yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] segv11:
Thank you for the dumps. Downloading now...

About paritions, according to this thread ...

mmcblk0p9 (UDA) is /data, including /sdcard. Of course this didn't work because you were dumping /data ONTO /data, causing it to grow without bounds. I don't expect to find lockstate here, as it would not survive a factory reset.

mmcblk0 is the entire internal storage, unparititioned. Like mmcblk0p9, we can't dump that. If we really needed those bytes, we'd need to dump to a mounted thumb drive, using stickmount.

mmcblk0p3 (APP) is /system. I wouldn't expect to find lockstate here, as it wouldn't survive flashing a ROM. Since this will be an ext4 filesystem image, I'm not sure analyzing a hexdump will help... I may need to find a way to convert it to a tarfile and/or mount it (I'm on MacOS X, not linux :( )

mmcblk0p4 (CAC) is /cache. This would also be a strange place to store lockstate, as people wipe /cache all the time. This will also be an ext4 image, so it may be a challenge to analyze it.

mmcblk0boot0 is low-level bootloader CODE, not just data. This is the only meaningful place I found changed last time I tried this device. However I would be very wary of experimental writes to this partition, as corrupting the bootloader at this level is just about the only way to brick a Nexus.

I'm going to need a while to look at these dumps, but there doesn't seem to be anything promising. Lockstate shouldn't be in /system or /cache, and if it's in boot0 I would not want to try changing it unless it's a really obvious bit (and it wasn't, last time). I'll post again once I've finished downloading the files and done some analysis.
[Samsung Galaxy Nexus] osm0sis:
Thanks. If we could get dumps from several people running 3.41 then you could make sure all the locked/unlocked bits match and just write to all the matching spots that change, right? I realize this would be dangerous in theory, but if you've got data on your side that it's what makes it the unlocked state, it should work. I guess the trick would just be making sure you got it right the first time. ;)

P.S. Please remove the SkyDrive link from your post. I'm going back to remove it from mine since you're downloading now. I'll leave the files up until tomorrow night. :)
[Samsung Galaxy Nexus] segv11:
I've got all the files.

What concerns me is that what I find in boot0 is this (< lines are unlocked; > lines are locked):

1c1

< 0000000: 864a 6750 df52 6c32 7e8d 85aa 3b00 6286 .JgP.Rl2~...;.b.

---

> 0000000: 4ee6 ae4c 351c da46 9464 ef7d ebee 0633 N..L5..F.d.}...3

383c383

< 00017e0: 1d60 da35 f822 cc04 e1ad de08 5376 e14c .`.5."......Sv.L

---

> 00017e0: 9dc3 c5d6 e2dc be6e c237 03f4 00d0 e3c3 .......n.7......

This pattern repeats 64 times, at 0004000/00057e0, 0008000/00097e0, 000c000/000d7e0, all the way up to 00fc000/00fd7e0.

That's an awful lot of changes; not just a byte or two. Last time I did this (older bootloader), the we saw something simillar. This pattern repeated 64 times:

1c1

< 0000000: c240 111e 7faa 02d4 c4a7 5c07 d6ca 74b6 .@........\...t.

---

> 0000000: 79f4 dcc9 605a a16c 4abb 5605 76e5 2dc1 y...`Z.lJ.V.v.-.

383c383

< 00017e0: aa89 f4bd 2354 4f22 02ed 27b5 2179 fe3e ....#TO"..'.!y.>

---

> 00017e0: aac4 e9f5 772c 0a05 75c1 c9e6 6a6e 43ce ....w,..u...jnC.

I suppose that if we could get several dumps, and for the same bootloader version they all make the same changes then at least we'll no it's not some device-specific junk. It might still be a side-effect (eg: unlocked icon) of some other unlocking operation (in NVRAM for example). I'm still curious what's going on here: is the bootloader really self-modifying code?
[Samsung Galaxy Nexus] osm0sis:
Also weird that it modified cache and system.. I wiped cache and dalvik before taking my nandroid then dumping so you'd think it would stay empty, unless CWM wrote something to it; still doesn't explain system though.

64 lines in both doesn't sound coincidental. We should get oldblue910 (randomphantasmagoria.com) in on this if he's got some time. I'll drop a note asking for testers in his N7 factory images thread. :good:
[Samsung Galaxy Nexus] segv11:
Actually, the entire contents of the boot0 partition seems to repeat 64 times. The useful data run from 0x0000000 through 0x00017ef, then there are a bunch of nulls. The the same data pick up again at 0x0004000 through 0x00057ef, followed my more nulls, and so on...

