yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] Dhs92:
It boots to download because the bootloader can see that something was changed (sort of), we already have a custom recovery, and you can get around download mode by force rebooting and manually going to the download mode prompt, then press cancel.

Sent from my PurifieD S4
[Verizon Samsung Galaxy S 4] ryanbg:
Upon further analysis, and some inspection of the TrustZone debug logs, it appears those regions are actually the Qfuse shadow register. Whether this is a shadow register, 'eFuse' register, etc... I don't know, but I have successfuly confirmed the locations with locations dumped from TrustZone logs. This looks like a good place to start. If you S4 guys wanna check it out, try

cat /d/tzdbg/log

You may see QFPROM data displayed there, but it's normal if you don't. Most N3, if not all, have it. This leads me to believe that Developer Mode may be a fuse, but I'm not sure yet. I didn't see any references to an unlock/developer mode/etc... in the hardware register list. It could be under OEM config or something, but I have no idea yet.

Also, in my TZ log upon attempting to read the region Developer Mode is pointing to, where those *s are, the TZ had recorded 'xPU (Protection Unit for memory) error NON-SEC!!!' This memory is being protected by TrustZone, and I can replicate this every time I attempt to viewmem this region, then check the log. Certainly relevant and helpful information
[Verizon Samsung Galaxy S 4] dmt010:
Vruamdk boot loader

Mines blank except for a new line character
[Verizon Samsung Galaxy S 4] ryanbg:
Does /d/tzdbg/log not exist for you? If not, try dialing *#9900#, enable seclog and turn debug onto mid or high
[Verizon Samsung Galaxy S 4] KaratemanTJ:
I'm on ME7, I had /d/tzdbg/log, but it was empty. I enabled seclog and set debug to mid. Still blank. Thoughts?
[Verizon Samsung Galaxy S 4] V0latyle:
Possibly force developer bootloader..? I have a rock hard e-boner right now.
[Verizon Samsung Galaxy S 4] sokrboot:
Same here except I'm on MJ7. Maybe it's because I'm running S'S with HYPER DRIVE 15 in my stock slot...?
[Verizon Samsung Galaxy S 4] dmt010:
Related: Not sure if you saw this but this is interesting..

https://android.googlesource.com/ke...56a220f03076/Documentation/arm/msm/tz_log.txt

And hammerhead ex. kernel module source

https://android.googlesource.com/ke...mmerhead-3.4-kk-r1/arch/arm/mach-msm/tz_log.c
[Verizon Samsung Galaxy S 4] MorrisC2010:
Running stock rooted MJ7. My log is blank. But did find something in vmid in the same folder. Looks like the I'd for the TZ. Did a viewmem of the address and opened it in a hex editor (can't get to ida because I'm at work) saw something for a pbl_error_handler and a bit more gibberish foreign characters.
[Verizon Samsung Galaxy S 4] RuggedHunter:
Here's another potentially useful link that I again found because it was posted by [MENTION=5269988]david515[/MENTION]

http://sxtpdevelopers.com/samsung-note-3-knox-fix-qualcomm/

He found it in this thread in which [MENTION=631273]Chainfire[/MENTION] has posted some comments that are simultaneously encouraging and disappointing.

http://xdaforums.com/showthread.php?p=52281471

http://xdaforums.com/showthread.php?p=52293397

I hope it's useful.

Edit: Forgot to post the link...duh...
[Verizon Samsung Galaxy S 4] dmt010:
Looking at the screenshot involved it looks like the only work involved was a diff comparison, fix, then commit . lol? I don't know.. This is all a bit over my head
[Verizon Samsung Galaxy S 4] Diego1751:
set SEAndroid to permissive

So I am using xposed and wanam exposed

And one of the options under security is to disable SEAndroid. And the description is setting it to permissive at boot. Is that something to look into?

Again I'm not actually sure what the specific thing locking our boot loader is
[Verizon Samsung Galaxy S 4] Mistertac:
No that doesn't work on our Verizon S4. One of these guys I'm sure can elaborate as to why/how. Be nice if all we needed was wanam though lol
[Verizon Samsung Galaxy S 4] Diego1751:
Oh I wasn't saying this is a ready solution. I was just asking if its something worth looking into. I thought I remember reading something that SEAndroid was something that was holding up the bootloader.

Also according to WANAM its still in beta so it may be worth expanding into a working state.
[Verizon Samsung Galaxy S 4] tshelby73:
Or locked kernel ignores the permissive flag

Sent from S4 using Tapatalk
[Verizon Samsung Galaxy S 4] Diego1751:
Wut?

what does that even mean?
[Verizon Samsung Galaxy S 4] MorrisC2010:
Exciting News

Well i found something i think is very exciting!! Can't really release any details as I'd like to keep it private just in case it does lead to something we can use. [MENTION=4939386]Surge1223[/MENTION] I sent you an email detailing what happened

---------- Post added at 07:09 PM ---------- Previous post was at 06:59 PM ----------

It means that whether or not your SELinux is set to Enforcing or Permissive, the kernel is still going to be locked down and wont allow you to flash away
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
You can google samsungknox official website it has alot of info there that could walk you through alot
[Verizon Samsung Galaxy S 4] ryanbg:
Mind filling me in?
[Verizon Samsung Galaxy S 4] MorrisC2010:
pm me
[Verizon Samsung Galaxy S 4] TTLayland:
Awesome news
[Verizon Samsung Galaxy S 4] Brooklynsour:
How awesome?
[Verizon Samsung Galaxy S 4] RuggedHunter:
It appears to be a confirmed work for Exynos N3. Leaked Odin flashable TAR to reset Knox bit, as well as some EMMC PIN?

http://xdaforums.com/showthread.php?p=52329946

It's not an unlock and it's not S4 but I can't help but think there's useful info here...

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDB > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] MorrisC2010:
Anyone still have MJ7? If so contact me asap. Must be rooted, stock, no SS, no nothing. Clean install.
[Verizon Samsung Galaxy S 4] Hashbang173:
I think if you have mk2 you can odin back to mj7

Maybe all if not partally with nc5
[Verizon Samsung Galaxy S 4] MorrisC2010:
Yeah. I know. I'm still on MJ7.
[Verizon Samsung Galaxy S 4] machiz7888:
im still on mj7 whats up?
[Verizon Samsung Galaxy S 4] dmt010:
If you need mk2 testing lemme know.
[Verizon Samsung Galaxy S 4] k1mu:
Exactly what it says, and this has already been answered.

There's a variable in the kernel that stores the SELinux mode, permissive or enforcing.

If it's set to permissive, then SELinux is supposed to stop blocking things.

Unfortunately, our kernel is built with SELinux configured to ignore the permissive mode flag most of the time. You can flip the flag using xposed, but that's generally a waste of time.

The user-visible impact of this is that you can't do some things, even though you're root.
[Verizon Samsung Galaxy S 4] MorrisC2010:
I'll see
[Verizon Samsung Galaxy S 4] mcbr2002:
I'm still on mj7

Let me know if I can help
[Verizon Samsung Galaxy S 4] Brooklynsour:
I have mf3 if it would be useful, glad to help anyway
[Verizon Samsung Galaxy S 4] tshelby73:
I think anyone on mk2 can downgrade to mj7

Sent from S4 using Tapatalk
[Verizon Samsung Galaxy S 4] jhasty01:
Mk2 stock rooted willing to downgrade if needed and possible. Just PM instructions and what purpose.
[Verizon Samsung Galaxy S 4] DakotaSiberious:
Seconded
[Verizon Samsung Galaxy S 4] KaratemanTJ:
I've got an S4 with a bad screen on MJ7. I can do some testing with it. It works fine with HDMI and a bluetooth touchpad.
[Verizon Samsung Galaxy S 4] Diego1751:
guys I don't need 10 explanations

I was mainly referring to not understanding the grammar because the phrase when I read it the first time didn't make much sense.

I didn't know that they weren't linked like I now do but let's not waist posts and the devs time explaining things that have been said
[Verizon Samsung Galaxy S 4] cyrushehe:
Will mk2 downgraded to mj7 work?
[Verizon Samsung Galaxy S 4] Mistertac:
Yes you should be able to just Odin back to MJ7 from MK2.
[Verizon Samsung Galaxy S 4] cyrushehe:
I know that, but it seems odd that he was asking specifically for mj7 and not mk2/mj7. Maybe there are some discrete differences if you Odin back?
[Verizon Samsung Galaxy S 4] Mistertac:
Ohh ok gotcha!, no idea man most this stuff is way over my head... I just check in and read up to try an learn.
[Verizon Samsung Galaxy S 4] redwings73:
Now that I think about it, I have an s4 with a broken screen, too.... Thinking it has MJ7.

Willing to use if needed.
[Verizon Samsung Galaxy S 4] MorrisC2010:
Yes. As long as it is MJ7 and a pure stock TW experience and rooted, it should work
[Verizon Samsung Galaxy S 4] wasuellc:
Should work
[Verizon Samsung Galaxy S 4] KaratemanTJ:
[MENTION=4714732]MorrisC2010[/MENTION] do you want those of us with MJ7 to pm you or should we wait to hear from you?
[Verizon Samsung Galaxy S 4] MorrisC2010:
Sorry my wife is 8 months pregnant. Been busy with her since I found this thing. I'll be posting a thread in a second.
[Verizon Samsung Galaxy S 4] OneArm:
Congratulations
[Verizon Samsung Galaxy S 4] ryanbg:
That screen you found was a debug upload mode. There are serveral different ones. Not much we can do with it, but interesting nonetheless.
[Verizon Samsung Galaxy S 4] MorrisC2010:
I found that out after extensive searching. Were you able to replicate it?

To those who still want to see it: http://xdaforums.com/showthread.php?t=2739051

---------- Post added at 05:51 PM ---------- Previous post was at 05:51 PM ----------

Thanks :)
[Verizon Samsung Galaxy S 4] MorrisC2010:
Just FYI, I was finally able to replicate the screen now that I could sit down properly and look at it. Check the thread I posted earlier.
[Verizon Samsung Galaxy S 4] Diego1751:
so did we get anywhere?

So did we get anywhere With the exciting news/the debug screen?
[Verizon Samsung Galaxy S 4] jamesd1085:
If you read a few posts up you will see that the debug mode was found a few weeks back and already been debunked as a possible exploit...
[Verizon Samsung Galaxy S 4] Diego1751:
I did read it but I was just wondering if there were any developments

(Also I was more referring to the exciting news. Hoping something came up)

Anyways good luck guys! I hope your close
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
From what i read around XDA there are a few looking for exploits im not giving any names tho let them stay focused on it
[Verizon Samsung Galaxy S 4] jamesd1085:
He thought it was exciting news because he didn't know it had been found and looked into...it is a cool find but I think they have confirmed that it won't help us with unlock/workaround...Also if I came of like a d*** it wasn't my intention...I usually chime in if I know what's going on so that the people who don't won't clog up the thread with discussing something that has already been looked into
[Verizon Samsung Galaxy S 4] TTLayland:
I'm hoping work on the s4 is going to help us note 3 users and and the s5 users as well.
[Verizon Samsung Galaxy S 4] LongSimple:
Why does this matter in any way? Please stop the useless posts and stay high quality.
[Verizon Samsung Galaxy S 4] TTLayland:
It matters for a fairly obvious reason. With these phones all being locked down Samsung phones.

The idea that they might have some cross over in their security isn't far fetched. If they do cross over then the implications of unlocking any one boot-loader becomes exponentially more important.

My post is only here so that I may gain some insight. I was under the impression that it was only in the developer threads where we couldn't post anything that was not technical/related.

Also high quality posts are subjective, but thanks for your opinion.
[Verizon Samsung Galaxy S 4] LongSimple:
If you wanted insight you can pm a developer, read the thread or physically ask the question on a different thread not for developing You said "Im hoping work on the s4 is going to help note 3 users and s5 users" There was no question there, this is a thread for developing an unlock not for asking questions about it. I am sure the people who are working on the unlock are aware of what they are doing in correlation to other devices.
[Verizon Samsung Galaxy S 4] RuggedHunter:
His question doesn't really contribute...agreed. But this is not a development thread, it's in the noob and question friendly General section. Flaming here is just as pointless and thread-clogging as the contribution of his question...and this post.
[Verizon Samsung Galaxy S 4] sokrboot:
[MENTION=766721]ryanbg[/MENTION] [MENTION=4939386]Surge1223[/MENTION] have u guys looked to see if this applies to Note 3 or S4?
[Verizon Samsung Galaxy S 4] Maribou:
Sent that to surge this morning via hangouts. Hopefully it's useful to them.

Sent from my warranty voided device...
[Verizon Samsung Galaxy S 4] ryanbg:
I found a private RSA key inside the NON-HLOS. I'm not an expert on cryptography, so I'll leave this here.
[Verizon Samsung Galaxy S 4] Oishikatta:
The public exponent is 65537, but the public exponent in keys generated by QPSA and any other certs in the boot chain have a public exponent of 3.
[Verizon Samsung Galaxy S 4] waiters:
Nm
[Verizon Samsung Galaxy S 4] KaratemanTJ:
./QPSA/qpsa.py: print "exponent=3 : Takes value 3 or 65537, sets the exponent used in all RSA key generation"
[Verizon Samsung Galaxy S 4] Oishikatta:
The public exponent chosen by Samsung when using QPSA, and the default. I posted the public certs a few pages back.
[Verizon Samsung Galaxy S 4] ryanbg:
I built a homemade JTAG/debugger using a Raspberry Pi and OpenOCD. Neat, huh?
[Verizon Samsung Galaxy S 4] Hashbang173:
Because this is in the general section, can I ask what this means in terms of the bootloader unlock?
[Verizon Samsung Galaxy S 4] waiters:
The only thing it means is that our great developers haven't given up on the sgs4 yet!
[Verizon Samsung Galaxy S 4] sokrboot:
http://nelenkov.blogspot.com/2014/05/using-kitkat-verified-boot.html

dm-verity was originally developed in order to implement verified boot in*Chrome OS, and was integrated into the Linux kernel in version 3.4. It is enabled with the CONFIG_DM_VERITY kernel configuration item. Like Chrome OS, Android 4.4 also uses the kernel's dm-verity target, but the cryptographic verification of the root hash and mounting of verified partitions are implemented differently from Chrome OS.

The RSA public key used for verification is embedded in the boot partition under the*verity_key filename and is used to verify the dm-verity mapping table. This mapping table holds the locations of the target device and the offset of the hash table, as well as the root hash and salt. The mapping table and its signature are part of the verity metablock which is written to disk directly after the last filesystem block of the target device. A partition is marked as verifiable by adding the verify flag to the Android-specific fs_mgr flags filed of the device's fstab file. When Android's filesystem manager encounters the verify flag in fstab, it loads the verity metadata from the block device specified in fstab and verifies its signature using the verity_key. If the signature check succeeds, the filesystem manager parses the dm-verity mapping table and passes it to the Linux device-mapper, which use the information contained in the mapping table in order to create a virtual dm-verity block device. This virtual block device is then mounted at the mount point specified in fstab in place*of the corresponding physical device. As a result, all reads from the underlying physical device are transparently verified against the pre-generated hash tree. Modifying or adding files, or even remounting the partition in read-write mode, results in an integrity verification failure and an I/O error.

We must note that as dm-verity is a kernel feature, in order for the integrity protection it provides to be effective, the kernel the device boots needs to be trusted. On Android, this means verifying the boot partition, which also includes the root filesystem RAM disk (initrd) and the verity public key. This process is device-specific and is typically implemented in the device bootloader, usually by using an unmodifiable verification key stored in hardware to verify the boot partition's signature.
[Verizon Samsung Galaxy S 4] jwhistler:
I don't understand how it works, but I recognize genius when I see it. This is genius! :)
[Verizon Samsung Galaxy S 4] dmt010:
Arduino here.. Collecting dust :(

Need more breadboards and resistors...
[Verizon Samsung Galaxy S 4] Diego1751:
So what is currently being worked on? Are we still unlocking mj7/mk2 or are we looking for possible holes in KitKat? Both?
[Verizon Samsung Galaxy S 4] ryanbg:
It looks all fancy and complicated, but in reality it's just an over-glorified serial cable with wires at the end instead of a connector. I talked to Adam Outler, you want to avoid the Arduino unless you have the Due since the TTL is 5v on that, 3.3v for the Pi/Due. The Bus Pirate is most ideal, but I wanted the Raspberry Pi for other projects too. Very cool device.
[Verizon Samsung Galaxy S 4] Mistertac:
Yes my post here is really useless and contributes to nothing but that's really cool. Your a smart man keep up all your awesome work
[Verizon Samsung Galaxy S 4] KaratemanTJ:
From my basic understanding, QPSA is the tool that Samsung uses to sign the bootloaders. I was simply pointing out that it accepted either 3 or 65537 as options for the public exponent. Whether it supports it or not is irrelevant as they appear to have used 3 in all their certificates thus far. Hope that helps.

---------- Post added at 12:06 PM ---------- Previous post was at 12:03 PM ----------

Nice work. I'll have to look into OpenOCD. Any tips?
[Verizon Samsung Galaxy S 4] RuggedHunter:
http://xdaforums.com/showthread.php?p=51095184
[Verizon Samsung Galaxy S 4] Diego1751:
Are there any updates? Or anything. This is the first time I haven't seen a new post in a while
[Verizon Samsung Galaxy S 4] jhasty01:
Quiet isn't always a bad indication ;)
[Verizon Samsung Galaxy S 4] mbl1979:
If that does happen we all need to stop buying cell phones go to pagers, maybe that will get their attention LOL. It really bothers me that when we buy a cell phone from any company it should be are property right... I mean if I by a 500-600 dollar cell phone i should be able to do what I want with it. I cant say it enough THANKS TO ALL THE DEVS FOR THERE HARD WORK. May we continue the fight for CELL phone FREEDOM.
[Verizon Samsung Galaxy S 4] decaturbob:
Who has paid 500 or 600 for a cell phone outside of dev phones? The price is subsidized...and t&c is clear. Just like if you buy a new car...warranty is void if you do any modding of the car. No difference .

sent by slimkat
[Verizon Samsung Galaxy S 4] sokrboot:
I have great respect for your opinions [MENTION=3882268]decaturbob[/MENTION] but I think there is a difference. If I want to do an engine swap in my car and void the warranty then I am well able to do so. Auto manufacturers don't have their cars locked down to be unmoddable. If I don't give a crap about my smartphone warranty why can't I swap kernels in my phone? And I don't buy the whole "because of network security" argument because these cell networks are built to withstand much more sophisticated attacks than what could be mustered from a rooted consumer smartphone on a custom bootloader.
[Verizon Samsung Galaxy S 4] mbl1979:
My point exactly. Phones cost money, and yes S5 note 3 out right they are over 500 dollars. If I got an S3 off the net for 130 bucks, warranty is well over by then. I should be able to root and ROM the device. Here is an idea major carriers should approve a ROM then let the consumer flash it... Android experience is getting ruined more and more with every launch of a new OS. Back to topic does anyone have a update to the bootloader?
[Verizon Samsung Galaxy S 4] KaratemanTJ:
For the millionth time. Not the place. Go have this argument elsewhere.
[Verizon Samsung Galaxy S 4] mbl1979:
........ This is general section right.....
[Verizon Samsung Galaxy S 4] V0latyle:
Depends how you look at it. You perform some power and drivetrain upgrades then snap an axle? That probably isn't a manufacturer defect. You overboost and blow your turbo? Same deal. Install an aftermarket downpipe then fail emissions...really?

The generally accepted idea is, whatever modifications you may make shall not be blamed by default for failure of a specific part. Such as for people who drive GTIs like me, we often have coil packs blow. Most dealers will turn up their noses and refuse warranty replacement if we have any aftermarket mods, even though an ECU tune won't cause coil packs to fail.

I know of one guy whose car nearly burned to the ground because of an electrical short in the headlight wiring, and the manufacturer tried to blame it on his aftermarket cold air intake...even after the fire marshal had completed his investigation and determined the actual cause.

Can flashing an aftermarket kernel cause hardware damage? I don't really know but I imagine it is possible through bad power management or overclocking. Other than that, I would say it is likely an attempt to ensure that the ignorant masses that flood these forums and tend to brick their phones don't try to make fraudulent warranty claims...but maybe that's a little far fetched.
[Verizon Samsung Galaxy S 4] Brooklynsour:
**** Samsung **** att and verizon, america has been hijacked by wealthy greedy corporations and its likely an end of days for much customization....
[Verizon Samsung Galaxy S 4] Galaxy*$4:
ok i been thinking. has anybody tired using custom kernels. i dont care much for warranty. i am no dev by any means.

i understand that people like a fall back option if something messes up.
[Verizon Samsung Galaxy S 4] RuggedHunter:
Woah. This IS The general section. Where questions are okay, I think. But I don't think that gives everyone a license to yammer way off topic...I think there's a sticky for that. I dunno if [MENTION=4939386]Surge1223[/MENTION] and [MENTION=766721]ryanbg[/MENTION] stopped updating because they're close and in stealth mode or if they've abandoned the thread... all I know is that your warranty (car or phone) and talking about the who's and why's doesn't contribute to the cause or the topic.
[Verizon Samsung Galaxy S 4] decaturbob:
with a locked bootloarder, you can't load/run custom kernels, it will brick the phone.
[Verizon Samsung Galaxy S 4] vt0r:
The thread has definitely not been abandoned.

The team is in constant contact via other mediums as always, and there is still a very active collaboration ongoing.

When updates don't come for a while, that usually just means no news is available at that time. They will still be provided as they become available, per the norm.

Please be patient, and allow time to focus on the task(s) at hand.

In the mean time, please take the complaints about the locked bootloader to another thread or to your carrier, as they add no value to this thread outside of post and page counts.

Thanks, guys!
[Verizon Samsung Galaxy S 4] micmars:
Moderator Comment: If you have an issue with a particular post, ignore it, report it or take it to PM; keep it off the forums.

The next round of garbage gets deleted and personal follow-up from a friendly XDA staff member.
[Verizon Samsung Galaxy S 4] LiLPurP:
Ive been hearing alot about a dev saying he was able to downgrade but was working with random reboots and system wipes, could this be done on gs4?

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] TTLayland:
We need these skills if we want it cracked.

C/Java/asm code auditing, reverse engineering ARM, kernel exploitation, etc.
[Verizon Samsung Galaxy S 4] jon53179:
I miss the good old days of a nice TWRP. good luck to anyone who has these skills! :good:
[Verizon Samsung Galaxy S 4] eheinzeiii:
Hearing from where?
[Verizon Samsung Galaxy S 4] LiLPurP:
Here is a screenshot of the post that i saw, not sure if it helps us with gs4 at all but was curious none the less

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol