Golf MK7 Discover Pro Hack possible? - Connected Car

Hello everyone, hope I'm posting in the right place!
I own a VW Golf MK7 with the Discover Pro media system.
Recently I found a copy of the update package for it, and dabbling inside I found out a ton of cool info.
It's based ona Tegra 2 platform, and runs QNX 1.2b. There seems to be a way to telnet to the system somehow. Inside the files I found a ton of stuff, like what seems to be the user and root passwords?
Code:
root:x:0:0::/root/:/bin/sh
user:x:100:100::/eso:/bin/sh
nopasswd root::0:0::/root/:/bin/sh
user::100:100:FTP User:/eso:/bin/sh
group root:x:0:
user:x:100:user
root:f7otIPwQDbHLw:1320853303:0:0
user:6TfLBY3WGivFU:1324310912:0:0
ffs3.1ver #DATUM 2037
I don't know much about QNX, maybe someone can help and something can be done? Unlocking Mirrorlink? Unlocking other features? Installing apps? Installing android on it since it's Tegra 2 Based?
Thanks for the time and help!

I made some progress, I was able to extract files from the .ifs partitions and from the app.img partition, which is the largest 700mb one.
Seems that the entire google maps and google earth, plus street view, are all there waiting to be enabled for those who don't have it. Also, there is a browser, and a lot of other apps.
I also discovered a possible vector of entrance:
Code:
[SWDL_MEDIUM]
Callout = FNAME_MATCH
Argument = /metainfo2.txt
Match Rule = MediumInserted
Fail Rule = SW_UPDATE
[SW_UPDATE]
Callout = FNAME_MATCH
Argument = /mib_flashall
Match Rule = MediumInserted
Fail Rule = IOC_UPDATE
[IOC_UPDATE]
Callout = FNAME_MATCH
Argument = /V850app.bin
Match Rule = MediumInserted
Fail Rule = COPY_SCRIPT
[COPY_SCRIPT]
Callout = FNAME_MATCH
Argument = /copie_scr.sh
Match Rule = MediumInserted
Fail Rule = MIXED_DATA
I guess that's the name of the file it looks for on the SD and what action it takes based on what file it finds.
I could really use some QNX or even linux experts on this....

Sorry for the late reply... but you inspired me some time ago to start digging into this.
I've built a serial cable to connect into the back of the Discover Pro MIB1 unit, and now I've got root access to the unit. So far I haven't been able to enable SWAP features, but I did make some changes to the Green Engineering Menu, that allow me to set stuff and run scripts from SD again.
I also enabled WLAN hotspot on the Non-telephone-capable unit, but I haven't been able to put it into WLAN Client mode yet... that's another hurdle for an other time, I guess. Enabling wlan unhides the Google Earth and online services checkboxes in the navigation, but since it doesn't have any connection yet... it doesn't do much.
I would love to exchange thoughts and experiences about this device!!

My Discover Pro is broken (right channels don't work anymore) and there will be no support from VW, so I am up to play around with the unit.
@Chillout: Did you connect your terminal cable to the PCI-E like looking connectors? Which voltage do you need?

Hi!
Nice to see some interest here.
The PCIe style connectors are for JTAG and flashing for MMX/ Jacinto 5/ V850 cpus.
The serial consoles are on the back side of the unit on the big black connector (quadlock)
The serial is normal 115200 8 bit mode.
See the picture attached, you will need to connect on ESO_C3_RX and ESO_C3_TX for MMX
For Jacinto 5 you should use the J5_TX and J5_RX
password for emergency console is harman_f
@lionheartk How do you extract / mount app.img file?
Cheers!

Discover Media console
Hi!
By any chance do you know how it is working in a T6 MIB2 Discover Media (not pro) unit (made by Technisat)? Are the pinouts the same? And do you know the password for the emergency console for this as well?
radux.m.dan said:
Hi!
Nice to see some interest here.
The PCIe style connectors are for JTAG and flashing for MMX/ Jacinto 5/ V850 cpus.
The serial consoles are on the back side of the unit on the big black connector (quadlock)
The serial is normal 115200 8 bit mode.
See the picture attached, you will need to connect on ESO_C3_RX and ESO_C3_TX for MMX
For Jacinto 5 you should use the J5_TX and J5_RX
password for emergency console is harman_f
@lionheartk How do you extract / mount app.img file?
Cheers!
Click to expand...
Click to collapse

horacos said:
Hi!
By any chance do you know how it is working in a T6 MIB2 Discover Media (not pro) unit (made by Technisat)? Are the pinouts the same? And do you know the password for the emergency console for this as well?
Click to expand...
Click to collapse
Hi!
The MIB2 made by Technisat is completely different from software point of view. You need to figure out the UART pins, I don't think they are the same.

Fine, many thanks for sharing this! I'd like to play with my unit, but I think blindly checking the pins by connecting them to a uart port are not a good idea Do you have any hint on how should I start? What kind of software/hardware it is based on?

Hi!
You will need to open the unit and take a look on the PCB.
The unit is build around a iMX6 for HMI and Jacinto 5 for radio control. The operating system is still QNX
If you post some pictures with PCB I might be able to give you some hint.

radux.m.dan said:
Hi!
You will need to open the unit and take a look on the PCB.
The unit is build around a iMX6 for HMI and Jacinto 5 for radio control. The operating system is still QNX
If you post some pictures with PCB I might be able to give you some hint.
Click to expand...
Click to collapse
For first I'd like to avoid opening the unit, so I rather tried to use the pins marked as J5_TX, J5_RX and GND on your attached pic to hook to a serial port-usb cable. I've opened a terminal configured to 115200, 8N1, and below is a sample what I've got from it:
Code:
úçůąÁ˙˙ůíŃ÷˙ýýž
˙˙ď^ąÁ˙˙ůíŃ÷˙ýý˝
˙ńóÍ}úçůąÁ˙˙ůíŃ÷˙ýý|0lp˙˙˙^ąż˙˙ůíŃ÷˙ýýžűű˙˙^ąż˙˙ůíŃ÷˙ýýßąż˙3ż=żIc!żżżEżW[}yušem{_]AWYwA_Q[yAAuU[ëž_űűĺ˙|?˙˙˙ß˙˙ż˝ĐţůíŃ÷˙ý˙×ţý˙˙˙˙í˙˙˙˙˙˙˙˙˙ý˙˙˙ý˙˙˙˙˙˙˙˙˙˙˙˙˙ł˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ďýű˙ű˙?U_âń˙{ěď˙űö÷˙ú÷Uc˙|oc˙˙úń˝˙c˙˙í÷úń˝˙c˙˙Ď˙|oc˙˙ËÁ|oc˙˙ëőú÷a˝úí˙űv˙˙úóó˙ýúóu˙ýúí×I?Űoů!˙˙˙
9öÝS{Ď˙Ďé
*÷öÝM˝ż˙˙˙˙˙˙˙˙ý˙xúíöÝłżž˙˙˙˙˙˙˙ýxöÝM˝ż˙˙˙˙˙˙˙˙ýxöÝfż˙˙{˙˙˙˙˙˙ýxöÝąó˙˙˙xöÝ_ĹUý˙˙˙˙˙˙˙˙ý xö"ýxöÝcşýműąß˙˙˙˙˙ýxöÝÝ{ëďëá˙˙ű˙á˙ż÷Ňł˙ń?˙˙˙˙˙˙˙űűá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űůá˙ż÷Ň˙˙˙˙˙˙˙˙˙űőá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űńá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űďá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űëá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űçá˙ż÷Ň˙˙˙˙˙˙˙˙˙űăá˙ż÷Ň˙˙˙˙˙˙˙˙˙űáá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űÝá˙ż÷Ň˙˙˙˙˙˙˙˙˙űŮá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ű×ᯜÓőIoÝśŃ×I?o˙ßÍó;<eOńöß˙˙˙˙˙˙˙˙˙űÍß˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űÉá|gżÜ_˘6řú×űĹ×I?e˙˙Ýďýű˙˙˙˙ű÷öÝmş{Č/~˙˙˙˙űöÝŮ×˙˙˙˙˙˙˙˙˙˙űxöÝÝ[ëëëá˙˙űxöÝsś˙˙˙˙˙˙˙űxöÝ~âţ˙˙˙˙˙ů˙§˙űxöÝßâţ˙˙˙˙˙űó?űxöÝßâţ˙˙˙˙˙ů˙§˙űxöÝ~bo˙ýßĹ˙űxöÝßbo˙ýßĹ˙űxöÝ´şß_7ů˙˙˙˙˙ű}xöÝéďýąý˙ÝűűyxöÝM~l˙˙˙˙˙˙˙˙űwxö˙˙ýż˙ż÷Oţ˙˙˙˙˙÷ý§˙űoxöÝßâţ˙˙˙˙˙÷ý§˙űkxöÝMžű˙˙˙˙˙˙˙˙űixö˙˙ýżF˙ż÷2ą˙˙˙˙˙˙˙˙˙˙˙űaxöÝM˝ż˙˙˙˙˙˙˙˙ű_xöÝ˝żîoÝU]őU˙˙˙ű[xöÝŰĎUUKU˙ů˙˙˙˙űWxöÝśżneU˙ů˙˙˙űSxöÝlżnďăă]÷öÝßâţ˙˙˙˙ýŰă˙űxöÝ~âţ˙˙˙˙ýŮ÷˙ů˙á˙ż÷rOţ˙˙˙˙ýŮ÷˙ůűá˙ż÷ŇUľů˙˙˙˙˙˙˙˙ůůá˙ż÷Oţ˙˙˙˙ý×ů˙ůőá˙ż÷rOţ˙˙˙˙ý×ů˙ůńá˙ż÷Oţ˙˙˙˙ýŐé˙ůíá˙ż÷rOţ˙˙˙˙ýŐé˙ůëá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůçá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůăá˙ż÷ňM_ű˙˙˙˙˙˙˙˙ůáá˙ż÷ŇM˙˙ý~wxöÝMşű˙˙˙˙˙˙˙˙ůŮá˙ż÷˛M˙˙ý˙˙˙˙˙ůýůŐá˙ż÷Oţ˙˙˙˙ýÓé˙ůÓá˙ż÷rOţ˙˙˙˙ýÓé˙ůĎá˙ż÷rŰ˝UUKU˙ů˙˙˙˙ůËá˙ż÷2Ű˝ŤŞ]˙ů˙˙˙ůÉá˙ż÷ňŰ˝UUUŐż˙ůĹá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůÁá˙ż÷Ň˙˙˙˙˙˙˙˙˙ů˝á˙ż÷ňYű×˙~ˇ˙ż÷ňY~˙~[˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůłá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙ůąá˙ż÷ňYž˙˙~kxöż˙˙˙˙˙˙˙˙˙ůŠá˙ż÷ňY}˙˙~ixöż˙˙˙˙˙˙˙˙˙ůŁá˙ż÷ňYß˙˙á˙ż÷ňYźď˙˙˙ýýýý˙ůá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůá˙ż÷Oţ˙˙˙˙ýŃé˙ůá˙ż÷Oţ˙˙˙˙ýĹŰ˙áŻ{őIoÝ{×I?o˙ßÍó;<ŮĎńöÝ}âţ˙˙˙˙˙ő˙Ż˙ůwß˙ż÷rOţ˙˙˙˙ýŃé˙ůsá˙ż÷rOţ˙˙˙˙ýĹŰ˙ůoá˙ż÷2Oţ˙˙˙˙˙ő˙Ż˙ůká˙ż÷2÷Ďńů˙˙˙˙˙ůiá˙ż÷ňďýů˙˙˙˙ůeá˙ż÷2÷Íďů˙˙˙˙˙ůaá˙ż÷ňďý˙˙˙˙˙ů_á˙ż÷2÷Ëíů˙˙˙˙˙ů[á˙ż÷ň_˙˙˙˙˙ůWá˙ż÷Oţ˙˙˙˙ýĂ7˙ůSá˙ż÷rOţ˙˙˙˙ýĂ7˙ůQá˙ż÷Oţ˙˙˙˙ýÁ7˙ůMá˙ż÷ROţ˙˙˙˙ýĹŰ˙ůIá˙ż÷rOţ˙˙˙˙ýÁ7˙ůGá˙ż÷2Oţ˙˙˙˙ýĹŰ˙ůCá˙ż÷ňł˙˙˙˙˙˙˙˙˙˙˙ů?á˙ż÷Oţ˙˙˙˙ýż5˙ů;á˙ż÷rOţ˙˙˙˙ýż5˙ů9á˙ż÷Oţ˙˙˙˙˙7˙š˙ů5á˙ż÷rOţ˙˙˙˙˙7˙šőů1á˙ż÷2÷Éëů˙˙˙˙˙ů/á˙ż÷ňďýý˙˙˙˙ů+á˙ż÷O~\˙˙˙oĂ˙ů'á˙ż÷rO~\˙˙˙oĂ˙ů#á˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ů!á˙ż÷2÷Çéů˙˙˙˙˙ůá˙ż÷ňďýű˙˙˙˙ůá˙ż÷O~\˙˙˙kÓ˙ůá˙ż÷rO~\˙˙˙kÓ˙ůá˙ż÷O~\˙˙˙=ůá˙ż÷rO~\˙˙˙=ů
á˙ż÷Oţ˙˙˙˙˙5˙Ű˙ů á˙ż÷rOţ˙˙˙˙˙5˙Ű˙ůá˙ż÷r˙˙˙˙˙˙˙˙˙˙˙ůá˙ż÷2Ű*ŤŞ]˙Uő˙˙˙ůýxöÝ~âţ˙˙˙˙˙3őůűxöÝ~âţ˙˙˙˙˙1ýŻů÷xöÝßâţ˙˙˙˙˙3őůóxöÝ~âţ˙˙˙˙˙/˙˙ůńxöÝßâţ˙˙˙˙˙1ýŻ}~;xöÝ~âţ˙˙˙˙˙-ý×ůéxöÝ~âţ˙˙˙˙˙+ű?˙ůĺxöÝ~âţ˙˙˙˙˙)˙żůăxöÝ~"Çý˙˙˙]ůßxöÝßâţ˙˙˙˙˙/˙˙ůŰxöÝ~âţ˙˙˙˙˙%˙É˙ůŮxöÝßâţ˙˙˙˙˙-ý×ůŐxöÝ~âţ˙˙˙˙ý˝÷˙ůŃxöÝßâţ˙˙˙˙˙+ű?őůÍxöÝ~âţ˙˙˙˙˙#÷˙˙ůËxöÝßâţ˙˙˙˙˙)˙żůÇxúŰ˙ůŻ÷öÝßâţ˙˙˙˙˙%˙É˙ůŤxöÝ~âţ˙˙˙˙˙ýůŠxöÝßâţ˙˙˙˙ý˝÷˙ůĽxúďőůxöÝßâţ˙˙˙˙˙ý}~H˙ż÷rOţ˙˙˙˙˙˙őů
xöÝßâţ˙˙˙˙ýíőůxöÝߢ˙-˙Ő˙ů}xöż˙˙˙˙˙˙˙˙˙ůyxöÝY}˙˙~G˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůsxöż˙˙˙˙˙˙˙˙˙ůoxöż˙˙˙˙˙˙˙˙˙ůmxöÝ´żőő×ůM]˘J˙ń˙˙˙˙őŐőł÷ÁöÝ_˙˙˙˙˙ůI÷öÝ´şßß
ů˙˙˙˙˙ůExöÝéďý˛oÝűůCxöÝ´şß_űů˙˙˙˙˙ů?xöÝďýý˙˙˙˙ů;xöÝ´şßßëů˙˙˙˙˙ů7xöÝďýű˙˙˙˙ů5xöÝ´şß_Űů˙˙˙˙˙ů1xöÝéď˙ýůoŰűů-xúď˙÷˙˙˙˙÷)˙ż÷ˇIŃń˙˙˙˙˙÷)˙ż÷ňűIŃ˙˙˙˙˙˙˙˙÷'öÝcşý§ç˙˙˙˙˙˙˙÷˙ż÷ŇÓ÷ý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓűý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓýýĽů˙˙˙˙˙˙˙÷˙ż÷Rą/~!˙˙˙˙˙÷˙ż÷r6×˙˙˙˙˙˙˙˙˙˙÷˙ż÷ý˙˙˙˙˙˙˙˙˙÷˙ż÷ŇÓőý§˙˙˙˙˙˙˙˙őý˙ťVű˙Iiř˙˙ç˙˙˙ď÷őŮÝVű˙I?ińŠ˙˙˙˙óßőľ÷
öÝcş_Ľ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓűýĽ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓýýŁů˙˙˙˙˙˙˙ő÷˙˙ż÷6÷Ľý˙˙˙˙
I've tried with other speeds (less than 115200), but the result is similar. Maybe it is sending an inverted tx signal?

