yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] efrant:
Yes, you can try it. mskip tried doing that (I think), but the more people try it, the better.
[Samsung Galaxy Nexus] segv11:
OK, I can try it in a few days when I have some more time on my hands to do a nandroid and reset Wallet, just in case something goes south and wipes userdata.
[Samsung Galaxy Nexus] segv11:
I'd love to do a bitwise compare of two param dumps from the same device to see which bits need to be tweaked... Then repeat the process with dumps from a different version of the Galaxy Nexus (perhaps also one with an older version of the bootloader) to see if it's the same bits that change.
[Samsung Galaxy Nexus] Big Cam:
My data was removed, but when I signed into my gmail account it automatically downloaded all the apps I had before unlocking the bootloader.
[Samsung Galaxy Nexus] bozzykid:
This has always been the case with ICS. It is nothing new.
[Samsung Galaxy Nexus] segv11:
One byte Difference

Note to efrant and Adam Outler:

The only difference between the two zips you posted is a single byte at position 0x000007C which is 1 in the locked version and 0 in the unlocked version. See the result of diffing the output of xxd on each...

*** param.lock.hex	2012-06-06 17:23:51.000000000 -0700
--- param.unlock.hex	2012-06-06 17:24:09.000000000 -0700
***************
*** 7,9 ****
0000060: 0b00 0000 0000 0000 0c00 0000 0000 0000 ................
! 0000070: 0d00 0000 0100 0000 0e00 0000 0100 0000 ................
0000080: 0f00 0000 0000 0000 0000 0000 0000 0000 ................
--- 7,9 ----
0000060: 0b00 0000 0000 0000 0c00 0000 0000 0000 ................
! 0000070: 0d00 0000 0100 0000 0e00 0000 0000 0000 ................
0000080: 0f00 0000 0000 0000 0000 0000 0000 0000 ................

---------- Post added at 05:42 PM ---------- Previous post was at 05:30 PM ----------

Did fastboot oem lock. Rebooted to bootloader to verify that it is locked; would not flash unsigned images, no "unlock" icon booting Android.

Flashed your param.unlock using dd directly to the block device. Rebooted bootloader, shows as unlocked. No data wipe occurred.

Rebooted to Android.

Flashed your param.lock using dd directly to the block device. Rebooted bootloader, shows as locked.

----

In short, your param.unlock and param.lock files work as advertised. Of course if your bootloader is locked, you need root and the courage to use dd as your flashing tool...

See my previous post, there is only a one-byte difference between them. This should allow a more fine-tuned approach to unlocking than stomping on the entire partition with a saved image from some else's device...
[Samsung Galaxy Nexus] efrant:
Excellent!! Thanks for posting the information. -- much appreciated!

The only other thing that I wouldn't mind knowing is if there is any difference between the param.unlock that I posted, and the one that was originally on your device?

Thanks again.
[Samsung Galaxy Nexus] NCguy:
Congrats guys for sticking with it and solving the puzzle. Credit of course to adam outler for his discovery.
[Samsung Galaxy Nexus] AdamOutler:
All credit goes to Samsung source code :) That's how they've always been. Anything and everything relating to SBL, Booting and the first things you see on your screen are always in the PARAMs. The only earlier "settings" are the boot mode switches which I use for UnBrickable Mod.
[Samsung Galaxy Nexus] segv11:
Yours in son the top, mine is on the bottom. Offsets are in hex, values are 16 bit hex shorts. I see three differences, where one of has a NULL-terminated string and the other has NULLs:

Starting at 0x0000084, I have my baseband version.

Starting at 0x0000c90, I have my device's MAC address.

Starting at 0x0001094, You have "COA". (Anyone have any idea what that means?)

My device is a January 2012 build VZW Galaxy Nexus, running 4.0.4 IMM76K from the May 1st leak (which turned out to be identical to the OTA). What about the device your dump was taken from?

