# Do you want to help out developers?  Got a broken device?



## AdamOutler (Aug 26, 2011)

We now have the ability to make all devices with Hummingbird processors into "Super-Dev Phones".  I just need a single dead board from each model to locate the proper modification.  It can be water-damaged, broken, busted, cracked, smacked, set on fire, chewed on by your dog, dropped, thrown against a wall, or otherwise inoperable.   I need a mainboard from each device to make this work.

If you wish to donate a dead device, post here, send a PM, or email me at my username @gmail.com

We can bring this modification to *every device* with the same processor, we just need to perform analysis before you can set up your device for bootloader development, or resurrect them from a hard-bricked state with nothing but software after a slight hardware mod.

We need to locate the xOM5 pin on following devices before they can be modified into UnBrickable Super-Development devices:
*SGH-i896 Samsung Captivate UnBrickable  thanks: bulletproof
SGH-i897  Samsung Captivate  UnBrickable   thanks: bulletproof
GT-i9000 Samsung SGS UnBrickable   thanks: Zak Stinson
S8500 Samsung Wave Plans Available thanks: Rebellos
S8530 Samsung Wave II Plans Available  thanks: Rebellos
SPH-D700 Samsung Epic 4G Plans Available  thanks: James I-----
SGH-i997 Samsung Infuse 4G UnBrickable   thanks pdx 528e 
SGH-T959 Samsung Vibrant UnBrickable  thanks: ChauncyG 
SGH-T959V Samsung GalaxyS 4G UnBrickable  thanks: bhundven 
SGH-T849 Samsung Galaxy Tab 7.0 inch
GT-P1000  Samsung Galaxy Tab  UnBrickable  Thanks F50+
GT-P100 Samsung Sprint Galaxy Tab UnBrickable  
SCH-i800  Samsung Verison/US Cellular Galaxy Tab 7.0 UnBrickable  
SHW-M180 Samsung Galaxy Tab
GT-i9010 Samsung  Giorgio Armani Galaxy
T839  Samsung Sidekick 4g  UnBrickable 
SCH-i500  Samsung Fascinate UnBrickable  thanks: RootzWiki
SCH-i520  Samsung Droid Charge USB OTG port issue  thanks: Clarkkent434
7e ViewSonic ViewPad
R90L200 Pandigital 9" tablet 
SGH-i987 Samsung  Galaxy Tab 7.0
SGH-T849 T-Mobile Samsung  Galaxy Tab 7.0
GT-P1000N Samsung  Galaxy Tab 7.0
SGH-i877 Samsung Inspiration 
GT-I9020  Google Nexus S GSM - Failed -
GT-I9023  Google Nexus S CDMA - USB OTG port issue - Modification located, but CDMA gets in the way of USB OTG

GT-P1010 Samsung Galaxy Tab 7.0 Wi-Fi 16GB
M9 Meizu 
SC-01C NTT DoCoMo Galaxy Tab 7.0
X10 Viliv  HSPA 32GB
X7 Viliv  HSPA 32GB
SCH-i400 Samsung Continuum 
M9300 Kyocera Echo 
YP-G1CW Samsung  Galaxy S WiFi 4.0 8GB
SGH-T759 Samsung  Exhibit 4G
yp-g70 Samsung galaxy s wifi 50 2
YP-G70EW Samsung Galaxy S WiFi 5.0 16GB
YP-GB70NW Samsung Galaxy Player 70 32GB
SCH-I500 Samsung Galaxy S Mesmerize
YP-MB2 Samsung Yepp / Galaxy Touch 32GB
GT-I9088 Samsung Galaxy S
YP-GB1EW Samsung  Galaxy Player 
16GBH-I909 Samsung Galaxy S Pro Galaxy S
SCH-W899 Samsung phone
SCH-R910 Samsung Galaxy Indulge / Forte\
MID8024-4G Coby Kyros 8"
MID7022-4G  Coby Kyros 7"
MID1024-4G   Coby Kyros 10.1
*

Just about anything with a Samsung processor in it.. There's so many 
devices. These are the most common ones we are targeting.


Once I have received any of the above boards, I will attempt one of the following tricks to find out where the xOM5 resistor lies. Please understand that there is ALWAYS risk while working on electronics.  I have done several of these sucessfully.  

*Methods for locating modificaton*
1.  Monitor memory locations in real-time while using the viewmem tool for changes to the OM registers.  This only works on a rooted and working device.  I can short high from behind a 10kohm pull-up resistor to a low value which is pulled down from a 100kOhm pull-down reistor.  This will allow the high to counteract the low and a memory location can be monitored while performing this operation.  This leaves the device totally operational and is the best way to perform this type of analysis, but is only accessible on some devices

2. Using overlays and processor pinouts, I can trace out likely locations of the xOM5 resistor, make a modification, and watch the results from the SBL over UART.  This leaves the device totally operational. 

3. Using relative positioning, I can pick a resistor, make a change and test for proper modifiction.  This leaves the device totally operational.

4. Using a multimeter, I can remove the processor from a device and trace out the pins manually.  This method is only appropriate for a broken device.  


As an additional benefeit, we may be able to port the Nexus S bootloaders to the device, allowing for the latest version of Android to be ported easily to the device... After that, Ubuntu, Apple iOS, WP7, you name it... 

Let me get into some of the technical details here...  If you're not technical, jump to the end.  
----
Pure and simple, this is a hardware exploit which allows direct upload of code to run on the S5PC110/Hummingbird/Cortex A8 platform.   Samsung's chain of trust(CoT) model uses hardware to authenticate the Integrated Read-Only Memory (IROM), which authenticates the initial bootloader (IBL), which authenticates the Primitive Bootloader(PBL)...  The IROM,IBL, and PBL are all loaded in IRAM, the PBL's job is to initialize Dynamic RAM(DRAM) and authenticate/load the Secondary bootloader(SBL AKA BL3), which loads a kernel, which loads the operating system you see on-screen.

This is a two part hack.  We've developed a hardware modification which allows USB download of code. We've also developed the Hummingbird Interceptor bootloader(HIBL) which intercepts the CoT and allows a second, unsigned download.    The HIBL uses official code to handle authentication, which jumps to another memory location.   It's this memory location where we place our exploit.   Our exploit reuses the same code that downloads the HIBL to IRAM, but it initializes DRAM which means you can directly upload a SBL(the final bootloader) to DRAM.  

So once again.. really quick...  We use a hardware mod to download Rebellos' HIBL, which violates the Chain of Trust, exploits a memory jump and allows unsigned code to run on the processor.  All this means you can revive a dead phone easily or try out other operating systems and debug easily, regardless of signature checking on the device. 
---------

The first part is the hardware modification so things can be tested without risk.  Please help out if you have a dead device.  I can make constructive use of it, or you can PM me for instructions.  Either way, that old junked device you have can help out millions of people.


----------



## orb3000 (Aug 26, 2011)

Made sticky for the time being

@all
If you don´t have any of the requested stuff please stay away from cluttering the thread, all non related posts such as "great idea!" and so will be deleted and re-incidence could lead to a ban


----------



## AdamiX (Aug 28, 2011)

AdamOutler said:


> As an additional benefeit, we may be able to port the Nexus S bootloaders to the device, allowing for the latest version of Android to be ported easily to the device. Apple iOS, WP7, Ubuntu, you name it...

Click to collapse



So maybe u can run iOS on samsung, or WP7 on iPhone?
Or i misunderstand?


----------



## akurei (Aug 28, 2011)

Is my HTC Desire a Cortex-A8 phone or is it not? I didn't know and just NOW found out (after some googleing): "Nope... Some kind of snapdragon cpu".
But I guess not everyone takes the time to look up the cpu of their phone like I did.

I believe if you explicitely list all C-A8 devices (although it seems like a lot of work to do so) you'll receive more bricked phone donations as when you only list the most common ones, because most guys will probably read this post, say "mhh, no my phones not listed here", close their browser tab and forget about that thread, even though they might have a C-A8 phone.

If you want to maximize the donations of bricked phones, list them explicitely in a "searchable" (=search engine friendly) manner.

Just a recommendation, though


----------



## Ace42 (Aug 28, 2011)

akurei said:


> Is my HTC Desire a Cortex-A8 phone or is it not? I didn't know and just NOW found out (after some googleing): "Nope... Some kind of snapdragon cpu".
> But I guess not everyone takes the time to look up the cpu of their phone like I did.
> 
> I believe if you explicitely list all C-A8 devices (although it seems like a lot of work to do so) you'll receive more bricked phone donations as when you only list the most common ones, because most guys will probably read this post, say "mhh, no my phones not listed here", close their browser tab and forget about that thread, even though they might have a C-A8 phone.
> ...

Click to collapse



No it's not 


Apple A4
Samsung Hummingbird
TI OMAP3
Only phones with the above are from Ol-Sammy, Big Apple, and Google's MOTO . HTC gets their cpu's from Qualcomm which has their own special architecture that's a hybird of Arm v7/v8. But it's closer to v7 so your device can't help them.


----------



## bedwa (Aug 29, 2011)

Oy, you now have me torn. I picked up a physically broken iphone 4 last weekend and am planning to repair and sell it, but I would love to see this go off the ground.... Decisions, decisions......


----------



## AdamOutler (Aug 29, 2011)

AdamiX said:


> So maybe u can run iOS on samsung, or WP7 on iPhone?
> Or i misunderstand?

Click to collapse



Let me break this down...  This modification means you can NEVER brick your phone.  You have to physically destroy it.  There's no firmware which can ruin the phone.   You simply plug it in and run this tool.. 





This tool is still a work in progress.  It requires a Linux machine (or linux Virtual machine) in order to run.  However, it works, and it works well.  This tool will work for:
SGH-i897
SGH-i896
SGH-i9000
SGH-i9010
SGH-i997
GT-P1000
T959...   We will need to write another tool for other devices. 

What this allows is for debugging of entire operating systems without any risk.   For example,  I installed BADA Bootloaders to my device last night with one of the guys from the BadaDroid project (they're working on porting Android to Bada).   My device totally crapped when it saw that firmware, but it gave detailed logging messages about GPIOs.   It would be possible to take that firmware and rewrite it to work with our devices, and it basically eliminates that "what if I screw something up" $600 barrier that prevents porting of other operating systems to our devices.   

After I flashed Bada bootloaders with the tool above, I simply pulled the battery out, put it back in, connected to USB, used the tool above and it put my phone back into Odin download mode, at which point I reflashed the device.

We need to spread this mod to all the devices.  Currently we have SGH-i897 mod done.


----------



## StarbuxMcCloud (Aug 29, 2011)

Ace42 said:


> No it's not
> 
> 
> Apple A4
> ...

Click to collapse



That would mean the Samsung GT-I917 (Focus) wouldn't work because it uses a Qualcomm CPU. So why was it included in the list?


----------



## Ace42 (Aug 29, 2011)

StarbuxMcCloud said:


> That would mean the Samsung GT-I917 (Focus) wouldn't work because it uses a Qualcomm CPU. So why was it included in the list?

Click to collapse



I would ask the OP, could be a mistake, unless it still has a xOM5 pin on board. Which could be possible since it's still a Sammy after all. And Sammy makes parts for Apple too. He didn't put any htc phones in the OP, so only Sammy built phones contain the pin he wants.


----------



## AdamOutler (Aug 29, 2011)

StarbuxMcCloud said:


> That would mean the Samsung GT-I917 (Focus) wouldn't work because it uses a Qualcomm CPU. So why was it included in the list?

Click to collapse



You're right, removed from the list.   I must have received some misinformation somewhere.


----------



## ugothakd (Aug 29, 2011)

Great job! THIS is xda is all about. Hacking the devices until you cant hack them anymore


but no Samsung Epic 4g love?... Its sprints version of the Galaxy S


----------



## Ace42 (Aug 29, 2011)

ugothakd said:


> Great job! THIS is what xda is all about. Hacking the devices until you cant hack them anymore
> 
> 
> but no Samsung Epic 4g love?... Its sprints version of the Galaxy S

Click to collapse



That one should work too, it has the Cortex in it,  guess he has to add that one next. Unless CDMA causes issues with his tools..


----------



## kmmxracer (Aug 29, 2011)

I have a I9020T Nexus S that a shotty kernel made me loose my baseband and pretty much all phone info including IMEI.

It's pretty much a tiny wifi tablet at this point. That being said I'm not sure I want to part ways with it, but I really don't want to send it off to Samsung.

If you guys have and Ideas on how to fix it, I don't mind using it for testing.

Also may be interested in a PM with instructions on what is needed to get the information you'll need to help develop your work. 

Either way, thank you all for the hard work, I think this is an awesome development for our community.


----------



## Samsunguy (Aug 29, 2011)

AdamOutler said:


> We need to locate the xOM5 pin on following devices before they can be modified into Super-Development devices:
> 
> *Samsung I9000 SGS
> Samsung S8500 Wave
> ...

Click to collapse




I just want to help out your list by adding some more common phones that use the Cortex-A8 Processor:

Samsung i8910 Omnia HD
All First Gen. iPad types 
Samsung T839 Sidekick 4g
Palm pre, Palm pre plus
Palm pixi, Palm pixi plus
iPhone 3GS 
Samsung SCH-i520, Samsung Inspiration, Samsung Stealth V, Droid Charge
Most All motorola android phones running 1ghz processors 
Nokia N900


----------



## nubecoder (Aug 29, 2011)

Thankx Samsunguy, could you add in the model numbers as well?

For instance, Samsung SPH-D700 Epic 4G​ should be added to the list (and I'll be hunting down people with a "broken" Epic for the cause).

=]


----------



## Samsunguy (Aug 29, 2011)

nubecoder said:


> Thankx Samsunguy, could you add in the model numbers as well?
> 
> For instance, Samsung SPH-D700 Epic 4G​ should be added to the list (and I'll be hunting down people with a "broken" Epic for the cause).
> 
> =]

Click to collapse



I updated my list and added common names and model numbers for the devices that had them.
And no problem


----------



## mystichobo (Aug 29, 2011)

Hey Adam,
I've got a motorola droid here (with a broken speaker/microphone cable, so sound etc doesn't work), which uses the OMAP3430 CPU, would you be interested in this?

Might be very handy for debugging the Milestone, which is pretty much the same, but GSM and with a locked down bootloader.

Cheers,
Hobo


----------



## Volcacius (Aug 29, 2011)

*s5pc110/s5pv210*

Shouldn't the list include s5pc110/s5pv210 based devices only? Cortex A8 is a bit general.


----------



## AdamOutler (Aug 29, 2011)

Samsunguy said:


> I just want to help out your list by adding some more common phones that use the Cortex-A8 Processor:
> 
> Samsung i8910 Omnia HD
> All First Gen. iPad types
> ...

Click to collapse



Thank you.  I will review each one for compatibility.  They must be based on Hummingbird archetecture... really quickly, I checked the wikipedia on the Droid Charge and it said S5PC110 so that's a go for sure!   



Samsunguy said:


> I updated my list and added common names and model numbers for the devices that had them.
> And no problem

Click to collapse



I appreciate that, it makes things alot easier


masmalo said:


> The Samsung Galaxy Tab 7 Wifi Only GT-P1010 uses the Cortex A-8 too

Click to collapse



  I will add that one.  Thanks.



mystichobo said:


> Hey Adam,
> I've got a motorola droid here (with a broken speaker/microphone cable, so sound etc doesn't work), which uses the OMAP3430 CPU, would you be interested in this?
> 
> Might be very handy for debugging the Milestone, which is pretty much the same, but GSM and with a locked down bootloader.
> ...

Click to collapse



  I'm not sure about Motorola products.. I think they mostly use the Qualcom archetecture...  I'll verify to make sure.


----------



## AdamOutler (Aug 29, 2011)

Volcacius said:


> Shouldn't the list include s5pc110/s5pv210 based devices only? Cortex A8 is a bit general.

Click to collapse



You may be right, but so far that's all we've found in common with the entire range of processors.    don't forget the S5PC100, OMAP and A4.


----------



## AdamOutler (Aug 29, 2011)

Added:
Apple iPad 16/32/wifi/3g
Samsung i8910 Omnia HD
Samsung T839 Sidekick 4g
Samsung Galaxy Tab 7 Wifi Only GT-P1010\
Samsung Droid Charge
Samsung SCH-i520 Droid Charge
Samsung SGH-i877 Inspiration, 

This is based on the A9 arch and therefore is not in the range:
Samsung Stealth V


Cannot verify compatibility based on lack of information:
iPhone 3GS 
Palm pre, Palm pre plus
Palm pixi, Palm pixi plus
Most All motorola android phones running 1ghz processors 
Nokia N900


----------



## Nick14 (Aug 29, 2011)

3GS shouldn't have any problems  as it is a samsung cortex A8


----------



## AdamOutler (Aug 29, 2011)

Nick14 said:


> 3GS shouldn't have any problems  as it is a samsung cortex A8

Click to collapse



I can see the telltail sign of those 6 resistors right here...  Find the Pin0 dot on the processor and go straight down and off the chip to the left.
http://static.seekingalpha.com/uploads/2008/7/20/saupload_pmiphone_boardtopbig.jpg



Yep... that's the OM pins.


----------



## popfan (Aug 29, 2011)

Cannot verify compatibility based on lack of information:
iPhone 3GS 
Palm pre, Palm pre plus
Palm pixi, Palm pixi plus
Most All motorola android phones running 1ghz processors 
Nokia N900[/QUOTE]

I found this article on the Palm pre and pre plus:
Firstly, the Palm Pre (8GB) and Palm Pre Plus (16GB) come with the very same processor and PowerVR SGX chipset as the iPhone 3GS. The iPhone 3GS uses PowerVR SGX 520 which is a low-end chipset, whereas the Palm Pre has a higher end PowerVR SGX 530 chipset. So in short the Palm Pre can perform better than the iPhone 3GS in regards to 3D Gaming and other multimedia operations.

Full Article info here:
http://forums.precentral.net/palm-pre-pre-plus/223944-palm-pre-plus-512mb-ram-no-ways-pls-read.html


----------



## popfan (Aug 29, 2011)

On PIXI it doesn't look like it will be compatible because it uses a Qualcomm Chip.

http://pdadb.net/index.php?m=specs&id=2169&c=palm_pixi_plus


----------



## Nitro_123 (Aug 29, 2011)

Devs can I link to this in the SGS general forums ? Thanks in advance


----------



## Zagdima (Aug 29, 2011)

Hello guys so far as i understand you can unbrick any device with samsung s5pc110 cortex a8. So what about Chinese tablet dropad a8x who have this chip.
some photos of motherboard
bigger img508.imageshack.us/img508/8457/26087105.jpg
bigger2 img828.imageshack.us/img828/2678/34464026.jpg

link on slatedroid topic to people with broken devices
slatedroid.com/topic/20404-did-i-brick-my-a8x/


----------



## wocko1 (Aug 29, 2011)

How come iPod Touch 4th Gen isn't on the list? It has the same processor as the iPad/iPhone 4.


----------



## Nick14 (Aug 29, 2011)

popfan said:


> Cannot verify compatibility based on lack of information:
> iPhone 3GS
> Palm pre, Palm pre plus
> Palm pixi, Palm pixi plus
> ...

Click to collapse



I found this article on the Palm pre and pre plus:
Firstly, the Palm Pre (8GB) and Palm Pre Plus (16GB) come with the very same processor and PowerVR SGX chipset as the iPhone 3GS. The iPhone 3GS uses PowerVR SGX 520 which is a low-end chipset, whereas the Palm Pre has a higher end PowerVR SGX 530 chipset. So in short the Palm Pre can perform better than the iPhone 3GS in regards to 3D Gaming and other multimedia operations.

Full Article info here:
http://forums.precentral.net/palm-pre-pre-plus/223944-palm-pre-plus-512mb-ram-no-ways-pls-read.html[/QUOTE]

3gs got a PowerVR SGX 535.... Get your information right


----------



## popfan (Aug 29, 2011)

Nick14 said:


> I found this article on the Palm pre and pre plus:
> Firstly, the Palm Pre (8GB) and Palm Pre Plus (16GB) come with the very same processor and PowerVR SGX chipset as the iPhone 3GS. The iPhone 3GS uses PowerVR SGX 520 which is a low-end chipset, whereas the Palm Pre has a higher end PowerVR SGX 530 chipset. So in short the Palm Pre can perform better than the iPhone 3GS in regards to 3D Gaming and other multimedia operations.
> 
> Full Article info here:
> http://forums.precentral.net/palm-pre-pre-plus/223944-palm-pre-plus-512mb-ram-no-ways-pls-read.html

Click to collapse



3gs got a PowerVR SGX 535.... Get your information right[/QUOTE]

Was not me.  That was the author of the article.  Will check and verified next time.


----------



## lj27416 (Aug 30, 2011)

I have a Samsung T959 Vibrant. Will not boot. JTAG is no good. not even one blink.
If i can help, and get it running at the same time. Lemme know.

LJ


----------



## midas5 (Aug 30, 2011)

kmmxracer said:


> I have a I9020T Nexus S that a shotty kernel made me loose my baseband and pretty much all phone info including IMEI.
> 
> It's pretty much a tiny wifi tablet at this point. That being said I'm not sure I want to part ways with it, but I really don't want to send it off to Samsung.
> 
> ...

Click to collapse



This is more about recovering the efs partition and getting the IMEI back. Start a different thread for that.


----------



## midas5 (Aug 30, 2011)

Our unbreakable mod should work with any phone that has an IROM and the same seckey.
Maybe, to generate our list of phones we should ask people to send in IROM images for us to analyse.


----------



## AdamOutler (Aug 30, 2011)

midas5 said:


> Our unbreakable mod should work with any phone that has an IROM and the same seckey.
> Maybe, to generate our list of phones we should ask people to send in IROM images for us to analyse.

Click to collapse



Rebellos' HIBL is universal to bada and Android phones...  It will have to be redone for a few different phones, but overall it will be pretty much the same code driving everything.   He said the same bootloader that loaded my phone can work on his.


----------



## Helter2 (Aug 30, 2011)

*Hi, guys.* *Help unbrick Dropad A8X* --- Samsung S5PC110 Cortex А8Очень a large number of people forced to send the plates back to the manufacturer, wasting time and money. *Help restore of bricks.* *Please !!!*

Here's a photo motherboard:
http://forum.xda-developers.com/attachment.php?attachmentid=704944&stc=1&d=1314720227 
http://forum.xda-developers.com/attachment.php?attachmentid=704945&stc=1&d=1314720227
http://forum.xda-developers.com/attachment.php?attachmentid=704946&stc=1&d=1314720227


----------



## AdamOutler (Aug 30, 2011)

Helter2 said:


> *Hi, guys.* *Help unbrick Dropad A8X* --- Samsung S5PC110 Cortex А8Очень a large number of people forced to send the plates back to the manufacturer, wasting time and money. *Help restore of bricks.* *Please !!!*
> 
> Here's a photo motherboard:
> http://forum.xda-developers.com/attachment.php?attachmentid=704944&stc=1&d=1314720227
> ...

