yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] Surge1223:
Its interesting you mention that because if

I was just thinking about this and I don't think jtag would even bee needed. A lot of people assume it is because of the binary/fused failure message Odin gives if you try to flash an older bootloader. But if you try to flash a dev aboot Odin only gives a "sw revision check fail" message. And plus considering the dev MK2 and MJ7 aboot files are available we wouldnt be technically flashing an older aboot so I dont think jtag would be necessary as was the case with hellsdroids method.

I approach the bootloader situation with a null hypothesis, you know the science way. But one thing I cant verify by research or by my own means is some is the info located in the pbl of a dev device. It would also help immensely if you would download the viewmem zip I posted a few pages back and run some commands to generate dev pbl info, something that I cant believe I didn't think of asking dev users for until now.
[Verizon Samsung Galaxy S 4] Skeetch79:
I sent you a PM with links to both the MK2 and MJ7 aboot.mbn files from my DevS4 device. I will try and download thee viewmem zip you posted but I will need some tutoring...I don't know a thing about that program. I am happy to learn in any way I can in order to help.

---------- Post added at 04:33 PM ---------- Previous post was at 04:25 PM ----------

Ok, I adb pushed viewmem to my device. I also chmod 755'd it. I am lost after that point. What commands do I issue and then what do I do moving forward
[Verizon Samsung Galaxy S 4] Kamaole:
This is djrbliss' loki exploit. It was patched a while ago.
[Verizon Samsung Galaxy S 4] Skeetch79:
Ok, I ran all the commands on my MK2 device with viewmem. uploaded the 3 bin files for Surge1223.

Here is my screen print after all the commands were run: https://www.dropbox.com/s/f5e6izsdaz288qt/Screenshot_2014-02-23-18-18-04.png
[Verizon Samsung Galaxy S 4] Surge1223:
Yeah unfortunately. But on that note does anyone know or have I way I can contact Dan? I have a couple minor questions I want to ask him since some of what im trying to do I know he's already done. Im not going to ask him for help or any ideas though, that dude probably gets more email and annoyances from people asking if he'll help unlock their device than anyone so I can understand why he doesnt accept pms.

Yep great work! Now ill be able to tell the exact dumbassery method Samsung allowed Verizon to Vznavigate dev devices with. Yes I use the term "VzNavigate" synonymously with "An attempt to screw over some entity using a method that ends up screwing yourself over more, all while being oblivious to it" for instance;

Verizon: "New Share Everything plan!"

Me: *laughs..proceeds to remove the password off Wifi Hotspot..shares 500 gb of unlimited "everything" data at the airport. "Hey they said it not me."

Samsung: "The next best thing is already here!"

Me: "Yeah too bad we couldn't trust you morons to make the Nexus 5...Stupid Knoxi Vznavilovers..."
[Verizon Samsung Galaxy S 4] scoder:
Dan's twitter: djrbliss

or

dan.j.rosenberg@gmail.com
[Verizon Samsung Galaxy S 4] Surge1223:
OK! I need another dev aboot from OYUAMDK, OYUEMK2, or OYUEMJ7! Apparently I didn't have the right one before so I only have the two that Sketch provided. I need two copies from the same version. So if you know anyone that has a dev s4 ask them to do this for you or direct them here. Ill update this post when someone posts or pms me another aboot. Progress unfortunately will be stalled until then.

adb shell

su

dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/sdcard/devaboot.mbn

Edit: Changed requirement to any version of dev aboot
[Verizon Samsung Galaxy S 4] tommydrum:
(Removed Link as useless i guess) here is mine from an att gs4 on mk2

Sorry about that.. yea im ucuamk2, but not a dev edition.
[Verizon Samsung Galaxy S 4] Surge1223:
It has to be a developer edition S4, with the build OYUEMJ7 or OYUEMK2..thanks though
[Verizon Samsung Galaxy S 4] tshelby73:
You might check with Nitro maker if eclipse rom I think he might have a dev edition
[Verizon Samsung Galaxy S 4] Skeetch79:
PM sent with MDK DevS4 aboot.mbn
[Verizon Samsung Galaxy S 4] NighthawkXL:
He needs the MJ7 or MK2 aboot.mbn from a Dev S4 not the original MDK one sadly.

Seems like we're running into a wall... it looks like most of the people around here with dev S4's are still running the stock firmware.
[Verizon Samsung Galaxy S 4] Skeetch79:
I sent him one of each: MDK, MJ7 and MK2 aboot.mbn's

He posted this this morning: http://xdaforums.com/showpost.php?p=50609782&postcount=627
[Verizon Samsung Galaxy S 4] NighthawkXL:
Ah, didn't catch that. Thanks for clearing it up :)
[Verizon Samsung Galaxy S 4] Skeetch79:
Np :)
[Verizon Samsung Galaxy S 4] Dadud:
Keep up the work guys. Sending regards from the s3 forums, hopefully you find something we can use as well
[Verizon Samsung Galaxy S 4] pspod:
I wish I could help out. :/
[Verizon Samsung Galaxy S 4] NighthawkXL:
[MENTION=4939386]Surge1223[/MENTION]

You might want to check into what's allowing us AT&T users to downgrade from NB1 (4.4) back to MK2 (4.3) while still keeping the NB1 bootloader. Jeboo already confirmed from aboot that the fuse increment went up... and I would assumed the certs for the rest of the files would have changed?
[Verizon Samsung Galaxy S 4] Maribou:
This is just my opinion of course, but it seems like since the 4.4 update was only 400mb file, and not the standard 1.2g file, that it only changes and updates certain files. It doesn't wipe the entire device. So it keeps parts of MK2 and updates the rest. maybe I'm wrong here, but I highly doubt this is going to help in the quest for unlocking the bl.
[Verizon Samsung Galaxy S 4] phobia09:
I'm pretty sure there hasn't been a single OTA over ~700MB so it's not likely anything to do with the size of the update.
[Verizon Samsung Galaxy S 4] budding_developer:
Would this work, possibly?

I have been away for a while, so this may have already been tried... let me know if so, and what the results were.

I have an S4 running Hyperdrive 10.2 that is still on MI1 base. However, I am wondering if I could successfully flash this with the MJ7 aboot -- would it take, and turn my device into a developer device? The version count would be correct since MJ7 is the upgrade from MI1 -- it seems to me that if this works, I could then flash the remaining dev MJ7 files and have an unlocked bootloader on a dev device.

Or would the PBL stop any such "upgrade" with a failure message?
[Verizon Samsung Galaxy S 4] Surge1223:
Im working on this exact idea right now. But as of this moment, no it won't because dev aboots are unique, I mean even ones on the same build and also on corresponding retail builds. There's a 512b diff.
[Verizon Samsung Galaxy S 4] budding_developer:
I seem to remember someone saying that they were able to pad the file to make it the correct size -- would that be an option, or would it break the cert? There has got to be a way... :)
[Verizon Samsung Galaxy S 4] Nicgraner:
I don't think that would work as it would alter the MD5 wouldn't it?
[Verizon Samsung Galaxy S 4] MehStrongBadMeh:
Yes it would.
[Verizon Samsung Galaxy S 4] Nicgraner:
I hate shooting down all these ideas :( oh well. Hopefully getting the Note 3 this weekend. Anyone know if its any better over there?
[Verizon Samsung Galaxy S 4] JLow0214:
Pretty sure they're in the same boat as us.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Nicgraner:
Well that's disappointing
[Verizon Samsung Galaxy S 4] jeboo:
This has to do with selective version control. You can actually flash old bootloaders regardless of what version you're currently at, with the lone exception being aboot. Don't try this unless you have a JTAG, because you will hard brick your device. sbl1/2/3 all have internal checks vs the qfuse and will halt on a mismatch. The boot chain only checks for a matching qfuse and a valid signature of the next "link."

As for the ability to run older ROMs on newer bootloaders, that is simply based on boot.img (kernel) enforcement. Since fixing the loki exploit, there have been no further boot.img structure changes. If you look at a boot.img, you will actually see '..ME7' somewhere in the header, which was added to blacklist older kernels. I'm actually surprised they didn't go to a "3rd" boot.img structure to blacklist MK2, as that kernel exploit is pretty significant.

Of course now they're trying to embed basic functionality to the BL (lockscreens/wifi), but we see that's pretty easy to bypass :p
[Verizon Samsung Galaxy S 4] Kamaole:
Would downgrading from MLD be the reason my lock screen freezes and my sound is finicky?
[Verizon Samsung Galaxy S 4] ryanbg:
I've done a bit of reverse engineering, and I've discovered two very important pieces of information.

1. TrustZone appears to not be device specific, you could most likely flash any N3 TZ and possibly even S4/N2, as long as it is signed properly.

2. It appears rollback information is stored in the rpmb. I found a string in TZ.mbn directly indicating so.

Here's my idea; Since the only way to communicate with TrustZone is via TEE (Trusted Execution Environment) or in our case QSEE (Qualcomm Trusted Execution Environment) which is a proprietary stack. The device driver for QSEE is /dev/qseecom. I'm doing some experimenting on whether it'll accept commands or data, but this looks to be the most promising route. If it were possible to rollback the counters to 0, which I know now to be rpmb based so we can most likely reset them, we could flash an old aboot that exists from MHV or MG3 (I might be able to insert the certificates MG3 since it is not signed, but it's 4.2.2 based.) I'm able to see much lower level debug and logging information thanks to [MENTION=4939386]Surge1223[/MENTION]. The files in /firmware/image and /system/etc/firmware are elf images of TZ HLOS applications. Another place to start investigating more thoroughly. I would not be surprised to find Knox related things too.

After an attempt of provisioning rpmb:

Hmm...

More information: RPMB Secure Boot PDF
[Verizon Samsung Galaxy S 4] pyroman512:
When the S5 was announced I almost got sucked into the bandwagon until I read about KNOX 2.0... I mean I honestly feel sorry for whatever hardcore users get the consumer edition. Once it comes to the S4 we likely won't have any administrative control left. I got excited because I thought I was reading that the new knox would give you the option to have or not have it.. but that was quickly ruined.

I hope everyone doesn't jump ship to the S5 upon release because I already see that as a lost cause
[Verizon Samsung Galaxy S 4] jj22212003:
i remember way back when i owned a magic... i know that is an htc product but that was originally cracked with an unsecured sbl.... is there a possability in that area.... again, i know that it could be far fetched but im just asking because ive been out of the game as far as samsung goes
[Verizon Samsung Galaxy S 4] ryanbg:
enter download mode

set_charger_state: buck(1), chg(0), reg(0x04)

ULPI 0x81:3a, 0x82:2b

USB init ept @ 0xf91a000

init_ddi_data: usable ddi data.

<LP> ODIN MODE

<LP> PRODUCT NAME: SM-N900V

<LP> CURRENT BINARY: Samsung Official

<LP> SYSTEM STATUS: Official

KL: API Status 0x0

KNOX KERNEL LOCK: 0x0

<LP> KNOX KERNEL LOCK: 0x0

WV: API Status 0x0

KNOX WARRANTY VOID: 0x0

<LP> KNOX WARRANTY VOID: 0x0

QFPROM oem_config1: 0x00000f03

<LP> QUALCOMM SECUREBOOT: ENABLE (CSB)

anti_en 0xf

QFPROM_RAW_AP_ANTI_ROLLBACK_ROW0_LSB: 0x10001

QFPROM_RAW_AP_ANTI_ROLLBACK_ROW1_LSB: 0x3

QFPROM_RAW_SPARE_REG19_ROW0_LSB: 0x0

<LP> RP SWREV: S1, T1, R1, A2, P0

<LP> WRITE PROTECTION: Enable

odin3_init()

udc_start()
[Verizon Samsung Galaxy S 4] Blahness:
How did you get this print out (I know what it is)?
[Verizon Samsung Galaxy S 4] gnubian:
Care to share what it is/means?
[Verizon Samsung Galaxy S 4] Blahness:
It's a print out of statements that aboot makes as you put it into download/odin/fastboot mode plus some extra debugging comments of qfprom being read. These print out statements can be seen in the aboot source and is a good way to watch what's getting executed in what order if you dont have IDA setup for remote debugging (which I couldn't figure out)
[Verizon Samsung Galaxy S 4] gnubian:
Ah. Was thinking it was a step forward to unlocking BL (though I saw secure boot still enabled). Thanks for the clarification.
[Verizon Samsung Galaxy S 4] Surge1223:
Ok that's it. Its become apparent to me that far too many people are under the impression that the "bootloader" is a single entity, and that it is just too complex to understand. This is unacceptable to me. I had no idea what a bootloader was before I got this S4. Im going to detail the process first with a general overview, then again in more detail. Plus I dont see the current threads on this topic that include all we know, like the hexagon modem/kernel and the function of the tz and sbl2 are way over generalized. And discussion of the device cookie is completely missing. Ill post it in a new thread thread and link it here when im done.
[Verizon Samsung Galaxy S 4] instinct408:
I would love a guide on bootloaders, I have always wanted to learn but never really found a good source for this. It would be amazing if you made a guide!
[Verizon Samsung Galaxy S 4] ryanbg:
You are right, this technically does come from aboot, but that dump is from the log file that those strings from aboot create ;) aka that is a device specific (mine) dump.
[Verizon Samsung Galaxy S 4] Blahness:
Where can I find this log file on my phone? And is this a dev device or no?
[Verizon Samsung Galaxy S 4] Surge1223:
Using a flash programmer is probably out of the question now unless someone knows how to authenticate it with sbl1.

Edit: Actually wait I wont disregard this idea yet...

So if you look into the Qualcomm's Gobi Loader protocol (the method they use to communicate with devices in QDL mode) you will find it contains information on how to communicate with devices in this so called bricked state. In the QDLEnum.h file you see that it defines QDL protocol enumerations and related methods

So it would seem that if we were to use the Gobi interface we could upload amss.mbn which if you look at /firmware or /firmware-mdm you can see that the file is clearly in there, better yet the file is in ELF format..so ill update this in a bit with more info as to what it actually does or contains...also check this out, its Ralekdev's post on a similar matter which gave me an idea/clue to this

Theory on the reason SBL1 Calls RPM

- So we know it contains info on how to kick watchdog out of reset in order to enable krait and uses sbl1 and sbl2. This makes sense with the scenario I've described above. The smart people reading this will realize that amss (in general, not amss.mbn) is the modem, so what the hell does it have to do with sbl1? Good question. Remember those /firmware and /firmware-mdm folders I described above that are mounted via loopback from the modem and hlos? Theres an elf copy of sbl1 and sbl2 in there...so the significance of Gobi requiring the amss modem image is that it corroborates the documentation we have and evidence that shows without sbl1 and sbl2 the device will boot into qhsusb dload mode...so the plot thickens.

Some memory location and magic numbers to check out/ locate:

Mobile Model number location

MOB_MODEL_LOC 0x00000024

ROM_CHECK_LOC 0x000FFFDC

Rom Security Code

SEC_CODE_BYTES 8

SEC_CODE_LOC 0x000FFFE4

Secure Boot

SB_OK 0x00000000

SB_OFF 0x80000000

SB_ERROR_VALIDATE_PUBLIC_KEY_INFO 0xFFF10000

SB_ERROR_VERIFY_PSS_RSA_SIGNATURE 0xFFF20000

Magic numbers for allowing SD card dload mode

FORCE_DLOAD_SD_MAGIC_NUM_1 0xDFE699D3

FORCE_DLOAD_SD_MAGIC_NUM_2 0x8423C761

FORCE_DLOAD_SD_MAGIC_NUM_3 0x66666666
[Verizon Samsung Galaxy S 4] TMcGrath50:
I don't know much about QPST, but I've become more familiar lately with eMMc functionality lately. I think it's a long shot, but it's a good idea none the less. I'm trying to correlate base addresses and binaries, and it's a mess.

My question to you Surge: have you ever heard of an OTA introducing a security loophole that didn't exist on older versions? I don't think Sammy has made any deep firmware modifications with the updates, so it's probably a waste of a thought. At least, none deep enough to affect the bootloader level binaries (probably, with the exception of closing the Loki loophole).

---------- Post added at 06:25 AM ---------- Previous post was at 06:19 AM ----------

Do you think there's still anything to be learned from Dan Rosenberg's old S4 exploit?

http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html?m=1
[Verizon Samsung Galaxy S 4] Surge1223:
Alright, I had not seen this part of this thread. Apparently their idea was/is similar to what we are trying to do (when I say we I mean I but hey to each his own lol). Apparently they were going down the same road as me (albeit, they had more knowledge and man power) but stopped pursuing that avenue once Adam posted about the leaked aboot. So currently im waiting/trying to get qpst to give me a signed 8960_msimage.mbn, but even without it I have been able to to get qdload.pl to give me:

Sending MAGIC...
Got magic response: 03 00 03
Requesting SoftwareVersion...
sent 0c
received something
Version: PBL_DloadVER2.0
Requesting Bootloader..........
Response: 03 00 06
Requesting Param...
requestParam send ok
Param: 08 08 01 06 00 90 00 00
Sent 0x16
got back something
Uploding file...

I feel like I might be able to get a device unbricked if I can create the signed version, though thats not my main goal. if you click the link above and actually understand what they are talking about then you can probably see what im trying to do..maybe ill try to dump the pbl next see what we can find out.
[Verizon Samsung Galaxy S 4] Surge1223:
I'll agree with you on the base addresses and binaries, its a big mess and hard to learn to do. Kudos for joining the effort! As far as security loopholes, I don't know there's alot of firmware updates to go through. Well I posted the link to djrbliss' post in the OP, I think a lot can be learned. Especially by studying the aboot.c file of Little Kernel project. According to Dan they are similar and you can see they are similar from some relevant sections I posted below. The second quote is what djrbliss found out phone's aboot says

kernel_actual = ROUND_TO_PAGE(hdr->kernel_size, page_mask);
ramdisk_actual = ROUND_TO_PAGE(hdr->ramdisk_size, page_mask);
second_actual = ROUND_TO_PAGE(hdr->second_size, page_mask);

dprintf(INFO, "Loading boot image (%d): start\n",
kernel_actual + ramdisk_actual);
bs_set_timestamp(BS_KERNEL_LOAD_START);

offset = page_size;

/* Load kernel */
if (mmc_read(ptn + offset, (void *)hdr->kernel_addr, kernel_actual)) {
dprintf(CRITICAL, "ERROR: Cannot read kernel image\n");
return -1;
}
offset += kernel_actual;

/* Load ramdisk */
if(ramdisk_actual != 0)
{
if (mmc_read(ptn + offset, (void *)hdr->ramdisk_addr, ramdisk_actual)) {
dprintf(CRITICAL, "ERROR: Cannot read ramdisk image\n");
return -1;
}
}
offset += ramdisk_actual;

dprintf(INFO, "Loading boot image (%d): done\n",
kernel_actual + ramdisk_actual);
bs_set_timestamp(BS_KERNEL_LOAD_DONE);

if(hdr->second_size != 0) {
offset += second_actual;
/* Second image loading not implemented. */
ASSERT(0);
}

hdr = (struct boot_img_hdr *)buf;

image_addr = target_get_scratch_address();
kernel_actual = ROUND_TO_PAGE(hdr->kernel_size, page_mask);
ramdisk_actual = ROUND_TO_PAGE(hdr->ramdisk_size, page_mask) + 0x200;
imagesize_actual = (page_size + kernel_actual + ramdisk_actual);

memcpy(image_addr, hdr, page_size);

offset = page_size;

/* Load kernel */
if (mmc_read(ptn + offset, (void *)hdr->kernel_addr, kernel_actual)) {
dprintf(CRITICAL, "ERROR: Cannot read kernel image\n");
return -1;
}

memcpy(image_addr + offset, hdr->kernel_addr, kernel_actual);

offset += kernel_actual;

/* Load ramdisk */
if (mmc_read(ptn + offset, (void *)hdr->ramdisk_addr, ramdisk_actual)) {
dprintf(CRITICAL, "ERROR: Cannot read ramdisk image\n");
return -1;
}

memcpy(image_addr + offset, hdr->ramdisk_addr, ramdisk_actual);

offset += ramdisk_actual;
[Verizon Samsung Galaxy S 4] Gator Brah:
I HAD an mdk phone...froze the update apk's and all...had everything i dreamed of on that baby. Then the screen cracked..then the screen cracked again...then it got dropped into a pool. Im on my 4th S4 and not one of them has been on MDK since the first one. Its heartbreaking. I'm extremely grateful to have SS at the least but for me, aosp roms are where its at.

I appreciate all the hard work hashcode has put in (donated for SS) and would gladly donate to you fellas on this endeavor.
[Verizon Samsung Galaxy S 4] awskier08:
I can test also if you would like.
[Verizon Samsung Galaxy S 4] TMcGrath50:
Ah, I really need to brush up on my programming. Shouldn't be too bad. I'm going to see what I can dig up in the next few days from LKP. I'll be slow though, I'm swamped with school work right now.
[Verizon Samsung Galaxy S 4] Froryrory:
What school work? Maybe I can lighten the load with the math and/or engineering portion. LMK...
[Verizon Samsung Galaxy S 4] TMcGrath50:
I'm an undergrad in aerospace engineering, and I just have a lot of research projects and designs to finalize. If only it took a rocket to unlock this bootloader...
[Verizon Samsung Galaxy S 4] harrytery:
Maybe it does take a rocket :)