GTI9300PARAM » History » Version 6
Denis 'GNUtoo' Carikli, 01/31/2022 09:18 AM
Add toc
| 1 | 6 | Denis 'GNUtoo' Carikli | {{toc}} |
|---|---|---|---|
| 2 | |||
| 3 | 1 | Denis 'GNUtoo' Carikli | h1. GTI9300PARAM |
| 4 | |||
| 5 | You can dump the PARAM partition for the Galaxy SIII (GT-I9300) like that: |
||
| 6 | <pre> |
||
| 7 | adb pull /dev/block/platform/dw_mmc/by-name/PARAM PARAM.img |
||
| 8 | </pre> |
||
| 9 | |||
| 10 | That file at first looks like a tar archive. |
||
| 11 | <pre> |
||
| 12 | $ file PARAM.img |
||
| 13 | PARAM.img: POSIX tar archive (GNU) |
||
| 14 | </pre> |
||
| 15 | |||
| 16 | And it indeed does contain a tarball: |
||
| 17 | <pre> |
||
| 18 | $ tar tvf PARAM.img |
||
| 19 | -rw-r--r-- se.infra/se.infra 3624 2013-11-28 13:33 adv-env.img |
||
| 20 | -rw-r--r-- se.infra/se.infra 42023 2013-11-28 13:33 ani_upload_1_kernel_panic.jpg |
||
| 21 | -rw-r--r-- se.infra/se.infra 39255 2013-11-28 13:33 ani_upload_2_cp_crash.jpg |
||
| 22 | -rw-r--r-- se.infra/se.infra 47443 2013-11-28 13:33 ani_upload_3_forced_upload.jpg |
||
| 23 | -rw-r--r-- se.infra/se.infra 10810 2013-11-28 13:33 ani_upload_4_hardware_reset.jpg |
||
| 24 | -rw-r--r-- se.infra/se.infra 11586 2013-11-28 13:33 ani_upload_4_smpl.jpg |
||
| 25 | -rw-r--r-- se.infra/se.infra 54151 2013-11-28 13:33 ani_upload_4_unknown_reset.jpg |
||
| 26 | -rw-r--r-- se.infra/se.infra 11495 2013-11-28 13:33 ani_upload_4_watchdog_reset.jpg |
||
| 27 | -rw-r--r-- se.infra/se.infra 12276 2013-11-28 13:33 ani_upload_4_wtsr.jpg |
||
| 28 | -rw-r--r-- se.infra/se.infra 9703 2013-11-28 13:33 ani_upload_4_wtsr_smpl.jpg |
||
| 29 | -rw-r--r-- se.infra/se.infra 12711 2013-11-28 13:33 ani_upload_5_user_fault.jpg |
||
| 30 | -rw-r--r-- se.infra/se.infra 19098 2013-11-28 13:33 ani_upload_6_hsic_disconnected.jpg |
||
| 31 | -rw-r--r-- se.infra/se.infra 84123 2013-11-28 13:33 download_error.jpg |
||
| 32 | -rw-r--r-- se.infra/se.infra 73061 2013-11-28 13:33 download.jpg |
||
| 33 | -rw-r--r-- se.infra/se.infra 64410 2013-11-28 13:33 logo.jpg |
||
| 34 | -rw-r--r-- se.infra/se.infra 37205 2013-11-28 13:33 lpm.jpg |
||
| 35 | -rw-r--r-- se.infra/se.infra 36572 2013-11-28 13:33 lpm_wireless.jpg |
||
| 36 | -rw-r--r-- se.infra/se.infra 91511 2013-11-28 13:33 secure_error.jpg |
||
| 37 | -rwxr-xr-x se.infra/se.infra 5851 2013-11-28 13:33 sud_0.jpg |
||
| 38 | -rwxr-xr-x se.infra/se.infra 2713 2013-11-28 13:33 sud_1.jpg |
||
| 39 | -rwxr-xr-x se.infra/se.infra 5634 2013-11-28 13:33 sud_2.jpg |
||
| 40 | -rwxr-xr-x se.infra/se.infra 6292 2013-11-28 13:33 sud_3.jpg |
||
| 41 | -rwxr-xr-x se.infra/se.infra 4604 2013-11-28 13:33 sud_4.jpg |
||
| 42 | -rwxr-xr-x se.infra/se.infra 5706 2013-11-28 13:33 sud_5.jpg |
||
| 43 | -rwxr-xr-x se.infra/se.infra 6792 2013-11-28 13:33 sud_6.jpg |
||
| 44 | -rwxr-xr-x se.infra/se.infra 3885 2013-11-28 13:33 sud_7.jpg |
||
| 45 | -rwxr-xr-x se.infra/se.infra 6826 2013-11-28 13:33 sud_8.jpg |
||
| 46 | -rwxr-xr-x se.infra/se.infra 6528 2013-11-28 13:33 sud_9.jpg |
||
| 47 | -rw-r--r-- se.infra/se.infra 168616 2013-11-28 13:33 warning.jpg |
||
| 48 | </pre> |
||
| 49 | |||
| 50 | The size of the PARAM.img file is exactly 8MiB: |
||
| 51 | <pre> |
||
| 52 | $ ls -lah PARAM.img |
||
| 53 | [...] 8.0M [...] PARAM.img |
||
| 54 | $ ls -la PARAM.img |
||
| 55 | [...] 8388608 [...] PARAM.img |
||
| 56 | </pre> |
||
| 57 | |||
| 58 | And we can get the size of the tarball with --totals: |
||
| 59 | <pre> |
||
| 60 | $ man tar |
||
| 61 | [...] |
||
| 62 | --totals[=SIGNAL] |
||
| 63 | Print total bytes after processing the archive. [...] |
||
| 64 | </pre> |
||
| 65 | |||
| 66 | For example: |
||
| 67 | <pre> |
||
| 68 | $ tar --totals -tf PARAM.img |
||
| 69 | adv-env.img |
||
| 70 | [many files] |
||
| 71 | warning.jpg |
||
| 72 | Total bytes read: 911360 (890KiB, 286MiB/s) |
