Android OS Forum banner
1 - 1 of 1 Posts

34 Posts
[adiv=ipsBox clear][adiv=ipsBox_container ipsPad][adiv=ipsLayout ipsLayout_withright ipsLayout_bigright clearfix][adiv=ipsLayout_content][adiv=ipsLayout_right][adiv=ipsPad ipsSideBlock]File Name: [Hardware Mod] UnBrickable Captivate
File Submitter: AdamOutler
File Submitted: 02 Nov 2011
File Updated: Today, 08:33 PM
File Category: Hardware
[aurl=/files/download/41-/]Download[/aurl][aurl=]Changelog[/aurl][aurl=/index.php?app=downloads&module=post&section=submit&do=edit_main&id=41]Edit Mod[/aurl][/adiv][/adiv][adiv=ipsLayout_content]Background
First off, big thanks to TheBeano and Midas5 for teaching me about UART, decompiling bootloaders and figuring out how the OM values work. Their initial work and dedication in Lets Save Some Bricks inspired me greatly. Since the work started we've analyzed UART outputs, hacked the heck out of the SBL prompt, obtained both decompiled and source for bootloaders.
I'm not kidding when I say UnBrickable. Modifying the OM pins means you can boot from USB, UART or MMC. This makes the phone quite UNBRICKABLE. There is nothing you can do software wise to prevent the device from booting into this mode. We are communicating with the unrewritable, efused IROM on the processor. It's the thing that makes the system on a chip into a "system on a chip".I am here now to tell you how to turn your Samsung Captivate into a KIT-S5PC110 development board. The KIT-S5PC110 development board is the platform used to develop our phones. There are some differences between this mod and the official development platform. The S5PC110 has a removable internal SDCard and no touchscreen.
Why would you want to do this? When you plug in the battery and connect it to the computer in "off" mode, it will become an S5PC110 board awaiting download of a program to run. This occurs long before anything like software or firmware enters the processor. This is the IROM of the device awaiting commands or a power on signal. Because it is accepting a memory flash, anything may be put onto the device to perform a boot sequence..... Apple iOS (iPhone4 has the same processor) WP7 (mango supports this processor).

This is a much better alternative to JTAG. How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like a captivate. See the Special Instructions section.
Hardware Modification
You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(my username or Connexion2005(aka Note: I do not work for/with
2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (for the wire contained within)
getting started:
You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 12cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.
Take the 12cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.
performing the modification:
1. tear apart your phone... remove 6 #0 phillips screws from the back. Two of them are under the battery slide flap. The slide flap must be up on one end and down on the other in order to get to these screws... Don't LIFT the slide flap, just rotate it at an angle. Once the 6 screws are out, then you can separate the back from the front. Make sure to take out your SIM and external SDCard before you do this.

2. remove the mainboard... there's a single screw and 5 connectors which require removal. Remove them. Pull the board out and place it on your workspace

3. remove the EM shield from the processor side.

4. remove the OM5 resistor in the picture below. It's coated in glue. I've found the best thing is to just coat the area in flux and let it do the work while prodding with the iron to move the resistor out of place.

5. Connect the active side of xOM0 resistor to the active pad on OM5's resistor pads.

6. reassemble the phone.

Special Instructions
  • This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds.
  • To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
  • 3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.
Software based UnBricking


1. Apply UnBrickable Mod to your device: See above
2. Run UnBrickable Resurrector: This will only work on linux currently. Install Linux or dual boot if you have windows.
3. Run Heimdall One-Click: http://forum.xda-dev...d.php?t=1238093 (or odin3 one-click),
4. repeat steps 2 and 3 with bootloader flashing enabled (Heimdall One-Click has a safety mechanism which requires you to flash once before flashing bootloaders).

You've unbricked the unbrickable captivate... This should not have been difficult. If it was, you should learn teh computer better... Really. And with that said, I'm happy to announce that you no longer have to flash with a fear of bricking.
The HIBL is the key to resurrecting a S5PC110 based processor. I'm going to let Rebellos explain the inner workings of the Hummingbird Interceptor Bootloader. It's really quite amazing. While my work is more hardware and high level tasks like making things into one-clicks, Rebellos' work involves reverse software engineering, assembly language, and more...
Windows32 command line app and drivers http://forum.xda-dev...=1&d=1315091523
Linux one-click Resurrector:
4SEP11: added 32 bit, miscellanious impovements to visuals
6SEP11: removed additional commands
reading material
Creating your own Samsung Bootloaders: http://forum.xda-dev...d.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire...94krzvvxksvmuxh
how to use DNW:
Flash using openOCD and DNW: http://www.arm9board...OpenOCD_and_DNW
another DNW example: http://www.boardset....ucts/mv6410.php
ODroid dev center:

drivers and utilities
This will be an ever expanding list
Windows Drivers http://forum.xda-dev...37&d=1312590673
Windows Download Tool DNW: http://forum.xda-dev...38&d=1312590673
Windows Command Line tool: http://forum.xda-dev...23&postcount=27
Linux DNW Utility:
Linux Detector tool: http://forum.xda-dev...d.php?t=1257434
Linux Automated UnBricker:http://forum.xda-dev...d.php?t=1242466
Bootloader Hello World by Rebellos http://forum.xda-dev...77&d=1314105521
UnBrick tool http://forum.xda-dev...d.php?t=1242466[/adiv][/adiv][/adiv][/adiv][/adiv]
1 - 1 of 1 Posts