The pattern of changes that we noticed repeats 64 times, because the whole bootloader partition repeats 64 times. The change is being made to every copy. It is also interesting that these changes are made in the first (0x0000000) and last (0x00017e0) 16 bytes of each copy.

I would love to get some input from someobody who knows more about ASUS and terga bootloaders, as this is very different from what Samsung is doing in the G-Nex.
[Samsung Galaxy Nexus] osm0sis:
Looks like the JB 4.2 OTA for the N7 contains another bootloader revision, so I guess we'll get to do this all over again later this week. ;)

Since I locked my bootloader though, I'm going to do some bleeding edge testing and write my unlocked mmcblk0boot0 image back before I do the OTA upgrade. I'll let you know if I end up with a paperweight or not. :p

Edit: Disappointing...

/data/local/tmp # dd if=/data/local/tmp/mmcblk0boot0.img of=/dev/block/mmcblk0boot0
dd if=/data/local/tmp/mmcblk0boot0.img of=/dev/block/mmcblk0boot0
dd: writing '/dev/block/mmcblk0boot0': Operation not permitted
1+0 records in
0+0 records out
0 bytes (0B) copied, 0.000182 seconds, 0B/s
/data/local/tmp #

Any idea how I can force it to write?
[Samsung Galaxy Nexus] segv11:
Sorry for taking so long to respond: your edit did not show up as a "new item" in my thread list, so I didn't see it right away.

I would not be flashing bootblk0. However, if you are crazy enough, you must first override kernel-level protections... When I get home I will look up how to this: it involves writing to a control for in a special directory.

On a separate note, I would like some feedback from those lucky maguro owners who have installed 4.2:

1) Does it come with a new bootloader, or are we still running PRIMECL03?

2) A lot of root apps are breaking under 4.2, possibly because of SELinux changes. Is BootUnlocker still working for you?

I ordered a Nexus 10 yesterday. Once I have it in my hands I'll see if i can port BootUnlocker to it. Wish me luck.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] osm0sis:
I'm crazy enough to write to mmcblk0boot0. :cyclops: Though I won't be doing so now that I've upgraded to the 4.13 bootloader from JOP40C, I'd still like to know the method when you get the chance.

PRIMELC03 is still the included bootloader on the GN and BootUnlocker is working perfectly with SuperSU 0.98. I think a lot of breakage has more to do with the multiuser sdcard resymlinking than anything.
[Samsung Galaxy Nexus] segv11:
According to the Linux Kernel Mailing List archive, "there's a strong potential for bricking the device you're running on by writing to these", so you need to enable write access first:

echo 0 > /sys/block/mmcblk0boot0/force_ro

With great power comes great responsibility... please don't brick your Nexus 7. :)
[Samsung Galaxy Nexus] segv11:
I've received one bug report on Google Code where the app complains of no root access, even though access was granted and other root apps work. If you experience the same thing, please send me output from "adb logcat" so I can debug. (Also feel free to "star" the issue on Google Code.)

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] segv11:
Nexus 10 support coming soon!

Almost the same technique works on the Nexus 10, so Nexus 10 support coming soon.

Until I can update the app, feel free to hack your own devices using dd: Lockstate is written to PARAM partition. Offset for N10 is 0x0000224, and the sense is reversed from the GNex (1 means UNLOCKED on this device).
[Samsung Galaxy Nexus] segv11:
Nexus 10 support is almost done.

I have a beta with Nexus 10 support that needs some testers before I release it into the wild. PM me if you are interested.

Also, I would appreciate some feedback on:

1) The full (Play Store) name of the app can no longer by "Boot Unlocker for Galaxy Nexus". The limit is 30 characters, so I can't use the title as a laundry list of compatible devices. On the other hand, it doesn't support ALL Nexus devices, not is it likely to.

2) Ideas for a better icon.

3) Any bugs you've seen, especially in terms of 4.2 compatibility.
[Samsung Galaxy Nexus] chrone:
1. I say stick with boot unlocker for keeping the brand image while adding some devices on the compatibility list.

2. Current icon speaks for itself. But i like the unlocked lock icon of gnex bootloader icon, what a pretty simple icon. :D

3. I've tried to lock and unlock several times to fastboot erase cache, working very well so far. Thanks! :)

Sent from my Galaxy Nexus
[Samsung Galaxy Nexus] silentshab:
I have a Nexus 4. What can I do to help get it supported?
[Samsung Galaxy Nexus] efrant:
Although slightly off-topic, I hope you don't mind me posting this here. Someone has put some of your original work to good use: take a look at this thread. Base on your work in the bootloader discussion thread, he managed to figure out how to unlock the bootloader on a GNex, without wiping, and without root. Pretty cool.
[Samsung Galaxy Nexus] segv11:
Indeed that is very interesting; if you have a low-level tool like OMAPFlash that allows you to write directly to raw storage (even with a locked bootloader) then you can pretty much do what you want to the device...

Combing that with our discovery of the correct offset in param is a big win, however. I'd still love to find the correct info for a few more devices...

Nexus 10 coming soon. Beta is available if anyone wants it: I'll push it to production next week when I have some more time for testing.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] segv11:
I made a post about this earlier on the thread: http://xdaforums.com/showthread.php?p=33065779

In short, you need to dump raw images of every partition of your storage, except userdata... in both locked and unlocked bootloader state. MD5 them to see which ones changed, and send me the changed ones. Make nandroids first and copy then off device.

PM me, and I'll walk you through it.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] osm0sis:
Next week at some point I'm going to unlock and lock my N7 grouper 4.13 bootloader multiple times, taking images of that boot0 block we narrowed it down to.

If all the locked and unlocked images respectively match then I'm going to try force-writing the unlocked img over a locked bootloader and see if it unlocks it.

Provided that works what we'll really need are some other people to dump the locked and unlocked images for their device so we can make sure they match mine.

If that's all a go, we could have a tool or at least some CWM zips to lock and unlock the N7 grouper bootloader. Would just have to make a new set for each revision of the bootloader.
[Samsung Galaxy Nexus] efrant:
I will also do the same for my N4. There are a bunch of partitions (25!!) on the N4, so I will get a dump of all of them (aside from system, userdata, boot, recovery and cache), both when locked and unlocked, and get back to segv11.
[Samsung Galaxy Nexus] segv11:
Don't forget to take MD5s of the dumps, as a quick way of knowing if there was a change. Include an ls -l of your /dev/block and the list of mounts so we can interpret which image is which.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] kevin.26:
Just one quick question:

If I have a custom ROM with a custom Kernel and I lock the bootloader, what will it happen?

Thanks :D
[Samsung Galaxy Nexus] osm0sis:
Nothing happens if you lock it, no matter how you do it, other than obviously you can't flash or boot things to it with fastboot since it's locked.

If you unlock with fastboot then it wipes your userdata and sdcard, hence the usefulness of BootUnlocker getting around that.

None of this depends on what ROM or kernel you have.
[Samsung Galaxy Nexus] segv11:
Nothing bad happens. That's how I run. On the Galaxy Nexus, the locked bootloader does not check the kernel or anything: it's just an on/off switch for fastboot features.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] segv11:
Version 1.2 released: HELLO NEXUS 10!

Version 1.2 is released, supporting the awesome Nexus 10 tablet. OP Updated. As a results of this addition, the app is now called "BootUnlocker for Nexus Devices". I hope to add more devices if I have some volunteers to help me hack on them.

The new APK has been pushed to the Play Store a few hours ago, and should be available already. As always, the APK is also available on Google Code: links are in the OP. I will be asking for a link to be created in the Nexus 10 Themes and Apps forum, so if you arrived on this thread from there, welcome!
[Samsung Galaxy Nexus] osm0sis:
Total success, gentlemen! These are from N7 grouper bootloader 4.13:

d1ce2f968f55511c7ab5abd0985dfdfc *locked1-mmcblk0boot0.img
d1ce2f968f55511c7ab5abd0985dfdfc *locked2-mmcblk0boot0.img
d1ce2f968f55511c7ab5abd0985dfdfc *locked3-mmcblk0boot0.img

3fdead47055e2edeed071736a344b408 *unlocked1-mmcblk0boot0.img
3fdead47055e2edeed071736a344b408 *unlocked2-mmcblk0boot0.img
3fdead47055e2edeed071736a344b408 *unlocked3-mmcblk0boot0.img

Then (..despite the creepy "dead deed" MD5s..) I force-wrote the unlocked image over a locked bootloader and it unlocked it. :D

And the same idea worked for relocking.

Now I just need someone to reproduce my results (or at least MD5s from their own device), then I'll make some CWM zips, unless anyone has a better idea, or it's possible to include it in BootUnlocker officially. :good:

Edit: Hmm.. I guess I could also finally take the time to learn how aroma installers work and include both options in one zip... But I'll do that only if there's no way to put it in the app.

[Attachment removed. Since partition is encrypted it is unnecessary.]
[Samsung Galaxy Nexus] segv11:
BootUnlocker will need to be VERY CAREFUL before flashing bootloaders! I don't want the app bricking devices.

Sent from my 4.1.2 toro Bugless Beast.
[Samsung Galaxy Nexus] agouracaguy:
So, once the bootloader is unlocked, ota updates have no effect on the data. The only thing I have to worry about is rerooting the device?
[Samsung Galaxy Nexus] osm0sis:
Oh, without a doubt. ...But it works! :D
[Samsung Galaxy Nexus] osm0sis:
Alright, I've got an all-in-one script made, I just need some N7 grouper people with root and an unlocked 4.13 bootloader to run the following command from terminal and paste me the output:

su -c busybox sha1sum /dev/block/mmcblk0boot0

It just gets a checksum for the partition we know controls the lock state.

I'm hoping they'll match my unlocked checksum; if so, we might be able to assume locked would also match.

Edit: Also please post the HW Version listed when booted into the bootloader.
[Samsung Galaxy Nexus] efrant:
6fd3708ca1cf03d01a0fcb06e2779b6860954efc
[Samsung Galaxy Nexus] osm0sis:
Oohh you finally took the plunge and got a N7 too, eh efrant? :)

Bad news is that's different than the sha1sum of my unlocked "lockstate partition"; I have 0d15831d51c5158827ca052cb91d557e42011d05.

Which means there's something else in there other than the lockstate. Probably the serial number and the HW version or something? Hopefully some more people will post theirs as well, since if it's HW rev I might still be able to accommodate it with my script if there's no other way. I'm HW version ER3.

Don't suppose you'd be willing try and retrace my steps above and MD5 it locked and unlocked a few times, then post dumps of both? Who knows, segv is the master of the hexedit, perhaps with multiple dumps he can narrow down that the repeating code is always in the same spot, and might be the same code; so whatever other differences there may be, he might be able to officially support the N7 based on just writing to that specific area of the partition.:fingers-crossed:
[Samsung Galaxy Nexus] efrant:
Nah, I don't have one, but my kids do. :) (I personally wouldn't really have any use for a tablet.)

I'll see if I can help out, but I'm going to have to back up the game data and Justin Bieber and One Direction songs/videos, so I'm not sure when I'll have a chance (and the patience to do that).
[Samsung Galaxy Nexus] segv11:
It could be encrypted with the device identifier as well. If we have multiple full dumps (not just the md5s) we might be able to see a pattern... I'm willing to try but I'm not holding my breath.

It's actually pretty cool that at least you can flash back your own boot0 images to lock/unlock. That could be a big help to the hackishly-inclined N7 owners, but not much use for an app.
[Samsung Galaxy Nexus] Mach3.2:
Let me know if you guys need some help on it too.

Beamed from my Maguro.
[Samsung Galaxy Nexus] osm0sis:
We definitely could use the help of you and a few others who have a N7 grouper with bootloader 4.13.

I originally made this offer to efrant via PM, but I'll extend it to anyone willing to help in this phase (let's say, first 5 people, in case there turns out to be a lot of demand ;)); I will tailor my script to your device using your dumps of the boot0 partition so that in locking it to get the locked dump you won't lose any data, and even if nothing ever comes of it officially you will have a personalized BootUnlocker Script that will work for your specific N7 while the bootloader is still 4.13. Literally nothing to lose by helping (unless you're locked to begin with)!

Assuming you're starting unlocked with custom recovery installed (required).

adb shell in and do the following:

dd if=/dev/block/mmcblk0boot0 of=/tmp/unlocked-mmcblk0boot0.img
exit

adb pull /tmp/unlocked-mmcblk0boot0.img unlocked-mmcblk0boot0.img
adb reboot-bootloader

fastboot oem lock

Boot to Recovery using the Bootloader menu then adb shell in and do the following:

dd if=/dev/block/mmcblk0boot0 of=/tmp/locked-mmcblk0boot0.img
exit

adb pull /tmp/locked-mmcblk0boot0.img locked-mmcblk0boot0.img

It's important that the dumps are named correctly according to the lockstate for the script. Then attach both img files to a post in this thread like I did a page ago. I will PM you with a link to your personalized script after I've created it so that you can unlock your device again and not suffer any data loss. :)
[Samsung Galaxy Nexus] Mach3.2:
I'll get on it tomorrow, going to shoot cosplay later on.