||
| 73 | </pre> |
||
| 74 | |||
| 75 | So here the tarball terminates way beyond the end. |
||
| 76 | |||
| 77 | 911360 is 0xde800: |
||
| 78 | <pre> |
||
| 79 | $ python |
||
| 80 | [...] |
||
| 81 | >>> hex(911360) |
||
| 82 | '0xde800' |
||
| 83 | </pre> |
||
| 84 | |||
| 85 | But we still have things after the tarball: |
||
| 86 | <pre> |
||
| 87 | $ hexdump -C PARAM.img |
||
| 88 | 000dd4a0 05 00 14 00 50 07 ff d9 00 00 00 00 00 00 00 00 |....P...........| |
||
| 89 | 000dd4b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 90 | * |
||
| 91 | 00700000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 92 | 00700010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 93 | * |
||
| 94 | 00700200 00 00 00 00 03 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 95 | 00700210 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 |................| |
||
| 96 | 00700220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 97 | 00700230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 98 | 00700240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 99 | * |
||
| 100 | 00700e20 00 00 00 00 00 00 00 00 ff ff ff ff ff ef 7f ff |................| |
||
| 101 | 00700e30 ff ff f7 ff ff ff f7 ff ff fe ff ff ff ff 7f ff |................| |
||
| 102 | 00700e40 fb ef ff ff ff fb ff df ff ff ff ff ff ff ff ff |................| |
||
| 103 | 00700e50 df bf ff ff 7f ef f7 ff f7 ff ff ff ff fe ff ff |................| |
||
| 104 | 00700e60 ff ff ff ff ef fb ff ef ff fb ff ff fd ff f7 ef |................| |
||
| 105 | 00700e70 ff ff ff ff f5 ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 106 | 00700e80 ff ff ff fe ff ef ff ff ff bf fd ff ff ff ff ff |................| |
||
| 107 | 00700e90 ff ff ff ff ff ff f7 fb ff ff ff eb ff ff ff eb |................| |
||
| 108 | 00700ea0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 109 | 00700eb0 ff ff ff ff ff ff ff ff ff ff ff df ff ff ff ff |................| |
||
| 110 | 00700ec0 ff ff ff ff ff ff f7 ff ff ff ff ff ff ff ff ff |................| |
||
| 111 | 00700ed0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 112 | 00700ee0 df ff ff ff ff ff ff ff ff ff ff ff ff ff d7 ff |................| |
||
| 113 | 00700ef0 ff ff ff af ff ff ff fe ff ff ff ff ff ff ff ff |................| |
||
| 114 | 00700f00 ff ef ff ff ff 7f ff ff ff df ff ff f7 ff ff ff |................| |
||
| 115 | 00700f10 ff ff ff ff ff ff ff ff ff ff ff ef ff ff f7 ff |................| |
||
| 116 | 00700f20 ff ff ff ff ff ff ff ff ff fe ef ff ff ef fb df |................| |
||
| 117 | 00700f30 ff ff ff ff ff fb ff ff ff ff ff ff ff ff ff ff |................| |
||
| 118 | 00700f40 ff ff f5 ff ff ff ff fb ff ff ff ff ff ff ff ff |................| |
||
| 119 | 00700f50 fb ff ff fb fd ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 120 | 00700f60 f7 ff ff ef f7 ff ff ef ff ff ff ff ff 9e ff fd |................| |
||
| 121 | 00700f70 ff ff ff ff fb ff ff de f3 fb ff ff ff ef df ff |................| |
||
| 122 | 00700f80 ff ff ff ff ff fb ff bf ff ff ff ff ff ff ff fd |................| |
||
| 123 | 00700f90 ff fe f7 fe ff eb ff ff ff fb ff ff df ff ff ff |................| |
||
| 124 | 00700fa0 df ff ff ff ff ff ff ff ff ff fb ff ff ff ff fb |................| |
||
| 125 | 00700fb0 ff ff ff df ff ff ff ff fe fe fe ff ff f7 ff ff |................| |
||
| 126 | 00700fc0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb |................| |
||
| 127 | 00700fd0 fd ff ff ff ff fd ff ff ff ff ff ff fe ff ff ff |................| |
||
| 128 | 00700fe0 ff ff df ff ff ff ff fb ff ff ff ff ff ff ff ff |................| |
||
| 129 | 00700ff0 ff f7 df ff ff ff ff ff ff ff ff ff ff ff ff ff |................| |
||
| 130 | 00701000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 131 | * |
