GTI9300PARAM » History » Version 18
Denis 'GNUtoo' Carikli, 02/01/2022 04:22 AM
| 1 | 6 | Denis 'GNUtoo' Carikli | {{toc}} |
|---|---|---|---|
| 2 | |||
| 3 | 1 | Denis 'GNUtoo' Carikli | h1. GTI9300PARAM |
| 4 | |||
| 5 | 12 | Denis 'GNUtoo' Carikli | h2. Structure |
| 6 | |||
| 7 | 17 | Denis 'GNUtoo' Carikli | | Start (included) | End (included) | size | Content | |
| 8 | | 0x000000 | 0x0de800 - 1 | 890 KiB | [[GTI9300PARAM#Tarball|Tarball]] | |
||
| 9 | | around 0x000228 | ? | | [[GTI9300PARAM#Kernel command line|Kernel command line]] | |
||
| 10 | | 0x700204 | 0x700204 | 1 byte | [[GTI9300PARAM#USB switch|USB switch]] |
||
| 11 | @0x00@: MODEM USB routed to the USB connector |
||
| 12 | @0x01@: SOC USB routed to the USB connector | |
||
| 13 | | 0x700208 | 0x700208 | 1 byte | [[GTI9300PARAM#Modem debug level|Modem debug level]] |
||
| 14 | @LO@: Modem debug level set to @LOW@ |
||
| 15 | @MI@: Modem debug level set to @MEDIUM@ |
||
| 16 | @HI@: Modem debug level set to @HIGH@ | |
||
| 17 | | 0x7FFC00 | 0x7FFC0F | 16 bytes | [[GTI9300PARAM#Modem debug level|checksum]] | |
||
| 18 | | 0x7ffc10 | 0x7fffff | 1008 bytes | MDM settings ? | |
||
| 19 | 16 | Denis 'GNUtoo' Carikli | |
| 20 | 17 | Denis 'GNUtoo' Carikli | Size of the partition: 0x800000 (8MiB) |
| 21 | 12 | Denis 'GNUtoo' Carikli | |
| 22 | 11 | Denis 'GNUtoo' Carikli | h2. Tarball |
| 23 | |||
| 24 | 1 | Denis 'GNUtoo' Carikli | You can dump the PARAM partition for the Galaxy SIII (GT-I9300) like that: |
| 25 | <pre> |
||
| 26 | adb pull /dev/block/platform/dw_mmc/by-name/PARAM PARAM.img |
||
| 27 | </pre> |
||
| 28 | |||
| 29 | That file at first looks like a tar archive. |
||
| 30 | <pre> |
||
| 31 | $ file PARAM.img |
||
| 32 | PARAM.img: POSIX tar archive (GNU) |
||
| 33 | </pre> |
||
| 34 | |||
| 35 | And it indeed does contain a tarball: |
||
| 36 | <pre> |
||
| 37 | $ tar tvf PARAM.img |
||
| 38 | -rw-r--r-- se.infra/se.infra 3624 2013-11-28 13:33 adv-env.img |
||
| 39 | -rw-r--r-- se.infra/se.infra 42023 2013-11-28 13:33 ani_upload_1_kernel_panic.jpg |
||
| 40 | -rw-r--r-- se.infra/se.infra 39255 2013-11-28 13:33 ani_upload_2_cp_crash.jpg |
||
| 41 | -rw-r--r-- se.infra/se.infra 47443 2013-11-28 13:33 ani_upload_3_forced_upload.jpg |
||
| 42 | -rw-r--r-- se.infra/se.infra 10810 2013-11-28 13:33 ani_upload_4_hardware_reset.jpg |
||
| 43 | -rw-r--r-- se.infra/se.infra 11586 2013-11-28 13:33 ani_upload_4_smpl.jpg |
||
| 44 | -rw-r--r-- se.infra/se.infra 54151 2013-11-28 13:33 ani_upload_4_unknown_reset.jpg |
||
| 45 | -rw-r--r-- se.infra/se.infra 11495 2013-11-28 13:33 ani_upload_4_watchdog_reset.jpg |
||
| 46 | -rw-r--r-- se.infra/se.infra 12276 2013-11-28 13:33 ani_upload_4_wtsr.jpg |
||
| 47 | -rw-r--r-- se.infra/se.infra 9703 2013-11-28 13:33 ani_upload_4_wtsr_smpl.jpg |
||
| 48 | -rw-r--r-- se.infra/se.infra 12711 2013-11-28 13:33 ani_upload_5_user_fault.jpg |
||
| 49 | -rw-r--r-- se.infra/se.infra 19098 2013-11-28 13:33 ani_upload_6_hsic_disconnected.jpg |
||
| 50 | -rw-r--r-- se.infra/se.infra 84123 2013-11-28 13:33 download_error.jpg |
||
| 51 | -rw-r--r-- se.infra/se.infra 73061 2013-11-28 13:33 download.jpg |
||
| 52 | -rw-r--r-- se.infra/se.infra 64410 2013-11-28 13:33 logo.jpg |
||
| 53 | -rw-r--r-- se.infra/se.infra 37205 2013-11-28 13:33 lpm.jpg |
||
| 54 | -rw-r--r-- se.infra/se.infra 36572 2013-11-28 13:33 lpm_wireless.jpg |
||
| 55 | -rw-r--r-- se.infra/se.infra 91511 2013-11-28 13:33 secure_error.jpg |
||
| 56 | -rwxr-xr-x se.infra/se.infra 5851 2013-11-28 13:33 sud_0.jpg |
||
| 57 | -rwxr-xr-x se.infra/se.infra 2713 2013-11-28 13:33 sud_1.jpg |
||
| 58 | -rwxr-xr-x se.infra/se.infra 5634 2013-11-28 13:33 sud_2.jpg |
||
| 59 | -rwxr-xr-x se.infra/se.infra 6292 2013-11-28 13:33 sud_3.jpg |
||
| 60 | -rwxr-xr-x se.infra/se.infra 4604 2013-11-28 13:33 sud_4.jpg |
||
| 61 | -rwxr-xr-x se.infra/se.infra 5706 2013-11-28 13:33 sud_5.jpg |
||
| 62 | -rwxr-xr-x se.infra/se.infra 6792 2013-11-28 13:33 sud_6.jpg |
||
| 63 | -rwxr-xr-x se.infra/se.infra 3885 2013-11-28 13:33 sud_7.jpg |
||
| 64 | -rwxr-xr-x se.infra/se.infra 6826 2013-11-28 13:33 sud_8.jpg |
||
| 65 | -rwxr-xr-x se.infra/se.infra 6528 2013-11-28 13:33 sud_9.jpg |
||
| 66 | -rw-r--r-- se.infra/se.infra 168616 2013-11-28 13:33 warning.jpg |
||
| 67 | </pre> |
||
| 68 | |||
| 69 | The size of the PARAM.img file is exactly 8MiB: |
||
| 70 | <pre> |
||
| 71 | 8 | Denis 'GNUtoo' Carikli | $ ls -lah PARAM.img |
| 72 | 1 | Denis 'GNUtoo' Carikli | [...] 8.0M [...] PARAM.img |
| 73 | 8 | Denis 'GNUtoo' Carikli | $ ls -la PARAM.img |
| 74 | 1 | Denis 'GNUtoo' Carikli | [...] 8388608 [...] PARAM.img |
| 75 | </pre> |
||
| 76 | |||
| 77 | And we can get the size of the tarball with --totals: |
||
| 78 | <pre> |
||
| 79 | $ man tar |
||
| 80 | [...] |
||
| 81 | --totals[=SIGNAL] |
||
| 82 | Print total bytes after processing the archive. [...] |
||
| 83 | </pre> |
||
| 84 | |||
| 85 | For example: |
||
| 86 | <pre> |
||
| 87 | 8 | Denis 'GNUtoo' Carikli | $ tar --totals -tf PARAM.img |
| 88 | 1 | Denis 'GNUtoo' Carikli | adv-env.img |
| 89 | [many files] |
||
| 90 | warning.jpg |
||
| 91 | Total bytes read: 911360 (890KiB, 286MiB/s) |
||
| 92 | </pre> |
||
| 93 | |||
| 94 | 7 | Denis 'GNUtoo' Carikli | So here the tarball terminates way before the end of the PARAM.img file. |
| 95 | 1 | Denis 'GNUtoo' Carikli | |
| 96 | 911360 is 0xde800: |
||
| 97 | <pre> |
||
| 98 | $ python |
||
| 99 | [...] |
||
| 100 | >>> hex(911360) |
||
| 101 | '0xde800' |
||
| 102 | </pre> |
||
| 103 | |||
| 104 | But we still have things after the tarball: |
||
| 105 | <pre> |
||
| 106 | $ hexdump -C PARAM.img |
||
| 107 | 000dd4a0 05 00 14 00 50 07 ff d9 00 00 00 00 00 00 00 00 |....P...........| |
||
| 108 | 000dd4b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 109 | * |
||
| 110 | 00700000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 111 | 00700010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 112 | * |
||
| 113 | 00700200 00 00 00 00 03 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 114 | 00700210 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 |................| |
||
| 115 | 00700220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 116 | 00700230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 117 | 00700240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 118 | * |
||
| 119 | 00700e20 00 00 00 00 00 00 00 00 ff ff ff ff ff ef 7f ff |................| |
||
| 120 | 00700e30 ff ff f7 ff ff ff f7 ff ff fe ff ff ff ff 7f ff |................| |
||
| 121 | 00700e40 fb ef ff ff ff fb ff df ff ff ff ff ff ff ff ff |................| |
||
| 122 | 00700e50 df bf ff ff 7f ef f7 ff f7 ff ff ff ff fe ff ff |................| |
||
| 123 | 00700e60 ff ff ff ff ef fb ff ef ff fb ff ff fd ff f7 ef |................| |
||
| 124 | 00700e70 ff ff ff ff f5 ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 125 | 00700e80 ff ff ff fe ff ef ff ff ff bf fd ff ff ff ff ff |................| |
||
| 126 | 00700e90 ff ff ff ff ff ff f7 fb ff ff ff eb ff ff ff eb |................| |
||
| 127 | 00700ea0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 128 | 00700eb0 ff ff ff ff ff ff ff ff ff ff ff df ff ff ff ff |................| |
||
| 129 | 00700ec0 ff ff ff ff ff ff f7 ff ff ff ff ff ff ff ff ff |................| |
||
| 130 | 00700ed0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 131 | 00700ee0 df ff ff ff ff ff ff ff ff ff ff ff ff ff d7 ff |................| |
||
| 132 | 00700ef0 ff ff ff af ff ff ff fe ff ff ff ff ff ff ff ff |................| |
||
| 133 | 00700f00 ff ef ff ff ff 7f ff ff ff df ff ff f7 ff ff ff |................| |
||
| 134 | 00700f10 ff ff ff ff ff ff ff ff ff ff ff ef ff ff f7 ff |................| |
||
| 135 | 00700f20 ff ff ff ff ff ff ff ff ff fe ef ff ff ef fb df |................| |
||
| 136 | 00700f30 ff ff ff ff ff fb ff ff ff ff ff ff ff ff ff ff |................| |
||
| 137 | 00700f40 ff ff f5 ff ff ff ff fb ff ff ff ff ff ff ff ff |................| |
||
| 138 | 00700f50 fb ff ff fb fd ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 139 | 00700f60 f7 ff ff ef f7 ff ff ef ff ff ff ff ff 9e ff fd |................| |
||
| 140 | 00700f70 ff ff ff ff fb ff ff de f3 fb ff ff ff ef df ff |................| |
||
| 141 | 00700f80 ff ff ff ff ff fb ff bf ff ff ff ff ff ff ff fd |................| |
||
| 142 | 00700f90 ff fe f7 fe ff eb ff ff ff fb ff ff df ff ff ff |................| |
||
| 143 | 00700fa0 df ff ff ff ff ff ff ff ff ff fb ff ff ff ff fb |................| |
||
| 144 | 00700fb0 ff ff ff df ff ff ff ff fe fe fe ff ff f7 ff ff |................| |
||
| 145 | 00700fc0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 146 | 00700fd0 fd ff ff ff ff fd ff ff ff ff ff ff fe ff ff ff |................| |
||
| 147 | 00700fe0 ff ff df ff ff ff ff fb ff ff ff ff ff ff ff ff |................| |
||
| 148 | 00700ff0 ff f7 df ff ff ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 149 | 00701000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 150 | * |
||
| 151 | 007ffc00 d4 ad 55 ff 52 e9 ed 4c f8 d1 9c 08 79 b6 e9 6c |..U.R..L....y..l| |
||
| 152 | 007ffc10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 153 | * |
||
| 154 | 00800000 |
||
| 155 | </pre> |
||
| 156 | |||
| 157 | Questions: |
||
| 158 | * Can we ignore what is after the tarball and grow it to 8MiB? |
||
| 159 | 2 | Denis 'GNUtoo' Carikli | * Does what's after contains encrypted data for the bootloader? |
| 160 | 1 | Denis 'GNUtoo' Carikli | |
| 161 | 11 | Denis 'GNUtoo' Carikli | h3. adv_env.img |
| 162 | 2 | Denis 'GNUtoo' Carikli | |
| 163 | Here's the content of the adv-env.img file: |
||
| 164 | <pre> |
||
| 165 | 8 | Denis 'GNUtoo' Carikli | $ hexdump -C adv-env.img |
| 166 | 2 | Denis 'GNUtoo' Carikli | 00000000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
| 167 | 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 168 | * |
||
| 169 | 00000200 04 00 00 00 01 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 170 | 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 171 | 00000220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 172 | 00000230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 173 | 00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 174 | * |
||
| 175 | 00000e20 00 00 00 00 00 00 00 00 |........| |
||
| 176 | 00000e28 |
||
| 177 | </pre> |
||
| 178 | |||
| 179 | Questions: |
||
| 180 | * Why are the kernel parameters repeated again after the end of the tarball? |
||
| 181 | * Where are the updated kernel parameters stored? |
||
| 182 | 3 | Denis 'GNUtoo' Carikli | * Are the default and in-use kernel parameters stored at different location? |
| 183 | 1 | Denis 'GNUtoo' Carikli | |
| 184 | 12 | Denis 'GNUtoo' Carikli | h2. Kernel command line |
| 185 | 3 | Denis 'GNUtoo' Carikli | |
| 186 | *Default kernel command line*: @console=ram loglevel=4@ |
||
| 187 | |||
| 188 | 8 | Denis 'GNUtoo' Carikli | Test: |
| 189 | 3 | Denis 'GNUtoo' Carikli | * change to @console=ram loglevel=8@ through the bootloader setenv command |
| 190 | 8 | Denis 'GNUtoo' Carikli | * run saveenv |
| 191 | 3 | Denis 'GNUtoo' Carikli | * reboot and validate that it's really changed with printenv |
| 192 | * observe the results on the filesystem |
||
| 193 | |||
| 194 | See [[MidasBootloader]] for more details on how to change the command line parameters. |
||
| 195 | |||
| 196 | After changing the environment variable, we still have loglevel=4 in the adv-env.img file that is in the tarball: |
||
| 197 | adv-env.img |
||
| 198 | <pre> |
||
| 199 | 8 | Denis 'GNUtoo' Carikli | $ hexdump -C adv-env.img |
| 200 | 3 | Denis 'GNUtoo' Carikli | 00000000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
| 201 | 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 202 | * |
||
| 203 | 00000200 04 00 00 00 01 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 204 | 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 205 | 00000220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 206 | 00000230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 207 | 00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 208 | * |
||
| 209 | 00000e20 00 00 00 00 00 00 00 00 |........| |
||
| 210 | 00000e28 |
||
| 211 | </pre> |
||
| 212 | So these must be the default parameters. |
||
| 213 | |||
| 214 | And the actual kernel parameters were instead saved after the tarball: |
||
| 215 | <pre> |
||
| 216 | $ hexdump PARAM.img |
||
| 217 | * |
||
| 218 | 00700200 00 00 00 00 03 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 219 | 00700210 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 |................| |
||
| 220 | 00700220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 221 | 00700230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 38 00 00 |ram loglevel=8..| |
||
| 222 | 00700240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 223 | * |
||
| 224 | </pre> |
||
| 225 | |||
| 226 | |||
| 227 | 8 | Denis 'GNUtoo' Carikli | *Results:* |
| 228 | 3 | Denis 'GNUtoo' Carikli | * Since the s-boot 4.0 bootloader on several Exynos 4412 devices (GT-I9300, GT-I9305, GT-N7100, GT-N7105) doesn't take into account the boot.img kenrel parameters, we can then try to change them by editing the PARAM.img after the tarball. |
| 229 | * There is valuable info after the tarball => don't make the tarball grow too much. |
||
| 230 | 4 | Denis 'GNUtoo' Carikli | |
| 231 | h2. USB switch |
||
| 232 | |||
| 233 | On a GT-I9300, if I set the address @0x00700204@ to @00@, it switch to the USB to the modem's USB, and @Bus 002 Device 095: ID 1519:0020 Comneon HSIC Device@ appears when connecting the GT-I9300 to a computer. |
||
| 234 | |||
| 235 | When I set it back to @01@, I can have ADB again. |
||
| 236 | |||
| 237 | 1 | Denis 'GNUtoo' Carikli | Here's the diff: |
| 238 | <pre> |
||
| 239 | 5 | Denis 'GNUtoo' Carikli | $ vbindiff PARAM.img PARAM.img.new |
| 240 | PARAM.img |
||
| 241 | 4 | Denis 'GNUtoo' Carikli | 0070 0204: 00 00 00 00 4C 4F 00 00 00 00 00 00 00 00 00 00 ....LO.. ........ |
| 242 | 0070 0214: 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 243 | 0070 0224: 00 00 00 00 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 ....cons ole=ram |
||
| 244 | 0070 0234: 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 00 00 00 00 loglevel =8...... |
||
| 245 | 0070 0244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 246 | 0070 0254: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 247 | 0070 0264: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 248 | 0070 0274: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 249 | 0070 0284: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 250 | 0070 0294: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 251 | 0070 02A4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 252 | 0070 02B4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 253 | 0070 02C4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 254 | 0070 02D4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 255 | 0070 02E4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 256 | 0070 02F4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 257 | PARAM.img.new |
||
| 258 | 0070 0204: 01 00 00 00 4C 4F 00 00 00 00 00 00 00 00 00 00 ....LO.. ........ |
||
| 259 | 0070 0214: 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 260 | 0070 0224: 00 00 00 00 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 ....cons ole=ram |
||
| 261 | 0070 0234: 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 00 00 00 00 loglevel =8...... |
||
| 262 | 0070 0244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 263 | 0070 0254: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 264 | 0070 0264: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 265 | 0070 0274: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 266 | 0070 0284: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 267 | 0070 0294: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 268 | 0070 02A4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 269 | 0070 02B4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 270 | 0070 02C4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 271 | 0070 02D4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 272 | 0070 02E4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 273 | 0070 02F4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 274 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 275 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 276 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 277 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 278 | </pre> |
||
| 279 | |||
| 280 | 9 | Denis 'GNUtoo' Carikli | At the next boot the s-boot bootloader will then configure the USB switch to connect to the modem USB. |
| 281 | |||
| 282 | You can also get that behavior with the stock OS if you go to the phone application and enter @*#7284#@ and set @USB@ to |
||
| 283 | @MODEM@ and then click on the @SAVE and RESET@ button. It will then reboot the phone automatically. |
||
| 284 | |||
| 285 | Note that in both case (when doing it manually with Replicant or through the stock OS): |
||
| 286 | * ADB will not work anymore in Replicant, the recovery and the stock OS |
||
| 287 | * Heimdall may not work anymore |
||
| 288 | so you need a plan to be able to recovery from it. |
||
| 289 | |||
| 290 | If you run the stock OS, you can't count on recoveries as it tend to replace them the recoveries with its own recovery, but you can still use @*#7284#@ to change @USB@ back to @PDA@ instead of @MODEM@. |
||
| 291 | |||
| 292 | With Replicant, you can enable the terminal, adb and root for adb and applications in the developers settings, and once that is done, through the terminal application you can get root with @su@ and then type the following command to enable adb again: |
||
| 293 | <pre> |
||
| 294 | echo PDA > /sys/devices/virtual/sec/switch/usb_sel |
||
| 295 | </pre> |
||
| 296 | as this command is temporary (until the next reboot), you'll have to edit again the @PARAM@ partition and copy the modified @PARAM@ image to the @PARAM@ partition with @dd@. |
||
| 297 | 10 | Denis 'GNUtoo' Carikli | |
| 298 | h2. Modem debug level |
||
| 299 | |||
| 300 | In the stock OS, if we go to the phone application and dial @*#9900#@ and change the @Debug Level Enabled@ (@LOW@ @MEDIUM@ and @HIGH@ are available), the PARAM partition will be modified (and then the phone will be rebooted): |
||
| 301 | |||
| 302 | Here we switched the setting from @LOW@ to @MEDIUM@, and it produces a difference at @0x700208@: |
||
| 303 | <pre> |
||
| 304 | $ vbindiff low-2/PARAM.img medium-2/PARAM.img |
||
| 305 | low-2/PARAM.img |
||
| 306 | 0070 0208: 4C 4F 00 00 00 00 00 00 00 00 00 00 03 00 00 00 LO...... ........ |
||
| 307 | 0070 0218: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 308 | 0070 0228: 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 6C 6F 67 6C console= ram logl |
||
| 309 | 0070 0238: 65 76 65 6C 3D 38 00 00 00 00 00 00 00 00 00 00 evel=8.. ........ |
||
| 310 | 0070 0248: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 311 | 0070 0258: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 312 | 0070 0268: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 313 | 0070 0278: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 314 | 0070 0288: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 315 | 0070 0298: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 316 | 0070 02A8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 317 | 0070 02B8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 318 | 0070 02C8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 319 | 0070 02D8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 320 | 0070 02E8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 321 | 0070 02F8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 322 | medium-2/PARAM.img |
||
| 323 | 0070 0208: 4D 49 00 00 00 00 00 00 00 00 00 00 03 00 00 00 MI...... ........ |
||
| 324 | 0070 0218: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 325 | 0070 0228: 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 6C 6F 67 6C console= ram logl |
||
| 326 | 0070 0238: 65 76 65 6C 3D 38 00 00 00 00 00 00 00 00 00 00 evel=8.. ........ |
||
| 327 | 0070 0248: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 328 | 0070 0258: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 329 | 0070 0268: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 330 | 0070 0278: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 331 | 0070 0288: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 332 | 0070 0298: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 333 | 0070 02A8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 334 | 0070 02B8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 335 | 0070 02C8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 336 | 0070 02D8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 337 | 0070 02E8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 338 | 0070 02F8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 339 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 340 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 341 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 342 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 343 | </pre> |
||
| 344 | |||
| 345 | And here's what happens when switching from @MEDIUM@ to @HIGH@: |
||
| 346 | <pre> |
||
| 347 | $ vbindiff medium-2/PARAM.img high-1/PARAM.img |
||
| 348 | medium-2/PARAM.img |
||
| 349 | 0070 0200: 00 00 00 00 01 00 00 00 4D 49 00 00 00 00 00 00 ........ MI...... |
||
| 350 | 0070 0210: 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 ........ ........ |
||
| 351 | 0070 0220: 00 00 00 00 00 00 00 00 63 6F 6E 73 6F 6C 65 3D ........ console= |
||
| 352 | 0070 0230: 72 61 6D 20 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 ram logl evel=8.. |
||
| 353 | 0070 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 354 | 0070 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 355 | 0070 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 356 | 0070 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 357 | 0070 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 358 | 0070 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 359 | 0070 02A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 360 | 0070 02B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 361 | 0070 02C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 362 | 0070 02D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 363 | 0070 02E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 364 | 0070 02F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 365 | high-1/PARAM.img |
||
| 366 | 0070 0200: 00 00 00 00 01 00 00 00 48 49 00 00 00 00 00 00 ........ HI...... |
||
| 367 | 0070 0210: 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 ........ ........ |
||
| 368 | 0070 0220: 00 00 00 00 00 00 00 00 63 6F 6E 73 6F 6C 65 3D ........ console= |
||
| 369 | 0070 0230: 72 61 6D 20 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 ram logl evel=8.. |
||
| 370 | 0070 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 371 | 0070 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 372 | 0070 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 373 | 0070 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 374 | 0070 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 375 | 0070 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 376 | 0070 02A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 377 | 0070 02B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 378 | 0070 02C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 379 | 0070 02D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 380 | 0070 02E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 381 | 0070 02F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 382 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 383 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 384 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 385 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 386 | </pre> |
||
| 387 | |||
| 388 | Unfortunately in both cases, it also changes what appears to be a checksum: |
||
| 389 | <pre> |
||
| 390 | $ vbindiff medium-2/PARAM.img high-1/PARAM.img |
||
| 391 | medium-2/PARAM.img |
||
| 392 | 007F FC00: 0D 4D 03 C0 FD 5C A8 D1 2B 14 25 76 03 51 C5 27 .M...\.. +.%v.Q.' |
||
| 393 | 007F FC10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 394 | 007F FC20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 395 | 007F FC30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 396 | 007F FC40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 397 | 007F FC50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 398 | 007F FC60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 399 | 007F FC70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 400 | 007F FC80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 401 | 007F FC90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 402 | 007F FCA0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 403 | 007F FCB0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 404 | 007F FCC0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 405 | 007F FCD0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 406 | 007F FCE0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 407 | 007F FCF0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 408 | high-1/PARAM.img |
||
| 409 | 007F FC00: 67 39 08 85 9C 4A FE B8 65 47 9C C8 BB 95 DF B7 g9...J.. eG...... |
||
| 410 | 007F FC10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 411 | 007F FC20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 412 | 007F FC30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 413 | 007F FC40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 414 | 007F FC50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 415 | 007F FC60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 416 | 007F FC70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 417 | 007F FC80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 418 | 007F FC90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 419 | 007F FCA0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 420 | 007F FCB0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 421 | 007F FCC0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 422 | 007F FCD0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 423 | 007F FCE0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 424 | 007F FCF0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 425 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 426 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 427 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 428 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 429 | </pre> |
||
| 430 | |||
| 431 | To capture that I had to : |
||
| 432 | * Set the desired setting (through the phone application after dialing @$*#9900#@ and let it reboot |
||
| 433 | * then shut down the phone |
||
| 434 | * Then boot into the download mode |
||
| 435 | * then flash a Replicant recovery with root to @BOOT@ (do not flash it to RECOVERY) |
||
| 436 | * Then to dump the PARAM partition |
||
| 437 | * Then to reboot to the bootloader |
||
| 438 | * Then to flash back the stock OS BOOT |
||
| 439 | |||
| 440 | If for some reason I rebooted to the RECOVERY partition, the setting would be changed back to @LOW@ (this was verified by dialing @*#9900#@ and then looking at the setting value without changing it). |
||
| 441 | 15 | Denis 'GNUtoo' Carikli | |
| 442 | 18 | Denis 'GNUtoo' Carikli | I then tried to workaround the checksum issue by just reusing as-is the PARAM with @LOW@/@MEDIUM@/@HIGH@ and potentially modifying them on top to switch the modem routing to the SOC or the modem USB (as that doesn't affect the checksum). |
| 443 | |||
| 444 | That worked fine with the stock OS, we can see the settings being changed (from @LOW@ to @HIGH@ for instance) after dialing @*#9900#@, and by reflashing a Replicant recovery with root to the BOOT partition (and reflashing the stock BOOT after that), I could verify that PARAM wasn't modified again after that and that the changes were really taken into account. |
||
| 445 | |||
| 446 | But after installing Replicant (still by using the recovery in the BOOT partition and by verifying that the @PARAM@ partition hasn't been modified) once we boot in Replicant we don't have any messages anymore through xgoldmon, even with the USB routing to the modem USB and the debug to @HIGH@. With LineageOS (so with the nonfree samsung RIL library instead of the free software implementation), debug messages didn't appear either on /dev/ttyACM1 with xgoldmon. |
||
| 447 | |||
| 448 | What enables that debug function could also be in userspace: |
||
| 449 | * In the stock OS, some applications can send samsung-ipc commands[1] (and that even contains a security issue), so maybe it works through that. Though we can see what is sent to the modem by looking at what goes through the kernel. |
||
| 450 | * There might also be code in userspace to parse the PARAM partition, including how to change the MDM settings (which requires encrypting / decrypting the data at the end of the PARAM partition), so it might also be a way that the data is retrieved from param. |
||
| 451 | |||
| 452 | fn1. https://roberto.greyhats.it/2016/05/samsung-access-rild.html |
||
| 453 | |||
| 454 | fn2. [[AcademicPapersAndPresentations#Forensics-acquisition-Analysis-and-circumvention-of-samsung-secure-boot-enforced-common-criteria-mode|Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode]] |
||
| 455 | |||
| 456 | 15 | Denis 'GNUtoo' Carikli | h2. See also |
| 457 | |||
| 458 | * The [[AcademicPapersAndPresentations#Forensics-acquisition-Analysis-and-circumvention-of-samsung-secure-boot-enforced-common-criteria-mode|Forensics acquisition - Analysis and circumvention of samsung secure boot enforced common criteria mode]] paper has some information about the PARAM partition but it's mostly interested in MDM settings |