yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] Droidriven:
My current device is a J767VL, until two days ago, we that have this device have been stuck dealing with a locked bootloader, no OEM unlock option in settings at all and no rooting tools with exploits worthy of rooting this device. Two days ago, I discovered an engineering firmware for this Straight Talk device, S767VLUDU4ASG1, last night, I found an older engineering firmware S767VLUDU2ARJ1. An hour ago, I found another for the TracFone S767VLUDU2ARI3.

I know for certain that the Straight Talk U4ASG1 firmware has the OEM unlock setting and can be enabled with no issue.

The question now is, how to determine whether that is enough to allow TWRP or Magisk to work. Typically, with OEM unlock enabled, I would think that TWRP or Magisk would work. But, there is a similar J7 Refine that was rooted using a temp root that has to be re-enabled at every reboot, they said they did this because they couldn't use TWRP or Magisk because sboot wouldnt allow it every time they tried, they devised a method using engineering files. It is worth mentioning the one difference, for some reason, their device was using engineering software and had the OEM unlock setting, but it is greyed out. Not sure if they've tried the date/time change trick or not.

TLDR, what I'm trying to do now is figure out how to determine what state my device is in with this engineering firmware? It has the OEM unlock setting, yet, another user with this device that I've been discussing this with, enabled this setting but is still having issues flashing and making modifications. They got impatient and flashed the engineering firmware, then flashed everything except BL from the most up to date firmware for this device, basically, flashed the newer stuff over the older engineering BL. Obviously, now they are soft bricked, stock recovery only, no download mode. There isn't much they can do from recovery, unfortunately. I tried finding a recovery flashable stock update.zip for this device so they could flashing it in stock recovery to see if it helped, but no luck.

I know this engineering firmware or the older U2 versions were intentionally built for developers to bypass restrictions for testing purposes on this device. How do I go about determining what backdoors I'm working with and how to go about taking advantage of these backdoors in order to possibly get TWRP and/or a Magisk patched boot.img flashed on this thing? I'm not used to dealing with this on my Samsung devices, all of them before this one didn't have a locked bootloader or at least had available resources and tools that worked regardless of bootloader. Not so with this one.

I had given up hope for this device until I found those factory test firmware, these lead me to believe that it might finally be possible. I'm trying to feel this factory test firmware out to see exactly what it will and will not allow me to do.

[MENTION=7644154]SubwayChamp[/MENTION], are you fimilar with using Samsung factory test/engineering firmware to achieve an exploit that can be taken advantage of?
[General Questions and Answers] Kalnon:
Thank you for the info. Running Nougat on it would be awesome. I will definitely look into that. I figured there would be issues with app compatibility on a version as old as Gingerbread.
[General Questions and Answers] Droidriven:
Yes, that is one of the firmware that I found.

Yes, I'm aware of RMM, that is why I mentioned the trick that involves changing date/time in system settings to bypass the waiting period and that I don't know if they've tried it or not.

Yes, the J7 Refine temp root that I mentioned used a method that used Eng Boot to achieve root, but, as I said, he has to re-enable root via commands at each reboot, they don't have persistent root.

The engineering firmware that I found are binary 2 (U2ARJ1) and binary 4 (U4ASG1). What is the significance of this, I've never had to deal with which binary my firmware has or not. Does the binary 2 firmware have less security measures implemented than the binary 4 firmware? If so, does this mean that the binary 2 firmware would be more likely to be rooted without having to jump through hoops?

I'm considering buying a used J7 like mine so I can test/troubleshoot a rooting method, one that is busted but still functions. I found one for $22 US.

There isn't a TWRP for this device, but, as with all of my other Straight Talk Samsung devices, it is a rebranded version of the Verizon J737V(j7topeltevzw), the Straight Talk J767VL(j7topeltetfnvzw) has the Verizon 737 model number stamped on the motherboard(s). The Verizon J7 elte variant has Exynos 7885 processor and the Straight Talk J7 has the same CPU architecture. Would you agree that it is more than likely compatible? Do you think it will flash if the OEM unlock setting is disabled? I'll wait for the used device to come in the mail before I try it though.

Just like with my other Straight Talk Samsung devices(they also had the Verizon model number stamped inside), this leads me to believe that I can flash the J7elte recovery without having to modify the recovery, provided I enable the OEM unlock setting before flashing TWRP. If I get it to boot TWRP I'll flash the Defex zip and the dm-verity/no-verity zips via TWRP. I read what you posted, what I saw stated that Defex was to be flashed after the device is rooted. Is this correct? Are the dm-verity and no-verity supposed to be flashed before or after rooting the device? Do I install TWRP then flash Magisk, then flash defex, dm-verity and no-verity? Or is there a different order of steps?

Thank you for the assistance, I'm just being very cautious. With the way Samsung is locking bootloader on modern devices and with all the security measures to detect/block root these days, these things make me skeptical, especially since I'm not familiar with most obstacles involved in rooting modern Samsung devices.
[General Questions and Answers] Droidriven:
It comes bootloader locked and all further updates get "more" locked. But, the engineering firmware isn't and can be used to downgrade where a standard carrier firmware won't allow downgrading. I believe what I am finding is a test firmware that is made to work on all TracFone variants(Straight Talk, Net10, Total Wireless, etc...), they all have the same model number but they are on different networks. Where each of them would have a different firmware because each MVNO of the Tracfone network would have different bloatware and extras specific to each MVNO, the test firmware isn't specific to any of them but is compatible with all of them. I found a U1xxxx(binary 1) firmware also.

I bought this device new, so I don't need to worry about FRP, but yes, I do know to remove the existing account before factory resetting. And in cases where I do , somehow, run into FRP, I have the tricks for fixing that, never had one that couldn't be bypassed.
[General Questions and Answers] SubwayChamp:
I also was thinking about that since these engineering firmwares have the ability to boot either way you can take advantage on it and patch the boot image using Magisk that inside and then put it again in the tar file and flash it to achieve root and/or additionally replace recovery with TWRP.
[General Questions and Answers] ahvazsmart:
I want change j610f imei on android 8 . how can do it?
[General Questions and Answers] :
That's highly ilegal for reasons that I don't even want to get into however, if you genuinely flashed a rom and the imei is not yours..

MobileUncle MTK Tool*

It's in the GPRS section tab.

Obviously you need to be rooted
[General Questions and Answers] deathgaze2497:
sorry wrong post
[General Questions and Answers] Droidriven:
Say this again, I don't quite understand what you mean.

Are you saying to patch the eng boot.img then put the patched .img in the engineering firmware .tar file, then flash the modified firmware package and/or TWRP also?

Would this work?

1)Flash the engineering firmware.

2) Enabe OEM unlock setting in the engineering firmware.

3)Modify the stock firmware file with a patched boot.img for root and TWRP recovery all packaged in one file to flash all in one shot.

Or

1) Flash engineering firmware.

2) Enable OEM unlock.

3) Flash TWRP via Odin.

4) Modify the stock firmware file to create a flashable zip to flash in TWRP to restore to stock while keeping TWRP and the unlocked bootloader from the engineering firmware intact. I'm assuming that depending on what is or isn't left out of the test firmware, I might need to flash the kernel or modem or other parts of the firmware via Odin or TWRP. Basically, get the unlocked bootloader on the device then rebuild everything else around it using .imgs and files extracted from the full stock firmware. I would prefer flashing what I need to rebuild via TWRP in order to have more control over what is getting applied and what isn't.

5) Flash Magisk via TWRP to root the device. Would I still need to flash defex, dm-verity bypass or anything else somewhere in this process? Before or after flashing Magisk via TWRP?

Or

Find a way to use the engineering firmware to get a patched boot.img flashed in order to gain root and get back to full stock but without TWRP.

By the way, I completely forgot that I have another J7 J737A, the AT&T sister to the Verizon J737. But, even though my 767VL(Exynos 7885) is a rebranded Verizon 737, for some reason, this J737A AT&T variant has Exynos 7870. This means that the Verizon 737 TWRP that I downloaded probably won't work on the 767. It's made for devices with 7870, my device has 7885.

But, I found a 737A eng firmware, I can try these steps on it since the existing TWRP that I have is made for 737 variants. And possibly port the 737 TWRP to work on 7885 devices.

What puzzles me is, how can my device (with 7885 CPU) be a rebranded Verizon 737 (it is supposed to have 7870 CPU) with that 737 model number stamped on its hardware components inside the device if the CPU in my device is different than the CPU that is supposed be in the device it was originally branded as? One would assume that the only thing changed is the branding and software on the device, not the hardware, especially not the CPU.

One more question, do you have a link to the recovery that you used on your 7870 device? The J737A that I want to experiment on is a 7870 device. I found a TWRP for a 7885 device, if my experiments work on the 7870 device, I'll do the same on the 7885 device. Also, I read that a 7885 is nothing more than a 7870 that has had the stock clock speed reduced. Would this mean that, in some way, the 7870 and 7885 are cross compatible?
[General Questions and Answers] DragonFire1024:
I have downloaded several different kernel sources from GitHub for exynos3475 and or universal3475 and if I disable anything related to security, mainly selinux, and rebuild the kernel, flash the device, it will not boot. Either I get stuck at the splash screen that says 'Galaxy on5' or if I manage to get past the booting, I get stuck at the end of the boot animation so the system hangs. I have switched the boot.img-zImage with the compiled zImage, renaming it to boot.img-zImage, I have done the same with the newly compiled DTB image too. I even tried swapping and renaming the DTB image with boot.img-dt. I know there is a configuration to disable Samsung root detection and defense, when building from source (make menuconfig), which I make sure isn't selected each time. I started with disabling the selinux boot parameters, build, flash, boot hang. I tried disabling selinux altogether and he same. I even made sure to unselect the 'different security types' to no avail. So I removed the boot.img-tailtype and although it says the 'kernel is not SEAndroid enforcing', when it boots, you go into settings and developer options then software info, it still says 'seandroid enforcing'. I'm at a loss. I've only managed to come across one boot image that was permissive and I can't find it and I don't have a link to where I got it from. Any advice at this point would be appreciated.

I also set the tima and knox props in the build.prop to false/0, and those disappear from the same section in settings.
[General Questions and Answers] Droidriven:
Is the device already rooted? Or are you modifying the kernel to gain root? If already rooted, won't the SeLinux Switch/Selinux Toggle app serve the same purpose? Or does your stock kernel not support selinux permissive at all and you're trying to add support to enable permissive?
[General Questions and Answers] Nokia_8_fan:
[MENTION=7644154]SubwayChamp[/MENTION], I sincerely hope I was not too much for you, I'm trying hard to figure this out on my own, even gone as far to create a separate thread for the emmc software download app, showing as much information of the current problem as possible, but no-one responded.

I guess no-one hasn't an idea why or not experienced my situation with the software either? :(
[General Questions and Answers] tek3195:
Hey all, I'm in need of a way to get root shell through stock-like recovery. I have a Huawei t3 8 kob-w09 that was a live demo and really cheap. Somewhere along the way I mishandled an UPDATE.APP for one of my other tablets and it wound up being installed via dload method to this tablet. Should not have happened I wouldn't think, they check for that, right? I got board firmware to flash sort-of, with chinese lang. and no touch but recovery that is stock android type instead of emui. Screenshot will be faster and it is permissive with # access. Problem is I can't get a shell to try and dd some stuff from sdcard in an attemp to rescue this thing. Tried a multitude of tools to no avail and dont want to drop money on hcu as it may not work either. Oh and I do mean it flashed the entire 3.9GB UPDATE.APP and not just a partition or two. So, can anyone shed some light on too many sym links in userdebug stock recovery? I sure would appreciate it or a link to good documentation.

Also it no longer boots the chinese home screen fastboot is possible if I dc the battery a few seconds, it just does not have a fastboot screen to confirm. adb works in recovery but as soon as out of recovery env I get hit with vendor keys and not authorized. And the firmware flashed was T3 10 AGS-WO9.
[General Questions and Answers] DragonFire1024:
I'm going to have to go with the second statement because the toggle switch does not work at all. I have finally actually been able to get the kernel to compile and boot. However again despite removing or on selecting the options for selinux to boot, the setting still says enforcing. I even was able to make a selection that says make selinux NEVER enforcing. However the result is still the same. By the way the source I'm using now is the kernel source for TWRP. https://github.com/jcadduono/android_kernel_samsung_universal3475/tree/twrp-6.0
[General Questions and Answers] Droidriven:
Have you looked to see if there is a factory binary engineering firmware for your device? It has to be the same binary as your current stock firmware(i.e. binary 4, binary 5, etc..). These usually have a stock kernel that natively supports permissive. The J7 that I am currently trying to exploit has a factory binary firmware with a permissive kernel. Maybe the kernel from the factory binary firmware(if one exists for your device) can be used to get you going in the right direction, whether it works as-is or if it can be modified to work with your current stock firmware.
[General Questions and Answers] SubwayChamp:
In the case OEM unlock option is visible this would be the first step but if it is grayed out or not present then to reboot to TWRP the first that have to be done is flash the RMM state bypass file otherwise device gets soft bricked.

So I think that the steps would be:

- Either patch the ENG boot and put it again inside the eng. firmware or also Magisk can patch the eng. firmware tar file and then flash it through Odin

- And first without installing TWRP see if device reboots fine. Better would be try to make only one modification at once (instead of boot rooted and TWRP)

- In the case something goes wrong then restore device with Odin and now try the other way installing TWRP

- Rebooting first to TWRP prior to system, flash RMM fixer (only in case OEM unlock was not set up) and then in order to reboot flash DM-verity

- Now reboot without root it.

- If all is ok reboot to TWRP again and flash just one of both; Magisk or Magisk-defex, probably the normal would be ok.

Probably a TWRP based on some TWRP for devices with Exynos 7870 could work, I´m actually using this https://xdaforums.com/galaxy-j7-2017/development/j730f-fm-g-gm-x-samsung-galaxy-j7-pro-t3835629

and I checked a TWRP for Galaxy A8 (Exynos7885) that eventually could be ported too https://twrp.me/samsung/samsunggalaxya82018.html
[General Questions and Answers] Droidriven:
I've installed the engineering firmware, enabled OEM unlock, then used magisk to patch the eng firmware file and flashed that via Odin. It fails when I try patching the whole firmware .tar, then I tried patching just the boot.img, recovery.img then flash that, it passes but remains no change, it just reboots into eng system like nothing happened.

I've tried flashing the eng firmware, OEM unlock then patching the 8.0 stock firmware .tar then flash via Odin, that fails also and triggers a secure check fail boot error in red letters in the download mode screen on the device. I had to restore the eng firmware via Odin to start over.

I tried flashing the eng firmware, OEM unlock then flash a TWRP from another 7870 variant but it gives a secure check fail recovery error in download mode screen, again, I had to restore the eng firmware via Odin

I've triggered unknown power reset mode a few times and triggered kernel panic mode but successfully restored to stock via Odin each time.

I've ported a 7870 TWRP using the stock recovery from the engineering firmware but I haven't tried flashing it yet.

I'm currently trying to see if I can port the 8.0 stock firmware using .imgs and files extracted from the eng firmware, such as boot.img, sboot.img, settings.apk(to retain the dev options and OEM unlock from the eng firmware). Basically, I'm trying to see if there is a way to get the eng bootloader to work in the 8.0 stock firmware while also retaining the OEM unlock option.

ADB and ADB shell work fine with the eng firmware and it also has permissive mode. I've considered booting into the eng system and then using adb shell to dd a copy of the 8.0 system.img over the eng system.img or maybe dd a TWRP.img

I have enough pieces of the puzzle that I "should" be able to get something to work.

OEM unlock is enabled, I don't understand how I'm getting secure check fails when I try to flash a magisk patched .tar or when I try to flash TWRP, shouldn't it be working? I've tried with normal Odin and with patched Odin.

I've also tried sideloading apps on the eng firmware, it isn't working. ADB push commands aren't working either. There is a package installer apk in the eng /system/priv-app but I can't install apps from storage. The eng firmware doesn't have a normal launcher/systemui, no browser, no file manager that can't do anything other than view the files in the user partition.

It just seems like there should be a whole somewhere that I can punch through. I don't have the necessary experience to get this deep into figuring out a way to mod a device. I'm pretty good at following things others have done, but I'm lost when it comes to blazing a new trail with no guides that apply to what I'm working with.
[General Questions and Answers] DragonFire1024:
Yes I think they call it a combination ROM or firmware. And I do have it and I have flashed it but I'm not sure what exactly I'm to do after that. since most of the files for this device don't exist on XDA anymore I've had to pick and choose ones off of Android file host. And I'm sorry if I didn't mention this but the device is a Samsung Galaxy on5. It is from MetroPCS and I hate to say up at so far I have not run into a MetroPCS phone that hasn't been a royal pain in the butt to root or unlock or otherwise. MetroPCS generally does not lock their phone but they go through a large amount of trouble to make sure it's a pain in the butt for you to do it.
[General Questions and Answers] Droidriven:
Don't flash the firmware, just extract the kernel from it. Then flash it by itself via Odin, if it will flash and boot, if it works, it will replace your current kernel with the permissive kernel. Or use the extracted engineering kernel to port the kernel you're working on. Or, decompile the kernel and compare it to the kernel you modified, maybe comparing the conents of two might help you figure out what isn't working.
[General Questions and Answers] DragonFire1024:
well I don't know if I mentioned this or not but I did manage to get the kernel built properly and to boot but even when unselecting the selinux options and other security functions such as root detection, it still says selinux enforcing. I have even removed the tailtype from the split_img folder, which says inside the file SEAndroid. All that does is tell me that be kernel is not SE Android enforcing when the device boots. However when you run the shell command getenforce, you guessed it correct. It's still enforcing.
[General Questions and Answers] Droidriven:
I know your modified kernel is booting, but maybe there is something in the way it is built/configured that is preventing it from making the switch, maybe it's just right enough to flash and boot but still isn't exactly right enough to work as you want it to.

It's hard to say whether the issue lies in kernel itself or if it lies in the devices security and settings. It boots, but is it working correctly at the kernel/software/permissions level?
[General Questions and Answers] SubwayChamp:
What I got of all these steps is that ENG firmware doesn´t admit altered files taken previously from in.

Regarding the recovery that you tried probably is not matching with the yours then Odin detects some error on the structure and refused to flash it or gives a fail, I guess you are trying now for your 7885 not for the 7870. And also a modded PrimceComsy Odin is recommendable to use https://androidfilehost.com/?fid=24591023225177749

And here I have a ported TWRP from the A8 that is based on ENG firmware for SM-S767VL https://drive.google.com/open?id=1z6CZ0iXCAI5HPICsQhfcsQOJyK18y7CM

If it doesn´t work we have to consider that it could make a difference where is ported the recovery from, probably from a totally stock and not from a ENG firmware works.

Comparing which of those steps is better candidate to get a good result between try to flash a rooted boot and try to flash a custom recovery I´m sure that is better to try the second option first of.

Other thing that you can try is replacing just the files/images inside the ENG firmware with those that are inside of your stock rom, the files left that you won´t find a correspondent are those that do the trick.

If we compare with old devices; yes, the ENG boot is (within other things) to gain some root privileges through adb and some things can be done with it, here an example from where probably you can take a look inside the bat files that was used to get root in the S7/Edge

https://androidfilehost.com/?fid=457095661767141717

https://androidfilehost.com/?fid=673368273298958289

I didn´t find in a quick search nothing similar to this for Magisk although this method that used Supersu can work at least till Oreo.

If OEM unlock is enabled it should work at least to get flashing it, don´t forget to untick Verify apps over USB under Developer options.

But I yet have a great dude here, If for example Tracfone locks bootloader (isn´t) then why OEM unlock can be unticked? This lead me to think that maybe great part of the trick to not allow unlock bootloader in various Samsung devices always resided there; just in the toggle, hidding it from the user.

ENG firmware doesn´t admit installing apps, probably data is unmounted? although it stays practically unusable this way.