||
| 132 | 007ffc00 d4 ad 55 ff 52 e9 ed 4c f8 d1 9c 08 79 b6 e9 6c |..U.R..L....y..l| |
||
| 133 | 007ffc10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 134 | * |
||
| 135 | 00800000 |
||
| 136 | </pre> |
||
| 137 | |||
| 138 | Questions: |
||
| 139 | * Can we ignore what is after the tarball and grow it to 8MiB? |
||
| 140 | * Does what's after contains encrypted data for the bootloader? |
||
| 141 | 2 | Denis 'GNUtoo' Carikli | |
| 142 | h2. adv_env.img |
||
| 143 | |||
| 144 | Here's the content of the adv-env.img file: |
||
| 145 | <pre> |
||
| 146 | $ hexdump -C adv-env.img |
||
| 147 | 00000000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 148 | 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 149 | * |
||
| 150 | 00000200 04 00 00 00 01 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 151 | 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 152 | 00000220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 153 | 00000230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 154 | 00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 155 | * |
||
| 156 | 00000e20 00 00 00 00 00 00 00 00 |........| |
||
| 157 | 00000e28 |
||
| 158 | </pre> |
||
| 159 | |||
| 160 | Questions: |
||
| 161 | * Why are the kernel parameters repeated again after the end of the tarball? |
||
| 162 | * Where are the updated kernel parameters stored? |
||
| 163 | * Are the default and in-use kernel parameters stored at different location? |
||
| 164 | 3 | Denis 'GNUtoo' Carikli | |
| 165 | h2. kenrel command line |
||
| 166 | |||
| 167 | *Default kernel command line*: @console=ram loglevel=4@ |
||
| 168 | |||
| 169 | Test: |
||
| 170 | * change to @console=ram loglevel=8@ through the bootloader setenv command |
||
| 171 | * run saveenv |
||
| 172 | * reboot and validate that it's really changed with printenv |
||
| 173 | * observe the results on the filesystem |
||
| 174 | |||
| 175 | See [[MidasBootloader]] for more details on how to change the command line parameters. |
||
| 176 | |||
| 177 | After changing the environment variable, we still have loglevel=4 in the adv-env.img file that is in the tarball: |
||
| 178 | adv-env.img |
||
| 179 | <pre> |
||
| 180 | $ hexdump -C adv-env.img |
||
| 181 | 00000000 03 00 fe ca 00 01 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 182 | 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 183 | * |
||
| 184 | 00000200 04 00 00 00 01 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 185 | 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 186 | 00000220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 187 | 00000230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 34 00 00 |ram loglevel=4..| |
||
| 188 | 00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 189 | * |
||
| 190 | 00000e20 00 00 00 00 00 00 00 00 |........| |
||
| 191 | 00000e28 |
||
| 192 | </pre> |
||
| 193 | So these must be the default parameters. |
||
| 194 | |||
| 195 | And the actual kernel parameters were instead saved after the tarball: |
||
| 196 | <pre> |
||
| 197 | $ hexdump PARAM.img |
||
| 198 | * |
||
| 199 | 00700200 00 00 00 00 03 00 00 00 4c 4f 00 00 00 00 00 00 |........LO......| |
||
| 200 | 00700210 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 |................| |
||
| 201 | 00700220 00 00 00 00 00 00 00 00 63 6f 6e 73 6f 6c 65 3d |........console=| |
||
| 202 | 00700230 72 61 6d 20 6c 6f 67 6c 65 76 65 6c 3d 38 00 00 |ram loglevel=8..| |
||
| 203 | 00700240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| |
||
| 204 | * |
||
| 205 | </pre> |
||
| 206 | |||
| 207 | |||
| 208 | *Results:* |
||
| 209 | * Since the s-boot 4.0 bootloader on several Exynos 4412 devices (GT-I9300, GT-I9305, GT-N7100, GT-N7105) doesn't take into account the boot.img kenrel parameters, we can then try to change them by editing the PARAM.img after the tarball. |
