yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S III] alquimista:
{i} Qualcomm USB Settings

There is a hidden UI:

com.sec.android.app.phoneutil/com.sec.android.app.phoneutil.SetPortUartUsbMSM8960

I found it and many others using Logging Checker by TevE. If I long press on that item I get this:

When I press the big "Qualcomm USB Settings" button I get this:

From what I've read, and I could be very wrong, this is how to access Qualcomm diagnostics over usb. Unfortunately, I don't know much about what to do from there. I know RNDIS stands for Remote Network Driver Interface Specification. And RMNET is Qualcomm's proprietary version of RNDIS for their phones. I assume DM means Direct Media as in DMA direct media access, but I could be wrong.

I haven't had time to have a go at talking to the device using any of the last three ports or combos of ports. Could we possibly disable Qualcomm Secure boot with this? I've seen instructions on how to do it using Jtag, but I don't have a Jtag set up. The reason I bring it up, is because as I understand it Qualcomm Secure boot checks for any changes to the bootloader. If we could disable it, then cracking the bootloader might be a bit easier.

Ta,

ALQI

EDIT: I'm working on a text list of all the hidden UI's but I haven't had time to put it all together.
[Verizon Samsung Galaxy S III] chadamir:
Alquimista, QPST will probably not give you the ability to get around the bootloader. DM stands for diagnostic mode. You can read certain info off of the phone and write certain info to the phone with it, but it's a pain in the ass to get working. The builds floating around online are really old, and predate this phone by a long while.
[Verizon Samsung Galaxy S III] alquimista:
Ta very much chadamir.

Well, I wrote a little script for launching IOTHiddenMenu, not that it'll be usefull but learning a bit of SL4A was fun:

import sys
import types
import android

droid = android.Android()
intent = droid.makeIntent(None,None,None,None,None,"com.android.hiddenmenu","com.android.hiddenmenu.IOTHiddenMenu",0x10100000)
droid.startActivityIntent(intent[1], False)

Its in python so you'd need to download SL4A and install the python interpreter to use it. It a fun little scripting layer though.

There's probably a much much simpler way to do it, but I like overcomplicated toys. ;)

Ta,

ALQI
[Verizon Samsung Galaxy S III] chadamir:
You just need to make a shortcut to it using anycut or your launcher under activities. It would be useful if we could get it working under cm10 or aosp generally though. I have yet to figure out how to put the phone into the right usb mode.

Edit: It's clear that these modes can be entered into via cm10 if you look at init.qcom.usb.rc . I'm just not sure how to make a script that won't break something.

Edit 2: Here is the script I used to get it working in cm10 :)

echo 0 > /sys/class/android_usb/android0/enable 0

echo 04E8 > /sys/class/android_usb/android0/idVendor 04E8

echo 685D > /sys/class/android_usb/android0/idProduct 685D

echo smd,bam > /sys/class/android_usb/android0/f_rmnet/transports

echo diag > /sys/class/android_usb/android0/f_diag/clients

echo 1 > /sys/class/android_usb/android0/f_acm/instances

echo rmnet,acm,diag > /sys/class/android_usb/android0/functions

echo 1 > /sys/class/android_usb/android0/enable

use that in gscript lite http://xdaforums.com/showthread.php?t=1785243 Based off of this thread.

Edit 3: Also, so it's clear you can use the mtp scripts in that thread to get back to normal.

Here are some things I found when comparing the nv data in cm10 vs stock. (I didn't go through everything)

Stock: NV item: 10 [NV_PREF_MODE_I],

NV_PREF_MODE_I 0: 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00

In cm10 it was 00 04

Stock: NV item: 442 [NV_ROAM_PREF_I], index 0

NV_ROAM_PREF_I 0: 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00

In cm10 it was 00 01

I'm not sure if any of those values are static or if they change.