Click to collapse



Send a board to me.  I just need one to do a writeup.

Also I believe it is possible to unbrickable the c100-110 via one of the ports.


----------



## AdamOutler (Aug 30, 2011)

lj27416 said:


> I have a Samsung T959 Vibrant. Will not boot. JTAG is no good. not even one blink.
> If i can help, and get it running at the same time. Lemme know.
> 
> LJ

Click to collapse



The initial analysis is destructive....  if you want, I could glue the processor back on and you could do whatever when I send it back, LOL.


----------



## Clarkkent434 (Aug 30, 2011)

*Bricked Droid Charge*

I just bricked my SCH-I510 Droid Charge. I tried this imoseyon GB kernal last night with GummyCharged GBE 1.9RC2.3. I reboot my phone after flashing the kernal and the went black. So it tried to get it to recovery there was no recovery it wiped it. So i was going in to put it in download and use odin and fix it but it wipe out download load mode. It basically bricked my phone. Odin won't recognize it.


----------



## AdamOutler (Aug 30, 2011)

Clarkkent434 said:


> I just bricked my SCH-I510 Droid Charge. I tried this imoseyon GB kernal last night with GummyCharged GBE 1.9RC2.3. I reboot my phone after flashing the kernal and the went black. So it tried to get it to recovery there was no recovery it wiped it. So i was going in to put it in download and use odin and fix it but it wipe out download load mode. It basically bricked my phone. Odin won't recognize it.

Click to collapse



Great!  Send me a PM.  I need the board. I'll gladly remove the processor and get the modifications documented for an Unbrickable Droid Charge.


----------



## AdamOutler (Aug 31, 2011)

Added video to first post


----------



## orb3000 (Aug 31, 2011)

*.*

Please help us:



orb3000 said:


> Please, if you don´t have any of the requested stuff please stay away from cluttering the thread, all non related posts such as "great idea!" and so will be deleted and re-incidence could lead to a ban

Click to collapse


----------



## daugh016 (Sep 1, 2011)

I have an iphone 3G or 3GS (not sure which one) that I found in the parking lot at the gym.  The screen is crushed because someone ran it over and i'm not sure about the internals.  It's just sitting here because I don't want to get it fixed and have AT&T trace a possibly lost IMEI number to me.

Could you use it?


----------



## mnpolock (Sep 2, 2011)

I have a number of phones that I can donate.... I will get a list together ...can you let me know what you need to determine if they will work for you.... do I just need Manuf and model # or what would you like in the list to figure out if you want it for your testing (I have multiple carriers, phones, etc..).

Thanks,

TOny


----------



## AdamOutler (Sep 2, 2011)

daugh016 said:


> I have an iphone 3G or 3GS (not sure which one) that I found in the parking lot at the gym.  The screen is crushed because someone ran it over and i'm not sure about the internals.  It's just sitting here because I don't want to get it fixed and have AT&T trace a possibly lost IMEI number to me.
> 
> Could you use it?

Click to collapse



I'm sorry...  someone gave me some bad information.  Only the iPhone4/pad will work.  Removed from list.



mnpolock said:


> I have a number of phones that I can donate.... I will get a list together ...can you let me know what you need to determine if they will work for you.... do I just need Manuf and model # or what would you like in the list to figure out if you want it for your testing (I have multiple carriers, phones, etc..).
> 
> Thanks,
> 
> TOny

Click to collapse



the requirement is a hummingbird processor or a hummingbird based processor.   They are all smartphones. Mostly Samsung, but some others as well.  See the list on the first page.


----------



## AdamOutler (Sep 2, 2011)

rbk1016 said:


> iPhone 4 x 2 (one black 32gb mint, one white 16gb mint)

Click to collapse



if you can sacrifice the iPhone4 board and the iPad board, then I can remove the processor, get the proper modification documented, and we can move on from there with uploading unsecure code.  The first part is to get the device into S5PC110 USB download mode....  this is several levels lower in the boot sequence then the DFU mode (SBL) which is used to reload Apple Software...  Apple can patch over jailbreaks, but once we have this, then there's nothing Apple can do.  

It is likely that we already have the proper interceptor bootloader ready.  Rebello's HIBL may already work with it. The only question is if they have a funky sort of different signature check, in which case it may be necessary to disassemble the firmware and rewrite a HIBL.   This is beyond me, however Rebellos is good with this type of stuff.

Send a pm to me. 

Also, we are only interested in the devices on the list.  The 3/3g/2/original devices are not going to work with this particular mod..  Maybe newer devices.

I'm not paying a dime.  If you want this modification brought to your platform, then you can fork up the hardware and ill send it back when the work has been completed.


----------



## popfan (Sep 2, 2011)

I did check ARM's website and noticed that the Palm Pre is using the A8 chipset if you want to include this again on the first page.

http://www.arm.com/markets/mobile/palm-pre.php
Palm Pre
Palm Pre Image (View Larger Palm Pre Image)

Introducing Palm® Pre™, a phone so in sync with your life it feels like it's thinking ahead for you. Pre pulls your different online calendars into one view, bringing you the information you want without having to search for it. Pre links your contacts from different sources, giving you one place to find what you need. And Pre delivers incoming messages1 and notifications in an intuitively subtle way, letting you react or respond however you want. People, events, information that matters. With Palm Pre, it’ll come to you.
ARM Processor: Cortex-A8
Sources:  TI Powers Palm Pre – EETimes Article


----------



## PatchesDM (Sep 3, 2011)

I have an Apple iPhone 4, where should I send it? (All apologies if I missed it somewhere)


----------



## duce102 (Sep 3, 2011)

I request the SPH-D700 Samsung Epic 4G be added to the list.... Ill be on a hunt for bricked devices and refer them to this page and have them pm you....  im so freaking excited!!!!!


----------



## rhernz212 (Sep 3, 2011)

No Galaxy S 4G?
If added, I'll post a link to this in the General section of the SGS4G forums.


----------



## AdamOutler (Sep 3, 2011)

PatchesDM said:


> I have an Apple iPhone 4, where should I send it? (All apologies if I missed it somewhere)

Click to collapse



PM sent


theduce102 said:


> I request the SPH-D700 Samsung Epic 4G be added to the list.... Ill be on a hunt for bricked devices and refer them to this page and have them pm you....  im so freaking excited!!!!!

Click to collapse



That is Samsung Exnyos processor.  It is newer then the target of this thread.  If you can find datasheets, I'll be on it.



rhernz212 said:


> No Galaxy S 4G?
> If added, I'll post a link to this in the General section of the SGS4G forums.

Click to collapse



I'll add that.    Do you have the model number?


----------



## duce102 (Sep 3, 2011)

AdamOutler said:


> That is Samsung Exnyos processor.  It is newer then the target of this thread.  If you can find datasheets, I'll be on it

Click to collapse



Nope thats the SGSii Epic 4G Touch.... The SPH-D700 has a 1GHz Samsung S5PC110 RM CORTEX-A8 (Hummingbird) 

http://en.wikipedia.org/wiki/ARM_Cortex-A8


http://en.wikipedia.org/wiki/Samsung_Galaxy_S

http://shop.sprint.com/mysprint/shop/phone_details.jsp?ensembleId=SPHD700BKS




As for the SGSII w/ Exynos, did you say you could possibly use this mod on that processor if I got you the data sheet? Cause I plan on getting the Epic 4G Touch and it would be awesome if we could get this mod on that device.....




EDIT: If I sent you my board, you take the processor off, and map the pins, could you put the processor back on the board to where it looks untouched long enough to have the phone rapid exchanged by insurance..... If this is messed up let me know cause I just want this so bad but I dont want to be phone-less afterwards


----------



## Nitro_123 (Sep 3, 2011)

Guys i gut these links showing some pics of the I9000 mainboard

http://www.ubmtechinsights.com/repo...stigative-analysis/samsung-galaxy-s/teardown/
http://www.squidoo.com/disassembly-of-samsung-galaxy-s
http://www.careace.net/2010/06/09/disassembly-of-the-samsung-galaxy-s/

Hope it helps in locating the xOm5 resistors and everything


----------



## nubecoder (Sep 3, 2011)

There was someone supposed to be sending Adam an Epic 4G already.  I thought Adam had even responded to the PM already...  Maybe there is some confusion at hand.

Adam, hit me up in IRC sometime when you see me, if you need to get in touch with the guy again.

=]


----------



## AdamOutler (Sep 3, 2011)

theduce102 said:


> Nope thats the SGSii Epic 4G Touch.... The SPH-D700 has a 1GHz Samsung S5PC110 RM CORTEX-A8 (Hummingbird)
> 
> http://en.wikipedia.org/wiki/ARM_Cortex-A8
> http://en.wikipedia.org/wiki/Samsung_Galaxy_S
> ...

Click to collapse



I don't have the ability to replace the processor.   I'm sorry.  If you can deal without it for a while... maybe the processor can "fall off" and you can RMA it because it does not work anymore?  dunno....



Nitro_123 said:


> Guys i gut these links showing some pics of the I9000 mainboard
> 
> http://www.ubmtechinsights.com/repo...stigative-analysis/samsung-galaxy-s/teardown/
> http://www.squidoo.com/disassembly-of-samsung-galaxy-s
> ...

Click to collapse



I would love to get the i9000 working.  I need a  sacrificial board in order to make resurrection possible using this technique.   We can make guesses...  and we know the i9000's resistor bank is on the opposite side of the "Pin 0" dot on the processor... 

in this picture see 6 rows on the bottom right of the blue square app processor






However I don't know which one is which because they are likely not in any order as I have seen on the Captivate and Droid Charge...

Once I get a sacrificial board, it will be easy as moving a resistor, or removing a resistor and bridging two connections.... VERY similar to Droid Charge: http://forum.xda-developers.com/showthread.php?t=1245391


Thanks for the links.



nubecoder said:


> There was someone supposed to be sending Adam an Epic 4G already.  I thought Adam had even responded to the PM already...  Maybe there is some confusion at hand.
> 
> Adam, hit me up in IRC sometime when you see me, if you need to get in touch with the guy again.
> 
> =]

Click to collapse



I've heard nothing about a i9000 board.   I'd like to get one for decapitation and sacrifice to the UnBrickable gods 

I'll hit you up on IRC now.


----------



## Rebellos (Sep 3, 2011)

theduce102 said:


> As for the SGSII w/ Exynos, did you say you could possibly use this mod on that processor if I got you the data sheet?

Click to collapse



If it does have OM pins (and probably does) - yes.
I'd love to see datasheet of Exynos, can you get it? Really?


----------



## Rebellos (Sep 4, 2011)

//nevermind, got too excited too soon, like I need to get some sleep.

To port WP7 into Hummingbird devices we would need package called "Windows Phone Builder", which is available only for OEM companies with Microsoft's agreement.


----------



## dandan86 (Sep 4, 2011)

I've got a hard bricked I500 Galaxy S phone
Cellular South is the carrier but I500 model like the mesmerize and captivate I believe
Could this be useful?


----------



## Rebellos (Sep 4, 2011)

dandan86 said:


> I've got a hard bricked I500 Galaxy S phone
> Cellular South is the carrier but I500 model like the mesmerize and captivate I believe
> Could this be useful?

Click to collapse



Yes! It has got S5PC110 CPU inside.


----------



## duce102 (Sep 4, 2011)

Rebellos said:


> If it does have OM pins (and probably does) - yes.
> I'd love to see datasheet of Exynos, can you get it? Really?

Click to collapse



I believe the Exynos is a Cortex-A9 processor so it seems like it would be very similar to the A-8 with added features....


Heres a link to the ARM website with all the resources - http://www.arm.com/products/processors/cortex-a/cortex-a9.php?setcookie=classic



Exynos Data Sheet available for download on Samsung website - http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=844&partnum=Exynos 4210


Edit: to get the data sheet you have to use company email address to register for an account on samsungs website. If anyone does this please post the document here


----------



## KarlosTheJackal (Sep 4, 2011)

I work for CeX in the UK & we get alot of non-working phones come though, Ill be on the lookout & if I see any that are of any use I will let you guys know


----------



## treUse (Sep 4, 2011)

KarlosTheJackal said:


> I work for CeX in the UK & we get alot of non-working phones come though, Ill be on the lookout & if I see any that are of any use I will let you guys know

Click to collapse



Awesome news, make sure to catch a NS 

Sent from my Nexus S using Tapatalk


----------



## spartan.062 (Sep 5, 2011)

What about the Fascinate? (SCH-i500) It also has an A8. (I don't have a bricked one, but it might be good to add to the list.)


----------



## FrostyWolf359 (Sep 5, 2011)

Are you guys sure this won't work for any of the Texas Instruments Cortex A8 devices? Like the Droid, Milestone, Nook Color, Samsung i9003, Nokia N900, Palm Pre etc?


----------



## lilstevie (Sep 6, 2011)

AdamOutler or Rebellious are either of you available on IRC, there has to be a better way of identifying the xOM pins than lifting the CPU, I also have the P1000 and a schematic of most of the board .


----------



## AdamOutler (Sep 6, 2011)

lilstevie said:


> AdamOutler or Rebellious are either of you available on IRC, there has to be a better way of identifying the xOM pins than lifting the CPU, I also have the P1000 and a schematic of most of the board .

Click to collapse



It would be good to see that schematic, but we would still be shooting in the dark without some sort of mapping.  Let me know if you want to help out... I can send it back when I get done.




FrostyWolf359 said:


> Are you guys sure this won't work for any of the Texas Instruments Cortex A8 devices? Like the Droid, Milestone, Nook Color, Samsung i9003, Nokia N900, Palm Pre etc?

Click to collapse



Likely not, the Droid Charge has already been done, but mostly the items on the list and others as they are added.




spartan.062 said:


> What about the Fascinate? (SCH-i500) It also has an A8. (I don't have a bricked one, but it might be good to add to the list.)

Click to collapse



Added, Thanks.



KarlosTheJackal said:


> I work for CeX in the UK & we get alot of non-working phones come though, Ill be on the lookout & if I see any that are of any use I will let you guys know

Click to collapse



Great!  As soon as you get one of those devices on the list, send me a PM and we can work it out somehow...  Shipping from UK would be expensive, but maybe we can do something...  slow boat, or I can tell you what to do, or we can figure out something.  It's great that you are willing to help, we need more repair facilities helping here.  It's a quick way to resurrect a phone and requires no jtag box.  Technically, this is more valuable to the customer then JTAG ever would be.



theduce102 said:


> I believe the Exynos is a Cortex-A9 processor so it seems like it would be very similar to the A-8 with added features....
> Heres a link to the ARM website with all the resources - http://www.arm.com/products/processors/cortex-a/cortex-a9.php?setcookie=classic
> Exynos Data Sheet available for download on Samsung website - http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=844&partnum=Exynos 4210
> 
> ...

Click to collapse



We still need datasheets.  That's the website where they hold them and reject anyone who requests them.  I already requested some.


----------



## lilstevie (Sep 6, 2011)

also as a side note, I don't think you will find this working for hummingbird based iPhones and iPads (A4) as xOM affects IROM IIRC and SROM (The Apple written variant) is where DFU is implemented


----------



## AdamOutler (Sep 6, 2011)

lilstevie said:


> also as a side note, I don't think you will find this working for hummingbird based iPhones and iPads (A4) as xOM affects IROM IIRC and SROM (The Apple written variant) is where DFU is implemented

Click to collapse



DFU is the same as SBL.  The modification we are trying to reach triggers a USB upload mode before booting from ROM.  The phone will boot normaly.


----------



## lilstevie (Sep 6, 2011)

AdamOutler said:


> DFU is the same as SBL.  The modification we are trying to reach triggers a USB upload mode before booting from ROM.  The phone will boot normaly.

Click to collapse



no, DFU is bootrom, apple layout is different, SROM is the first piece of code to run, is non updatable in the field (ergo why limera1n hasn't been patched). while the A4 is similar it is not identical. SBL is more like the equivalent of iBoot in the iPhone


----------



## AdamOutler (Sep 6, 2011)

lilstevie said:


> no, DFU is bootrom, apple layout is different, SROM is the first piece of code to run, is non updatable in the field (ergo why limera1n hasn't been patched). while the A4 is similar it is not identical. SBL is more like the equivalent of iBoot in the iPhone

Click to collapse



AHH!  I see


> 0x0000_0000 0x1FFF_FFFF 512MB Boot area Mirrored region depending on
> the boot mode.
> 0x2000_0000 0x3FFF_FFFF 512MB DRAM 0
> 0x4000_0000 0x7FFF_FFFF 1024MB DRAM 1
> ...

Click to collapse



So, instead of putting bootloaders in OneNAND Apple put them in SROM and left a security hole. However, I was looking at the L1mera1n exploit and it is using the same commands that we access in the SBL prompt.  See here for SBL> prompt: http://forum.xda-developers.com/showthread.php?t=1209288

I was looking at the schematics for the A4 processor.  It would appear that they have integrated 2 extra bits into their protected boot modes...  http://forum.xda-developers.com/showthread.php?p=17269178 

We have begun hacking it and I believe someone has tipped me off about where those pins are located on the board.  He will be getting voltage readings today sometime and we can begin working with the device...   

Regardless, with the information that you have given me, it looks like L1mera1n will suffice for jailbreaking for now. I've been out of the Apple loop since I got my iPhone 3GS, decided it was garbage and got a Captivate.   However, with the pins available, it may be possible to reload SROM if anything happens in future editions of the iOS/iPhone software.  It's just a matter of completing it. 

So, let me see if I got this..  the bootloader is written into the SROM on the System on a Chip and not the Flash Memory.  It contains all the bootloaders needed to get the device to accept any flash.  An exploit available for this bootloader allows insecure flashing.  

I find it interesting that Samsung did not utilize the SROM as it could have been used.  They store their bootloaders off-chip in the OneNAND and use the System-on-a-Chip platform as a processor with a ROM instead of an entire System-on-a-Chip.  It seems that Apple used the chip more effectively and less securely.

It sound slike GeoHotz did a fine job, and we can cross it off the list, referring to the L1meRa1n exploit as it does basically the same thing in a different manner.  Unless it would be worth while to get this hardware method working for some reason...  Like I said, i've been out of the loop on Apple.  Let me know what you think.


----------



## lilstevie (Sep 6, 2011)

AdamOutler said:


> AHH!  I see
> 
> 
> So, instead of putting bootloaders in OneNAND Apple put them in SROM and left a security hole. However, I was looking at the L1mera1n exploit and it is using the same commands that we access in the SBL prompt.  See here for SBL> prompt: http://forum.xda-developers.com/showthread.php?t=1209288
> ...

Click to collapse



it is actually implemented far more securely, by default unsigned code will NEVER run on the CPU. As for the prompt; iBoot implements a shell, DFU does not, it is a usb upload mode only, it accepts a signed binary under normal circumstances and nothing else. The very few bootrom exploits discovered have been luck really


----------



## AdamOutler (Sep 6, 2011)

lilstevie said:


> it is actually implemented far more securely, by default unsigned code will NEVER run on the CPU. As for the prompt; iBoot implements a shell, DFU does not, it is a usb upload mode only, it accepts a signed binary under normal circumstances and nothing else. The very few bootrom exploits discovered have been luck really

Click to collapse



Same on all S5PC110s.. we exploited a static memory jump to insert code which calls back code normally used to download secure code but this time we skip the signature checks.  This is how the HIBL works.  Normally there is a chain of trust,  the HIBL compromises that and allows for unsigned code to run on the processor.  It should be possible with the A4 as well.


----------



## lilstevie (Sep 6, 2011)

AdamOutler said:


> Same on all S5PC110s.. we exploited a static memory jump to insert code which calls back code normally used to download secure code but this time we skip the signature checks.  This is how the HIBL works.  Normally there is a chain of trust,  the HIBL compromises that and allows for unsigned code to run on the processor.  It should be possible with the A4 as well.

Click to collapse



I wouldn't count on it working on the A4, it may or may not work. Apple have their own implementation, and memory layout, we could get lucky, very lucky if it also works on exynos (A5)


----------



## AdamOutler (Sep 6, 2011)

lilstevie said:


> I wouldn't count on it working on the A4, it may or may not work. Apple have their own implementation, and memory layout, we could get lucky, very lucky if it also works on exynos (A5)

Click to collapse



We'd just need to analyze the initial bootloader to find out.  Its likely there are a few which will all work.


----------



## popfan (Sep 6, 2011)

I am not sure how much this will help out, but this got a good picture of a tablet with locational markers that uses an A9, also has a dev build there for Ubunto.
http://www.cnx-software.com/category/processors/samsung-exynos/


----------



## popfan (Sep 6, 2011)

I found the public manual for the Exynos4210

http://com.odroid.com/sigong/nf_file_board/nfile_board_view.php?keyword=&bid=64


----------



## AdamOutler (Sep 6, 2011)

popfan said:


> I found the public manual for the Exynos4210
> 
> http://com.odroid.com/sigong/nf_file_board/nfile_board_view.php?keyword=&bid=64

Click to collapse



The link is not working.  Can you rehost the file on mediafire?  Also, it must contain a pinout.


----------



## Rebellos (Sep 6, 2011)

lilstevie said:


> it is actually implemented far more securely, by default unsigned code will NEVER run on the CPU. As for the prompt; iBoot implements a shell, DFU does not, it is a usb upload mode only, it accepts a signed binary under normal circumstances and nothing else. The very few bootrom exploits discovered have been luck really

Click to collapse



I do believe that there is security hole which does SHAtter use, that even if hashes are generated in very complicated way by multiple SHA1 rounds, their size is in the end truncated to 32bits. So it makes "only" 4294967296 combinations of end-hashes possible, which does allow finding collision by brute-force realiable.


----------



## popfan (Sep 6, 2011)

AdamOutler said:


> The link is not working.  Can you rehost the file on mediafire?  Also, it must contain a pinout.

Click to collapse



I will have to post it when I get home.  You can just do a google search for SEC_Exynos4210_pulbic_manual_Ver.0.00.01.pdf.  There should be 3 entries for it.  This thing is 734 pages long, I am sure this will have something you can use.


----------



## Rebellos (Sep 6, 2011)

popfan said:


> I will have to post it when I get home.  You can just do a google search for SEC_Exynos4210_pulbic_manual_Ver.0.00.01.pdf.  There should be 3 entries for it.  This thing is 734 pages long, I am sure this will have something you can use.

Click to collapse



Too bad its initial draft of manual, and it doesn't cover things like OM pins or iROM documentation.


----------



## gurinder (Sep 7, 2011)

if iphone 4 included in this, so this can be possible to repair mac address, imei of phone. coz i have 2 phones both have same problem, one handset automatically restart and after that i see that it has imei blank,mac address blank,bluetooth blank.. is this problem can be prepared then i will keep these baords with me and waiting for ur develeopment.

gurinder


----------



## Nitro_123 (Sep 8, 2011)

NO SGS I9000 UNTIL NOW ??? I CANT BELIEVE IT!!! I MUST'VE READ AT LEAST 25 "BRICKED" TOPICS IN 1 MONTH AND STILL NO ONE DONATES!!! WTH?? 
Sorry for the rant 
I Personally think this is THE most EPIC thing that has happened tho the SGS.....
Imagine triple-booting WP7, iOs, Android...... EPIC!!!
Excellent work devs and keep it up!!


----------



## Jose_Paramore (Sep 9, 2011)

Nitro_123 said:


> NO SGS I9000 UNTIL NOW ??? I CANT BELIEVE IT!!! I MUST'VE READ AT LEAST 25 "BRICKED" TOPICS IN 1 MONTH AND STILL NO ONE DONATES!!! WTH??
> Sorry for the rant
> I Personally think this is THE most EPIC thing that has happened tho the SGS.....
> Imagine triple-booting WP7, iOs, Android...... EPIC!!!
> Excellent work devs and keep it up!!

Click to collapse



Yes, it's incredible that a device that sold more than 14 millions units still doesn't have this feature... but in the other hand, if my Galaxy S get bricked, I'd try to repair it, don't you think? 
A donation could be better... We donate a small amount of money, the devs buy a Galaxy S (bricked, new, whatever) and they start working 
I'm also looking forward to try WP7!


----------



## AdamOutler (Sep 9, 2011)

Jose_Paramore said:


> Yes, it's incredible that a device that sold more than 14 millions units still doesn't have this feature... but in the other hand, if my Galaxy S get bricked, I'd try to repair it, don't you think?
> A donation could be better... We donate a small amount of money, the devs buy a Galaxy S (bricked, new, whatever) and they start working
> I'm also looking forward to try WP7!

Click to collapse



I could manage that if you wanted to start a donation fund...  just ensure everyone who donates posts in the thread, and mentions that they donated.  and I will acknoledge that I received the money so that everyone knows there's nothing shadey going on.  Then I would keep everyone updated so that they know where their money is going.  I'm not too keen on "asking for money", however if you wanted to start that thread, then I'll play along and buy a busted i9000 from e-bay.

Or you could simply send me a device, and I can put it back together, send it back, then you can say..  OMG WHT HAPPND?!?!  The processor came off!   lol...   i'm not recommending this...  but hey.. it might work.


----------



## bulletproof1013 (Sep 9, 2011)

I like rhe donate thing. Lemme know when yall set it up. Ill donate

Sent from my unbrickable cappy *bam*


----------



## venitex (Sep 9, 2011)

why not have the htc device??


----------



## AdamOutler (Sep 9, 2011)

venitex said:


> why not have the htc device??

Click to collapse



Those would be platform speciffic software mods.  That platform is not my specialty.  I did link in the first page to someone who made their OMAP based device do the exact same thing.  He's contacted me with that information..  no hardware changes are required.


----------



## AdamOutler (Sep 10, 2011)

UnBrickable Mod made hackaday and now PCWorld Magazine which is the first "news" site to feature it as classified by google.  http://www.pcworld.com/article/239580/hummingbird_brings_your_bricked_phone_back_to_life.html.

Cool huh?  

Get those junk devices together and send them to me!  I can send them back if you want.


----------



## waxworkz (Sep 10, 2011)

ok sorry for asking, but i have read and not found an answer; is there/will there be an "unbrickable" mod for the htc? soon? i have an htc incredible that i think i bricked


----------



## AdamOutler (Sep 10, 2011)

waxworkz said:


> ok sorry for asking, but i have read and not found an answer; is there/will there be an "unbrickable" mod for the htc? soon? i have an htc incredible that i think i bricked

Click to collapse



If you can find datasheets with pinouts, we can get that system-on-a-chip working.  Robellos and I have not been able to find pinouts.


----------



## Nitro_123 (Sep 11, 2011)

Agree Adam... I guess you should start a donate fund


----------



## ZinovaS (Sep 11, 2011)

hi, I have 360 H1 or i8320 (if they differ) so there is also Cortex-A8 cpu. think they sould be on the list. my is working but I would love to use this mod before trying other os'es on this device...


----------



## AdamOutler (Sep 11, 2011)

Nitro_123 said:


> Agree Adam... I guess you should start a donate fund

Click to collapse



Like I said before...  I'm not going to ask for money.  If someone else wants to start a thread in their respective forums and let me know about it, I'll make sure to post a goal and status updates to each thread if they want to maintain the first post.   When someone donates they should specify it in the thread and the donation notes and I will post in the thread that I received it.  I don't want to get wrapped up in thousands of unorganized donation dollars without a structure.   Someone else should start the thread. I will keep it updated and buy the device, then return the results once complete.


----------



## popfan (Sep 12, 2011)

AdamOutler said:


> If you can find datasheets with pinouts, we can get that system-on-a-chip working.  Robellos and I have not been able to find pinouts.

Click to collapse



http://forum.xda-developers.com/showthread.php?p=6647344

Found this on XDA for TV out, it contains the pinouts.


----------



## AdamOutler (Sep 12, 2011)

popfan said:


> http://forum.xda-developers.com/showthread.php?p=6647344
> 
> Found this on XDA for TV out, it contains the pinouts.

Click to collapse



We need the processor pinout.   Every electronic component or device has a pinout.  Even a resistor, it's got 2 pins and that's enough to have a "pinout".


----------



## AdamOutler (Sep 13, 2011)

I need boards.  The most requested device is the i9000, but noone seems to want to turn one over for inspection.   We need one device for destructive inspection and then the mod will work.   We've got 5 devices down, and about 10 to go.


----------



## ChauncyG (Sep 14, 2011)

*T959 board available*

Adam, I have a dead T959 Vibrant board you can have. I don't know why or how it died but you are welcomed to it. No apparent water damage. The JTAG pins are bad and the RF shielding is missing from one side (used it in another phone). I can include the SIM / SD carrier on the other side if you need it. If not I'll keep it. Camera is included but no speaker. Let me know where to send it and I'll get it out tomorrow.


----------



## AdamOutler (Sep 14, 2011)

ChauncyG said:


> Adam, I have a dead T959 Vibrant board you can have. I don't know why or how it died but you are welcomed to it. No apparent water damage. The JTAG pins are bad and the RF shielding is missing from one side (used it in another phone). I can include the SIM / SD carrier on the other side if you need it. If not I'll keep it. Camera is included but no speaker. Let me know where to send it and I'll get it out tomorrow.

Click to collapse



 PM sent. Thanks!


----------



## kmmxracer (Sep 14, 2011)

What about the Apple TV 2nd Gen. The hacking sceen for it is pretty weak. Would be nice to see the possibilities 

Sent from my HTC Sensation 4G using xda premium


----------



## AdamOutler (Sep 14, 2011)

kmmxracer said:


> What about the Apple TV 2nd Gen. The hacking sceen for it is pretty weak. Would be nice to see the possibilities
> 
> Sent from my HTC Sensation 4G using xda premium

Click to collapse



We need pinout descriptions...  I have access to mapping of the pins.  I came across a gentleman with a totally unbuilt mainboard.  He mapped out the pins already.  All that's left is to get pinout descriptions.


----------



## Nitro_123 (Sep 15, 2011)

LOL.... god knows where you people work (and what you people do at work...)   anyways excellent work again. hoping for an I9000 mod..............


----------



## AdamOutler (Sep 15, 2011)

Nitro_123 said:


> LOL.... god knows where you people work (and what you people do at work...)   anyways excellent work again. hoping for an I9000 mod..............

Click to collapse



Rebellos is an engineering student.  I'm a BMET. http://en.wikipedia.org/wiki/Biomedical_Equipment_Technician

Lets get those boards in!  The more developement devices we have, the more software options we have.


----------



## Nitro_123 (Sep 16, 2011)

AdamOutler said:


> Rebellos is an engineering student.  I'm a BMET. http://en.wikipedia.org/wiki/Biomedical_Equipment_Technician
> 
> Lets get those boards in!  The more developement devices we have, the more software options we have.

Click to collapse



Okay!! all i knew before was that you were too good at soldering  and Rebellos was one hell of a coder/programmer combo 

Am trying my best to spread the word around but no one seems to give this method a go. 

---------- Post added at 12:41 PM ---------- Previous post was at 12:38 PM ----------

P.S. I was thinking of starting a thread appealing to all the devs to leave android development and their roms for a while :O and to PORT stuff like WP7, Ubuntu etc. after the mod is done on at least around 10 phones 
BTW, you guys are the DFT of the SGS world IMO


----------



## AdamOutler (Sep 16, 2011)

Nitro_123 said:


> Okay!! all i knew before was that you were too good at soldering  and Rebellos was one hell of a coder/programmer combo
> 
> Am trying my best to spread the word around but no one seems to give this method a go.
> 
> ...

Click to collapse



Its OK.  I'm sure it will pick up once people see the UnBrickable Droid Charge next week and the Vibrant coming after that.  

Contact me and get that junk device out of the drawer.  Put it to some good use for the community!  Help others to help themselves.  Bricked devices suck.  We can cure the brick.  Gentlemen, we can rebuild them.  We have the technology.


----------



## popfan (Sep 16, 2011)

Insert Bionic Man theme here


----------



## AdamOutler (Sep 16, 2011)

That quote was actually from the 6 million dollar man...


----------



## bulletproof1013 (Sep 16, 2011)

I got it man lol





AdamOutler said:


> That quote was actually from the 6 million dollar man...

Click to collapse





Sent from my unbrickable cappy *bam*


----------



## popfan (Sep 16, 2011)

Sorry i forgot it was called 6 million dollar man

AKA bionic man = Steve Austin


----------



## lilstevie (Sep 17, 2011)

you might want to remove the P1010 from the list, the WiFi SGT7" uses the OMAP3 not hummingbird


----------



## Nitro_123 (Sep 17, 2011)

Guys lets not clutter this thread  might help 
IF you can then please make a thread in the forums of the unbrickable phones saying that if a user has bricked a phone, there is still hope etc etc  and then please link to this thread  Might get us some boards  
P.S. : Unbrickable phones = phones with cortex A8's = the list given in first post


----------



## hausmanis (Sep 17, 2011)

haha thats funny


----------



## AdamOutler (Sep 17, 2011)

Nitro_123 said:


> Guys lets not clutter this thread  might help
> IF you can then please make a thread in the forums of the unbrickable phones saying that if a user has bricked a phone, there is still hope etc etc  and then please link to this thread  Might get us some boards
> P.S. : Unbrickable phones = phones with cortex A8's = the list given in first post

Click to collapse



Not so fast...

Just cracked the Exynos CORTEX A9 boards today.. 
http://forum.xda-developers.com/showthread.php?p=17638565#post17638565


----------



## rhernz212 (Sep 18, 2011)

I'll add that.    Do you have the model number?[/QUOTE said:
			
		

> The model number is SGH-t959V

Click to collapse


----------



## AdamOutler (Sep 22, 2011)

Bump!  I will be posting Epic and Vibrant plans soon.   These should be easy.  Droid charge is not going to be as easy as the captivate.    The Epic and Vibrant should be easy.


----------



## AdamOutler (Sep 22, 2011)

T959 Vibrant plans are available.  http://forum.xda-developers.com/showthread.php?t=1273083


----------



## XXCoder (Sep 23, 2011)

How hard is it to make epic to unbrickable forever?


----------



## AdamOutler (Sep 24, 2011)

Just added plans for Epic and crossed off the list: http://forum.xda-developers.com/showthread.php?t=1274999

Need moar boards!


----------



## AdamOutler (Sep 27, 2011)

The Vibrant is now UnBrickable!  Go here: http://forum.xda-developers.com/showthread.php?t=1277056


----------



## sublimeike (Sep 29, 2011)

This is amazing.  Thank you for your work.


----------



## AdamOutler (Sep 30, 2011)

added Pandigital 9" tablet R90L200 to the list of wanted devices.


----------



## Nitro_123 (Sep 30, 2011)

Adam please can you change the colour of the "plans available" text? it's pretty hard to read


----------



## kmmxracer (Oct 1, 2011)

AdamOutler said:


> We need pinout descriptions...  I have access to mapping of the pins.  I came across a gentleman with a totally unbuilt mainboard.  He mapped out the pins already.  All that's left is to get pinout descriptions.

Click to collapse



I may be wrong, but would the pinout description on the Apple TV 2g be the same or similar to its iPhone counterparts?  If it is, then getting together $99 for one might be easier then acuiring and iPhone 4 donation??? 

Sent from my HTC Sensation 4G using xda premium


----------



## Omnichron (Oct 2, 2011)

I would love to help out. I have a dead Droid 2, where do I send it?


----------



## 6liuxa (Oct 2, 2011)

*any help or.....*

Hi m8.
Have galaxy tab gsm 7inch p1000 possibly bricked as it showing no charging when it's on charge and no reaction on power button... 
Any advise whagt I can do with it as it belongs to  my little sister.

I tried to upgrade via Kies when it was downloading something and PC fall in a sleep mode. On resume it had lots of tables while TAB had  mobile+triangle+PC symbols.
Left it like that for couple hours and now it completely  non reactive....
Any advice on this....
As I read you now developing program to make all Samsung + other brand mobile devices UNBRICKABLE...


----------



## nubecoder (Oct 2, 2011)

This is not the right thread to be asking questions about being bricked.
You should be looking around your respective device's forums for methods to recover from a soft brick.

If your phone is booting (into recovery / download mode / hboot / whatever) then it is not hard bricked, and more than likely there is a way to recover.

But this is not the place to find out what to do.
Sorry if that seems a little harsh, but this thread is for specific devices and hard bricks or damaged phones only.

This thread is about donating your very dead device (that's on the list or uses the same processor as ones on the list) to a very good dev, so that he can further destroy the device by disassembling it's cpu and mapping (some of) it's traces.

Please try not to muddy this thread with questions that are unrelated to the goal of the thread.

=]


----------



## 6liuxa (Oct 3, 2011)

Well it actually not responces to anything. It does not show any life on any action that I take.
Put charger in- no action
press POWER button- no action
press any combination of buttons- no action....

Is it not hard bricked enought???


----------



## AdamOutler (Oct 3, 2011)

6liuxa said:


> Well it actually not responces to anything. It does not show any life on any action that I take.
> Put charger in- no action
> press POWER button- no action
> press any combination of buttons- no action....
> ...

Click to collapse



I've been able to revise my methods a bit.  I no longer need to remove the processor.   Send me a pm.  I can locate xOM5 based on UART output from the device.  Once we have xOM5, its a matter of figuring out the upload sequence.  I believe that the p1000 will be similar to the rest of the GalaxyS series.


----------



## Omnichron (Oct 4, 2011)

nubecoder said:


> This thread is about donating your very dead device (that's on the list or uses the same processor as ones on the list) to a very good dev, so that he can further destroy the device by disassembling it's cpu and mapping (some of) it's traces.
> 
> Please try not to muddy this thread with questions that are unrelated to the goal of the thread.
> 
> =]

Click to collapse



yeah, it's bricked. Dissection by one of XDA's Devs is it's next duty!


----------



## AdamOutler (Oct 4, 2011)

Omnichron said:


> yeah, it's bricked. Dissection by one of XDA's Devs is it's next duty!

Click to collapse



I'm still locating OMAP datasheets.  Its going to be a while.  We have all Samsung devices ready though.  I need hummingbird and Exynos based devices.


----------



## AdamOutler (Oct 4, 2011)

Added Fascinate to the UnBrickable List.  http://forum.xda-developers.com/showthread.php?t=1288162

The owner of RootzWiki gave me a Fascinate yesterday at the Big Android BBQ.  I was able to locate the modification, gather together firmware and make an entire solution available within 24 hours.   

UART: http://forum.xda-developers.com/showthread.php?t=1287780
UnBrickable Mod: http://forum.xda-developers.com/showthread.php?t=1288093
How to: http://forum.xda-developers.com/showthread.php?t=1288162
One-Click software update: http://forum.xda-developers.com/showthread.php?t=1288130

This is a worlds first for the Fascinate.  Never before has there been a method of unbricking a Fascinate.  I didn't even have to destroy it!  I'm pretty happy about that.


----------



## AdamOutler (Oct 8, 2011)

This thread is not for tech support.  This thread is for organization. This thread is for dead devices which you wish to give for teardown.  This thread is also for helpful tips about datasheets and/or leads to other devices.   


Post in an existing q&a or help thread if you want help.  If your problem cannot be found on the site, post a new thread.

Again, this is not the place to ask for help.  I'm the one asking for help here!


----------



## vikas776 (Oct 9, 2011)

What about Galaxy S2 ( international version )

Is it do any contribution to this thing.

I have three devices and i love to help


----------



## AdamOutler (Oct 9, 2011)

vikas776 said:


> What about Galaxy S2 ( international version )
> 
> Is it do any contribution to this thing.
> 
> I have three devices and i love to help

Click to collapse



As long as it is Exynos based, I would love to get ahold of one to test xOM resistors on the device.   The development would be longer then most as we do not have FULL signal descriptions on the device.  Rebellos and I DO need one for mapping and developing bootloaders.  If the device works, then I won't need to remove the processor, however there is a very slight risk to the hardware.

http://forum.xda-developers.com/showpost.php?p=17637489&postcount=24

So I need one to map out the hardware mod, and then if time allows I could send it to Poland for Rebellos to make the first Exynos custom bootloader firmware.  If time is contstrained, I Rebellos may be willing to work remotely like we did the first time to develop the firmware.

If you're willing to send one, I'm willing to mod it, send it to poland, and send it back.


----------



## AdamOutler (Oct 9, 2011)

Added Samsung Continuum SCH-i400.  This device is wanted.


----------



## violentj424 (Oct 10, 2011)

*for the cause*

New ns4g available for tests, no worries I can play dumb and get another so let's make it invincible!


----------



## mahert45 (Oct 12, 2011)

*T-Mobile G2 (HTC Vision)*

Screen busted cant see anything yours if you want it


----------



## that747guy (Oct 13, 2011)

i have a htc g2 with a broken screen if you would like it!


----------



## AdamOutler (Oct 13, 2011)

mahert45 said:


> Screen busted cant see anything yours if you want it

Click to collapse





that747guy said:


> i have a htc g2 with a broken screen if you would like it!

Click to collapse



Thanks, but it has a Qualcom processor..  They're too locked down and there may be no chance of doing anything with them.  I can't use it.


----------



## AdamOutler (Oct 13, 2011)

violentj424 said:


> New ns4g available for tests, no worries I can play dumb and get another so let's make it invincible!

Click to collapse



This will work well!  I'll make sure to send it back when it's done.


----------



## AdamOutler (Oct 13, 2011)

Added Kyocera Echo m9300 to the list of wanted devices.


I need devices from the list to work with.  I'm getting several requests per day about "is there UnBrickable Mod for my device"...  The answer seems to always be the same..   I need a device to work with...

If you have a busted or unused device on the list, please send it to me.  I can make use of it and post the information here on XDA so that people can resurrect their own devices.


----------



## JDMpire (Oct 14, 2011)

Do you know if there are any devs in the Philly area? I may have some older android phones I could donate. If their close enough I'll just meet them somewhere. I'm not sure if its a phone on your list, but a free phone is better then no phone, right?


----------



## AdamOutler (Oct 16, 2011)

JDMpire said:


> Do you know if there are any devs in the Philly area? I may have some older android phones I could donate. If their close enough I'll just meet them somewhere. I'm not sure if its a phone on your list, but a free phone is better then no phone, right?

Click to collapse



Currently this mod will only work on Hummingbird devices.  I'm waiting on datasheets for others.


----------



## jkk111 (Oct 20, 2011)

Hey i have a fully bricked gt-i9000 if you're still looking for one


----------



## AdamOutler (Oct 20, 2011)

jkk111 said:


> Hey i have a fully bricked gt-i9000 if you're still looking for one

Click to collapse



I think i have one enroute.  I will get back with you.


----------



## AdamOutler (Oct 20, 2011)

Added GT-P1000 to the list.  Plans are available.


----------



## rishi3594 (Oct 24, 2011)

*Need your help Regarding this!!*

I have hard bricked my Galaxy Mini GT-S5570 and nothing is working on it. I could"nt understand the whole launguage of the post can the tool you mentioned can unbrick my phone or any other ?


----------



## dublinz (Oct 24, 2011)

i have bricked htc hero.... if you can use it just let me know


----------



## rabiny (Oct 24, 2011)

*SGS I9000*

Any news from the SGS1 front ?


----------



## AdamOutler (Oct 25, 2011)

The Infuse 4G is now crossed off the list.  This is the Tenth device.


----------



## rabiny (Nov 1, 2011)

*any help ?*

can this document help in any way to figure out how to implement the unbrickablemod for the SGS ?






​Source: http://www.4shared.com/file/4AouODfo/Samsung_i9000_Schematic__Troub.html


----------



## AdamOutler (Nov 1, 2011)

rabiny said:


> can this document help in any way to figure out how to implement the unbrickablemod for the SGS ?
> 
> 
> 
> ...

Click to collapse



That document is already in the GalaxyS Hack pack.


From previous experience I'm betting R438/R425 is the switch between xOM5 being high and low.  I will experiment with this tonight.   I have an i9000 at home for research.


----------



## Nitro_123 (Nov 3, 2011)

Adam Mobiletechvideos reports that they have performed an I9000 UnBrickable Mod !
http://www.facebook.com/pages/MobileTechVideos/182579981788132
So if this is true can you ask connexion for the details? will help you out, I think 
Good luck


----------



## AdamOutler (Nov 3, 2011)

Nitro_123 said:


> Adam Mobiletechvideos reports that they have performed an I9000 UnBrickable Mod !
> http://www.facebook.com/pages/MobileTechVideos/182579981788132
> So if this is true can you ask connexion for the details? will help you out, I think
> Good luck

Click to collapse



It's true.  I posted the xOM pinout on Google+ last night.  Before I did the writeup, he sent me a text message saying he had already made it work.  I did the full writeup here: http://forum.xda-developers.com/showthread.php?t=1330491


----------



## jkk111 (Nov 7, 2011)

Sorry to bother you with a most likely simple question on the i9000 unbrickable mod, but can you tell me if i have the right idea here.
Do I desolder the xom5 resistor and solder it onto the 2 connectors right below and then the mod is complete,
or am i going completely wrong with this?
thanks a lot in advance


----------



## AdamOutler (Nov 7, 2011)

jkk111 said:


> Sorry to bother you with a most likely simple question on the i9000 unbrickable mod, but can you tell me if i have the right idea here.
> Do I desolder the xom5 resistor and solder it onto the 2 connectors right below and then the mod is complete,
> or am i going completely wrong with this?
> thanks a lot in advance

Click to collapse



Yeah, but resoldering a resistor is difficult.   You will have better luck shorting with magnet wire.   This is not a support thread though.  Ask in the mod thread.


----------



## AdamOutler (Nov 7, 2011)

Added Infuse4G


----------



## AdamOutler (Nov 7, 2011)

Added GalaxyS 4G


----------



## TheMrRoxtar (Nov 8, 2011)

*k*

kk i want too


----------



## seangeezy12 (Nov 8, 2011)

will be sending a few phones, who do i send em to


----------



## AdamOutler (Nov 8, 2011)

seangeezy12 said:


> will be sending a few phones, who do i send em to

Click to collapse



PM sent.


Hey check out this thread for a detailed description of how to locate the xOMs on these devices.  http://forum.xda-developers.com/showthread.php?p=19169045#post19169045


----------



## Romance1 (Nov 8, 2011)

*nice*



bedwa said:


> Oy, you now have me torn. I picked up a physically broken iphone 4 last weekend and am planning to repair and sell it, but I would love to see this go off the ground.... Decisions, decisions......

Click to collapse



nice work i like this


----------



## longthanh (Nov 10, 2011)

can x10 run win7?


----------



## gianspi (Nov 11, 2011)

I have an OG Droid if any developer needs parts.  The screen won't turn on.


----------



## AdamOutler (Nov 12, 2011)

Massive update to the list of wanted devices

Upgraded P1000 Galaxy Tab to UnBrickable
Added P100 Galaxy Tab as UnBrickable.


----------



## fsoly (Nov 12, 2011)

Thank you ,, very much


----------



## DEVileper (Nov 15, 2011)

*bricked k1*

Id love to help out a dev. I have a bricked lenovo k1.
the screen shows..."booting recovery kernel image"
nothing else happens.

I have nvflash and have followed instructions for unbricking SEVERAL other tablets, but since its "other tablets roms"...

I have the OTA from the lenovo site.

What do i do with it? I am unsure as to how to get anything on the hdd of the tablet. nvflash isnt working since Its not meant for the k1.

I know im close to the magic so what do I do with the OTA.zip

i have sdk tools installed. However, adb shell in a command prompt doesnt do anything for me either so how can i push a boot img and recovery(cwm) into it?

The key that keeps "something" locked up has been found? or was the guy lieing?
I read conflicting blogs here...
Please advise friends...thank you in advance guys...


----------



## modchip80 (Nov 16, 2011)

hello..i have p1010 brick device..i've flashed it with oudin but with p1000 firmware.
Now it's completely black and unresponded.

how can i try to find xOM5 resistor?


----------



## AdamOutler (Nov 16, 2011)

modchip80 said:


> hello..i have p1010 brick device..i've flashed it with oudin but with p1000 firmware.
> Now it's completely black and unresponded.
> 
> how can i try to find xOM5 resistor?

Click to collapse



I don't have the modification listed for this device.  If you'd like to send it to me, I can do this, or you can click here: http://forum.xda-developers.com/showthread.php?t=1338073


----------



## modchip80 (Nov 16, 2011)

AdamOutler said:


> I don't have the modification listed for this device.  If you'd like to send it to me, I can do this, or you can click here: http://forum.xda-developers.com/showthread.php?t=1338073

Click to collapse



I'll send to you my device?


----------



## GiveMe2Beers (Nov 16, 2011)

I will break my device tonight. Thanks!


----------



## Gaszton (Nov 17, 2011)

*i8320*

i have a samsung i8320 bricked, does not even shows charging animation, unable to put it in download mode also,
is it possible to repair this phone with your method?


Thanks,

Gaszton


----------



## AdamOutler (Nov 17, 2011)

Gaszton said:


> i have a samsung i8320 bricked, does not even shows charging animation, unable to put it in download mode also,
> is it possible to repair this phone with your method?
> 
> 
> ...

Click to collapse



this has a OMAP3 processor.  I'm focusing more on current production processors now.  I don't have resources for this processor.  JTAG is a good option.


----------



## AdamOutler (Nov 21, 2011)

Added 3 Coby tabs to the list.  They have just been released and personally, I think these are pretty nice devices for the cost.

Coby 8" tab with Gingerbread for $161.14:
http://www.amazon.com/gp/product/B0...d_t=101&pf_rd_p=1328920862&pf_rd_i=1232597011

Thats dirt cheap for a gingerbread tab, has better specs than a Galaxy Tab 7, and it's way chaper.   The device is basically a GalaxyS class device..  Looks like a good deal to me.


----------



## AdamOutler (Nov 27, 2011)

Lets keep this on-topic guys?   I'm REALLY getting tired of having to report every other comment.  This entire page is worthelss.  I've contacted those who have said they have devices and they have not responded.

Do not post in here unless you have something helpful to say, or you have a device you're willing to part with

I made this tool which should help out..  It's a processor overlay







Get an overhead of the board and apply this overlay for location of pins on a Hummingbird.  I needed a place to post this valuable tool.


----------



## orb3000 (Nov 30, 2011)

*.*

Second a and final warning, as OP states, if you have nothing to contribute and only want to get more posts this is not the place, *failing to respect this petition will lead into an infraction.*


----------



## AdamOutler (Dec 13, 2011)

^^ I did that.  see the first post.  I have provided all links to each device which I can currently work on without any research.  Those are the devices I need.  I am working on OMAP3&4 and Exynos4, It's not looking promissing for Tiegra1&2 or  Qualcomm.


Mish.Mash said:


> should this not be in the market threads in want to sell????????

Click to collapse



I'm not selling them.  It's just a fact.  They're compatible with Unbrickable Mod and they cost that amount.


----------



## Eggathis (Dec 21, 2011)

I know they are old, and pretty much dead development wise, but I have two OG Droids that are busted up.  PM me if anyone is interested in them.


----------



## bhundven (Dec 24, 2011)

helldogg75 said:


> Did some homework...seems the motorola bravo has the cortex a8.  Any support for these phones?

Click to collapse



A lot of arm-based processors that emerged during 2008-2011 were Cortex-A8.
It's possible that a lot of these microprocessors in our devices can support UBM, if not a variant of. But unless we can clone AdamOutler and a few others, it's better to focus on a specific set of variants.

Some devices are also Cortex-A9 devices are also out, and it may also be possible to create some kind of UBM for them as well. Newer devices coming out in the future will have Cortex-A15 cores... which makes me feel woozy... Can't wait! 

Most mobile/embedded processors have other names for their "Power-On Reset" configuration pins. Samsung calls theirs xOM. Freescale just calls them "Power-On Reset Configuration Signals", but I don't know what they name the actual pins.


----------



## AdamOutler (Dec 27, 2011)

Working on the A9s.  It seems that Texas Instrument calls them BOOT_MODE_* and Samsung has changed from xOM* to X_OM_*.   The A9 will prove to be more challenging..  It seems that the security technology has been rapidly evolving and the OMAP would appear nearly impossible to work with..  Although, to be honest, I havn't really started yet.   We'll see.  

I'm fairly confident that UBM will be possible with anything that contains an Exynos 4120 with a Samsung branding.


----------



## AdamOutler (Dec 28, 2011)

Just updated: SCH-i800 Samsung Verison/US Cellular Galaxy Tab 7.0 UnBrickable 

The sch-i800 and sch-i100 are the same device.


----------



## herbertsilver (Dec 30, 2011)

The mod really works to US Cellular SCH-i800, I tested 2 days ago and reported to Adam.

Here is the link to it's Full ROM "USCC SCH-i800 EJ06 Gingerbread Stock Odin Package"

multiupload.com/V49Y2EDXQJ

Thanx


----------



## sparkyuiop (Jan 2, 2012)

AdamOutler said:


> If you wish to donate a dead device...

Click to collapse



I got an iPhone 3G that keeps freezing if it's any help. I have jailbroken 4.2.1 and upgraded it to the iPad baseband to unlock it. It was freezing prior to that though.
Let me know if you want it.

Phill.


----------



## BroadStreetBullie (Jan 6, 2012)

Need a Nexus S? I cant get the thing to work. I ordered a jig to give that a try. If that don't work its up for the taking.


----------



## virgile (Jan 9, 2012)

Hello i've a dead I9003 with OMAP3630 after flashing a I9000 rom into my device.
I understand you search the X_OM 5 to apply your method on this phone and i'm very impatient.
Excuse me but i'm permit to send you a doc about the OMAP3 cpu.
If you doesn't already have, i hope it will be usefull
w ww. ti. com/pdfs/wtbu/OMAP36xx_ES1.x_PUBLIC_TRM%20_vW.zip

p.207-208

Excuse my bad english i'm a french noob.

Thank's for all.


----------



## AdamOutler (Jan 13, 2012)

virgile said:


> Hello i've a dead I9003 with OMAP3630 after flashing a I9000 rom into my device.
> I understand you search the X_OM 5 to apply your method on this phone and i'm very impatient.
> Excuse me but i'm permit to send you a doc about the OMAP3 cpu.
> If you doesn't already have, i hope it will be usefull
> ...

Click to collapse



I've documented methods of finding the xOM pins here: http://forum.xda-developers.com/showthread.php?t=1338073  most methods require a working device.  If you'd like, I can locate these pins by removing the processor.  The mod can be applied to the next device.


----------



## soybi (Jan 15, 2012)

I have a dead eken m001 tablet... 

How can i give it to you..

Sent from my MT11i using XDA App


----------



## Turmoyl (Jan 15, 2012)

*Motorola DEFY (MB525)*

*CLAIMED - No longer available*

I have a Motorola DEFY (MB525) that still functions perfectly, but the bottom of the case has been split open, and the volume button is missing. I have none of the cables for it, but do have the OEM window-based car mount that I'll include with it.

I would like to give this phone and dock to a developer that can use it. Just pay for the shipping method of your choice from 89521.


----------



## teufen (Jan 16, 2012)

I have a badly bricked HTC Magic 32A. (I tried to flash a new radio ROM through recovery => BAD idea!)

If this interests you, please let me know!


----------



## b1gm0n3yhustla (Jan 23, 2012)

*To whom started this thread   -------------------*

i have a what i would call a BRICKED kyocera echo i would be willing to donate if you haven't gotten one already      let e know email me details


----------



## lethas (Jan 23, 2012)

Thank you so much


----------



## flatmo (Jan 23, 2012)

I have a broken Nexus One if that helps anybody


----------



## mrgeorgia (Jan 27, 2012)

Not sure if this phone is worth it but I have a BL40 New Chocolate with a cracked screen but otherwise functional. Even the screen still works. Amazing.

Its from Canada on the Telus network but unlocked.


----------



## orb3000 (Feb 13, 2012)

*.*

Please keep it clean!
This thread is for users willing to *DONATE* their phones to Devs.



orb3000 said:


> If you have nothing to contribute and only want to get more posts this is not the place, *failing to respect this petition will lead into an infraction.*

Click to collapse


----------



## JustinUhhh (Mar 1, 2012)

It looks like its crossed off, but if you ever need a Captivate I could probably donate my old one. The power button is broken and it just powers on when you insert the battery. Let me know.


----------



## dexter93 (Mar 5, 2012)

if anyone has a bricked sensation let me know.. we are working on reviving them


----------



## Punjabi23 (Mar 23, 2012)

I may have a broken mytouch, let me know if anybody needs one.


----------



## dsw1ft (Mar 24, 2012)

I have a broken blackberry if someone wants one.


----------



## asking_alexandria27 (Mar 28, 2012)

*my samsung admire is bootlooped/bricked*

i have no use for it lol tried fixin it but without a backup and the ability to put it in debug mode for adb to work its non fixable so yall want it?


----------



## nyamd20 (Apr 8, 2012)

I'm confuse what exactly is a super dev phone

Sent from my SGH-T989D using xda premium


----------



## AdamOutler (Apr 8, 2012)

nyamd20 said:


> I'm confuse what exactly is a super dev phone
> 
> Sent from my SGH-T989D using xda premium

Click to collapse



One which cannot be bricked.


----------



## soshite (Apr 9, 2012)

*samsung sch-r680*

I've got a samsung calibur that I broke apart to check out its insides. I can't remember what it runs exactly. If it'll be of some use let me know.


----------



## dexter93 (Apr 14, 2012)

UNKNOWN714 said:


> I gotta broken sensesation

Click to collapse



You have pm 

Sent from my HTC Sensation using XDA


----------



## lamborg (Apr 14, 2012)

have an old ericsson mobile, should work fine if you can charge it but the charge port is broken.


----------



## AdamOutler (Apr 14, 2012)

lamborg said:


> have an old ericsson mobile, should work fine if you can charge it but the charge port is broken.

Click to collapse



what kind?


----------



## Tedbadger (Apr 26, 2012)

*HTC touch*

I got an old HTC touch wich has a broken screen


----------



## Cirkustanz (May 3, 2012)

I have an AT&T Nexus one that is rather flawless, except the bottom part of the screen seems to only work one out of 20 tries.  It took me 20 swipes just to unlock the phone.  Sometimes it takes more.


----------



## PimpBabyMaker (May 20, 2012)

do you only want android phones??


----------



## uberto.costanzo (Jul 8, 2012)

*i9001 hardbrick*

hi to all i have flash a wrong partition and my sgs+ is dead, no on, no recovery, no download mode, nothing. i have buy usb jit but i don't have download mode. i remove battery plug usb jit and put battery but nothing only black screen. there is possibility for my sgs+ whitout assistance??? thanks for reply


----------



## det0xx (Jul 14, 2012)

*Samsung Galaxy Exhibit 4g*

Hey , i was wondering if anyone could provide me help or give me an explanation why my Samsung galaxy exhibit 4g only boots up to samsung logo? i tried recovering it to factory setting via recovery mode but i cant get there it just flashes back and forth. then i tried odin and no luck, lastly i try this and no luck .  does anybody have any ideas? thanks for your time and cooperations. keep up the good work


----------



## madjosh (Jul 17, 2012)

*Samsung Captivate (AT&T)*

I have a broken captivate, fell 5 floors down. Then I opened it apart to see that the screen was smashed in bits. So unscrewed everything, ripped out the screen apart from some sticky goo parts. Then realized that a mechanical engineer could not explore it further  I will be more than happy to send the device to anyone if needed for further research.


----------



## joachim_D (Oct 23, 2012)

can i try this on my galaxy ace S5830? 
or isnt this gonne work at all on the ace ?


----------



## AdamOutler (Oct 24, 2012)

joachim_D said:


> can i try this on my galaxy ace S5830?
> or isnt this gonne work at all on the ace ?

Click to collapse



Wont work on Ace.


----------



## joachim_D (Oct 24, 2012)

AdamOutler said:


> Wont work on Ace.

Click to collapse



oke thx AdamOutler,
i was hoping it would work even now i can put it in the trash.
but thx for you reply.
isnt there an other option i know JTAG but something else?

Grtz


----------



## microMXL (Nov 10, 2012)

you guys still receiving phones? got a bricked i9000, no download mode (not even with jig) no boot no nada


----------



## HellHammer83 (Dec 13, 2012)

I have an Galaxy SII GT-I9100 Europe (from Spain) with water damage.  I can donate the main board (have volume flex broken) due the LCD still working. If want the main board let me know.


----------



## drraptor (Dec 14, 2012)

How can I apply this to galaxy S GT-9000 

Nevermind found it http://forum.xda-developers.com/showthread.php?t=1330491


----------



## hehe13 (Jan 10, 2013)

hi,

im now stuck at upgrade screen on my YP-GB1EW Samsung Galaxy Player .. samsung kies not recognizng device.. =[ cant go to download mode either..

please help..


----------



## crashpsycho (Jan 18, 2013)

Adam You are the man i was wondering if the project was stil alive i wanna help my fellow collegues in development im not a super advanced Person but i was wondering if there was any potential to help SAVE att skyrocket i727 i have 2 working devices and 2 bricked device we can use for testing and i can even send you one of each if you wouldnt mind helping Thanks adam for all you do


----------



## slim_thug (Apr 7, 2013)

*I will indulge you with the Indulge*

*if you are still doing you project, with the broken phones and such i have a hard hard harder than hard never been abused other than intensively flashing it to its dark state. I have all that i read and viewed of the hows and whats to do to fix it! But im am at an impasse......so like my self i will donate it to discovery so that it will not have gone into dark rebellion for nothing.   ​*


----------



## androidfr33k (Apr 24, 2013)

@AdamOutler,

Is it possible to use this to fix the Nexus 7 from a hard brick state?

Doesn't it come down to somehow accessing the nand flash and at least getting a good bootloader.img back onboard?

Thanks


----------



## AdamOutler (Apr 24, 2013)

androidfr33k said:


> @AdamOutler,
> 
> Is it possible to use this to fix the Nexus 7 from a hard brick state?
> 
> ...

Click to collapse



I don't know of anyone who software bricked their Nexus.  I don't know if we have the NVidia SBK required to communicate with the N7.


----------



## androidfr33k (Apr 26, 2013)

AdamOutler said:


> I don't know of anyone who software bricked their Nexus.  I don't know if we have the NVidia SBK required to communicate with the N7.

Click to collapse



So whether we could JTAG or nvflash in apx mode in either case we would need the secure bootloader key in theory?  Can't the SBK be retrieved if the device is unlocked?

I wonder if there is a way to clone all the partitions through nvflash as a way to restore a hard bricked fastboot bootloader?


----------



## celica7 (May 22, 2013)

*working with s2 i9100 ?*

hello this solucion work with i9100 s2 ? thank you


----------



## anwar726 (Jul 11, 2013)

Dear Adam
My samsung I8262 (GT-I8262 Samsung Galaxy Core) is bricked accidently .
now its totaly dead and nothing happen when i have tryed to power
key... i also tryed with usb jig but nothing happen i also tryed the
three combo keys like VOLdown+home+power key but handset is not going
in download mode and also not detecting by my computer via USB DATA
cable
I need help regarding to same
Technical info is
Microprocessor,-Chipset
CPU_Clock:       1200 MHz
CPU:     Qualcomm Snapdragon MSM8225
Browse devices based on Snapdragon MSM8225
Width;of+Machine:Word:   32 bit
CPU-Core:        2x ARM Cortex-A5
Instruction_Set:         ARMv7-A
Software;Environment
Embeddedperating_System:       Google Android 4.1.2
Browse devices running this OS
Operating-System:Kernel:         Linux
Memory,;Storage_capacity
RAM_type:        LPDDR2 SDRAM
RAM+capacity:    1024 MiB
ROM_type:        Flash EEPROM
ROM-capacity:    7630 MiB
ROM+capacity+in+bytes:   8 GB (billion bytes)

Brand:   Samsung
Browse Samsung devices
Manufacturer:    Samsung Electronics
Browse all devices manufactured by Samsung Electronics
Hardwareesigner:       Samsung Electronics
Releaseate:    May, 2013
Physical+Attributes
Dimensions
(width x height x depth):        67.6 x 129.3 x 8.95 millimetres
2.7 x 5.1 x 0.4 inches
Bounding;Volume:         78.2 cubecentimetres
Mass:    124 grams (battery included)


PLEASE PLEASE & PLEASE GIVE ME THE UNBRICK SOLUTION  AS SOON AS POSSIBLE
THANKS & REGARDS
ANWAR SAYED
FROM BEED MAHARASHATRA INDIA
IF u WANT TO TALK ME MY CONTACT NUMBER IS : +919028943409

Thanks Again to reading My E-mail


Sorry for the POOR english. LOL


----------



## machv5 (Jul 29, 2013)

I have an SGH-I727r that can only be seen by QHUSB Download mode can I do the Unbrickable mod on it? 
I noticed an S2 in the list someplace but not my exact model.
If so do you know the location of the correct resistor I need to remove and any related pins that I need to be soldering. I can send a picture of my board if necessary. I have seen other pictures of what my board should look like for the jtag but it doesn't seem to resemble the photos I have seen. It's a Rogers Canada model (hence the 'r' I think?)
Thank you

Without XDA I'd still be using a hammer to crack open a phone


----------



## ukayani (Aug 12, 2013)

*Dead Galaxy Tab (SGH-T849)*

Hey:

I have a dead Samsung Galaxy Tab SGH-T849 (T-Mobile). My son washed it to clean it up :/ I was initially booting but in loop. so I tried to install a new custom rom and it went completely dead.

I showed it to a couple of techs but they said the motherboard/ main board is bust and will have to be replaced.

I was wondering that by any chance you would have a spare working motherboard for this unit or maybe can help in any way.

Thank you.


----------



## machv5 (Aug 13, 2013)

machv5 said:


> I have an SGH-I727r that can only be seen by QHUSB Download mode can I do the Unbrickable mod on it?
> I noticed an S2 in the list someplace but not my exact model.
> If so do you know the location of the correct resistor I need to remove and any related pins that I need to be soldering. I can send a picture of my board if necessary. I have seen other pictures of what my board should look like for the jtag but it doesn't seem to resemble the photos I have seen. It's a Rogers Canada model (hence the 'r' I think?)
> Thank you
> ...

Click to collapse



bump


----------



## MWTTRON (Sep 22, 2013)

I have an SGH-I777 and an SCH-I535 that I stupidly flashed CWM 4.3 and a 4.3 ROM two weeks ago.  Something didn't install correctly as two weeks later they both are soft bricked.  The SGH-I777 will go to download mode but my computer wont find anything but the very basic driver (Casual) from Samsung.  If I press the power button I get the Samsung Error Message saying an update messed up and to run Emergency Recover in Keis.  I try to run it but it freezes at about 30% and then nothing.
The I535 boots to download immediately but the computer wont find any driver.  It says it is unrecognizable!
I am not good with linux but good with Old DOS and windows(fair) so I understand the basics just not the specifics.
I tried the one click Heimdall but it didn't find the right driver...
I need HELP!!  Anything you can suggest would be greatly appreciated!


----------



## jinhazel (Nov 9, 2013)

Hi,

does anyone have a working link of the patched *LG 3d P920 *CM 7.2.0 that is posted by sir dragonzkiller?
here is his thread. the link is dead and I can't find any reference to a working one. I hope somebody can help. thank you.
hxxp://forum.xda-developers.com/showthread.php?t=1442803&page=248


----------



## akarsh007 (Dec 20, 2013)

anwar726 said:


> Dear Adam
> My samsung I8262 (GT-I8262 Samsung Galaxy Core) is bricked accidently .
> now its totaly dead and nothing happen when i have tryed to power
> key... i also tryed with usb jig but nothing happen i also tryed the
> ...

Click to collapse



hi i am also stuck in the same situation, did u find and method getting ur phone back


----------



## juno106 (Mar 28, 2014)

Hi ADAM

IS UNBRICKABLE MOD POSSIBLE NOW FOR "SAMSUNG GALAXY S2 GT-I9100"? So many of them are hard bricked now and waiting for help.Mine just died, few days ago 

Please respond if there is a way to fix dead Galaxy S2

Thank you in advance


----------



## speedman2202 (Sep 2, 2015)

@AdamOutler

i want u check this thread and help me understand why this phone act like that with me ..... i have samsung s4 same condition , I dont know whats wrong :\
http://forum.xda-developers.com/android/help/samsung-galaxy-dous-s2-gt-s7582-t3034002

if u have any hint plz dont hesitate to tell me .... thx


----------

