RIFF BOX JTAG New Update AE Post ở đây

[namnhatrang]

RIFF JTAG Manager v1.74, RIFF Box Firmware v1.48 Turbo Mode for RIFF Box v1

Hello dear RIFF Box users !

We're proud to announce newest updates for RIFF Box v1 and RIFF BOX v2:

RIFF Box Firmware v1.48
---------------------------
- New SD/MMC Interface is added for RIFF1: the CPLD is used for data shifting at max 8MHz rate.
As the eMMC signals the TDI, TMS, RTCX, and TDO signals on JTAG Connector are used. Read/Write speeds at 8MHz are aprroximately 800KB/sec - read, 365KB/s - write.
Since the new SD/MMC Interface shares the JTAG port connector, in the JTAG Manager in the SD/MMC Interface list, it is named as 'JTAG';
- The eMMC Read/Write speeds for GPIO (RJ-45) SD/MMC Interface are increased: 260KB/s - read, 360 KB/s - write (compare with Firmware 1.47: ~198 KB/s - read, 190 KB/s - write)
- The eMMC Read speeds for RIFF2 (30PN) SD/MMC Interface are increased: at SD/MMC Clock Speed = 34MHz: ~9.50MB/s - read (compare with Firmware 1.47: ~7.80 MB/s - read)
- The eMMC Write speeds for RIFF2 (30PN) SD/MMC Interface are increased more than 20x(!!!) times: at SD/MMC Clock Speed = 34MHz: 6.40MB/s - write (compare with Firmware 1.47: ~390 KB/s - write)


RIFF JTAG Manager v1.74
---------------------------
- ExtCSD Register's fields 177, 179 and 162 (BOOT_BUS_CONDITIONS, PARTITION_CONFIG, and RST_n_FUNCTION) are now displayed in eMMC connection info ("Check eMMC/SD Card" button or eMMC Advanced Actions Dialog's "Read Info from eMMC")
- Added selection of SD/MMC H/W Interface: currently are available:
> 1. RIFF1 SD/MMC Interface @RJ45 Connector
> 2. RIFF1 SD/MMC Interface @JTAG Connector
> 3. RIFF2 SD/MMC Interface @30-Pin Connector
- Added real-time RIFFBOX status (in StatusBar): the BOX revision (RIFFBOX1/RIFFBOX2) and Firmware version
- Improved switching on-the-fly of the JTAG Manager's specific to RIFFBOX revision parameters, immediately when the new box is connected to PC while JTAG Manager is running.
- Schematics picture is updated (RIFF JTAG Pinout button on the Resurrection page). Schematics picture is now displayed depending on the box revision - RIFFBOX1 or RIFFBOX2.
- Fixed buffer overrun bug in RIFF2 firmware, which caused getting chaotically corrupted data during the eMMC Read operations
- Added one-time Start Trial Period feature for RIFF v1 users


RIFF Remote Helper v1.10
----------------------------
- Added support for RIFF v2 hardware
- Added support for new drivers
- Remote Helper is now included with setup package by default.


You can download new files from RIFF Box home page:

RIFF Box – Best JTAG Box in this Galaxy Easy to operate ! | Rocker Team Flashing Interface


- RIFF Box v1 SD/eMMC interface via JTAG port (CPLD):

In order to maximize read/write speed on v1 hardware, we decided to update CPLD firmware and use 20 pin port to connect SD/eMMC to RIFF Box.
Please note that RJ45 port remains functional, too.


- One Time Trial for v1 users:
For those users with expired accounts, who want to test new features for free, we added optional function. Upon connecting to RIFF Box license server, You'll be prompted to activate Trial Period (15 days) which will enable Your box with all current updates and functions.

- Support activations are permanent from now.
All users who activate their account will get "Forever" status (Including those who activated support in last 3 months). This means that there will be no more account expiration.

[namnhatrang]

RIFF Box eMMC Plugin - File System explorer for MTK added


Please download latest version of our great tool - eMMC Plugin v4.08.

Whats new:

• Added full support for MTK internal partition descriptor
• Added support for MTK MBR/EBR
• Added file system explorer support for MTK models
• Added manual selection of parsing method - now its possible to force parsing GPT/MBR in Samsung flash dumps (useful in cases with preloader in boot partition 1)
• Added manual selection to force MTK MBR/EBR parsing instead of MTK Internal partition layout parsing.

Lets review most important functions present now:


File systems and partitions:

• File system explorer which supports EXT2/EXT3/EXT4 and FAT32
• Exporting detected partitions in raw binary format
• Exporting detected partitions as logical drive
• Exporting single files from file system in selected partition

Boot loaders, EFS, NVRAM or any other important partitions manipulation:

• Load Full flash dump and export partitions to separate files
• Load full flash dump and write GPT or any other partition to another eMMC chip
• Load GPT and inject binary files into designated partitions (for example load boot loader files from firmware)
• Read single partition raw binary
• Write single partition raw binary
• Build custom flash dump files
• Read Product Info partition from HTC models and modify CID/IMEI/Simlock status.
• ...

