UnBrickable Mod on the Samsung Galaxy Nexus

[Bryant]

I am doing searches into for UnBrickable Mod on the Galaxy Nexus. UnBrickable Mod will furnish a technique of recuperating a dead device and assurance unlocked bootloaders for those with the mod. I unequivocally sorted through the 5,000 page OMAP 4430 processor manual. I accept this OMAP 4430 to be particularly comparable to OMAP 4460 utilized in the Galaxy Nexus. I am offering this on account of I need assist of you guys in this research.

[Gaganvihari]

I will need 2 Galaxy Nexus devices to compose this strategy work. I've done the research and I thoroughly think UnBrickable Mod on the Galaxy Nexus is possible.

[JoanaJhon]

In the game that this apparatus is anything like past Galaxy devices which I have finalized, the SysBoot will be locked to OneNAND. 0b100110. to process Boot from USB, a hardware alteration absolute necessity be performed to update that to 0b000110. This will permit boot from USB then boot from OneNAND.

[CassandraD]

The primary thing that struck me as odd is that OneNAND utilized to be a Samsung technology. The following thing was the way that the SysBoot binds role also to the Samsung S5PC110/Exynos xOM binds on S5PC110, xOM5 should be carried elevated to empower boot from USB then OneNAND. The OMAP4 permits this same practicality by changing SysBoot5. I accept Samsung made advance the OMAP4 chip.

[robot.txt]

Booting is the process of beginning a bootstrap from one of the booting apparatuses. The ROM code has several methods for booting: Peripheral booting and memory booting. In fringe booting, the ROM code surveys a chose correspondence interface for example UART or USB, downloads the executable code over the interface, and executes it in inward RAM. Downloaded product from an outside host might be utilized to modify flash remembrances joined to the device. This extraordinary instance of fringe booting is called preflashing; product downloaded for preflashing is called the flash loader. The flash loader smolders a revamped customer provision redisplay in outside flash memory. Starting product is a bland term for bootstrap, downloaded product, and flash loader. When the redisplay is smoldered, a programming (warm) reset might be performed.

[Bala Murugan S]

In the game that somebody has got ANY information concerning this device such as utilized chipset models, inside s, fix manuals, chipset documentations (particularly for the CPU, there are few tremendous manuals from TI about OMAP4460 general assorted angles). This is what we likewise do require.

[Ry]

In memory booting, the ROM code recognizes the bootstrap in lasting remembrances for example streak memory or memory cards and executes it. This procedure is ordinarily performed after a cold or warm device reset. The ROM code distinguishes in case the device might as well download product from a fringe interface (USB or UART) by utilizing the sys_boot[5:0] bind setup. This device includes introductory flashing I creation (outer memory is purge) and reflashing in service (outside memory is even now customized).

[Kork]

The ROM code architecture, it part into several essential layers with a top-down approach: high-level, drivers, and hardware reflection layer (HAL). One layer communicates with a more level layer through a unified interface. The heightened-level layer performs the essential undertakings of the general population ROM code: multicore startup, watchdog and clock configurations interfere with administration, cooperation with the capacity-administration IC, and fundamental booting schedule.

[TamaraAce]

Here are the bootmode pins we are concerned with.

h_SYSBOOT_0 pin: F26
h_SYSBOOT_1 pin: E27
h_SYSBOOT_2 pin: E26
h_SYSBOOT_3 pin: E25
h_SYSBOOT_4 pin: D28
h_SYSBOOT_5 pin: D27
--we are not concerned with the following--
h_SYSBOOT_6 pin: AF8
h_SYSBOOT_7 pin: AE8

These values are for the OMAP4430 and should follow on the OMAP4460

[DaminiAMD]

I apprehend that it appears mischievous to warranty a device following devastating it, but keep in mind. This adjustment has potential to help individuals who could have warranted their device in the ahead of everyone else. In the game that this adjustment keeps actually 2 individuals from sending their apparatus in for aid, the makers and warranty suppliers start safeguarding cash for each and every UnBrickable Mod performed. The users have less to fret over when flashing ROMs. The visionaries have less fret about bricking their device while developing.

[Memphis M]

I'd prefer to additionally indicate that the service manual on the i9000 instructs the service centers to put the device into download mode and download firmware. Since the firmware flash misses the mark then its hardware harm and the board needs to be replaced.

[AdamOutler]

Hi. I'm surprised this conversation went this far without a single mention of my name... Considering I'm the only developer who has ever published a guide on any hardware modification which makes any piece of technology "UnBrickable".. The capitol B in UnBrickable was started to represent my line of development... Also, I see directly quoted posts in this thread without reference to my name *cough*I-wrote-TamaraAce's-entire-post*cough*... How about a mention?

I've never been to this forum before, however, I do appreciate the clarity and detail which you people put into each post and I intend on reading and posting more here. So, with that out of the way, I will now make my first post.

OMAP4430 and OMAP4460 are nearly entirely the same device. We are working with them simultaniously and practically interchangeably. While I have not yet held one of these devices, I expect the Galaxy Nexus to be a low security device as it is made by a company which prides itself on openness. Whereas the Nook Tablet is an example of a high security device with signature checking in each stage of the bootloader. I am currently tackling the Nook Tablet and searching for security holes..

I would appreciate it if anyone with a nice large set of e-balls would tackle the project I'm about to mention on the Galaxy Nexus. First things first, we need to tackle the configuration of the boot mode.

BOOT_MODE5 pin must be low to enable boot from USB first. The boot from USB mode will reveal a USBID of 0451:d00e at the beginning portion of the boot if the device is configured to boot from USB.

If the device is not configured to boot from USB, we need to find out the initial mode in which it is configured. The Viewmem tool will give us an output

You must mount your system R/W and copy this binary into /system/bin, mark the binary executable (chmod 777), then check the status of the registers.
Post the output of the following command run from a terminal on your device

echo "CONTROL_STATUS=`viewmem 0x4A0022C4 |hexdump`"

This should show a nice clean output like this:

CONTROL_STATUS=0000000 0a96 0000

The 96, decoded into binary, starting with the LSB will show the mode in which the Galaxy Nexus is configured to boot.

Next we begin the hardware hacking: [
For now, we need the CONTROL STATUS register value.