||
| 210 | * There is valuable info after the tarball => don't make the tarball grow too much. |
||
| 211 | 4 | Denis 'GNUtoo' Carikli | |
| 212 | h2. USB switch |
||
| 213 | |||
| 214 | On a GT-I9300, if I set the address @0x00700204@ to @00@, it switch to the USB to the modem's USB, and @Bus 002 Device 095: ID 1519:0020 Comneon HSIC Device@ appears when connecting the GT-I9300 to a computer. |
||
| 215 | |||
| 216 | When I set it back to @01@, I can have ADB again. |
||
| 217 | |||
| 218 | 1 | Denis 'GNUtoo' Carikli | Here's the diff: |
| 219 | <pre> |
||
| 220 | 5 | Denis 'GNUtoo' Carikli | $ vbindiff PARAM.img PARAM.img.new |
| 221 | PARAM.img |
||
| 222 | 4 | Denis 'GNUtoo' Carikli | 0070 0204: 00 00 00 00 4C 4F 00 00 00 00 00 00 00 00 00 00 ....LO.. ........ |
| 223 | 0070 0214: 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 224 | 0070 0224: 00 00 00 00 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 ....cons ole=ram |
||
| 225 | 0070 0234: 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 00 00 00 00 loglevel =8...... |
||
| 226 | 0070 0244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 227 | 0070 0254: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 228 | 0070 0264: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 229 | 0070 0274: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 230 | 0070 0284: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 231 | 0070 0294: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 232 | 0070 02A4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 233 | 0070 02B4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 234 | 0070 02C4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 235 | 0070 02D4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 236 | 0070 02E4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 237 | 0070 02F4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 238 | PARAM.img.new |
||
| 239 | 0070 0204: 01 00 00 00 4C 4F 00 00 00 00 00 00 00 00 00 00 ....LO.. ........ |
||
| 240 | 0070 0214: 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 241 | 0070 0224: 00 00 00 00 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 ....cons ole=ram |
||
| 242 | 0070 0234: 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 00 00 00 00 loglevel =8...... |
||
| 243 | 0070 0244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 244 | 0070 0254: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 245 | 0070 0264: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 246 | 0070 0274: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 247 | 0070 0284: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 248 | 0070 0294: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 249 | 0070 02A4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 250 | 0070 02B4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 251 | 0070 02C4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 252 | 0070 02D4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 253 | 0070 02E4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 254 | 0070 02F4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 255 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 256 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 257 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 258 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 259 | </pre> |
||
| 260 | |||
| 261 | You can also get that behavior with the stock OS if you go to the phone application and enter *#7284# and set "USB" to |
||
| 262 | "MODEM" and tap "SAVE and RESET". After that phone will reboot and you'll see the modem when connecting the GT-I9300 to a computer through USB. |