Here is a list of what many of these refer to: http://read.pudn.com/downloads125/sourcecode/windows/comm/529045/CDMA测试工具v2.6.3/Include/NV.h__.htm

I don't know whether or not any of these will help with the RIL or anything else.
[Verizon Samsung Galaxy S III] natalic:
There are various items that may change due to the RIL. Roaming pref sets Home, Auto, Home A, Home B. The other settings I believe is the settings related to the *#*#4636#*#*...not sure I'd need to check.

I know a lot about CDMA, so if you find something you got questions about, just ask.

They have nothing to do with the bootloader.
[Verizon Samsung Galaxy S III] E:V:A:
Great work! What you are seeing (above) is the software controlling the internal micro-USB multiplexer (MUX), which is used to switch between application processor (AP) and baseband processor (BP). It decides whether you are connected with one or the other. However, unlike older SGS1/2, on the SGS3, using the Qualcomm 8960, has integrated the modem functionality (BP) directly on the same "chip" as the AP. (AFIK. Remind you I don't own a SGS3.) Which is far more complicated (hardware wise) although more integrated than before. In addition the SGS3 have several chip based switches and MUXes, which help control UART, MHL, JTAG and Audio over USB connectivity, including classic JIG values.

Thus when you do your "long press" on Qualcomm USB settings, you are determining the protocols allowed over your USB settings, remembering that you can have several layers of communication protocols over one physical USB connection. (Just connect your device to Windows and see what appears in Device Manager...) So basically I think you're just choosing what device drivers should be used (on the PC side) when connecting the phone.

What would be interesting is to see what drivers are used during Odin operation and/or Qualcomm modem tuning/setup operations...

All though very off topic, ultimately we would like to see how to communicate directly with modem by AT command set, using a local shell...
[Verizon Samsung Galaxy S III] xd.bx:
Hi,

People might be wondering, could the same unlocking techniques that worked on HTC phones be applied here?

The main difference is that most exploits (unrevoked/alpharevx) relied on the fact that HBOOT itself is not signed until late 2011 and could be reflashed through a software vulnerability in it. In addition, the XTC Clip exploits the vendor's normal mecanism for unlocking, possibly because they extracted an RSA key from the official SIM.

A more likely avenue of research would be to discover a vulnerability in the boot rom (the PBL) thus allowing forever untethered boot, as it could not be patched. However the PBL is a rather simple piece of code as compared to the boot rom that is found on iPhones, thus reducing the likelyhood of finding a vuln (it is also very quite old - 2006 ? and very well conserved between MSM revisions).

I have more faith in finding a vuln in the Samsung bootloaders, they are less studied and implement a crapload of stuff, however keep in mind they can be patched at any point in time.

As for me I don't care much for locked phones anymore, and have stopped buying them since I discovered my WildFire was locked, then unlocked thanks to unrevoked, then relocked by HTC through an update, then fully unlocked by XTC Clip. What a pain.
[Verizon Samsung Galaxy S III] alquimista:
Thoughts

I was thinking about QPST and the old WinCE hacking days. There may be some other tools that can be used, some specific to CDMA, I remember a samsung phone from way back in the day that I was modifying. I'll have to look into some old archives of mine, but it may produce something of use to us. I'll report back on that.

On another topic, is there anyway to disable QUALCOMM SECURE BOOT over USB? I've seen some older instructions for using JTAG on the MSM8660, but I don't have a JTAG set up, and I don't know the correct connections on the SGS3 board to DIY one together or even purchase a USB to JTAG adapter/kit.

Ta,

ALQI
[Verizon Samsung Galaxy S III] ooofest:
Not a substantive comment, so please remove - but, somebody has "edited" the topic tags with useless values.

- ooofest
[Verizon Samsung Galaxy S III] neyenlives:
I have heard, but do not know, that there may be plans to get one of the developer phones into Adam's hands to extract from. That may provide insight into how to disable Qualcomm Secure Boot no? Anyone care to shed some light on if this is still planned or not? Thanks
[Verizon Samsung Galaxy S III] AdamOutler:
I don't need another device. I want all of the partitions from a developer device and I'd like to work with someone who has one. Remote access via "WirelessADB" and the device set to be in the "DMZ" of a router would be sufficient for all tests I would need to do.