*** param.unlock.efrant.hex	2012-06-06 19:28:27.000000000 -0700
--- param.unlock.segv11.hex	2012-06-06 17:45:49.000000000 -0700
***************
*** 9 ****
! 0000080: 0f00 0000 0000 0000 0000 0000 0000 0000 ................
--- 9 ----
! 0000080: 0f00 0000 4935 3135 2e46 4330 3400 0000 ....I515.FC04...
***************
*** 202,203 ****
! 0000c90: 0000 0000 0000 0000 0000 0000 0000 0000 ................
! 0000ca0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
--- 202,203 ----
! 0000c90: 4430 3a44 463a 4337 3a43 313a 4233 3a37 D0:DF:C7:C1:B3:7
! 0000ca0: 3200 0000 0000 0000 0000 0000 0000 0000 2...............
***************
*** 266 ****
! 0001090: 1300 0000 434f 4100 0000 0000 0000 0000 ....COA.........
--- 266 ----
! 0001090: 1300 0000 0000 0000 0000 0000 0000 0000 ................
[Samsung Galaxy Nexus] NCguy:
Microsoft uses it to stand for Certificate of Authenticity.
[Samsung Galaxy Nexus] segv11:
Oops, I had to edit my post. efrant's dump had "COA"; Mine had the baseband version and the MAC address.
[Samsung Galaxy Nexus] efrant:
We are only half way there. Still need to figure out where the difference is in Play Store devices that don't wipe with an unlock versus non-Play Store devices that do wipe with an unlock.
[Samsung Galaxy Nexus] efrant:
I'm hoping AdamOutler can chime in here. The images are his...
[Samsung Galaxy Nexus] AdamOutler:
The difference would be in SBL. its likely related to the brick bug paranoia. Firmware revision 0x25 fixed it. http://www.xda-developers.com/android/determine-your-devices-hard-brick-risk-with-got-brickbug/ those of you who are not wiping, please check with that app.

The SBL is responsible for any actions in fastboot, odin, sbl prompt, and a few other minor functions like initializing the screen and loading linux ;)
[Samsung Galaxy Nexus] segv11:
Shell Scripts

Here are some quick shell scripts you can run from Terminal or ADB. They need root and busybox, of course.

#
# Lock the bootloader by writing a 1 at 0x000007C of the param parition
#
echo -n '\x01' | dd obs=1 count=1 seek=124 of=/dev/block/platform/omap/omap_hsmmc.0/by-name/param

#
# Unlock the bootloader by writing a 0 at 0x000007C of the param parition
#
echo -n '\x00' | dd obs=1 count=1 seek=124 of=/dev/block/platform/omap/omap_hsmmc.0/by-name/param
[Samsung Galaxy Nexus] AdamOutler:
Are you using tr to remove the \n? Try echo -n '\x01'
[Samsung Galaxy Nexus] segv11:
No, I was using the \n to give tr something to translate. I knew that tr could take backslash escapes, but forgot that busybox echo can too. The built-in echo on my computer doesn't.

Either way, I like your code better. I will revise my original post to use

echo -n '\x01' for lock

echo -n '\x00' for unlock

piped into the same dd command.
[Samsung Galaxy Nexus] efrant:
Thanks, I'll have a look a little later.

I never bothered comparing SBL partitions, because I thought the sbl and xloader were written to when you flashed a bootloader.

What I'm trying to figure out is: can we turn a GNex that wipes when the bootloader is unlocked INTO a GNex that does not wipe when the bootloader is unlocked?
[Samsung Galaxy Nexus] NCguy:
And possibly vice versa for those who are worried about bootloader security?
[Samsung Galaxy Nexus] AdamOutler:
Yes. Just flash the non-wiping bootloader.

yes. just flash the vice versa bootloader.
[Samsung Galaxy Nexus] efrant:
Thanks for the reply.

Hmmm. mskip said that he flashed the bootloader from a Play Store GNex (which didn't wipe on unlock) to his non-Play Store GNex, but it still wiped when he attempted to unlock. mskip, wanna chime in here?

If I am not mistaken, the bootloader on the Play Store GNex (included in the takju factory image) is the the non-Play Store GNex (included in the yakju factory image), so I don't understand where the difference would arise.
[Samsung Galaxy Nexus] AdamOutler:
Why has noone run the app from the last page? Those who are not wiping need to run the app.
[Samsung Galaxy Nexus] efrant:
I just had a read of that, and I'm pretty sure that is not what we are talking about here.

Galaxy Nexus devices that are being sold on the Play Store do NOT force a wipe of the userdata partition when the bootloader is unlocked -- it is not one or two devices -- all of them are like that.

Galaxy Nexus devices sold outside of the Play Store DO force a wipe of the userdata partition when the bootlaoder is unlocked.

We are trying to reconcile the difference.
[Samsung Galaxy Nexus] efrant:
Thanks for this.

Would these work on all param images, or only the ones I posted from AdamOutler?
[Samsung Galaxy Nexus] segv11:
It works on Adam's images and in the ones on my phone. If you're brave and have a Galaxy Nexus, you could just run the scripts... If you're more cautious, you can do what I did: dump param on an unlocked device, fastboot oem lock, dump param again. Run xxd on each to see the hex, and diff -c the result.

Unlock either with fastboot oem unlock, or by flashing (with dd, not fastboot) the unlocked image you made originally.

If the only difference you see is the 1 or 0 an 0x7C then you're good to go. Otherwise the scripts will need to get smarter.

We're getting a little off topic because this thread was about finding out why some devices wipe on fastboot oem unlock, and others don't. Adam's probably right that we should look in elsewhere for that... This has evolved into how to lock/unlock your device _without_ fasboot; do we need to fork this into a new thread?
[Samsung Galaxy Nexus] efrant:
I think you meant "wipe" and not "lock" correct? The topic is finding out why non-Play Store GNex device wipe when unlocking with fastboot, while Play Store GNex devices do not wipe when unlocking.

Yeah, we could start a new thread for locking/unlocking without fastboot, but I still believe that it is somehow tied together.
[Samsung Galaxy Nexus] segv11:
Yes. I'll correct my post.

Also, xxd is not on-device, I'm using it on my desktop after adb pulling the images. If you want to stay on-device, od -x will work, and is part of busybox but you'll see the offsets in octal rather than hex.
[Samsung Galaxy Nexus] segv11:
I'm curious how many different Galaxy Nexus versions this offset into param works on. Mine its toro/mysid with bootloader PRIMELA03.

+AdamOutler, it looks like it works with the param dumps you supplied: could you post the relevant build props for that device?

Does anybody else (with a different build) feel like dumping the locked and unlocked param partitions and comparing them? (Or upload both and I'll compare...)
[Samsung Galaxy Nexus] efrant:
I uploaded my unlocked param earlier in this thread. Have a look to see if it is the same as yours or the one as AdamOutler provided.
[Samsung Galaxy Nexus] segv11:
I just scraped all the param images off the thread, including yours. I'll compare them to see if any are identical.

What I am trying to do is figure out which variants of the Galaxy Nexus the scripts I posted work on. To do that needs the build infos. (I'm on a toro, and a lot of you are on maguro, but various different versions: takju, yakju, yakjuxx, ...) Ideally we could get locked/unlocked pairs (from the same device) under each variant.

If the scripts work on enough variants, then I'm going to build an APK around it so root users have any easy way to lock/ unlock without wiping. (Now that I have an unlock script, I keep my bootloader locked, with stock recovery, and usb debugging off, to make it a little bit harder for an unauthorized user to get my data. I know that if I want to take a nandroid or flash something I can quickly unlock-boor TWRP-do stuff-relock without losing any data.)
[Samsung Galaxy Nexus] efrant:
Aside from the devices sold on the Play Store (and even then...), I do not think there is any difference between the param images among the maguro devices. Mine was originally a yakjuux device bought in Canada.

Sounds good!

P.S. I still wish we could figure out what causes the Play Store devices to not wipe when unlocking...
[Samsung Galaxy Nexus] segv11:
Comparison Results

I scraped the following param images off the thread. (I'm only counting full images, not MD5's because I needed to compare the raw bits.)

Archpope: locked & unlocked; takju build from Play Store.

AdamOutler: locked & unlocked; unknown build (presumably maguro device).

efrant: unlocked only; yakjuxx build from Canada.

NCguy: locked only; yakjus build (unknown origin)

segv11: locked & unlocked; mysid build (Verizon toro device)

Raftysworld: unlocked only; takju build from Play Store.

We appear to have several different maguro builds, and one toro build (mine). Does anyone out there have a rooteed toroplus that they want to experiment with?

First, it is worth noting that in all three cases where we have a locked/unlocked pair from the same device, the ONLY difference is a 1 (locked) or 0 (unlocked) at offset 0x000007C. This makes me very optimistic that the shell scripts I posted earlier will work on all maguro and toro devices.

For the curious, I have done all 15 possible pairwise comparisons between these 6 different dumps. There are only a few differences, other than lock state:

1) My toro device has its baseband version string starting at offset 0x0000084. I also have my WiFi MAC address (as a string) at 0x0000C90. None of the maguro devices has either of these.

2) All the maguro devices (except Archpope's) have a three character code at offset 0x0001094. My toro device does not have this. The codes I found are as follows:

* Archpope: (none)

* AdamOutler: "COA"

* efrant: "BMC"

* NCguy: "TGY"

* Raftysworld: "GEN"

I am guessing that this is a carrier identifier, because "BMC" looks like "Bell Mobility Canada" (efrant, you're on Bell not Rogers, right?). That would also make sense for the Play Store devices to either have this field blank (like Archpope) or "GEN"eric, like Raftysworld. Please let me know if my guess is right. I'm wondering what carriers COA and TGY represent.

All in all, this is a very positive development. I'm fairly confident that root users can lock and unlock the bootloader of any toro or maguro device (regardless which carrier's build) by changing the value at 0x000007C. The scripts above should suffice for most of us until I can get around to writing an APK to do the job.

I didn't see any param dumps from toroplus (Sprint) devices so I don't know about those. Also, all if all of these devices are running PRIMELA03, we don't know if this will change with a future bootloader.

A big thank-you to all the contributors to this discussion, especially those who contributed param dumps. Even though we didn't figure out why Play Store devices don't wipe on "fastboot oem unlock", I think we learned something _almost_ as good: how to lock and unlock the bootloader (without wipe) from within Android.
[Samsung Galaxy Nexus] Mach3.2:
Looking forward to your app!:)

Although you guys did not find out what cause the Play Store gnex to not wipe after doing a fastboot oem unlock, you guys found another way to unlock without wiping user data, good work i say:)
[Samsung Galaxy Nexus] NCguy:
In my case TGY, is Tmobile (USA, NC)

Looks like you're guess is a good one. Great work!
[Samsung Galaxy Nexus] efrant:
First of all, thanks for all your work, and for sharing your findings -- it is much appreciated.

As for the BMC, yeah, it would make sense that it stands for Bell Mobility Canada, as my device was purchased at Virgin Mobile Canada (part of Bell Mobility Canada), although my carrier is Rogers. Obviously that string represents which carrier the device came from.

---------- Post added at 06:25 AM ---------- Previous post was at 06:23 AM ----------

Did you purchase your device from T-Mobile? I believe that string reflects where the device came from, not which carrier you are using. If you are on a yakjuzs build, that is a China/HK variant, not a T-Mobile device.
[Samsung Galaxy Nexus] NCguy:
If what efrant says is true then the TGY must not be a reference to my carrier Tmobile. Mine was actually purchased through expansys-usa and I believe it was an HK import (yakjuzs). Maybe someone in Hong Kong could shed light on an Asian carrier that would match those initials?
[Samsung Galaxy Nexus] Mach3.2:
Anyway, kind of interested in the 3 character codes thing, maybe you can take a look at my param.img?
[Samsung Galaxy Nexus] segv11:
For the three-character code, you have "XSP". This looks like a maguro device with an unlocked bootloader. What was your original carrier, and your original build (i.e. "yakju__"?)

I would love to know what all the other fields (that are the same on all devices) mean. For the stuff that differs from device-to-device, we have so far:

1) the lock-unlock flag

2) the "carrier" code (maguro)

3) the baseband version and MAC address (toro)

Here are some quick scripts to extract these. All need root and busybox. Although if you'd rather upload your whole param dump, I'd be happy to analyze it. *And if you have a toroplus, I'd _LOVE_ to get a locked/unlocked pair from you to verify that your device locks/unlocks the same way as ours.

#
# Check the bootloader lock flag at 0x000007C of the param parition
#
dd ibs=1 count=1 skip=124 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param 2&> /dev/null | tr '\000\001' '01' | sed 's/0/Unlocked/; s/1/Locked/;'
echo

#
# Get the carrier code (maguro only)
#
dd ibs=1 count=3 skip=4244 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param 2&> /dev/null ; echo

#
# Get the baseband version (toro only)
#
dd ibs=1 count=9 skip=132 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param 2&> /dev/null ; echo

#
# Get the WiFi MAC address (toro only)
#
dd ibs=1 count=17 skip=3216 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param 2&> /dev/null ; echo
[Samsung Galaxy Nexus] Mach3.2:
I have no idea what my original built is, i flashed stock 4.0.4 takju after playing with it for a day.

Original carrier is Starhub Singapore, looks nothing like the 3 character code i say.

---------- Post added at 06:33 PM ---------- Previous post was at 06:22 PM ----------

I did a search, can anyone verify this?
[Samsung Galaxy Nexus] segv11:
Good work, and great googling! It looks like CSC codes are exactly want these are, though I don't have one because I've got a toro. Your XSP matches your Singapore phone, NCguy's TGY matches his Hong Kong phone, efrant's BMC is right for Bell Mobility Canada, and AdamOutler's COA image must have come from a Romanian phone from a Greek (COSMOTE) carrier.

Here are a couple of older threads on CSC codes...

http://xdaforums.com/showthread.php?t=779580

http://www.sammobile.com/firmware/?page=1&t=1
[Samsung Galaxy Nexus] Mach3.2:
I noticed the 3 character code is in the /factory/imei/mps_code.dat file
[Samsung Galaxy Nexus] segv11:
[root] BootUnlocker for Galaxy Nexus >>ALPHA<<

I finally got around to writing a root APK to unlock, lock and check the lock state, of the Galaxy Nexus bootloader by reading writing from the param partition.

Coming from a unix shell and C background, this is a first Android app for me. Because of this the current version is a gross hack wrapped around the scripts I posted earlier. I'm not willing to post it here, or on the Play Store, until I clean it up a _lot_. But if you are interested in trying out a _very_ alpha version please PM me. It should work on maguro or toro, but I don't know about toroplus because I've never seen a param dump from a toroplus.
[Samsung Galaxy Nexus] Mach3.2:
You got PM:)
[Samsung Galaxy Nexus] NCguy:
Nice!
[Samsung Galaxy Nexus] Mach3.2:
Your app works good.
[Samsung Galaxy Nexus] segv11:
Thank you for testing. There are two big issues I want to fix first before putting it in the wild. Until then if anybody else wants to test it, let me know.
[Samsung Galaxy Nexus] Mach3.2:
I'm curious, what issues?:p
[Samsung Galaxy Nexus] segv11:
Should check that it is indeed running on maguro or toro. If I'm putting it up on XDA and Google Play, I don't want someone to try running on their brand new SGSIII and mess things up. ;-)

"su" is exec()ed from the main thread, causing two problems:

The first time you run, and you get the su authorization popup, the app can get get stuck updating the interface, and (at least on SuperSU) can hit you up for multiple authorizations.

