yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] scryan:
To expand on this his claim was not made by itself.... He brought it up while offering to fix other peoples phones if the sent them to him... I dunno the guy, so Ill let you make the conclusion, but this is a guy who made claims asking people to send him expensive electronics, then when questioned was "Unavailable" when people wanted proof and offered the bounty for details... posted for a while but wouldnt answer questions because it was his "wife" then when he claimed to be back never responded to inquiries. He has not shown as much as a picture.

So.....
[Verizon Samsung Galaxy S 4] decaturbob:
all bs that somehow gets repeated in this thread every couple months....
[Verizon Samsung Galaxy S 4] Ricky Divjakovski:
Ive got some information you may consider useful.

PM me and ill discuss it more!

also [MENTION=5851429]sduda[/MENTION] not sure on these guys progress but I'd say they might be able to give you some useful info or y or u could expand on giving some to them
[Verizon Samsung Galaxy S 4] Diego1751:
Now that the KitKat update has been rolled out for a while. Any chance we could get a status update?

Thanks devs for all your work
[Verizon Samsung Galaxy S 4] decaturbob:
I can comment that kitkat is even more locked down than previous releases were where no native root method has been found to be possible, none the less a bootloader unlock or exploit.
[Verizon Samsung Galaxy S 4] Diego1751:
Sorry after reading it again I realize how bad my English was. I meant: now that the kit Kat update has passed can the devs let us know the current status or if there are any updates on our unlock.progress?

Mainly for those who have not updated to kitkat
[Verizon Samsung Galaxy S 4] SMiGGs:
When something has been discovered, or progress has been made they will post in here.

I have not updated my phone since i got it last year, stuck on mf3, waiting for that special day. I know everyone is anxious to ask, but its best to be patient and just check the thread every other day, theyll post when more progress has been made, sometimes its weeks, so dont be discouraged. Its best to keep the post to a minima, and leave the thread for new ideas, and progress. :)
[Verizon Samsung Galaxy S 4] kirbee213:
More like when they have found something they will be shouting from the rooftops in a voice that will be on loan from Morgan Freeman, held aloft by fluffy kittens, and shooting off the most wondrous display of fireworks known to man. While the masses dance in the streets to the magical music of thousands of babes crying their names. Yeah it will be that good, or better.
[Verizon Samsung Galaxy S 4] V0latyle:
You said it...now you have to create the picture to match.
[Verizon Samsung Galaxy S 4] Hashbang173:
I know heartbleed has been discussed before but now there is even more exploits from it: http://www.androidpolice.com/2014/0...-patches-7-more-vulnerabilities-some-serious/
[Verizon Samsung Galaxy S 4] NighthawkXL:
Still nothing relevant to helping unlock out bootloader though, however interesting reading nonetheless for us more geeky folks.
[Verizon Samsung Galaxy S 4] Hashbang173:
What if Samsung's server keys are the same as the bootloader keys?
[Verizon Samsung Galaxy S 4] dmt010:
Then there's a chance you could theoretically sniff raw data between client / server or send malformed packets to a device within a SSL established connection
[Verizon Samsung Galaxy S 4] NighthawkXL:
Even if that where true, which is incredibly unlikely this new exploit requires a very elaborate setup in terms of the SSL server and client. Not to mention let's hypothetically say we where to break into their server using Heartbleed (which is fixed) who would take the fall for the legal ramifications? Stealing a encryption keys is theft in the same way stealing a candy bar or money is.

The point is, there is nothing to gain other then knowledge from looking at Heartbleed and it's sister exploits.
[Verizon Samsung Galaxy S 4] dmt010:
Would it be possible to expose this vulnerability if one was able to set up a mock ssh server and force a device to communicate with it to exploit the device by redirecting any of these connections to the mock sever? That is if the device actually accesses something using SSL over IP in some way shape or form? Or would it be private key specific?
[Verizon Samsung Galaxy S 4] Hashbang173:
So there might be a very small chance we could get the keys to ublock the bootloader but it would be illegal
[Verizon Samsung Galaxy S 4] dmt010:
Yes that would be jail time
[Verizon Samsung Galaxy S 4] NighthawkXL:
I wouldn't know...

But the fact still remains... breaking into their servers would constitute a lot of legal issues. We're better off to continue researching a bypass via reverse engineering or hoping for a internal leak.
[Verizon Samsung Galaxy S 4] dmt010:
..

