yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] npjohnson:
Worth noting that we have ModLoad working on NK1, I posted it up in the Development Section. I am working on finding the addresses for the OC1 kernel so modload will work for it as well, but don't have a lot of time to spare right now. :p

Well, multi system has support for kexec... Just as SafeStrap does.... We just can't get Kexec to work!

There is no difference between executing Kexec from MultiSystem and SafeStrap, both provide a second init hijack (MS disables it by default), and both can unmount all partitions to give an optimal kexec execution enviorment.

Sudo-hardboot? Did you mean psuedo? Sudo is a Super User do command in unix. If you meant psuedo, kexec already does a warm boot (keeping system live, but systematically taking HW down and back up)... that's how it works.

As for kexec hardboot (power off and reboot to new kernel), that almost always requires a working kexec before you can use hardboot, as hardboot provides even less (0) logs, and at least with kexec warm boot, we can snag a LAST_KMSG, which helps the debugging process.

FlashFire kills all system processes, unmounted all partitions, and executes its commands from a root terminal. It basically strips the system down to a terminal, and the places the files, before rebooting the device. Both SafeStrap and MultiSystembprovide an equally as optimal platform from which to execute Kexec.

Correct, it has some awesome features for data sharing among ROMs. Excited to see what can be done.

Not closed doors :p anyone that wants to contribute can join the group, but obviously some experience is required to work on Kexec/other roads.

If you've got any question about where we have gotten kexec, I'd be more than willing to answer.
[Verizon Samsung Galaxy S 4] Legitsu:
yea /s/sudo/psuedo

and yea I am aware of what kexec does what I was getting at is that you need some way of "resetting" the hardware to a "sane" enough state for kexec to work particularly the driver stack and GPIO/IC2 are gonna be where the likely hangs are gonna happen I wonder if it would be possible to take a snapshot of what state the hardware is in and what GPIO commands are given and import them into a debugger so you could walk them

as for hard-boot I was talking about writing a second module to issue what would amount to a psuedo-hardboot and then directly load the kexec payload via some kind of zimg highjack

id would go a little something like this

create a module that will do pre-warmboot hardware sanitation as well As setup the highjack for loading kexec >write to memory warmboot lock the pages to read only(this will be tricky because you need to insure that its still a state where the stock kernel won't bomb out)

the module will then insure the sanitation is kept while issuing a warmboot, and then proceeded to load the second payload module containing the actual kexec payload

if everything is kept sane and clean it should boot provided you have properly patched the guest kernel

again processing out loud here ... its been a long time since I have played with any of this ...
[Verizon Samsung Galaxy S 4] npjohnson:
We already have something similar to a GPIO debugger... we can walk through the whole boot sequence in IDA, and view what happens and such.

You aren't to far off what we have going currently :p haha. We can use kernel modules to help with TIMA debug, and several other things like you were mentioning. That's actually what we are doing though, loading several related kexec prep modules before executing. You can view their Source on Surge1223's github.
[Verizon Samsung Galaxy S 4] Legitsu:
haven't had time to review the repo but there are only so many ways you can go about it

;)
[Verizon Samsung Galaxy S 4] jaw20:
Just another heads up guys, any unlock method may be restricted to nc5 or nk1. Meaning if you are still on the nk4 bl you are fine.

Clarfication: This is not to say that were arent working things for the oc1 update. This is just saying that a possibility wont work on oc1.
[Verizon Samsung Galaxy S 4] kcarden:
Another thing worth mentioning is that the things being worked on are in the telegram chat and unless we have a spy for Samsung brainstorming with us, it is very possible that whatever vuln is found in nc5 could be left open in Lolli.

Edit: it's important we manage our expectations though.
[Verizon Samsung Galaxy S 4] knox0x1:
So is there anything you guys have done for the vzw note 3? I'm still on nc4 using hyperdrive rls8 and even though it's an awesome rom I'd like to update.
[Verizon Samsung Galaxy S 4] jaw20:
For right now the method that we are currently researching, No. I really cant say anymore than that. We are in contact with the person in charge of kexec over on the note 3. So we will have to see what happens there.
[Verizon Samsung Galaxy S 4] knox0x1:
OK thanx for the reply.. Please let me know if anything changes. You can pm me if that's would be a better way to let me know.
[Verizon Samsung Galaxy S 4] jaw20:
What could THIS mean? How could this be used? Why do I keep on asking questions?

Find out more, after the break.

Stay tuned.