The "Status" box in the interface doesn't always update after you lock/unlock. Sometimes you can click the lock or unlock button, and it takes effect but the change does not appear in the status box because the UI updated too quickly. Switching to another app then switching back fixes this, as does clicking the same button again.
[Samsung Galaxy Nexus] Mach3.2:
Oh.
[Samsung Galaxy Nexus] segv11:
[root]BootUnlocker for Galaxy Nexus, v1.0

The app is prepared and released on Google Code. Still waiting for the Play Store to update.

Here's the new thread: http://xdaforums.com/showthread.php?p=27878306

Thanks to all of you on _this thread_ that discovered the technique that the app uses.
[Samsung Galaxy Nexus] efrant:
Back on topic -- Another idea

OK, we are still trying to figure out why some GNex's wipe while others don't when unlocking. Anyone still interested?

I have another idea:

Maybe I dismissed the whole bootloader thing too soon. What I'm saying is we've confirmed that flashing the same bootloader on both a Play Store GNex and on a non-Play Store GNex, but it makes no difference. HOWEVER, we don't know if there is a byte that is not written to during the flash -- I don't really know how the the bootloader image is split between the sbl and the xloader partitions. This is what the flash script does:

assert(samsung.write_bootloader(package_extract_file("bootloader.img"), "/dev/block/platform/omap/omap_hsmmc.0/by-name/xloader", "/dev/block/platform/omap/omap_hsmmc.0/by-name/sbl"))

So, in order to confirm that there is not a byte that is not replaced, we would need a dump of the xloader and the sbl partitions from both a non-Play Store GNex and a Play Store GNex, with both running the same bootloader version.

Would anyone with a Play Store GNex mind dumping those two partitions please while your bootloader is locked AND unlocked?

Here is how:

adb shell

su

dd if=dev/block/platform/omap/omap_hsmmc.0/by-name/sbl of=/sdcard/sbl.img

dd if=dev/block/platform/omap/omap_hsmmc.0/by-name/xloader of=/sdcard/xloader.img

exit

exit

adb pull /sdcard/sbl.img

adb pull /sdcard/xloader.img

Then zip them up and post here.

Don't forget to do it twice: once when locked and once when unlocked.

Make sure you indicate which bootloader your device is currently running.

After we get the 8 images (Play Store locked and unlocked and non-Play store locked and unlocked), maybe segv11 wouldn't mind doing a quick comparison? :)

Thanks.
[Samsung Galaxy Nexus] NCguy:
Yup, still interested but unfortunately my phone was not play store:(
[Samsung Galaxy Nexus] segv11:
I'm interested, but since I have a toro, I don't think my bootloader images will be useful. Of course I would be happy to compare whatever dumps people upload.

We really should check _everything_ except system and userdata, because we might find that it's a flag in a funny place like efs. Anyone know if the PRIMELA03 bootloader is in AOSP - I haven't looked yet.
[Samsung Galaxy Nexus] efrant:
Well so far, we've already dumped dgs, metadata and misc, and they are all the same across devices. We know what param does, and efs would certainly differ given that it stores your IMEI. So the only ones we haven't dumped yet (aside from efs) would be sbl and xloader. (There are also two others labeled mmcblk0boot0 and mmcblk0boot1, but they are not listed the same way along with the others, so I would suggest leaving them until after we verified sbl and xloader).

By the way, there is no difference between the toro PRIMELA03 bootloader and the maguro PRIMELA03 bootloader. They are identical. I have them both here, and I verified the MD5 hash - identical.

And no, the bootloaders are not open source.
[Android Q&A, Help & Troubleshooting] whitepandaaa:
i was just wondering, why does US version does not come with physical home button? patent issue? i cannot google on any reason why, as im just researching on coursework about patent etc would anyone can explain why ?? :confused: