Retail I9300 and Tizen RD-PQ Firmware

Is it possible to use RD-PQ Firmware with Retail I9300?


If yes, then please how?

Please, don't try at home, without to know how... risk to brick I9300.


But maybe someone has broken I9300 with cracked/damaged Display or is smart enough to use "Live Demo Unit" I9300X...

Maybe JTAG enabled...


Thanx in advance.


Best Regards


8 Replies
Peter Wegner

Partitiontable aka PIT...


No problem, is inside u-boot-mmc.bin...


Tool Odin... Internet...


Now only Question, how well is Boot of I9300 protected with all Knox inside...

Risky, if something forgotten or unkown surprice...


Maybe someone could confirm theory and real live... thanx.


Best Regards

Peter Wegner
Little progress... I was able to find Victim I9300X Live Demo Unit... with broken Display and Touch also damaged... I see nothing and I can not navigate... To enter Download Mode blind... no problem. Test 1. Round 1. GT-I9300_Boot_Recovery.tar flashed with Odin 3.04, success. I thought/think maybe lower Security... Handset alive. Round 2. Tizen_RD-PQ_System_20131107_1.tar Tizen_GPT_Ver08.pit ---> extracted from u-boot-mmc.bin Added!! Odin v.3 engine (ID:6).. File analysis.. SetupConnection.. Initialzation.. Set PIT file.. DO NOT TURN OFF TARGET!! Get PIT for mapping.. Odin 3.04 hangs. nothing happens... But S3 alive... Second attempt with Odin 1.85 Added!! Odin v.3 engine (ID:6).. File analysis.. SetupConnection.. Initialzation.. Set PIT file.. DO NOT TURN OFF TARGET!! Re-Partition operation failed. All threads completed. (succeed 0 / failed 1) S3 alive... I think reason is, because "Knox Bootloader" expect signed PIT files... for partition eMMC and not allow unsigned PIT. Tizen_GPT_Ver08.pit looks unsigned for me... or I have not seen the Signature... For more stupid tests I need working Display... then more stupid tests to flash Tizen RD-PQ on I9300... Best Regards
Peter Wegner
If I can find working Display for my Live Demo Unit... Next idea is also this with SD card... ""SDCARD MODE COPY BINARY FROm SDCARD.. COPY BINARY TO EMMC.. SDCARD DOWNLOAD COMPLETED."" Meanwhile I will play little bit with Odin and T-Flash option... Best Regards
Alexander AVSukhov


I think it is impossible.
SDK_SecureBoot_1st which is used for m1 devices does not detect M0 device at all.

Peter Wegner
Thanx for info. I hope my I9300X Live Demo Unit is less secured... But I have an bigger problem to find cheap working Display... Meanwhile I have more then 10 x damaged/broken Displays tested... with no luck. None is alive... I see nothing on Screen. :( PBA is alive, I have access via Explorer to Phone + SD Card and Odin works... but I can't see anything... I'm working blind... Damn... Best Regards
Peter Wegner
It seems RD-PQ is GT-I8800... Because is visible on PCB... Also visible... missing parts like I9300X Live Demo Unit... Someone was able to write Android to RD-PQ via direct eMMC... So my chance to write successfully Tizen to I9300X is not 0... Maybe I have to go the hard way... Direct eMMC Best Regards
Peter Wegner

2 years later.

It is not impossible.

Tested successfully with GT-I9300 and GT-I9305... replacing sboot.bin with content of s-boot-mmc.bin

+ using 32 MB dump with u-boot inside... for proper Download Mode.

No tweezer, no direct eMMC nor other Hardware action needed...

Simple sending few commands via ADB... + 2 dd



Maybe I need 2 more years... but GT-I9305 "support" THOR via sboot.bin...

Handshake THOR answered with LOKE... instead ROHT...

This leads to other handsets/mobiles...


Only as info...


Best Regards


Hello Peter,

I'm working with the project and we are trying to get our own version of u-boot running on the i9300 and i9305 exlusively via software, without needing to use tweezers or other hardware action. The work you documented in this thread is very informative. I'm curious, do you have any updates related to your work on this that you'd be willing to share?