Just as an update, I'm slowly getting back to work. For those who were wondering, I packed up everything and moved. I have my stuff 90% set up. I'm just getting back on it. I'm working on compiling all of the Verizon GS3 exploits into a single CASUAL one-click package. Root, recovery, Busybox, Basic Hacking Tools.

Once I've got a CASUAL package put together I'll go through and read this thread again from start to finish and figure out what needs work... my mind is totally off-topic right now after a move. Time to get back to work. I hope to have some big news at the end of next week.
[Verizon Samsung Galaxy S III] qv775219:
I wanted to assist with finding a place we could exploit. I am working on fully decompiling aboot.mbm. At an early glance looks like I found some interesting lines associated with the hexadecimal locations. I am going to break it down a little more to see what else I can find. :cowboy:

00035A03 88 51 55 41 4C 43 4F 4D 4D 20 53 45 43 55 52 45 êQUALCOMM SECURE

00035A13 42 4F 4F 54 3A 20 45 4E 41 42 4C 45 00 51 55 41 BOOT: ENABLE.QUA

00035A23 4C 43 4F 4D 4D 20 53 45 43 55 52 45 42 4F 4F 54 LCOMM SECUREBOOT

00035A33 3A 20 54 33 32 20 45 4E 41 42 4C 45 00 51 55 41 : T32 ENABLE.QUA

00035A43 4C 43 4F 4D 4D 20 53 45 43 55 52 45 42 4F 4F 54 LCOMM SECUREBOOT

00035A53 3A 20 44 49 53 41 42 4C 45 00 00 00 00 51 55 41 : DISABLE....QUA

00035A63 4C 43 4F 4D 4D 20 53 45 43 55 52 45 42 4F 4F 54 LCOMM SECUREBOOT

00035A73 3A 20 4E 4F 4E 2D 53 45 43 55 52 45 20 42 49 4E : NON-SECURE BIN

00035A83 41 52 59 00 00 51 55 41 4C 43 4F 4D 4D 20 53 45 ARY..QUALCOMM SE

00035A93 43 55 52 45 42 4F 4F 54 3A 20 4E 4F 4E 45 00 00 CUREBOOT: NONE..
[Verizon Samsung Galaxy S III] pyrostic:
What about flashing all of the partitions from another phone in place of our own, then copying back our .efs partition (for imei and such).

I just feel like with having the same hardware as other carriers it shouldn't be all too difficult. I heard something about a bootloader from another phone being used but causing bricks. What if the bootloader is dependant upon matching up with another partition.

I know this isn't too technical just trying to think outside of the box.
[Verizon Samsung Galaxy S III] AdamOutler:
Go away. This was not intended to be a public release. It works great on Linux and Mac. I removed this because I'm not prepared to work on this and support random Windows users complaints.
[Verizon Samsung Galaxy S III] LLStarks:
Adam, did you ever get a chance to examine the VRALEC bootloader?

I'm curious to understand how and why recovery is ODIN-ready with that boot chain, but isn't with LF2 or LG1.

http://goo.im/devs/invisiblek/i535/VRALEC.bootchain.tar.md5
[Verizon Samsung Galaxy S III] dexter35803:
That is the way to access Qualcomm over usb as i just did it last night was able to successfully fully flash the phone to cricket with 3G and no need for an LTE sim card there is a lil more to it but it works very well and DM stands for Diag Mode which is used by QC devices to give access to the Diagnostic functions and reprogramming
[Verizon Samsung Galaxy S III] ericerk:
Less secure bootloaders you say, does that mean you can actually unlock it and not use kexec, or would the kexec still be in play?
[Verizon Samsung Galaxy S III] AdamOutler:
Alright... I seriously need a 1/2 decent processor manual.. We need to figure out how Qualcomm has adapted this BOOT_SCUR pin into this newer chip. This is from the MSM7XXX processor... A previous generation Qualcomm chip.

