yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] osm0sis:
Tried with both PRIMEKK15 and PRIMEMD04 GN bootloaders:

>fastboot oem device-info

...
FAILED (remote: Invalid Argument)
finished. total time: 0.017s

I'd be inclined just to have it see if it needs to flip the tamper bit to false every time, then do it if it's true... or even simpler just to reset it to false every time regardless of whether it's ever been set true.

Sweet! Honorable mention for my N7 BootUnlocker Script thread too. ;)
[Samsung Galaxy Nexus] segv11:
My manta also gives the same Invalid Argument. Maybe Samsung Nexus devices don't do the tamper flag... or don't do it in the same way.

My mako does give device info, but it appears that the tamper-switch is off, despite the fact that never did anything to clear the tamper flag. My N4 has been "fastboot oem unlock"ed, flashed custom recovery, rooted, and relocked. I've never flashed a custom ROM on that device.

$ fastboot oem device-info
...
(bootloader)	Device tampered: false
(bootloader)	Device unlocked: false
(bootloader)	off-mode-charge: true
(bootloader)	set-crash-dload: false
OKAY [ 0.005s]
finished. total time: 0.005s

What are you folks seeing on your Nexus 4s for the tamper flag? I wonder if the N4 only sets it when you flash unofficial firmware or something...
[Samsung Galaxy Nexus] iuss:
Is the Galaxy Nexus bootloader lk-based? If not, chances are it doesn't have the device_info struct (and/or doesn't support oem device-info). Even if it is, there's no guarantee it'll actually store the tamper flags there, I'm sorry if I made it sound generalizable.

However, if it does have the struct (including the ANDROID-BOOT! magic), it's worth a shot. Be cautious making changes though (I actually found the flag through reverse engineering, the struct happened to match), if the bootloader chokes on your modifications it might be hard to reflash misc..
[Samsung Galaxy Nexus] osm0sis:
Ah gotcha! I thought the android magic being in there was a bit odd compared to the others. Okay so sounds like the tamper bit will always be the lock offset+4 because they're blocks of the internal android image header.
[Samsung Galaxy Nexus] Shadowman19:
So is it still possible to reset the flag with your tool? If not, can you already say if and when this function will be available? Thanks in advance!
[Samsung Galaxy Nexus] Mach3.2:
It would help if you read. Don't ask for ETAs, he have a kid to take care of and this app is the last thing on his mind.

Beamed from my Grouper
[Samsung Galaxy Nexus] stepw:
Looks there are a few more conditions that could potentially cause tamper flag to be set (depending on bootloader version, in aboot.c):

- execution of unsigned/custom kernel

- when rooting is detected, presumably by some OEM check

/* Assuming device rooted at this time */

device.is_tampered = 1;

So I'd say it would make sense to maintain tamper flag opposite to unlock flag.

Unlocked -> tampered

Locked -> not tampered

If unlock flag is set and tamper flag is not set when device is RMA'ed, it raises as many questions as when tamper flag is set. One is not supposed to have unlocked device without tampering.

---------- Post added at 08:32 PM ---------- Previous post was at 08:24 PM ----------

Code is open source and there's enough details in this thread for anyone to patch net.segv11.bootunlocker/ src/ net/ segv11/ bootunlocker/ bootLoader_N5.java to tamper with tamper flag when locking/unlocking N5.
[Samsung Galaxy Nexus] osm0sis:
Good point.

Only issue I see is the Nexus 4 doesn't appear to trigger the tamper flag yet even though it has one, so to build in blanket support to set it tampered when it doesn't set it itself seems a bit heavy handed. And to build special cases for the N4 and the N5 is just as cumbersome.

I'd still rather always set it to not tampered, and then obviously someone should relock their device when they RMA it. It's part of the procedure even. Also, I'm a lazy scripter. ;)
[Samsung Galaxy Nexus] osm0sis:
I went ahead and uploaded my recovery flashable script BootUnlocker version with support for resetting the tampered bit. :)

http://xdaforums.com/showpost.php?p=47402916&postcount=133
[Samsung Galaxy Nexus] osm0sis:
Can someone with a N5 use my zip script to reset the tampered flag to false and then fastboot oem lock to see if that sets tampered to true? Worth knowing.

I imagine the new N4 bootloader that'll come with KitKat will enable the functionality as it is on the N5.

Edit - [MENTION=4551856]segv11[/MENTION] Questions and Results for these tests are here:

http://xdaforums.com/showthread.php?p=48060100#post48060100

Thanks [MENTION=2918197]The Gingerbread Man[/MENTION] for the help.

Basically only "fastboot oem unlock" seems to trip the tampered flag on at least the N5. :good:
[Samsung Galaxy Nexus] Dikks:
Will it be support of Nexus 7 (2013) - flo & deb? :fingers-crossed:
[Samsung Galaxy Nexus] osm0sis:
Unlikely. It looks like the same issue as the N7 2012 but now the encrypted partition is persist. :(

Someone could likely adapt my N7 '12 BootUnlocker Script Zip to the '13, and they're welcome to try. I'd do this myself but I wouldn't feel comfortable doing something with brick potential unless I was able to test it out on my own device first (and I don't own a '13).
[Samsung Galaxy Nexus] besweeet:
So, for the Nexus 5, it requires root, which requires an unlocked bootloader, which requires a wipe. So, this is made for those who unlock and root beforehand and if they want to just unlock and lock their bootloader whenever, rather for those who want to unlock the bootloader for the first time?
[Samsung Galaxy Nexus] osm0sis:
Essentially. Also if an exploit for rooting without unlocking gets discovered then you can imagine how useful it becomes.
[Samsung Galaxy Nexus] uentity:
Some posts in the very beginning of this thread suggests that if my device is already rooted then attacker can easily gain access to all the device contents even with locked bootloader (and unlock it if needed).

Please, clarify what additional security I gain if bootloader is locked on ROOTED phone? Are there some vulnerabilities that requires unlocked bootloader even if root is present? In short -- what is the purpose to lock bootloader on rooted phone?

Or it was discussed somewhere already?
[Samsung Galaxy Nexus] efrant:
There is no easy answers to your questions.

Here are some points to consider (I will keep the comments below for the Galaxy Nexus):

1) As far as I know, no one has published any vulnerability/exploit to get root on Android 4.3 or higher, so the only way to get root is to unlock the bootloader (or use a low-level utility like OMAP_Flash to bypass the bootloader).

2) Unlocking the bootloader will force a wipe of userdata, while using OMAP_Flash will not.

So, as it relates to the Galaxy Nexus, having a locked bootloader could add a little bit of extra protection (assuming you have the stock recovery flashed), as not everyone knows how to use OMAP_Flash to get access to your data. Other than that, for a Galaxy Nexus, a locked bootloader is more of a hassle than anything else.

In the end, the only real way to ensure the security of your data (if you are really worried about it), is to use encryption with a strong password.

Maybe someone else would like to add additional comments...
[Samsung Galaxy Nexus] uentity:
Thank you very much for clarification. I get your arguments.

But in context of discussed application it is assumed that you already have root access. So gaining root isn't the desired target already.

I really don't store any highly valuable data on a phone. I was thinking about dangerous apps like viruses that can damage data or make your device a spam machine or something like that. As I understand locking bootloader on a phone with root access doesn't protect you in any way against such vulnerabilities?
[Samsung Galaxy Nexus] efrant:
Correct, because the bootloader has nothing to do with the Android OS.

Assuming that your "root access management" app is coded correctly, root shouldn't matter either.