Please remove this post mod
[Verizon Samsung Galaxy S 4] travisjshepherd:
Sorry, Bump
[Verizon Samsung Galaxy S 4] ryanbg:
We're still working, we haven't given up. Not much to update on yet.
[Verizon Samsung Galaxy S 4] LiLPurP:
So I was reading about (and sorry if I have this wrong) different frequency blocks having legal restriction to prevent these things, the example used was that verizon which is on a C Block released the HTC Thunderbolt illegally with a locked bootloader, just wonder if this is the case on the s4 with att or verizon, i kno i does us no good but i am curious as alot of things have been recently changing in the mobile hacking and modding world

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] k1mu:
No. Access to certain LTE bands requires the vendors to not lock their devices to a single carrier. That agreement means that you can use any carrier's SIM in the i545 without having to unlock it. Nobody is required to provide unlocked bootloaders.
[Verizon Samsung Galaxy S 4] failedjedi:
Actually the terms say users have to be able to do whatever they want with their device. Which means unlocked bootloaders. However, there is a stipulation that says verizon can limit anything that will be "detrimental" to network performance. So they are using that as justification for being able to lock bootloaders.

I know at one point there was ready to be a lawsuit over it, but I don't know what ever came of it, if anything yet. It seems unless someone sues and wins, or the FCC steps in verizon can do whatever they want. The fact that the FCC isn't stepping in, makes it seem like their argument for allowing it is a risk to the network is holding up as far as the FCC is concerned.
[Verizon Samsung Galaxy S 4] E:V:A:
Can someone who has a SCH-I545 go figure out what is the EMMC used in that thing. I cannot find that info, and I'm tired of Google's lame results. Me and [MENTION=766721]ryanbg[/MENTION] need it to trace down the correct EMMC pins for JTAG.

You need to post your exact device name and model and the emmc size + ram size. Then if you can figure out what is the emmc name and model number.
[Verizon Samsung Galaxy S 4] Hashbang173:
In the AT&T S4 it's Toshiba THGBM5G7A4JBA4W

accoring to ifixit: https://www.ifixit.com/Teardown/Samsung+Galaxy+S4+Teardown/13947/

I'll continue to search for the verizon one

---------- Post added at 04:56 PM ---------- Previous post was at 04:51 PM ----------

Not sure if this helps but this is using jtag on the SCH-i545

http://www.samsdroid.com/2013/09/unbricking-samsung-galaxy-s4-verizon.html

---------- Post added at 05:16 PM ---------- Previous post was at 04:56 PM ----------

Found some other stuff about jtag: http://img843.imageshack.us/img843/2986/fzop.jpg

This guy might help you out, heres the site I got this from: http://www.ebay.com/itm/Samsung-Gal...JTAG-repair-brick-SGH-I337-M919-/281324081221

Heres a youtube video: https://www.youtube.com/watch?v=ScuBkgbWu8M
[Verizon Samsung Galaxy S 4] JLow0214:
I have SCH-I545 If you can tell me where and how I can find this out for you. I have Windows 7 and Ubuntu 12.04. So whichever is easiest for you to explain.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] failedjedi:
Someone needs to get [MENTION=3280118]geohot[/MENTION] an s4 now that he explodes back on the scene.
[Verizon Samsung Galaxy S 4] LiLPurP:
Hopefully [MENTION=3280118]geohot[/MENTION] has intrest in joining [MENTION=4939386]Surge1223[/MENTION] and the others in unlocking the bootloader, all we can do is hope for this thing to be exploited soon, large corporations could care less about what a percent of ppl have to say, thats why these guys work there butts off to give thousands of ppl the features they want, you guys are the heart and soul of what root has been and still is, thanks guys

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] jgrubbs:
Couldn't said it any better!
[Verizon Samsung Galaxy S 4] Walter.White:
[MENTION=4939386]Surge1223[/MENTION] [MENTION=3280118]geohot[/MENTION] [MENTION=766721]ryanbg[/MENTION] [MENTION=4372730]E:V:A[/MENTION] [MENTION=631273]Chainfire[/MENTION] [MENTION=2471504]jeboo[/MENTION]

CVE-2014-0973

https://www.codeaurora.org/projects...arsing-during-boot-image-authentication-leads
[Verizon Samsung Galaxy S 4] dmt010:
I love you
[Verizon Samsung Galaxy S 4] alias747:
Does this mean what I think it means??
[Verizon Samsung Galaxy S 4] Walter.White:
It depends on how Samsung implemented it. Nonetheless it looks promising.
[Verizon Samsung Galaxy S 4] NighthawkXL:
It might, time will tell though. After giving it a look over, and from what I've learned about our situation something may come out of it. The exploit looks good at least on paper, the trick is implementing it on the device. I'm not means a expert on the inner workings of our bootloader though, I'll leave the work up to those who are more attuned.

