yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] jamesd1085:
Dumb to this but learning...lol...what is it trying to upload at this point?
[Verizon Samsung Galaxy S 4] ryanbg:
I think it's a debug-type mode, where you can possibly access uart and various dumps (system, ram, cp, etc...) given the right tools (jig, jtag, etc...) but I'm very intrigued. Not so much with the Upload Mode itself since this is very commonly stumbled onto, but more so the kernel panics. This seems to be (I've got little knowledge in this area,) in my opinion, one of our more realistic opportunities at 'unlocking' this device. Again, this is a complicated and detailed process that I know little about, but we're consulting with the proper channels. [MENTION=4939386]Surge1223[/MENTION] and I have a mixed bag of skills and knowledge, and with some guidance from more experienced/knowledgable devs, we continue to make progress. Their guidance has been invaluable, but we still have quite a ways to go.

I've made another recent discovery that I feel like now would be a good time to share since I've been and will be rather busy for the next couple weeks. It's possible to send AT and proprietary QC commands to the modem from terminal emulator (on the device itself, AKA no adb shell.) I must warn you at this point that this is DANGEROUS if you don't know what you are doing. Sending random/incorrect commands can erase, corrupt, reset, etc... your device and SIM card with ease, some cases permanently. This is one of those things that you should really heed warning and not mess around with unless you know what you are doing. That being said, if you wish to continue, you are doing so at your own risk. This is for informational/educational purposes only. What you do with this information is your liability. IF you wish to continue, you may do this in the following manner (busybox/root shell required):

Terminal Emulator

Disable RIL:

stop ril-daemon

Connect to the modem:

microcom -t 5000 -s 115200 /dev/smd0

At this point you will not see a cursor blinking, but your input is accepted. For example, the command

ati

will request basic information from the device and display it to you.

AT+CLAC

will give you a list of available commands. There are hidden/OEM commands also, but my knowledge is limited in this area.

Enjoy.
[Verizon Samsung Galaxy S 4] RuggedHunter:
Ahhh...

At some point last night during my searches, I came across several logs posted to pastebin that looked interesting. Also an XDA thread that had located all the sbl.mbn images...it had the cell address locations for the boot screen images for all 3 types of upload screens you see...param-ifs I think they were called? But they were just the image files, I think...

Edit: http://xdaforums.com/showthread.php?t=1750645

Thanks for the clarity!

:beer::beer:

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDL > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] ryanbg:
That will be useful, thank you. What I found most interesting was that one Upload Mode I'm able to boot into is not shown in the jpegs he extracted. 'Hardware Reset: Upload Mode' is not there. Very interesting.
[Verizon Samsung Galaxy S 4] RuggedHunter:
Okay, cool! Thanks for letting me know, I'm glad it's at least a little helpful! My problem is recognizing when I've found something. Here are some other links I thought were interesting that came up on the same keyword search last night...mostly general linux/kernel info on the first link, and some logs that I can't read... That were posted to pastebin. Maybe you guys will find a nugget of knowledge in them?

http://www.ouah.org/p61_BONUS_BONUS.txt

http://pastebin.com/NhzR5nrh

http://pastebin.com/SfS16sf8

http://pastebin.com/SgLvjFMC

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDL > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] RuggedHunter:
Okay, last little bit of nothing to add, then I'll creep back to my hole in the sidelines...

In my own phone, I see the following directories:

/data/dontpanic

/datamedia/dontpanic

/sys/kernel/debug/....

In the last folder there are two more folders each named /pm8821-dbg/ and they each contain 2 files... /addr and /data. There is a third folder named /pm8xxx-adc that contains about 12 files. ...I know it's a stretch but I was thinking 'pm' might indicate panic mode...

I cannot open any of the files in these folders. Would the information contained in them be of any use? If so, I need some instructions to get it to you. If not, I'll delete this garbage post.