FInally serial output
Hi All,
Now i've tried to connect to port ESO C3_TX and RX, and finally i was able to see some understandable output (See below)
But do you know how shoudl I access any shell on it? I tought it provides a prompt to enter the password, but it doesn't. it rather seems to be a one direction logging console.
Any idea?
Thanks!
Code:
J5e.imx6.start: 0x01CCEB6D
-Welcome to TechniBoot-
SVN Rev: 490082
J5e.M30.LoadImage.ready: 0x03EE913A
J5e.M31.LoadImage.ready: 0x04CBAAAC
J5e.QNX.LoadImage.ready: 0x1D5A82BD
CPU0: L1 Icache: 512x64
CPU0: L1 Dcache: 512x64 WB
CPU0: L2 Dcache: 4096x64 WB
CPU0: VFP-d32 FPSID=410330c3
CPU0: NEON MVFR0=11110222 MVFR1=00011111
CPU0: 413fc082: Cortex A8 rev 2 600MHz NOALIGN
Loading IFS...done
System page at phys:83fe0000 user:fc404000 kern:fc404000
Starting next program at vfe05145c
cpu_startnext: cpu0 -> fe05145c
VFPv3: fpsid=410330c3
coproc_attach(10): replacing fe0815b0 with fe080d6c
coproc_attach(11): replacing fe0815b0 with fe080d6c
Welcome to QNX Neutrino on the Texas Instruments J5 ECO MIBSTD2NAV_MAIN Board (ARMv7 Cortex-A8 Core)
J5e.QNX.init.ready
Waiting for i.MX...
Thu Jan 01 00:01:00 UTC 1970
add net default: gateway 10.200.1.2
Starting tsd.mibstd2.main.root...
Current core file directory: /tsd/var/core/startup-1/main
00:01:00.926 [Info] [J5e.mcp] [FREQ:20000000]
00:01:00.929 [Info] [J5e.mcp] [PERF:0x16a0592:IO1] J5e.MCP.init.start
Start Com-Client (MAINROOT)
Start Com2M30
shm mapped to 28010000
Start Network
Create Thread
00:01:00.998 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8100f09
00:01:01.004 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051a
00:01:01.005 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051b
00:01:01.005 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051c
00:01:01.006 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051d
00:01:01.007 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051e
00:01:01.007 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051f
00:01:01.008 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0520
00:01:01.008 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0521
00:01:01.009 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0556
00:01:01.009 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0556
00:01:01.025 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x70a0067
00:01:01.026 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x70a0068
shm mapped to 28020008
00:00:00.018 [Error] [J5e.cmsg.m30] persist: (p1:p2) configuration failed status (p3). p1: 0 p2: 0 p3: 8
00:00:00.018 [Info] [J5e.mcp] Booting at Normal Mode (0, 1)...
00:00:00.053 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8100002
00:00:00.055 [Info] [J5e.mcp] [PERF:0x19d5536:IO0] J5e.MCP.init.ready
00:00:00.089 [Info] [J5e.mcp] [PERF:0x1a7c8b2:IO0] J5e.PersMaster.start
00:00:00.114 [Info] [J5e.mcp] [PERF:0x1af6181:IO0] J5e.Police.start
00:00:00.223 [Info] [J5e.mcp] [PERF:0x1d0b969:IO0] J5e.Bap.start
00:00:00.262 [Info] [J5e.mcp] [PERF:0x1dc6331:IO0] J5e.DSPStarter.start
dspstarter:
00:00:00.525 [Info] [J5e.mcp] [PERF:0x22cabdd:IO0] J5e.DSPStarter.end
dspstarter:
00:00:00.568 [Info] [J5e.mcp] [PERF:0x239d383:IO0] J5e.PersMaster.ready
00:00:00.585 [Info] [J5e.mcp] [PERF:0x23f14fb:IO0] J5e.Keypanel.start
00:00:00.619 [Info] [J5e.mcp] [PERF:0x2499719:IO0] J5e.Radio.start
00:00:01.152 [Info] [J5e.mcp] [PERF:0x2ec1003:IO0] J5e.Keypanel.ready
bap: 00:00:01.166 [Error] [J5e.Bap.tsd.communication.serializer] Serializer already registered for event 0x80e0006
00:00:01.176 [Info] [J5e.mcp] [PERF:0x2f36f0d:IO0] J5e.Bap.ready
bap: 00:00:01.190 [Error] [J5e.Bap.bap.ref.parking] 000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
bap: 00:00:01.192 [Error] [J5e.Bap.bap.ref.parking] 000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
radio: 00:00:01.559 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x3002
radio: 00:00:01.563 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x40000bf
00:00:01.579 [Info] [J5e.mcp] [PERF:0x36e4695:IO0] J5e.Radio.ready
radio: 00:00:01.632 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x14110001
00:00:01.717 [Info] [J5e.mcp] [PERF:0x398a4d4:IO0] J5e.Police.ready
ListenServer: creating new worker thread
persmaster: 15:06:56.662 [Error] [J5e.PersMaster.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998404847 endtime: 1481382416662
15:06:56.800 [Info] [J5e.mcp] [PERF:0x8aefb6b:IO0] J5e.AudioMgr.start
bap: 15:06:56.880 [Error] [J5e.Bap.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405050 endtime: 1481382416880
keypanel: 15:06:56.880 [Error] [J5e.Keypanel.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405052 endtime: 1481382416880
police: 15:06:56.879 [Error] [J5e.Police.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405032 endtime: 1481382416879
15:06:56.894 [Error] [J5e.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405079 endtime: 1481382416894
audiomgr: Audio Manager started.
radio: 15:06:57.307 [Error] [J5e.Radio.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405492 endtime: 1481382417307
audiomgr: 15:06:57.499 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x8100003
audiomgr: 15:06:57.502 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307df
audiomgr: 15:06:57.526 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x8100003
audiomgr: 15:06:57.529 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307b2
audiomgr: 15:06:57.530 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307df
15:06:57.624 [Info] [J5e.mcp] [PERF:0x9aa900b:IO0] J5e.AudioMgr.ready
15:07:03.052 [Info] [J5e.mcp] [PERF:0x1022e899:IO0] J5e.Logging.start
bap: 15:07:10.831 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCCurrentConsumption1_local: unknown unit
bap: 15:07:10.833 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bap: 15:07:10.835 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
15:07:12.550 [Info] [J5e.mcp] [PERF:0x1b756fa6:IO0] J5e.BapCar.start
15:07:13.225 [Info] [J5e.mcp] [PERF:0x1c437c58:IO0] J5e.BapCar.ready
bapcar: 15:07:13.241 [Error] [J5e.BapCar.bap.ref.Klima] 000A13: (CarBAPCacheChanged): BAP-device (1) not yet enabled!
bapcar: 15:07:13.254 [Error] [J5e.BapCar.bap.ref.Klima] 000A13: (CarBAPCacheChanged): BAP-device (2) not yet enabled!
bap: 15:07:13.330 [Error] [J5e.Bap.tsd.mibstd2.hmi.dsi.cpp.DSICarKombi] DSICarKombi::updateHUDColour: Dummy implementation called. Construction of service-provider-object not complete, HMI-Message lost.
bap: 15:07:13.333 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
bap: 15:07:13.335 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bapcar: 15:07:13.508 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
15:07:16.051 [Info] [J5e.mcp] [PERF:0x1fa2030f:IO0] J5e.NwMgr.start
15:07:16.144 [Info] [J5e.mcp] [PERF:0x1fbe3d21:IO0] J5e.NwMgr.ready
bapcar: 15:07:19.506 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
nwmgr: if_up: retries exhausted
nwmgr: ifconfig: SIOCGIFFLAGS ax0: No such device or address
15:07:21.072 [Info] [J5e.mcp] [PERF:0x259e265d:IO0] J5e.SwDL.start
15:07:21.119 [Info] [J5e.mcp] [PERF:0x25ac76d6:IO0] J5e.Debug.start
15:07:21.433 [Info] [J5e.mcp] [PERF:0x260c719c:IO0] J5e.Debug.ready
bapcar: 15:07:25.510 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
bapcar: 15:07:31.511 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!

