhere else.
UART pinout
J3 - 4 pin unpopulated header on the front of the board near the LED
Pin 1: 3.3v
Pin 2: TX
Pin 3: RX
Pin 4: GND
Bootloader and kernel console output comes out this port, but android doesn't start a shell.
Bootloader strap
On the back of the board in the center, there is an unpopulated button (U33). When jumped while the power button is pressed, this appears to put the bootloader into USB recovery mode. It enumerates with an nvidia vendor id. Presumably nvflash or tegrarcm could be used to unbrick the device.
I haven't done anything with the bootloader recovery since I haven't yet made a backup. I'm not sure how much of the functionality is allowed given the state of the production fuse, but I would think we could use this to at least get back to a stock state.

I had posted pretty much the same thing a few hours earlier over on the ouya forums - https://forums.ouya.tv/discussion/comment/11742/#Comment_11742
The good news about the bootloader is that none of the android partitions have any sort of signature, which means that the bootloader is effectively "unlocked", you can even do a "fastboot boot". The bad news is that there doesn't seem to be any sort of hotkey to enter the bootloader or recovery mode, although I did find that you could usually get into recovery with the sysrq, just press alt-sysrq-i a few times at bootup to crash the processes spawned by init and eventually it will reboot into recovery -- obviously this won't work if your ouya doesn't even boot that far, so be careful.
The button at u33 does get you into nvflash mode, but from what I can tell it's entirely useless since every command will return a 0x4; we'll need the secure boot key to actually get this working.
As far as backups, the OTA download contains an entire copy of the system and boot partitions, this can be flashed from recovery using adb sideload; rayman has posted a link to all the known OTA downloads over on this thread - http://forum.xda-developers.com/showthread.php?t=2266629

tylerwhall said:
I started looking into bootloader-level recovery tonight before messing with the file system too much and potentially getting into a bad state. I couldn't find this information anywhere else.
UART pinout
J3 - 4 pin unpopulated header on the front of the board near the LED
Pin 1: 3.3v
Pin 2: TX
Pin 3: RX
Pin 4: GND
Bootloader and kernel console output comes out this port, but android doesn't start a shell.
Bootloader strap
On the back of the board in the center, there is an unpopulated button (U33). When jumped while the power button is pressed, this appears to put the bootloader into USB recovery mode. It enumerates with an nvidia vendor id. Presumably nvflash or tegrarcm could be used to unbrick the device.
I haven't done anything with the bootloader recovery since I haven't yet made a backup. I'm not sure how much of the functionality is allowed given the state of the production fuse, but I would think we could use this to at least get back to a stock state.
Click to expand...
Click to collapse
Sadly, no. The way nvidia does security means that you need to know the Secure Boot key (if set - but it is set on ouya) to even be able to communicate with the device through APX/nvflash.
As embeem mentions, it will return 0x4, which essentially means "go away, i don't know you" after which it goes into an almost turned off state where it refuses to do anything but restart. The SBK is an AES-128 key so it's essentially impossible (inpractical) to bruteforce it.

rayman said:
Sadly, no. The way nvidia does security means that you need to know the Secure Boot key (if set - but it is set on ouya) to even be able to communicate with the device through APX/nvflash.
As embeem mentions, it will return 0x4, which essentially means "go away, i don't know you" after which it goes into an almost turned off state where it refuses to do anything but restart. The SBK is an AES-128 key so it's essentially impossible (inpractical) to bruteforce it.
Click to expand...
Click to collapse
So what was the trick that you used/developed to bypass the encryption on TF101 B80+ / TF201 / TF701 ? As far as I know their bootloaders also required SBK, nevertheless you published tool that works with them even though SBK remain unknown, or am I wrong and misread something?
Cheers

wolf849 said:
So what was the trick that you used/developed to bypass the encryption on TF101 B80+ / TF201 / TF701 ? As far as I know their bootloaders also required SBK, nevertheless you published tool that works with them even though SBK remain unknown, or am I wrong and misread something?
Cheers
Click to expand...
Click to collapse
Black magic.