(Ceremonial bump)

(If anyone looking at link understands what needs to be done to accomplish that, contact me)
[Verizon Samsung Galaxy S 4] kcarden:
Interesting bug but we'd have to have fastboot to implement it.
[Verizon Samsung Galaxy S 4] npjohnson:
No actually [emoji14]
[Verizon Samsung Galaxy S 4] jaw20:
We don't necessarily need fastboot.
[Verizon Samsung Galaxy S 4] ryanbg:
Not much for us. Writing to protected regions of eMMC won't help us execute code or exploit anything. It's a neat bug but only applies to devices that use near-stock Little Kernel/fastboot. Samsung uses the Odin protocol and has it's own system of checks aside from generic LK checks. So in reality, nothing really to see here. If it was vulnerable (I haven't confirmed but doubtful), you could maybe use it to write custom system partition, and possibly root.
[Verizon Samsung Galaxy S 4] jaw20:
I was suggesting using it on RPMB. If we can go over partition boundaries, we can overwrite RPMB. we don't have to use odin per se either. We could still use heimdall to do this.

(could we talk in the telegram chat? [MENTION=766721]ryanbg[/MENTION] )

Oh and, If anyone wants to join the Telegram group Chat CLICK HERE

(You will need telegram in order to join though, this is just an invite link)
[Verizon Samsung Galaxy S 4] traco1:
Unlock my Phone

Well I fell into the same trap . Now I can not root phone. I'm disappointed in Samsung's fix to security.

I can't even change my boot animation. What horse****. I be thinking next time before I purchase.

Hopefully these great developers can come up with a fix. I'm rooting for you 1!!! ( No pun intended )
[Verizon Samsung Galaxy S 4] npjohnson:
Just to prevent people who may just click to join and not contribute... Maybe we should keep the links to PM messages...
[Verizon Samsung Galaxy S 4] jaw20:
. The link is no longer usable.
[Verizon Samsung Galaxy S 4] traco1:
Rooting s4 veizon lollipop

I have found a software app called "RootKing" it's a chineese made program. Has anyone tried this ?
[Verizon Samsung Galaxy S 4] jaw20:
We already have root. We are trying to currently unlock the boot loader
[Verizon Samsung Galaxy S 4] Bones519:
I want to apologize in advance if my question annoys anyone, I'm not a developer. But, I've been a happy flashaholic for years over several devices and found myself with a locked bootloader on this s4 when I bought it. My question is this... When Verizon sends out an OTA update and it includes a new locked bootloader, does it just erase or overwrite the current bootloader? I know my question is so simple that it's probably stupid, but why can't we just replace the bootloader with one that can be unlocked? If an OTA update can replace the bootloader, why can't we?
[Verizon Samsung Galaxy S 4] Legitsu:
it trips a hardware based counter and there is no way around that because its encrypted and signed
[Verizon Samsung Galaxy S 4] jaw20:
It overwrites the old boot loader and trips a qfuse when flashed. ALSO DO NOT TAKE THE OTA TO OC1. Even though there is root for oc1 our exploit will most likely be for nc5
[Verizon Samsung Galaxy S 4] Bones519:
Thanks! I haven't yet, though I have read how to update and keep root, and have thought about it, but I am on nk1 which I can still Odin back to nc5 last time I checked. The biggest reason I haven't tried to update is loss of xposed compatibility with lollipop. I NEED xposed! :p
[Verizon Samsung Galaxy S 4] ryanbg:
The RPMB is a physical hardware partition and cannot be written to the same way a regular eMMC partition can. We also don't know if the Samsung implementation of LK is vulnerable.
[Verizon Samsung Galaxy S 4] jaw20:
We are contacting someone about that now (about the vuln).
[Verizon Samsung Galaxy S 4] ryanbg:
Odin/LK will not have the proper logic to write to the RPMB, at least in the way you want it. There are special commands needed to access it.
[Verizon Samsung Galaxy S 4] JeepinxJosh:
then....?

CVE-2014-4325: When processing the boot command in fastboot mode, the Little Kernel bootloader, as used on Android, will not verify that the device is unlocked or that the target does not use signed kernels before booting the downloaded kernel image without verification. A local user can use this flaw to boot arbitrary kernel images via fastboot even when the target uses a signed kernel and the bootloader is locked.

and

CVE-2014-0973:

When parsing a padded PKCS#1-formatted RSA-signature, LK is not properly verifying that there are no trailing bytes left after the hash value in the signature decrypted with the public exponent. Given a certificate with an exponent of 3, it becomes practical to force a chosen expected hash by reducing the padding length and adding garbage bytes after the hash where the garbage bytes are adjusted to make the signature the cube root of the encrypted value. A local attacker can use this flaw to craft a signature that this implementation passes as valid, leading to a bypass of the secure boot feature for application bootloader images.

and then this

CVE-2013-2598:

The LK implementation performs basic tasks to start an operating system for the application processor. As part of that, it reads the Linux kernel and ramdisk from a boot or recovery image, loads it up to RAM based on the image header information, performs signature verification, and finally boots. Because of implicitly treating the header values that determine the load destination of the image as trusted, it was possible to load this image to arbitrary locations, including the memory of the LK application bootloader itself and thus overwrite, e.g., signature verification code.