I hate getting my hopes up, but it's exciting news nonetheless. Regardless of the outcome.
[Verizon Samsung Galaxy S 4] dmc2359:
I wonder if this might be the exploit Dan is going to demonstrate at Blackhat, either way still looking forward to Dans presentation.
[Verizon Samsung Galaxy S 4] NighthawkXL:
It could be, but why publish it (publicly, that is) before Blackhat? I believe this is a completely different exploit that just coincidentally coincides with the upcoming announcement by Dan in August of his TrustZone kernel exploit. We'll know soon enough though, Blackhat is right around the corner.
[Verizon Samsung Galaxy S 4] dmc2359:
Maybe someone else found the same vuln that Dan found and published it. Fingers crossed that Dans exploit will be for Samsung!!!!
[Verizon Samsung Galaxy S 4] ryanbg:
Guys, the Samsung bootloaders are NOT vulnerable to this vulnerability. I just want to clear the confusion now. Samsung uses different code that is NOT vulnerable to verify images. Unfortunately we will have to keep looking. This is a separate exploit from Dan's upcoming project at Blackhat, and has existed for awhile now. It was published by a well-known researcher named Lee Harrison aka ralekdev, and Kang Li. Do NOT contact Lee Harrison about this being exploitable on Samsung, because it most certainly is not. It only applies to stock/near stock LK implmentation, while Samsung uses their own Odin/TIMA code to verify images. I hate to be the bearer of bad news, but it's best to make sure people don't get unrealistic expectations.

Dan's exploit revolves around TrustZone while this exploit is related to a vulnerability in Little Kernel (LK) as it verifies an image's hash.

We are making good progress, but again it will take time.
[Verizon Samsung Galaxy S 4] decaturbob:
Great analysis. ..too many want to jump to conclusions. ..as much as bootloader unlock is hoped for...gotta be realistic.
[Verizon Samsung Galaxy S 4] Mistertac:
It's nice to see that some progress is still being made... This latest exploit plus the recent root for Kit Kat phones is a good thing for sure

.... Even if this latest one that Ryanbg commented on isn't going to help any Sammy devices it's still very cool.
[Verizon Samsung Galaxy S 4] NighthawkXL:
I figured as much, hence why I told people it looked good on paper... not necessarily in functionality for our device. Perhaps there are some devices out there that might actually benefit from it though, who knows. That aside, thanks for confirming what we speculated that is wasn't Dan's new exploit that he'll show off in August. I guess it's back to the waiting game... keep up the good work.
[Verizon Samsung Galaxy S 4] 06sharpshot:
Am I able to help?

I am on the NC5 version now as I had to return my phone under warranty and the one they sent me as a replacement was already updated. Is there anything I can do with the version I'm on to help? I'm not very experienced but I can learn whatever is needed.
[Verizon Samsung Galaxy S 4] decaturbob:
Shouldn't post this is in thus thread...do some reading...There is stickie here in general forum you need to read and bookmark
[Verizon Samsung Galaxy S 4] 06sharpshot:
I'm sorry, I think you misunderstood me. I read the OP on this thread and was wondering if there was anything I could do to contribute even though I'm no longer on the ME7 build which is what the majority of the OP referred to.
[Verizon Samsung Galaxy S 4] ky5ever:
OK, so how does download mode really work?

Download mode is part of aboot, right? When its called, when you hold Vol Down and Power, is it loaded into RAM?

It kinda has to be in RAM, right? Cause if you flash in ODIN, it flashes a new aboot, so technically an old version of Download Mode, loaded in memory, is handling the installation of a new version, extracted into the eMMC storage. Upon reboot, the old copy of Download Mode is deleted from RAM and the BIOS or whatever loads the new version off storage. Right? Somewhat?

So, NAND Erase All does indeed remove everything, especially when paired with a .PIT file. Thats why its so dangerous to use. If the flash fails before aboot is installed, you may not be able to get back into Download Mode if you cut power to the phone. I have never saw "SD Card" mode in action, but I know it exists and I think its hardcoded because you apparently hold both volume buttons down to initiate it? (Please someone correct me if Im wrong about any of this) But you might could use that to get aboot back if its hardcoded. Kinda like a USB boot option on desktop computers.

So, this is really just a speculation, but Surge said it was possible to upgrade to NC5 but keep the old bootloader by simply removing the bootloader .tar file from installation. Some people did that. Its confirmed to work that way.

So, maybe its possible to NAND erase all, then install an older version of aboot? If it fails, its possible to just flash the latest version (or well, the version your phone is on) and everything will be fine. As long as Download Mode is still in memory.

Why wouldnt that work, though? What keeps track of what version aboot is? If its a QFUSE, it can be erased through ODIN.

ODIN does have the ability to literally destroy everything on the phone. I think the only thing ODIN couldnt do is delete the eMMC firmware itself. And....that may be what causes our problems. But eMMC firmware resets can only be done via JTAG as of right now. So, what gives?

If aboot's version is kept on file, so older versions wont be accepted, I know its easier than we think to get past that. We shouldnt really need to bypass it or ignore it, but simply delete it. Thats how the eMMC firmware reset works, so why wont this?

ODIN has a lot of power. We just need to tap into it.
[Verizon Samsung Galaxy S 4] Adam_NCNN:
Maybe instead of attacking the bootloader itself, what about spoofing the signatures? Sign an old bootloader as a new version and load the thing.
[Verizon Samsung Galaxy S 4] ky5ever:
Thats not possible. We cant sign the bootloaders because its encrypted with a nice 2048 bit key made by Verizon itself. We cant bruteforce it, and we cant hack Samsung or Verizon to get it. I doubt Samsung would even have it. Only way to get past it with that method is if someone finds an exploit related to it, like the TrustZone exploit we hope Dan Rosenberg is gonna release at Blackhat, or if a Samsung or Verizon dev just lets the key slip. But hed be in a metric crapton of trouble. Metric. Not imperial. Metric. Like a meter is more than a yard, a metric crapton is more than an imperial one.

Also, my idea wasnt to attack the bootloader, but to replace it. It still probably wouldnt be that easy, but it feels like the easy things are what no one ever thinks about, and the manufacturers overlook and dont patch.

I actually talked to a Verizon software engineer in a level 3 support call once. I talked to him about why Verizon thinks removing features is such a good thing. Sure, only 1/6 of the population know about rooting and its pros and cons, but still. He said he shared my feelings and wanted it done as bad as I did, but theres nothing we could do. And thats all because of Knox. Verizon had to make Knox sooper secure and apply a massive layer of encryption over it.
[Verizon Samsung Galaxy S 4] LiLPurP:
Ok so if as he said KNOX is indeed the issue, i have seen many threads refering to the removal of KNOX on the S4, so could that possibly help any? Or would that not change the encryption?

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] ky5ever:
No, as there are two different components of KNOX. I should have clarified.

Verizon added the extra layer of security for the Knox "container," which is the app that lets you have a secure work environment separate from your personal environment. Your work is encrypted and personal data cant be accessed while in work mode. Verizon added the security to better entice corporate workers needing phones for a "bring your own device" policy.

The other part of KNOX is the bootloader, its so low level that its nearly impossible to get access to the KNOX work mode without entering that password, and you can only enter the password when all conditions are exactly right.

Samsung supports the dev community, so you can actually flash another ROM without any trouble, but doing so compromises the guarantee that the bootloader is secure. So, KNOX work mode will no longer be accessible for the life of the device.

Verizon's bootloader security makes the phone impervious to unsecure ROM installs, so the KNOX work mode will always be accessible. Its actually a really cool and good thing, but it ****ing sucks donkey **** for us devs and rooters and such.
[Verizon Samsung Galaxy S 4] LiLPurP:
So is there no way to completeley wipe the device of everything, aboot, knox, ect. And install a new system? Or even a service to downgrade the system or bootloader?

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] ky5ever:
Thats what Im trying to figure out. ODIN says its deleting everything when you check NAND Erase All, and Ive had an S4 become bricked because of a power outage after NAND erase but before aboot could be installed. So I know it does completely delete aboot, not just overwrite it.

And I know Samsung workers, or people at Best Buy or something, have the ability to reset the KNOX void counter, reset custom status, and downgrade phones with ease. So there is a service or utility. But we dont have access to it.
[Verizon Samsung Galaxy S 4] peppersu812:
Now we can say goodbye to delvik on the next Android version. They are sticking with just ART.
[Verizon Samsung Galaxy S 4] LiLPurP:
ART will (with more developing) be better, but not to concerned with this, unlocking my bootloader is top priorety, ive been reading into the google sdition as well as htc phones, but money is tight and options for a new phone are low, these limits on MY phone are getting rediculous, the ONLY gain the carriers have for this, is to have more cobtrol over their CUSTOMERS device, witch isnt nessisary, if i want to void my warranty, thats my buisness, the only way to have actual android freedom is to buy an overpriced google edition, its criminal

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] dmt010:
Unrelated / Related, What are your thoughts on this..

@2:16

http://technet.microsoft.com/en-us/windows/jj737995.aspx

Wouldn't it be great if you couldn't install anything on your PC other than Windows?

Love Samsung...
[Verizon Samsung Galaxy S 4] DeadlySin9:
That's probably meant more for windows 8 tablets than PC's. Either way when it is implemented you'll see another thread to get around that.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] tiger505:
If I could ask a little help and see if anyone has an answer I'd be most appreciative. I have Verizon S4 with NC5 that I did NOT get from an OTA, but Odin the NC5. Got SU and was able to root. Cool. Followed the instructions to install Safestrap (permissive) etc and was able to get it installed, at least I think I did.

Safestrap says State: Installed

Install Recovery (which I did and it seemed to work) as it says 3.72 on left side

Uninstall Recovery

Safe System: Not Active

Reboot to recovery

But when I go to reboot to Recovery it just reboots the phone. ???? So as of now I cannot get in Recovery. Am I missing something?

Big thanks in advance if someone can fix me.
[Verizon Samsung Galaxy S 4] gunz.jones:
You'll need to ask this in the safestrap thread.
[Verizon Samsung Galaxy S 4] tiger505:
Thanks, I'm a little lost right now, will do a search for that thread.
[Verizon Samsung Galaxy S 4] gunz.jones:
http://xdaforums.com/showthread.php?t=2769389
[Verizon Samsung Galaxy S 4] Sir_Eagle:
That is working correctly on our phones.

What you need to do is go into the SS app, click "install recovery",then shut down, then boot phone normally. You'll get a screen with to options then, one to boot normal, and one to boot into recovery, this is how you get into SS recovery.
[Verizon Samsung Galaxy S 4] ky5ever:
EDIT: Realized several people had already answered on the next page (Im on my phone). Still, I provide a possible solution.

The reboot to recovery button is broken in the 3.72 release. Just reboot your phone manually. After the "SAMSUNG GALAXY S4" boot screen, you should see a robot figure with "SAFESTRAP: DISABLED" above it, and "Recovery" and "Continue" below. Pressing the menu key goes into Recovery, and pressing back skips the 10 second delay.

If you dont see that robot screen, then SafeStrap is NOT installed. You probably dont have Busybox. You should get an installer for it off the Play Store.
[Verizon Samsung Galaxy S 4] Surge1223:
Small correction, the reboot to recovery button is not broken in the 3.72 release. This error occurs because the reboot binary is symlinked to toolbox in kitkat, and toolbox cant reboot. You can fix this issue by removing the symlink to toolbox for the reboot binary.
[Verizon Samsung Galaxy S 4] kevinco1:
Thanks for the tip! I've noticed this is a problem in some ROMs, but for others reboot is fully functional in any app. Now I know how to fix this.
[Verizon Samsung Galaxy S 4] pyroman512:
Can samsung push any updates to KNOX that aren't OTAs? Yesterday was probably the worst day I've had with the S4. I'm on ME7 and I started get random reboots early in the morning. The battery plummeted and shut off. Before it shut down I noticed KNOX was using 75% of my battery. When I got home I plugged it in and it automatically went into dl mode. It would not accept a charger unless it was turned off. While it was off It vibrated every 10 seconds and showed a gray battery with a circle in it then shut off and repeated. I got it to boot and nothing would work without crashing including recognizing my microSD card.

It was all really bizarre and since I noticed KNOX killing some battery it confused the hell out of me because I'm on ME7
[Verizon Samsung Galaxy S 4] mcflyrk01:
thanks, that has been frustrating. what's the location of the symlink to remove?