Useful tips:

• If flash dump with corrupted partition is loaded, "Out of Memory" message may appear after some time. This can be caused by corrupted directory structure where parser enters into loop. In such case, kill the application via task manager, save such partition as binary file and write it to usb flash disk as "disk image". File system repair can be attempted and data salvaged using Windows or Linux tools.
• MTK files with MBR styled layout need a bit longer time to be parsed and in case plugin appears to be frozen just give it some time

Please check attached screens. That is full flash dump from MTK based "i9500 clone"

[namnhatrang]

RIFF Box v1/v2 updates, 15.05.2018:


RIFF Box JTAG Manager v1.78
---------------------------
- (SDK): more functions are now available (exported) for future Resurrector DLLs;
- PKG Editor: added button 'Visual Conditional Writes' - which helps sorting write actions into specified groups of conditions
Those who have experience in PKG creation will understand the purpose.
- Fixed SD/MMC voltage list for RIFFBOX1
- Fixed correct partition name logging when reading/writting via Direct EMMC interface




RIFF Box v1 users now have option to fine tune VCCIO (VCCQ) voltage in order to achieve best stability.
VCCIO can be increased/decreased in 0.05v steps. We recommend this procedure if nominal 1.8v VCCIO doesn't work properly.


eMMC Partition Table FullFlash Image Files Processing Plugin (eMMCDiskPartitions.dll) v4.09

-------------------------------------
- "Load Firmware Files" button is added. This feature will allow to load official firmware files directly into recognized partitions.
At the release moment only MTK Scatter Files are supported.
- Added MTK Scatter Files support. Please note, to load a Scatter File, first is required for plugin to Load a valid Dump (Load Layout from File or read Layout from Device (Load Layout from Device).
After partitions layout is recognized by plugin, a Scatter File can be loaded: files of partitions listed in scatter file will be automatically injected into current Layout.




- Plugin now supports OTHERS THAN the User Area partition!!!



For example, if after parsing, plugin detects extra used partitions (e.g. boot partition1 in some Samsung phones, boot partition1,2&RPMB in some phones with MTK MCU-based layout)
then these partitions are displayed in the partitions list too. User can work with these partitions as usual - read/write, inject data from file, storing to disk, etc - plugin
will automatically manage data redirection to proper hardware locations of the eMMC chip.
- Added column "LOCATION ON CHIP" - displays hardware location of the current partition inside the eMMC Chip (Boot parition1,2, User Area, etc.)
- Keyboard shortcuts are added for Read Partitions button (F6) and Flash partition button (F7)
- Context menu is expanded with same new minor features (right-click on any partition in the partitions list window)
- 'PRESENT' column is added to the partitions list. This shows info about each partiton - whether partition is available in dump file or dump ends prematurely
(100% - means partition is completely present in dump file, 0% - partition is not present in dump file, between 0 and 100 - partition is partially available, but a definite part of it is not available due to premature end of dump file)
- 'SIZE' column is added to the partitions list. This shows human-understandable size in KBs/MBs/GBs/TBs
- HEX window now supports 'NOT_AVAILABLE' data displaying: the '**' is displayed instead of HEX data for areas when data is not available
(for example this is true when local dump file size is less than current partition address, so the plugin cannot obtain data for such case)
(for example this is true when plugin failed to read data on-the-fly due to read errors)
- Progress bar in HEX window is fixed for chunks of data of size up to ~32GB, but still is not full 64-bit wide, thus weird behaviour is expected for partition sizes more than ~32GB (more than 0x7FFFFFFF0 bytes = 31,9999GB)
- Due to obsolete meaning, removed ACTIVE and SELECTED columns in the parsed partitions list.
- Added new column 'RELATIVE PARTITION' to the parsed partitions list. Plugin now supports relative partitions, base of which depends on connected physical eMMC chip.
Thus the real address is calculated by plugin on-the-fly, during read/write operations.
For relative partitions, 'RELATIVE PARTITION' column shows relative offset from the end of the chip area where partition must be located. In this case the 'STARTING OFFSET' column shows
absolute address calculated at the moment of parsing (that is if partitions were parsed from dump file, the starting offset is calculated using dump's file size; if partitions were parsed from connected emmc device,
then starting offset is calculated using current emmc chip's user area size). This address will be recalculated every time any read/write on this partition is performed.
P.S. Real life relative partitions can be found in MTK-based devices (BMPOOL partition), Samsung phones (SGPT partition)
- added keyboard control to the partitions list window. One can navigate through partitions with keyboard keys,
select/deselect single entry with ENTER key, use INSERT key to select an entry and automatically move cursor down.
In case the plugin is invoked by the JTAG Manager (PKG Editor, MassStorage selector, etc.) the ESC key serves the function of buttons "Back to MassStorage" and "Back to PKG Editor"
- The order of focused controls when TAB key is pressed is sorted correctly.
- Option "When parsing is possible from GPT and PIT, force discarding PIT so GPT data is used" is transfered to CheckBox for better convenience. It is named "PIT Dumps -> Force EFI Layout"
- Option "When parsing is possible from MBR and MTK Tables, force discarding MTK layout, so data from MBR/EBR is used" is transfered to CheckBox for better convenience. It is named "MTK Dumps -< Force MBR Layout"
- Double progress is implemented - to display read/write progress of current partition and total read/write progress of selected group of partitions
- Color of selected text in partitions list window is adjusted
- For MBR/EBR parsing added feature to resize last partition into reasonable size: sometimes last partition is reported having maximum possible size (~2TB).
If layout is read from device then last partition is resized to fit into the current memory chip.
If layout is read from a local dump file then the last partition is resized to fit into the 58.25GB memory chip.
- after parsing supported file system into Embedded F/S Explorer, loss of foreground position of the main plugin window bug is fixed
- 'Check for Blank' operation is made more informative: each partiton checking progress is drawn. Blank partitions are grayed out in the partitions list, so blank partitions are visible instantly.
Checking for blank is improved - partitions which have "NOT_AVAILABLE" data status are considered to be blank and time is not lost doing unnecessary checks (especially big sized partitions)



LG Models boot repair, ISP pinout, Read/Write eMMC:

• LG D335
• LG E440
• LG E445
• LG E450
• LG K220DS
• LG K410
• LG K430

Samsung Models boot repair, ISP pinout, Read/Write eMMC:

• Samsung A500fU
• Samsung G800F
• Samsung G900H

XiaoMi Models boot repair, ISP pinout, Read/Write eMMC:

• Xiaomi Mi 5X (MDT2)
• Xiaomi Redmi Note 5A Prime (MDG6S)

To download and install updates, click "Check for Updates" button on "Box Service" tab.
You can also register an account at Turbo-Support download server:


Index of ../../RIFF/RIFF_ROOT/




RIFF Box v1 (Black box) users who havent used 15 days trial can activate it after installing JTAG Manager v1.76 and downloading new data.
In case that trial period is used but fw version is still 1.48 or older, please request trial reset in "Account recovery" section.
Box S/N and "Trial reset" required

[namnhatrang]

RIFF Box v1/v2 updates - MTK, SPD, Samsung fw files



RIFF Box eMMC Plugin 4.11 - Samsung TAR/MD5/PIT , MTK Scatter and Spreadtrum PAC


RIFF Box updates, 26.06.2018 24 new models supported.



RIFF Box JTAG Manager v1.80, RIFF Box firmware v1.50 released





How to get license for RIFF Box v1 JTAG functions for free

[namnhatrang]

RIFF Box Qualcomm Sahara support, tips and tricks

Hello dear users !


We took some time to prepare latest addition to JTAG Manager and built from scratch complete Sahara protocol support (both firehose and streaming download). We didn't just embedded freely available tools from Qualcomm (emmcdl and qh_loader), instead, we used own code.


Great work is done on eMMC Plugin too, which now supports USB, ISP and JTAG access. You can select partition on LU (Logical Unit) to parse.
Among other improvements, we added GPT repair/adjust which serves as analogue to patch0.xml used with QFIL.
"Adjust GPT" will automatically update checksums and resize userdata partition to fill whole chip. This is valuable in cases where gpt is from different chip size.


There is more work, but we feel confident that current functions can satisfy most of the needs in servicing and forensics fields.


So, for start, few important tips:


1. Make sure to have Qualcomm drivers installed
2. Most Snapdragon 200 firehose loaders don't have read support, also some will not output storage info (size, SN, brand). We found out that there is one universal firehose looader which supports all this, but uses a bit different protocol. As this is Alcatel loader, we named it "Alcatel Firehose".
It can be used with MSM8x10, MSM8x12, MSM8x26 which otherwise don't have read support. File is attached here.


3. Sahara protocol requires phone to be in EDL mode. To enter EDL mode, exist few methods:
1. Kill phone BootChain or GPT [IMG]http://www.****************/images/smilies/biggrin.gif[/IMG]
2. Switch to EDL from ADB or from TWRP: (TWRP tested on some Samsung models)

"Adb reboot EDL"
3. Use EDL cable (Xiaomi phones for example)
4. Activate Diag mode and JTAG Manager will switch it to EDL automatically if phone supports it.
5. Hold Vol+ for 10 seconds (OnePLus models)

6. Short EDL TP-s if exist
7. Short CMD to GND
9. Most reliable method is to remove eMMC [IMG]http://www.****************/images/smilies/biggrin.gif[/IMG]




I'll add some videos to this post later, for now please test functionality and ask for clarification if there is anything unclear.