yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] U251:
Unroot possible?

Newbe question here.

Coming over to Samsung from Motorola.

Currently still running MDK stock.

Can rooted VRUAME7 be unrooted by flashing back to stock VRUAME7?

Motorola's had locked bootloaders for a long time. The SAFEBOOT app seemed to get around that rather well.

Rooting MDK and staying with it deprives a person of any good updates that are in VRUAME7.

Are there not any good updates or fixes in VRUAME7??

Always liked to know I could get back to stock if I needed to is why I asking the unroot question.

Thanks to all for any help on this topic.

U251
[Verizon Samsung Galaxy S 4] :
Please read the thread or search for your topic in the "search in thread" box. This question has been answered more than 100 times...

Stay on MDK and root with recovery and Loki.

ME7 just has root, no recovery yet.
[Verizon Samsung Galaxy S 4] Anthony825:
I'm pretty sure you can flash back to the stock me7 image using Odin, and then reset the entire phone back to factory settings. It unrooted my other S4 before I returned it to the manufacturer.

Sent from the future...
[Verizon Samsung Galaxy S 4] Cruiserdude:
Yes, you can Odin stock ME7, in fact that's all you can Odin once you take the update. Motos use SBF files flashed through fastboot, the recovery image method Google built into Android and adb, just like a Nexus device. You can recover manually, use a tool script, or something like RSDLite that automates the process behind a GUI. Samsung either disables or removes fastboot from most of their devices, and replaces it with Odin. Odin is a tool that communicates with a daemon on your device when you put it in Download mode, and flashes tarballs of the recovery image, after verifying md5 if available.

So yes, this is equivalent to fastboot, and can return the phone to stock. However, like Motorolas and unlike previous Samsungs, you cannot currently flash an ME7 device back to an older build. Time will tell whether this holds true with each subsequent update, but they certainly have the capability.

Recovery, as we're referring to it, is a custom recovery menu like CWM or TWRP that allows you to flash any zip you want, rather than being limited to OEM signed files like the stock recovery. Bootstrap and Safestrap were apps that utilized an exploit to hijack the bootchain and allow a custom recovery, though they still did not allow a custom kernel to boot. We have a more effective exploit called Loki that allows custom kernels to boot, but it only works on phones that have NOT updated to ME7.

So, if you update as of this posting, you will not have any means available to flash roms or kernels or anything else, nor any method to go back to MDK and use the Loki exploit. Something may be found for ME7, but there is NO guarantee of this. So if you update, you will be stuck with just root alone for now, and possibly forever.

ME7 does have some improvements, that's why you should flash a rom that's based on it. Stay MDK, and choose a rom and kernel that have all the benefits of ME7 and newer builds from other jflte variants. Just don't take the OTA, and make sure you read all the posts about how to keep the phone from updating itself as soon as you activate it. This applies both when brand new, as well as if you Odin back to stock MDK.

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] jacksonpeebles:
Who do I pay?

So, I apologize if this has been adequately addressed and I missed it, but who do I pay, exactly? I was (am) down for $15 and haven't received a PM. The root exploit (assuming it works for me, which I'm guessing it will) credits hiikezoe, DooMLoRD, and PWM978 for the exploit, but OP made the post... :confused:
[Verizon Samsung Galaxy S 4] SamuriHL:
This is the bounty thread but I'll respond very quickly to your question. Those on MDK can get a safe ME7 zip that can be flashed in custom recovery. It'll contain everything that the update has to offer without the negatives of breaking Loki.
[Verizon Samsung Galaxy S 4] RaptorMD:
Well then put me in for $10 on Root and $25 on Bootloader. Sorry it's not much but I am moving in a month so funds are a bit tight at the moment.
[Verizon Samsung Galaxy S 4] steven197:
Could you link me to the zip or thread? i cant find it! I feel a little autistic...
[Verizon Samsung Galaxy S 4] jorceshaman:
Once again, the bounty requires recovery which has not been attained. If you wish to donate beyond your commitment for just root, PWM978 said to give to DooMLoRD.

HOWEVER, any donations for just root are above and beyond the bounty in this thread since recovery has not been attained!
[Verizon Samsung Galaxy S 4] SamuriHL:
I don't own this device so I don't have a link offhand, but, I know some pages back a link was posted cause someone made a "stock rom" out of it basically. AFAIK it even had the radios.
[Verizon Samsung Galaxy S 4] jorceshaman:
http://xdaforums.com/showthread.php?t=2397313

[ROM][I545VRUAME7][4.2.2] Stock Rooted Deodex 08/7/13
[Verizon Samsung Galaxy S 4] jacksonpeebles:
Thanks

Thank you. My apologies as I learn how the bounty system works.
[Verizon Samsung Galaxy S 4] jorceshaman:
No problem, it was just asked at least 15 times before root was attained and I know I answered 1 person after not long ago and I'm sure there's more than that as well.
[Verizon Samsung Galaxy S 4] pingpong1109:
Now I don't know much about unlocking bootloaders but I am willing to give a suggestion, because an armatures perspective, sometimes helps. I know with Odin it has a bootloader section, but I know it could mess up your phone if you flash the factory firmware outside of the PDA version. Could we program our own bootloader and flash it? Or would this be to risky/complicated? Just some thoughts I have had.
[Verizon Samsung Galaxy S 4] :
Try it.
[Verizon Samsung Galaxy S 4] Cruiserdude:
Not unless you're a Qualcomm or a Samsung engineer. Low level bootloaders are signed to the hardware, and subsequent bootloaders are signed to the bootloader that proceeds it in the boot chain. Therefore we'd need the proper signing key from Qualcomm for the low level bootloaders, as they are verified by the hardware itself. The higher level bootloaders are signed by Samsung, and still must be verified by the bootloader that proceeds it, regardless of whether they have signature verification enabled or not.

Not to mention that we'd need full hardware schematics, and source for the low level bootloaders in the NAND on the hardware. I'm not sure how much of this information we have available. This would be needed to successfully write a new bootloader, or reverse engineer one from Assembly. But it still wouldn't work unless it was signed with a valid key that would pass signature verification of the bootloader that proceeds it.

So ideally, we'd need to have one of the bootloaders in the chain, properly engineered for the hardware, and signed with a valid key, that itself has signature verification disabled. That way the next bootloader in the chain, up to the system itself, would only need to be properly built for the hardware and would not require a valid signature. This is how the S3 was unlocked, and will not happen without such a thing being leaked from Samsung or Qualcomm. Obtaining or reverse engineering Samsung or Qualcomm's signing key is not a realistic possibility. And you wouldn't want that to happen anyway.

But with a valid, signed bootloader that had signature verification disabled in hand, Odin may be a means to flash it, though I'd imagine dd would be much simpler.

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] jacksonpeebles:
Elaboration

A lot of good that required "newbie" video to come onto XDA Forums did me, eh? ;) It does confuse me, though, that I signed up to donate even if only a root is found but this is not required unless the entire bounty is fulfilled. Ah, well. I'll read better. At any rate, I admire the developers here and am ordering my exFAT-compliant microSDXC card now (by the way, to anyone reading, I found what I think is a good deal on one - $50.26 USD - as an Amazon special at amzn.to/13is2ve)
[Verizon Samsung Galaxy S 4] camparks:
Put me down for $20 on each

Also, if anyone can offer help with my locked phone issue, I would greatly appreciate it - thread. For now, it looks like I'll have to wait for the bootloader to be cracked so I can install a customer recovery to access files and fix it...
[Verizon Samsung Galaxy S 4] jorceshaman:
The 2 separate bounties are:

A. Bootloader has exploit found that allows flashing of a custom recovery AND root.

B. Bootloader is completely unlocked AND flashing of custom recovery AND root.

The hardest part on A is finding the exploit to work around the bootloader. The hardest part on B is completely unlocking the bootloader which is much LESS likely than just an exploit. Until all conditions of A OR B are met, both bounties are still up for grabs. If conditions of just 1 are met, it makes the other invalid.
[Verizon Samsung Galaxy S 4] jackwagon06:
Can we donate/start a redbull and or nicotine donation page for the devs???? The $ amount is looking nice, but maybe more hours with crossed eyes at the screen might do it? Seriously, keep up the work! Keep calm and hack on!!!!

sent from my supercalaphablet-noteyexpeealadocious
[Verizon Samsung Galaxy S 4] chaerichard:
I will donate $30 dollars!

I love what you guys do there and keep up the good work. You guys do quality work and people just don't know how difficult these things are. Kudos to all you at XDA!!!:good:
[Verizon Samsung Galaxy S 4] Loglud:
Actually theres an interesting idea because the original bootloader is signed by the original manufacturer. I know people have said you cannot flash the old bootloader over the new one. This is (theoretically) because the first boot on the new bootloader modified the fuses, and what is known as Secure RAM. This SRAM is located on chip and can be called too through the TZ partition on the chip. With this being said, it is, theoretically possible to find a way to call those RAM bytes back to the original through the TZ kernel. However this relies on going thought the TRUSTZONE kernel, which for many commands requires authentication. However there is room in here to find a security hole in here, or maybe use the security chain to modify this.
[Verizon Samsung Galaxy S 4] pingpong1109:
I know that there is a bounty up for grabs but if someone is having an issue maybe they should post it?
[Verizon Samsung Galaxy S 4] isildursheir:
Bounty

Count me in for $20 for both.
[Verizon Samsung Galaxy S 4] Surge1223:
I still don't think this would work because aboot is before TZ in the bootchain. I think you would need to get by aboot security checks first. Then you might be able to get TZ to do that if you can ensure no efuse is altered.
[Verizon Samsung Galaxy S 4] Cruiserdude:
I don't know, has anyone actually CONFIRMED that ME7 burns out another QFuse, or are we all just assuming that? It's at least theoretically possible that Samsung has built-in some sort of method to return to the original firmware, and changing SRAM through the TZ would likely be part of it. If the block is NOT done with another QFuse, I don't see how else they would do it.

Of course, exploiting this would be rather tough, as it's not like TrustZone is wide open or anything. But it could be an area to focus effort on. Even so, it would only let us roll back to MDK, unless there was a leak of an engineering bootloader by then. Loki isn't an unlocked bootloader, though it basically looks the same from a user's perspective. But if something like an engineering bootloader were to leak, I suppose it's also possible that it would allow us to flash it as is, either because it would contain a string within it to modify SRAM through TZ, or it just had a valid signature that hasn't been blocked. Or who knows, it may even require JTAG, I'm just thinking there's likely some way for Samsung to roll the firmware back on their own devices, and hopefully it wouldn't be through re-signing an old build with a new key.

It's not very productive to dream of what we wish would leak to us, but it is productive to speculate how Samsung would do what we want to do, and look for an exploit that let's us break in and use their same process. Again, unless QFuses were blown to prevent this, it's worth looking into.

Let it be known that I'm no dev, but I do hope my speculation is at least on the right track.

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] Surge1223:
But even with TZ and SRAM, no matter how you want to start unlocking the bootloader eventually you are going to have to deal with the security at aboot . But its also critical that an efuse isnt altered because tz, recovery, kernel and system are after aboot in the bootchain while sbl2 and sbl3 are before.
[Verizon Samsung Galaxy S 4] ozzzzysh:
So... I've heard that you can spoof md5 signatures. Is that all Odin checks besides the Samsung one? Why isn't it possible to edit the me7 image just enough to get a recovery into the phone, and then find an md5 "collision" to give it the same md5 signature? Does the phone itself check the partitions that are flashing as Odin hands them over? Is Odin smarter than I thought?
[Verizon Samsung Galaxy S 4] mikecantreed:
Pretty big longshot but maybe we can find someone at Qualcomm that would release the signing keys. I think that if you don't explicitly state that you will be using them to exploit a carrier branded device they would potentially release it.

Anyone have any contacts there? Otherwise maybe go through the general contact page.

http://www.qualcomm.com/connect/contact
[Verizon Samsung Galaxy S 4] sub1287:
Good luck with that, most employed people that appreciate having a job aren't going to risk it from someone cold calling random people.
[Verizon Samsung Galaxy S 4] Cruiserdude:
Well Odin communicates with a daemon on the phone (that I had previously heard referred to as the Loki daemon before this phone, but I digress as the two are not related AFAIK). So I'm not sure exactly how much Odin does and how much the daemon does, but you can only flash packages signed by Samsung now AFAIK. I remember on my old Droid Charge, you could make your own packages with custom roms and kernels already set up and just flash them no problem, and that's not the case here. So the daemon itself is at least involved in the process.

Unfortunately if it was as simple as using Odin or even JTAG to flash something from MDK or the dev edition, it'd be done by now. But who knows, maybe there's something we can do with the right file somewhere, it's just that EVERYTHING is signature verified, so it's not just gonna flash over like normal.

The changes in ME7 go down at least as far as sbl2, as that proceeds the TrustZone where the vulnerability was found, and a new sbl2 prevents the old TZ from being used. The key to a downgrade is figuring out how far down past sbl2 on the bootchain it goes, and seeing if we can restore the sbl2 from MDK, and therefore sbl3, then TZ, etc. But if those changes go all the way down to the hardware itself, that may be a dead end without something new from Samsung.

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] Au_A7:
Honestly as much as I want unlock I don't think anyone wants this, poses way too much of a security risk to have keys available to anyone
[Verizon Samsung Galaxy S 4] :
Try it...

Find someone...

Why propose all these ideas without trying them out. So many people are saying "what if/ why don't we" and have no idea it works. Am I the only one noticing this?? It's as annoying as the overuse of the word "stoke" on this forum. :confused:
[Verizon Samsung Galaxy S 4] mikecantreed:
We would need someone well versed in the mechanisms in play here to even ask for this stuff. Basically all of my knowledge on the subject is coming from AdamOutler's posts.

http://xdaforums.com/showpost.php?p=43943624&postcount=176
[Verizon Samsung Galaxy S 4] ashaton:
Dan mentioned this in his explanation of Loki: http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html

It doesn't compare MD5, it compares SHA1 which is much more robust. Unless you want to pick up $3 million in EC2 nodes, finding a collision is unlikely.
[Verizon Samsung Galaxy S 4] hallstevenson:
I bet that could work! :o
[Verizon Samsung Galaxy S 4] SamuriHL:
Want to know the fun part? The sha1 hashes are in clear text in every update. Go look at install-recovery.sh in the update zip for ME7. You'll find the sha1 for the boot img and the generated recovery partition.
[Verizon Samsung Galaxy S 4] ozzzzysh:
Yea.. The key is staring us in the face. If only we could find a way to align the stars..

Edit: So apparently the raw probability of an SHA1 collision is ~10^-45 out of 100... Why aren't there digital locksmiths?
[Verizon Samsung Galaxy S 4] PWM978:
So.... I'd like to recommend not pursuing the SHA-1 collision route.

http://people.csail.mit.edu/yiqun/SHA1AttackProceedingVersion.pdf

So.. to do 2^69 computation - if you had 2,500,000 cores you could probably do it in about 8 years. Or, if you had 350,000 cores you could do it in 50 years.

Prior to this paper, brute force was about 2^106, which is not at all practical but was the best we could do (we being planet earth).

http://eprint.iacr.org/2004/304.pdf

If this does not deter you, I wish you the very best of luck.
[Verizon Samsung Galaxy S 4] sokrboot:
Ive got time. Anyone else?

««I used to be a Serial Flasher...now I'm just a Cereal Flasher.»»
[Verizon Samsung Galaxy S 4] wtherrell:
A little levity to help pass the time while we wait.

Picard out. Engage!

Sent from my Hyperdriven Vzw Dev Edition Galaxy S4 with Tapatalk 4
[Verizon Samsung Galaxy S 4] :
You guys realize this thread will be shut down now...?
[Verizon Samsung Galaxy S 4] cbmggm:
+1 Mods please shut this thread down. No one has listened to your warnings and the rantings are beyond tolerable.
[Verizon Samsung Galaxy S 4] RaptorMD:
My donations to the bounties will remain $10 for Root $25 for Bootloader.

However I am sending my GS4 back. I decided to fully support the cause but I just am not sure about the phone long term for me. I am waiting to see what else is going to hit the market and wait it out a few months. In the meantime I will likely get an S3 off eBay to hold me over.
[Verizon Samsung Galaxy S 4] KennyG123:
OK...THIS was the thread I meant to close until the OP has something to post or discuss

Moderators have spent too much time cleaning out non development posts

Please post in the discussion thread

Thanks

FNM
[Verizon Samsung Galaxy S 4] sporty377:
Stock rooted is fine with me...TW isn't that bad...I mean it could be better but not that bad
[Verizon Samsung Galaxy S 4] mikeyinid:
True. At least if you're rooted you can also run nottach modules. Basically what I run anyway. Stock + nottach.
[Verizon Samsung Galaxy S 4] sporty377:
Whats nottach?
[Verizon Samsung Galaxy S 4] loveEA:
10 for full unlock
[Verizon Samsung Galaxy S 4] asdecker:
At least you could manually debloat some crap thru TB as well
[Verizon Samsung Galaxy S 4] open1your1eyes0:
Donator list updated

Just a friendly reminder about the second bullet in the disclaimer section.
[Verizon Samsung Galaxy S 4] mikeyinid:
http://xdaforums.com/showthread.php?t=2285074

[XPOSED MOD] NottachXposed v12 [ATT][6/22]
[Verizon Samsung Galaxy S 4] asdecker:
Will this thread work? Its the factory image but doesnt wipe data.

http://xdaforums.com/showthread.php?t=2301259
[Verizon Samsung Galaxy S 4] r_hippy:
Doesn't remove recovery I believe
[Verizon Samsung Galaxy S 4] open1your1eyes0:
It works only if you never took the official update to VRUAME7 build (be it OTA, Samsung Kies, or the Verizon Upgrade Assistant). If you took this update it is too late as the update prevents your from downgrading your bootloader back to the original one that came on our devices.
[Verizon Samsung Galaxy S 4] SmokeyMon:
What if he did a factory wipe reset from in the GUI on that ROM? Wont that put factory recovery back?
[Verizon Samsung Galaxy S 4] Rebel908:
Curious, if root is able to survive after updating, will it still survive if I do a factory reset?

---------- Post added at 07:36 PM ---------- Previous post was at 07:35 PM ----------

It does actually. Or at least it has when I have been using it
[Verizon Samsung Galaxy S 4] asdecker:
No I havent updated. Still on MDK (hyperdrive)
[Verizon Samsung Galaxy S 4] r_hippy:
I has to return a defected phone and it didn't remove it when I did it I had to use the factory image from sextape http://www.sxtpdevelopers.com/showthread.php?t=237
[Verizon Samsung Galaxy S 4] open1your1eyes0:
That error was noted and fixed a little while ago: http://xdaforums.com/showpost.php?p=41995969&postcount=15
[Verizon Samsung Galaxy S 4] Rebel908:
Alright, just letting everyone know now - Going to see if root will stay after updating if done via OTA, with Voodoo OTA Rootkeeper. We'll see what happens
[Verizon Samsung Galaxy S 4] asdecker:
Gonna take a little bit to download this factory image.
[Verizon Samsung Galaxy S 4] sneekerpimpz:
Im in!

I drop a 10 spot to get my root and apps2sd!:D
[Verizon Samsung Galaxy S 4] asdecker:
Guess ill wait for Rebel lol
[Verizon Samsung Galaxy S 4] Rebel908:
Quick question - I have my rooted VRUAMDK Stock ready, but when I booted it gave me the Samsung custom kernel thing. I'm concerned this may have some bearing on how well this goes?

Flashed MD2 Kernel

Ran Motochopper

Updated SuperSU Binary

Flashed MDK Kernel

(Boots with Samsung Custom Kernel thingy)

I have root protected now, but is there something to take care of the custom kernel message?

EDIT - Getting an error. Will not let me proceed. I get ~30% in and it fails. Don't know if I did something wrong.

MD2 Kernel

Motochopper

SuperSU Binary Update

MDK Kernel

Back up root/temp unroot

Download OTA/Flash OTA

Maybe I'm doing something wrong?
[AT&T Samsung Galaxy S II Skyrocket SGH-I727] Rissa82:
Alright, I've gotten the twrp done and am aware you don't have to root in order to flash roms, etc, on the skyrocket. Does the same apply to radio? I'm needing to change the radio over to tmob and I've downloaded the correct one, but can't seem to find a thread that explains how to flash it. Can someone please direct me to the correct place. I'm totally supposed to be headed to bed right now and would love to have a working phone first!
[AT&T Samsung Galaxy S II Skyrocket SGH-I727] bps119:
Just reboot to recovery and flash the radio zip. No need to have root to do so.

You could also just flash the superuser zip and obtain root access as well

BAM! Rooted and booted;)

Sent from my Slimmed out Skyrocket
[Verizon Samsung Galaxy S 4] bamige1:
Well I was going to install twrp on my s4 but had a few concerns. 1. Can I uninstall it? 2. If so where is the stock recovery for Verizon s4. Thanks
[Thinkpad Tablet General] kamkash:
Hi kaschemme

I flashed your rom, coming form cm10

However, I forgot to flash gapps while i was in recovery. How can I re-enter recovery to flash gapps. on cm10 one of the reboot options was into recovery.

I dont have access to play store as well

Thanks KamK
[Thinkpad Tablet General] ti-pich:
First you have to activate developper option, to do this go into setting/about tablet and tap several time on the build number at the bottom of the page until it say "you are now adevelopper" then go back into setting into the developper option and check "advanced reboot". This will add the optionto reboot into recovery in the power menu.
[Thinkpad Tablet General] kamkash:
Thanks Bro, helped. However now I am having tons of force closed issues, mostly with google apps, specifically google keybrd, chrome. I have also noticed that this rom runs slower then cm10, you recommend a clean flash?

Is there any way to bring the notification and time to the bottom/right cant find it in the settings...

THanks for all your help