Unfortunately, I don't believe there is a way to protect against something like you mentioned (i.e., a virus that can "make your device a spam machine"). Those are permissions you allow when you install an app -- if you allow it to have access to, say, your SMS, it can spam all it wants if it is a malicious app. The bootloader or root have nothing to do with it.
[Samsung Galaxy Nexus] segv11:
Well I took the recent OTA on my N4 without unlocking by bootloader first. In order to regain root I had to fastboot oem unlock. :(

Good news is:

a) Basically all of my data were backed up in the cloud

b) My N4 now shows the tamper flag, where it did not before. So I guess the recent bootloader update started setting the tamper flag.

I hope to have time next weekend to work on add tamper-flag-tampering :p to the app.
[Samsung Galaxy Nexus] sordna:
What is the tamper flag and why is it present on Nexus devices? I thought only samsung/htc had that kind of stuff, but Nexus are supposed to de developer devices, where flashing things is expected. How can I check if my phone has the tamper flag set, and does it affect warranty ? (I'm past warranty, so just curious for future purchases).

Thanks!
[Samsung Galaxy Nexus] osm0sis:
Read back a few pages maybe? Obviously we've been talking about it.
[Samsung Galaxy Nexus] sordna:
Sure, I did that now (hadn't read the thread in a long time), but I'm still wondering what difference does it make if the tamper flag is set to true or false? Has an any Nexus owner reported getting warranty work denied, because of it ?
[Samsung Galaxy Nexus] osm0sis:
Finally got the chance to play around with my parents' Nexus 7 2013 while I'm visiting for the holidays, and ruh-roh:

>fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) SB=Y
OKAY [ 0.009s]
finished. total time: 0.010s

Weird though, because the device IS unlocked. There is an ANDROID! magic block in aboot, but it's followed by blank 00 data, so perhaps that's what it's reading from incorrectly.

I've also verified that aboot's 5241884 01/00 offset is definitely not the lockstate, going to lock and unlock a few times and see what changes predictably.

Edit: Also for me persist doesn't change with lockstate, so that leaves somewhere else in aboot, or a hidden partition.

Edit 2: Flashing aboot whole changes the lockstate. So I'd say I was close before with 5241884 even though that wasn't the right one. :good:

Comparing the aboot diffs from both Bronto and myself, only a few things change from 00 to data and change consistently; here they are:

> 04ffc00: [color=blue]02[/color]00 0000 0000 0000 0000 0000 0000 0000 [color=blue].[/color]...............
> 04ffc10: 0000 0000 [color=red]10[/color]00 0000 [color=red]05[/color]00 0000 [color=red]01[/color]00 0000 ....[color=red].[/color]...[color=red].[/color]...[color=red].[/color]...
> 04ffc20: [color=red]05[/color]00 0000 0000 0000 0000 0000 [color=red]3c66 4b89[/color] [color=red].[/color]...........[color=red]<fK.[/color]
> 04ffc30: [color=red]8046 4b89[/color] 00[color=red]20[/color] 0000 fde9 [color=red]f088[/color] 0000 0000 [color=red].FK.[/color]. ....[color=red]..[/color]....
> 04ffc40: 0000 0000 [color=red]6472 6177 2075 6e6c 6f63 6b20[/color] ....[color=red]draw unlock[/color]
> 04ffc50: [color=red]6d65 6e75[/color] 0000 0000 0000 0000 0000 0000 [color=red]menu[/color]............
> 04ffc60: 0000 0000 0000 0000 0000 0000 [color=red]1c[/color]00 0000 ............[color=red].[/color]...
> 04ffc70: 0000 0000 0000 0000 4d[color=red]d7 f088 20c3 2089[/color] ........M[color=red]... . .[/color]
> 04ffc80: 0000 0000 0000 0000 [color=red]980d[/color] 0000 0000 0000 ........[color=red]..[/color]......

I'm going to go through the first couple of rows and change each offset back to 00, one at a time, and see what ends up relocking..

---------- Post added at 05:58 PM ---------- Previous post was at 05:40 PM ----------

Nailed it! :D:victory:

[MENTION=4551856]segv11[/MENTION] Here's the info:

elif [ $device == "flo" -o $device == "deb" ]; then
ui_print "Nexus 7 (2013): $device";
block=/dev/block/platform/msm_sdcc.1/by-name/aboot;
offset=5241856;
locked=00;
unlocked=02;
hastamper=0;

Highlighted the correct offset above in blue now, and I'll be adding support to my BootUnlocker zip shortly. :cowboy:

I also tried changing it to 01 just to see what would happen and it acts the same as 00 (locked), so it has to be 02 to be unlocked, which is new. ;)
[Samsung Galaxy Nexus] osm0sis:
Nexus BootUnlocker Script Zip with Nexus 7 2013 (flo & deb) support added to the OP of my Odds and End's thread. :D
[Samsung Galaxy Nexus] segv11:
Sounds like we might have a lead on the N7. That would be sweet.

Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] osm0sis:
Oh, it's more than a lead; it's tested and working. ;):D
[Samsung Galaxy Nexus] segv11:
My read of your results are: 5241856(dec);l=00,u=02;no tamper flag?

Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] osm0sis:
Yup, that's the lockstate offset for the dd command, and the two lock states for the byte. It doesn't appear to have a working tamper byte at the moment, though aboot does contain an ANDROID! header (but after the lockstate) and does respond to oem device-info (but incorrectly). :good:
[Samsung Galaxy Nexus] segv11:
OK. Once the Christmas shopping rush is over I'll try to do a beta with this, and maybe with tamper flag support for N4/N5 if I can figure it how it should look.

Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] p.pavljasevic:
Do i need to use stock recovery or can i just use cwm? I just want a bit of extra security.
[Samsung Galaxy Nexus] segv11:
If you want the locked bootloader to be worth anything, you need the stock recovery. If you have CWM, someone who gets your phone could simply boot to CWM, and a copy of your data (a Nandroid for example) before you could do anything about it.
[Samsung Galaxy Nexus] segv11:
Beta with Nexus 7 (2013) support.

Thank you for all the sleuthing. Here is a beta with Nexus 7 (deb/flo) support.

https://code.google.com/p/boot-unlocker-gnex/downloads/detail?name=net.segv11.bootunlocker.1.5beta1.apk

Please test and let me know if there are any problems. Also, the Play Store is bugging me for a 7" tablet screenshot. If any of you N7 owners would like to contribute one, that would be appreciated.
[Samsung Galaxy Nexus] The Gingerbread Man:
Screen shots off my flo, feel free to use them for Google play store pics. I locked and unlocked my flo using the app and checked boot loader status has changed booting to boot loader and checking the value. I can't test tamper state as I'm not by PC and in bed
[Samsung Galaxy Nexus] osm0sis:
There is no tamper state anyway, it's more of a fastboot bug that it reports anything at all. :good:
[Samsung Galaxy Nexus] segv11:
New beta with tamper flag support on N4 and N5

In addition to flo and deb support, this beta also includes a UI for setting/clearing the tamper flag on mako and hammerhead.

https://code.google.com/p/boot-unlo...ail?name=net.segv11.bootunlocker.1.5beta2.apk

Please help verify that it works.

Also, the UI for the tamper stuff has issues:

It doesn't fit in landscape on phones

It's ugly

I don't know if the wording is clear enough

I would appreciate some feedback from N4/N5 users so I can improve the UI.
[Samsung Galaxy Nexus] The Gingerbread Man:
I tested on my hammerhead and the locking / unlocking works but about to go to work so can't try tamper flag. The ui is fine, just make make it so scrolling can be used to access the lower part of the screen.

This is worded slightly better and very close to your wording

Some devices contain a tamper flag inside the boot loader to check the device status.

Unlocking the boot loader allows you to change the tamper status.
[Samsung Galaxy Nexus] efrant:
All functions work fine on the N5.

I agree with The Gingerbread Man with regards to landscape mode: if you add scrolling, it will be just fine.

As for it being ugly, that's subjective, and I've never been the one to judge the look of things if they functions properly. To be honest, it looks fine to me.

I'm still thinking about the wording.
[Samsung Galaxy Nexus] segv11:
New beta with scrollbars

Here is a new beta that adds scrollbars as needed.

https://code.google.com/p/boot-unlo...ail?name=net.segv11.bootunlocker.1.5beta3.apk

Doing this required a major change of the layout code, so please help me test on various devices (not just N4/N5) in both orientations to make sure that I didn't break anything in the layout.

I didn't change any of the wording yet.
[Samsung Galaxy Nexus] The Gingerbread Man:
I tested all functions on my flo and hammerhead. Lock and unlock work, changing tamper flag seems to work but not able to test with a PC. Tamper state doesn't appear on flo (which is correct as it doesn't need it). Everything seems to work and no force closing, scrolling works so two thumbs up from me
[Samsung Galaxy Nexus] osm0sis:
Works well enough on the GN. The root prompt seems to take a little longer than I remember it did before though; any reason I might be seeing that?
[Samsung Galaxy Nexus] efrant:
Confirmed working on the N5 in both layouts.
[Samsung Galaxy Nexus] segv11:
I think the verdict was that although deb/flo have tamper in fastboot oem device-info, the tamper flag is never actually set by the bootloader. Thus I didn't include it in the app. If we learn otherwise (and get the offsets), it is not a difficult change to make.

Thank you for the testing.

Thank you for the testing.

Yeah, I noticed that the first root prompt takes longer than before, on all devices not just on the devices with tamper flag

management. I'm not quite sure why since the code path has not changed that much for the non-tamper devices... unless the new layout hierarchy takes a while.

Thank you for the testing.

I'm going to wait a little longer to see if bugs come up (or if we as a group can come up with better wording for the tamper flag management).

If there are no issues, I will likely push a version to the Play Store later today with the existing wording, then push an update with

improved wording later.
[Samsung Galaxy Nexus] osm0sis:
What is the tamper text? I don't have a device with it but I'd be happy to help with the wording. :)
[Samsung Galaxy Nexus] segv11:
Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] osm0sis:
Tamper Flag: Untampered

Some newer device bootloaders set a tamper flag if it has ever been unlocked/altered. BootUnlocker allows you to change this state.
[Samsung Galaxy Nexus] segv11:
Nexus 7 support and tamper flag management (on N4 and N5) are published.

A new version with deb and flo (Nexus 7 2013) support has been published to the Play Store.

This version also includes the tamper flag management for Nexus 4 and Nexus 5.

Thank you all for your research and beta testing. Thank you especially to osm0sis, whose suggested wording I adopted for the tamper flag management.

EDIT: Apparently osm0sis changed his suggested wording; I implemented the older one. Once the app has propagated, let me know if we think it's worth changing. A new build with updated string resources is not much work.
[Samsung Galaxy Nexus] Taomyn:
Does this mean you have to unlock the boot loader in order to change the tamper status, i.e. I have already unlocked the loader etc, then relocked it with the app. I would now have to first unlock it again in order to reset the tamper flag?
[Samsung Galaxy Nexus] segv11:
Tamper flag and lockstate are controlled separately. If you have v1.5.1 on a Nexus 4 or Nexus 5, you should see what I mean: one row of buttons for lockstate, and another for tamper flag.

Version 1.5.1 was pushed to the Play Store a couple of hours ago; it may not have arrived on your device yet. You can download and install the APK from Google Code if you prefer (link is in the OP).
[Samsung Galaxy Nexus] osm0sis:
Yeah I made it closer to what you did for lock state. I like both though. Just changed my post back. :)

P.S. Could a brother get a thank you in the 2nd post? ;)
[Samsung Galaxy Nexus] Ronaldo Forenucci:
Just wanted to say thanks for figuring out Flo! Running this on my N5 (and GNex before that).

Osm0sis: I really wish you'd get an N5 and head over to Franco N5 :) Good to see you.
[Samsung Galaxy Nexus] abhi98228:
how to root nexus 5 when the bootloader is loacked
[Samsung Galaxy Nexus] RusherDude:
The reset tamper feature is awesome!

Thank you!
[Samsung Galaxy Nexus] segv11:
A user was confused by the first wording. I'm gonna change it to the second one.

Which post needs a thank? EDIT: nvm, my contributors list was WAY out of date. Probably still is. If I missed anyone, please let me know.

Something is not quite right with root: we've all noticed it take too long to prompt for root on first run, and a user with Koush's Superuser sent a message that it is not prompting at all. That's gonna be an annoying bug to track down...

Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] efrant:
This is what I've noticed: when i start the app the first time, I get prompted for root access (with no delay by the way). Then, I see no other toasts when locking/unlocking/etc. However, once I rotate my N5 to landscape, the superuser toast appears. (I am currently using Chainfire's SuperSU.)

P.S. I think osm0sis was asking about thanks (i.e., credit) in post #2 of the thread. ;)
[Samsung Galaxy Nexus] osm0sis:
Thank you sir. N4 (partially), N5 and N7 2013 under my belt now. Pretty pleased. :)

You might want to mention that the N7 2013 is the only one that uses 02 to denote unlocked to complete the How It Works section as a reference though.

I guess it was the true/false part that confused the guy eh? I suppose you could just make that Tampered / Untampered and that'd cover it. Updated my previous post again. :good:
[Samsung Galaxy Nexus] segv11:
Android Police noticed us again:

http://www.androidpolice.com/2013/1...per-flag-modification-on-nexus-4-and-nexus-5/

Sent from my stock 4.4 Manta.
[Samsung Galaxy Nexus] osm0sis:
Nice! And my N7 '12 thread got linked as a reference again. :)

May I suggest the following reword for the 2nd post? Just to make sure all the info's there:

BootUnlocker for Nexus Devices avoids using "fastboot oem unlock", with its associated "userdata" wipe. When fastboot unlocks, it updates a lock status flag, stored on a partition of your device's internal storage. Device partitions, positions and state values (locked/unlocked) are as follows:

On the Galaxy Nexus, the bootloader uses position

0x000007C

(124 decimal) of the "param" partition, stored as 01 / 00.

On the Nexus 10, the bootloader uses position

0x0000224

(548 decimal) of the "param" partition, stored as 00 / 01.

On the Nexus 4 and Nexus 5, the bootloaders use position

0x0004010

(16400 decimal) of the "misc" partition, stored as 00 / 01.

On the Nexus 7 (2013), the bootloader uses position

0x04FFC00

(5241856 decimal) of the "aboot" partition, stored as 00 / 02.

The Nexus 4 and Nexus 5 bootloaders also keep a "Tamper" flag at position

0x0004014

(16404 decimal) of the "misc" partition. It is stored as 00 / 01 (untampered/tampered), and can be viewed using "fastboot oem device-info". BootUnlocker for Nexus Devices can set and clear this flag too.

BootUnlocker uses root privileges to write to to the appropriate location directly, bypassing fastboot. This allows you to lock and unlock your bootloader from within Android, without wiping your "userdata" partition.

The technique used was discovered through the efforts of several contributors on another XDA thread: http://xdaforums.com/showthread.php?t=1650830&page=13

Special thanks go to those who posted raw images of their device partitions, helped with/conducted the analysis, or put their devices in harm's way to beta test: efrant, osm0sis, iuss, Archpope, AdamOutler, NCguy, Raftysworld, Mach3.2, Meep70, and others. This application could not have been written without their contributions.

To learn more about how this app works, and plans for future functionality, follow this project on Google Code: https://code.google.com/p/boot-unlocker-gnex/