yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] ncope562:
From the research I have done today, Samsung already apparently patched the "master key" exploit mentioned by bliss for the s4 before it was released so I guess that one is out, sorry to be a Debbie downer.

Edit, sorry, the first master exploit was fixed for sure but the second master key that Dan mentioned, bug 9695860, may still be an option if it wasn't part of the new ota. Not 100% sure though. It also seems to be mostly a way to bypass signature verification of apps so not sure if it would help with bootloader or recovery issue but I could definitely see how this could be used to obtain root.

Edit 2, regarding the perf_event_open exploit, though I don't understand all the code behind it, seems like an exploit in the Linux kernel that Android works off to escalate privileges to root level on Linux versions prior to 3.8.9. From what I can tell Android 4.2.2 is based on Linux 3.0, so the exploit should work, but again it only would seem to open the root door and not the recovery or bootloader issues.

I'm not skilled enough to make these into root methods nor to make the pathway to an unlocked bootloader, I am posting just to try and kick start meaningful discussion and maybe inspire someone in case one day I'm forced to take the dreaded ota.

And thread dude, add me on for 10 buckeroos for either option. May the force be with you who have the skill to overcome the Verizon dark side.

Sent from my SCH-I545
[Verizon Samsung Galaxy S 4] Rebel908:
I see. I only ask because I know I was running Faux Kernel before hand so I was confused, because I had assumed the biggest hurdles had been dealt with, thank you for sharing the information :)
[Verizon Samsung Galaxy S 4] sokrboot:
Here's more info on the perf_event_open exploit. Maybe someone smarter than me can use it for the betterment of all mankind.

http://www.scip.ch/en/?vuldb.8744

More

http://sebug.net/vuldb/ssvid-60808

---------- Post added at 06:53 AM ---------- Previous post was at 06:44 AM ----------

Perf_event_open exploit for Samsung Note as of July 9th

http://pastebin.com/TLK9Qrgi
[Verizon Samsung Galaxy S 4] SmokeyMon:
Guys,

I understand that these documents are published elsewhere and the exploits discussed are fairly well known, but the less that is known about any potential exploit until it is put into "production" for our benefit, the better. It is best for all concerned for the developers to operate in the "shadows". You guys should take serious discussion private. I realize it may take a confluence of ideas to accomplish this.

The OEM updates -> We study, learn and exploit flaws in the security -> They study, learn and update to break our exploits. -> Forever!

The real problem here is that The OEM will eventually win. In time, they can make it impossible, or so difficult to do it is not worth it.

Forgive the analogy, but say it's a card game. You don't want to show your cards till you have to to win the hand.

I realize I am not inventing the wheel here just trying to offer a little perspective to those who may not work in IT.

I would like to kick up my offer to $25
[Verizon Samsung Galaxy S 4] PWM978:
O RLY?

Modified DooMLoRD's exploit (and lazily I might add). Anyway, not going to package this for the masses, but run in terminal and figure it out for yourselves ;-P
[Verizon Samsung Galaxy S 4] jcase:
The exploits discussed publicly are well known, and patches are already available to OEMs.

Both mentioned also present their own issues in use on the S4
[Verizon Samsung Galaxy S 4] cm0803o2:
This is what I did to get rid of the notification (root required):

After renamed FWUpgrade.apk, SDM.apk and their odex, deleted the zip file in /cache. The notification is gone without a reboot.
[Verizon Samsung Galaxy S 4] :
wow... Root method isn't impressive sorry to say that's a given. What I'm really waiting for is an unlocked boot loader. But it seems this will never happen ... got Adam outler and Dan and they cannot figure out how to bypass Knox (which is essentially the biggest problem) time to bring someone over from apple to work on this. hahahaha just kidding. Totally different OS
[Verizon Samsung Galaxy S 4] jcase:
Knox is not the issue, Knox isn't even enabled on this device by default. Where are you getting this idea?

Adam, for all he does, he does not hack bootloaders/write exploits, people should stop bugging him about it.

