yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] SamuriHL:
0. Verizon doesn't sell the dev edition.
[Verizon Samsung Galaxy S 4] sppatel:
For future reference (and sorry if this has been answered before), but what is the exact app name we should freeze?
[Verizon Samsung Galaxy S 4] bobby janow:
Been a while but if I recall correctly it was SDM 1.0. Then I froze everything with the word Knox in it as well. If the file downloaded it's somewhere in a system folder called "cache" something or other. You can then delete the update and you'll never be bothered again.
[Verizon Samsung Galaxy S 4] Cruiserdude:
SDM.apk AND FWupgrade.apk. And like he said, the file will be in /cache if it had already started downloading.

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] knights665:
Well my replacement came for my stuck home button and has mdk installed! killing two birds with one stone:)
[Verizon Samsung Galaxy S 4] afmracer6:
i picked up a s4 at bestbuy today. still on mdk!
[Verizon Samsung Galaxy S 4] msterwolf:
Good and bad news everyone.

http://xdaforums.com/showthread.php?p=44438715
[Verizon Samsung Galaxy S 4] asharad:
That's a repost of a repost. You want this THIS ORIGINAL thread: http://xdaforums.com/showthread.php?t=2395340
[Verizon Samsung Galaxy S 4] Cruiserdude:
That's awesome!! What's the bad news? Someone with a Dev edition will jump in soon enough and we'll see if this works! A permanent unlock, I'm so excited about the mere possibility!

Sent from my VZW Galaxy S4 Google Play Edition :)
[Verizon Samsung Galaxy S 4] klick37:
This may sound stupid (in fact, I'm sure it will) but since we have root permission on the phone and the ability to modify system files, shouldn't it theoretically be possible to circumvent the standard boost process entirely by modifying some kind of system file and have it boot to a custom partition, like safestrap?
[Verizon Samsung Galaxy S 4] bajasur:
This is a discussion thread...speak freely
[Verizon Samsung Galaxy S 4] elliwigy:
If it were that easy it wouldve been done.. it was said that safestrap will not work already before but i am no expert so forgive me if im wrong
[Verizon Samsung Galaxy S 4] twizzlejr:
So I know this might be off topic a little bit but it's interesting to say the least I previously has my phone rooted and unlocked on MDK I accidentally accepted the update and everything went thru but it said the update was unsuccessfully but the build number shows ME7 now but my device status still says custom and I've still got the unlocked symbol on my start up screen don't know if it's relevant at all but I figured I'd say something plz pm me if anybody has any ideas or can tell me if my current situation could be relevant to our current plight
[Verizon Samsung Galaxy S 4] gacole:
Exact same thing happened to me. Had rooted and installed ClockworkMod, but not flashed a custom rom. Accepted the update before I knew that it would break the ability to enter recovery. Said it failed because recovery was invalid, or something like that. So I figured I dodged a bullet on that one, still showed MDK as the build. I blocked SDM, and thought I was good. Fast forward a couple of weeks, and I'm ready to flash a custom rom. I go to reboot into recovery and it fails, and I check the build, and it is now ME7. The only thing that happened in that time was my battery ran down totally, and the next morning after I plugged the phone in, I saw that most of my root apps said "package invalid" in the status bar. But I still have root, titanium backup reports it and SuperSu still works. Did Verizon somehow push something out to get past having a custom recovery in place? Because somehow I got upgraded from MDK to ME7 but retained root.
[Verizon Samsung Galaxy S 4] elliwigy:
that is what upgrading does.. if it updates you lose the ability to hsve custom recovery.. doesnt sound like you have proper root if most of your root apps say invalid. i would try to get a root checker app n see what that reads.. and as far as it saying custom and having the lock it will show this once you flash anything custom to your phone. it does not revert back unless you use something like triangle away.. however. triangle away only masks the custom logo and does not reset the flash count.. i believe there is another way.. possibly odin stock me7? i know there are a few ways but it doesnt bother me and im not returning my phone any time soon to worry bout a splash screen lol
[Verizon Samsung Galaxy S 4] samiamapirate:
JTAG Brick Repair

Okay..Im no expert at any of this but is it possible to do a complete wipe of the phone and have the developer edition stock..well everything..transfered onto the regular edition? Like when a phone is hard bricked to the point of no return, could some equipment such as the tools that JTAG repairs uses make it possible to get a full unlock? I know it's $60 to send your phone into him for a brick repair but it would soooooo be worth the money to get a full unlock like the dev version has. Like I said I could be way off because I am quite new to this but hey - gotta throw it out there.:silly:
[Verizon Samsung Galaxy S 4] twizzlejr:
Could someone provide a link for stock me7 I've looked around but as far as I know I didn't think it was available at all
[Verizon Samsung Galaxy S 4] iwearthebelt:
http://xdaforums.com/showthread.php?t=2357235 Go here
[Verizon Samsung Galaxy S 4] gacole:
Just used Root Checker and confirmed root was maintained. The only time the root apps showed the error was when the phone had restarted that first time. haven't seen that since.

Anyone else upgrade to me7 and not have to re-root?
[Verizon Samsung Galaxy S 4] zerofighter1:
This is interesting. Are you suggesting having the developer edition firmware fully flashed to a Verizon edition? If so I'd be curious to as to whether this is possible, and definitely willing to do so if established. I don't see why it couldn't be done from a hardware perspective. From what I understand they're identical in that fashion. As far as whether the boot loader allows it from a JTAG perspective I have no idea. Anyone care to speculate?
[Verizon Samsung Galaxy S 4] blastagator:
Speculation based on hardware security: No.

Lets break the bootloader down in to stages. The very first thing to load being 1bl, and the next being 2bl (or what is commonly referred to as the bootloader). 1bl is hardcoded in to the phone (likely the cpu) and runs the signature check on 2bl before loading 2bl. 2bl checks the qfuses and continues booting if the fuse state is correct.

Therefore, the hardware can be the same, but the 1bl on a verizon phone may be different than the 1bl on a dev phone. Therefore, exactly copying a dev phone might not work because verizon 1bl may not like dev 2bl. The only way to change 1bl is to change the cpu (AKA waste of $, time)

Not sure if this is the type of security at play in this phone, but if they are serious about locking down, this is what you do, and you can't beat it without finding an exploit in 2bl such as the loki exploit.

Although, based on some of the info floating around, this may not be the security setup.
[Verizon Samsung Galaxy S 4] zerofighter1:
Any way you can point me towards a layman's explanation of Loki and how it functions?
[Verizon Samsung Galaxy S 4] blastagator:
This is probably the best you'll get:

http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html

There is also this:

http://xdaforums.com/showthread.php?t=2389246
[Verizon Samsung Galaxy S 4] eklipz3:
if i remember right i also read something about qfuses and if things don't go right you got yourself a true brick.
[Verizon Samsung Galaxy S 4] samiamapirate:
They seem pretty serious about locking things down but who knows. I'm about to start college focusing on a degree in computer science so maybe someday I will be knowledgeable enough for such advanced development questions. Until then I can only speculate and ask questions and hope someone more informed than I can provide the answers. I sincerely thank you for the clear explanation of such a security set up.

Another question: For people that have already bought the s4 and cannot afford a developer edition, would buying a replacement CPU be cheaper, or even possible? Provided the security lies within a hard coded 1bl?
[Verizon Samsung Galaxy S 4] resurektz:
Now im no expert on things. But couldnt you buy a broken dev edition like cracked screen or something. And swap the mother boards and wala you got a dev edition

Sent from my Bonestock S4
[Verizon Samsung Galaxy S 4] blastagator:
Not economically feasible, if even possible.
[Verizon Samsung Galaxy S 4] SamuriHL:
It's fairly correct from what I understand. What's different between the consumer and dev editions, however, from my limited understanding is the qFuses. On the Motorola OMAP phones (RAZR, Bionic, D4, etc) they blew the eFuse to lock the phone permanently. The engineering devices they use in house for testing did not have the eFuse blown so it was essentially unlocked. What you're calling 1bl checks the state of the eFuse in that case and either goes into "secure boot mode" or not. I'm guessing, but, I believe the same type of scenario exists for the VZW S4 consumer edition. They blow a qFuse at the factory that distinguishes it as a consumer phone, and then 1bl always boots in secure mode. Loki found a security hole in 2bl that allowed unsecure code to be run. This hole has been patched. I'm curious to see if another hole can be found.
[Verizon Samsung Galaxy S 4] Surge1223:
So from my understanding, the FORCE_TRUSTED_BOOT Qfuse is blown to a 1 forcing "secure boot mode" which subsequently forces the security checks of PBL and SBL and disables not trusted/unsecure boot modes. I though since eFuses can be re-programmed, while Qfuses are only programmed once was the main issue. Where are the names 1bl and 2bl coming from? are we just breaking aboot, boot, sbl2, sbl3, rpm and tz down into two steps or are we referring to pbl and sbl? Im confused where/what we are referring to here.
[Verizon Samsung Galaxy S 4] SamuriHL:
No idea on the 1bl 2bl thing. I was just using the terminology of the person I was replying to. The eFuses used on the OMAP phones were definitely not reprogrammable. Perhaps they really are qFuses then and the terminology I've seen around them are wrong. But I know once blown, they're done. That's why those phones can't be unlocked. It is my understanding that the VZW consumer S4 is using a similar process. So yes, you're correct in what you said about the boot sequence. This is also why I think anyone who tries to flash files from a dev edition to a consumer edition will hard brick it. What I don't know is how many qFuses there are and what they all do. Right now the consumer edition is locked. Is there a "master qFuse" that overrides it to unlock it? No idea. I know on the Snapdragon Moto phones there's a master qFuse to permanently lock it. My understanding is severely limited, however.
[Verizon Samsung Galaxy S 4] Surge1223:
Just throwing this out there... employees of qualcomm have access to the pdf describing the Qfuses, they have to in order to help oems with initial programing.
[Verizon Samsung Galaxy S 4] recDNA:
32 gb model is still internet availability only right?

I admire how you folks rage against the dying of the light. Seems like moto folks already gave up any hope of cracking the bootloader again since the last update. Like you we have root and one developer has really put a lot of work into getting root back but not even dimmest hope of opening bootloader again.

Good luck!

I was thinking of buying the developer edition gs4 but I've read enough to know I don't know enough to make good use of it. Modding roms to use them a little beyond my comfort zone.
[Verizon Samsung Galaxy S 4] Surge1223:
It is kinda strange that a few of us that were responding/helping him knew quite a bit more about what was going on. If you read the earlier posts in that thread you can see a lot of the help he asks for would be easy to get by yourself...I would argue most of the useful info came from the other people with dev editions discussing/comparing info with those of us that knew what we were talking about. But hey if you look at my previous posts it probably doesn't look like I would know what im talking about either so I'll remain a skeptic, at best at least we brainstormed a few ideas in that thread.
[Verizon Samsung Galaxy S 4] SamuriHL:
It wasn't exactly clear what he was after from the dev edition. His earlier posts made it sound like he had a way to temporarily unlock the bootloader and he was looking for files from the dev edition that might help him make it permanent. When he mentioned something about a "recovery.img" file that gets flashed every time the phone shuts down I knew that whole situation was in trouble. I really don't get what he's after now but I'm near positive it'll not turn into a bootloader unlock. A bricked phone, perhaps, but, not much more than that.
[Verizon Samsung Galaxy S 4] SamuriHL:
Nope. Not at all. I was just trying to help those who were trying to get him what he asked for. I have no dog in this hunt as I bought an unlocked S4 GPE for a reason. But I do like seeing a community come together and help solve complex problems like this. So anything I can do to help I'll do. I will say that the VZW S4 is a strange beast. No fastboot mode at all? Weird. :) I hope you guys and gals succeed but I have very little hope I'm afraid. The Moto OMAP phones give a template for how to truly lock down a phone. Now with SELinux coming online even Safestrap is in jeopardy. The inherent problem you face with this type of thing, and ultimately why Dan R quit the game, is that as you find these exploits they get patched. At this point all the "easy" stuff has been exploited and patched. Whatever's left for bugs and exploitable code is very difficult to find and exploit. So there may be another bug in the TZ that can bring Loki back online, but, it's going to be difficult, tedious work. This is not something that can be solved by flashing a couple files from a dev phone. I don't think people truly understand the scope of the security around these things. When you have an entire vritualized OS sitting on top of the hardware (the TZ) and secures direct access to the hardware using insane levels of encryption, well, it's not an easy castle to breach.
[Verizon Samsung Galaxy S 4] Gutsman:
Could a buffer overflow be used in the signature check to take control of the boot process?
[Verizon Samsung Galaxy S 4] Loglud:
Um unfortunately they do a check to the signature and only pass in how many bytes the signature is, so even if you tried to overflow it it would not take the overflow.

True but that mostly came in the form of a leaked Signed bootloader. One of the things that has happened here is that there is a second bootloader, which I assume never gets flashed, but provides a path for the main bootloader to communicate with a secure sector. Now this is where a very interesting security vulnerability was found in a previous in the previous versions that might actually be interesting. This vonerablity was that of blowing the unlocked fuse. Now this is truly interesting. For anyone whom has decompiled the tz partition they will notice that there are a couple of interesting lines.

tzbsp_blow_sw_fuse
[Verizon Samsung Galaxy S 4] SamuriHL:
True, but, the TZ has been quite well protected since Dan exploited it on the Moto phones. They kind of start to panic when the "trusted zone" has security flaws. LOL! So even if another vulnerability exists, and it's certainly possible, it won't be easy to find or exploit, and will be patched very quickly. I say this as a warning....if an exploit ever comes out for this phone that allows you to blow a qFuse to unlock it, do NOT hesitate. Some on the Moto phones did and now the vulnerability is patched with no hope of it being done again.
[Verizon Samsung Galaxy S 4] eskomo:
This device is locked permanently. The only way Verizon will open this back up is when people leave Verizon and port phone numbers to sprint. This phone is not locked down on sprint. Now you may not like sprint but honestly they are the best option. Otherwise you will forever have a locked down tight phone. There is a reason no devs are talking. They have nothing to say. Its much beyond them.
[Verizon Samsung Galaxy S 4] biznazz:
I wonder if there is anyway we could at least be able to semi unlock it to be able to flash ROMs like the Deva did for the Samsung continuum. The boot loader was still locked but we were able to flash ROMs. I don't remember how they did it tho

---------- Post added at 03:17 PM ---------- Previous post was at 03:16 PM ----------

We just didn't have a custom kernel
[Verizon Samsung Galaxy S 4] thejulianath20:
So your saying that Verizon's update changed the physical phone?! No Lol.

From what I've learned from Modding/Hacking in every electronic venue if the manufacture breaks the Mods with an update its only a matter of time before the Geniuses that do the Hacking will Hack it again.

I have seen this with all of my devices and the Manufactures trying to break the Hacks:

My original Xbox with Soldered Chip with XboxLive updates,

My Xbox360 Flashing the dvd drives and soddering my Motherboard to boot into RGH mode with XboxLive updates...

My AppleTV2 with Jailbreaks and OS updates

My iPhone and Jailbreaks and IOS updates

My Kindle Fire and Rooted and Kindle Updates

And now.... THIS!

If it was hacked before it will be hacked again ;) Have hope!
[Verizon Samsung Galaxy S 4] SamuriHL:
You've clearly never owned a Motorola phone...
[Verizon Samsung Galaxy S 4] KennyG123:
Ooops...wrong thread

I was never here

Carry on
[Verizon Samsung Galaxy S 4] Surge1223:
Haha I know about those Motos, had the Bionic and Droid x . 2nd-Init is when I first started learning about this stuff. Anyways were not going to be able to exploit Tz unless we have a modded/leaked aboot. and if we had that then threre would be no reason to exploit Tz since it comes after.
[Verizon Samsung Galaxy S 4] swears11:
I got $20 on the bootloader
[Verizon Samsung Galaxy S 4] blastagator:
That's exactly what the update did. Fuse blown, no going back.
[Verizon Samsung Galaxy S 4] RaptorMD:
Busted . . . LOL. :angel:

---------- Post added at 11:12 PM ---------- Previous post was at 11:11 PM ----------

So a new path must be charted and cut through. At the rate they are going the phones will have so many things blown in them they may never be able to fix them either.
[Verizon Samsung Galaxy S 4] Surge1223:
No they didn't. Qfuses are only able to be programmed once, while efuses can reprogrammed. They changed an efuse, blacklisting older firmware and this starts at the security checks at aboot. If we somehow obtain leaked/modded firmware (even just sbl2 or sbl3) it could be exploited again. So aboot is the problem, because everything want is after it in the bootchain, including recovery.
[Verizon Samsung Galaxy S 4] TechSavvy2:
So I don't know how many people knew this......but remember Adam Outler from the S3 and the Note 2?? Did you guys know he's at it again with the S4 bootloader? Its just that his thread is over in the AT&T section. But I could be wrong in saying, if exploits are found, a lot of times they are universal between devices. Definitely worth taking a look if you're one of those people who needed to see progress being made in order to continue to "believe"....

http://xdaforums.com/showthread.php?t=2255644

EDIT: There's not really a lot to follow.....but its more tech info q's and a's that people can go explore.
[Verizon Samsung Galaxy S 4] eskomo:
There isn't any info. Its a few days old and nothing in the form of progress. Just a bunch of nonsense about old useless programs that don't do anything to further help anyone on this project.
[Verizon Samsung Galaxy S 4] Surge1223:
True and though I had read it before it did remind me I have a knox installer on my phone anf found i have all the otacerts readable and then I found a completely readable devcerttemplate.dat
[Verizon Samsung Galaxy S 4] aldread:
Reading that thread just shows why 'real' development isn't discussed in open threads. Twenty posts from knowledgeable devs, interspersed with 170 nonsense posts from noobs and trolls. These discussions are happening, just not in public.
[Verizon Samsung Galaxy S 4] asharad:
Meh.
[Verizon Samsung Galaxy S 4] mlin:
I agree. What's the point of discussing progress in the public forums. It would only distract from the goal.
[Verizon Samsung Galaxy S 4] asharad:
I wouldn't mind learning from the pros. But I guess that isn't going to happen.
[Verizon Samsung Galaxy S 4] Loglud:
This is kind of true. There is a lot of misconception on what an eFuse technically is. When looking at the actual diagram an eFuse by definition (not IBM's latching fuse) is a electronic fuse. This runs under the same principle as a as a fuse that we use in an electric panels. If too much current flows the connection between the anode (negative terminal) and the cathode (positive terminal) the substrate breaks prohibiting the flow of electrons. This makes it so that you can only program all fuses once, 1 time, once their blown unless you want to use a FIB with Litho, your not going to fix it. With this logic, it is often times that they make when the fuse is blown the bootloader is unlocked, since otherwise it would render the device completely useless, even to them potentially. When you talk about reprogramming a fuse, what you're actually looking at is a FGMOS. or a MOS Latch, which under the right conditions can be reset.

eFuses are often times used for serializing devices since you can only program them once. usually theres a write enabled efuse which is not blown, they serialize a set of signals to blow the actual serial bits in the correct order then once thats done they blow the write fuse, and you will never be able to write the other fuses again. By doing this, we do not have to manufacture multiple targets (what is actually photolithoed onto the die) to serialize a die, since a target runs a couple thousand dollars, and a batch could have a million serialized devices, you do the math.

So now with this being said you can see why we do this. Now as for the bootloader, the reality is while there are people creating security measures there will be hackers breaking them. Don't ever give up hope for unlocks, because the reality is that it is potentially always a solution to use a second init and a boot strap, as this can truly be on any device that has a flaw in coding (all of them) because you can compile a runtime solution to push code over the existing kernel, or to start a new insecure boot process, and while this hasn't been a desirable method, it is *always* possible due to the nature of linux.
[Verizon Samsung Galaxy S 4] Obsidian...:
Hey guys I feel your pain over here. I came from the Bionic but got the Note 2 when it came out. Even though I don't have a S4 I know how it is and I saw someone bring up Safestrap. Since you guys are Sammy guys I figured none of you would really know or have access to Hash so I hit him up for you asking how hard it would be to make SS for the S4. He normally responds quick on Hangouts if he's available so I'll let you know what he says when I hear back.

Just so you know Kexec works great on Moto devices now. So I'm sure the great team of Hashcode0f and DHacker could pull it off for you but I have a feeling it'll only happen if word gets out that it's impossible to unlock. I know it's not a blown efuse like with the Bionic so it isn't physically impossible so at least there is hope.

If you don't understand what SS does with Kexec it basically hijacks the code right after the bootloader reads the valid signature of the stock kernel and loads a custom kernel on top of it. It can make the phone reset to that point as well so it doesn't take a long time on reboots.

Anyway I just didn't want you guys to give up hope that it can be "fixed" even if it stays locked but it'll be a while before I'd expect those two to take on such a large project with the possibility of a much simplier fix by someone finding a whole in the me7 code.

Please Message Me On Hangouts Rather Than PM obsidiansemail@gmail.com