Hey I just noticed you guys have found a Vuln I had not got to the last 2 pages yet when I posted this... should I remove it (does this contain info on the vuln that we may want to keep a little less accessible?) or ? sorry I got reading and excited... i'm still very much a neewbie with androids. I see similarities in code I know but have no clue how similar they work...
[Verizon Samsung Galaxy S 4] npjohnson:
The last two are 2013 & 2014 meaning that they are well beyond patched. The first one is also patched, and we don't have fastboot protocol, so its useless to us anyway.

You confused us having fastboot with the original vulnerability being present despite the fact that we don't have fastboot. Even with that new vulnerability (none of the ones you listed, one from a few pages ago), it doesn't affect the bootloader work at all it seems. It could potentially lead to root, but that seems improbable to say the least.
[Verizon Samsung Galaxy S 4] JeepinxJosh:
The search continues then but that post a few pages bacl on the original fastboot idea was not me

Sent From My S4 on XDA Free
[Verizon Samsung Galaxy S 4] XxD34THxX:
0.o A Vulnerability... I am just silently reading, and am glad so have some progress happening..
[Verizon Samsung Galaxy S 4] uplusion23:
So. As someone who after three years upgraded finally to an S4 from an S3 [I've flashed so many ROMS] to find out this damn S4 is almost worse than the S3 because of no flashing, I considered selling it for cheaper and just jumping back. After seeing this was somewhat still under-way, I have hope.

So, I'm on NK1 which I've seen is relatively close to NC5. Would say the NC5 exploit work for me if there were one, since I can flash to either? Or could I just flash down, and exploit NC5?

Also, if there is any help needed or anything I can do such as providing partitions or information, I'd be glad to help. I would love to be able to get rid of annoying features, such as most of the bloatware [Got a lot removed with root uninstallers], and the IME switcher notification. Finally, how come Samsung NEVER adds a torch toggle to the notification panels?!

Anywho, I'd love to see the progress, and although I'm not a developer, I would love to lend a hand in any way possible.
[Verizon Samsung Galaxy S 4] XxD34THxX:
Hyperdrive is a decluttered version of Touchwiz WITH the Torch in the notification bar...

I think the only way to break this 'loader is through an inside source or a metric ton of luck, none of which seems to becoming anytime soon. And from what I read, the vulnerability is at most a way for root...
[Verizon Samsung Galaxy S 4] jaw20:
You can definetly flash down to nc5 from nk1.
[Verizon Samsung Galaxy S 4] uplusion23:
Hyperdrive has given me some issues. Got it on SafeStraps Slot 1, and no wifi works. The main reason I would love the bootloader unlocked is for aosp roms.

[MENTION=5552234]jaw20[/MENTION] Alright, so if the bootloader unlock for NC5 comes out, I can just downgrade and apply?
[Verizon Samsung Galaxy S 4] XxD34THxX:
Flash the WiFi modules...
[Verizon Samsung Galaxy S 4] STIKID:
You're suppose to flash the nc5 modules, also if you're using rls21 you also have to flash hyperdriveUI.
[Verizon Samsung Galaxy S 4] uplusion23:
Do you know why its possible to downgrade from NK1 to NC5 yet we can't go from something like OC1 to NK1?
[Verizon Samsung Galaxy S 4] wavedashdoc:
This thread is not about Rom Q&A or Downgrade talk. Please post in correct threads to keep this one clean for boot loader unlock Info and discussion only.
[Verizon Samsung Galaxy S 4] jaw20:
There is a rollback counter that prevents us from going from the official oc1 ota back to nk1
[Verizon Samsung Galaxy S 4] jaw20:
That question is related but I do agree on the fact that ROM discussion should not be in this thread.
[Verizon Samsung Galaxy S 4] Legitsu:
the hammer needs to come down here the thread needs to be limited to people that have actually contributed something of relevancy to the discussion
[Verizon Samsung Galaxy S 4] jaw20:
That may be a bit much.
[Verizon Samsung Galaxy S 4] Ragnar:
Hello everyone,

It has come to our attention that this thread has been derailed.

