yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] networkservices:
How is not this simple? Copy a boot loader that is unlocked from an older S4 that has not been stolen by Verizon. Gain root access on your locked device and overwrite the boot loader with a copy of the unlocked boot loader.
[Verizon Samsung Galaxy S 4] dmt010:
Because you have to get in to the 2006 Ford bootloader with the 2006 key the hybrid 2005 model key won't fit the socket.

Even if you were able to get in by breaking in doesn't mean the key will start the engine
[Verizon Samsung Galaxy S 4] skepticmisfit:
here's a less funny reply:

the Verizon s4 never really had an unlockable bootloader, just one that was exploitable (through the Loki process)

also there's RSA encryption keys for each bootloader and cracking RSA would literally take a hundred years.

also there's a different key for each bootloader and, get this, each variant of the s4. so you can't use a different carrier's bootloader on any s4, or any phone in general. that's generally not how it works.

and, to top it off, there's a hardware fuse that trips every time there's a bootloader change, e.g. in an OTA update or Odin flash. that hardware fuse prevents downgrading to older bootloaders and only allows the writing of new ones.

Hope that made sense.
[Verizon Samsung Galaxy S 4] npjohnson:
Just FYI, this is wrong. The S4 (and all apq8064 devices) have static fuse beds, meaning that the fuses aren't written by updates, they are only written at the time of manufacturing (or by TrustZone exploit :p).

What prevents downgrades is a specialized drive separate from the eMMC, called RPMB (Relay Protected Memory Block), and the only way to write to it is by booting a newer signed SBL (which would up the counter upon first boot). The value of this partition is read out by SBL/Aboot through TrustZone protocols to determine if Rollback prevention should be enforced.

And to shoot down potential questions: No, you can't just format/zero that partition, if you could/did, you would brick, as even MDK expects some value to be there (likely due to internal testing builds). No, you cannot read it out/write to it without a TZ exploit, and a very specialized understanding of the eMMC/how Samsung's RPMB works. No, you cannot use JTAG to write to it. The only way to write to it would be to unhook the eMMC and know the pin outs/can hook them up, and have Toshiba's vendor commands for our eMMC (never gonna happen).
[Verizon Samsung Galaxy S 4] skepticmisfit:
thanks for correcting me, you're better at this than I am [emoji12]

I'm just an outsider who has like 3 devices and is interested in this one primarily (cuz its my actual phone lol)
[Verizon Samsung Galaxy S 4] scryan:
I can't believe that after, what 2 years? We forgot to try this. So much wasted time.

Thank you.
[Verizon Samsung Galaxy S 4] XxD34THxX:
I really hope that was sarcasm after reading the lest few posts..
[Verizon Samsung Galaxy S 4] sinner822:
Not to be a ****. But posts of dreams and ohhs and ahhs are not wanted. Wait for real facts. Start a new chat room elsewhere for that. Please. Sorry for the rant.
[Verizon Samsung Galaxy S 4] daredevl99:
You dont want updates? No problem.
[Verizon Samsung Galaxy S 4] networkservices:
Thank you for the helpful answers to my question. I have over twenty years of experience consulting in networks, operating systems, software, and information security. My skill set and desire to own the hardware and software that I purchased could be helpful to this endeavor. I do not have the time to pursue this right now. Hopefully in a couple of months I will. I purchased an S4 with kitkat that was rendered useless by OTA updates to lollipop. Battery life went from 7 days to less than 7 hours. I also bought an extra battery, lifeproof case, and wireless charger, so the quickest fix was to buy a refurbished S4 with kitkat and root that. At least it is functional, and I have control of the device.
[Verizon Samsung Galaxy S 4] dmt010:
Nice resume. This device is a lot smarter than you think, I think, they all think. Also "Serious" topic is serious as you can see.
[Verizon Samsung Galaxy S 4] 2real4u:
You may want to start reading up on QFPROM (eFuses) and how this affects Secure Boot.

It has been discussed in this thread many times.
[Verizon Samsung Galaxy S 4] jaw20:
That one is not the right exploit. This one is the right one
[Verizon Samsung Galaxy S 4] blackops11252:
This thread keeps going. ....going....& going!
[Verizon Samsung Galaxy S 4] TTLayland:
This is the best thread on xda.
[Verizon Samsung Galaxy S 4] real4life72:
And hopefully thread will keep going. I wish I had the skills these developers had. I have confidence someone will crack that annoying bootloader.