4.1 Secure boot configuration
The MSM7xxx device can be configured to boot in secure mode using the BOOT_SCURpin or the FORCE_TRUSTED_BOOT Qfuse.
■The BOOT_SCUR pin (N5) determines the boot mode of the MSM7xxx IC. TheMSM7xxx IC can be booted in secure mode and it then follows the boot processdescribed in the previous section. If the device is booted in non-secure mode,authentication of the boot code is not performed

http://www.scribd.com/doc/51789612/80-V9038-15-APPLICATION-NOTE-MSM7XXX-QFUSES-AND-SECURITY

I have a feeling if we can find a labeled processor pinout, busting up the security may be as easy as opening the device and cutting a board trace or popping off a resistor. We seriously need documentation. Hacking consists of Input, Knowledge of what's inside and Output.. We need at least two of these things. Right now we have 1/2 of output. We need a processor manual.
[Verizon Samsung Galaxy S III] papi92:
I found this so far.

https://developer.qualcomm.com/discover/chipsets-and-modems/snapdragon

Maybe an email to them would offer help
[Verizon Samsung Galaxy S III] qv775219:
Just a thought but if we can locate the boatloader signature validation string we can change the data return value to trick the validation process. For example:

(Please don't judge my example code it's for visual concept purpose)

Signature Verified returned 0 = No (abort)

Signature Verified returned 1 = Yes (update)

All we would have to do is change the data return value to equal verified on both options. Then we could load any boot.img we want. This works with several Windows applications for security verification. Editing it would be simple with a hexadecimal editor. Any thoughts?
[Verizon Samsung Galaxy S III] alexmason:
That wouldn't work would it. It is reading the signature at a hardware level. If we could modify the hardware sure... we could do what we want.
[Verizon Samsung Galaxy S III] E:V:A:
So we need to know how to read these Qfuse registers, before we can do much else. Then, if we are lucky,

we could by comparing what we can read, figure out what these registers are.

Here is a more readable summary of what Adam wrote above, as an excerpt from the document above;

"Qualcomm MSM7xxx Application note on Qfuses and security". (BTW. We're using an MSM8960.)

[SIZE=2][I][B]FORCE_TRUSTED_BOOT[/B][/I]: (Blow to a "1")

Override trusted/non-trusted boot mode input pin (GPIO95/BOOT_SCUR)
0: Do not override
1: Disable non-trusted boot

Blowing this fuse forces the PBL to authenticate the off-chip SBL.

[COLOR=Navy][B]2.3 Mode pin[/B][/COLOR]

The mode pin is used to determine whether the MSM device will boot in secure
mode from the on-chip PBL. The pin is available behind GPIO and cannot be used
as GPIO unless the corresponding Qfuse is blown.

[B]BOOT_SCUR[/B] (Input pin):

If this pin (GPIO 95) is enabled (high), it forces the SBL or any subsequent
code to be authenticated for security. This pin function is available only if
FORCED_TRUSTED_BOOT fuse is not blown, otherwise it is used as a GPIO.

[B][COLOR=Navy]4.1 Secure boot configuration[/COLOR][/B]

The MSM7xxx device can be configured to boot in secure mode using the BOOT_SCUR
pin or the FORCE_TRUSTED_BOOT Qfuse.

The BOOT_SCUR pin (N5) determines the boot mode of the MSM7xxx IC. The MSM7xxx
IC can be booted in secure mode and it then follows the boot process described
in the previous section. If the device is booted in non-secure mode,
authentication of the boot code is not performed.

The MSM7xxx IC is booted in non-secure mode when BOOT_SCUR = 0. When the
BOOT_SCUR pin is pulled to high (BOOT_SCUR = 1) then the MSM IC is booted in
secure mode and all subsequent code is authenticated. This configuration is only
valid when the FORCE_TRUSTED_BOOT Qfuse is NOT BLOWN.

The BOOT_SCUR pin functionality is shared with GPIO[95]. When the pin is used as
BOOT_SCUR, the GPIO functionality is not available.

