yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy S 4 Android Development] fukenbiker:
documentation

American Telephone and Telegraph I remember when I got my first cell phone and you were able to dial 611 and talk to anyone even if it was Christmas day or the middle of the night it was 24/7 customer service oriented very good outfit then it turned into Cingular and then they changed the name back to AT&T. The tiered data plans replaced my grandfathered unlimited. Nothing good. Big international outfit not likely to fail but too big to care.

I want enough documentation to create a class action until AT&T unlock the bootloader so that we can obtain complete control over the handsets that we purchased and own
[AT&T Samsung Galaxy S 4 Android Development] alacrify:
Did you purchase or get it subsidized? Unless you paid full price, it's not "yours". I'm willing to trust the devs here to help me work around their stupid restrictions when it saves me $500 or so...

You might look at the Oppo 5 - it's pretty sweet, reasonable price, and then it would be "your phone". And some great devs at CM (Entropy512, anybody?) are already making cool stuff with it.
[AT&T Samsung Galaxy S 4 Android Development] Phoneguy589:
While I agree with your statement alcrify, to me, I'm entering a 2 year payment agreement as "the remaining" payment for the device. The say if I end the contract early I would have to pay $350 plus $10 per month for non use. No where does it state that I must return the phone so it is there assumption that by accepting the terms, the phone is indeed mine... Or end users.
[AT&T Samsung Galaxy S 4 Android Development] alacrify:
Then it's a lease to own, and just like a car they get to set limits to what you can do to it until you own it outright.

Sorry for the off-topic.
[AT&T Samsung Galaxy S 4 Android Development] Phoneguy589:
Only difference is the carriers don't repo your phone or ask for it back, you're stuck owing the contract amount... They sell refurbished phones but not preowned ones. Also with a lease, car wise, you're allowed to do whatever to the car so long as it can be returned to its original condition when returned. So to me, as long as I can re lock the bootloader or flash back to stock then it should satisfy the lease term. Besides, once your warranty us up, they won't give you a new one after the first year, they should warranty it for the full two year contract.

Lol, sorry about derailing the thread. ;)
[AT&T Samsung Galaxy S 4 Android Development] fukenbiker:
derailing thread

my fault
[AT&T Samsung Galaxy S 4 Android Development] Unknownforce:
[MENTION=3682533]AdamOutler[/MENTION] and/or [MENTION=4229979]djrbliss[/MENTION]

I'm very interested in decompiling bootloaders, SBL's and such. You guys seem to be very well versed in it. I'm interested more for personal development, but I'm also interested in helping the community as well. Can you provide me a good starting point to learn these things?

I understand that much of these kinds of things are "confidential" but I'm not looking for the answers or "OMG how did you do that," I'm just looking for a starting point to learn these things on my own.

I know a little bit about reversing, and I know a few programming languages fairly well. I'm a fairly quick learner, plus I'm all about trial and error, I think there's no better way to learn something. But with that, I wouldn't bug you much after I get a decent understanding on where to begin.

I appreciate any help.
[AT&T Samsung Galaxy S 4 Android Development] fresh_TD:
this definitely should of been sent via PM...
[AT&T Samsung Galaxy S 4 Android Development] Unknownforce:
Sure, if they accepted them. But they don't accept PM's. Well at least Adam doesn't.
[AT&T Samsung Galaxy S 4 Android Development] Peoplearmy:
Can a mod or someone close this thread so that it does not get flooded with unrelated posts and requests? It seems the thread is taking a shift in a different direction and we need this thread to stay on topic. Thanks.

DX
[AT&T Samsung Galaxy S 4 Android Development] jeboo:
You can start with an ARM disassembler. IDA is a great option if you can find a "trial" version..After that it's mostly deadlist analysis unless you have advanced equipment (jtag, etc). Then find previous exploits to get an idea of the structure/protections. Dan's motorola essay was a great read.

After this ATT fiasco, I'm definitely getting a jtag..
[AT&T Samsung Galaxy S 4 Android Development] LLStarks:
A thought regarding the GS4 Google Edition assuming it's not a rare Exynos+LTE jewel.

Would it be possible for the entire bootchain (fastboot too?) to be ripped and flashed to any GSM Snapdragon GS4?
[AT&T Samsung Galaxy S 4 Android Development] Phoneguy589:
Does the exploit need to be specifically for this device or just the snapdragon/qualcomm chipset? I know the xperia z has the snapdragon s4 chip which is similar to the one used in our device. Being motochopper can root our device, maybe an exploit from another device with a similar chipset might work. (I'm not very knowledgeable in this area so please don't flame me :silly:)
[AT&T Samsung Galaxy S 4 Android Development] jesa:
Has anyone tried to Odin the I9505 Rom to the I337. Wouldn't that unlock the boot loader. I have been googling the different threads but nobody seems to know if there is a hardware difference that would cause an issue.

Being that the LTE bands are different, it looks like if we flash the I9505 then get into the service menu and turn on the right LTE bands then it would work and give us the unlocked bootloader.
[AT&T Samsung Galaxy S 4 Android Development] CZ Eddie:
http://xdaforums.com/showpost.php?p=41386752&postcount=269
[AT&T Samsung Galaxy S 4 Android Development] AxAtAx:
You can odin any of the other carriers, some things just may not work, I am saying now that the Tmo roms WILL run on our device.
[AT&T Samsung Galaxy S 4 Android Development] Wilcox12:
Am I the only one who noticed a few pages back when all the non dev related posts started all the devs left? Thanks guys!
[AT&T Samsung Galaxy S 4 Android Development] WackyJoe:
Sorry, IGNORE this post.
[AT&T Samsung Galaxy S 4 Android Development] jesa:
Knox software, anyone have access to the Knox management software? Since it is able to block the boot loader through "Customizable Secure Boot* Customizable Secure Boot ensures that only verified and authorized software can run on the device."

Can it be used to unlock the bootloader. Or is this available in the Airwatch console? when I look in Titanium Backup I see that there is a Knox apk on my GS4.

Since the Root of trust can be changed through it as it says on the Knox Web page " allows the switch of the secure boot root certificate in a secure manner after the devices are shipped" If we get access to it can't the bootloader be unlocked?

Just trying to learn and think ahead since djrbliss will probably have his released in a week, but if the Knox advert is right this would probably unlock any future Samsung boot loader locks or work arounds If this is how ATT is doing it.
[AT&T Samsung Galaxy S 4 Android Development] Bender B. Rodgriguez:
One would imagine that if you can switch or add a trusted certificate, that the device would accept a bootloader that was signed with the private key corresponding to that certificate.

My question is where in the hell is knox?? Samsung advertises it on their page, the dod had approved its use, but I see NOWHERE where it is available to download or purchase? Theres an app on the phone but how is it launched? Wheres the the documentation? Its like they implemented this feature, advertise it, yet theres little to no evidence of its use.
[AT&T Samsung Galaxy S 4 Android Development] alacrify:
Release was delayed until (possibly) July - they weren't ready at launch. It was in the news dumps when it went on sale in the US.

http://www.androidcentral.com/samsung-knox-security-suite-galaxy-s4-delayed
[AT&T Samsung Galaxy S 4 Android Development] Dean1650:
I speculated this same conclusion after reading the "white paper" on Knox. All of the S4 shipped have the software installed. Add in the BYOD campaigne and its difficult to overlook Knox as the source of the lock. There are 500k phones in the DoJ alone. Don't you think ATT and VzW would love some of that action? Recommend reading the white paper.

sent from my SGH-i317
[AT&T Samsung Galaxy S 4 Android Development] winco209:
verizon preorder shipped can we get unlock bootloader

When can we expect the reales
[AT&T Samsung Galaxy S 4 Android Development] mattdm:
1. Never ask for ETAs.

2. This is an R&D thread, and it has nothing to do with Dan's forthcoming exploit.

3. Never ask for ETAs.
[AT&T Samsung Galaxy S 4 Android Development] spectrumfox:
https://twitter.com/djrbliss/status/336500002316771328

[MENTION=4229979]djrbliss[/MENTION]: Successfully booted a custom recovery on the Verizon Samsung Galaxy S4 (thanks to a helpful tester). Look forward to a release soon.

:D
[AT&T Samsung Galaxy S 4 Android Development] eighty1:
Nice!
[AT&T Samsung Galaxy S 4 Android Development] slider2828:
I am sure people are jittering with for this release like a crack fiend.
[AT&T Samsung Galaxy S 4 Android Development] T41NT:
Can't wait to unlock and root my GFs gs4. Excited for the potential
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
It's unbelievable how this thread got destroyed by noobs. there's 10 pages of the exact thing that was specified as against the rules in the first post. If you have nothing to contribute, don't post.
[AT&T Samsung Galaxy S 4 Android Development] pj1000:
It was bound to happen. You've picked an exciting subject with not much going on that anyone feels comfortable talking about.
[AT&T Samsung Galaxy S 4 Android Development] fix-this!:
While i agee ,to be fair though. Whats to contribute as its a done deal. Were just waiting for a release.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
You don't need to be posting here. The OTA patch is also a done deal. It may have a two-month lifespan at best. You may unlock your phone but the vast majority will not be able to use [MENTION=4229979]djrbliss[/MENTION] 's method. What is needed is a permanent hack for those who decide that in two years from now that they need to upgrade the kernel.
[AT&T Samsung Galaxy S 4 Android Development] djrbliss:
I could also really use a magic wand that automatically roots and unlocks every phone you point it at.

I don't really understand what you're getting at here. Unlocking the bootloader in this case requires manipulating the software running on the device in some way unexpected to the developers of that software. It's common sense that if users install software updates or purchase phones that contain updated software, they may not be able to take advantage of this hack.

In other words, because the status of whether the bootloader is "locked" or "unlocked" is entirely dependent on the software running on it (i.e. there is no magic QFuse to blow to unlock it), which can always be updated, there is no such thing as a "permanent hack" for this phone if you insist on installing updates.
[AT&T Samsung Galaxy S 4 Android Development] LeKtRiCzzz:
So as long as we don't update the bootloader shall remain unlock?
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
What I'm saying is this device has no magic bullet like the Exynos4412 where its a matter of figuring our how to deploy said bullet. We may be able to find one. These users are posting as though you've found the end-all be all thing... "Its a done deal" is not the right attitude. This device will be patched over. On the Exynos 4412 "its a done deal", not this device. They can blow the magic Q-fuse and its all over. There may be something though.. Like Knox.
[AT&T Samsung Galaxy S 4 Android Development] slapdaddy:
But the only way to blow the Q-Fuse is to install an update provided by Samsung or AT&T. So as long as we (current owners) do not install any updates, we should be fine for as long as we own the device, correct?

Sent from my Galaxy S4.
[AT&T Samsung Galaxy S 4 Android Development] mg2195:
Yes, you sir are correct :)

What Adam is gettin at is that people who get the phone later on will not be able to use djrbliss exploit...it will likely be patched...he's not worried about current users, he's worried about future users...what's so hard to understand about that people?

Let's all take a deep breath, read, read and read again...and let's get this thread back on track...Adam literally posted about how people weren't following his rules and then people replied to it not following his rules for this thread...come on people...you quote (referring to others...not you) a post that says if you have nothing to contribute than don't post, and in that quoted post you don't contribute

-sorry for adding to the mess Adam...just trying to help get your point across

To other users, there a nice bootloader discussion thread in the general thread, although its by djrbliss it is now a general thread and I feel its the best place to post about anything bootloader related :) -and please no one quote or reply to this post
[AT&T Samsung Galaxy S 4 Android Development] :
Not to be such an asshole but why would it be his problem if the exploit gets patched. Its kind of ridiculous to bash Dan for it. He's doing great and found an exploit or whatever it may be...that no one else has. If you think of it iPhone users are always with the same demise. There's a jailbreak. Apple is on top of it and patches it in 3 to 6 weeks. And all phones are updated and a new batch is sent to retail within a couple of months. Still thousands jailbreak, obviously continuation of this thread is necessary as its a means to more of a permanent procedure to an unlock, but no one needs to point fingers. Each dev contributes and that's all that matters. We should think about now as in a week or two down the road not months when the exploit Is patched.
[AT&T Samsung Galaxy S 4 Android Development] SlimJ87D:
J

No one is bashing Dan. Stop posting here before one of the nicest Devs decides to not help us in the future.
[AT&T Samsung Galaxy S 4 Android Development] BeansTown106:
Adams whole point is to find something that can help in the longrun.. aka u have a nice unlocked s4 for a cpl months and then u break it and need a replacement ur replacement comes in with the exploit patched u come back to this thread and wine more.. all hes trying todo is circumvent that.. and to make it so new users in 6 months and ppl who need replacements can unlock. Hes not bashing dan at all..

On topic sorta this whole knox thing wont we need a certain signature for it? Isnt it gonna be unlikely to get such signature unless were part of the dod isnt this signature gonna be just as hard to get as say samsungs private key? Just trying to understand knox because it sounds like it could be really good
[AT&T Samsung Galaxy S 4 Android Development] Thermalwolf:
From what I am understanding with KNOX, it shouldn't be to bad. It sounds like a dual boot to me. A secured kernel for your job life and an unsecured kernel for your personal life. I was thinking KNOX would allow us to still run unsigned code on the personal kernel while simply locking us out of the private kernel.

Just my theory, I'm probably extremely wrong lol
[AT&T Samsung Galaxy S 4 Android Development] alacrify:
Guys, read the OP - this isn't a discussion thread. Open one if you want, but please leave this to the devs.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
The secure kernel is the one we would target. Knox has provisions for government agencies to change the root trust certificate. If we can figure out how to change the root trust certificate to our own certificate, in theory, we should have total control of everything from the secure kernel on down.. Which, if the theory is correct, should be enough to run CyanogenMod or any other ROM while the unsecure OS sits idle.

There has not yet been enough information to confirm this possibility, but from the diagrams and arch overviews this appears possible.
[AT&T Samsung Galaxy S 4 Android Development] :
Do you think it'll possibly be easier to work with Knox once the software is actually released? I mean its in our phones but as far as I know the software isn't actually there.
[AT&T Samsung Galaxy S 4 Android Development] E:V:A:
I'm not clear on how Knox works, but the certificates cannot be "changed" since they are blown into Qfuses. However, there could be some Qfuse certificate space left over, to blow one of our own... Could you (or someone) check?
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
The Q-fuses would be what are blown when you change your root of trust. That's why we would need to have some sort of "development" certificate. From what I've read, the certificate starts off ad Samsung and can only be changed once.
[AT&T Samsung Galaxy S 4 Android Development] djrbliss:
I think you're making a lot of assumptions based on marketing literature alone (unless there's actual technical documentation that I'm not aware of). As E:V:A suggests, it's not possible to modify the trust root, since that is based in blown QFuses (which are one-way programmable).

However, it's absolutely possible for a vendor to change the certificate used by their APPSBL (aboot) to validate boot and recovery images, because this requires no modification to QFuses whatsoever - a vendor can simply sign and ship a new aboot that includes a different certificate for kernel verification. Knox may make this process easier for vendors in some way, but I really doubt there's going to be some sort of hidden mechanism that intentionally renders the entire trust chain useless.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
I'm looking at the same manuals that you are looking at. It is my understanding that the idea behind this is to have a secondary chain of trust. The primary locks the device into its own "native" security... what we're fighting now..

The secondary is intended to be used by companies to have their own security installed, for things like CAC access and custom kernels. This secondary security would not yet be activated on the device since the Knox software is not yet available.

Please take note of the following few paragraphs from "Samsung Knox: Whitepaper: An overview of Knox".
[AT&T Samsung Galaxy S 4 Android Development] KennyG123:
Thread cleaned

Been said a lot of times: R&D thread: Development contributions ONLY

Make a thread in General if you want to hang out like Twitbook but don't post here

Thank you for your cooperation

Friendly Neighborhood Moderator
[AT&T Samsung Galaxy S 4 Android Development] romracer:
I agree that my reading of the whitepaper was a similar understanding. I'm not sure I'd call it a secondary chain of trust and more an alternate root chain. One that can be activated only once. I think secondary implies the Samsung one would still be active, which I believe it would not be.

I was confused by some of the paragraphs you highlighted though in my initial reading. It seems to indicate the alternate chains "may" be activated at the factory. Does this mean that some phones may already have these spare QFuses (or whatever holds the root) may be blown ahead of time so there is no place to store the alternate? Its hard to say based on later lines implying it can be switched once by government agencies (or those that leak their software).

Another spin here may be the idea that Dan's exploit allows us to explore this alternate chain of trust more thoroughly. Presumably Dan's exploit has bypassed Samsung's chain of trust. By doing so, does this allow us to install that alternate chain without needing a properly signed program to do it for us? Who should be the holder of that alternate chain if it can only be changed once? We can't all be installing our own self-signed certs (if you know what I mean). I think we can't fully answer these until Dan's exploit is released (and hopefully a write-up, I loved the Motorola one). Hopefully the wait will not be much longer now.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
I've inferred the secondary CoT from Samsung's launch event where they stated it was possible to have a secure environment and an insecure one on the same device... One for work and one for home. That's the main stated goal behind Knox. So, one must assume that the only software currently running is the Samsung CoT. The secure environment has yet to be installed.
[AT&T Samsung Galaxy S 4 Android Development] slycog:
Has anyone considered modifying the existing samsung public key?

Obviously with OTP you're not going to unset a bit... but finding a private key that gives you a public key of all FFs or even a public key where every byte is >= the existing public key would in theory allow you to modify/resign the chain appropriately.

Assuming you're still able to write to the OTP area, this would be a lot easier than factoring the samsung key.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
I remember exploring this idea with the GS1. From what I remember, a public key of all 0xFs will match nothing while 0x0's will match everything. At the same time, modifying any EFuse will make your device refuse to boot the stock firmware. Its best to hold off on that until we figure out what Samsung Knox is all about. I'd bet it would be possible to obtain a key designated for development which will allow us to sign our own boot chain, modify the pit and relaunch a stock SBL from the modified SBL.. at least that would be ideal in case of wanting to return to stock.
[AT&T Samsung Galaxy S 4 Android Development] slycog:
Here's a more in-depth explanation of the cryptography: http://catid.mechafetus.com/news/news.php?view=340

You're right about the stock firmware, however the solution you're exploring with knox will result in the same thing.

One time switch to a secondary root cert implies you would end up having to resign the stock firmware assuming you don't just remove the signature verification and resign the modified components.
[AT&T Samsung Galaxy S 4 Android Development] AdamOutler:
Well, that's what I was saying about modifying the PIT. It would take a slight bit of restructuring, but basically we would want to replace the kernel with a "Seccond ABoot", similar to what we did on the Nook Tablet. We should then be able to simply move the kernel somewhere into the UserData. If I'm thinking correctly,

So...normally it goes

sbl 1-2-3-aboot-TZ-kernel-recovery--stuff--system--data...

So, security goes downwards in the chain and I've never seen it go upward. We need to break the chain at Samsung's bootloader, ABoot.

sbl 1-2-3-modded aboot with dropped security(possibly with EFuse protection, not sure if needed, Remove PIT references).

TZ -- resigned for dropped security.

aboot-- modded aboot will launch second (stock or modified) aboot.

recovery-stuff-system--data

kernel - reassigned in PIT to the end of the userdata.

sbl 1-2-3 -fake PIT references.

The device should be capable of accepting OTA updates as well as Odin flashes and SBL1,2,3..

There are of course some development flaws that would need to be worked out and we don't know how Knox will affect the boot chain, but this SHOULD be a logical way to do it as long as PIT is never referenced until the ABoot partition.

We would basically be using two techniques... [MENTION=4426306]bauwks[/MENTION] "Second U-Boot", and [MENTION=2918486]Ralekdev[/MENTION] PIT exploit, as well as a new fake update partitions for those partitions which serve no purpose except qualcomm security.
[AT&T Samsung Galaxy S 4 Android Development] fix-this!:
adam im not dev but i saw dans twitter post today about the tool he is releasing. i assume this is not a true user bootloader unlock but rather a method to circumvent it. seems like its more for the devs to use? please correct me if im wrong? i assume what you trying to do is find a more permanent solution?
[AT&T Samsung Galaxy S 4 Android Development] bhp090808:
Its official yayyyyyyy

https://github.com/djrbliss/loki

Sent from my Nokia 5120. Rocking it oldschool