new brick on the block :-(

[vasile-gh]

@ottokiksmaler, I think I messed up. I did that:

mkswap -c /dev/mmcblk0p9
echo disk > /sys/power/state

pulled battery

When I put the battery back in the led turns on, screen backlight comes on and that is it.

Ideas?

power off button does nothing: turns on camera but does not turn it off.

[ottokiksmaler]

Ouch. Mkswap just clears the partition, swapon activates it. You just invalidated swap partition and did not actually activate a new one. FWIW I did echo disk (and mem) to state and mem did nothing while disk put it to sleep. IIRC.
I think it reverted back to restore mode but I guess you would need a suitable usb cable (should be able to find one in some store?) and tizen sdk (actually sdb tool from it) and try that.

[vasile-gh]

%$&^%#@$!^%#$!&^#%!

[vasile-gh]

but it should detect the partition is empty and boot normally
I can't believe they would not detect an invalid hibernation image. Especially since they have a signature

[ottokiksmaler]

You did not mess up main filesystem so there is chance it can be recovered. I'll take a look tonight at what happens and whether it's possible to blindly do firmware update. You could put nx500.bin in the card and boot?

[vasile-gh]

good idea, doing now.

[ottokiksmaler]

In the worst case take it to service and say you mistakenly popped out the battery during firmware update. And hope for the best :)

[vasile-gh]

yeah. And lose at least two weeks waiting for it to be fixed. ^%#&^%@!#&^!%*&!@%#&!^@%#

[ottokiksmaler]

Also, be patient - let it idle for 3 minutes in any test

[vasile-gh]

how long did it take first time in recovery?

[ottokiksmaler]

Well, you can always also brick your other camera without waiting :D sorry

[ottokiksmaler]

A minute or so

[ottokiksmaler]

But firmware update might take longer

[ottokiksmaler]

I works have to see what gets started in restore mode and whether it checks for any file on SD card. Might need something like adj file to start update

[vasile-gh]

the adj files are read by di-camera-app :-(, and it is not up.

[vasile-gh]

nope. nothing doing

[vasile-gh]

^%!@^#%!&@^%#*&!

[vasile-gh]

ok let us judge coolly. I did not touch bootloader nor the uboot partition. So there should be some sort of kernel loaded - I think. In the kernel command line there is a rootwait keyword - any idea what it does and if there's some sort of timeout?

[vasile-gh]

can you check what is the kernel command line?

[vasile-gh]

ok the lens cover was on - when I took it off, I can see the image.
But no di-camera-app UI

[ottokiksmaler]

T-kernel is running you are probably in restore mode. I can check it out after 22h. I'll ping you if it's OK

[vasile-gh]

yep, thx. But I won't be able to stay up too long tonight - tomorrow I have a long road ahead tomorrow and leaving early. Will be back Sunday.

[ottokiksmaler]

Ok, I'll take a look and document it here, if I find anything interesting. I'll also take a look at boot loader.

[vasile-gh]

I dumped the bootloader strings:, here is an extract:

DRIMe5 bootloader   
CA9 clock    : 600Mhz
usage: boot [mode] 
              0 : cold boot 
              1 : snapshot boot 
              2 : warm boot 
help
Invalid snapshot image. 
Supported bult-in commands:
---------------------------------------
bootloader> 
boot
info
exit

but I need a special UART through micro-USB cable to get at it...

[ottokiksmaler]

Like this one? http://forum.xda-developers.com/showthread.php?t=1901376
There's a ready made cable http://www.gabotronics.com/accesories-and-cables/usb-to-uart-cable.htm
There's a bunch of devices made from cp2102 uC === gabotronics say the cable supplies 5V to target. Not good

[vasile-gh]

The ready-made is not good. yes, something like the one in the xda. Looks like I need to acquire some stuff.
But I cannot during the week, and tomorrow I am not in, so will have to wait until next Sat.

[vasile-gh]

Not sending in the camera yet. Going to try to build a USB - UART cable to see if I can get to the boot console. I am ordering the parts I need online, hope to get them this week. If this works I won't need to send it in.

[ge0rg]

Just out of curiosity: which special UART cable have you tried? I've made some attempts to get at the bootloader with a micro-USB-resistor serial cable here: ge0rg/samsung-nx-hacks#7

I performed a "reboot" on the NX500 with 150K and 620K resistors, and got no response :(

[vasile-gh]

None - yet. I presume you looked at this.
For my part I just ordered today this and some resistors.
Your attempt, was it done with a 3.3V UART cable or with a 5V one? You should do it with 3.3V.
Also, I am ordering the 121K, 150K, 255K, 301K, 523K and 619K (values picked from the chip datasheet).
Also, did you use the right baud rate/stop bits/parity settings (do not know them by heart) and did you try to send an enter straight away upon connection?
Did you see any output - even if you could not stop it, with the right baud rates you should see console output.

[ge0rg]

I've got a 3.3V UART cable attached to a Micro-USB port with selectable 150K/620K for some earlier smartphone bootloader work. Now I've tried rebooting again with both resistor values, listening on the line at 115k2 and 9k6 and pressing Enter various times.

Also tried to interact with the NX500 UART ports /dev/ttyAMA0 and AMA1 (115k2 and 9k6 respectively, according to stty -F dev). There is zero communication going on, and not even the typical mismatch-baudrate garbage seen on bootup.

[vasile-gh]

1. are you sure the resistor is between GND and ID pins:
2. IMO plugging the cable with 620K would boot the camera, assuming the power is in.
3. also try with putting the battery in - in fact, when the "charging" symbol or light shows, the bootloader has already run, and the camera is actually booted in a special mode (charging mode).

I would basically pull the battery, plug the cable, ensure 115K is set on cutecom / minicom and then put in the battery.