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDL > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] RuggedHunter:
☆☆☆☆☆☆☆☆☆☆☆☆☆☆
[Verizon Samsung Galaxy S 4] Hashbang173:
has anyone contacted [MENTION=4686490]meteorrock[/MENTION] about unlocking the bootloader. I think she knows a lot of devs that could be helpful in this unlock process
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
Im really happy you guys are working so hard for this and I hope you achieve this unlocked bootloader soon. Looking forward to Cyanogenmod 11!
[Verizon Samsung Galaxy S 4] Surge1223:
No, not yet anyways but we're always looking for help so maybe we'll ask. Also, its not just me, ryanbg, and our loner buddy jeboo lol. We regularly consult/talk with with devs behind the scenes. Though if [MENTION=2918486]Ralekdev[/MENTION] is bored we sure wouldnt mind his thoughts/comments. Especially in relation to issuing an SMC call to disable secboot via the TZ, I dont believe many besides him and djrbliss have experience in that (SMC calls that is).
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
When 4.4 KitKat arrives for VZW S4 will it be any easier to make unlock the bootloader???
[Verizon Samsung Galaxy S 4] gunz.jones:
Most likely not since they will be patching any holes they've already found. Although, one patch could cause a bigger hole somewhere else. Never know.
[Verizon Samsung Galaxy S 4] Coycaine:
Without knowing anything, I'm going to say it is going to be much harder, if that is even possible.
[Verizon Samsung Galaxy S 4] decaturbob:
I don't understand why you would think that? Each subsequent release incorporated additional security measures and 4.4 may be one where it may be difficult to root....if at all.
[Verizon Samsung Galaxy S 4] jamesd1085:
Not necessarily... Its a completely new version of android that operates very differently with new ways of using the chipset...first releases might have new exploit openings
[Verizon Samsung Galaxy S 4] eheinzeiii:
I have to say. Although I read this thread everyday and most of the time I can't understand most of it. I greatly appreciate the work you all are doing here. I know I speak for a lot of people who can't wait for this bad boy to be unlocked. Thanks again.
[Verizon Samsung Galaxy S 4] hybrid86:
Agreed. I yearn for the day when the world can again run sweet cyanogenmod on their S4's.
[Verizon Samsung Galaxy S 4] sokrboot:
I cant help but think that working in QEMU might be helpful. Anyone have experience here? What are our roadblocks to manipulating the chipset OS? http://wiki.qemu.org/Main_Page

sent from my VZW S4 w unlocked ME7 bootloader
[Verizon Samsung Galaxy S 4] rushless:
I admire people's tenacity in this thread. Apparently futile, but honorable none the less.
[Verizon Samsung Galaxy S 4] ericerk:
Verizon* S4s.

All other S4s (excluding att) Can Run what ever they want...
[Verizon Samsung Galaxy S 4] ohbuckeyeman:
Yeah, not helpful or encouraging...
[Verizon Samsung Galaxy S 4] Dhs92:
It's not futile, they've made progress. Would you like to give it a try? No? Okay then, they'll find an exploit soon enough.

Sent from my PurifieD Galaxy S4
[Verizon Samsung Galaxy S 4] gnubian:
Seriously. We know people appreciate the effort, that's what a thanks button is for. Please stop telling surge, ryanbg and jeboo that you "love their dedication and would help if you could". Either research and help, hit the thanks button, or stfu. Seriously the I love you wish I could help posts are getting old. [EndRant]
[Verizon Samsung Galaxy S 4] Surge1223:
You know whats weird? I know the S4 is a APQ8064/MSM8960 but from looking at how its built it uses MSM8960 For its sbl1-3, but uses a APQ8064 (MPRG8064.hex) flash programmer to enumerate them

/home/se.infra/jenkins1/workspace/HUDSON_GA_JELLYBEANPLUS_JFLTE_VZW-REL-USER/nhlos/ap/boot_images/core/boot/secboot3/hw/msm8960/sbl1/sbl1_mc.c

-/home/se.infra/jenkins1/workspace/HUDSON_GA_JELLYBEANPLUS_JFLTE_VZW-REL-USER/nhlos/ap/boot_images/core/boot/secboot3/src/boot_pbl_v1.c
[Verizon Samsung Galaxy S 4] RuggedHunter:
I figured out how to read the addr and data files. Will they help?

sys/kernal/debug/pm8821-dbg/addr says 0xC4D23F8800001000

sys/kernal/debug/pm8821-dbg/data says 0xC985FF8800001000

sys/kernal/debug/pm8921-dbg/addr says 0xDC1BDF8800001000

sys/kernal/debug/pm8921-dbg/data says 0xCA8DDF8800001000

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDB > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] budding_developer:
Hey Surge -- been thinking about this, and jeboo's custom "bypasslkm" kernel module, and I am wondering if there is a way we can use the bypasslkm module as a step toward EFFECTIVELY unlocking the bootloader on the S4. Here is my logic flow:

1. Early into the stock kernel init, load the bypasslkm module which allows us to load unsigned kernel modules;

2. Upon successful loading of bypasslkm, load a custom kexec module to enable a second kernel to be loaded "on top" of the stock kernel in memory;

3. After these modules are successfully loaded, issue a call to the kexec module to start the custom kexec module's loading of the custom kernel on top of the stock kernel and bringing up the custom ROM.

This would be a boot-time hijack which wouldn't trip any warranty or knox counters, but would allow us to run custom kernels and ROM's -- perhaps hashcode could even implement this in SafeStrap; currently, it lets a user run a custom ROM, but only using the stock kernel. By adding bypasslkm and a custom kexec, SafeStrap could then allow the use of a custom kernel as well at runtime.

I don't know enough about module programming to do this myself, but I think this would work -- I can successfully run bypasslkm on my S4 with the MI1 kernel, so it would make sense to simply load & run a custom kexec after that. You would know the inner workings of that better than I would though.
[Verizon Samsung Galaxy S 4] Kamaole:
This is what [MENTION=4243514]Hashcode[/MENTION] is trying to implement on safestrap. I believe he is having trouble flushing the cache
[Verizon Samsung Galaxy S 4] E:V:A:
There is no need for new theories, just read all about it here:

Admin Edit: Link removed due to receipt of a DMCA takedown notice.

the entire boot chain is signed, at least it used to be, last time I checked (~1 year ago).

This is very good, but why do you need to stop the ril-daemon first?

Also, what effect does this have on any other network connections (adb, wifi etc)?
[Verizon Samsung Galaxy S 4] gigilie:
so sorry to quote you from your closed thread but does the answer lie in those docs that we can't get anymore cause files are offline? i was literally just on your thread a few hours before had a PM ready to send you asking to join the cause. I'm sure we can rustle you up an S4 or maybe the bounty(ies) if you wana just save the guessing games and do it for us... n add a couple more K thanks your way? :) or just point in the right direction n guide us anythings appreciated!
[Verizon Samsung Galaxy S 4] Surge1223:
In all honesty as you probably know, the deeper you get into this stuff the more complicated it gets and

I agree with you that the boot chain is signed, however I dont think we should shut the doors there.

So the hexagon modem is verified by sbl3, but conditionally it can be loaded earlier. Also rpm loading can be cancelled when the tz loads back up memory etc.

I guess what im saying is that even though the boot chain is signed doesnt mean every step between is. (the note 2 pit exploit to boot to/write to insecure mem comes to mind)

What if the COT was broken using a flash programmer exploit? Despite the cookie verification issue it still remains that we are able to write to memory with a flash programmer. Executing code there certaintly wouldnt be easy, but from the qhsusb/pbl >> sbl1 rpm/tz functionality we cant say its impossible either.
[Verizon Samsung Galaxy S 4] E:V:A:
Sorry, didn't mean to come across as negative, just trying to prevent us from thinking in loops and repeating old discarded ideas. (But maybe it can be also good to review old ideas...)

About the files, that is a problem with crappy file host and partially with preventing XDA to get into trouble, and trying to avoid DMC take downs. I simply decided to stop spending any time trying to maintain download links that gets removed after a few days/weeks. Surely there are several hundreds of people who have that archive by now, so why they don't just upload to a torrent, I don't know. I was contacted by QC lawyers for those links!

But, anyway, most of what regards these current issues are not directly found in any of those documents, and is more likely available elsewhere. BTW. Google is NOT the best search engine for this...

As much as I'd like to help, there's not much I can do right now. I'm too much involved elsewhere... But I'm happy to chime in if I see something I know something about.

What do you mean with Flash programmer exploit?
[Verizon Samsung Galaxy S 4] ryanbg:
Qfuse address dump from device tree source for Note 3, hoping this will draw the right attention

Qfuse address list
[Verizon Samsung Galaxy S 4] mhannah3333:
Found this thread here on Xda.. This might not be useful but interesting nonetheless.

http://xdaforums.com/showthread.php?t=2447832
[Verizon Samsung Galaxy S 4] Maribou:
Do you want to waste five minutes of your life on rubbish? No? Then I would suggest staying away from that link.

Sent from my warranty voided device.
[Verizon Samsung Galaxy S 4] sokrboot:
Possibly a reference to this?

http://www.cvedetails.com/vulnerab...1/year-2014/opec-1/Google-Android-4.2.2.html

[MENTION=766721]ryanbg[/MENTION] [MENTION=4939386]Surge1223[/MENTION]

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] ryanbg:
Flash programmer is in reference to the Qualcomm 'firmware' hex file that's used to flash devices at the OEM/Qualcomm level. It's loaded via eMMC tool in QPST or QDART or etc... This is how they initially program the eMMC.
[Verizon Samsung Galaxy S 4] xs11e:
I wish you all success!

I wanted the bootloader unlocked so badly but... I'm now wondering if it will ever happen?

I've ordered a new phone, a non-Samsung phone and it should arrive today so I want to wish everyone success in finally getting the unlock figured out and hope it will also work for the S5!

Thanks to everyone here for all the help I've received and good luck!
[Verizon Samsung Galaxy S 4] JSanchez41:
Yall just lost me way too techy yo
[Verizon Samsung Galaxy S 4] sokrboot:
Obviously, there are people here who are WAY smarter than I am. Should we be focusing our efforts on the "hole" described in this article?

http://www.theregister.co.uk/2014/01/13/knox_vuln_is_android_not_us_says_samsung/

"January 9, Samsung says: “Samsung has verified that the exploit uses legitimate Android network functions in an unintended way to intercept unencrypted network connections from/to applications on the mobile device."

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] ericerk:
Holy mother of redundancy... Dan Rosenberg called BS on this. We're going in circles now.

Can we start posting general stuff in the General forum vs everyones feels in a DEVELOPMENT section.
[Verizon Samsung Galaxy S 4] sokrboot:
I know DR called BS on Paul Kocialkowski and FSF's claim about a backdoor. To my understanding (which is quite limited) what the Israeli research team found was different and Samsung and Google confirmed its existence.

Im sorry if im wrong.

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] numbR7:
First, let me say the following is in no way, shape or form a criticism or any type claim that I have or know a "better way" it is only a humble idea and nothing more. With that said, I have no idea what the leaders of this project are doing behind the scenes. I have no doubt the people are smart and the work is hard. I read about "thinking in loops" etc... and can't help but wonder if Six Sigma and LEAN techniques might prove useful. With regard to LEAN "waste" could be redifined as anything that is contrary to a completely open bootloader. In my experience, waste is anything that does not add value to a product no matter what the product. The product here is an open bootloader. To solve the problem it must first be thoroughly defined or the "current state" well understood. This would be drawn out as an actual process map. In understanding the "current state" this does not mean you understand a solution--yet. This "map" could be shared. Then a "desired state" is created. As before, mapped out on a dry erase board, if need be, (there are many programs designed for this purpose). In creating a "current state" map all "waste" would be identified. If this map is drawn up with care (preferably by a group of those that work with the "process") , it would eliminate "loops" etc... The obstacles to desired state would be clearly defined and easily observed. That is not to say this miraculously solves the problem, it just clearly defines the obsticales to the "desired state" or an unlocked bootloader. If one does not appreciate the power of LEAN and statistical techniques perhaps a simple but comprehensive flow chart could be created and used as a tool by sharing it. "Waste" that can be eliminated could be--changing the map--thereby removing clutter. Pieces of a solution could be collected in the proper "box." In this way, progress and information could be observed effeciently and without "loops" etc... Though the solution no doubt lies in code, etc... a visual tool can be extremely helpful and surprisingly efficient. Different people or groups could focus on a single block (or whatever form your map takes) recording all information and attemps, tests etc... there. Once added to the map, it would be there for all to see perhaps even providing a missing piece or inspiration. It has been said that the state of an efficient process can be understood by a new comer within five minutes (of course given that person posses a basic understanding of what he was observing). Though I do not know squat about bootloaders I know something about problem solving. You guys may already have done precisely this. I want bore you any further with the beauty of LEAN techniques but I will say that a thoroughly fleshed out "current state map" actually committed to paper or chalkboard or program is an extremely powerful tool.
[Verizon Samsung Galaxy S 4] sinner822:
We need a BOO button for all this bull. STFU if you don't have anything technically constructive to add!

Sent from my SCH-I545
[Verizon Samsung Galaxy S 4] failedjedi:
Because you just added something technically constructive.
[Verizon Samsung Galaxy S 4] jaw20:
To those that want to look at the webkit exploit. Here's the github link. Click!
[Verizon Samsung Galaxy S 4] Sir_Eagle:
Good post, especially if you know what he's talking about and understand Lean and Six Sigma.

Wasted post and should follow his own advise.
[Verizon Samsung Galaxy S 4] Hashbang173:
Can the mods here delete these posts that aren't helpful?
[Verizon Samsung Galaxy S 4] mulhiny:
At the DOD we are obsessed with lean...A lean "event" for this task would require only those with the know how. A small dedicated group with the defined goal and ability to see it through.

I think it's a great idea.
[Verizon Samsung Galaxy S 4] Hashbang173:
Guys look at this http://xdaforums.com/showthread.php?t=2702696

This is an old ROM for mdk but it works on safestrap mk2.

It's an aosp rom
[Verizon Samsung Galaxy S 4] decaturbob:
why are you posting this in this thread?
[Verizon Samsung Galaxy S 4] Surge1223:
It's not aosp. Also it's less than 200mb in size
[Verizon Samsung Galaxy S 4] Hashbang173:
I'm saying that there is something that is not based on touch wiz that works on safestrap for some reason. Maybe if we build roms a speical way we can have non touchwiz based roms
[Verizon Samsung Galaxy S 4] NighthawkXL:
It's not the first time we've had this happen... after all the Google Play Edition ROM works on MF3 devices via Safestrap. The key to them working is having kernels that are compatible with each other.

But anyway, back to the topic at hand I suppose.
[Verizon Samsung Galaxy S 4] Hashbang173:
so would it be possible to get something like PAC custom made to work on safestrap
[Verizon Samsung Galaxy S 4] NighthawkXL:
Negative, since we are forced to use the stock TouchWiz kernel, even with Safestrap. It was a fluke that the Google Play Edition ROM was able to work on the TW kernel, but sadly it only applied to the MF3 baseband. Attempting to run a 4.3 or 4.4 GPE rom via Safestrap will result in a bootloop, as for PAC it's in the same boat as Paranoid, CyanogenMod,etc. until we can either A. Unlock the Bootloader, or B. Use kexec to load a custom kernel we won't be seeing these rom's on our device.
[Verizon Samsung Galaxy S 4] scryan:
its not really a fluke that one worked, or that the other didn't, ect...

If someone was willing to do a bunch of work we could probably have something similar to an "AOSP" rom...

Like you said, we cannot update the kernel... the 4.2.2 GPE rom was a good example of what someone would have to do. It was basically fake AOSP, in that it ran on a TW kernel just all the user interface stuff was AOSP. When they updated GPE past 4.2.2 they gave it its own kernel, so we could not use it anymore.

I believe it was discussed in the early days of safestrap that for other devices rom developers were basically building modded "CM" or "AOSP" builds that ran on stock kernel.

From my understanding that Illusion rom is just that, and Illusion.... Not to say it doesn't work, or that its bad or poorly done... But its closer to a new theme then a new rom.

HOWEVER, roms, walls of text about lean production, six sigma, and what philosophies the DOD embraces are pretty damn unrelated to bootloader exploits.
[Verizon Samsung Galaxy S 4] numbR7:
Understanding the current state

Does anyone know by exactly what method(s) the bootloader is locked? Can anyone take a pen and paper and write it down? Not how to defeat it, just simply what exactly needs to be defeated? If so, please post the list so that many people can join in the effort.

Thank you in advance...
[Verizon Samsung Galaxy S 4] scryan:
Its not like there is a list different techniques to try that could be written... especially at this point. Maybe before anyone had tried anything there were some known exploits for particular android kernels, ect...

But now it is just examining the code, and looking at how it prevents different software from being loaded... Then looking for flaws in the security logic that would allow a user to execute their own code, and trying to figure out what changes we can make that won't trip security flags but WILL change the environment enough to allow us to install a custom recovery and make the security system think everything is natural.

So for instance with the loki exploit http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html

It was noticed by examination of the bootloader code it was noticed that it was seemingly based on the open source lk ("Little Kernel") project...

With information from lk, the functions that load and verify the kernel were identified and it was found that the code was loaded before signature checks were performed, so code could be added to overwrite aboot with the kernel with no further verification... (OK, well close enough. Read the article, google anything you don't understand....)

The point being its not like these exploits are a standard thing. Most of what they are doing is probing for holes and trying to establish how and what all is being read and in what order during boot, and what we are allowed to tamper with.