I just started to collect Information about the MIB2 in Golf7. Here are some Informations that could be also usable:
forums. vwvortex .com / showthread.php?7159156-Discover-Pro-Hack-may-be-possible/page4
(sorry I´m not able to post full links)

horacos said:
For first I'd like to avoid opening the unit, so I rather tried to use the pins marked as J5_TX, J5_RX and GND on your attached pic to hook to a serial port-usb cable. I've opened a terminal configured to 115200, 8N1, and below is a sample what I've got from it:
Code:
úçůąÁ˙˙ůíŃ÷˙ýýž
˙˙ď^ąÁ˙˙ůíŃ÷˙ýý˝
˙ńóÍ}úçůąÁ˙˙ůíŃ÷˙ýý|0lp˙˙˙^ąż˙˙ůíŃ÷˙ýýžűű˙˙^ąż˙˙ůíŃ÷˙ýýßąż˙3ż=żIc!żżżEżW[}yušem{_]AWYwA_Q[yAAuU[ëž_űűĺ˙|?˙˙˙ß˙˙ż˝ĐţůíŃ÷˙ý˙×ţý˙˙˙˙í˙˙˙˙˙˙˙˙˙ý˙˙˙ý˙˙˙˙˙˙˙˙˙˙˙˙˙ł˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ďýű˙ű˙?U_âń˙{ěď˙űö÷˙ú÷Uc˙|oc˙˙úń˝˙c˙˙í÷úń˝˙c˙˙Ď˙|oc˙˙ËÁ|oc˙˙ëőú÷a˝úí˙űv˙˙úóó˙ýúóu˙ýúí×I?Űoů!˙˙˙
9öÝS{Ď˙Ďé
*÷öÝM˝ż˙˙˙˙˙˙˙˙ý˙xúíöÝłżž˙˙˙˙˙˙˙ýxöÝM˝ż˙˙˙˙˙˙˙˙ýxöÝfż˙˙{˙˙˙˙˙˙ýxöÝąó˙˙˙xöÝ_ĹUý˙˙˙˙˙˙˙˙ý xö"ýxöÝcşýműąß˙˙˙˙˙ýxöÝÝ{ëďëá˙˙ű˙á˙ż÷Ňł˙ń?˙˙˙˙˙˙˙űűá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űůá˙ż÷Ň˙˙˙˙˙˙˙˙˙űőá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űńá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űďá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űëá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űçá˙ż÷Ň˙˙˙˙˙˙˙˙˙űăá˙ż÷Ň˙˙˙˙˙˙˙˙˙űáá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űÝá˙ż÷Ň˙˙˙˙˙˙˙˙˙űŮá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ű×ᯜÓőIoÝśŃ×I?o˙ßÍó;<eOńöß˙˙˙˙˙˙˙˙˙űÍß˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űÉá|gżÜ_˘6řú×űĹ×I?e˙˙Ýďýű˙˙˙˙ű÷öÝmş{Č/~˙˙˙˙űöÝŮ×˙˙˙˙˙˙˙˙˙˙űxöÝÝ[ëëëá˙˙űxöÝsś˙˙˙˙˙˙˙űxöÝ~âţ˙˙˙˙˙ů˙§˙űxöÝßâţ˙˙˙˙˙űó?űxöÝßâţ˙˙˙˙˙ů˙§˙űxöÝ~bo˙ýßĹ˙űxöÝßbo˙ýßĹ˙űxöÝ´şß_7ů˙˙˙˙˙ű}xöÝéďýąý˙ÝűűyxöÝM~l˙˙˙˙˙˙˙˙űwxö˙˙ýż˙ż÷Oţ˙˙˙˙˙÷ý§˙űoxöÝßâţ˙˙˙˙˙÷ý§˙űkxöÝMžű˙˙˙˙˙˙˙˙űixö˙˙ýżF˙ż÷2ą˙˙˙˙˙˙˙˙˙˙˙űaxöÝM˝ż˙˙˙˙˙˙˙˙ű_xöÝ˝żîoÝU]őU˙˙˙ű[xöÝŰĎUUKU˙ů˙˙˙˙űWxöÝśżneU˙ů˙˙˙űSxöÝlżnďăă]÷öÝßâţ˙˙˙˙ýŰă˙űxöÝ~âţ˙˙˙˙ýŮ÷˙ů˙á˙ż÷rOţ˙˙˙˙ýŮ÷˙ůűá˙ż÷ŇUľů˙˙˙˙˙˙˙˙ůůá˙ż÷Oţ˙˙˙˙ý×ů˙ůőá˙ż÷rOţ˙˙˙˙ý×ů˙ůńá˙ż÷Oţ˙˙˙˙ýŐé˙ůíá˙ż÷rOţ˙˙˙˙ýŐé˙ůëá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůçá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůăá˙ż÷ňM_ű˙˙˙˙˙˙˙˙ůáá˙ż÷ŇM˙˙ý~wxöÝMşű˙˙˙˙˙˙˙˙ůŮá˙ż÷˛M˙˙ý˙˙˙˙˙ůýůŐá˙ż÷Oţ˙˙˙˙ýÓé˙ůÓá˙ż÷rOţ˙˙˙˙ýÓé˙ůĎá˙ż÷rŰ˝UUKU˙ů˙˙˙˙ůËá˙ż÷2Ű˝ŤŞ]˙ů˙˙˙ůÉá˙ż÷ňŰ˝UUUŐż˙ůĹá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůÁá˙ż÷Ň˙˙˙˙˙˙˙˙˙ů˝á˙ż÷ňYű×˙~ˇ˙ż÷ňY~˙~[˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůłá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙ůąá˙ż÷ňYž˙˙~kxöż˙˙˙˙˙˙˙˙˙ůŠá˙ż÷ňY}˙˙~ixöż˙˙˙˙˙˙˙˙˙ůŁá˙ż÷ňYß˙˙á˙ż÷ňYźď˙˙˙ýýýý˙ůá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůá˙ż÷Oţ˙˙˙˙ýŃé˙ůá˙ż÷Oţ˙˙˙˙ýĹŰ˙áŻ{őIoÝ{×I?o˙ßÍó;<ŮĎńöÝ}âţ˙˙˙˙˙ő˙Ż˙ůwß˙ż÷rOţ˙˙˙˙ýŃé˙ůsá˙ż÷rOţ˙˙˙˙ýĹŰ˙ůoá˙ż÷2Oţ˙˙˙˙˙ő˙Ż˙ůká˙ż÷2÷Ďńů˙˙˙˙˙ůiá˙ż÷ňďýů˙˙˙˙ůeá˙ż÷2÷Íďů˙˙˙˙˙ůaá˙ż÷ňďý˙˙˙˙˙ů_á˙ż÷2÷Ëíů˙˙˙˙˙ů[á˙ż÷ň_˙˙˙˙˙ůWá˙ż÷Oţ˙˙˙˙ýĂ7˙ůSá˙ż÷rOţ˙˙˙˙ýĂ7˙ůQá˙ż÷Oţ˙˙˙˙ýÁ7˙ůMá˙ż÷ROţ˙˙˙˙ýĹŰ˙ůIá˙ż÷rOţ˙˙˙˙ýÁ7˙ůGá˙ż÷2Oţ˙˙˙˙ýĹŰ˙ůCá˙ż÷ňł˙˙˙˙˙˙˙˙˙˙˙ů?á˙ż÷Oţ˙˙˙˙ýż5˙ů;á˙ż÷rOţ˙˙˙˙ýż5˙ů9á˙ż÷Oţ˙˙˙˙˙7˙š˙ů5á˙ż÷rOţ˙˙˙˙˙7˙šőů1á˙ż÷2÷Éëů˙˙˙˙˙ů/á˙ż÷ňďýý˙˙˙˙ů+á˙ż÷O~\˙˙˙oĂ˙ů'á˙ż÷rO~\˙˙˙oĂ˙ů#á˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ů!á˙ż÷2÷Çéů˙˙˙˙˙ůá˙ż÷ňďýű˙˙˙˙ůá˙ż÷O~\˙˙˙kÓ˙ůá˙ż÷rO~\˙˙˙kÓ˙ůá˙ż÷O~\˙˙˙=ůá˙ż÷rO~\˙˙˙=ů
á˙ż÷Oţ˙˙˙˙˙5˙Ű˙ů á˙ż÷rOţ˙˙˙˙˙5˙Ű˙ůá˙ż÷r˙˙˙˙˙˙˙˙˙˙˙ůá˙ż÷2Ű*ŤŞ]˙Uő˙˙˙ůýxöÝ~âţ˙˙˙˙˙3őůűxöÝ~âţ˙˙˙˙˙1ýŻů÷xöÝßâţ˙˙˙˙˙3őůóxöÝ~âţ˙˙˙˙˙/˙˙ůńxöÝßâţ˙˙˙˙˙1ýŻ}~;xöÝ~âţ˙˙˙˙˙-ý×ůéxöÝ~âţ˙˙˙˙˙+ű?˙ůĺxöÝ~âţ˙˙˙˙˙)˙żůăxöÝ~"Çý˙˙˙]ůßxöÝßâţ˙˙˙˙˙/˙˙ůŰxöÝ~âţ˙˙˙˙˙%˙É˙ůŮxöÝßâţ˙˙˙˙˙-ý×ůŐxöÝ~âţ˙˙˙˙ý˝÷˙ůŃxöÝßâţ˙˙˙˙˙+ű?őůÍxöÝ~âţ˙˙˙˙˙#÷˙˙ůËxöÝßâţ˙˙˙˙˙)˙żůÇxúŰ˙ůŻ÷öÝßâţ˙˙˙˙˙%˙É˙ůŤxöÝ~âţ˙˙˙˙˙ýůŠxöÝßâţ˙˙˙˙ý˝÷˙ůĽxúďőůxöÝßâţ˙˙˙˙˙ý}~H˙ż÷rOţ˙˙˙˙˙˙őů
xöÝßâţ˙˙˙˙ýíőůxöÝߢ˙-˙Ő˙ů}xöż˙˙˙˙˙˙˙˙˙ůyxöÝY}˙˙~G˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůsxöż˙˙˙˙˙˙˙˙˙ůoxöż˙˙˙˙˙˙˙˙˙ůmxöÝ´żőő×ůM]˘J˙ń˙˙˙˙őŐőł÷ÁöÝ_˙˙˙˙˙ůI÷öÝ´şßß
ů˙˙˙˙˙ůExöÝéďý˛oÝűůCxöÝ´şß_űů˙˙˙˙˙ů?xöÝďýý˙˙˙˙ů;xöÝ´şßßëů˙˙˙˙˙ů7xöÝďýű˙˙˙˙ů5xöÝ´şß_Űů˙˙˙˙˙ů1xöÝéď˙ýůoŰűů-xúď˙÷˙˙˙˙÷)˙ż÷ˇIŃń˙˙˙˙˙÷)˙ż÷ňűIŃ˙˙˙˙˙˙˙˙÷'öÝcşý§ç˙˙˙˙˙˙˙÷˙ż÷ŇÓ÷ý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓűý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓýýĽů˙˙˙˙˙˙˙÷˙ż÷Rą/~!˙˙˙˙˙÷˙ż÷r6×˙˙˙˙˙˙˙˙˙˙÷˙ż÷ý˙˙˙˙˙˙˙˙˙÷˙ż÷ŇÓőý§˙˙˙˙˙˙˙˙őý˙ťVű˙Iiř˙˙ç˙˙˙ď÷őŮÝVű˙I?ińŠ˙˙˙˙óßőľ÷
öÝcş_Ľ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓűýĽ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓýýŁů˙˙˙˙˙˙˙ő÷˙˙ż÷6÷Ľý˙˙˙˙
I've tried with other speeds (less than 115200), but the result is similar. Maybe it is sending an inverted tx signal?
Click to expand...
Click to collapse
Make sure it is at 115200 speed, xon/xoff flow control.
I got pretty far with the mib1, currently playing with the mib2. This can be accessed pretty easily, just put it in wifi client mode and then you'll have port 23 open for some telnet business!
---------- Post added at 03:00 PM ---------- Previous post was at 02:56 PM ----------
horacos said:
Hi All,
Now i've tried to connect to port ESO C3_TX and RX, and finally i was able to see some understandable output (See below)
But do you know how shoudl I access any shell on it? I tought it provides a prompt to enter the password, but it doesn't. it rather seems to be a one direction logging console.
Any idea?
Thanks!
Code:
J5e.imx6.start: 0x01CCEB6D
-Welcome to TechniBoot-
SVN Rev: 490082
J5e.M30.LoadImage.ready: 0x03EE913A
J5e.M31.LoadImage.ready: 0x04CBAAAC
J5e.QNX.LoadImage.ready: 0x1D5A82BD
CPU0: L1 Icache: 512x64
CPU0: L1 Dcache: 512x64 WB
CPU0: L2 Dcache: 4096x64 WB
CPU0: VFP-d32 FPSID=410330c3
CPU0: NEON MVFR0=11110222 MVFR1=00011111
CPU0: 413fc082: Cortex A8 rev 2 600MHz NOALIGN
Loading IFS...done
System page at phys:83fe0000 user:fc404000 kern:fc404000
Starting next program at vfe05145c
cpu_startnext: cpu0 -> fe05145c
VFPv3: fpsid=410330c3
coproc_attach(10): replacing fe0815b0 with fe080d6c
coproc_attach(11): replacing fe0815b0 with fe080d6c
Welcome to QNX Neutrino on the Texas Instruments J5 ECO MIBSTD2NAV_MAIN Board (ARMv7 Cortex-A8 Core)
J5e.QNX.init.ready
Waiting for i.MX...
Thu Jan 01 00:01:00 UTC 1970
add net default: gateway 10.200.1.2
Starting tsd.mibstd2.main.root...
Current core file directory: /tsd/var/core/startup-1/main
00:01:00.926 [Info] [J5e.mcp] [FREQ:20000000]
00:01:00.929 [Info] [J5e.mcp] [PERF:0x16a0592:IO1] J5e.MCP.init.start
Start Com-Client (MAINROOT)
Start Com2M30
shm mapped to 28010000
Start Network
Create Thread
00:01:00.998 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8100f09
00:01:01.004 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051a
00:01:01.005 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051b
00:01:01.005 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051c
00:01:01.006 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051d
00:01:01.007 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051e
00:01:01.007 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff051f
00:01:01.008 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0520
00:01:01.008 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0521
00:01:01.009 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0556
00:01:01.009 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8ff0556
00:01:01.025 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x70a0067
00:01:01.026 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x70a0068
shm mapped to 28020008
00:00:00.018 [Error] [J5e.cmsg.m30] persist: (p1:p2) configuration failed status (p3). p1: 0 p2: 0 p3: 8
00:00:00.018 [Info] [J5e.mcp] Booting at Normal Mode (0, 1)...
00:00:00.053 [Error] [J5e.tsd.communication.serializer] Serializer already registered for event 0x8100002
00:00:00.055 [Info] [J5e.mcp] [PERF:0x19d5536:IO0] J5e.MCP.init.ready
00:00:00.089 [Info] [J5e.mcp] [PERF:0x1a7c8b2:IO0] J5e.PersMaster.start
00:00:00.114 [Info] [J5e.mcp] [PERF:0x1af6181:IO0] J5e.Police.start
00:00:00.223 [Info] [J5e.mcp] [PERF:0x1d0b969:IO0] J5e.Bap.start
00:00:00.262 [Info] [J5e.mcp] [PERF:0x1dc6331:IO0] J5e.DSPStarter.start
dspstarter:
00:00:00.525 [Info] [J5e.mcp] [PERF:0x22cabdd:IO0] J5e.DSPStarter.end
dspstarter:
00:00:00.568 [Info] [J5e.mcp] [PERF:0x239d383:IO0] J5e.PersMaster.ready
00:00:00.585 [Info] [J5e.mcp] [PERF:0x23f14fb:IO0] J5e.Keypanel.start
00:00:00.619 [Info] [J5e.mcp] [PERF:0x2499719:IO0] J5e.Radio.start
00:00:01.152 [Info] [J5e.mcp] [PERF:0x2ec1003:IO0] J5e.Keypanel.ready
bap: 00:00:01.166 [Error] [J5e.Bap.tsd.communication.serializer] Serializer already registered for event 0x80e0006
00:00:01.176 [Info] [J5e.mcp] [PERF:0x2f36f0d:IO0] J5e.Bap.ready
bap: 00:00:01.190 [Error] [J5e.Bap.bap.ref.parking] 000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
bap: 00:00:01.192 [Error] [J5e.Bap.bap.ref.parking] 000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
radio: 00:00:01.559 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x3002
radio: 00:00:01.563 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x40000bf
00:00:01.579 [Info] [J5e.mcp] [PERF:0x36e4695:IO0] J5e.Radio.ready
radio: 00:00:01.632 [Error] [J5e.Radio.tsd.communication.serializer] Serializer already registered for event 0x14110001
00:00:01.717 [Info] [J5e.mcp] [PERF:0x398a4d4:IO0] J5e.Police.ready
ListenServer: creating new worker thread
persmaster: 15:06:56.662 [Error] [J5e.PersMaster.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998404847 endtime: 1481382416662
15:06:56.800 [Info] [J5e.mcp] [PERF:0x8aefb6b:IO0] J5e.AudioMgr.start
bap: 15:06:56.880 [Error] [J5e.Bap.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405050 endtime: 1481382416880
keypanel: 15:06:56.880 [Error] [J5e.Keypanel.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405052 endtime: 1481382416880
police: 15:06:56.879 [Error] [J5e.Police.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405032 endtime: 1481382416879
15:06:56.894 [Error] [J5e.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405079 endtime: 1481382416894
audiomgr: Audio Manager started.
radio: 15:06:57.307 [Error] [J5e.Radio.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time starttime: 1356998405492 endtime: 1481382417307
audiomgr: 15:06:57.499 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x8100003
audiomgr: 15:06:57.502 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307df
audiomgr: 15:06:57.526 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x8100003
audiomgr: 15:06:57.529 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307b2
audiomgr: 15:06:57.530 [Error] [J5e.AudioMgr.tsd.communication.serializer] Serializer already registered for event 0x80307df
15:06:57.624 [Info] [J5e.mcp] [PERF:0x9aa900b:IO0] J5e.AudioMgr.ready
15:07:03.052 [Info] [J5e.mcp] [PERF:0x1022e899:IO0] J5e.Logging.start
bap: 15:07:10.831 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCCurrentConsumption1_local: unknown unit
bap: 15:07:10.833 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bap: 15:07:10.835 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
15:07:12.550 [Info] [J5e.mcp] [PERF:0x1b756fa6:IO0] J5e.BapCar.start
15:07:13.225 [Info] [J5e.mcp] [PERF:0x1c437c58:IO0] J5e.BapCar.ready
bapcar: 15:07:13.241 [Error] [J5e.BapCar.bap.ref.Klima] 000A13: (CarBAPCacheChanged): BAP-device (1) not yet enabled!
bapcar: 15:07:13.254 [Error] [J5e.BapCar.bap.ref.Klima] 000A13: (CarBAPCacheChanged): BAP-device (2) not yet enabled!
bap: 15:07:13.330 [Error] [J5e.Bap.tsd.mibstd2.hmi.dsi.cpp.DSICarKombi] DSICarKombi::updateHUDColour: Dummy implementation called. Construction of service-provider-object not complete, HMI-Message lost.
bap: 15:07:13.333 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
bap: 15:07:13.335 [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter] ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bapcar: 15:07:13.508 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
15:07:16.051 [Info] [J5e.mcp] [PERF:0x1fa2030f:IO0] J5e.NwMgr.start
15:07:16.144 [Info] [J5e.mcp] [PERF:0x1fbe3d21:IO0] J5e.NwMgr.ready
bapcar: 15:07:19.506 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
nwmgr: if_up: retries exhausted
nwmgr: ifconfig: SIOCGIFFLAGS ax0: No such device or address
15:07:21.072 [Info] [J5e.mcp] [PERF:0x259e265d:IO0] J5e.SwDL.start
15:07:21.119 [Info] [J5e.mcp] [PERF:0x25ac76d6:IO0] J5e.Debug.start
15:07:21.433 [Info] [J5e.mcp] [PERF:0x260c719c:IO0] J5e.Debug.ready
bapcar: 15:07:25.510 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
bapcar: 15:07:31.511 [Error] [J5e.BapCar.bap.ref.HomeLink] 019406: BAP-device (20) not yet enabled!
Click to expand...
Click to collapse
Hit enter a couple of times!
You'll see a login error soon enough.
Type stfu after login to be sure your screen isn't filled with data.

Re-start
Appreciate your help Chillout! As I can recall I saw these kind of login error messages, but haven't seen any command prompt. So I think I need some work to do today evening once I get home I'll try, especially this very special command called "stfu"
And how can I put the device in wifi client mode? Should I have the vag-com cable for that? Thanks again for the help!

If you have an MIB2 (2nd generation) device, the Wifi client mode can be found under WLAN settings. There are two possibilities with this device:
- hotspot mode
- wlan client mode (although they don't call it wlan client in the menu's, it's the one that allows you to search for hotspots).
You don't need anything else besides a MIB2 and a hotspot.
I really had to laugh about STFU. It took some time before I found the command, while browsing through all the directories, and got curious what "stfu" would do. Before that, it was extremely frustrating to see all the data scrolling by whenever I wanted to see contents of a directory, or file. STFU is not needed when connecting over telnet, it's a serial access only thing.

Chillout said:
If you have an MIB2 (2nd generation) device, the Wifi client mode can be found under WLAN settings. There are two possibilities with this device:
- hotspot mode
- wlan client mode (although they don't call it wlan client in the menu's, it's the one that allows you to search for hotspots).
You don't need anything else besides a MIB2 and a hotspot.
I really had to laugh about STFU. It took some time before I found the command, while browsing through all the directories, and got curious what "stfu" would do. Before that, it was extremely frustrating to see all the data scrolling by whenever I wanted to see contents of a directory, or file. STFU is not needed when connecting over telnet, it's a serial access only thing.
Click to expand...
Click to collapse
Hi chillout!
When i am trying to connect via telnet i can't get connection to the unit.
i put in the IP which MIB2 shows me in the "Hidden Engineering menü"
thx

offsystem said:
Hi chillout!
When i am trying to connect via telnet i can't get connection to the unit.
i put in the IP which MIB2 shows me in the "Hidden Engineering menü"
thx
Click to expand...
Click to collapse
When the unit is in wifi client mode, you should be able to connect to it, by using the IP it is using as an access point. If this doesn't work, get one of these devices, plug it in the USB port, and connect to IP: 172.16.250.248 (make sure to change your own IP to something in the same IP range, so something like 172.16.250.247). Port 23 should be available to you.
D-Link DUB-E100 (0x2001, 0x3c05)
D-Link DUB-E100 (0x2001, 0x1a02)
SMSC9500 (0x0424, 0x9500)
Germaneers LAN9514 (0x2721, 0xec00)
Cinterion AH6A 3G (0x1e2d, 0x0055)
Cinterion ALS1/ALS6 (0x1e2d, 0x0060)

Maybe this can help you read01.com/m8OMBO.html

Hi,
Some questions:
1) This can be possible also with MIB2 "non-pro"?
2) To enable the TELNET access is required to enable the Green Manufacturer Menu?
3) The USB dongle has all the time the TELNET server enabled, or only when the Green Menu is enabled?
Thank you for sharing this info.

manos78 said:
Hi,
Some questions:
1) This can be possible also with MIB2 "non-pro"?
2) To enable the TELNET access is required to enable the Green Manufacturer Menu?
3) The USB dongle has all the time the TELNET server enabled, or only when the Green Menu is enabled?
Thank you for sharing this info.
Click to expand...
Click to collapse
1: should be possible, just use one of the network adapters I mentioned
2: as far as I can tell, this is always on. But it doesn't hurt to enable developer mode
3: all the time.

Related

[SOLVED] Recompile official kernel 2.6.29 - Sense 3D problem

Hello,
When I found out this morning that HTC has released their hero-2.6.29-5f74b252, I decided to go ahead and try to compile this without modifications. Just to make sure it works as the pre-compiled version before doing any modifications.
As I'm already running the official 2.1 (ChungHwa, same kernel as the source) I performed the following steps to try to replicate the official build:
Fetch kernel config from my device
Code:
adb pull /proc/config.gz config-htc-2.1.gz
Build zImage
Code:
export PATH=$PATH:<path/to/android/source>prebuilt/linux-x86/toolchain/arm-eabi-4.3.1/bin/
gunzip -c ../config-htc-2.1.gz > .config
make -j4 zImage ARCH=arm CROSS_COMPILE=arm-eabi-
After that I built a new wlan.ko and created a boot.img, followed by a signed update package and so on.
The kernel booted just fine and everything seemed to be working as it should. But sometimes when unlocking (lock screen) the phone and entering sense with the weather/clock widget (that shows a weather animation overlay in fullscreen) I get some bad looking gray-scale shapes flying over the screen. Also games like Labyrinth runs really slow after this problem occurs. Attaching screenshot of weather animation bug.
Has anyone else had similar experience with the released kernel source???
I've been running the official hero-2.6.29-5f74b252 kernel for quite some time now and never had any problems like this.
logcat (when unlocking)
Code:
I/HtcLockScreen( 90): touch ACTION_DOWN
D/skia ( 90): purging 191K from font cache [26 entries]
I/HtcLockScreen( 90): touch ACTION_UP
W/dalvikvm( 90): disableGcForExternalAlloc: true
D/HtcLockScreen( 90): unlock animationn done
I/HtcLockScreen( 90): Drag down to unlock screen
W/dalvikvm( 90): disableGcForExternalAlloc: false
I/HtcLockScreen( 90): HtcLockScreen:onPause
D/dalvikvm( 160): GC freed 9041 objects / 531616 bytes in 200ms
W/IndicatorRequest( 445): The running request PersonIndicatorRequest(112) is no longer valid... requeue it!
W/IndicatorRequest( 445): The running request PersonIndicatorRequest(112) is no longer valid... requeue it!
D/KeyguardViewMediator( 90): pokeWakelock(7000)
D/KeyguardViewMediator( 90): pokeWakelock(7000)
D/HtcLockScreen( 90): onScreenPause
D/KeyguardViewManager( 90): hide()
W/InputManagerService( 90): Window already focused, ignoring focus gain of: com.android.internal.view.IInputMethodClient$Stub$Proxy <at> 4494e8b0
D/dalvikvm( 1732): GC freed 1224 objects / 190144 bytes in 80ms
D/dalvikvm( 1732): GC freed 483 objects / 186216 bytes in 82ms
D/libEGL ( 1732): loaded /system/lib/egl/libGLES_qcom.so
[B]E/EGL.oem ( 1732): could not open hw3dc (Operation not permitted)
E/libEGL ( 1732): No EGLDisplay for hardware EGL!
E/copybit ( 1732): Error opening frame buffer errno=13 (Permission denied)
E/copybit ( 1732): Error opening frame buffer errno=13 (Permission denied)
E/copybit ( 1732): Error opening frame buffer errno=13 (Permission denied)[/B]
D/dalvikvm( 1533): GC freed 567 objects / 28344 bytes in 10 sec
dmesg (when unlocking)
Code:
<6>[ 4886.515686] request_suspend_state: wakeup (3->0) at 4883223881359 (2010-07-06 06:31:19.395568809 UTC)
<6>[ 4886.516357] [R] late_resume start
<6>[ 4886.517425] perflock_notifier_call: screen_on_policy_req 1,policy_min 480000
<6>[ 4886.517700] perflock_notifier_call: cpufreq recover policy 480000 528000
<6>[ 4886.538818] lightsensor_enable
<3>[ 4886.541076] lightsensor_enable: microp is suspended
<6>[ 4886.829010] msmfb: ready, waiting for full update
<6>[ 4886.829345] hero_ts_power:1
<6>[ 4886.836975] msmfb: pan_update in state(1)
<6>[ 4886.837005] msmfb: full update starting
<6>[ 4886.866638] msmfb: full update completed
<6>[ 4886.867065] msmfb: turning on panel
<7>[ 4886.907775] turn on backlight.
<6>[ 4887.109832] microp-i2c 0-0066: microp_i2c_auto_backlight_set_interrupt_mode: 1
<6>[ 4887.112579] [R] late_resume end
<7>[ 4887.613098] ALS value: 0x4, level: 2 #
<7>[ 4887.618255] ALS value: 0x4, level: 2 #
<6>[ 4887.649444] S1 <at> 2025, 2676
<6>[ 4887.925445] E1 <at> 2071, 5196
[B]<6>[ 4892.686065] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.686340] hw3d_open: can't open hw3d while suspending
<6>[ 4892.697113] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.697387] hw3d_open: can't open hw3d while suspending
<6>[ 4892.708160] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.708435] hw3d_open: can't open hw3d while suspending
<6>[ 4892.719207] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.719482] hw3d_open: can't open hw3d while suspending
<6>[ 4892.730255] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.730560] hw3d_open: can't open hw3d while suspending
<6>[ 4892.741302] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.741577] hw3d_open: can't open hw3d while suspending
<6>[ 4892.752532] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.752807] hw3d_open: can't open hw3d while suspending
<6>[ 4892.763763] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.764068] hw3d_open: can't open hw3d while suspending
<6>[ 4892.774871] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.775146] hw3d_open: can't open hw3d while suspending
<6>[ 4892.785919] hw3d_open: pid 1772 tid 1777 opening client node
<4>[ 4892.786224] hw3d_open: can't open hw3d while suspending[/B]
<4>[ 4893.162109] select 1762 (ufou.android.su), adj 15, size 4030, to kill
<4>[ 4893.162384] send sigkill to 1762 (ufou.android.su), adj 15, size 4030
It seems as there is some kind of conflict with the power states, as if the kernel has not understood that the device is awake:
Code:
hw3d_open: can't open hw3d while suspending
arch / arm / mach-msm / hw3d.c
Code:
...
spin_lock_irqsave(&info->lock, flags);
if (info->suspending) {
pr_warning("%s: can't open hw3d while suspending\n", __func__);
ret = -EPERM;
spin_unlock_irqrestore(&info->lock, flags);
goto err;
}
...
Can you please share that .config? I need the one from an official 2.1 WWE based build, like the one you have. Thanks.
RaduG said:
Can you please share that .config? I need the one from an official 2.1 based build, like the one you have. Thanks.
Click to expand...
Click to collapse
Sure, attaching the config here
Thanks mate. I will compile now too and I'll let you know.
I bet its caused by the animated weather overlay from the clock widget, does it still happen if you remove the clock widget from your homescreen?
Yup, you're right it's caused by the animated weather overlay. It happens to be partly sunny here today, so some light clouds are supposed to fly over the screen after unlocking... and these are now the grayish boxes instead.
The problem on the attached picture will go away when removing the widget or just tapping the screen.
But there must be an underlaying problem with the new kernel (or my compilation at least) since the same problem also affects games that uses 3D, i.e. Labyrinth Lite for example.
The same "hw3d_open: can't open hw3d while suspending" can be seen when playing Labyrinth...
Just to add... after rebooting the problem does not usually show up immediately... meaning I will see the weather clouds etc (and games run smoothly). But after using the phone for a short while, i.e. unlocking a couple of times and perhaps opening a few 3D related apps the problem will appear. A reboot will again make it OK for a while and so on...
As I promised, I'm back with feedback.
I've done some kernel tweaks and enabled overclocking and it works properly. I get no 3D issues whatsoever. I need to optimize it because it is not working as I want it to(speed wise).
Thanks RaduG, I'm re-building again as well... and will double check that the code is clean first. Hope it solves my 3D issues as well...
Could it be, that if the Device is going into a "powersave" mode, some functions are going into standby and cannot come up, when the device is awaken?
Could be something like that...
I just finished another recompile after making sure the code from HTC was properly clean (ready to build), when running it it again looked perfectly OK for some time... but after starting and stopping i.e. Labyrinth (3D mode) and locking/unlocking a couple of times the problem came back :-(
I found a dmesg log indicating that the 3D "device" failed to suspend:
Code:
<6>[ 1272.269500] [R] suspend start
<6>[ 1272.275177] PM: Syncing filesystems ... done.
<4>[ 1272.281707] Freezing user space processes ... (elapsed 0.05 seconds) done.
<4>[ 1272.336822] Freezing remaining freezable tasks ... (elapsed 0.00 seconds) done.
<3>[ 1272.362335] pm_op(): platform_pm_suspend+0x0/0x58 returns 1
[B]<3>[ 1272.363372] PM: Device msm_hw3d.0 failed to suspend: error 1[/B]
<3>[ 1272.363891] PM: Some devices failed to suspend
For me the following steps solved my problem...
I noticed that during compilation a few warnings was thrown related to the file "arch/arm/mach-msm/hw3d.c". When looking deeper into this it seems that the driver suspend function was wrong.
I therefore applied the following changes, and the problem has not re-occurred since then:
Code:
diff -crB hero-2.6.29-5f74b252/arch/arm/mach-msm/hw3d.c hero-2.6.29-5f74b252-pon/arch/arm/mach-msm/hw3d.c
*** hero-2.6.29-5f74b252/arch/arm/mach-msm/hw3d.c 2010-06-15 17:58:03.000000000 +0800
--- hero-2.6.29-5f74b252-pon/arch/arm/mach-msm/hw3d.c 2010-07-06 21:02:59.288988755 +0800
***************
*** 645,651 ****
}
#ifndef CONFIG_MSM_HW3D_EARLYSUSPEND_ENABLED
! static void hw3d_suspend(struct platform_device *pdev)
{
struct hw3d_info *info = platform_get_drvdata(pdev);
unsigned long flags;
--- 645,651 ----
}
#ifndef CONFIG_MSM_HW3D_EARLYSUSPEND_ENABLED
! static int hw3d_suspend(struct platform_device *pdev, pm_message_t state)
{
struct hw3d_info *info = platform_get_drvdata(pdev);
unsigned long flags;
your patch is very usaful!
I'm glad if you find it useful
So what did RaduG change?
Guys, you're really crazy, doing kernel hacking and stuff... and I'm loving it
I was wondering: if these are the official kernel sources, HTC should have used these sources for the official kernel. So, why doesn't this happen with the official kernel?
xdafalter said:
Guys, you're really crazy, doing kernel hacking and stuff... and I'm loving it
I was wondering: if these are the official kernel sources, HTC should have used these sources for the official kernel. So, why doesn't this happen with the official kernel?
Click to expand...
Click to collapse
Because they removed a few lines of codes to "fully" support all the hardware
I'm kinda wondering the same thing, it's hard to know if the source is really the exact one that HTC used for our device. But it could also be affected by i.e. which gcc version was used to compile it. I'm gonna compare the GCC version as soon as I bother to boot up the official kernel again. I'm currently using arm-eabi-4.3.1 (because it's the only one I happen to have installed) while I've seen that most people seem to use arm-eabi-4.4.0 by now.
Regardless of if another compiler would make it work I think I will stick to the patch, as this is the expected format of a suspend function for a platform driver of this kernel version
Code:
struct platform_driver {
int (*probe)(struct platform_device *);
int (*remove)(struct platform_device *);
void (*shutdown)(struct platform_device *);
[B]int (*suspend)(struct platform_device *, pm_message_t state);[/B]
int (*suspend_late)(struct platform_device *, pm_message_t state);
int (*resume_early)(struct platform_device *);
int (*resume)(struct platform_device *);
struct device_driver driver;
};
As you would see it's supposed to return an int (not void) as well as taking an additional parameter (pm_message_t).
Hi, All,
I have some problems while compiling the WIFI driver with this kernel.
it seems something changed we didn't know with the WIFI support? I use the same .config works great with the leak version of kernel source, but with this official one, it doesn't work.
if I check the wlan.ko module with insmod, it can be loaded.
and use lsmod, it's there but just not work.
witysimon said:
Hi, All,
I have some problems while compiling the WIFI driver with this kernel.
it seems something changed we didn't know with the WIFI support? I use the same .config works great with the leak version of kernel source, but with this official one, it doesn't work.
if I check the wlan.ko module with insmod, it can be loaded.
and use lsmod, it's there but just not work.
Click to expand...
Click to collapse
cant confirm that, wifi is working fine here, sure you rebuild your wlan.ko with the new kernel sources and not using the old one?

[Q] com.android.mms stopped unexpectedly - missing db table!

I am suddenly unable to send og view messages on my HTC Desire Z, I just get a popup saying com.android.mms has stopped unexpectedly.
Connected the device to my computer, and found this in the logcat:
Code:
01-06 11:11:01.812: INFO/Database(1433): sqlite returned: error code = 1, msg = no such table: contact_threads
01-06 11:11:01.832: ERROR/SqliteWrapper(12609): Catch a SQLiteException when query:
android.database.sqlite.SQLiteException: no such table: contact_threads: , while compiling: SELECT _id, message_count, recipient_ids, date, read, snippet, snippet_cs, error, unread_count, recipient_address, priority, type, transport_type, msg_box, locked, name, err_type FROM contact_threads WHERE htc_category=0 AND (_id IN (SELECT contact_id FROM contacts WHERE thread_id IN (SELECT DISTINCT thread_id FROM pdu WHERE htc_category=0 AND (msg_box != 3 AND (m_type = 128 OR m_type = 132 OR m_type = 130)) UNION SELECT DISTINCT thread_id FROM sms WHERE htc_category=0 AND (type != 3)))) ORDER BY date DESC
at android.database.DatabaseUtils.readExceptionFromParcel(DatabaseUtils.java:158)
at android.database.DatabaseUtils.readExceptionFromParcel(DatabaseUtils.java:114)
at android.content.ContentProviderProxy.bulkQueryInternal(ContentProviderNative.java:372)
at android.content.ContentProviderProxy.query(ContentProviderNative.java:408)
at android.content.ContentResolver.query(ContentResolver.java:245)
at com.google.android.mms.util.SqliteWrapper.query(SqliteWrapper.java:112)
at com.android.mms.util.MmsAsyncQueryHandler$MmsWorkerHandler.handleMessage(MmsAsyncQueryHandler.java:93)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:143)
at android.os.HandlerThread.run(HandlerThread.java:60)
01-06 11:11:01.832: DEBUG/ConversationListAdapter(12609): onQueryComplete, the cursor is null or token changed.
I read somewhere that I can solve this by deleteing the messages database and the files with the content. Anybody who can verify this (I would like to keep my messages if possible, but itis not possible then ok).
Maybe I could just add the 'contact_threads' table again by sql?
Or if anybody has any other hints on how to solve this, please forward me in the right direction.
I'm new to android hacking, but looking at this as an opportunity to learn

[WIP] Lets recover hard-bricks

Hey guys. I'm doing some work to figure out how to recover Galaxy Nexus devices which are hard-bricked.. ie.. they have a bad or no bootloader installed.
the boot sequence
1. IROM - the Internal ROM which cannot be rewritten on the device. This loads the XLoader.
2. XLoader/MLO - This completes the initialization of the processor and memory, and loads up the relatively huge U-Boot ( Samsung modified this and calls it SBL)
3. UBoot/SBL - This "Bootloader" is almost a complete operating system. The U-Boot initializes the screen, provides Odin mode, Fastboot Mode as well as loading the kernel/recovery and provides a UART debugging mode (Yet to be unlocked).
4. Kernel - Once we reach this point, it's all clear.. the kernel is linux which loads android and all sorts of other things.
The Problem
People are bricking their devices at stage 2 and 3 of this boot sequence... This leaves them unable to boot Fastboot or Odin. The device is 100% interchangable with a brick. These devices are ending up hard bricked.
The solution
We must come up with a way to undo the hard brick. Here are some things i'm looking at to use the native hardware to recover itself.
When you plug in the device (when off), you will immediately notice a Texas Instruments D010 device gets enumerated. This is a debug mode for the processor.
Code:
Bus 001 Device 023: ID 0451:d010 Texas Instruments, Inc.
We've started looking at some bootloader output here: http://forum.xda-developers.com/showthread.php?t=1461986
You can find information about the OMAP4 bootloaders here: http://omapedia.org/wiki/Bootloader_Project
Help
I need help locating drivers to initialize the 0451:d010 device and make it readable from within Linux or Windows.. Generally Linux is easier to find appropriate drivers.
I could use some help collecting more reading materials and resources.
I think together as a community we can take care of this problem.
I kinda forgot that thread, it got lost among rom/kernel threads. Thanks for the reminder.
sent from my i9250
Ok... so here's the most complete boot log I've been able to obtain from the device
Code:
[Thermal] OK to boot
Initialize runtime thermal monitoring ...done!
-- OMAP 00004460 (version 04460e11) PPA release 1.6.1 Hash 30639809--
Device type: HS, DEBUG OFF
CPFROM HAL API support integrated
THERMAL support integrated: Run Time + Boot time
HDCP support integrated
-- PROD PPA RC3.2.3 --
Reset reason = 00037ba2
PRM_RSTST = 00000002
PPA freed 2992 bytes
Texas Instruments X-Loader 1.41 (Nov 16 2011 - 16:28:45)
Starting OS Bootloader from MMC/SD1 ...
EXCEPTION : CM_CLKMODE_DPLL_ABE = 0x7
EXCEPTION : CM_IDLEST_DPLL_ABE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_ABE = 0x804018
EXCEPTION : CM_CLKMODE_DPLL_CORE = 0xf
EXCEPTION : CM_IDLEST_DPLL_CORE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_CORE = 0x7d05
EXCEPTION : CM_CLKMODE_DPLL_PER = 0x107
EXCEPTION : CM_IDLEST_DPLL_PER = 0x1
EXCEPTION : CM_CLKSEL_DPLL_PER = 0x1400
EXCEPTION : CM_CLKMODE_DPLL_MPU = 0x117
EXCEPTION : CM_IDLEST_DPLL_MPU = 0x1
EXCEPTION : CM_CLKSEL_DPLL_MPU = 0x807d07
CFG_LOADADDR = 0xa0208000
1st instruct = 0xEA000007
[ __omap_twl6030_init_vbat_cfg :49] SA_PHOENIX_START_CONDITION = 0x4a
[ __omap_twl6030_init_vbat_cfg :54] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :63] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :86] SA_BBSPOR_CFG = 0x78
====== VCELL : 381375, SOC : 49, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
dev : 5
[sbl_board_charger_init_post] : Succeed set model data : 0x78!!!!!
====== VCELL : 381500, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381500000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
message.command =
message.status =
message.recovery =
<hit enter twice to activate fiq debugger>
[Thermal] OK to boot
Initialize runtime thermal monitoring ...done!
-- OMAP 00004460 (version 04460e11) PPA release 1.6.1 Hash 30639809--
Device type: HS, DEBUG OFF
CPFROM HAL API support integrated
THERMAL support integrated: Run Time + Boot time
HDCP support integrated
-- PROD PPA RC3.2.3 --
Reset reason = 0003fba2
PRM_RSTST = 00000002
PPA freed 2992 bytes
Texas Instruments X-Loader 1.41 (Nov 16 2011 - 16:28:45)
Starting OS Bootloader from MMC/SD1 ...
EXCEPTION : CM_CLKMODE_DPLL_ABE = 0x7
EXCEPTION : CM_IDLEST_DPLL_ABE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_ABE = 0x804018
EXCEPTION : CM_CLKMODE_DPLL_CORE = 0xf
EXCEPTION : CM_IDLEST_DPLL_CORE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_CORE = 0x7d05
EXCEPTION : CM_CLKMODE_DPLL_PER = 0x107
EXCEPTION : CM_IDLEST_DPLL_PER = 0x1
EXCEPTION : CM_CLKSEL_DPLL_PER = 0x1400
EXCEPTION : CM_CLKMODE_DPLL_MPU = 0x117
EXCEPTION : CM_IDLEST_DPLL_MPU = 0x1
EXCEPTION : CM_CLKSEL_DPLL_MPU = 0x807d07
CFG_LOADADDR = 0xa0208000
1st instruct = 0xEA000007
[ __omap_twl6030_init_vbat_cfg :49] SA_PHOENIX_START_CONDITION = 0x8
[ __omap_twl6030_init_vbat_cfg :54] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :63] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :86] SA_BBSPOR_CFG = 0x78
====== VCELL : 381375, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
<hit enter twice to activate fiq debugger>
Communications established====== VCELL : 381375, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
<hit enter twice to activate fiq debugger>
debug> console
console mode
[ 3.320373] cannot apply mgr(lcd) on inactive device
[ 3.325805] omapfb omapfb: failed to apply dispc config
[ 3.331359] cannot apply mgr(tv) on inactive device
[ 3.336578] omapfb omapfb: failed to apply dispc config
[ 3.341949] cannot apply mgr(lcd2) on inactive device
[ 3.347167] omapfb omapfb: failed to apply dispc config
[ 3.354888] regulator_init_complete: VDAC: disabling
[ 3.361053] omaplfb OMAPLFBInitFBDev: Device 0: Requesting 4 TILER 2D framebuffers
[ 3.369232] ## wifi_probe
[ 3.371917] wifi_set_power = 1
[ 3.631866] wifi_set_carddetect = 1
[ 3.647338]
[ 3.647338] Dongle Host Driver, version 5.90.125.94
[ 3.647338] Compiled in drivers/net/wireless/bcmdhd on Nov 21 2011 at 19:05:54
[ 3.764984] mmc1: queuing unknown CIS tuple 0x80 (7 bytes)
[ 3.817810] mmc1: queuing unknown CIS tuple 0x80 (3 bytes)
[ 3.837463] mmc1: new high speed SDIO card at address 0001
[ 3.844818] F1 signature read @0x18000000=0x16844330
[ 3.859436] DHD: dongle ram size is set to 294912(orig 294912)
[ 3.866546] wl_create_event_handler thr:5b started
[ 3.871673] dhd_attach thr:5c started
[ 3.875488] dhd_attach thr:5d started
[ 3.879272] dhd_attach thr:5e started
[ 3.883148] wifi_get_mac_addr
[ 3.888519] Broadcom Dongle Host Driver: register interface [wlan0] MAC: 00:90:4c:11:22:33
[ 3.897430] wifi_set_power = 0
[ 4.157012] =========== WLAN placed in RESET ========
[ 4.163116] fsa9480 4-0025: cable detect change, from 'unknown/none' to 'uart'
[ 4.171203] twl_rtc twl_rtc: setting system clock to 2012-05-13 00:25:12 UTC (1336868712)
[ 4.180816] Freeing init memory: 276K
[ 4.187561] init (1): /proc/1/oom_adj is deprecated, please use /proc/1/oom_score_adj instead.
[ 4.214172] max17040 4-0036: online = 1 vcell = 3795000 soc = 48 status = 3 health = 1 temp = 330 charger status = 0
[ 4.288116] keychord: using input dev tuna-gpio-keypad for fevent
[ 4.354614] EXT4-fs (mmcblk0p10): mounted filesystem with ordered data mode. Opts: (null)
[ 4.446746] mms_ts 3-0048: fw version 0x62 already present
[ 4.454498] mms_ts 3-0048: Melfas MMS-series touch controller initialized
[ 4.757202] omap-rproc omap-rproc.1: Loaded BIOS image ducati-m3.bin, size 4489868
[ 4.765838] omap-rproc omap-rproc.1: BIOS image version is 2
[ 4.785888] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
[ 4.806243] omap_hwmod: ipu: failed to hardreset
[ 4.811035] omap-iommu omap-iommu.0: ducati: version 2.1
[ 4.822448] omap-rproc omap-rproc.1: remote processor ipu is now up
[ 4.835571] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.842071] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.848541] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.855072] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.861816] virtio_rpmsg_bus virtio0: creating channel rpmsg-client-sample addr 0x32
[ 4.869812] virtio_rpmsg_bus virtio0: creating channel rpmsg-client-sample addr 0x33
[ 4.877899] virtio_rpmsg_bus virtio0: creating channel rpmsg-omx addr 0x3c
[ 4.885192] rpmsg_omx rpmsg-omx0: new OMX connection srv channel: 1024 -> 60!
[ 5.959960] EXT4-fs (mmcblk0p12): recovery complete
[ 5.974639] EXT4-fs (mmcblk0p12): mounted filesystem with ordered data mode. Opts: nomblk_io_submit,errors=panic
[ 6.021484] virtio_rpmsg_bus virtio1: creating channel rpmsg-omx addr 0x3c
[ 6.029602] rpmsg_omx rpmsg-omx1: new OMX connection srv channel: 1024 -> 60!
[ 6.170227] EXT4-fs (mmcblk0p11): recovery complete
[ 6.178833] EXT4-fs (mmcblk0p11): mounted filesystem with ordered data mode. Opts: nomblk_io_submit,errors=panic
[ 6.199371] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
[ 6.269744] android_usb: already disabled
[ 6.274810] mtp_bind_config
[ 6.277740] adb_bind_config
[ 6.297790] HDCP: loaded keys
[ 6.481079] warning: `adbd' uses 32-bit capabilities (legacy support in use)
[ 6.488433] adb_open
[ 6.702026] init: sys_prop: permission denied uid:1001 name:net.rmnet1.dns1
[ 6.709808] init: sys_prop: permission denied uid:1001 name:net.rmnet1.dns2
[ 6.718780] init: sys_prop: permission denied uid:1001 name:net.rmnet1.gw
[ 6.726196] init: sys_prop: permission denied uid:1001 name:net.rmnet2.dns1
[ 6.733612] init: sys_prop: permission denied uid:1001 name:net.rmnet2.dns2
[ 6.741455] init: sys_prop: permission denied uid:1001 name:net.rmnet2.gw
[ 6.749481] PVR: Installing MISR with cookie c0800c2c
[ 6.757415] PVR: Installing device LISR SGX ISR on IRQ 53 with cookie c7aa2700
[ 6.766174] PVR: OSUnMapPhysToLin: unmapping 65535 bytes from c8be0000
[ 6.773162] PVR: SysFinalise: Version string: SGX revision = 1.2.0
[ 6.797027] [MODEM_IF] misc_open : umts_boot0
[ 6.801666] omap_hsi omap_hsi.0: HSI clock is now 96000000
[ 6.824066] omap_hsi omap_hsi.0: Entering RX wakeup in 3 wires mode (no CAWAKE)
[ 6.831634] [MODEM_IF] xmm6260_off()
[ 6.835327] [MODEM_IF] PA EVENT : reset =0, pa=1
[ 6.840057] [MODEM_IF] umts_ipc0 state changed: OFFLINE
[ 6.845367] [MODEM_IF] xmm6260_on()
[ 6.866821] SMC: SecureCRC=0xBC7458DC
[ 6.959045] [MODEM_IF] PA EVENT : reset =1, pa=0
[ 7.042053] SMC PA: INFO 00000001 00:00:00.000 ------ ------ --------------- Booting... (t=00:25:15.356) SMCXG01.04p11.32196 /Widevine Integration
[ 7.058532] SMC PA: INFO 00000002 00:00:00.017 ------ ------ --------------- Booted
[ 7.238128] [MODEM_IF] misc_release : umts_boot0
[ 7.245147] omap_hsi omap_hsi.0: hsi_write_cancel ch 0
[ 7.251708] omap_hsi omap_hsi.0: __hsi_write_cancel : -125
[ 7.258941] omap_hsi omap_hsi.0: hsi_read_cancel ch 0
[ 7.265106] omap_hsi omap_hsi.0: __hsi_read_cancel : -125
[ 7.270629] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 7.276794] omap_hsi omap_hsi.0: __hsi_read_cancel : -61
[ 7.282470] [MODEM_IF] misc_open : umts_boot1
[ 7.287506] omap_hsi omap_hsi.0: Entering RX wakeup in 4 wires mode
[ 8.299774] misc dsscomp: [c7234000] ignoring set failure -22
[ 8.530609] s6e8aa: d/b 1, p 1, b-01390ffb
[ 8.530639] s6e8aa: c0, 1, b-001215fb, got v 3534794, factory wants 3529338
[ 8.530670] s6e8aa: c1, 1, b-00478927, got v 3764175, factory wants 3755229
[ 8.530700] s6e8aa: c2, 1, b-0012a421, got v 3486385, factory wants 3481495
[ 8.530731] s6e8aa: d/b 1, p 2, b-044d7cf9
[ 8.530761] s6e8aa: c0, 2, b-00bc6c9a, got v 3336878, factory wants 3330014
[ 8.530761] s6e8aa: c1, 2, b-01688d4e, got v 3556595, factory wants 3547367
[ 8.530792] s6e8aa: c2, 2, b-00a7db92, got v 3293516, factory wants 3285750
[ 8.530822] s6e8aa: d/b 1, p 3, b-0b323808
[ 8.530853] s6e8aa: c0, 3, b-026395cd, got v 3203365, factory wants 3194725
[ 8.530883] s6e8aa: c1, 3, b-0331a9fb, got v 3435905, factory wants 3424659
[ 8.530914] s6e8aa: c2, 3, b-021e3100, got v 3149091, factory wants 3139262
[ 8.530944] s6e8aa: d/b 1, p 4, b-186611f4
[ 8.530944] s6e8aa: c0, 4, b-062b8517, got v 3065435, factory wants 3053644
[ 8.531036] s6e8aa: c1, 4, b-0725b7f8, got v 3297279, factory wants 3284148
[ 8.531249] s6e8aa: c2, 4, b-053f8b4b, got v 3005194, factory wants 2992315
[ 8.531280] s6e8aa: d/b 1, p 5, b-6840e4ff
[ 8.531311] s6e8aa: c0, 5, b-221c3d41, got v 2688265, factory wants 2667329
[ 8.531341] s6e8aa: c1, 5, b-24fd4a51, got v 2906316, factory wants 2884895
[ 8.531372] s6e8aa: c2, 5, b-1d67176e, got v 2594260, factory wants 2571400
[ 8.531402] s6e8aa: d/b 1, p 6, b-ffffffff
[ 8.531433] s6e8aa: c0, 6, b-59b1b4d2, got v 2325286, factory wants 2292333
[ 8.531463] s6e8aa: c1, 6, b-60d28a3e, got v 2534439, factory wants 2499333
[ 8.531463] s6e8aa: c2, 6, b-4efd2a80, got v 2197307, factory wants 2162000
[ 11.727386] [MODEM_IF] misc_release : umts_boot1
[ 11.732147] omap_hsi omap_hsi.0: hsi_write_cancel ch 0
[ 11.756225] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 11.762268] omap_hsi omap_hsi.0: hsi_read_cancel ch 0
[ 11.767791] omap_hsi omap_hsi.0: __hsi_read_cancel : -125
[ 11.773620] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 11.779174] omap_hsi omap_hsi.0: __hsi_read_cancel : -61
[ 11.785552] [MODEM_IF] misc_open : umts_ipc0
[ 11.790954] omap_hsi omap_hsi.0: Entering RX wakeup in 4 wires mode
[ 11.798675] [MODEM_IF] misc_open : umts_rfs0
[ 11.829528] [MODEM_IF] PA EVENT : reset =1, pa=1
[ 11.834228] [MODEM_IF] umts_ipc0 state changed: ONLINE
[ 14.545074] drivers/misc/inv_mpu/mldl_cfg.c|inv_mpu_get_slave_config|1792 returning 4
[ 26.044372] request_suspend_state: wakeup (3->0) at 26030029299 (2012-05-13 00:25:34.359069826 UTC)
[ 26.622772] acc_open
[ 26.625122] acc_release
[ 26.670013]
[ 26.670043] Dongle Host Driver, version 5.90.125.94
[ 26.670043] Compiled in drivers/net/wireless/bcmdhd on Nov 21 2011 at 19:05:54
[ 26.684082] wl_android_wifi_on in
[ 26.687622] wifi_set_power = 1
[ 26.971282] =========== WLAN going back to live ========
[ 26.977600] sdio_reset_comm():
[ 27.066314] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
[ 27.228179] wifi_get_mac_addr
[ 27.232513] Firmware up: op_mode=1, Broadcom Dongle Host Driver mac=a0:0b:ba:e6:73:ae
[ 27.344390] dhd_rx_frame: net device is NOT registered yet. drop packet
[ 27.351531] dhd_rx_frame: net device is NOT registered yet. drop packet
[ 27.360076] Firmware version = wl0: Oct 5 2011 14:41:12 version 5.90.125.94
[ 28.639709] wl_bss_connect_done succeeded status=(0x9)
[ 28.732391] wl_bss_connect_done succeeded status=(0x11)
[ 29.166564] nfc_power_apply ON
[ 29.201965] nfc_power_apply OFF
[ 29.272308] nfc_power_apply ON
[ 35.672241] rpmsg_omx rpmsg-omx1: local addr assigned: 0x401
[ 35.682067] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
[ 35.703735] omap_hwmod: ipu: failed to hardreset
[ 35.713470] omap-iommu omap-iommu.0: ducati: version 2.1
[ 35.826934] rpmsg_omx rpmsg6: conn rsp: status 0 addr 101
[ 35.975158] rpmsg_omx rpmsg-omx1: Disconnecting from OMX service at 101
[ 39.279998] wlan0: no IPv6 routers present
[ 44.895355] init: untracked pid 1113 exited
[ 44.905731] init: untracked pid 1119 exited
[ 44.918914] init: untracked pid 1123 exited
[ 44.923248] init: untracked pid 1124 exited
[ 44.927612] init: untracked pid 1117 exited
[ 44.932067] init: untracked pid 1120 exited
[ 54.283905] max17040 4-0036: online = 1 vcell = 3788750 soc = 48 status = 3 health = 1 temp = 350 charger status = 0
[ 61.938812] request_suspend_state: sleep (0->3) at 61924468996 (2012-05-13 00:26:10.253540041 UTC)
[ 61.959869] dhd_set_suspend: force extra Suspend setting
first. The device checks if it's too hot or too cold to boot via IROM software (internal read only memory). After that it begins initialization. The IROM version is displayed. Then the device type..
The OMAP processor in the Galaxy Nexus is a HS (High Security) processor, as opposed to GP (General Purpose) processor. This means the first bootloader (AKA MLO or X-Loader) is a signed binary which is e-fused to the device.
I've seen in the past on similar Hummingbird processors that only the first 1K is checked for speed because hashing it takes a little bit of time. This may or may not be the case with this particular device. We will see.
Anyway.. There's a possiblity we can find an MLO which is already presigned somewhere on the Internet. We need whatever they use at Samsung which provides the initial firmware load to a device without any firmware on it.
Here is a relevant page: http://omapedia.org/wiki/Bootloader_Project
Code:
If you are using an HS (High Security) OMAP device, an extra step is required. First, build x-load.bin using the steps above. Then, download the MShield signing tool and use the commands below. Contact your TI representative to get access to this tool.
In order to get the firmware onto the device in the first place, this bootloader must exist. We need a copy of it. Once we have this bootloader, we can revive Galaxy Nexus devices.
You may have seen this already, but just in case - this seems to be a bootloader of some kind. I couldn't get it to work with my bricked SGN, but it may be of some use to the unbricking effort.
Can't post link, so search for "Unbrick dead Samsung GT-i9250 Galaxy Nexus 32GB".
Best of luck!
The user above is referring to this link, I think:
http://forum.xda-developers.com/showthread.php?t=1640443
The user there shares a .zip file that supposedly is able to unbrick a 32gb GNex using some samsung software. It calls OMAPFlash.exe with a bunch of parameters. I don't know whether it will be useful or not, but it's a start.
The batch file that the post above ^ asks the users to run is this:
Code:
::::
:: Copyright (C) 2010-2011, Samsung Electronics, Co., Ltd. All Rights Reserved.
:: Written by System S/W Group, S/W Platform R&D Team,
:: Mobile Communication Division.
::::
::::
:: Project Name : Proxima GED
::
:: Project Description :
::
:: Comments : tabstop = 8, shiftwidth = 8, noexpandtab
::::
::::
:: File Name : omap4460_tuna_hs.bat
::
:: File Description :
::
:: Author : System Platform 2
:: Dept : System S/W Group (S/W Platform R&D Team)
:: Created : 17/Aug/2011
:: Version : Baby-Raccoon
::::
:__loop
@OMAPFlash.exe -v @Targets\Projects\tuna\omap4460_tuna_hs_pro.txt
@PAUSE
GOTO __loop
Seeing the text file path, I went and looked. Here's what I found:
Code:
##
# Copyright (C) 2010-2011, Samsung Electronics, Co., Ltd. All Rights Reserved.
# Written by System S/W Group, S/W Platform R&D Team,
# Mobile Communication Division.
##
##
# Project Name : Proxima GED
#
# Project Description :
#
# Comments : tabstop = 8, shiftwidth = 8, noexpandtab
##
##
# File Name : omap4460_tuna_hs.txt
#
# File Description :
#
# Author : System Platform 2
# Dept : System S/W Group (S/W Platform R&D Team)
# Created : 17/Aug/2011
# Version : Baby-Raccoon
##
-omap 4
-t 36000 -p OMAP4460_TUNA_8G_HS_PRO -2
#chip_download [email protected] Targets\Projects\tuna\MBR.bin
chip_download [email protected] Targets\Projects\tuna\MLO_4460_HS_PRO
chip_download [email protected] Targets\Projects\tuna\sbl.img
command cold_sw_reset
So it appears that the software writes the files MLO_4460_HS_PRO and sbl.img to different parts of the internal memory.
Any success for the device driver? In the documents above, they say you should use the FTDI VCP (Virtual COM Port) drivers... But included in the package above, there is a driver in the ../usb_drv_windows directory, for exactly the TI driver you mentioned:
Code:
%USB_OMAP4460% = USB_Install, USB\VID_0451&PID_d010
For lazy reference:
Code:
[SIZE=2]-- Usage --
OMAPFlash Host is a command-line based application. It is currently available
for Windows XP only and will run in a Windows command shell. The application can
take commands directly from the command line or via a script file (a more useful
approach). The syntax for calling the tool is:
[B]omapflash [ <option> ] <command>[/B]
or, if a script file is used: omapflash @<file>
-- Options --
The tool has a number of options that can be used to control its overall
behavior.
[B]-com <port number> [/B]By default OMAPFlash will try to communicate with the
target platform using a USB serial link. This option will force OMAPFlash to
use a UART for serial communication and specify the host side COM-port to use.
-t <timeout> By default the timeout for communication on the serial link is 5
seconds. This option allows control of the timeout value by specifying another
timeout value in seconds.
[B]-p <platform>[/B] This option is required by OMAPFlash and specifies the platform
for which the download is to take place. The platform specified is a name tag
that allows OMAPFlash to identify the correct second loader to use. The tag
typically identifies the platform type and the memory used with the OMAP
device present on the platform (“e.g. SDP_MDDR_HYNIX_4G). The tag is used to
look up the second loader in a configuration file (omapflash2nd.txt) in
combination with an OMAP device identifier received from the platform during
peripheral boot.
[B]-omap <version> [/B]This option is required by OMAPFlash if a peripheral boot
sequence is used to transfer a second loader to a target platform. The option
specifies the OMAP generation used on the platform – without this option set,
OMAPFlash will be unable to determine how to correctly perform the peripheral
boot sequence necessary for transfer of the second loader to the platform. The
version number is a single digit integer (e.g. ‘3’ for an OMAP3xxx based
platform or ‘4’ for an OMAP4xxx based platform).
[B]-2[/B] This option controls whether OMAPFlash will try to use the ROM code
peripheral boot sequence to transfer a second loader to internal RAM before
doing anything else. This option will be required for most scenarios where
OMAPFlash is used but can be left out if OMAPFlash Host is interacting with a
second loader already running on a target platform.
[B]-v[/B] The ‘-v’ option controls whether OMAPFlash Host will run in verbose mode.
If set, more information will be shown during the execution of the flashing
sequence. Note that this option should be set in order to see the target
platform response to certain commands (e.g. ‘chips’).
-- Commands --
Commands are executed on the target platform. Any command is prefixed by the
keyword ‘command’ and anything following this keyword will be passed directly to
OMAPFlash Second by OMAPFlash Host without interpretation or modification.
Typically the ‘verbose’ option should be used with commands in order to ensure
that information returned from the platform will be shown on the console.
branch <device> <offset>
This command will cause OMAPFlash Second to make an
unconditional branch to a memory mapped address. The device will typically be
the SDRAM handled by the OMAP SDRAM controller in this case, and the offset
typically zero. The device ID must be one known by OMAPFlash Second and the
offset an integer within the address offset range valid for the device.
peek32 <address> Get the register value of the register with the given
address.
poke32 <address> <value> Modify the register at the given address to the given
value
peekpoke32 <address> <value> <mask> Modify the register at the given address
with the given value and mask
-- Flashing --
OMAPFlash Host is able to handle three basic procedures for accessing memory
devices through the OMAPFlash Second loader. These procedures are used to erase
memory devices, transfer a binary file to a device or upload the device content
to a binary file. In all cases, parameter values specifying sizes or offsets are
hexadecimal.
[B]chip_erase <device>[@offset] <size> [/B]
This procedure is used to erase the
content of a device, either for the whole device or for part of its address
range. The ‘device’ identifier is a string matching one of the devices
available on the platform as listed from the ‘chips’ command – in other words,
a device known to OMAPFlash Second for the particular platform used (SDRAM is
not a valid choice). If an ‘offset’ is used, the device erasure will start at
the offset specified. The offset will need to be compatible with the memory
structure of the device in question – e.g. if the device has a block size of
40000h bytes, the offset will need to be a multiple of the block size. The
‘size’ specifies the number of bytes to erase – a value of zero has the
special meaning of “to the end of the device”, either starting at offset zero
or at the specified ‘offset’ value, and can be used to erase the entire
device. Note that the typical erase functionality of a memory device is based
on the erasure of blocks of memory – it may not make sense to ask for erasure
of a size that is not a multiple of the block size of the device.
[B]chip_download <device>[@offset] <file> [/B]
In order to transfer a binary file to a
device on the platform this procedure is used. The ‘device’ identifier is a
string matching one of the devices available on the platform. If an ‘offset’
is specified the binary will be downloaded to the device starting at the
offset address specified. Using an offset should be done with some caution,
since the meaning of the offset value may be unclear for some device types
(e.g. for a NAND device the offset will be used without consideration of bad
blocks present in the memory space preceding the offset address). The file to
be downloaded is specified by the ‘file’ parameter and must be a raw image.
[B]chip_upload <device>[@offset] <size> <file> [/B]
In order to upload the content of
a memory device this procedure is used. The ‘device’ identifier is a string
matching one of the devices available on the platform. If an ‘offset’ is
specified content will be uploaded from the device starting at the offset
address specified. As for the ‘chip_download’ procedure the use of an offset
should be done with caution. The ‘size’ parameter specifies the number of
bytes to upload and the ‘file’ parameter the file to which the uploaded data
will be saved. Note that due to some limitations on the serial link, upload of
data will be considerably slower than download.
[/SIZE]
First things first. I recieved a PM from user itsalllgood with information regarding this topic. Here's the whole PM, copied and pasted:
itsalllgood said:
Dear fred,
Sorry to bother you...I wanted to post here but iam not allowed.. I am a computer engineer from montreal current living abroad..I had gnex that died and did a lot of work to try to get it back..to summ it all the omapidia project add TI site will get the full picture. the tool you linked is based on TI 1.6 omap flash.. i will keep it short... the link below will summ my work and please copy past it if you think its worth it..thanks in advance..
http://forum.xda-developers.com/showthread.php?p=26334564&posted=1#post26334564
Click to expand...
Click to collapse
^^ Somehow your link got messed up, but I think its this one.
Is it possible to hardware prevent a device like Samsung Galaxy S2 to go fastboot / odin mode when powering on but still be able to load the operating system?
Because even although I have a password set on the device, if it is stolen anyone can connect it to fastboot with power+voldown+menu and restore it to defaults. For example filling that corresponding partition with zeros will prevent from entering odin mode unless you boot into the operating system and with dd restore the partition.
First of all, that's off-topic. But I'll provide a speculative answer nonetheless.
I would think that you would be able to prevent a device from reaching recovery/fastboot/odin-download-mode, but it would have a big disadvantage, which is that if you are not able to boot into the OS somehow, you would have an unusable device. Although a device like the Galaxy Nexus, if stolen, could have its data retrieved by potentially using Odin and/or fastboot to reset the password, removing these failsafes would mean that you have a higher chance of bricking. Besides, that's what remote wipe apps (and other stolen-phone tools) are for. Check out Avast! if you don't have an antivirus/stolen-phone toolkit.
I'm by no means an expert here, but that's just my two cents.
EDIT: By the way, could we have someone (like AdamOutler) look at what we've got in this thread so far to see if the MLO file that we found is what's needed (as mentioned by Adam in the first couple posts)?
It's just that I don't either know the exact boot sequence of the SGS2 GT-I9100 nor the partitions interdependence (for example say that the boot partition needs the recovery or the sbl), I coudn't zero that partition because is a dependence.
What I woukd like to know if is possible:
- Backup all partitions.
- Zero, from android with dd, all partitions that allow anyone to enter odin/fastboot/clockworkmod/recovery so, if I lose the device, no one can make a odin backup or reset my device, unless you restore the partitions from the android or you use a hardware JTAG.
- Even the previous done, the phone must be able to normal boot into operating system.
I have a gut feeling that that's not possible. For recovery/odin modes, it may be possible due to them not really being directly involved in the boot process. However, for fastboot, I think it's part of the bootloader itself and therefore cannot be disabled using simple commands without also disabling the phone's booting process. For example, if you have the proper drivers installed on your computer, a Galaxy Nexus that's booting into Android will show up the same device as if you're connected via Fastboot. Unless someone can alter the source and recompile a bootloader with disabled fastboot, I don't think what you stated above is completely possible.
FredFS456 said:
I have a gut feeling that that's not possible. For recovery/odin modes, it may be possible due to them not really being directly involved in the boot process. However, for fastboot, I think it's part of the bootloader itself and therefore cannot be disabled using simple commands without also disabling the phone's booting process. For example, if you have the proper drivers installed on your computer, a Galaxy Nexus that's booting into Android will show up the same device as if you're connected via Fastboot. Unless someone can alter the source and recompile a bootloader with disabled fastboot, I don't think what you stated above is completely possible.
Click to expand...
Click to collapse
I think what I need could be done with a locked bootloader. As far as I know, the Samsung Galaxy S2 comes with an unlocked bootloader (causing the security flaw) while other like Samsung Galaxy Nexus come with a locked one: that means on stock devices, with use pattern or password and usb debugging disabled, there is no way someway can access you data even if not encryption is set.
Anyone can clarify things on this?
Bump, and back on topic.
Any developments here?
Yes. http://forum.xda-developers.com/showthread.php?t=1640443
it's done.
AdamOutler said:
Yes. http://forum.xda-developers.com/showthread.php?t=1640443
it's done.
Click to expand...
Click to collapse
Does anyone know HOW it's done??
EDIT: Actually the accompanying documentation explains quite well!
@Adam: Do you think we could tweak these drivers etc. for other devices not using OMAP?
(It seem that many protocols are standard, inducing the serial (UART) over USB FTDI-drivers...)
E:V:A said:
Does anyone know HOW it's done??
EDIT: Actually the accompanying documentation explains quite well!
@Adam: Do you think we could tweak these drivers etc. for other devices not using OMAP?
(It seem that many protocols are standard, inducing the serial (UART) over USB FTDI-drivers...)
Click to expand...
Click to collapse
It works just like UBM... but stock.
No. I dont think we can do that. Its an omap tool that requires bootmodes to be proper to work on omap. It can be applied to other properly configured omap devices.

FF18 Leak (OTA) Bluetooth Panasonic Home phone

I have a panasonic th12 home phone base that normally my phone connects to when I am at home over bluetooth. This allows me to use regular handsets while in the house to make / receive phone calls. I just updated to the FF18 from sfhub's odin and now my device no longer will connect the home phone base. It pairs but it will not stay connected or allow me to check the box for phone calls as well. Any ideas? is this a bluetooth bug?
Every time I flash I have to pair my phone with car again. I typically delete device profile from phone, delete phone profile from device, change bluetooth name of phone, pair phone with device under new name. Finally after paired wait for message to pop up on phone asking if device has permission to access your stuff and check box for always allow.
Yes my phone does the same for Microsoft sync in my vehicle but it will not connect with my home phone.
EDIT: I have a couple of logcat during the time i tried to connect my device to the base if that helps anything?
Code:
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:conn_complete() status 0x00
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/src/adapter.c:adapter_get_device() 00:80:F0:8F:61:B6
V/BluetoothEventLoop.cpp( 1910): event_filter: Received signal org.bluez.Device:PropertyChanged from /org/bluez/2534/hci0/dev_00_80_F0_8F_61_B6
D/BluetoothEventLoop( 1910): Device property changed: 00:80:F0:8F:61:B6 property: Connected value: true
I/BluetoothService( 1910): ACL connected, mAclLinkCount = 1
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:remote_features_information() hci0 status 0
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:remote_name_information() hci0 status 0
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:link_key_request() hci0 dba 00:80:F0:8F:61:B6
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:get_auth_info() hci0 dba 00:80:F0:8F:61:B6
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:link_key_request() kernel auth requirements = 0x04
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:link_key_request() Matching key found
I//system/bin/bluetoothd( 2530): bluetoothd[2534]: external/bluetooth/bluez/plugins/hciops.c:link_key_request() link key type 0x00
W/ActivityManager( 1910): Permission Denial: receiving Intent { act=android.bluetooth.device.action.ACL_CONNECTED flg=0x10000010 (has extras) } to com.locationlabs.v3client requires android.permission.BLUETOOTH due to sender android (uid 1000)
V/BluetoothEventManager( 4127): Received android.bluetooth.device.action.UUID
D/Bluetooth HSHFP( 2156): SDP UUID: TYPE_HANDSFREE
E/CachedBluetoothDevice( 4127): updating profiles for Base TH12
V/CachedBluetoothDevice( 4127): Class: 620210
V/CachedBluetoothDevice( 4127): UUID:
V/CachedBluetoothDevice( 4127): 0000111e-0000-1000-8000-00805f9b34fb
E/CachedBluetoothDevice( 4127): onUuidChanged: Time since last connect2151
D/CachedBluetoothDevice( 4127): Command sent successfully:CONNECT Address:00:80:F0:8F:61:B6 Profile:HEADSET
D/CachedBluetoothDevice( 4127): Preferred profiles = 1
D/BluetoothUtils( 2156): isHeadsetAllowedBySecurityPolicy
V/BT HSHFP( 2156): waitForAsyncConnectNative
V/BT HSHFP( 2156): connectAsyncNative
I/BT HSHFP( 2156): Created RFCOMM socket fd 125.
I/BT HSHFP( 2156): async connect is in progress (Operation now in progress)
V/BT HSHFP( 2156): Remaining time 486ms
V/BT HSHFP( 2156): select() returned 2.
E/BT HSHFP( 2156): RFCOMM async connect() error: Connection refused (111), nr = -1
V/BT HSHFP( 2156): disconnectNative
D/BluetoothService( 1910): CONNECTION_STATE_CHANGE: : 1 -> 0
V/BluetoothEventManager( 4127): Received android.bluetooth.headset.profile.action.CONNECTION_STATE_CHANGED
I/BluetoothDeviceProfileState( 1910): Entering ACL Connected state with: 102
D/BluetoothPbap( 1910): disconnect()
Looks like someone on CM had issues with this as well, but it eventually worked... mine doesnt
http://forum.cyanogenmod.com/topic/41497-bluetooth-wont-auto-connect/
Maybe someone can even point me in the right direction as to how to debug this situation? I have a development environment up for apps, but havent ever explored the base source code. If anyone has any thoughts it would truly be appreciated.
Its really makes me made because I had a similar problem with my last phone, the HTC hero. It got to the point you wait for all of these updates and then I had to limit my phone to like andorid 1.5 otherwise my phone would not connect. Its should be a bigger issue only because users who are not on xda would be screwed and could not rollback to a previous Android release. At lease this community exists so that I can go back if needed. As of right now I'm liking the new ics on this phone and will be very disappointed if I have to to back to GB just for this.

Build ResurrectionRemix V5.8.0 - Nougat for D855

Hi everyone !
I try to build RR from myself for the D855. The nougat version : V5.8.0 !
I followed the guide in RR android_manifest github : https://github.com/ResurrectionRemix/platform_manifest.
I build with Archlinux.
The process fail because of the prebuid package Gello. I don't know why, maven cannot download the apk.
Code:
FAILED: /home/julian/android/RR/out/target/common/obj/APPS/Gello_intermediates/org.cyanogenmod.gello-40.apk
/bin/bash -c "(mvn -q org.apache.maven.plugins:maven-dependency-plugin:2.10:get org.apache.maven.plugins:maven-dependency-plugin:2.10:copy -DremoteRepositories=central::::https://maven.cyanogenmod.org/artifactory/gello_prebuilds -Dartifact=org.cyanogenmod:gello:40:apk -Dmdep.prependGroupId=true -Dmdep.overWriteSnapshots=true -Dmdep.overWriteReleases=true -Dtransitive=false -DoutputDirectory=/home/julian/android/RR/out/target/common/obj/APPS/Gello_intermediates/ )"
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:2.10:get (default-cli) on project standalone-pom: Couldn't download artifact: Could not transfer artifact org.cyanogenmod:gello:apk:40 from/to central (https://maven.cyanogenmod.org/artifactory/gello_prebuilds): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
[ERROR] org.cyanogenmod:gello:apk:40
[ERROR]
[ERROR] from the specified remote repositories:
[ERROR] central (https://repo.maven.apache.org/maven2, releases=true, snapshots=false),
[ERROR] central (https://maven.cyanogenmod.org/artifactory/gello_prebuilds, releases=true, snapshots=true)
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[ 52% 17961/34013] target Package: Eleven (/home/julian/android/RR/out/target/product/d855/obj/APPS/Eleven_intermediates/package.apk)
Warning: AndroidManifest.xml already defines versionCode (in http://schemas.android.com/apk/res/android); using existing value in manifest.
Warning: AndroidManifest.xml already defines versionName (in http://schemas.android.com/apk/res/android); using existing value in manifest.
Warning: AndroidManifest.xml already defines minSdkVersion (in http://schemas.android.com/apk/res/android); using existing value in manifest.
Warning: AndroidManifest.xml already defines targetSdkVersion (in http://schemas.android.com/apk/res/android); using existing value in manifest.
[ 52% 17961/34013] Building with Jack: /home/julian/android/RR/out/target/common/obj/APPS/Exchange2_intermediates/with-local/classes.dex
ninja: build stopped: subcommand failed.
make: *** [ninja_wrapper] Error 1
make: Leaving directory `/home/julian/android/RR'
[COLOR="Red"]#### make failed to build some targets (19:06 (mm:ss)) ####[/COLOR]
Why are there some prebuild packages ?
How can I build them from source ? Or how can I remove then from my build ?
I did not find information on cynogenmod wiki (archive.org). Maybe because of the cyanogen shutdown, there is no way to build CM.
Thanks !
Julian

Categories

Resources