[ge0rg]

1. Pretty sure, yes. It yields different results on my old Galaxy Nexus phone, depending on the resistor value, and it works as UART there, not as USB.
2. Sorry, plugging in/out the USB adapter doesn't yield any results on the camera.
3. Tried pulling the battery as well; no reaction over the UART with 9k6 or 115k2 when plugging it back in. I can not get into the charging mode with this adapter as it does not power the camera (only RX/TX/ID).

[ottokiksmaler]

I tried with factory made usb-otg just to test - the camera acts as if was plugged into PC and unmounts the SD card. Same thing regardless of power state and battery.

[vasile-gh]

well, I just changed my order to mouser: now I ordered the 80.6K, 102K, 121K, 150K, 255K, 301K, 523K, 619K. One of them just has to work. (look here to see what they trigger on the chip).

[vasile-gh]

BTW you need to connect 4 pins on the usb side: DM, DP, ID and GND. The resistor should be between ID and GND.
But I guess your cable already does something like that because it works with the Nexus.
So it's probably only a matter of resistor value.
So I ordered all that have an impact on the UART part of the chip.

[vasile-gh]

Another thing to test is to make the cable provide Vcc as well from a charger.
Luckily I also ordered a breadboard and accessories, so I will be able to experiment.

[ottokiksmaler]

If this works out it could be more important than all the other hacks.

[vasile-gh]

FedEx will hold the package for me to pick it up this Friday. Looks like I have a busy weekend ahead.

[vasile-gh]

got the package. This weekend I will do hardware hacking - for a change.

[vasile-gh]

Total failure. Wasted weekend. :-(
The NX500 does not send anything through the USB port configured as UART.
I will ask for a RMA.

[ottokiksmaler]

It was a long shot. Did you try it with working nx500 in factory mode?

[vasile-gh]

no - I just worked on the brick. Working on a working NX500 is pointless since I wanted the method to work on the bricked one. :-(
I also tried to dump bootloader strings - it references S1 and S2 - tried to power up with shutter pressed/half pressed and nothing, no change.

I give up - for now. I will send in the camera.

What was the method to update the hibernation image again?
Also: do you know how are the edje files used by the apps? is we recompile edje files, will they be used by the app as long as the hooks remain the same?

[ottokiksmaler]

To update hibernation (https://github.com/ottokiksmaler/nx500_nx1_modding/blob/master/doc/Update_hibernation_image.md)
systemctl rescue
Wait a while
Restart the system (pop out the battery)

Regarding edje files, there is a decompiler in standard development package but main file for di-camera-app on nx500 contains a file (nx500 config or similar) that resides above the current directory so the decompiler gives up. You need to either recompile it or binary edit checks for .. in it (IIRC there are two). But this made me wary of recompiling since they did produce invalid file in the first place.

Also, there are copyright notices that the files are proprietary so I stayed clear.

[vasile-gh]

I patched edje_decc (could not recompile) and the missing file is now decompiling. It is actually just selecting camera model:

 * Automatically generated header file: don't edit
 */

#ifndef AUTOCONF_INCLUDED
#define AUTOCONF_INCLUDED


#undef CONFIG_PROJECT_NX30
#undef CONFIG_PROJECT_NX300
#undef CONFIG_PROJECT_NX2000
#undef CONFIG_PROJECT_NX1
#define CONFIG_PROJECT_NX500 1
#undef CONFIG_SAMPLE_PRODUCT
#undef CONFIG_NX2000_GUI_TEST
#undef CONFIG_NX2000_LCD_TEST
#define CONFIG_GRID_GUI 1

#endif  /* AUTOCONF_INCLUDED */

[vasile-gh]

in the other files there is only one copyright notice, BSD-style.

So no restrictions.

nx500_edje.zip

you can see for yourself. NB I also included the patched decompiler

[ottokiksmaler]

Yes, that's the one.

[vasile-gh]

so, any chance to add menu entries? - assuming we force hibernation update.

[ottokiksmaler]

I don't know, didn't try it. But edje files don't do much on the own. They do contain quite a lot of lua scripts but in the end they just invoke hooks from main cpp file. That is good as it can enable a way to trigger safely (relatively) the di-camera-app operations, but I'm not sure how one world go about adding new entries to menu (after seeing /dev/log_main it's quite possible that menu levels and structures are hard coded in di-camera-app but I didn't have time to check - it would mean that the same thing happens on menu 2 submenu 3 option 4 regardless of what's in edje files).

[ottokiksmaler]

Also, AFAIK we don't need hibernation update to test - just rescue mode and restart.

[vasile-gh]

@ottokiksmaler What would be nice would be to develop a generic hook into the camera menu, that opens additional submenus.
I should be able to inject a .so that would contain the hooks in the di-camera-app address space, and I know where the menu elements are created so I could probably (again) replace some of the debug code with calls to create additional menu entries (or at least one "mod root" menu entry that would spawn the "mod" menus.
This would allow us to basically "extend" the camera menu in an elegant way with all mods integrated in the camera app with no need for additional executables.

What do you think? Would this be feasible?

[ottokiksmaler]

I don't know, didn't get into it that much, never meant to modify internal menus. And next 10 days or so are hellish for me on work (we have a hard deadline) so I have next to no time for anything :(
But, I would first wait for burner cam to return as I wouldn't want to brick my operational camera :) and then check on live filesystem with rescue mode without updating swap.
But, then again, any menu you want to add would have to be sub-menu somewhere and as such buried quite deep (not on first page, probably at the end) - not very user friendly if one wants to operate quickly.
Edit - also IIRC edje files are independent of exe files and can live on their own.

[vasile-gh]

Camera will be given to the retailer for repair either tonight or tomorrow. In the meantime I am back on my own cam (which will be sent afterwards for the power button fix).