As far as Dan, go read his posts. He says nothing about not being able to figure out anything, more like he has a job and a life.
[Verizon Samsung Galaxy S 4] Southern_mind:
I'm hoping to try it tonight. I'll keep checking here though if someone else figures it out.
[Verizon Samsung Galaxy S 4] darthmuffin:
I'm in.

$10 for root, $50 for bootloader unlock.

I see people mentioning at least two methods of root exploits exist now, but I find it hard to believe that anyone who is doing this can't be bothered to take an hour of their time to document it in a repeatable procedure for $2700+. I call shenanigans.

Really want the permanent fix of a bootloader unlock, but it's not sounding like that's likely :(
[Verizon Samsung Galaxy S 4] PWM978:
I'll package something up with manual steps..... standby.
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Just curious, have you actually tested and confirmed working on stock VRUAME7 build or just made the modifications without testing?
[Verizon Samsung Galaxy S 4] Phobophobia:
There's no bounty for just root. The bounty is for root plus custom recovery (necessary to install a custom rom), which is much more difficult to achieve than just root. I'm assuming anyone who's achieved a root method is holding out until they can also get a custom recovery working.
[Verizon Samsung Galaxy S 4] Bakerboy448:
As per OP "Root and Recovery Bounty" IT is not just root only.
[Verizon Samsung Galaxy S 4] bfmetcalf:
am i supposed to run this in terminal on my phone, or on a linux box?
[Verizon Samsung Galaxy S 4] PWM978:
I am stock ME7, rooted.

Have a test, let me know.

Instructions in zip, just start sshdroid and ssh to device.... scp whole dir over to /mnt/extSdCard, run through serially (can't promise any typos), restart.
[Verizon Samsung Galaxy S 4] zagan131313:
Okay so this gives you root but are you able to use supersu because i read somewhere that the update lets you be rooted but it wobt give those apps permission.
[Verizon Samsung Galaxy S 4] bfmetcalf:
I get a permission denied whenever I try to run it on the device.
[Verizon Samsung Galaxy S 4] PWM978:
chmod 755
[Verizon Samsung Galaxy S 4] JamesPumaEnjoi:
To Thread....as of yesterday I told you I would update the thread when I received my warranty replacement device....I woke up this morning and it was sitting at the door for me, booted it up and it does not have the update on it....ill root it either tonight or tomorrow whenever I have the time to install CrUbuntu on my Chromebook....I would still like to keep my pledge for this thread however and I wish you all the best of luck with this never ending back and forth with OEMs....ill keep coming back and seeing whats going on with this thread because theres some outstanding people on here like Open1your1eyes0 and Jcase and others I failed to mention....if you have the chance to receive the warrranty replacement I would go for it only if you intend to still keep your pledge on this thread...Enjoy your day everyone and good luck I'll see you soon!!
[Verizon Samsung Galaxy S 4] bfmetcalf:
I tried that. I did it on the device, it just errors out because of permissions, tried changing it on my linux box, then moving over my samba share, still owned by root on the device, then tried adb push. Whatever I do it's always owned by root on the phone
[Verizon Samsung Galaxy S 4] :
Knox itself isn't the issue. But Knox is the main reason why the phones are so secure. So the united states government has a secure phone ,Samsung trying to compete with iPhone in terms of security... Anyways yeah Dan has a life but I don't get why people cannot understand how hard it is to unlock a devices bootloader... They really don't want it to happen so it'll take a while if ever for it to happen on this device if ever. Yes its happened before but this is different. It took 6 months for a jailbreak to come out and people own more iphones then a Galaxy s4 so just put that into perspective... Much more people work on the iPhone as well. Just an example.
[Verizon Samsung Galaxy S 4] BeansTown106:
try this if on me7 it "should" root you let me know if it works, doesnt work and what the output says if it doesnt work

https://dl.dropboxusercontent.com/u/59757245/jfltevzw-CASUALRoot-R734bBeansTown106.jar

all credits to this goto pwm978, doomlord, dan rosenburg, and adam outler. i just repackaged it. it is casual so should work on mac, linux, windows

