yashsingh1/xdaforums huggingface dataset:
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Proweedsmoker:
So I was confused about this whole thing, however, looking in Djrbliss files, its a code and not an application.... So, please let me know if Im wrong, but, this is to be applied while Devs build up fancey goodies for the community, and really us "end users" dont need to worry about applying this somehow?

Since it can be patched, what will happen if the carriers force an OTA patch while on loki software?

Edit, Man I type slow.... Last question...

Say I wanted to install TWRP recovery... It will need to be loki patched, and how will we push the software to the phone itself?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spy890:
This is true. I was sort of just trying to clarify that to the guy asking the question that he doesn't have to patch anything, it's the developers that patch their releases.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
Bingo.

If you're running a community ROM like this is intended for, then your phone won't pick up carrier OTA's so there's no need to worry.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] niv3d:
Question... what is the benefit to using this method versus an actual unlock? Im honestly just trying to learn and understand.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] MrPlNK:
All this does is tell the bootloader than anything with Loki is okay to flash, just as if it were a samaung file, each rom will have this loki tag inside of it when it checks if it can flash or not, if it has it than it bypasses bootloader and proceeds to flash.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] djrbliss:
The biggest benefit is that this actually exists, and the other doesn't.

Also, there are some perks to not permanently modifying the hardware, such as not setting off any irreversible "warranty voided" flags. Note: I do not encourage warranty fraud in any way.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
Good explanation :victory:

---------- Post added at 07:02 PM ---------- Previous post was at 07:01 PM ----------

I just wanted to say thanks, by the way, great job and very good insight to be able to pick up on something like this.

And yeah we might never get a bootloader unlock...
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] xZip-:
Great job Dan. One question? Do the recoveries that you flash with loki stick until you ODIN to stock or flash another one or are they just booted to without flashing it to the phone?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] SysAdmNj:
Will that cm10.1 for the canadian version be advisable to flash now? I wish I still had the device I'd so try it :)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] StolenVW:
If your on att no...you have to Loki patch the boot.IMG first
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
No, the developer has to Loki patch it, and we will need to wait for a Loki-patched recovery.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] david.degraw54:
OUDHS recovery is already patched, now all we have to wait for is a patched ROM.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] fix-this!:
you rang?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
LOL, I cannot patch CM 10.1 for the life of me :| keep getting errors, arghhhhh
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] jawonder:
Can i do this on a Mac ? .
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
You might want to wait and let CyanogenMod patch their own release...

---------- Post added at 12:13 PM ---------- Previous post was at 12:12 PM ----------

Do what exactly on a Mac?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
Yeah, I was just trying it own for my own to try and 'learn' lol
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
Ahh, well good luck. I'm not one for compiling myself. :)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Entropy512:
From an initial reading his technical description, yes - it's a way to create unsigned kernels that have a payload which circumvents the locked bootloader by overwriting "secure" code with "insecure" code.

My initial reaction on my first readthrough of Dan's blog post (I need to reread it in more detail later tonight) is that it would be very easy for AT&T or Verizon to have bounds-checking of the kernel header added so it doesn't clobber the trusted code with untrusted code.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] jawonder:
Download and install the files .
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
It's not something you install. It's a set of tools for developers to use to patch boot.img files to allow them to bypass the bootloader check. You can apply it to your own boot.img files if you know how to, and yes that can be done using any operating system.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] kiru:
For us Canadian owners with unlocked bootloaders, can we just flash a LOKI patched custom rom normally? Or would we need to flash a unpatched version?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] djrbliss:
Loki ROMs are for AT&T and Verizon only. Flashing them to an unlocked device will cause boot failures. I'm not sure why you'd even want to try this.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] kiru:
Thanks...because most devs will develop for the AT&T version which hardware wise is identical to the Canadian. Just wants to get more options for custom roms :)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] CZ Eddie:
I'm having trouble with this step. I know it's something easy to fix, but I'm working on like five different things rt now and my mind is having trouble focusing on this.

Any ideas?

STEP #2 (what I can't figure out)

I've extracted the contents of the downloaded loki zip to the same directory as the motochopper exploit to take advantage of the ADB that was in there.

The first step goes fine....

The second step I get stuck. First I just extracted the zip contents to c\loki and that didn't work....

So then I extracted the contents into the previous Motochopper directory but it still didnt' work.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] shabbypenguin:
its actually a very easy fix, first install linux. compile a kernel. compile loki_patch.c.

then youll need to grab teh boot.img you compiled, your aboot.img from your device, and then you should be able to use loki_patch.c to flash a custom kernel you made.

if you would like to cheat you can instead just wait for a developer to patch a kernel they make and you can flash it in the recovery i patched :)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] jawonder:
Ok i see it now i was on the road while reading just got home to read it properly. Guess i'll wait .
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] BusyPooping:
alright.... cant wait
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] C13v3r0n3:
should be able to use cygwin with gcc to compile loki_patch.c and then run it from there, i am downloading the linux dev tools now and i am going to see if i can get it to work.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] MrPlNK:
Lol thats just how i understand it please correct me if im completely wrong, as i am no developer, and all of this is fairly still new to me.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] calvin35:
I'm kind of new to this and just wanted to make sure I understand correctly. After reading every post in this thread am I correct in assuming that this exploit is only for ROM and kernel developers and that as an end user the only thing I would need to do if I wanted to flash ROMs is figure out a way to install a custom recovery, root the phone and make sure I flash compatable ROMs and kernels with the exploit already aplied.?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
That is correct, this for rom, kernel, and recovery developers.

All we need to do as end users is to wait for Loki-patched roms, kernels, and recoveries.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] D00lie:
Can someone touch on what will be the compatibility of these loki Roms and us with already unlocked Canadian phones?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
You cannot use loki roms on the Canadian variant of the S4.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] D00lie:
Right then. I guess devs can just post two different files when releasing Roms? One that has been run through loki and one that hasn't for us Canadian folk?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
That's kind of the way it works now anyway. Devs will release different varients of the same ROM for each model/carrier.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] sd_N:
THANK YOU

Just a thank you for this. You are and have always been one of the great Devs in the community. Thank you.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] jesa:
Thank you so much The info and explanation are great info for all of us to learn. I was able to use your loki tools to make a .lok for twrp and flash it to my ATT S4 , Just need to test it now.

Thanks so much ....
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] wally3614:
BAM!!!!

deviantlife
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] iB4STiD:
lil problem, copied loki_patch to system/bin,

adb shell loki_patch

gives me an example

i type

loki_patch boot aboot.img boot.img boot.lok

then i get

[+] loki_patch v1.2

[-] Failed to open aboot.img for reading.

pulled aboot.img and its in the dir of adb, also tried to place aboot.img and boot.img in system/bin, but same error

trying to avoid using linux

what did i mess up ?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] alacrify:
Try ./aboot.img etc. otherwise not sure.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] iB4STiD:
thanks, still cant read it, hmm
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] mathieulh:
It is exploitable but I don't see why you would want to run a process as aboot on an unlocked bootloader, to set a few flags perhaps ?

Oh ! And when I say exploitable, that doesn't mean the Loki tools will work on other devices (different addresses are used for the check_sig() function among other things), not to mention it isn't called on unlocked devices so replacing it to your own code would have no effect, you would need to find some other function to insert your code to)

Dan, why did you call it Loki at all ? Are you aware that's the name of Samsung's daemon for ODIN on their devices ?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Jonnyredcorn:
Thanks for this Dan, even though I won't be getting an s4 for a few months I hope that I will still be able to use your exploit. If Samsung and/or AT&T & VZW think our community is too small to care about by locking the boot loader, hopefully they think we are too small to spend the time to patch your work.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] mathieulh:
I would like to add that .lok files are dependent on the targeted aboot it has been built for, because the header is built to overwrite the check_sig() function, the .lok file may not work on different aboot revisions even if the aboot is still vulnerable.

As seen with the loki_patch code, the tool searches through the aboot supplied by the developer for the function to patch:

/* Find the signature checking function via pattern matching */
if (fstat(aboot_fd, &st)) {
printf("[-] fstat() failed.\n");
return 1;
}

aboot = mmap(0, (st.st_size + 0xfff) & ~0xfff, PROT_READ, MAP_PRIVATE, aboot_fd, 0);
if (aboot == MAP_FAILED) {
printf("[-] Failed to mmap aboot.\n");
return 1;
}

target = 0;

for (ptr = aboot; ptr < aboot + st.st_size - 0x1000; ptr++) {
if (!memcmp(ptr, PATTERN, 8)) {
target = (unsigned long)ptr - (unsigned long)aboot + ABOOT_BASE;
break;
}
}

if (!target) {
printf("[-] Failed to find function to patch.\n");
return 1;
}

tgt = NULL;

for (i = 0; i < (sizeof(targets)/sizeof(targets[0])); i++) {
if (targets[i].check_sigs == target) {
tgt = &targets[i];
break;
}
}

if (!tgt) {
printf("[-] Unsupported aboot image.\n");
return 1;
}

printf("[+] Detected target %s build %s\n", tgt->vendor, tgt->build);

if (patch_shellcode(tgt->hdr) < 0) {
printf("[-] Failed to patch shellcode.\n");
return 1;
}

Therefore using a static address in the header once the function's location has been found, this means that unless the check_sig() function's address does not change, a .lok image will only work on a specific aboot version/revision, so keep that in mind.

Furthermore, thou it is probably not the case, I have yet to inspect whether or not the boot_linux_from_mmc() function is called prior to entering the download mode, if so, overwriting the wrong aboot address in memory may permanently brick your device as you would have no way of triggering download mode. (otherwise you should be safe)

That is probably why the loki_flash code contains a check to make sure the .lok image matches your device's aboot.

patch = hdr->ramdisk_addr - ABOOT_BASE + aboot + 8;
if (memcmp(patch, PATTERN, 8)) {
printf("[-] Loki aboot version does not match device.\n");
return 1;
}

Yet, should a developer wish to implement his own solution to flash .lok images to a device, it would be better to run an external call to loki_flash than risk failing some check and damage existing devices as it isn't just a matter of checking a hash and writing an image to a partition anymore.

In fact, rather than pre-patching images, I believe it would be better for wider distribution purposes to keep the images unpatched and have a (mobile odin like or run from adb) tool on the device that verifies the image, verifies the aboot, patches the image and flashes it.

Something to keep in mind I guess.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] StolenVW:
I was talking to Dan and other yesterday and he said this is something that could be built into the recovery so when you go to flash a zip that has a boot.IMG it will do the Loki patch on it then install...people building the recovery just have to figure out how to add it
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] shabbypenguin:
"To kernel devleopers, the anykernel update scripts will not work with loki patched kernels due to the way loki modifies the boot image. If you plan to use anykernel, you will need to update it to work with loki patched kernels."

-dees_troy

:)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] bhp090808:
Apparently you can flash tw based roms without loki patch as long as you flash a tw kernel with loki patch right after. Tmobile roms flash perfect. Tw only
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
Yep that's true
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] plwalsh88:
That's because, as it's been said many times in this thread by Dan himself, the Loki patch only applies to kernels and recoveries. Has nothing to do with the ROM.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] C13v3r0n3:
Use cygwin and during the setup select the Devel section and install everything from there.

After that you need to go to dans page and copy the code from loki_patch.c into a notepad and save it as loki_patch.c

after that you need to open up cygwin and place the files into the cygwin/home/<windowsuser>/kitchen folder (aboot.img, boot.img), cd into the kitchen folder from cygwin terminal and run the following command gcc loki_patch.c -o loki_patch .

after it finishes you should have a new file in your kitchen folder called loki_patch.exe, you can now run the proper command to create the boot.lok file.

you only need boot.lok if you are flashing anything other than a tw rom.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] RockRatt:
Dan is it pissible for kernel devs/rom devs/ whomever/ tbat are creating roms to have some kind of aroma installer or updater-script that would check the device to see if it NEEDS the .loki patch and if it doesn't it continues without adding it. But if it DOES need it then it will add it?

Basically I am hoping/wanting that roms and such could be created for any of the i337/i9505's and the checking in a script or otherwise will allow the community to share roms. I ask this because I have seen some with the i337m have flashed i9505 roms on their phones. So would be great if something like this can be worked out in the future.

Or will this kind of thing never work due to how the i337/verizon models and locked bootloaders bypassed work?

Sent from My Spiderman Themed I747
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] C13v3r0n3:
Post 97 talks a little about this.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
Its possible as far as I know but it seems difficult. Ive been trying to compile some roms for LOKI that I like but it seems that I need linux for that. Maybe I can use kitchen or something
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] djrbliss:
Yes, I encourage this sort of thing. I know ShabbyPenguin is working on making his recovery automatically Loki-patch any kernels you attempt to flash, so you can effectively flash unmodified update.zip files and the recovery will take care of everything for you.

It might be useful for developers to know that if you give loki_patch an image that's already been Loki-patched, it will just copy the input image to the output location. This way, things like ShabbyPenguin's recovery can always run the kernel through Loki patch; if the kernel wasn't patched, the output will be, and if it was already patched, no harm done.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Aou:
And this is what I'd be waiting for: a custom recovery that you can throw any kernel (or ROM w/ kernel) at, and it will automatically Loki-patch it prior to flashing it to your device. I would also like to see the same thing implemented in this custom recovery to patch nandroid backups if needed before restoring them.

Personally I'm okay with the stock AT&T ROM (now that I've frozen all the bloatware), so I'll probably be after a custom recovery for the sake of nandroid backups and kernel tweaks.

A bit off-topic: I know very little in regards to the partitions and size, but I would like to be able to increase the size of the data partition, and decrease the system partition whilst still keeping the device mostly-stock. I'm assuming a new kernel and ROM would be required here? Or just a new kernel?

Edit: forgot to ask... If we install a custom Loki'd kernel, can we simply flash the stock kernel back using a custom recovery without needing to Loki it, or must we use Odin to return to stock kernel?

Thanks!!
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] :
I can answer the first one. ( I think )

As far as I know, we cannot re partition our phones, I think it has something to do with the boot.img telling the phone how much data to allocate, which is why no matter how much bloat you remove its always pretty much the exact same amount of space. But you can probably free up some space.

Well what I did was nandroid my stock rom and that way when you restore it it restores your stock kernel as well.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] luigic81:
is there a step by step somewhere on how to download and install LOKI? I know this is addressed in the OP but I thought I saw a post somewhere that someone had made a step by step guide..? Or maybe I was drunk lol

I've looked through this thread a bit and followed the links on the OP but not sure exactly which files to download and where to go from there.

thanks in advance
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] alacrify:
Click on the github link in the OP - it's all there. Further discussion is searchable in the thread.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] supersixevo:
Hopefully someone can put together a tool that some of us that do not know hiw to use this dev tools will be able to flash custom recovery as with the sgs3.

Thanks for you great contribution Dan!!!
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Thermalwolf:
There will be something soon but to be quite honest it's not difficult AS LONG AS you do your research. Dan explains pretty well what needs to be done :)
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] spectrumfox:
That is brilliant, and this needs to happen.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] shabbypenguin:
check the dev forums :P
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] shabbypenguin:
ugh, you know how much work that is? after all that work to make it auto loki :P
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Bigtjmc:
So im trying to get this right. And yes I've searched the treads and been trying to keep but im out ran by so many post so my question is , im rooted and flashed twrp loki version do I still need to do this if the rom has the patch ? If not then I just open recovery and flash a rom and kernel ?
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] _Dennis_:
Ok let me break this down barney style:

Your phone's bootloader checks recovery and kernel (boot.img) EVERY time you turn it on.

Loki does not touch the bootloader, only thd kernel or recovery img.

It puts code in the recovery and kernel to load code (when the kernel or recovery is loaded) into the memory address that the bootloader will check to see if the recovery or kernel is signed.

This memory obviously is written to at each boot.

This means EVERY recovery or kernel MUST be ran through loki first.

Some ROMs include a kernel, those need loki.

Some ROMs do not include a kernel, those won't need loki.

All recoveries include a recovery (seems logical right?) and will need loki.

Loki is ran on a COMPUTER or within the recovery (in the case of kernels flashed in SOME recoveries). Loki is NOT a bootloader on your phone. Infact had you read LOKI DOES NOT TOUCH YOUR BOOTLOADER.

TL; dr

Recoveries need loki to be ran on them before you flash them.

With that said, the AT&T twrp on goomanager already has loki ran in it so it works.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Bigtjmc:
thank you for the break down and yes I read that many times I guess I just dont understand the term analogy

---------- Post added at 10:55 PM ---------- Previous post was at 10:52 PM ----------

I will keep reading i guess till I understand the whole process , I have the twrp and goo installed just got to understand it better. Thanks tho
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] TechSavvy2:
Pretty straight forward, thanks man :p
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Anthony04x:
You can flash the Loki patched ROMs like cm10.1, I'm running it. Just make sure its Loki'd and flash like you would any other ROM
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] attn1:
this just seemed obvious. http://tau.shadowchild.nl/attn1/?p=483
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] LeKtRiCzzz:
Even though this doesn't unlock the bootloader its pretty damn close enough. For everyone who says Dan doesnt deserve the bounty should be ashamed because if it wasnt for him we wouldnt be able to put all these wonderful ROMS or Kernals on the phone. Dan I appreciate your work and I applaud you
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] sk8trix:
So ive been readin alot on this whole unlocking prcess but its kind of confusing...

I am already rooted so can I just download TWRP from goo manager and flash that recovery to my S4?

I am not sure if the recovery is patched with the loki'd thing? any answers are apreciated
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] Intellectua1:
It is Loki'd I didn't even bother with this method. I just rooted my device and installed TWRP. It's way easier then trying to understand this message.. This is the TWRP link http://xdaforums.com/showthread.php?t=2262996
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] sk8trix:
ok I am about to just get twrp from goo manager I jsut wanted to make sure before i did ...lol dont wanna brick my phone like noob I rather get flamed on the forum and know for sure if this is a good isea or not