Well, not much capable in nvflash mode, can't get anything to work properly.
UART lets me see it boot up, and fail miserably. Sadly, nothing doing there either. Nothing I send to it seems to affect it.
Back story: I broke init. The sysrq trick doesn't work unless you're getting to init.
Boot log via UART:
http://pastebin.com/ENQYQbTS
It still responds to sysrq, but nothing I'm doing seems to do much. I can dump the memory, crash the system, reboot it, shut it down, all kinds of things. Here's the HELP for sysrq:
Code:
[ 66.672046] SysRq : HELP : loglevel(0-9) reBoot Crash terminate-all-tasks(E) memory-full-oom-kill(F) kill-all-tasks(I) thaw-filesystems(J) show-backtrace-all-active-cpus(L) show-memory-usage(M) nice-all-RT-tasks(N) powerOff show-registers(P) show-all-timers(Q) Sync show-task-states(T) Unmount show-blocked-tasks(W) dump-ftrace-buffer(Z)
an easier list of sysrq commands:
Code:
alt + sysrq + [0-9] - set log level (doesn't seem to work)
alt + sysrq + B - reboot
alt + sysrq + C - crash
alt + sysrq + E - terminate-all-tasks
alt + sysrq + F - memory-full-oom
alt + sysrq + I - kill-all-tasks
alt + sysrq + J - thaw-filesystems
alt + sysrq + L - show-backtrace-all-active-cpus
alt + sysrq + M - show-memory-usage
alt + sysrq + N - nice-all-RT-tasks
alt + sysrq + O - poweroff
alt + sysrq + P - show-registers
alt + sysrq + Q - show-all-timers
alt + sysrq + S - sync
alt + sysrq + T - show-task-states
alt + sysrq + U - unmount
alt + sysrq + W - show-blocked-tasks
alt + sysrq + Z - dump-ftrace-buffer
Some more detailed information on what these are: http://en.wikipedia.org/wiki/Magic_SysRq_key
Open to ideas!

This reminds me of the old Droid X I had years back, which had a locked bootloader.
Because of this, there had to be a special "boot to recovery" boot strapper installed onto the system.
We have full RW access to the Ouya's filesystem and software, so it would seem like the first thing the community should do is develop some sort of "successfully booted" flagging to make the system try to automatically drop into CWM in the event that it looks like the OS is broken.
Couldn't such a thing live in the boot.img, and thus be available even if some silly person formats their /system partition? (This has happened already, and so the guy pretty much bricked his Ouya)

DivinityCycle said:
This reminds me of the old Droid X I had years back, which had a locked bootloader.
Because of this, there had to be a special "boot to recovery" boot strapper installed onto the system.
We have full RW access to the Ouya's filesystem and software, so it would seem like the first thing the community should do is develop some sort of "successfully booted" flagging to make the system try to automatically drop into CWM in the event that it looks like the OS is broken.
Couldn't such a thing live in the boot.img, and thus be available even if some silly person formats their /system partition? (This has happened already, and so the guy pretty much bricked his Ouya)
Click to expand...
Click to collapse
My plan is to develop a sysrq key to write the appropriate bit(s) to SCRATCH0 and reboot. This would allow us to get into recovery via a simple keystroke. I've actually got it written but need to test it. Testing it would not be dangerous as it would normally boot the stock kernel/init.
Next week when I'm home I'll try to find a tester since I cannot test it (can't write anything to my mmcblk0)
This shouldn't be dangerous to test.
Sent from my SCH-I545 using Tapatalk 4 Beta