The OFF TOPIC conversation must stop right now.

This thread is strictly about discussing ways to to figure out how to unlock the bootloader.

Only post items which lead to development. Any other type of post will be dealt with going forward.
[Verizon Samsung Galaxy S 4] tshelby73:
Although I do agree the topic should stay related I do suggest this thread be moved to development thread and not general. General pretty much means anything can be posted.

Sent from S4 using the better than it was then they jacked it again Tapatalk
[Verizon Samsung Galaxy S 4] Ragnar:
That sir is incorrect. All forums on XDA unless marked as OFF TOPIC or OPEN are development forums. The General section is for discussions on anything Development related. It may be on a specific simple topic as edits, or discussion of root or bootloaders.

Unfortunately there are not enough moderators to cover every single post made by the 35k avg users which log into XDA daily so we do depend on concerned users who report post using the small triangle icon at the bottom of each post to assit us in locating such off topic posts.

The Development Forums within each device section are strictly for Developers to post and share their work.

So please help us help you by reporting any incorrect posts......
[Verizon Samsung Galaxy S 4] RuggedHunter:
Wow, thank you for that clarity. I believe I also misunderstood the rules and perhaps have made that "General thread" comment before too... Even though I generally agree with keeping this thread on track.

AT&T S4 i337 > SafeRoot > SafeStrap 3.71 > HyperDrive RLS12

Tasker-ized
[Verizon Samsung Galaxy S 4] Walter.White:
[MENTION=766721]ryanbg[/MENTION] [MENTION=4939386]Surge1223[/MENTION] [MENTION=974229]Cobaltikus[/MENTION]

Here is an interesting read for you guys. http://iknowu.duckdns.org/files/public/Qualcomm-Secure-Boot/Qualcomm-Secure-Boot.htm
[Verizon Samsung Galaxy S 4] RuggedHunter:
It was tucked away in a different thread, but be sure to thank his post HERE too, if it's useful!

:)

AT&T S4 i337 > SafeRoot > SafeStrap 3.71 > HyperDrive RLS12

Tasker-ized
[Verizon Samsung Galaxy S 4] JeepinxJosh:
Is the bootloader lock coding in the firmware part(s) that stays the same no matter what version or if updates come? or is it changed fom update to update? My question is to understand if it would be better or easier to look into a certain version or to know not to go past a certain version so that if we do get it unl we can actually take advantage of it...
[Verizon Samsung Galaxy S 4] npjohnson:
We have the most research done on NC5/NK1. Just don't update to OC1. There are some serious changes. Plus you'll lose root.
[Verizon Samsung Galaxy S 4] jaw20:
Hey would anyone be interested in donating an s4 for [MENTION=4732871]r3pwn[/MENTION] ?

If you are interested pm [MENTION=4732871]r3pwn[/MENTION] .

CLARIFICATION: This is to mean that [MENTION=4732871]r3pwn[/MENTION] needs a device on the cheap. This does not mean that you have to give up your s4 for free. That was not the intention when I said donation.
[Verizon Samsung Galaxy S 4] XxD34THxX:
So, no major/minor developments yet?
[Verizon Samsung Galaxy S 4] rp1226:
I think the S4 is starting to get old.. and people are starting to give up. Any support we do have is great but looks like we might be stuck with this locked bootloader. I'm just waiting for my contact to finish so I can get a new phone around Black Friday timeframe.
[Verizon Samsung Galaxy S 4] jaw20:
I can definitely tell you work is happening. On the kexec front, and on the hardware front.
[Verizon Samsung Galaxy S 4] rp1226:
That is great news. Thanks!
[Verizon Samsung Galaxy S 4] RuggedHunter:
http://xdaforums.com/showthread.php?p=61333983

Sounds good...

AT&T S4 i337 > SafeRoot > SafeStrap 3.71 > HyperDrive RLS12

Tasker-ized
[Verizon Samsung Galaxy S 4] XxD34THxX:
yay. I though dev for this died off.

:D
[Verizon Samsung Galaxy S 4] budding_developer:
This is to say good bye to this thread... I have given up on the S4 in favor of the Google Nexus 6.

It's a true Android phone, without the bothersom "TouchWiz" problems -- and the bootloader is already unlockable/ unlocked. I can do anything I wish with the Nexus 6 -- any ROM, any kernel, any custom recovery. Yes, I had to buy the phones outright -- but in my opinion, they were well worth it. I just picked up the Nexus 6 64 gb version direct from Google for a total of $567.99 shipped overnight. And for those of you who want to go on the installment plan, Verizon is selling it on their website on a 2-year contract.

Good luck with trying to get this bootloader unlocked or bypassed -- I don't see the future in it, though.
[Verizon Samsung Galaxy S 4] nvrpayretail:
Ah, a glimmer of hope. Thanks for all the hard work! I'm very rusty on my coding so I'm no use in doing any development, but am more than willing to test if anyone needs it. Thanks and good luck!!
[Verizon Samsung Galaxy S 4] Sterben Pistole:
I don't know if this would be useful for you guys or not. Please don't bash me if you've mentioned everything on this list >.> Here you go. http://odste.blogspot.com/2015/05/breaking-samsungs-security.html
[Verizon Samsung Galaxy S 4] nvrpayretail:
Interesting reading, but as I am old and feeble I'm a bit confused. If I read the link correctly, it articulates potential exploits and their probability of success or failure. However, the document begins by saying:

"Solution: ACHIEVED! (1/2)**

**= No Custom Kernel booting, but AOSP ROM's achieved, see next post."

How does one get to the next post? Does it provide a means to get oc1 rooted? Many thanks for any info.....
[Verizon Samsung Galaxy S 4] skepticmisfit:
this is actually a really good post for spectators like me and most of the other people hopping in on this thread randomly. thanks for the link.

---------- Post added at 07:38 PM ---------- Previous post was at 07:27 PM ----------

so that blog post was actually from [MENTION=5848265]npjohnson[/MENTION] here lol
[Verizon Samsung Galaxy S 4] NighthawkXL:
This is [MENTION=5848265]npjohnson[/MENTION] 's blog by the way, he's already active in the group working on exploiting the S4.
[Verizon Samsung Galaxy S 4] Sterben Pistole:
Yeah, I noticed that it was his a couple minutes after I posted it. If I may ask, which method are you going with to unlock the bootloader?
[Verizon Samsung Galaxy S 4] NighthawkXL:
I'm not actively involved in it, my interest in the S4 has mostly waned. I'll be moving to either a Nexus 6 or LG G4 come September. Probably a G4 if the bootloader is unlocked by then... for now it's only the European model. Going back on the topic of the S4, I've just been lurking around keeping tabs on whats been going on. I'm still keeping my S4 as a backup, and a testbed.... so if we ever do get a unlock it's nice to know the status.
[Verizon Samsung Galaxy S 4] kcarden:
Right now there are multiple methods being worked one. Kexec seems to be the fallback seeing as it's the most probable solution and could be implemented easily across devices. but I, personally, am interested in anything that isn't checked in the boot process. Or that is only signed by the manufacturer not the vendor.
[Verizon Samsung Galaxy S 4] npjohnson:
Lol. Yeah. That was actually a WIP and supposed to be private. (Not for any bad reason, just that small parts of it are incorrect).

Yupm

Agreeing with Troy (kcarden) here, Kexex is the most viable option, as Mike has UART going, so we have accurate error messages now ;) progress is being made nonetheless.

Lol. I like how you worded that.
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
<Silence>
[Verizon Samsung Galaxy S 4] XxD34THxX:
None of this code makes any sense to me since I haven't had time to do Python, Java, or Bash(Unix). But glad to see that we(I mean you that actually work on this) are making progress. May I ask for some sort of percentage that tells us how far you guys have made it?
[Verizon Samsung Galaxy S 4] kcarden:
Lol it doesn't really work like that. See the first "attack" was blowing testbit. Which failed miserably. So giving a percentage or an eta would be unfair to you and the community. Although, we have made progress in a sense of learning about alternative qfuses related to a locked bootloader. Nothing set in stone yet, but we have been presented with other "options".

Edit - If you were referring to Kexec progress, there hasn't been much. Nothing presentable anyways..
[Verizon Samsung Galaxy S 4] XxD34THxX:
So no progress on an exploit, but progress on learning about other ways to exploit? If you catch my drift?
[Verizon Samsung Galaxy S 4] kcarden:
Exactly. That being said, finding the correct fuses and their locations, and it's function is where we are now.
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
55% Thats just my guess :sly:
[Verizon Samsung Galaxy S 4] kcarden:
Lol if that's the case we've been at 55% for a while.
[Verizon Samsung Galaxy S 4] XxD34THxX:
Better than 0%
[Verizon Samsung Galaxy S 4] scryan:
[MENTION=4169204]Ragnar[/MENTION]

Possibly another round of cleaning please? It was VERY nice only getting relevant notifications when this thread was bumped.

I reported as you ask, but my reports were dismissed by another mod who disagrees on the purpose of general forums.