yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 3 Q&A, Help & Troubleshooting] phat0074:
Could you please repost this one more time the links not working. Thanks
[Galaxy Note 3 Q&A, Help & Troubleshooting] rayman95:
true I removed it from my dropbox....I 'll reupload it

---------- Post added at 11:43 AM ---------- Previous post was at 11:40 AM ----------

do you want it odex or deodex????
[Galaxy Note 3 Q&A, Help & Troubleshooting] phat0074:
Odex thanks
[Galaxy Note 3 Q&A, Help & Troubleshooting] keeper22:
I would like it also if possible.
[GT540 Optimus General] soupmagnet:
Opening this post should automatically redirect you to another thread on the forum. If you are reading this note, it probably means that you are using a mobile app. Apparently, mobile apps have a problem with redirection and show this post instead. Use the link below to see the welcome message from the forum moderators...

http://xdaforums.com/showpost.php?p=46847787&postcount=1
[Verizon Samsung Galaxy S 4] Travisdroidx2:
This really sucks. Looks like the dev that knows how to downgrade from ME7 to MDK is locked up for a while.

h311sdr0id is currently indisposed and will probably not be getting out anytime soon. He has court next month. If anyone is interested in writing him, please send a message to his account and I will give you his info.

- Mrs. h311sdr0id
[Verizon Samsung Galaxy S 4] Nicgraner:
Man... Samsung's really cracking down...:eek:;)
[Verizon Samsung Galaxy S 4] neh4pres:
Is it confirmed this is Samsung's doing?
[Verizon Samsung Galaxy S 4] -Maverick-:
WOW, this is news to me! It explains why I haven't seen him update his VS3 rom in awhile.

[MENTION=3318503]Nicgraner[/MENTION]

Sarcastic joke, or are you serious?
[Verizon Samsung Galaxy S 4] belovedson:
I noticed in the note 3 part of the forum a member started a petition to unlock the boot loader. Can someone start one or combine with the note 3 page?
[Verizon Samsung Galaxy S 4] Surge1223:
Petitions just turn into complaint threads. I wanted to give this a last shot, so I posted alot of info and plenty of references with the intent that even less experienced s4 users could learn and eventually contribute to helping unlock this bootloader. I also offered some ideas as a starting point. Ive never joined irc's or google talk sessions with others in trying to solve things, I mostly read and learned on my own and im by no means a dev. But I don't think we can unlock this unless we stop complaining and one-uping each other and start working together. I wish that people would stop asking if devs are still trying to unlock this, or being pessimistic about it and start being part of the solution by reading a little and then helping contribute to a solution. All suggestions are welcome. But if you don't know what comprises the "bootloader", learning the flashing order of the partitions at least uptil tz.mbn would benefit you greatly.

P.S.

Just because your not a dev doesn't mean you cant help, most devs are knowledgeable about their devices, but some don't know much beyond how to use android kitchen.
[Verizon Samsung Galaxy S 4] equake:
On that note, I thank you for developing the OYUAMDK FW. I have not tried it yet just waiting for another guinea pig or at least have a backup device to swap SIMs so that I can have something to use.

Samsung has their first Dev Conference today in San Francisco and hopefully there will be Devs there to get better insight on Samsungs position on ROMs and bootloaders etc...
[Verizon Samsung Galaxy S 4] jeboo:
Awesome analysis Surge, that hellsdroid thread piqued the interest of several devs, including myself. Unfortunately I believe his thread was a bit misleading, which may explain why he closed it. There has been no demonstrated method to boot vulnerable BLs (ie, loki-fiable aboot) once the qfuse has been incremented.

Some of us are looking at the binaries, but no exploit has popped out yet. I did find it interesting they updated SBL1 in the latest OTA, that may be a hint towards something..
[Verizon Samsung Galaxy S 4] Surge1223:
So I just started analyzing my emmc back up (took the entire 16gb mmcblk0 to make sure I didnt miss anything) have you looked through the emmc? I think the modem and apnhlos are more involved in the security checks than we previously thought. Plus these tima, tzapps, and apps.mbn etc files may have contributed to the failure of flashing the mdk aboot on the me7 device you guys were attempting, is there a reason you guys didnt include the mdk modem and apnhlos in your attempt to restore the mdk bootchain? I flashed the dev bootloader with the exception of the dev aboot, boot and recovery using 3 heimdall packages. The first contained the modem, apnhlos and sbl1-3. The second contained rpm and tz, and the third contained boot and recovery (as expected this package failed) the result was my device was now on the dev bootchain with the exception of aboot, boot and recovery and confirmed these results via hexedit. So I think we can rule out sbl3 being the main culprit in checking the fuses when trying to flash a new aboot, also I dont get the "fused 3 binary 1 aboot" failure message when I attempt to flash aboot anymore, just the "secure check fail aboot" message. I definitely think its worth looking into using the dev tz.mbn to find an exploit because I no longer ever see the "samsung custom unlock" boot screen and my device believes its unmodified, and reports its official. My device is so far from unmodified its ridiculous. That means the dev tz.mbn partition I flashed is behaving as if my s4 is a dev edition (see ralekdev's post I linked to in the OP)
[Verizon Samsung Galaxy S 4] equake:
So does this mean if I flash your OUYAMDK ODIN image my Dev Ed phone will think its OOB without custom unlock?
[Verizon Samsung Galaxy S 4] Surge1223:
Theres a post in that thread where a dev owner achieved those results as well he only flashed a couple partitions, you can get more details there
[Verizon Samsung Galaxy S 4] Naddict:
thread cleaned of selling and or trading and the ensuing discussion.

Use Swappa.com for that.
[Verizon Samsung Galaxy S 4] dothog:
I've always known Samsung to be like Google when it comes to consumer development. Google supports and encourages the freedom to modify Android, it being open source in the first place. Samsung doesnt mind, themselves; it's carrier security teams that require companies like Samsung to create their own methods of locking down the device for the average user. I'm quite impressed with the Knox bootloader and secure VM app. It may not be done anytime soon, but it can always be cracked. But, the fact that this code is so hard to modify, thanks to carriers, is actually a good thing.
[Verizon Samsung Galaxy S 4] WillyPhilly100:
Hey guys I am totally supporting this thread. Unfortunately i have no experience in this kinda stuff or else i would help. Good luck!
[Verizon Samsung Galaxy S 4] TMcGrath50:
Much like most of us. Still out there Surge?
[Verizon Samsung Galaxy S 4] Surge1223:
Still here :) I use tw based roms so my motivation for wanting to unlock this isnt for AOSP or custom kernels. Its just the challenge, that and out of hate for Verizon lol. The Droid X sitting on my desk is a painful reminder of defeat. Cant let them win twice..
[Verizon Samsung Galaxy S 4] AntwonJenkins:
No doubt... can't believe i left my G-Nex for this locked down thing... unfortunately i had to craigslist an upgrade and couldn't snag one of these when they first came out.
[Verizon Samsung Galaxy S 4] th3bl3d:
i am also in full support of this thread! running stock MJ7 never rooted my phone once, i have taken all the OTAs i'm really crossing my fingers that someone can break this thing so i can finally root and install a stock google rom, i hate TW so much! with all the headache with safestrap and junk on the MI1 i was not wanting to root my device just to have a half assed recovery.
[Verizon Samsung Galaxy S 4] boogeeman69:
Does it mean anything that my S4 is still showing unlocked and custom? Should it still show that even if it is in fact locked?
[Verizon Samsung Galaxy S 4] MehStrongBadMeh:
Kinda, but it would have to be a Verizon model (that one is T-mobile) and would have to have a signature that still works correctly on devices that already have several q-fuses tripped. Such a device or firmware being leaked is extremely unlikely to happen any time soon (but you never know).
[Verizon Samsung Galaxy S 4] k1mu:
This is a fiendishly difficult nut to crack. The bootloader chain checks at each step. The primary bootloader uses a PKI key from Samsung to verify that it hasn't been tampered with, then it verifies the integrity of the secondary boot loader 1 before activating it. That then checks sbl2, which checks aboot. The aboot verifies that the kernel root of trust is from Samsung.

On top of that, there's data in the Trust Zone that normal software can't access unless the bootloader and kernel signatures are correct.

The description here really sounds like they've thought this through.
[Verizon Samsung Galaxy S 4] jamesd1085:
Yeah they have...we now pay hundreds for devices that don't truly belong to us...thankfully I'm still on mdk
[Verizon Samsung Galaxy S 4] Surge1223:
Secure boot is kind of deceiving though. Its true that each bootloader checks the next but only if they are valid or not. For instance you could flash an older rpm, tz, sbl2 etc this is also why you can flash older modems (the modem is a bootloader as well) its only for aboot that the version and validity are checked, that is you cant flash an older but valid aboot.

Edit: also you cant flash an older boot (kernel) or recovery partition either
[Verizon Samsung Galaxy S 4] coolsilver:
Sounds like the only real way to do this is to find a way to resign the old MDK bootloaders as the newer versions based on the version you have installed. OR find a way to increment the version that takes a cracked bootloader that would allow downgrading back to MDK and stock.

As you mentioned though, that would take someone leaking the samsung signatures to resign each part.

Such as someone not on MK2 could "upgrade" MK2 but really just patched and signed.
[Verizon Samsung Galaxy S 4] JLow0214:
So today I wake up to my phone wanting me to do a software upgrade. I havent done it but I'm already on mj7 as my phone came with it. Anybody out there take it?????

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] pyroman512:
The upgrade was MK2 and there is a root method and posts about it all over the place in the General Forum
[Verizon Samsung Galaxy S 4] JLow0214:
I Suppose were still screwed in the boot loader department on that build too huh?

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] tshelby73:
From my experience with locked phones is we will always be screwed unless you shell out the money for a developer phone on Verizon. Even then Verizon might block the updates like they did on Galaxy nexus, it still hasn't got 4.3.
[Verizon Samsung Galaxy S 4] kalestew:
Yup. And we pray for surge
[Verizon Samsung Galaxy S 4] pyroman512:
I follow this thread religiously. It seems he had made a lot of progress. Surge I have a question. Are you looking to just unlock the 4.3 bootloader or have you been looking at ME7 as well? And I don't know too much about the developer edition for the vzw s4 but if and when it gets 4.3 or 4.4 will that update be able to be flashed over ME7?

Keep up the good work Surge we are all rooting for you
[Verizon Samsung Galaxy S 4] Surge1223:
At first I was looking only at ME7, then I decided it would be beneficial looking at the latest build (at that time it was MJ7). Then recently things got busy with the new update coming out, and the holidays rolled around but recently ive been analazying the aboot from all releases and eventually, I hope to be able to see what they changed between every update and hopefully try to see what they (vzw and Samsung) saw as vulnerabilities they needed to patch up. So if you're also wondering why this thread has been slow lately its because

1. This crap is complicated

2 .The holidays are here

3. A new update was released

4. Samsung released new documents that a lot of us are reading

Hope that clears some things up!

P.S. The dev version prob wont get a 4.3 release anytime soon. We can hope though.
[Verizon Samsung Galaxy S 4] jco897j:
Any chance you'd like some outside help in analyzing the code differences between different aboots?
[Verizon Samsung Galaxy S 4] failedjedi:
Hey, I'm not asking for an ETA, but I am asking this: Are you hopeful enough that something will eventually be figured out that you still work seriously on it, or have you lost hope and it's more of a side project now? Just basically trying to get a feel for your confidence and hopefulness on it.

REALLY like the s4. Love removable battery, sd slot, and most importantly a physical home button with the buttons on the side. Hate the on screen buttons ala the nexus lineup.

Tomorrow is the last day to return the S4, I can't find a better phone hardware wise that fits my needs/wants. Guess I'm happy enough with safestrap and a google play edition of 4.2.2 that I will probably keep it.
[Verizon Samsung Galaxy S 4] Surge1223:
Im a overconfident person by nature. Im never pessimistic either. I work on it because it interests me. Im probably not anywhere near the skill level of some people on xda but ever since djrbliss exploited motos tz (a first I believe) I guess im of the mindset anything is possible. I know thats not the clearest answer but thats the only way I know how to answer that question lol.
[Verizon Samsung Galaxy S 4] Mistertac:
[MENTION=4939386]Surge1223[/MENTION]

Thanks for working on this I check in almost everyday, it interests me too.

Wish I had half the skill you have so I could help out.

Verizon Galaxy S4

# MJ7
[Verizon Samsung Galaxy S 4] jamesd1085:
Don't feel alone...I used to be somewhat knowledgeable back when we had froyo and gingerbread... But as much reading and learning I have done recently...I just can't gain enough to grasp this whole secure boot sequence to even work towards cracking it
[Verizon Samsung Galaxy S 4] JLow0214:
Hey surge I remember a few posts back you were saying something about documentation on the boot loader, tz and whatnot, could you point me to where those are or share them I'd like to read them.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Surge1223:
Sure. Problem is I refer to a lot of documentation lol Im currently reading this, doesnt seem very useful though

https://www.google.com/url?sa=t&sou...VmrL9NpydO4WPibXw&sig2=RDpqpZWQq6oZ_qRVNHo4wA

Im not at home, but when I get home I can link you to more documentation (the more people reading things the better)
[Verizon Samsung Galaxy S 4] JLow0214:
Sweet thanks man

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Cobaltikus:
Incorrect. We can flash aboot.mbn using Odin. Odin interfaces with the currently running aboot (or earlier running process) and does verify the signature. You can flash an unmodified aboot.mbn and sbl because they are signed properly. If you want to alter these files before flashing, you can, but you will also have to properly sign them or Odin won't let you flash them, and if you try to bypass that by dd'ing the files, it won't boot properly because the signatures are checked during boot as well.

I know if verifies anything of importance, but we probably don't want to circumvent the verification process in Odin, because that is there to help us. If you bypass Odin verification, you can get it to flash pretty much anything, except the lowest level boot process, but then when the phone reboots, the verification will happen at boot time and then you have a bricked phone.

Not sure, maybe someone else can answer that. I'm currently more interested in SBL1, which we can flash, as long as it's signed, because SBL1 is what verifies aboot, at least it is for the Note 3. But even if I had the Samsung Private Key, it would do me no good until I figure out what that flippin' hash is of. The private key will encrypt whatever you want to encrypt, but what is it encrypting? A hash of something unknown to me at the moment... I just know it is a hash of something on the phone that is accessible by anything that can properly verify the signature embeded in aboot, and is unique per Baseband Version, at least for Retail Devices.
[Verizon Samsung Galaxy S 4] SamuriHL:
Aboot on dev edition devices are most definitely not the same. The signature embedded in it is unique as I mentioned. This is why you can't take aboot from one dev edition and flash it to another and remain unlocked. Doing so turns it into a retail device because the signature doesn't match your device's cid. As for extracting cid I only know hiw to do it on the s4. I don't know anything about the note 3 partition table.

---------- Post added at 09:25 AM ---------- Previous post was at 09:20 AM ----------

Ok so you're talking about two different things which is where the confusion comes from. The mechanism I'm talking about is NOT about signing aboot itself. That's different. What I'm specifically referring to is how they generate the signature that is embedded in aboot to unlock a device. If the signature is present and valid for the device, it does not use the secure boot chain (iow it's unlocked). If the signature is not present or is invalid for the device, it will use the secure boot chain (it's locked). Signing the files to pass the flash check is a different issue.
[Verizon Samsung Galaxy S 4] Cobaltikus:
Sorry, I should have specified. I'm studying to unlock non dev editions. In order to flash aboot on a non dev edition, the signature in the non dev edition must be verified, and is unique per baseband version, and is not just a straight SHA256 hash of just aboot code section, and most likely does not incorporate the cid partition for reasons previously stated.
[Verizon Samsung Galaxy S 4] Walter.White:
Our N3 does have DBI partition. Here are all the partitions on our N3.

http://xdaforums.com/showpost.php?p=46922445&postcount=2

Nevermind. You are looking for CID partition not DBI. It seems like our N3 doesn't have CID partition.

Edit.

Also you can use the following site to analyze any .pit file.

https://jenkins.casual-dev.com/job/Analyze PIT File/build?delay=0sec
[Verizon Samsung Galaxy S 4] SamuriHL:
Well, here's the thing. The reason I know anything at all about this process is because I know of someone who was able to get their s4 dev edition upgraded. Don't ask... I'm not going into that backstory. In any case, this is what happened :

O) The s4 was odin flashed with the latest retail build at the time. It was locked after this... Iow a retail device.

O) The cid partition was extracted as a bin file

O) Samsung performed magic using the bin file and used it to generate a new device specific aboot file.

O) The aboot file was flashed, thus turning the "retail device" back into a dev edition... Running the latest version at the time.

The magic was that they took the cid bin image, hashed it with their private key, and appended the resulting signature to aboot, then resigned aboot so it'd pass the flash signature check on a retail device. So yes, this could be done to any retail device in theory. But you'd need to be able to generate the hash for the cid, and then be able to sign aboot. If you could sign aboot, then really you'd not have much need to unlock it. Hence even though the mechanism is fairly well understood, it gets us no closer to be able to use it to unlock.
[Verizon Samsung Galaxy S 4] dmt010:
Also added note the DMCA sucks
[Verizon Samsung Galaxy S 4] intika:
We really need a phone with an open source bootloader :(

Any way here is an other leaked stuff from samsung for the i9500 that let us boot the phone in a special mode "Odin - SDCard" may be from that mode we could downgrade the bootloader to an old hack-able signed version. (loki exploit or so)

Require only a : JIG O CABLE JIG

http://forum.gsmhosting.com/vbb/f777/hot-hot-easy-repair-boot-samsung-s4-i9500-via-sd-card-1693343/
[Verizon Samsung Galaxy S 4] NighthawkXL:
Judging by the age of that post I'd say it's completely irrelevant at this point and won't work unfortunately.

As for open-source bootloaders, well the closest any device will get to that is probably over on Project Ara.
[Verizon Samsung Galaxy S 4] ryanbg:
It's possible to downgrade to MDK and indefinitely disable rollback protection bits. Difficult, but possible. Perhaps the test bit is what you gentlemen are after ;)
[Verizon Samsung Galaxy S 4] Walter.White:
Mind sharing how to do that on N3? ;)
[Verizon Samsung Galaxy S 4] ryanbg:
Let me elaborate on this. The CID we're referring to in, reference to Samsung, is not the CID partition (Samsung does not use a CID partition). It's the identification/serial number assigned to your eMMC chip. That number is hashed (SHA256) and then signed with Samsung's Developer Edition private key (RSA, 2048 bits.) This results in a 256 byte signature. This signature is appended directly to aboot at the end, right after the aboot signature. Aboot verifies this signature upon boot, and sets a flag in aboot's memory. All that happens is a simple STR of signed int 1 to this address after verification of the CID signature. Aboot will hash the CID, and compare it against the value derived from the 'decrypted' signature, which again is the SHA256 of your eMMC CID.

---------- Post added at 12:50 PM ---------- Previous post was at 12:39 PM ----------

On the Note 3, you'll need to blow 0x80030 to the fuse 0xFC4B80AC.
[Verizon Samsung Galaxy S 4] SamuriHL:
Hopefully I won't get in trouble for posting this...

adb shell cat /sys/block/mmcblk0/device/cid > config.bin

That's what they used in the case of the upgraded S4 Dev Edition.
[Verizon Samsung Galaxy S 4] tulth:
If I am understanding you right, there is a "test bit" qfuse we can blow to prevent rollback checking on the s4? I realize this is probably not trivial.

Related info: I took a look at my verizon S4 PBL and noted many accesses to 0x706000 region (and 0x704000). Some of these code fragments are identical to what ralekdev has previously posted with respect to the 8960 (though at a slightly different address). I believe this device has the qfuses shadow at 0x704000

Based on the address you mentioned and the info above, we would possibly need to write something like 0x80030 to 0x7000AC
[Verizon Samsung Galaxy S 4] ryanbg:
Try searching for the bitmask in aboot (0x80030)

---------- Post added at 01:14 PM ---------- Previous post was at 01:13 PM ----------

No harm in posting that. It won't get you anywhere without having it signed with their private key.
[Verizon Samsung Galaxy S 4] SamuriHL:
That wasn't my point. I was given that command in confidence but hopefully the person doesn't care that I posted it.
[Verizon Samsung Galaxy S 4] ryanbg:
That command isn't secret is what I'm getting at. All it does it copy the CID from sysfs to a text file called config.bin (you already know that, but I'm making a point that cat is a standard Unix command.) Android and OEM applications read your CID in a similar fashion.
[Verizon Samsung Galaxy S 4] SamuriHL:
No, I know. I get it. :)
[Verizon Samsung Galaxy S 4] Cobaltikus:
Thank you very much for this.

And now that that has been explained, I'd like to restate my original question:

What the *regular* signature a hash of? I can't seem to reproduce it?
[Verizon Samsung Galaxy S 4] Walter.White:
Are you using .mbn and .imgs that you DD'ed off of your N3? Or are you using them from NC2 Odin tars?

If its the former then you need to remove padded zeros at the end...so that DD'ed image's hash matches to that of the files in NC2 Odin tars.
[Verizon Samsung Galaxy S 4] Cobaltikus:
NC2 Odin tars - no padding
[Verizon Samsung Galaxy S 4] ryanbg:
Hash of aboot that Samsung/Odin uses to verify the partition.
[Verizon Samsung Galaxy S 4] Cobaltikus:
What kind of hash? How is it generated? When you say aboot are you talking about just the code portion? Because if you take the code portion of aboot and generate the SHA256 hash, it does not match the decrypted signature.