PS. gotta love when theres thousands of people wanting root etc. and then you post a possible way and 15 mins later no one has replied.. im on mdk so i cant try but am anxious to see if it works lol
[Verizon Samsung Galaxy S 4] Tada10:
How do I run this on Windows please I am on ME7

Sent from my Galaxy S4
[Verizon Samsung Galaxy S 4] BeansTown106:
u need to have java installed then just right click it and hit open with java
[Verizon Samsung Galaxy S 4] lycwolf:
MY output:

[*] Waiting for device...
Waiting for ADB device connection. When your OS recognizes the device, we will continue. Don't touch anything.
[*] Device found.
[*] Pushing exploit...
79 KB/s (81016 bytes in 1.000s)
[*] Pushing root tools...
6531 KB/s (104500 bytes in 0.015s)
6536 KB/s (104500 bytes in 0.015s)
4245 KB/s (1919763 bytes in 0.441s)
[*] Rooting phone...

Device detected: SCH-I545 (JDQ39.I545VRUAME7)

Attempt acdb exploit...

SCH-I545 (JDQ39.I545VRUAME7) is not supported.

Attempt fj_hdcp exploit...

Attempt fb_mem exploit...

Attempt perf_swevent exploit...

writing address is 8335

Segmentation fault

installing superuser to system partition
/system/bin/sh: su: not found

/system/bin/sh: su: not found

/system/bin/sh: su: not found

done
Script Complete

Edit: Turned ADB verification off as well, same result.
[Verizon Samsung Galaxy S 4] jstoneky:
--GS4 Root--

This will install root for you Qualcomm based Samsung Galaxy S4

[*]

[*] Motochopper Meets Pref Exploit

[*] v1

[*] by Dan Rosenberg (@djrbliss)

[*]

[*]

[*] Waiting for device...

Waiting for ADB device connection. When your OS recognizes the device, we will continue. Don't touch anything.

[*] Device found.

[*] Pushing exploit...

4907 KB/s (81016 bytes in 0.016s)

[*] Pushing root tools...

5587 KB/s (104500 bytes in 0.018s)

5399 KB/s (104500 bytes in 0.018s)

5242 KB/s (1919763 bytes in 0.357s)

[*] Rooting phone...

Device detected: SCH-I545 (JDQ39.I545VRUAME7)

Attempt acdb exploit...

SCH-I545 (JDQ39.I545VRUAME7) is not supported.

Attempt fj_hdcp exploit...

Attempt fb_mem exploit...

Attempt perf_swevent exploit...

writing address is 8335

Segmentation fault

installing superuser to system partition

/system/bin/sh: su: not found

/system/bin/sh: su: not found

/system/bin/sh: su: not found

done

Script Complete
[Verizon Samsung Galaxy S 4] srphoenix:
I'll give it a try, how do you run the program? I'm coming from a Galaxy Nexus and just used WUGS toolbox for everything.

Thanks!
[Verizon Samsung Galaxy S 4] BeansTown106:
thanks guys looking into it now
[Verizon Samsung Galaxy S 4] lycwolf:
Look up.
[Verizon Samsung Galaxy S 4] jcase:
Im not even sure where to start. I think you are confused as to what Knox is. As far as thw number of researchers, I certainly disagree on that.

Sent from HTC ONE Z using xda premium
[Verizon Samsung Galaxy S 4] :
Having problems installing su binary into the system as far as I can see?
[Verizon Samsung Galaxy S 4] PWM978:
Seeing varied results. Anyone have a boot.img from the OTA? I flashed/exploited the following ME7 image via Odin:

SCH-I545_VZW_1_20130613171315_24s13crny1_fac.zip

Compared this to a boot.img sent to me, same offsets.

I'm not convinced there isn't deviation. Please let me know if you have a boot.img kicking around, I'd like to inspect this and verify.
[Verizon Samsung Galaxy S 4] Tada10:
I'm no smart guy but I noticed I can't even make a new directly under system bin is it because there is a file i there called sh?

Here's what I'm getting when I try to make a new dir for this beans root to push in.

/system/bin$ mkdir sh

mkdir: can't create directory 'sh': File exists
[Verizon Samsung Galaxy S 4] jorceshaman:
I'll up my amounts to 25/100. I didn't screw myself like some people but still like to know that my options are available.
[Verizon Samsung Galaxy S 4] hcu721:
Just got this phone for my birthday and excited as I was, I took the OTA. Poor me. Not sure how to share the OTA boot.img. Please instruct me. Thanks.
[Verizon Samsung Galaxy S 4] Protibus:
Here is the boot.img extracted from the OTA update zip, if this helps.
[Verizon Samsung Galaxy S 4] srphoenix:
I got the same output, updated adb drivers based on the universal ones from the galaxy nexus kit too. Thanks again beans for making some progress on this!

Also, would I get any different result from trying it while in odin or will it just screw something up from there?
[Verizon Samsung Galaxy S 4] :
Okay so what is Knox then? I thought it was a secured boot loader. Almost like a secondary one.
[Verizon Samsung Galaxy S 4] jcase:
Google is your friend until I get back from my trip (ie have a real keyboard and internet access). I will try to get a details explanation.

Sent from HTC ONE Z using xda premium
[Verizon Samsung Galaxy S 4] jab476:
count me in

I'm in for $20 for root access
[Verizon Samsung Galaxy S 4] TheSavageSquid:
sh is a binary used to run scripts. In the example from lycwolf, you do see bin/sh because sh is the program being used to run the scripts.
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Guys, I can officially confirm

we have root access

, thanks to PWM978's modification of DooMLoRD's exploit

See my personal results below as a tester on my stock VRUAME7 build:

Next step is beanstown106 is working on fixing his CASUAL application to make an easy one-click method for this exploit.

Remember the bounty is for root

AND

recovery. So nobody give your contributions just yet because when the person who creates the recovery method is going to collect, you will be responsible for submitting that contribution to them.
[Verizon Samsung Galaxy S 4] musicfreak190:
NO WAY I AM ON MDK and I am STILL SO EXCITED!
[Verizon Samsung Galaxy S 4] lycwolf:
It's progress folks! Yay. I see Root AND recovery not far off. Baby steps... :good: :D :D
[Verizon Samsung Galaxy S 4] Nathanias:
I know I'm late to join the game and honestly won't make much use of it but I'll donate 15$ to the man responsible for this root method :)
[Verizon Samsung Galaxy S 4] dvsgod:
dont know if this matters as of this point but heres my results on verizon s4 Me7

"--GS4 Root--

This will install root for you Qualcomm based Samsung Galaxy S4[*]

[*] Motochopper Meets Pref Exploit

[*] v1

[*] by Dan Rosenberg (@djrbliss)

[*]

[*]

[*] Waiting for device...

Waiting for ADB device connection. When your OS recognizes the device, we will continue. Don't touch anything.

[*] Device found.

[*] Pushing exploit...

564 KB/s (81016 bytes in 0.140s)

[*] Pushing root tools...

1273 KB/s (104500 bytes in 0.080s)

485 KB/s (104500 bytes in 0.210s)

1733 KB/s (1919763 bytes in 1.081s)

[*] Rooting phone...

Device detected: SCH-I545 (JDQ39.I545VRUAME7)

Attempt acdb exploit...

SCH-I545 (JDQ39.I545VRUAME7) is not supported.

Attempt fj_hdcp exploit...

Attempt fb_mem exploit...

Attempt perf_swevent exploit...

writing address is 8335

Segmentation fault

installing superuser to system partition

/system/bin/sh: su: not found

/system/bin/sh: su: not found

/system/bin/sh: su: not found

done

Script Complete"

so is exploit for all carrier models?
[Verizon Samsung Galaxy S 4] open1your1eyes0:
There are some kinks in the process for now so it is not entirely universal just YET but it does work 100% for those devices that are compatible like mine. Please standby as the folks responsible are working on making it 100% compatible for all Verizon Galaxy S4 devices (AT&T coming later I'm assuming).
[Verizon Samsung Galaxy S 4] :
LOVE IT! PROGREEEESSSSS! One BIG small step in the right direction :laugh:
[Verizon Samsung Galaxy S 4] Cruiserdude:
Awesome! Should make things much easier for folks trying to find exploitable holes in the boot process for bypassing the security check and at least getting another exploit similar to Loki. Not to mention prevent further updates for now, let's just hope they don't plug this hole as well.

Now that root is had, does anyone know if the dd command still works, or did they block it in this kernel?
[Verizon Samsung Galaxy S 4] bfmetcalf:
Do I have to run it with adb or can I run it from a terminal emulator on the phone itself?
[Verizon Samsung Galaxy S 4] SamuriHL:
First thing people should do after regaining root....DISABLE OTA checking! No one wants to find themselves in this position again, right?
[Verizon Samsung Galaxy S 4] flanger001:
I was just coming in to say that I'm in for $10 for root/recovery! Then I saw they got root! Awesome!!
[Verizon Samsung Galaxy S 4] TheSavageSquid:
Been watching for a while and realized I don't think I added anything. Count me in for $10 for R/R and $15 for the Boot loader.
[Verizon Samsung Galaxy S 4] dvsgod:
I'm a patient kinda guy, and I love the fact there are people smarter then me that can make an impact on those of us less gifted. I'm already grateful for the progress made I'm in for $15.00 as well.

thanks to all involved:good::highfive:
[Verizon Samsung Galaxy S 4] TheSavageSquid:
By the looks of it, if you can push the exploit to your phone you can run it in a terminal emulator. The screen shot is just using adb shell (basically using the Android Terminal from your PC) to simply run it. I'd say you're good to go!
[Verizon Samsung Galaxy S 4] PWM978:
No donations necessary (to ME, I won't speak for DooMLoRD as I don't even know the guy. However, if you DID want to donate to someone he would be much more appropriate). I just happened to be in a position where I could make a minor contribution to the overall effort.

I did not discover the vulnerability (this has been around quite a while), nor did I write the exploit - DooMLoRD generously posted his work for others to modify.

Which I did. So it worked out, team effort!
[Verizon Samsung Galaxy S 4] trident123:
I'm sorry I looked but couldn't find it in the thread. How do you run this?
[Verizon Samsung Galaxy S 4] Tada10:
Yes I am ready to root this baby!

Sent from my Galaxy S4
[Verizon Samsung Galaxy S 4] srphoenix:
Have adb drivers installed as well as java, then run the program with Java rather than zip. I think there are still some errors though because some are still getting this script:

[*] Waiting for device...

Waiting for ADB device connection. When your OS recognizes the device, we will continue. Don't touch anything.[*] Device found.[*] Pushing exploit...

79 KB/s (81016 bytes in 1.000s)[*] Pushing root tools...

6531 KB/s (104500 bytes in 0.015s)

6536 KB/s (104500 bytes in 0.015s)

4245 KB/s (1919763 bytes in 0.441s)[*] Rooting phone...

Device detected: SCH-I545 (JDQ39.I545VRUAME7)

Attempt acdb exploit...

SCH-I545 (JDQ39.I545VRUAME7) is not supported.

Attempt fj_hdcp exploit...

Attempt fb_mem exploit...

Attempt perf_swevent exploit...

writing address is 8335

Segmentation fault

installing superuser to system partition

/system/bin/sh: su: not found

/system/bin/sh: su: not found

/system/bin/sh: su: not found

done

Script Complete

But, progress is being made it looks like!!!!
[Verizon Samsung Galaxy S 4] Droidatar:
Thank you so much for your assistance and contribution to enabling those of us who choose to root, do so. It just seems like the thank you button is not enuf :victory:.
[Verizon Samsung Galaxy S 4] MJMED:
So as noob who has rooted and flashed ROMs on my previous phones, we need root/recovery and an open bootloader to flash a new ROM, right? The reason I ask is that I stupidly updated my phone right after I got it (it was a looong day) but I'm still within the window to swap it out. If I can swap out the ROM by getting access to recovery (not interested in a new kernel/baseband etc, just rom) then I wouldn't bother to return it. Thanks!
[Verizon Samsung Galaxy S 4] prstorero:
Just root and recovery. No unlocked boot loader is necessary to flash a ROM.

prshosting.org
[Verizon Samsung Galaxy S 4] hoboballer:
Man I'm so happy to see progress happening. I wanted to know once Root/Recovery are achieved how do I go about paying for the donations?
[Verizon Samsung Galaxy S 4] gadget!:
Just an FYI for those thinking of returning a phone that you upgraded to ME7 in hopes of getting a phone that is not upgraded.

I just recieved a replacement 32gb from Verizon and it came with ME7 already on it.

Sent from a Galaxy S4... Far far away
[Verizon Samsung Galaxy S 4] randy hoopes:
Don't get what this means? So how can you root?
[Verizon Samsung Galaxy S 4] Tada10:
I think the devs here found a way to push it and is in the process in making an easy proggie for us to run to push the root.

Sent from my Galaxy S4
[Verizon Samsung Galaxy S 4] randy hoopes:
Nice.
[Verizon Samsung Galaxy S 4] fordmanck:
Throw me on for 20.
[Verizon Samsung Galaxy S 4] dvsgod:
bought mine on the 20th from verizon and automatically downloaded the update when connected to the network. Stuck with ME7 form the get go
[Verizon Samsung Galaxy S 4] gadget!:
No automatic download here. I took the sim card out before even starting the phone.

It came with ME7 already on it!

Sent from a Galaxy S4... Far far away.
[Verizon Samsung Galaxy S 4] andybones:
Very sorry to hear this, Sir!
[Verizon Samsung Galaxy S 4] Rhodesy757:
i got a replacement phone (16gb model) tuesday and it did not have me7 on it.... happily rooted and rom'ed now :victory:
[Verizon Samsung Galaxy S 4] spinwizard:
Link Status DISCONNECTED ????? What am I missing? :(
[Verizon Samsung Galaxy S 4] gadget!:
Thanks Andy, but it's not a problem.

I have a rooted and rommed 32gb that I use. This one was a replacement for my original 16gb that I had to go the rounds with VZW to get replaced. It's a long story but they stepped up to the pump and made me good again.

I'm just going to sell it :D
[Verizon Samsung Galaxy S 4] andybones:
well that's much better to hear! :cowboy:
[Verizon Samsung Galaxy S 4] lycwolf:
That specific JAR version doesn't work right now. Another has been jumbled together that works, but can only be done manually. Someone is working on streamlining it for testing. Still can't do anything without a recovery, but hopefully that will be the next step.
[Verizon Samsung Galaxy S 4] Chuck2003:
Is there a guide on how to do this ? im a root noob ...downloaded gs4ex.zip and DooMLoRD_Easy-Rooting-Toolkit_v17_perf-event-exploit.zip but dont know what to do lol
[Verizon Samsung Galaxy S 4] lycwolf:
See the post above. Unless you know how to do everything via the cmd line, don't bother right now. This is not 'noob friendly' until it gets repackaged. Shouldn't be too long.
[Verizon Samsung Galaxy S 4] dvsgod:
Envious:mad:
[Verizon Samsung Galaxy S 4] hallstevenson:
It's certainly going to depend on *where* you get your phone too. VZW corporate stores - yeah, they're likely to have updated phones. Best Buy, Amazon, VZW retailers, etc may have older stock.
[Verizon Samsung Galaxy S 4] Southern_mind:
I said the same thing some pages back. They replaced my 16gb one for a 32gb version I was happy but it came updated that was yesterday.
[Verizon Samsung Galaxy S 4] hcu721:
please forgive me if i'm way behind on this, but is there some sort of known defect with the 16GB?? should i be exchanging mine as well? my 16GB phone is less than a week old.