Any news on uart? I guess I bricked my ouya.
I was testing my custom kernel, did forget to use fastboot boot instead of flash and now have nothing but a black screen. My linux machine doesn't recognize my ouya and I can't go to recovery. So at least knowing what is causing the issue would be helpful.
Do you mind giving me a short intro on uart?
I guess I need a usb/uart adapter? If yes, which one should I get?
Thanks in advance
Gesendet von meinem HTC One X+ mit Tapatalk 2

anyone already saw this: http://forum.xda-developers.com/showthread.php?t=2071626
did only have time to skimm it but might be useful to people with still working devices
aim is to get the sbk which should be - if i have understood it the right way - unique for each device as long as the company didn't burn in a fix sbk.
so maybe this will help us to save people from further bricks...as long as nvflash is usable via usb

Has anyone tested in on ouya ?
Sent from my iPad using Tapatalk - now Free

Not yet i think...i know i won't be testing it on my OUYA no time soon, i don't feel like having my box BRICKED like nchantmnt does, screw this, it's too early to test this , i wont even risk it, i dont feel like buying another OUYA for testing this...

Hey... no pain no gain
Gesendet von meinem HTC One X+ mit Tapatalk 2

I have an idea for a small usb device that could force the ouya into recovery mode using the keyboard combination mentioned below:
http://ouyabrew.com/how-to-put-ouya-in-recovery-mode/
Essentially my idea is to have a little usb circuit board with a micro controller that is smart enough to simulate a keyboard periodically sending the specified keypresses. When the ouya goes into recovery you would just yank out the dongle. I don't have any background technical knowledge in this stuff but this sounds like something Ben Heck could whip up (he is a legend).
Update: Looks like these are already a thing! this looks promising:
http://www.irongeek.com/i.php?page=...ke-dongle#So,_why_would_a_pen-tester_want_one

zondajag said:
I have an idea for a small usb device that could force the ouya into recovery mode using the keyboard combination mentioned below:
http://ouyabrew.com/how-to-put-ouya-in-recovery-mode/
Essentially my idea is to have a little usb circuit board with a micro controller that is smart enough to simulate a keyboard periodically sending the specified keypresses. When the ouya goes into recovery you would just yank out the dongle. I don't have any background technical knowledge in this stuff but this sounds like something Ben Heck could whip up (he is a legend).
Update: Looks like these are already a thing! this looks promising:
http://www.irongeek.com/i.php?page=...ke-dongle#So,_why_would_a_pen-tester_want_one
Click to expand...
Click to collapse
this is a sweet idea, i wasn't aware of a programmable HID USB keystroke dongle...This would make things easier...i hope someone makes something out of this, this will solve the booting into recovery bigtime!!!

zondajag said:
I have an idea for a small usb device that could force the ouya into recovery mode using the keyboard combination mentioned below:
http://ouyabrew.com/how-to-put-ouya-in-recovery-mode/
Essentially my idea is to have a little usb circuit board with a micro controller that is smart enough to simulate a keyboard periodically sending the specified keypresses. When the ouya goes into recovery you would just yank out the dongle. I don't have any background technical knowledge in this stuff but this sounds like something Ben Heck could whip up (he is a legend).
Update: Looks like these are already a thing! this looks promising:
http://www.irongeek.com/i.php?page=...ke-dongle#So,_why_would_a_pen-tester_want_one
Click to expand...
Click to collapse
This would only work if the stock kernal is installed and the recovery partition is intact. If you lose you recovery partition you won't be able to boot recovery and get adb working, and if the kernel isn't the stock kernel the keyboard combo won't work.

