2013年12月12日 (四) 11:20的版本

1 缘起

手上的三星 Android 机 T959 用了快三年了，一直用原生系统，挺好用，一直没有分析的动力。

最近刷了 MIUI V5，内置了一堆的吸流量、浪费系统资源的应用，苦不堪言，该好好来解析一下手机 Android 系统了

2 Android 系统结构

3 ROOT

4 T959 硬件结构

AP: SANSUNG Exynos S5PC111 (S5PC110) -- ARM Cortex A8 1GHz + PowerVR SGX540 显示核心 --- Android 的系统实际是跑在这个处理器上

CP: Infineon 8824 - Infineon X-GOLD 61x Baseband processor --- 处理 2G/3G射频前端送来的数字信号，主要是 2G/3G 的通信协议处理 --- 刷机包中的 modem.bin 是个基带固件（一个实时OS + 协议处理进程），其是跑在这个处理器上的，内部一般就是一个 ARM 核心加一个 DSP 核心

Infineon 5703 --- 2G/3G射频前端 + 模拟基带处理 --- 把天线过来的射频信号降频（down-conversion），模拟信号处理，模数转换后，输出数字信号

Triquint TQM676021 --- Handset Tritium III PAD (power amplifier/duplexer) module for UMTS band I (IMT2100 band) --- 3G 射频功放，2100MHz 频段

Triquint TQM666022 --- Handset Tritium III PAD (power amplifier/duplexer) module for UMTS Band II --- 3G 射频功放，1900MHz 频段

Triquint TQM656024 --- Handset Tritium III PAD (power amplifier/duplexer) module for UMTS band IV --- 3G 射频功放，1800MHz 频段

Samsung KB100D00WM - KFG8GH6Q4M 8Gb OneNAND , K4X2G323PB, K4X1G323PB and another 1G package

Samsung KLM8G4DEDD - 8G of MoviNAND

Maxim MAX8998 – Power management IC

Broadcom BCM4751 - single-chip GPS Receiver Solution

Broadcom BCM4329 – 802.11n with Bluetooth 2.1 + EDR and FM receiver

NEC MC-10170 – Elpida Memory + Camera processor

Atmel MXT224 - a 224-node highly configurable touchscreen controller which is part of Atmel's maXTouch product platform

http://www.techinsights.com/teardowns/samsung-galaxy-s-teardown/

http://www.evolife.cn/html/2011/57854.html

http://forum.xda-developers.com/showthread.php?t=1372365

小米3拆解：http://en.miui.com/thread-7633-1-1.html

5 刷机

5.1 概述

5.2 工具

Samsung 官方提供给维修中心的刷机工具 Odin

开源的 heimdall

Odin is an internal Samsung tool used for flashing firmware to their devices (via Download mode, bypassing recovery etc.). Importantly, it also has the ability to repartition the device storage based on a .pit file, which can save you from softbricking (when flashing goes wrong and recovery/the bootloader fail). It is not open source and to my knowledge they have not intentionally released it — a few versions have been leaked. For what it's worth, I have used the version posted here without issue.

Heimdall, however, is open source and duplicates the functionality of Odin. It claims to be more reliable as well, in addition to being cross-platform (Odin is Windows-only).

Both tools appear to work best with Galaxy S devices, so if you're using another device you probably want to ensure someone else has tried it and succeeded. Another note is that they use .tar packages layed out differently than the normal update.zip format used by recovery and OTAs, so you need to get the proper package for it to work.

5.3 heimdall

Then turn off your phone, enter Download mode, connect the USB to phone. Next I used command like this to do the flashing itself

 sudo heimdall flash --MDM modem.bin --verbose --no-reboot

Also to you can use to diagnose more with these, in case of issues

heimdall --version
sudo heimdall detect
sudo heimdall download-pit --output I9505.pit --verbose --no-reboot

6 基带固件

原生系统基带版本：T959UVKB1