Beamed from my Grouper.
[Samsung Galaxy Nexus] Mach3.2:
For some reason i got this while trying it in cwm 6.0.1.5:

Got this while trying in CM10:
[Samsung Galaxy Nexus] osm0sis:
Forgot the if/ofs in my post. Sorry about that. Updated. Try again please. :)
[Samsung Galaxy Nexus] Mach3.2:
Here it is.:laugh:
[Samsung Galaxy Nexus] osm0sis:
Amazing how small they pack. Just goes to show how much of it is padding like segv was saying. I'll PM you in a little while with the zip so you can unlock again using it. :)

---------- Post added at 10:48 AM ---------- Previous post was at 09:56 AM ----------

PM sent. ;)
[Samsung Galaxy Nexus] Mach3.2:
Unlocked my bootloader with that cwm zip.

To anyone out there with a grouper, do help him out if you can, there's nothing to lose:)
[Samsung Galaxy Nexus] scary alien:
Been following this thread with great interest and appreciation for the great detective work going on--kudos to all involved :).

Here's my N7 bootloader images: View attachment sa-mmcblk0boot0-files.zip which also includes the od hex dumps in separate, corresponding files.

Here's the SHA1 sums to cross-check the files in the .zip if needed:

osm0sis, ping me again via PM or email if you need anything!

Cheers!
[Samsung Galaxy Nexus] partha:
Another sample

Attached the two files from my N7.
[Samsung Galaxy Nexus] efrant:
1) Not yet, no.

2) I guess I can start a thread in the Nexus 4 forum asking for dumps, and hopefully it won't get buried with the useless posts/threads that occur there on a hourly basis.
[Samsung Galaxy Nexus] JellyBeanToby:
No love for the Nexus 7?

Is there any release plans for the Nexus 7? I wanna unlock mine without wipe :(
[Samsung Galaxy Nexus] scary alien:
JBT,

That's what a lot of the recent discussion and research is about--the N7 tablet. There are also parallel efforts and research for the N4 phone, so you might be noticing those recent posts.

Locked/unlocked bootloader status is not a simple, single byte for the N7 like it is for the Samsung Galaxy Nexus. It's a bit more complex for the N7 apparently and folks are hard at work trying to debug/research this.

Check-out the previous posts for more details and status regarding this.

Cheers!

-SA
[Samsung Galaxy Nexus] dneto:
Please Support Nexus 7 (grouper) =]

It's amazing!!!
[Samsung Galaxy Nexus] osm0sis:
I can make a thread with the bones of my script for the hackishly inclined so each person can adapt it themselves to their device. I'll do that if we don't have any breakthroughs for the N7 over here.
[Samsung Galaxy Nexus] efrant:
So we had one volunteer in the N4 section (so far).

KyraOfFire posted his locked and unlocked misc.img files here and, as expected, they are different than mine.
[Samsung Galaxy Nexus] osm0sis:
Are they wholly different though? Perhaps rather than diffing the locked+unlocked it would be interesting to see if anything is the same between locked images for multiple users' dumps, then unlocked images for multiple dumps. If there are isolated areas that are the same, and those change when the lockstate changes then it would be safe to say those are our target.
[Samsung Galaxy Nexus] efrant:
I agree. But I will leave the diff'ing to someone more capable than me... :)
[Samsung Galaxy Nexus] efrant:
Hmm. Good catch. Although if flashing a different ROM changes that partition as well, we can probably rule out those parts. I'll see if he can update and re-dump.
[Samsung Galaxy Nexus] efrant:
Confirmed. Flashing the unlocked misc image to the misc partition unlocks the device.
[Samsung Galaxy Nexus] KyraOfFire:
This is what show up on my phone and my bootloader.

Build Number:JOP40D

Baseband version:M92615A-CEFWMAZM-2.0.1700.33

Bootloader version:MAKOZ101

I am returning to stock JOP40C and dump the misc partition again. Please tell me if there is something looks wrong.