Also no use for broken init
Gesendet von meinem HTC One X+ mit Tapatalk 2

cronikman84 said:
Not yet i think...i know i won't be testing it on my OUYA no time soon, i don't feel like having my box BRICKED like nchantmnt does, screw this, it's too early to test this , i wont even risk it, i dont feel like buying another OUYA for testing this...
Click to expand...
Click to collapse
I don't think that this necessarily means bricking your device.
You could always try fastboot boot patched kernel and then try reading fuse values.
I was playing with this method to run Debian:
http://tuomas.kulve.fi/blog/2013/09/12/debian-on-ouya-all-systems-go/
It is an easy procedure and I've got it running. Unfortunately my USB hub is not working correctly with ouya (it's passive so voltage on USB can be low), so I didnt login into it, but you could use this method to try to extract sbk keys.
Sent from my iPad using Tapatalk - now Free

nvflash
How About this : http://forum.xda-developers.com/showthread.php?t=2455927 ????

we first need to know if we do have a "masker sbk" or a device specific sbk.
for device-specific sbk this methode should work but only with a wheelie-enabled recovery for our device
don't try to flash any other recovery to your device or you're in danger of bricking it.
if you have access to the source and can add the required option for generating blob files to a working recovery image, then this should work for device specific sbks.
then you can use any uart-adapter/raspberry pi/etc. to connect to your device and make backup and flash partitions.
(NOTE: DO NOT USE YOUR PCS SERIAL OUTPUT - IT MIGHT DAMAGE YOUR DEVICE AND YOUR PC AS WELL... OH AND IT WILL NOT WORK)
if we do have any kind of masker-sbk i can only talk in theory:
you normally should be able to read out sbk from running system but this is of course prevented (in most cases by some kerner config).
i don't know exactly by what methode and what files exactly to change but I have read somewhere that you could make a custom kernel which doens't prevent read out of sbk. then fastboot boot boot.img, read out sbk and sould be good to go.
but praxis might be a good bit harde
... or maybe blob mehtode might work.
got important exams tomorrow but if anyone could send me link to wheelie-enabled n7 recovery i might take a look the next days.
maybe recovery-devs could make something out of it even earlier

[Q] XT890's Medfield SoC architecture

(I know this thread maybe should belong to Development forum, but I'm posting here since I don't have enough posts to discuss there yet)
I'm in the second year of Computer Science, being a dynamic/interpreted languages programmer for over 6 years now, C/C++ for 2 years.
I have a solid understanding on the x86 PC architecture: interrupts, buses, etc. I'm pretty good at basic x86 assembly... Been studying UEFI for over a month... Whatever.
I've lost the past couple hours searching but didn't find anything on the architecture of our device. Is the "Bootloader" here compared to a BIOS? Or is it like any PC bootloader (MS-DOS, Windows, Linux bootloaders). Is there anything like a BIOS at all or does the OS, once booted, manages all the hardware interrupts by itself? Can I use INT 10H on XT890? Is it ANYTHING close to the PC architecture?
PCI, ISA, (parallel and serial) "ports" managed by a chipset between the peripherals and the x86 core itself?
Ok, it's x86. Once the system has booted, we can call x86 instructions, ok... But what is under that? Is there any reference on this? How can I boot my own code, if it's not Linux?
I really got nowhere trying to learn about the architecture underneath Android and Motorola's Bootloader on Medfield. Found nothing on Intel nor Motorola websites. What am I doing wrong?
Thanks in advance!

I'm studying this myself but there is a lot that i need to learn. Check those to see if helps.
http://bootloader.wikidot.com/android
http://elinux.org/Android_Booting
http://www.ibm.com/developerworks/linux/library/l-linuxboot/

I would like more info about the RAZR I as well, considering it's the only mainstream phone with a x86 processor I'd expect more documentation about it, I am receiving a RAZR I soon.
For what I know, it's boot process is similar to other Android devices, it loads and decompresses a boot.img file that includes a ramdisk and the kernel, you should be able to load another non-linux OS by chainloading a secondary bootloader there, I honestly would like to see more development on the Razr i, specifically to get native Gnu-linux with x11 running

Using @thiagomtl's links, I was able to understand a little more about the Boot process. XT890 seems to have basically the same mechanics of the ARM ones, but x86 tuned.
However I'm yet to understand the differences between "normal" Linux bootstrapping and the Android Bootloader's one.
On a average legacy Linux box we have GRUB/LILO on the MBR. Making a hell of a simplification here: The user turns the PC on, BIOS does the POST and then loads whatever code is on the MBR. GRUB is a very small program there, which simply loads a driver for the storage device, loads vmlinuz and the f*ing ramdisk on the memory and executes it (effectively by simply pointing the IP to the address where the kernel is on the memory).

Samuelgames said:
I would like more info about the RAZR I as well, considering it's the only mainstream phone with a x86 processor I'd expect more documentation about it, I am receiving a RAZR I soon.
For what I know, it's boot process is similar to other Android devices, it loads and decompresses a boot.img file that includes a ramdisk and the kernel, you should be able to load another non-linux OS by chainloading a secondary bootloader there, I honestly would like to see more development on the Razr i, specifically to get native Gnu-linux with x11 running
Click to expand...
Click to collapse
But the Boot process is just a part of my original question. Ok, a important one, but a part.
What about the structure of the device? How it's all implemented? Is the display using plain old VESA VBE? Are the input devices PS/2? USB? Is the power implemented using ACPI standards? lol

As far as I'm concerned Atom SoC doesn't respect many industry standards for the architecture, even for those who run Windows 8, buttons on the Razr I should be naturally be defined as GPIO as the notification LED, I don't think the display respects VESA standards (SGX 540 can't even do scaling) but it should fallback to them at some extent depending on how you initialize the framebuffer.
All of this should be in the Motorola kernel, I haven't taken a look at it but I'll surely will once I get my phone

@Hazou, @YaPeL, @Omar-Avelar
you guys know anything about this?

Ok this is all i know about it by searching through the code and internet and by finding out myself (no sources included, just my memory). It's all linux, nothing like Windows.
Kernel:
We indeed are making a x86 kernel, but not for normal PC's. We use the mid-x86 implementation within the x86 code of the kernel. (arch/x86/platform/mid-x86) MID is the intel word for all the socs for mobile platforms intel is using. The normal upstream linux doesn't provide all the necessary code. And is has changed with the new android version 4.4.2 for our device.
Boot sequence:
The android devices use some sort of bootloader. Droidboot. Droidboot includes the fastboot commands and starts the bringup of the android system. You can read about it on the internet. In most devices (ARM) it is the first thing thats get called for.
Our intel device is a little different. Before the droidboot gets loaded the firmware of the device loads another OS. Also called POS (i think preprocessor OS, or something). Those gets updated with the dix and efwi(wrong name) files we got. The POS can be accessed by booting in the medfield download through the camera button, if i am correct. The POS then loads the droidboot which will in turn load the rest, like a linux device which loads from the bootloader.
The partition layout can be found in the gpt.bin. It can be flashed through fastboot and can change every partition afaik.
So the boot order is:
1. POS/RADIO
2. DROIDBOOT
3. BOOT.IMG is like linux. First the kernel then the ramdisk with the kernel modules.
4. ANDROID
To comment about the JB implementation.
We can build our own kernel and we can, if we want and take the time, upgrade the kernel to the newest version (for android is that 3.10, but we should be able to manage to go fully upstream 3.17). But that takes a lot of time.
I also noticed that, from what i heard, some kernel modules specific for our device has changed and now the kernel that we have can't load the new firmware files in 4.4. So we will need the next kernel from Moto to compile our own when 4.4.2 is released. Those changed are not upstream.

Hazou said:
The POS then loads the droidboot which will in turn load the rest, like a linux device which loads from the bootloader.
The partition layout can be found in the gpt.bin. It can be flashed through fastboot and can change every partition afaik.
So the boot order is:
1. POS/RADIO
2. DROIDBOOT
3. BOOT.IMG is like linux. First the kernel then the ramdisk with the kernel modules.
4. ANDROID
Click to expand...
Click to collapse
This is the most interesting part for hundreds of us. Is there a way we can find what sectors are used for the pos so we can possibly repair code corrupt?
I have a feeling the gpt is messed up so any amount of writing to the dnx or ifwi will be in the wrong location.
I can't find any information on this phone at all.
I think it's time I bought a spare mobo and dumped everything to compare a broken to working

Flacid Monkey said:
This is the most interesting part for hundreds of us. Is there a way we can find what sectors are used for the pos so we can possibly repair code corrupt?
I have a feeling the gpt is messed up so any amount of writing to the dnx or ifwi will be in the wrong location.
I can't find any information on this phone at all.
I think it's time I bought a spare mobo and dumped everything to compare a broken to working
Click to expand...
Click to collapse
If i am correct they are present on the partition layout of the phone. I just don't know wish ones are the right ones. Never looked good enough at that.
Also to repair the gpt and write the dnx or ofwi to the right location u need a dd command or flash command with the right parameters. The flash command most likely won't work because of the gpt partition and the DD command wont either because most of the time u don't have access to a recovery anymore.
But my knowledge about this is limited, so if u dare to put your phone on the line and have maybe the knowledge and skills to do what some people need, please do I can't and need my phone working

Hazou said:
If i am correct they are present on the partition layout of the phone. I just don't know wish ones are the right ones. Never looked good enough at that.
Also to repair the gpt and write the dnx or ofwi to the right location u need a dd command or flash command with the right parameters. The flash command most likely won't work because of the gpt partition and the DD command wont either because most of the time u don't have access to a recovery anymore.
But my knowledge about this is limited, so if u dare to put your phone on the line and have maybe the knowledge and skills to do what some people need, please do I can't and need my phone working
Click to expand...
Click to collapse
Skills/knowledge = limited. I'm no programmer but I take information in like a 100 petabyte SSD.
My phones knackered, I'm trying to fix it but it's not easy! If it's fixed, I'll break it again to make sure the fix works :good:
It's going to be a long road, there is zero success since the first report of code corrupt.
As you say, I need the right param. There's almost no information about it anywhere and what information is about is very fragmented.
I'll keep you updated

Flacid Monkey said:
Skills/knowledge = limited. I'm no programmer but I take information in like a 100 petabyte SSD.
My phones knackered, I'm trying to fix it but it's not easy! If it's fixed, I'll break it again to make sure the fix works :good:
It's going to be a long road, there is zero success since the first report of code corrupt.
As you say, I need the right param. There's almost no information about it anywhere and what information is about is very fragmented.
I'll keep you updated
Click to expand...
Click to collapse
I am almost certain it can be fixed as long as it is a software failure (some maybe have a hardware failure). As this seems one of them it should be fixable as long as your BL is unlocked. With a locked bootloader u don't stand any chance (nah, maybe with medfield flasher, but that one is also limited).
Take a look at the acer padphone or something. Dunno how it is called exactly. Is also uses the intel SOC and makes use of the medfield flasher.
I never had a phone thats corrupt so can't say much about it, but i can help with thinking my way through. If u have that problem can u boot in fastboot or is that even impossible? I know we can flash the POS and fastboot through xfstk. So with the right combination it should work. And if not we can try flash the modem as extra if that is possible. But do know it can hard-brick the device (modem, lowest thing of the device) of-course, aldo u don't have much choice now
Another thing, because fastboot (and even recovery) can flash the dix, ifwi and bootloader files. I 'assume' xfstk (that can also flash the ifwi, dix and bootloader) can flash the whole emmc with indeed the right parameters. We have the source code of the fastboot/recovery ifwi, dix and bootloader flasher. Also called update_osip.
So think it out, i will wait and see.

uart console
Has somebody tried to access a uart console on our razr-i? would be nice for debugging.
Intels datasheet says the board has 3 uart ports. http://ark.intel.com/products/70097
I hope one uart port can be accessed via usb or audio jack. Like on this device: http://forum.xda-developers.com/showthread.php?t=1081743
Or is it only possible with opening the phone and looking for jtag pins?

