SM-G920F Boot repair Exynos 7420 device - GSM-Forum

sataccount · 02-28-2017, 12:50

Hi to everyone,
i'm trying to repair a dead S6 SM-G920F with an exynos 7420 processor following the guide foun on service manual of this phone.
I've downloaded the software "multidownloader" and the LSI USB drivers (exynos serial driver), and the software found the serial port and can send DATA correctly.
i think if i cand send the fwbl1, bl1, bl2 and finally s-boot, to the exynos processor, i will be able to send a complete firmware with ODIN.

Can somebody tellme where can i download these files for the exynos 7420 (USB_RECOVERY_SM-G925F or USB_RECOVERY_SM-G920F zip files)?
Thanks in advance.

sataccount · 03-06-2017, 12:10

Hi,
i've extracted BL1, BL2, S-BOOT AND TZSW from (from original G920F firmware)
Here are the ofsets that i've found after two days of research

exynos 5430
bl1 FROM 0 TO 3BFF SIZE 3C00
bl2 FROM 3C00 TO 7BFF SIZE 4000
s-boot FROM 7C00 TO D83FF SIZE D0800
tzsw FROM D8400 TO 1183FF SIZE 40000

exynos 7420
bl1 FROM 0 TO 3BFF SIZE 3C00
bl2 FROM 3C00 TO 7BFF SIZE 4000
s-boot FROM 7C00 TO 10EFFF SIZE 10740
tzsw FROM 10F000 TO 18F10F SIZE 80110

and i can upload BL1 and BL2 to the damaged phone, but when the script try to upload S-BOOT, seems the phone not accept it, i don't know what i'm doing wrong.
The script used is one for Exynos 5430, G850F.

I have varios questions :
1- The BL1, BL2, S-BOOT and TZSW located at SBOOT file from original firmware, are the same that BL1, BL2, S-BOOT and TZSW used by samsung to recover dead boot?
2- The script used for upload the different Boot loader stages, is the same for exynos 5430 and exynos 7420?
3- Is possible that the phone have any part of RAM/eMMC damaged?
4- Anyone have the original Samsung files to recover dead boot from USB, like SM G850F USB RECOVERY, but with exynos 7420 files?

Can Someboy helpme?

Thanks in advance, and congratulations for this great forum.

zogu · 03-10-2017, 14:17

I have same problem with my g925a, bootloader is bricked. Please can you send me a link for multidownloader and drivers, i can't find it anywhere.
From power point document, i think that first 3. files are just for entering some "upper state" (simple bootloader) mod for flashing s-boot, real bootloader.
Maybe someone with access to samsung GSPN HHP can send us files

I need them for G925A.
Thanks

sataccount · 03-11-2017, 22:33

Hi,
here you can find the usb downloader for 32 and 64 bits :
GSM-Forum > GSM & CDMA Phones / Tablets Software & Hardware Area > Samsung > Samsung Flashers, Software, Firmware. > Dead Boot Recovery - SM-N910F SM-N9109W SM-N910A SM-N915D SM-N9108V SM-N9100 SM-G901F > Post #6 (G900H)
now only need the files for upload to the phone and the configuration file.

zogu · 03-13-2017, 13:01

Found one more config file for g850f, it is little different:

for some reason can't cut and paste text..

but it has in config file DNW_WAIT between 2. and 3. image and numbers are 200 20, 2000 20, 20000 20, 20000 20 instead of 10 1000 and 10 5000

Tried with both config files and 3 different bootloader (5_1, 5_1ENG and 6_0), always hangs when it is trying to load sboot img.
Also experimented little and tried to load different sizes first two images (for example 15360 and 32768, all from original sboot) and again it hangs at first "big" image. Maybe i should split files in 100 parts

Parameter in cfg files looks just like timeouts and priority, dont think it is very important. Only this usb wait...
Still hope that someone will send us files

sataccount · 03-13-2017, 14:16

If you put the tzsw (dot) img file as 3rth file instead 4rt, and you put the file from g850f recovery, it loads ok. I think that S-BOOT and TZSW extracted from our sboot (dot) bin from G920F are not correct for this repair method. I've also changed "address" from cfg file, and seems not affect at all...
Continue experimenting...

zogu · 03-13-2017, 15:17

Never succeed to load third file. Also never loaded 2nd file if the first one is not from original (same phone model) sboot.
I think that boot file is ok, this method should be 1:1 write. We should compare g900 and g850 (joined) files with original bootloader. Some stupid thing is missing to complete unbricking.

sataccount · 03-13-2017, 16:06

Have you tried to change the order in .cfg file and put BL1 from G925a, BL2 from G925a, tszw from g850F? My phone load BL1, BL2, then disconnect and reconnet itself and finally load tzsw succesfull but finally "write fail" i don't know if "write fail" is verifying tzsw or last file (s-boot).
one more thing, have yo tried to mantain the keys "voldown"+"home" pressed during the process (to simumlate enter in download mode with original SBOOT.BIN)?

; S Project

; must keep order of binary list

; BL1
DNW_STORE e5250 fwbl1 200 20 signed_E5430.N.bl1_get_dram_size.bin

; BL2
DNW_STORE e5250 bl2 2000 20 signed_bl2.bin

; u-boot
; Wait Re-Enumeration
DNW_WAIT
DNW_STORE e5250 tzsw 20000 20 signed_tz.img

DNW_WAIT
DNW_STORE e5250 bootloader 20000 20 signed_s-boot.bin

zogu · 03-13-2017, 20:40

I will try tomorrow with keys. It does not load anything after wait command. I changed in all my cfg files, e5250 to e7420, actually never tried with e5250. Don't have pc before morning to test with pressing keys. Did you try with engineering sboot?

sataccount · 03-14-2017, 09:04

Hi,
if I put "DNW_STORE e7420" instead "DNW_DSTORE e5250" in .cfg file, then never loads any file, always hangs. I must put "5250" for get it work. I don't know "instruction Set" for USB downloader, i think "WinDNWApi.dll" contains valid DNW commands...
i've "extracted" BL1, BL2, SBOOT and TZSW always from original Stock ROM sboot.bin
i don't have engineering SBOOT, can you tellme how can i download for test?
Thanks

sataccount · 03-14-2017, 10:14

I've downloaded Engineering bootloader 5.0.2 for G920F and i've extracted :
BL1 0..0x1FFF (size 0x2000)
BL2 0x2000..0x31FFF (size 0x30000)
S-BOOT 0x32000..10EFFF (size 0xDD0000)
TSZW 0x10F000..18F10F (size 0x80110)

and fail to load S-BOOT.

but if i put TSZW from G850F on 3rt and 4rth (on .cfg file), it loads successfully the 4 files and end the process ok. (obviously not repair the phone), but it accepts the tszm.img file.
I think the problem is that we cannot extract correctly TZSM, S-BOOT from the bootloader.

which offsets do you use for extract the files?
I've tried various without success.
i think that a valid BL1, BL2, S-BOOT and TZSW end with a 16x16bytes signature.
Someone can help us?
Thanks.

zogu · 03-14-2017, 10:22

I think last signiture in tzsw (TrustZone software) is signiture for complete sboot_bin and it should be deleted.
signiture for sboot extracted using your offset looks similar to sboot from 850, even version can be seen (VERSION B2 in 850, version Z0 in my sboot).
Yes, it loads tz_img from 850. Don't think it is signiture problem, probably some parameter is missing because file are much larger.
I will try to delete last few bytes from tzsw and test it again. But sboot is biggest problem.

anju786787 · 03-14-2017, 10:42

Can use samsung kies 3

zogu · 03-14-2017, 10:46

Does kies works with new devices? Smart switch does not recognize phone in this jtag mod.

sataccount · 03-14-2017, 11:40

Samsung kies 3 says "Connecting", but after one minute disconnects ansays that cannot connect with device.
and last bytes of sboot.bin file seems to be a "global" signature. 0x80000 bytes are best size for tzsw than 0x80110

first we need to get tzsw load succesfully, then we know that the sizes are correct and phone accept it.
i cannot upload succesfully any sboot file (i've tried from g850f, from g900h, and various i've created with diferent sizes)
but i've succefully uploaded tzsw file from another phone (g850f or g900h), it means that the tzsw file that i've created, are not valid ones.