The MSM7xxx IC can be configured to boot in secure mode by blowing the
FORCE_TRUSTED_BOOT Qfuse. If this fuse is blown, the SBL and any subsequent code
are authenticated for security. The BOOT_SCUR pin becomes meaningless when the
fuse is blown and does not need to be configured for secure boot. Once the
FORCE_TRUSTED_BOOT fuse is blown, the GPIO[95] is available for use
[/SIZE]

We may also be interested in the DEBUG_EN_KEY that is a customer specific key that

is used to enable debug features that have been disabled by blowing other Qfuses.

Here is a simple table for specific chip information/generations:

https://developer.qualcomm.com/sites/default/files/snapdragon-specs.pdf

How do we read the Qfuse registers?

Then a small a question and a half.

Is the Verizon SGS3 hardware similar to any other SGS3 "out there"?

Are the boot-loaders on all these the same?
[Verizon Samsung Galaxy S III] NegativeOne:
I don't believe so. I think people have tried flashing some of the boot files from Sprint because it's the only other CDMA one and it resulted in a very sexy brick
[Verizon Samsung Galaxy S III] E:V:A:
Just some more info to dump of my mind.

"Usage of system IMEM on AMSS8960"

In System IMEM there is a contiguous 4KB chunk used as shared memory between

multiple subsystems. the offset start address is 0x2A03F000, the below table

lists the detail.

[SIZE=2]------------------------------------------------------
Subsystem Offset Size (bytes)
------------------------------------------------------
BOOT 0x0 200
USB 0xC8 200
DDR 0x190 1024
EFS 0x590 200
HLOS 0x658 200
RPM 0x720 8
Unused space 0x728 12
Securemsm 0x734 512
peripheral debug 0x934 24
Image version info 0x94C 200
Unused space 0xA14 1416
BOOTROM 0xF9C 100
------------------------------------------------------
[/SIZE]

"Generate new private key with PHK (Private Hardware Key) in MSM7x30"

"QPST-Emergency Download Support"

I have no idea if any of this is of any use or help. We need to have a more clear approach of how to reach the unlocked bootloader challenge.

What has already been done (including results) and what need to be done?
[Verizon Samsung Galaxy S III] yosterwp:
I don't know if this will help at all, but after Googling for documentation , I came across this website from a comment from a post on the qualcomm developer zone thingy...

http://mydragonboard.org/faq/how-can-i-get-kernel-debug-messages/

I just stumbled across this link and thought it would be worth to share with the offset (no pun intended) chance that it would be useful. However, in the case that it is not useful, please remove this post if desired in order to keep the good thoughts flowing.
[Verizon Samsung Galaxy S III] E:V:A:
Do you know how to use IDA scripts to trace back, locate and identify various system/library routines/calls?

There's some old scripts around for iPhone reversing (still on ARM), that did this, but I have not seen any for Android... If you know how to use this, please share it. Here is an example of what I'm taking about:

"IDA Pro Signature Files for iPhone Baseband Reversing"
[Verizon Samsung Galaxy S III] E:V:A:
(Answer to old post.) You're most likely connected to the modem. Try to send some AT commands and look what happens. Try "ATZ" for example, also make sure you have your terminal set so that you can see what you type...
[Verizon Samsung Galaxy S III] LLStarks:
I can confirm that a device in ODIN or DM mode creates an /dev/ttyACM file.

Would it be helpful to establish a bounty for a service manual?

Do we need an I535 one or any LTE S3 (including TMo?).
[Verizon Samsung Galaxy S III] Rebellos:
These are signatures, not scripts. It helps IDA to automatically identify functions from libc and libc++ in binaries compiled with RVCT. Qualcomm tend to use RVCT for their firmwares. Might be helpful in AMSS analyse. I don't think it'll allow IDA to match anything inside bootloaders, but not sure.

Thanks anyway. ;)
[Verizon Samsung Galaxy S III] n64man:
I was able to get the Verizon Galaxy Nexus service manuals off of our work Samsung account a while back, I'll check later to see if the Galaxy S3 manuals are on there.. if anyone is interested. (not promising anything yet.. lol)
[Verizon Samsung Galaxy S III] lowg:
Yes but it's very barebones currently - xdaforums.com/wiki/Samsung_Galaxy_S_III/SCH-I535
[Galaxy Tab 2 Q&A, Help & Troubleshooting] KindleGuy:
I followed the instructions from http://xdaforums.com/showthread.php?t=1704668 and now I have a non-english Tab 2 10.1

How do I switch to English?
[Galaxy Tab 2 Q&A, Help & Troubleshooting] KindleGuy:
I figured it out from another forum

Change the displaylanguage

1 In the application list, select Settings → Language and input → Language.

2 Select a language.
[Member-Found Deals] forrest89sei:
Found a Awesome Deal on Screen Protectors for the Galaxy S III for Only $0.99 + Free Shipping!

Chromo Inc. 3X Crystal Clear Screen Protector Shield for Samsung Galaxy S III S3 - 3 Pack + Cleaning Cloth

http://www.amazon.com/Chromo-Crystal-Screen-Protector-Samsung/dp/tech-data/B008FONF4Q/ref=de_a_smtd

Product Features

Comaptibility: Samsung GALAXY S III

Shield and protect your screen from UV Rays, Scratches, Dust and Blemishes

Highest quality Grade A Film available on the market!

Anti-Glare & Anti-Fingerprint. Leaves no sticky residue!

Manufactured by CHROMO Inc.
[Member-Found Deals] KRAZYADROIDMASTER:
I will bookmark this for future reference.

If anyone orders this and uses this let me know how they are.

Thanks in advance!!!
[Member-Found Deals] chrischoi:
Thanks for sharing. I went ahead and ordered 2.

Seems like they always intro it at some sale price then spike it up later on.

I think it's better for $1.98 for 2 than $4.99 later on for one.
[Member-Found Deals] chrischoi:
So I didn't read the first post and assumed it was for 1 per .99 cents.

When I got them in the mail today, packaging was top notch in a bubble padded mailer. I was expecting 2 total. I ended up with 6. Seems to be cut great. Didn't put them on yet. So far so good.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] pvsgh:
Hi,

I want to know if there is any way to restore my tab to stock firmware? I can't find any links for GT-5113 ROM.

The reason to store the stock ROM is that I have installed CM9 on my tab and now I am unable to install Infected / Cleanrom. It hangs on Samsung boot screen after installing these roms via CWM.

Thanks.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] weltwon:
As you realized AFTER the fact, creating a thread in development means you have something to offer to others,

not asking questions. FYI: I stopped using CM9 ROMs a long time ago because they frequently contain MANY

hidden bugs, only work properly when loaded with certain kernels, certain CWMs ... bottom line is you're

just one of the latest victims. Try a factory reset. Then ODIN the CWM in my Root thread. Then install

the ORIGINAL v1.0 CleanRom. It's the best of current custom ROMs and NO, we still don't have a stock GT-P5113.

Glenn
[Galaxy Tab 2 Q&A, Help & Troubleshooting] kettont:
We had the same situation, so hope this help.

I used odin to flash the gt-5110 stock Rom followed the guide in restore stock rom in galaxy tab 2 general section .After flashed my model gt-5113 became gt5110...lolz then i flashed the Clean Rom v1.1 then my model was back to Gt-5113..now I decide to stay at stock rom because Cm9 sucks...waiting for Aokp official.

If have any question pm me, I'll think i can help your tab 2 back to stock.:D kettont@gmail.com
[Galaxy Tab 2 Q&A, Help & Troubleshooting] pvsgh:
Thanks, will try both the suggestions one by one.

The only problem with ODIN at the moment is that you can't reset the flash counter, I already have it at 3 :(
[Galaxy Tab 2 Q&A, Help & Troubleshooting] pvsgh:
Solved

Hi Glenn,

I was able to install CleanRom, by installing the CWM posted in your thread.

Thanks.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] KindleGuy:
When you flashed the 5110 rom, did you have a problem with the language (Mine is currently in a foreign language)?

if so, when you flashed the Clean Rom did your tablet revert to the proper language?

Thanks