Thanks to all the developers for everything. You have taught me a lot.
[Verizon Samsung Galaxy S 4] goggles99:
This thread is done... lock it down.

flash tmobile unlocked loader and chain binaries and be done with it. It don't care about blown eFuse - Screw VZW and ATTs garbage I threw it out at day one.
[Verizon Samsung Galaxy S 4] jaw20:
That doesn't work, as secure boot won't let it boot.
[Verizon Samsung Galaxy S 4] dmt010:
This is not a very nice comment
[Verizon Samsung Galaxy S 4] XxD34THxX:
Why don't you test this out firsthand and see what happens?

Why don't you see what happened to those who tried this?

Why don't you look up exactly why we can't do that?
[Verizon Samsung Galaxy S 4] doubleaykay:
Back to the topic...

Does Samsung's implementation of Secure Boot and TrustZone have any custom code that makes it different from what Qualcomm ships? Because if it does that may be a possible attack vector... HTC did that, and it made their Secure Boot/TrustZone vulnerable. Take a look at this:

http://atredispartners.blogspot.com/2014/08/here-be-dragons-vulnerabilities-in.html

Also, I found a post from a while back that details the Secure Boot process, if it helps anyone.

http://xdaforums.com/galaxy-grand-2/general/qualcomm-msm-boot-process-t2697617

Any progress updates that you guys are willing to reveal?
[Verizon Samsung Galaxy S 4] Surge1223:
Our secureboot is more or less standard for msm8960 with some parts changed for apq8084 and as far as the TZ I actually used some of that site you referenced code to compile a driver that dumps some of our qfprom. But anyone will tell you that our tz is a far cry from standard. As far as what the group you're referring to's progress, I'm not sure, I left the group. But last thing I did was write a few modules to aid them, so I'm not sure what they have achieved

I also completely understand how the developer edition type is determined and how the checks work, in short, it checks a value in securemem and if it returns a specific value then the checks on binary fuse is skipped, and the recovery/boot partition is no longer checked. I'll detail that more later.
[Verizon Samsung Galaxy S 4] ImpytheBiscuit:
Thank you so much for working on this!

I'm sorry if I sound ignorant, but does this unlock apply to one specific bootloader (ex: NC5) or is this kind of a universal unlock?
[Verizon Samsung Galaxy S 4] skepticmisfit:
most of the work is being done on the nc5 bootloader
[Verizon Samsung Galaxy S 4] XxD34THxX:
So I haven't join the group, due to me not being familiar much with Android.. Buuut has any new sort of info been discovered? Not necessarily about the bootloader, but on how the qfuses work, something that wasn't known before somehow?
[Verizon Samsung Galaxy S 4] Legitsu:
not that you or anyone else need be made privy too

if there is something a lid is being kept on it until a workable solution has been found

tl;Dr stop asking
[Verizon Samsung Galaxy S 4] tshelby73:
I've had this phone for almost two years now only bootloader unlock option is going to be buy a nexus or Motorola pure period.

Sent from S4 using the better than it was then they jacked it again Tapatalk
[Verizon Samsung Galaxy S 4] RuggedHunter:
Me too...29 months now. I've stayed on 4.3 the whole time too, just in case... I guess I've become satisfied now with my perfectly running RLS12 HyperDrive...as long as I can get root, a stable rom, and xposed, I can customize just about anything i want and automate or make my own apps to do anything imaginable. I'll live without CM.

I'm going with an international version s6e+ at some point in the next few weeks. Sick device.

And I'm keeping this S4 too just to say "I win!" when these guys get us there!

AT&T S4 i337 > SafeRoot > SafeStrap 3.71 > HyperDrive RLS12

Tasker-ized
[Verizon Samsung Galaxy S 4] ImpytheBiscuit:
I think it's definitely doable. Especially with the new phones out right now without a replaceable battery or microSD slot, I think I'm going to keep the S4 for another 24 months with or without the locked bootloader.

Though I am fascinated on how the process works/is going on this. I wish I could help move things along, but I don't really have the talent for it. I can only support in spirit.
[Verizon Samsung Galaxy S 4] NighthawkXL:
I finally ditched my S4 and AT&T altogether, although I did flash a T-Mobile ROM on SafeStrap and gave it to my little brother. I made the move over to T-Mobile back in August and picked up a unlocked LG G4, which is now running a alpha build of CM. All in all though it was a hell of a ride and I'm still keeping tabs on the ongoing effort. I'll still be lurking around, my S4 gave me the chance to learn the complexities of both hardware implementations, as well as the inner workings of Android itself. Wish you all luck, hopefully a solution will be found that can liberate multiple devices.
[Verizon Samsung Galaxy S 4] scryan:
Just buy a nexus 6.

No, its not too big... Its cheap and damn awesome [emoji14]

I gave my S4 to my brother... And am always curious if he has updated it/if he has moved it passed a firmware that may someday be unlocked. Lol, even if it is figured out he is not techy, and that phone will never be unlocked.

The ***** of it is, I had MDK... But I was ignorant and people were talking about using caution because we didn't have a working recovery, or images... Or what ever they were saying at the time. I figured no chance the next update wouldn't be cracked too... And updated off of mdk to fix the WiFi toggled as that was reported to be fixed with the update.

The real *****.... Update didn't fix WiFi toggle.
[Verizon Samsung Galaxy S 4] ImpytheBiscuit:
That reminds me, if the bootloader gets unlocked, would there be tutorials on upgrading the bootloader to NC5? My bootloader is on MK2 and it's been a while since I've used Odin and things like that.
[Verizon Samsung Galaxy S 4] skepticmisfit:
there are already guides here, just look around. any nc5 tar will give you its bootloader so you can just root using towelroot and be on your merry way
[Verizon Samsung Galaxy S 4] ericerk:
How did you do the safestrap, and rom flash, I need to get this device working for the short time I'm using it?

I'm on 5.0.1. Update.
[Verizon Samsung Galaxy S 4] STIKID:
This is not the thread to be asking this also idk if safestrap supports 5.0.1 it might only support up to 4.4.2

Sent from my VS986
[Verizon Samsung Galaxy S 4] daredevl99:
Not to discourage anyone but there has been a "falling out" and one of our important members has decided to leave the s4 which is his absolute right. And no work to my knowledge has been done since then.
[Verizon Samsung Galaxy S 4] tshelby73:
It's been a pipe dream for awhile if you ask me. I should have learned my lesson with the droid x2.

Sent from S4 using the better than it was then they jacked it again Tapatalk
[Verizon Samsung Galaxy S 4] STIKID:
Ive already moved to the g4 but i still like to know whats going on with the s4 since its a spare

Sent from my VS986
[Verizon Samsung Galaxy S 4] ImpytheBiscuit:
First off, thanks for the update! I'm sorry that happened. On a scale of 1 to 10, is it still possible to salvage this project?
[Verizon Samsung Galaxy S 4] Legitsu:
lol samsung

http://it.slashdot.org/story/15/10/...kernel-vulnerabilities-in-some-s4-smartphones
[Verizon Samsung Galaxy S 4] doubleaykay:
Looks like the vulnerabilities listed in this include "kernel memory disclosure" and "kernel memory corruption." Based on my quick research they are present in JellyBean and KitKat versions. More info and how to use them here: http://news.softpedia.com/news/sams...abilities-in-some-s4-smartphones-493519.shtml

So does this do us any good? Have you guys known about this already [MENTION=5552234]jaw20[/MENTION]?
[Verizon Samsung Galaxy S 4] Oishikatta:
Kernel exploits in discontinued android versions are a dime a dozen. Completely unrelated to the bootloader, no relevance to the thread. Also I'm not aware of which S4 variant didn't get lollipop but it's certainly not ours. Besides our KK already had towelroot.
[Verizon Samsung Galaxy S 4] daredevl99:
10/10 possible to salvage but the amount of work and luck required to find what was already found makes it almost not worth it. As of right now no work is being done that i know of. The only people left are to busy with school, work, families, and sometimes all three. Unless im told otherwise everyone you dont already know about would like to remain unnamed and ill keep it that way so they arent flooded with complaints. This was a free-time project and no one was required to work on it. There is a small possibility of

Releasing anything we have done for others to work as they please. A higher possibility of those with knowledge skill and time joining our chat and helping behind closed doors.
[Verizon Samsung Galaxy S 4] doubleaykay:
Wait, did the person who left not leave behind what they found out? Because if they didn't then that is a loss, especially if things are the way you put it...
[Verizon Samsung Galaxy S 4] blackops11252:
Just put it to rest!
[Verizon Samsung Galaxy S 4] Legitsu:
anybody not directly involved in helping please keep your comments to your self

this is a development thread

kexec is still a possibility personally I think unlocking the bootloader was a waste of time when kexec is far easier to get working
[Verizon Samsung Galaxy S 4] jeboo:
I'm assuming that can be removed at the ROM level (initramfs, apks, etc).
[Verizon Samsung Galaxy S 4] jco897j:
I believe the TZ is read only.
[Verizon Samsung Galaxy S 4] failedjedi:
So I was at best buy to spend a gift card I had lying around and they had one of those little samsung stores. So I went over and was just honest with the guy and said I know and don't care if it voids the warranty I just want to do custom roms. I asked him if there was anything they could do about maybe downgrading me to one of the older firmwares pre bootloader lock. He basically said there was nothing he could do for me, but was kind of hesitant and the careful how he worded his answers. I asked if it was possible and he just isn't allowed to do it or talk about it and he gave like a weird shrug.

So I don't know if this guy was just a weirdo or he was trying to hint that they do in fact have the ability to do it.
[Verizon Samsung Galaxy S 4] scryan:
They dont have the ability. Samsungs security is not entrusted to mall kiosk workers and if it was one of them would have claimed the thousands of dollars up for grabs for who ever can.
[Verizon Samsung Galaxy S 4] PetrichorXFi:
Okay, if I understand correctly:

Kernel Modules are verified by hashing the module, then checking that hash against a list of "known/trusted" hashes

Q1) What happens if this List is deleted? Sure, probably not easy to do, but if the file IS deleted, can we load any modules we want?

Q2) Can we modify this list? Is this list signed/hashed?

Q3) Does our device update this list? When? Only when Kernel is updated, or every OTA?

Q4) Can completely bypass the list completely?: Overwrite it, perhaps write a method that overloads the existing one thus bypassing the file completely, point towards our own modified/appended list?

Other aspects of the bootloader are digitally signed? If yes, can we use a signature vulnerability similar to the "recent Android APK signature vulnerability" earlier this year?
[Verizon Samsung Galaxy S 4] Bad Bimr:
SafeStrap is now in testing for MJ7 and MK2. Is there any light at the end of the tunnel to stay on ME7? I keep coming to this thread everyday hoping I see an exploit was found.
[Verizon Samsung Galaxy S 4] scryan:
I looked up the get/put_user exploit... has it been patched and would it apply to the newer kernels? The page I read mentioned october/november as the dates it was noticed in the wild for android... but not sure if there is a fix out?

Either way, that exploit should allow us to write over parts of the kernel in memory, that should mean a kexec module can be added to allow us to boot our own kernel.

However as mentioned above the system rechecks the kernel real time for changes.

If that is rom level stuff they may be onto something soonish? However it would probably be a little while to make it useble for average people.

Or none of this ever works... ; p

Personally... I dont know what reason any of us have to update yet. 4.3 doesnt offer anything I need I think and I like my current rom so I plan to stay where I am as long as possible... I updated my phone once, from MDK to ME7. That turned out to be a bad move, and I can always update later.

If 4.3 is still effected by the put user exploit I doubt your missing much by updating though. Ill let one of these guys comment more if they care to as I only just understand (or think I do) whats going on :p
[Verizon Samsung Galaxy S 4] k1mu:
Removing those will mean that you've modified the kernel, which then won't load. And flashing it will trip the Knox Warranty Void flag as it wouldn't match the expected signature. However, what you suggest is pretty close to what I'll be trying over the next week or so.
[Verizon Samsung Galaxy S 4] JLow0214:
Yea that makes sense..... I was also wondering about modifying the keys stored in the TIMA but from what I read that register in the processor is "tamper evident" sounds like you would need to hard flash this register to change the values.... Maybe JTAG could somehow do this? Just thinking back to this microproccesor class I took.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] jeboo:
I've confirmed being able to insert a modified stock module on MK2! And no system reboot or module unloading occurred due to tampering :)
[Verizon Samsung Galaxy S 4] bennyboy78:
So what exactly does it mean for us users? That kexec is pretty possible? :D
[Verizon Samsung Galaxy S 4] raulz28:
Accidentally thanked you just meant to quote you and say that is what I was thinking too.
[Verizon Samsung Galaxy S 4] jco897j:
If signature verification is not only device specific but carrier specific as well, ie sch-i545 vs sch-i337 or whatever att is, what would happen if the phone was made to think it was a different device via modifications to build.prop like when I installed Google wallet on my s3. Could a portion of the bootloader or the recovery itself from a t mobile or sprint factory bootloader unlocked device be flashed and the signature verification pass? I'm not sure if you're able to Frankenstein the different device bootloaders or recoveries. Just throwing ideas out.
[Verizon Samsung Galaxy S 4] Surge1223:
Thats good news! What stock module did you modify then load? What changes did you make to make it happen? Can you still reboot or does it go into the firmware error screen? Is it a module watched by sysscope? etc.?! Details!
[Verizon Samsung Galaxy S 4] jeboo:
I'm putting together the source now, it'll be on github. I'll also start a new thread (prob in ATT dev forum) since it's not exactly related to BL unlocking.

I was just going to build it for MK2, but it seems many people still run MJ7 here. Can someone post the boot.img for MJ7? Thanks!
[Verizon Samsung Galaxy S 4] ryanbg:
This is very big news!
[Verizon Samsung Galaxy S 4] Surge1223:
here
[Verizon Samsung Galaxy S 4] JLow0214:
So what will this modified stock kernel allow us to do?? Kexec???

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] scryan:
Hopefully eventually. For now I would be willing to bet its more of a proof of concept type deal... Showing that modifications can be made, THEN someone will need to figure out exactly what needs to be added to support kexec.
[Verizon Samsung Galaxy S 4] JLow0214:
As long I can get my sweet aosp Roms back..... How I hate this crappy excuse for an os they call touchwiz

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] doubleaykay:
Whats the progress on kexec? Last time I checked there was an issue where it would crash before dumping logs... Have we gotten any reliable logs? Also, will any of those kernel vulnerabilities play a role in getting kexec to work?
[Verizon Samsung Galaxy S 4] Legitsu:
no idea last I heard nobody could figure out how to setup a serial debugging console which is silly because I know its been done before ..

honestly I was looking at adapting a strait port of CM12/ASOP to work with the samsung stock kernel but just haven't had the time or motivation .....
[Verizon Samsung Galaxy S 4] doubleaykay:
Ugh, can we find the person who did it before? Sadly I can't, I *know* what a serial debugging console is but don't know how to set it up...

EDIT: What would it take to modify CM12/AOSP to take a Samsung kernel?
[Verizon Samsung Galaxy S 4] Legitsu:
no because hes in jail/banned lol
[Verizon Samsung Galaxy S 4] doubleaykay:
How convenient... what would it take to modify AOSP to take the Samsung kernel?
[Verizon Samsung Galaxy S 4] Legitsu:
A LOT of work ... particularly on 5.0 and up

there is VM differences,the way some modules are handled are completely different theres several samsung kernel related problems where creative work arounds would be needed but it would be possible ...and if it was it might be possible to port it to other bootloader locked samsung devices such as the S5/S6

I am a fairly competent coder but I am not that good and the code documentation on the samsung side is terrible ....
[Verizon Samsung Galaxy S 4] doubleaykay:
Ouch that seems like quite the task... I wonder if it's worth it to get a new thread started with the development of that, while bootloader/kexec stuff plays out in here...
[Verizon Samsung Galaxy S 4] Legitsu:
honestly I doubt anyone gives enough of a **** anymore the S4 is old and outdated and there are better cheaper,more open devices to be had (cough moto x)
[Verizon Samsung Galaxy S 4] doubleaykay:
Haha I do, it's my daily driver...
[Verizon Samsung Galaxy S 4] XxD34THxX:
Well, I'm stuck with this until next... September... Damn Verizon for closing my upgrade loophole...

So it looks like Development is officially closed unless someone finds the time from doing other, more profitable things to work on this?
[Verizon Samsung Galaxy S 4] ryanbg:
Get a MicroUSB breakout board. Connect GND and ID together with a 619k resistor, VCC to GND, and D- and D+ to UART_TX and UART_RX. 115200bps,8,n1.
[Verizon Samsung Galaxy S 4] Legitsu:
thats how it should work on a dev edition s4

the verizon model seems like its different
[Verizon Samsung Galaxy S 4] ryanbg:
Works fine for me on retail.
[Verizon Samsung Galaxy S 4] daredevl99:
Can confirm we had it working and that is the correct instructions for retail as well. Ryan knows his **** XD
[Verizon Samsung Galaxy S 4] hisham2630:
when i was playing with my sch-i545 nc5 build... my phone is rooted

my phone booted into special mode called a kernel panic mode thats what i saw on screen.

here is how that happened with es file explorer go to /sys/class/camera/flash/rear_flash then i put 1000000000 i can't remember the exact number.strange!!!!
[Verizon Samsung Galaxy S 4] vt0r:
Is this a joke?
[Verizon Samsung Galaxy S 4] ryanbg:
That'll happen when you cause the kernel to panic...
[Verizon Samsung Galaxy S 4] VMFortress:
Advantages

What does doing this enable us to do? I'll probably be upgrading my phone soon anyways so I might be willing to test things if that'd be at all helpful. I'd just like to be able to install something custom on this phone, even if I had to do it by hardware means.