How To Unbricked A Hard Bricked Phone [ Moto X ]

How To UnBrick A Hard Bricked Moto X​
Hii , First of all I wanna thanks to this awesome scrpit by @s5610 who brought my phone from dead to alive , I think i am the first guy to unbricked the hardbricked phone using this script lol , My phone was hardbricked because i was testing my kernel and entered wrong path in partition due to which i got hard bricked i was worried for my phone , Service Center was asking for 7k in Indian Rupees , i was hopeless then i gave a try to this method , followed all steps written here and then finally i entered to fastboot menu of 30.B7 Kitkat As i was using 30.B7 Bootloader earlier and then i flashed My gpt.bin and S-partition and flashed my stock rom voilla !! and my phone booted the aim was to share this post was this method was on page 42 and only less guys have seen this post , so i created a new thread regarding this
All Credits Goes to - @s5610​
s5610 said:
Unbricking Guide for any Moto X Gen 1 (wire trick)​
Download, and unpack supplied zip to any disk, C: or D:, in root folder. Install driver by launching Qusb.drv.inst.msi, then open Windows' Device Manager, and see if you got "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
If yes, you see it, go to software part below. If it's not there, a full disassemble of the phone is needed to get close to back side of motherboard (google for "iFixit Teardown Moto X Guide" for step-by-step instruction).
So, when you are inside, disconnect the battery first. No need to pull it out, it's glued. Now get to back side of motherboard, and very very gently gain access to the lower left corner of ARM+DRAM shield (see picture). I've done it with Stanley knife. Also you can use miniature nippers - but very carefuly! Once you get access to inner space of shield, use tiny wire to short special pin to the ground (see picture), then connect USB cable, and in the moment when you see "QHSUSB_DLOAD" device (or "Qualcomm HS-USB QDLoader 9008" if driver is installed) pop out in Windows' Device Manager, quickly remove the wire. The goal is to have "Qualcomm HS-USB QDLoader 9008" in "COM & LPT ports" section of Device Manager. If it is achieved, we are done with hardware, and move on to soft part.
Now software part. Go to unzipped C:\Python27 folder, launch bat-file, and wait until finish:
RUN_blank_bootloader_flash.bat
(if you got error like "No data read from USB..." etc, just skip to next step)
Next launch either
- .Boot_KK_4.4.2_B4.exe,
or .Boot_KK_4.4.4_B7.exe,
or .Boot_LP_5.0.2_BC.exe,
or .Boot_LP_5.1.0_BD.exe,
or .Boot_LP_5.1.0_BE.exe
- depends on Android version your phone has last time. If you don't know what you need, begin with first one.
Wait 10 seconds, then launch next bat-file, and wait until finish:
RUN_moto_x_bootloader_flash.bat
Phone should go into fastboot mode! If it doesn't, repeat previous step trying higher version. But don't try to flash BC, BD, and BE, if you didn't install Lollipop on this phone!
OK. Disconnect the USB cable, connect the battery, connect again USB cable (fastboot don't work, if don't see battery). Launch next bat-file:
RUN_gpt.bin_flash.bat
The phone will get in fastboot, ready to be flashed by appropriate firmware. If it is official RSD (SBF), delete from xml strings consisting gpt.bin and motoboot.img for safe flashing.
...
Download link: http://www.mediafire.com/download/3e38rr3wy28s071/Moto.X.Unbrick.zip
This guide was brought to you by s5610
Links that this guide is based on (where I took files and general idea):
http://forum.xda-developers.com/droid-ultra/general/droid-ultra-maxx-brick-recovery-t2830806
http://forum.xda-developers.com/mot...-moto-x-t2629057[/url[/QUOTE][/QUOTE][/QUOTE]
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Click to expand...
Click to collapse

Not sure if additional thread is necessary )
UPDATED
The best resurrection method for Moto X is here.

Can Someone re-upload that file? Thanx!

Please upload the mediafire link...
Plz plz.. I have bricked my phone. It seems that this procedure will work for me. Please upload and save my life.

even i have bricked my moto x...need a working download link..please.

https://drive.google.com/file/d/0B3EDzuzDCakzdWxHa2RWVDJhRXc/view?usp=sharing

Cannot install qsub.drv.inst.msi on my windows 10...says failed to attribute and failed to delete qcusbser.sys.

Thanks

Can we write the full firmware through Qload 9008 mode ???

HI I have a question. I bricked my gf's phone while trying to unlock the bootloader and I am not able to turn the phone on. Only positive feedback is that when I plug it in to the computer, I can hear a notification on my computer. I followed your guide. I can see the "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
Then I followed your software instructions. When I run the RUN_blank_bootloader_flash.bat, I get the following
Code:
Starting qflash!
Executing command qflash.exe -com3 -ramload MPRG8960.hex -mbn 33 MSM8960_bootloa
der_singleimage.bin -v -o
Motorola qflash Utility version 1.3
qflash - com3 is an invalid port
Invalid COM port enteredBlank flashing successful
Device will now enumerate in fastboot mode
Then, I followed the rest of the instructions by trying each .Boot .exe and waitng 10 seconds and finally with RUN_moto_x_bootloader_flash
but I am getting the following error.
Code:
C:\Users\cxx\Desktop\Python27>python qdload.py MPRG8960.bin -ptf _boot\partiti
ons.txt -pt
QDLoad utility version 1.2 (c) VBlack 2014
Found TTY port: com3
Traceback (most recent call last):
File "qdload.py", line 815, in <module>
main()
File "qdload.py", line 762, in main
tty = openTTY(args.ttyPort)
File "qdload.py", line 174, in openTTY
tty = serial.Serial(port=tty_path, baudrate=115200)
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 38, in __init
__
SerialBase.__init__(self, *args, **kwargs)
File "C:\Python27\lib\site-packages\serial\serialutil.py", line 282, in __init
__
self.open()
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 66, in open
raise SerialException("could not open port %r: %r" % (self.portstr, ctypes.W
inError()))
serial.serialutil.SerialException: could not open port 'com3': WindowsError(2, '
The system cannot find the file specified.')
C:\Users\cxx\Desktop\Python27>pause
Press any key to continue . . .
please help.
Thanks.

Device Shows As USB Input
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks

shengslogar said:
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks
Click to expand...
Click to collapse
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.

liveroy said:
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.
Click to expand...
Click to collapse
Will do! I think I did try charging it awhile ago, but I'll give it another shot.

can my phone be unbricked?? here is the error log:
RAMLOADER VERSION: PBL_DloadVER2.0
------------------------------------------------------
DEVICE INFORMATION:
------------------------------------------------------
Version : 0x8
Min Version : 0x1
Max Write Size: 0x600
Model : 0x90
Device Size : 0
Description : Intel 28F400BX-TL or Intel 28F400BV-TL
------------------------------------------------------
Using passed in packet size, changing from 0x600 -> 0x600
EXTENDED_LINEAR_ADDRESS_REC @ 0x2a000000
Write 65536 bytes @ 0x2a000000
100EXTENDED_LINEAR_ADDRESS_REC @ 0x2a010000
Write 11840 bytes @ 0x2a010000
100START_LINEAR_ADDRESS_REC @ 0x2a000000
EOF_REC
Sleeping for 3s
sdl_hello() - Invalid response: 7e030003331b7e
sdl_hello() - This is a NAK response from ROM code, which means the device has
een reset back to blank flash mode. Usually this is caused by power supply issu
s. Please try again with battery eliminator if it persists
Unexpected target reset, bailing out after 2 retries

I am trying to install the drivers and it will show up as qhsusb_dload for about 5 seconds then reverts back to Relink HS USB QDloader 9008. Should i try the wire trick? It will say that the Qhsusb drivers are installed but always changes.