[Verizon Samsung Galaxy S 4] npjohnson:
See below.

No released unlock, and no source code. No clue, see my ramblings below.

Well, if its what I think it is, it should work on all QCOM Based SAMSUNG devices that can get to a build made on or before JUL 2014.

Firstly, I congratulate Beaups on his work here! Its a tremendous feat! But... no actual unlock was released, and DEFINITELY no source for the exploit, meaning, we have no way to tell if it applies to the S4/Note 3. Don't ask. When we see the actual unlock, I can tell you for sure.

We have known for some time that using a well-written chain of public vulnerabilities, an unlock was 100% feasible.

On another note: DO NOT UPGRADE YOUR BOOTLOADER IN THE COMING WEEKS. If this is what I think it is, NC5 is your best bet. BUT stay where you are.

If this utilizes Dan's QSEE (As I'm 99% sure it does), we need Rollback Revision 6 (NC5, NG6, NK1, NK4) to be able to get to our vulnerable build (<=NC5). Anything lower (MK2, MI1, MJ7, ME7) stay where you are! You can always upgrade! If you are already on a leaked build (NC2) stay there, it can go lower (Rev. 5, or higher to Rev. 6). Unfortunately, if this makes use of Dan's QSEE exploit, OC1/OF1 are not vulnerable, and there is no chance of downgrade, sorry to be the bearer of bad news (you can check your BL version using "Phone Info" in the play store).

Now, onto what I THINK this is.

One of two possibilities:

- Using Dan's TZ QSEE exploit (use BypassLKM to get insecure module support, then load up specially cooked module to send a faulty SMC call that allows unsigned code access in TZ) to leverage TZ access, then using:

- M0nk's work on TZ (TZ Shellcode) to get shellcode access, and then write to the shared TZ cache/set up a script to modify the QFPROM readout of specific fuses every boot -- This would mean it will 100% apply to the S4, in which case, be excited.

OR

- Using just Dan's exploit and a fuse read/write gadget to write a new value to a fuse we did not know about previsouly -- This means it would LIKELY apply to the S4, depends on whether the apq8064 & msm8974 both have that fuse, and read it the same way, EXTREMELY questionable whether it would apply to any other device.

OR

- Use of a leaked insecure bootloader -- would be nice, but would only apply to KK S5's, no other deivces, AND depending on legality, may never see release.

NOTES: We had better hope for the former., because we already PARTIALLY have this working anyway. Would pry be a few minor changes, then we'd have it. Also, the exploit seems to have been run on a KK device (Which is why I am thinking it was Dan's QSEE exploit, purely by disclosure time-frame). Anotehr odd note is that Beaups flashes a Bootloader at the end of that, in the Bootloader slot in ODIN, which could've served two purposes, either:

- To show that the exploit survive BL flash (in which case its definitely one of my aforementioned thoughts).

- He could have flashed a custom bootloader, in which case, be excited.

- He could have flashed a leaked insecure bootloader (TBH, I have heard rumors of several of these floating around, but it is illegal to distribute), so in this case, we would likely never see a release, and it would work on ONLY that S5 model on a specific Rollback Revision.