02-28-2017, 12:50	#1 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	SM-G920F Boot repair Exynos 7420 device Hi to everyone, i'm trying to repair a dead S6 SM-G920F with an exynos 7420 processor following the guide foun on service manual of this phone. I've downloaded the software "multidownloader" and the LSI USB drivers (exynos serial driver), and the software found the serial port and can send DATA correctly. i think if i cand send the fwbl1, bl1, bl2 and finally s-boot, to the exynos processor, i will be able to send a complete firmware with ODIN. Can somebody tellme where can i download these files for the exynos 7420 (USB_RECOVERY_SM-G925F or USB_RECOVERY_SM-G920F zip files)? Thanks in advance.

03-13-2017, 13:01	#5 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	Found one more config file for g850f, it is little different: for some reason can't cut and paste text.. but it has in config file DNW_WAIT between 2. and 3. image and numbers are 200 20, 2000 20, 20000 20, 20000 20 instead of 10 1000 and 10 5000 Tried with both config files and 3 different bootloader (5_1, 5_1ENG and 6_0), always hangs when it is trying to load sboot img. Also experimented little and tried to load different sizes first two images (for example 15360 and 32768, all from original sboot) and again it hangs at first "big" image. Maybe i should split files in 100 parts Parameter in cfg files looks just like timeouts and priority, dont think it is very important. Only this usb wait... Still hope that someone will send us files Last edited by zogu; 03-13-2017 at 13:07.

03-14-2017, 10:42	#13 (permalink)
anju786787 Junior Member Join Date: Mar 2009 Location: qatar Posts: 4 Member: 997410 Status: Offline Sonork: cooling Thanks Meter: 1	Booting Can use samsung kies 3

03-14-2017, 11:40	#15 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	Samsung kies 3 says "Connecting", but after one minute disconnects ansays that cannot connect with device. and last bytes of sboot.bin file seems to be a "global" signature. 0x80000 bytes are best size for tzsw than 0x80110 first we need to get tzsw load succesfully, then we know that the sizes are correct and phone accept it. i cannot upload succesfully any sboot file (i've tried from g850f, from g900h, and various i've created with diferent sizes) but i've succefully uploaded tzsw file from another phone (g850f or g900h), it means that the tzsw file that i've created, are not valid ones. Last edited by sataccount; 03-14-2017 at 11:47.

03-06-2017, 12:10	#2 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	Hi, i've extracted BL1, BL2, S-BOOT AND TZSW from (from original G920F firmware) Here are the ofsets that i've found after two days of research exynos 5430 bl1 FROM 0 TO 3BFF SIZE 3C00 bl2 FROM 3C00 TO 7BFF SIZE 4000 s-boot FROM 7C00 TO D83FF SIZE D0800 tzsw FROM D8400 TO 1183FF SIZE 40000 exynos 7420 bl1 FROM 0 TO 3BFF SIZE 3C00 bl2 FROM 3C00 TO 7BFF SIZE 4000 s-boot FROM 7C00 TO 10EFFF SIZE 10740 tzsw FROM 10F000 TO 18F10F SIZE 80110 and i can upload BL1 and BL2 to the damaged phone, but when the script try to upload S-BOOT, seems the phone not accept it, i don't know what i'm doing wrong. The script used is one for Exynos 5430, G850F. I have varios questions : 1- The BL1, BL2, S-BOOT and TZSW located at SBOOT file from original firmware, are the same that BL1, BL2, S-BOOT and TZSW used by samsung to recover dead boot? 2- The script used for upload the different Boot loader stages, is the same for exynos 5430 and exynos 7420? 3- Is possible that the phone have any part of RAM/eMMC damaged? 4- Anyone have the original Samsung files to recover dead boot from USB, like SM G850F USB RECOVERY, but with exynos 7420 files? Can Someboy helpme? Thanks in advance, and congratulations for this great forum.

03-10-2017, 14:17	#3 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	I have same problem with my g925a, bootloader is bricked. Please can you send me a link for multidownloader and drivers, i can't find it anywhere. From power point document, i think that first 3. files are just for entering some "upper state" (simple bootloader) mod for flashing s-boot, real bootloader. Maybe someone with access to samsung GSPN HHP can send us files I need them for G925A. Thanks

03-11-2017, 22:33	#4 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	Hi, here you can find the usb downloader for 32 and 64 bits : GSM-Forum > GSM & CDMA Phones / Tablets Software & Hardware Area > Samsung > Samsung Flashers, Software, Firmware. > Dead Boot Recovery - SM-N910F SM-N9109W SM-N910A SM-N915D SM-N9108V SM-N9100 SM-G901F > Post #6 (G900H) now only need the files for upload to the phone and the configuration file.

03-13-2017, 14:16	#6 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	If you put the tzsw (dot) img file as 3rth file instead 4rt, and you put the file from g850f recovery, it loads ok. I think that S-BOOT and TZSW extracted from our sboot (dot) bin from G920F are not correct for this repair method. I've also changed "address" from cfg file, and seems not affect at all... Continue experimenting...

03-13-2017, 15:17	#7 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	Never succeed to load third file. Also never loaded 2nd file if the first one is not from original (same phone model) sboot. I think that boot file is ok, this method should be 1:1 write. We should compare g900 and g850 (joined) files with original bootloader. Some stupid thing is missing to complete unbricking.

03-13-2017, 16:06	#8 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	Have you tried to change the order in .cfg file and put BL1 from G925a, BL2 from G925a, tszw from g850F? My phone load BL1, BL2, then disconnect and reconnet itself and finally load tzsw succesfull but finally "write fail" i don't know if "write fail" is verifying tzsw or last file (s-boot). one more thing, have yo tried to mantain the keys "voldown"+"home" pressed during the process (to simumlate enter in download mode with original SBOOT.BIN)? ; S Project ; must keep order of binary list ; BL1 DNW_STORE e5250 fwbl1 200 20 signed_E5430.N.bl1_get_dram_size.bin ; BL2 DNW_STORE e5250 bl2 2000 20 signed_bl2.bin ; u-boot ; Wait Re-Enumeration DNW_WAIT DNW_STORE e5250 tzsw 20000 20 signed_tz.img DNW_WAIT DNW_STORE e5250 bootloader 20000 20 signed_s-boot.bin

03-13-2017, 20:40	#9 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	I will try tomorrow with keys. It does not load anything after wait command. I changed in all my cfg files, e5250 to e7420, actually never tried with e5250. Don't have pc before morning to test with pressing keys. Did you try with engineering sboot?

03-14-2017, 09:04	#10 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	Hi, if I put "DNW_STORE e7420" instead "DNW_DSTORE e5250" in .cfg file, then never loads any file, always hangs. I must put "5250" for get it work. I don't know "instruction Set" for USB downloader, i think "WinDNWApi.dll" contains valid DNW commands... i've "extracted" BL1, BL2, SBOOT and TZSW always from original Stock ROM sboot.bin i don't have engineering SBOOT, can you tellme how can i download for test? Thanks

03-14-2017, 10:14	#11 (permalink)
sataccount Junior Member Join Date: Jan 2005 Age: 53 Posts: 28 Member: 106301 Status: Offline Thanks Meter: 10	I've downloaded Engineering bootloader 5.0.2 for G920F and i've extracted : BL1 0..0x1FFF (size 0x2000) BL2 0x2000..0x31FFF (size 0x30000) S-BOOT 0x32000..10EFFF (size 0xDD0000) TSZW 0x10F000..18F10F (size 0x80110) and fail to load S-BOOT. but if i put TSZW from G850F on 3rt and 4rth (on .cfg file), it loads successfully the 4 files and end the process ok. (obviously not repair the phone), but it accepts the tszm.img file. I think the problem is that we cannot extract correctly TZSM, S-BOOT from the bootloader. which offsets do you use for extract the files? I've tried various without success. i think that a valid BL1, BL2, S-BOOT and TZSW end with a 16x16bytes signature. Someone can help us? Thanks.

03-14-2017, 10:22	#12 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	I think last signiture in tzsw (TrustZone software) is signiture for complete sboot_bin and it should be deleted. signiture for sboot extracted using your offset looks similar to sboot from 850, even version can be seen (VERSION B2 in 850, version Z0 in my sboot). Yes, it loads tz_img from 850. Don't think it is signiture problem, probably some parameter is missing because file are much larger. I will try to delete last few bytes from tzsw and test it again. But sboot is biggest problem.

03-14-2017, 10:46	#14 (permalink)
zogu Junior Member Join Date: Aug 2006 Posts: 22 Member: 339239 Status: Offline Thanks Meter: 5	Does kies works with new devices? Smart switch does not recognize phone in this jtag mod.