SM-G920F Boot repair Exynos 7420 device

[zogu]

After a lot of reading, i think that problem is in file el_3mon(dot)bin. It is used to change mode. It is part of bootloader, but i don't know size or anything.
Found some korean boards, mv7420 (mvtool(dot)co(dot)kr) and somee forum aesop(dot)or(dot)kr where there is described boot proccess, but can't download files.
anyway sboot consist from:
fwbl1 bl1
bl2 bl2
el3_mon el3
bootloader
tzsw.
We should probably use this name in cfg.
Just to find sizes of every part of boot.

el3 mon must be a second image, after that we can load sboot and everything else.

[sataccount]

in engineering botloader v5.02, at offset 0x9c0e8 says "EL3 monitor information", maybe at this offset is for E7420.N.el3_mon.bin

in "Galaxy S6 Boot recovery.pptx" there are 4 bin files :

-7420.nbl1.bin
-E7420.N.el3_mon.bin
-bl2.bin
-s-boot.bin

[zogu]

Yes, i saw that, but i think that sboot and tzsw are sent together, ot tzsw is not needed at all.
Will check offset, thanks.

[sataccount]

but in cfg file :
DNW_STORE e5250 fwbl1 --> for BL1.BIN
DNW_STORE e5250 bl2 --> for BL2.BIN
DNW_STORE e5250 bootloader --> for S-BOOT.BIN
DNW_STORE e5250 tzsw -->for TZSW.IMG

and for EL3_MON¿?

DNW_STORE e5250 ????? --> for EL3_MONITOR.BIN

i've found another "possible" signature from offset 0x3dc10..0x3dd10 in sboot.bin (engineering bootloader 5.02)

[zogu]

DNW_STORE e5250 el3_mon
Thats how is written on Korean forum for writing with fastboot. All other names are same. They are using fastboot, probably just sboot is different, all other files are signed buy samsung and if you compile your own bl1, fwbl2 etc file must sent for signiture.
I think that it should continue without releasing power key after WAIT if el3 mon is good.

[sataccount]

Finally phone accepts "DNW_STORE e5250 bootloader S-BOOT" with file extracted from G920F bootloader..

I've tested these four files and seems signature is ok, because downloader transfers ok, and does not gives any error :

BL1 0..0x1FFF (size 0x2000)
BL2 or EL3 0x2000..0x31FFF (size 0x30000)
EL3 or BL2 0x32000..0x3dfff (size 0xC000)
S-BOOT 0x3E000..10EFFF (size 0xD1000)

in pptx, says that you must keep pressing power key during all process (transfer all four files).

[sataccount]

if i put "DNW_STORE e5250 el3_mon" on second file, program don't send it and says "Write thread Exit" after send firs file (BL1)

[zogu]

It doesn't load sboot in my phone, just hangs. I will try with another sboot.
One more question, after DNW_WAIT, do you press power down and home to continue, or it just continue without touching?
Did you reach odin mode at the end?

[zogu]

Success. Thanks so much sataccount. It worked with bootloader which was in phone. I'm in odin now

[zogu]

At the end here is cfg file which worked for me:

; S Project

; must keep order of binary list

; BL1
DNW_STORE e5250 fwbl1 200 20 novi1.bin
;DNW_WAIT
; BL2
DNW_STORE e5250 el3_mon 2000 20 novi_2.bin

; u-boot
; Wait Re-Enumeration

DNW_WAIT

DNW_STORE e5250 bl2 2000 20 novi_3.bin
;DNW_WAIT
DNW_STORE e5250 bootloader 20000 20 novi4.bin

;DNW_WAIT
;DNW_STORE e5250 tzsw 20000 20 4pt.img

I tired to boot it first with 5.1 engsboot, but protection is still active, we can't downgrade phone with this method. At the end booted with original 6.0 sboot which was in phone before brick.

Thanks once more time sataccount for your work.

[sataccount]

perfect!!
can you tellme finally the offsets that you have used for extract novi1.bin, novi_2.bin...?
And thanks to you zogu too, for your great work!!

[zogu]

Used your offset from post 21.

Novi1.bin 0..0x1FFF (size 0x2000)
Novi_2.bin 0x2000..0x31FFF (size 0x30000)
Novi_3.bin 0x32000..0x3dfff (size 0xC000)
Novi4.bin 0x3E000..10EFFF (size 0xD1000)

[sataccount]

Zogu, Which version of multidownloader are you using?
32 or 64bits?
can you pass the link for download it?
i use sample_application v1.0 32bits (140.800 bytes)
from 2013

[zogu]

32 bit, found on some Persian forum and google translated it.
I hope it is allowed to post a link:
fars-gsm
If it does not work for you, just try with more sboot.bin from different firmwares until you find some which works.
I used same sboot.bin as firmware in phone.

[sataccount]

the problem is that the downloader not accept "el3_mon" as label, can you check your file "WinDNWApi.dat" with an hex editor at "C:\Program Files\Samsung\Exynos USB Driver\Drivers" to check if you have a valid "el3_mon" entry and what is the address?
maybe i have an old version of "disk1.zip" exynos driver and does not support "el3_mon"
my WinDNWApi.dat size is 306 bytes