yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] Skitals:
I had my service temporarily suspended (without notice) by switching my SIM into to many phones too quickly. Apparently it's an automatic protection meassure against theft or some BS. You can fix this yourself from the Suspend/Reconnect page on My Verizon. I bet that's what your problem is.

As an update... my ME7 backup has been going 12 hours and is only at 27% :( Unfortunately I didn't wipe any private info, so I won't even be able to share that dump.

I was looking more into the plugin jeboo mentioned, and it looks like you can infact do everything without any dumps (ME7 or MDK). The i545 Resurrector SHOULD be able to fix any hard brick, but it's still possible a full dump could be needed.

There are great instructions for the RIFF Box eMMC EFI/PIT/MBR/EBR Partitioning plugin here: http://faq.riffbox.org/content/10/5...emmc-efi_pit_mbr_ebr-partitioning-plugin.html

Per those instructions, it should be able to read the partitions from the device, right click the relevant partition, and "Select data from file to inject into ... partition".

Now I'm not exactly sure how verification works, but per Dan Rosenberg, the bootchain goes: pbl -> sbl1 -> sbl2 -> sbl3 -> aboot.

Each step loads and verifies the next. I'm not sure the sbl3 from ME7 will verify aboot from MDK. I don't know how to signature works... if they might be the same ME7 <-> MDK or if it's based on a hash. I DID note that sbl1, 2, and 3 did change from MDK -> ME7.

Also take note how it works on Motorola, which is apparently very similar (Qualcomm MSM8960):

So PBL can't be changed. Yet SBL1 has a different SHA1 hash from MDK to ME7. How does this work?
[Verizon Samsung Galaxy S 4] xbadace:
I have had to deal with this before testing phones for work (since I am the only one with verizon) I blacklisted my sim card quite a few times. Guys at verizon know me by name. My S4 has the correct time and date, reads my sim has been inserted, and shows my phone number, but keeps switching to Global mode on its own and will not pull service. My line is not suspended, but the note still shows as active. I'm thinking after the last full resurrection a modem did not get restored properly, or my sim card died somewhere in the switch and did not reactivate my s4. If I get a new phone today, I will drop by my work and start the dump with an untouched MDK. They most likely will not hand me one in store though, so it would be a few days to get my hands on it. Once I have the full MDK dump, we can try to flash it entirely and go from there.
[Verizon Samsung Galaxy S 4] jeboo:
The motorola essay is good for structure, but the s4 uses a totally different system regarding the qfuses.

As for the signatures, they change with each update (if the binary is different). It doesn't matter if it changes, the boot chain only confirms it's a VALID signature. There's no point in hard-coding signatures, as we can't generate them anyways.

So the hope is we can replace aboot with a valid/signed aboot from MDK via JTAG. This would presume:

- sbl3 doesn't check the version of aboot vs the qfuse before loading it

- aboot doesn't perform a check of itself vs the qfuse

I would not try and flash anything beyond aboot, which is all you need for loki. If that alone doesn't work, there's no simple JTAG solution.
[Verizon Samsung Galaxy S 4] xbadace:
I just got done dealing with Verizon. They had no idea what was going on with my phone, so I borrowed a gs3 from my job. While doing thisprocess I learned a few things. 1. To remove the "custom" from device state on the S4 you must root, use triangle away, select download mode, pull battery and manually enter recovery, wipe data, reboot download mode manually then flash the no wipe ME7 via odin. There is no write-up on this, so I figured I would share it. Also verizon will be sending me a new phone which will hopefully have MDK on it. If it does I will do a dump when I get it probably Friday
[Verizon Samsung Galaxy S 4] Skitals:
Why wouldn't you want the entire MDK bootchain? What would the harm be? It's trivial enough, and it removes possible kinks in the chain. Besides, ME7 updated the entire bootchain, there must be some reason for that. For what it's worth, this image shows all the partitions that were updated with ME7:

My other question is, are these files from the ODIN image compatible with the RIFF plugin? It will allow you to inject any binary file into any partition (*.*), but are these files from ODIN raw dump, or do they have extra header or partition info? When my ME7 dump finishes (another 24 hours...) I will open the dump with the partition plugin and extract a section, and see if it is identical to the counterpart from the ODIN image. That should tell us if it's compatible.
[Verizon Samsung Galaxy S 4] Skitals:
Did you check if you have a valid IMEI? It could have gotten corrupt from tinkering. This is why it's good to have a full backup, unless you borked the hardware.

For others that want to tinker... keep in mind when you open your phone and start soldering on the motherboard... you are 100% voiding your warranty. XDA does not tolerate warranty fraud and will close the thread. Mod at your own risk.
[Verizon Samsung Galaxy S 4] jeboo:
I've definitely seen qfuse checks in the sbl binaries, so they will most likely not boot. If you want a minimally invasive "hack" to re-enable loki, aboot is what you need.

And yes, the binaries are just as they appear in ODIN tars.
[Verizon Samsung Galaxy S 4] Skitals:
Going back to why I started down this path, h311sdr0id's claim was:

Flashing MDK via odin INCLUDES SBL1, SBL2, SBL3, etc...

So if anything h311sdr0id said is the be believed, a previously ME7 updated phone should be able to boot the entire MDK bootchain. But his unwillingness to respond to me or participate in this discussion is making me think it could be smoke and mirrors. It's frustrating when someone apparently already figured all this stuff out, but doesn't want to contribute that info to the community.
[Verizon Samsung Galaxy S 4] Skitals:
Quick update. Backup of ME7 complete. Took about 36 hours for a full 16GB flash dump.

I flashed the MDK aboot and it's hard bricked right now. I'm not getting anything when I try to turn it on. Making a jig right now to try to force it into download mode, but I doubt that will work. I was having JTAG issues and I couldn't get it to resurrect, or do anything for that matter. I was getting errors in RIFF. Probably jostled some wires when I was assembling. If the download jig doesnt work I will hook the dead body back up to the riff and see if I can revive it, and on to the next test :laugh:
[Verizon Samsung Galaxy S 4] jeboo:
Damn, guess it won't be that easy..If its hard bricked, only JTAGing will restore it. It means there is a security check failing in the boot chain (must be either sbl3 or aboot). The download jig requires a bootchain reaching aboot, where ODIN resides.

Did you try writing ME7 aboot back to phone? I get my MF3 test phone wednesday..
[Verizon Samsung Galaxy S 4] Skitals:
The phone was being detected, but trying to complete any function in RIFF I was getting this error:

All my troubleshooting told me it was either a bad solder connection, or a hardware issue. I resoldered and shortened the jtag wires twice to no avail. After trying everything (literally hours) I finally got the resurrector to run. It seems I had to "catch" the device at the exact right moment between plugging in USB (power) and hitting resurrect. Before it was bricked I had no such issues.

Anyway... it's flashing the resurrector data now, and the tinkering will recommence. I'm sticking to my gut and I'm going to try flashing the entire MDK bootchain next :silly:
[Verizon Samsung Galaxy S 4] Skitals:
I was able to resurrect to me7. Out of curiosity, I created a odin image of MDK without aboot. It failed on boot.img with an error:

secure magiccode check fail: boot

I am writing boot.img via jtag right now, hoping I will still be able to boot into download mode and try flashing my custom mdk odin image again.
[Verizon Samsung Galaxy S 4] Skitals:
I flashed mdk boot.img via jtag. I am still able to boot to download mode. I made a mdk odin tar w/o aboot and boot. It fails on cache with "secure check fail: cache"
[Verizon Samsung Galaxy S 4] Skitals:
Okay... I've had a bit of a breakthrough that tells me all might not be lost. When I do a fresh resurrect it will always boot into download mode no problem.

From a working state, for testing purposes I tried flashing the ME7 aboot... and it bricks the device. I've tried ME7 aboot from the stock odin image, as well as a one pulled over jtag after a fresh resurrect. For whatever reason, the way it is reading or writing is causing the signature to become invalid and hence the phone wont boot. Without being able to flash a ME7 bootloader, there is obviously no chance of being able to downgrade!

So I need to figure out how to extract and write a working ME7 aboot, and once I figure that technique, I will apply it to the MDK aboot.
[Verizon Samsung Galaxy S 4] Skitals:
Okay... I'm convinced it's an error with the plugin. I resurrected, did a full ME7 odin restore, read and saved the aboot partition with the emmc plugin, and flashed the saved bin back to the aboot partition and it bricks the device...

This should result in 0 net changes to the device, yet it fails to boot.
[Verizon Samsung Galaxy S 4] jeboo:
Just try writing aboot directly using the JTAG r/w or DCC r/w tab. Just get the flash memory address from the plugin.
[Verizon Samsung Galaxy S 4] Skitals:
I was successful booting after flashing ME7 aboot via DCC Read/Write.

I pulled aboot from the phone in terminal emulator using:

This bin was identical (sha-1) to the one I extracted from the emmc plugin. But flashing via plugin does NOT work. Flashing via DCC Read/Write tab works with the offset from the plugin (data length = file size).

Knowing this made it easy to pull aboot from my MDK phone the same way via dd.

I flashed the MDK aboot the same way via DCC Read/Write, and no boot.

I pulled sbl1, sbl2, sbl3 from the MDK phone in the same manner, and flashed with the proper offsets and also no boot. No download mode, no nothing.
[Verizon Samsung Galaxy S 4] Skitals:
Using the method I've proven to work, I tried flashing all the following partitions from valid MDK dumps:

aboot, sbl1, sbl2, sbl3, rpm, tz, boot, recovery

Still nothing :(
[Verizon Samsung Galaxy S 4] jeboo:
You're doing great work man..few have ventured what you're trying. A simple JTAG approach may not work, I'll confirm with MF3 later in the week.

Even resurrecting an ME7 brick is a major feat!
[Verizon Samsung Galaxy S 4] Bad Bimr:
Any more progress with this?

Thanks

BB
[Verizon Samsung Galaxy S 4] Surge1223:
Did you try bricking it, then corrupting emmc and partitions then use qpst to restore emmc followed by jtag sbl1 sbl2 sbl3 aboot etc? Plus use aboot as an mbn file and use a try to to covert sbl1 to a hex, that way its signed. Then use the sbl1.hex as the bootloader flasher and then try to jtag. I think sbl1 is the issue, and if you can get straight from emmc to download mode, youd be home free.

P.s. by valid mdk dumps do you mean you extracted them from the stock odin tar or that your dd 'ing previous partions with mdk onto your current system?

Edit: come to think about it and realized that the me7 ota doesnt touch sbl1, so leave sbl1 intact just get rid of sbl2 and sbl3 (pbl will trigger to go to qdload instead) then you could just jtag the rest of mdl bootchain or up until aboot, so you can get to download mode
[Verizon Samsung Galaxy S 4] jeboo:
Regardless of how you flash it, the protections within sbl2/3 & aboot are preventing a JTAG bypass (based on this thread and my MF3 experiments). We are back to the drawing board hoping to find an exploit (ie, loki) or a leak is released. :mad:
[Verizon Samsung Galaxy S 4] Surge1223:
Well lets say we intentionally corrupt the partitions. Im talking hard brick this phone. Doing so we send it to qdload. Then we use qpst to restore the emmc by either

A. Turning our extsdcard to the "internal" via dd like they accomplished on the s3 or

B. Send the msm8690.hex as the bootloader head file then jtag and/or dd the bootchain (sbl2,sbl3,aboot,tz etc) to the internal via adb or linux debrick tools.

Also, qpst has some valuable tools. What security checks would be in the way if we completely wiped out the bootchain and then manually put mdk on? Essentially were just using qdload to send a hboot, then fixing emmc to get to odin downloax mode.
[Verizon Samsung Galaxy S 4] jeboo:
You have the right idea, and we thought something similar would work too. Unfortunately the MDK aboot checks the qfuse value and the mismatch leads to boot failure.
[Verizon Samsung Galaxy S 4] Surge1223:
What if we used the aboot from the dev edition?
[Verizon Samsung Galaxy S 4] PetrichorXFi:
Looks like 4.3 update may set SELinux status to Enforcing. This is according to the leaked 4.3 build for the International model (GT-I9505) p[er SamMobile: http://www.sammobile.com/2013/10/01/exclusive-i9505xxuemi8-leaked-android-4-3-test-firmware-for-galaxy-s4-gt-i9505/

How will this affect bootloader/root?
[Verizon Samsung Galaxy S 4] xs11e:
Who wants to volunteer to test it?

HINT: NOT ME! I'm rooted, Lokied (is that a word?) TWRPed and CyanogenModed!

I'm happy with my S4 and totally unwilling to mess it up.
[Verizon Samsung Galaxy S 4] WarEagleUS:
Wow y'all are just amazing with your knowledge and abilities. I may be willing to try something here soon.
[Verizon Samsung Galaxy S 4] cybereclipse:
Pretty sure theres nothing to try. Looking like flashing MDK on a phone that was previously running ME7 won't boot because the of the qfuse check.
[Verizon Samsung Galaxy S 4] WarEagleUS:
I was referring to the poster who asked if someone wanted to try something, lol. I was referring to that when I said I may try something soon. Thanks for the reply bud. True that on the qfuse...winner of cracking the encryption of the Qualcomm checks would be possible. Given the length of the encryption (2048 bits) that would take a long time.
[Verizon Samsung Galaxy S 4] PetrichorXFi:
hmmm look into the Note 3's qfuse tech...

I thought that the Note3 actually has it locked down, yet I dont' remember hearing such with our phone... so perhaps we can modify/re-write parts of qfuse?
[Verizon Samsung Galaxy S 4] myfishbear:
idk maybe if we could somehow flash a modified shadow register we could break it open.
[Verizon Samsung Galaxy S 4] coolsilver:
SELinux is more security for the OS Kernel and File system than anything else. It keeps processes from trying to gain root or act foolish and try to get out of secured spaces.

It doesn't really do anything in regards to the bootloader. Think of it like DEP on Windows. It would help keep malware in check.
[Verizon Samsung Galaxy S 4] prdog1:
Basically have to kill any and all Q-Fuse checks. If have looked at a blown q-Fuse. Looks like a blown therm fuse on a 1970 Toyota. Q-Fuse is not tripped it is burnt. Would have to be replaced on the chip. If there is more than one which there must be would have to move check to another one. Blown Q-fuse is the ultimate block. That is why the old Motos were never unlocked. They write and then overvolt to burn it. I may be wrong but that is my understanding. Can never access that fuse again. E-fuses that are used by say Knox can be reversed with code although that is not easy either. I may be wrong but I'm buying dev phones from now on anyway to keep my unlimited.. :cool:
[Verizon Samsung Galaxy S 4] Cruiserdude:
This whole thread just reinforces my hope that having an all-LTE phone will soon be possible, thanks to the rollout of the AWS spectrum and VoLTE sure to be right around the corner. I don't see how Verizon could block any compatible device at that point, as the FCC regs won't let them. I get that they still need to use an ESN-based activation scheme until everyone has LTE phones with SIMs, which means it's a whitelist network. But just like the Nexus 7, an already activated SIM should register it's device on the LTE part of the network, they just won't be able to see what it is. So we could potentially buy unlocked GPe and Nexus devices in the near future and use them on Verizon.

But until then, we've gotta hold on to our MDK S4's, and keep trying to find a way to bring more into the fold.
[Verizon Samsung Galaxy S 4] antwong45157:
contacted my close friend at best buy about downgrading firm ware. i was told they didn't have a way to downgrade phones in the store. and I was referred to Google. go figure.
[Verizon Samsung Galaxy S 4] soulcrusher101:
Hmmm

So... I'm new here but am pretty sure I can can keep up with you guys. :p From my understanding, the QFuze in the Dev phone comes in tact, where as on the non dev phone it comes blown? And also from what I understand is that there is a piece of hardware (I can't think of what it's called right now, sorry!) that will blow the Qfuze on every boot? So, what if we removed the hardware that blows the QFuze, or just cut its connection to the QFuze, and then solder a new, unblown QFuze in its place and then flash the dev PBL, SBL1, 2, 3, and aboot... Wouldn't it, in theory, boot up into download mode and then flash the MDK??? Again I am new here, but I read this forum on a daily bases and feel I should finally chime in.

:fingers-crossed: :D
[Verizon Samsung Galaxy S 4] skeezer308:
You just resurrected a thread that's almost a year old.
[Verizon Samsung Galaxy S 4] joshm.1219:
In short, it doesn't work like thar
[Verizon Samsung Galaxy S 4] Batttie:
Maybe he used the search function!!
[Verizon Samsung Galaxy S 4] joefrog1996:
The q fuse is extremely small. You can see it with the naked eye.
[Verizon Samsung Galaxy S 4] soulcrusher101:
Yea, I'm fly like that.

---------- Post added at 09:34 AM ---------- Previous post was at 09:28 AM ----------

Learn something new everyday... Thanks! I don't know much about QFuzes, so I'm thinking I'm going to go do some research on em.
[Verizon Samsung Galaxy S 4] kenkitt:
QFuzes are inside chips

QFuzes cannot be accessed externally , that's why guys are thinking of a software based approach to this problem.

If one is blown, I think you would need to replace an entire chip.

So goodluck trying to solder one.
[Verizon Samsung Galaxy S 4] BoulderGeek:
Is this one of those "hip hop" threads?

I don't know if I feel comfortable with gangstas....
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
what?
[Nexus 4 Q&A, Help & Troubleshooting] dante510:
Hello everyone,

I have been experiencing poor battery life on my nexus 4 from stock 4.3. As of now it is running the latest ParanoidAndroid 3.99 Rom with franco.Kernel-nightly-r182.zip. I use hspa 5 hrs a day, wifi, light browsing, and email, with automatic brightness to only getting 2 hours 15 minutes of screen time. Then I would need to charge the phone again. I do use trickster mod to lower maximum clock frequency to 12000mhz and have my location access turn on/off base off necessity, with Google Now turn off. So does any one know if there are better ways to improve my battery life? A new rom or kernel perhaps? Any insight on this issue is much appreciated.
[LG Optimus G Pro] Gotroot:
Found this digging around thought it be good for people with locked bootloaders... You could use this to gain root on locked bootloaders

http://xdaforums.com/showthread.php?t=2250555
[T-Mobile Samsung Galaxy S II SGH-T989] eris170:
I recently flashed CM-10.1.3-RC2 and still no UMS. I guess it was removed from CM-10.1 earlier this due to bugginess. I wasn't able to tell if the bugs were in the SGS2 hardware, or CM itself. Can someone clarify? Because, if it's in the HW itself, it will most likely never work. I'm not using Windows so MTP/PTP simply do not work. I must boot into TWRP right now to transfer files. Iv'e also tried

setprop persist.sys.usb.config mass_storage

however no luck there either.

Anyone know of a ROM where UMS is working (AOKP, etc)?

Thanks
[T-Mobile Samsung Galaxy S II SGH-T989] Noyth:
Last time I used AOKP (a few months ago), it had working USB Mass Storage. If you don't want to switch ROMs, there's an app called Multi Mount SD Card (Sorry, I can't post a link) that can get UMS working for you.
[T-Mobile Samsung Galaxy S II SGH-T989] eris170:
Some of the reviews say that app didn't work for them so I went ahead and flashed aokp_hercules_jb-mr1_milestone-2. No UMS :confused:. Perhaps for the same reasons it's no longer in CM I guess. Happy surprise though: PTP *does* seem to be working under Ubuntu 12.04 with this ROM! Hopefully it's stable so I don't have to boot recovery to get the pics off.

EDIT: Nevermind on the PTP. It's actually not working. For some strange reason it's showing some pics that appear to be on the filesystem and not the device :|

EDIT: For anyone interested, found a link that sort-of gets MTP working on Ubuntu 12.04. You have to add some unstable repos and pull down some non-standard 12.04 libraries and edit some udev configurations. There are some limitations like file size, no drag & drop and opening files directly from the MTP mount point. http://xdaforums.com/showthread.php?t=2223401
[Upgrading, Modifying and Unlocking] olacnog:
I saw that rasputin1970 had the same problem

start of repair process,

preparing modem

perform. magic,

READ: 4, OOFF (OO si there square)

Failed to magic..

ROM: 1.03.00 WWE

ROM date: 11/01/04

Radio ver: 1.01.00

Protocol: 1337.38

Ext ROM: 1.03.154 WWE
[Sony Xperia S, Acro S, Ion] MaxPresi:
Good night guys ...

I used the DoomLord's ICS ROM and change to OpenSEMC R2 (10.1 CM)and that's really great. Very fast and smooth. Enough free RAM, the games run without lag (except Subway Surf does not work, as everyone knows), the battery have a long life and the screen looked better, even with small brightness.... Buuuuut the camera sucks! Pictures dark, unfocused, extremely grainy ... It seems the camera of Motorola V3!

So, I want the ROM for Xperia S with a better camera (because I bought this phone mostly because of the camera).

Sorry for my bad english and thanks for your help.
[Sony Xperia S, Acro S, Ion] Envious_Data:
any camera with .96 firmware

stock firmware often will have best camera quality
[Sony Xperia S, Acro S, Ion] MaxPresi:
So, what custom rom based on .96 fw has a good camera and is very fast?

Thx
[Sony Xperia S, Acro S, Ion] cities516:
Pure stock .96 is good and fast enough.
[Sony Xperia S, Acro S, Ion] MaxPresi:
Yes, I understand that. But I would like to know about a good custom ROM based on .96 fw that is fast and has a good camera (app).

Thx
[Sony Xperia S, Acro S, Ion] Envious_Data:
Pure .96

ACP official ROM (especialy V5(not V6)

, dont know about the Rest, dont realy feel the need to try them
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] JoeFCaputo113:
That can't be normal.... right?!
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] w7excursion:
If you have all the stock apps, yes. At least for me it was that way. Removed what I don't need and I can be down in the five or six hundreds.
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] JoeFCaputo113:
What'd you remove? I removed all of the Sprint stuff, but none of the Samsung stuff...
[Sprint Samsung Galaxy S 4 Q&A, Help & Troubleshoot] w7excursion:
I really can't remember. Some Samsung apks, Facebook, other apps I can't remember and their data folders.