yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] ExtraEme:
I just wanted to share this http://www.droidforums.net/forum/android-news/266463-leak-kit-kat-4-4-2-verizon-galaxy-s4.html
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
So technically we COULD put Cyanogenmod on our phone but we would just have a permanently voided phone?
[Verizon Samsung Galaxy S 4] michaelg117:
No, because the boot loader would still be locked. The warranty void by Knox is just showing that you TRIED to do something. Whether you succeed or not is a different story.
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
Ok thanks for making that clear!
[Verizon Samsung Galaxy S 4] scryan:
Not phones with a locked bootloader/kernel verification. The tmobile or similar devices that didnt come with locked bootloaders can. There only worry about knox is the warranty. Our bootloader is locked so we cannot replace the bits that verify the kernel is stock/secure.
[Verizon Samsung Galaxy S 4] myfishbear:
tell me if this sounds realistic. take a mdk phone's bootloader and kernel, edit it so it looks for different qfuses and flash it as a incremental update using the 4.4.2's new key so we can use loki again.
[Verizon Samsung Galaxy S 4] Kamaole:
Can't do that, that would cause a md5 mismatch
[Verizon Samsung Galaxy S 4] KaratemanTJ:
For more information, check out Wikipedia's article on Public-key Cryptography.
[Verizon Samsung Galaxy S 4] myfishbear:
oh yeah i forgot about md5 checksums. lol
[Verizon Samsung Galaxy S 4] RuggedHunter:
I know you saw HERE !
[Verizon Samsung Galaxy S 4] RuggedHunter:
Sheesh...of course my xda app is wonky right now and that post isn't visible. Here's a screenshot of the post (that only partially shows up)

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDB > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] jamesd1085:
If that works for us we will probably have a s**tstorm of new ROMs/Devs/mods hitting our forum!...fingers crossed...toes too...this could be huge
[Verizon Samsung Galaxy S 4] Kamaole:
It says it should work for all qcom devices as long as we have the required hex files
[Verizon Samsung Galaxy S 4] scryan:
wow, would be amazing.

Seen a lot of people post crazy ****, I'll believe it when it works but man I hope it does.

Its been seen though... so hopefully we see something one way or another soon.
[Verizon Samsung Galaxy S 4] jamesd1085:
Yeah surge was on that thread like white on rice...lol...if its useable he and our other great devs will have it up and running for us
[Verizon Samsung Galaxy S 4] dmt010:
And I still don't understand why Samsung put all of this sht security in our phones to begin with.
[Verizon Samsung Galaxy S 4] scryan:
Search this thread for the word offtopic and you will likely find 4 or 5 lengthy discussions on just that.
[Verizon Samsung Galaxy S 4] LiLPurP:
So wait i glanced at the post, but whats going on? Was an exploit found? Srry to junk up the thread btw :/ just really lost lol

Using: AT&T Samsung GS4 4.3 MK2 Rooted with Saferoot, SafeStrap Recovery 3.71

“Unless someone like you cares a whole awful lot, nothing is going to get better. It’s not.” - Dr. Seuss
[Verizon Samsung Galaxy S 4] Kamaole:
Its the tool used by qualcomm (I assume) to sign aboots.
[Verizon Samsung Galaxy S 4] LiLPurP:
So if all works correctly we can change the bootloader to one that we can unlock?

Using: AT&T Samsung GS4 4.3 MK2 Rooted with Saferoot, SafeStrap Recovery 3.71

“Unless someone like you cares a whole awful lot, nothing is going to get better. It’s not.” - Dr. Seuss
[Verizon Samsung Galaxy S 4] Kamaole:
I believe so. Yes. Give it a couple of days
[Verizon Samsung Galaxy S 4] Oishikatta:
What parts are signed by Qualcomm vs Samsung?
[Verizon Samsung Galaxy S 4] daredevl99:
its a tool by Qualcomm not samsung so it cant "sign" ABOOT as far as i know because that is signed with samsung keys but we should be able to penetrate the TZ using qualcomm interfaces. Either way this is great.
[Verizon Samsung Galaxy S 4] NighthawkXL:
The OP states "It signs an image/bin file using QComm's CA cert and one you provide (completing and controlling the chain of trust). With it, you can overwrite stock ABOOTs."

He also already tested the tool, and it seems to work (ie. signing ABOOT), he also released a zip file with cert files a few hours ago.
[Verizon Samsung Galaxy S 4] Kamaole:
What exactly are the cert files for that he posted in his last post?
[Verizon Samsung Galaxy S 4] NighthawkXL:
I haven't a clue, I'm not a developer... but I'd assume they are rather important.

Files include things like...

DEV_Device_CA.cer

DEV_Rights_Issuer_CA_Certs.der

Along with other .key and .der files with long strings for file names.
[Verizon Samsung Galaxy S 4] jj22212003:
Although im excited ...lets not jump to conclusions and muck up the thread... assuming a hex file is created either with an older version of aboot or a custom aboot, paired with the cert files and successfully flashed accordingly then this should be possible ... with the needed hex file just like the old htc sbl exploit.

happy days are close....
[Verizon Samsung Galaxy S 4] daredevl99:
Just going off of name they should be to make our device seem like a developer edition. Meaning we can unlock it.
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
Verizon S4 4.4.2 update incoming on May 2 I guess. Should we update once it releases or not?
[Verizon Samsung Galaxy S 4] tech_head:
Just from reading this thread, I'd say no.

We have no idea what they have baked into the bootloader of Kit Kat.
[Verizon Samsung Galaxy S 4] Kamaole:
I doubt the keys they use are specific to the firmware. While its possible they could have changed them, the op said that it should work on all Qualcomm devices, and I would imagine it work on most if not all firmwares. Unless of course they fix it before the release
[Verizon Samsung Galaxy S 4] Red_81:
I think with this it doesn't matter what keys were used in the firmware. This allows them to put a new trust chain in place that ignores the keys in the firmware.
[Verizon Samsung Galaxy S 4] Oishikatta:
It's not possible to put a new trust chain in place. Samsung uses ROM to lock it to their keys by hash, not by signature. Unless Samsung uses the same keys as Qualcomm, I don't see how this does anything for unlocking the bootloader.
[Verizon Samsung Galaxy S 4] daredevl99:
This will allow us to modify things that are signed by qualcomm which lets us penetrate the TZ
[Verizon Samsung Galaxy S 4] Kamaole:
Please don't raise false hopes. This is all just conjecture and probably can't be done, as said by jcase
[Verizon Samsung Galaxy S 4] RuggedHunter:
So, which of these statements is inaccurate? All of them?

It feels so close!! All of you devs...you ALL deserve to win this war...

☆☆☆☆☆☆☆☆☆☆☆☆☆☆

i337 MDB > MF3 > MK2 > SafeRoot > SafeStrap 3.71 > HyperDrive 12

Interesting read.... HERE !
[Verizon Samsung Galaxy S 4] Oishikatta:
Pretty sure this one in particular is the problem:

This is already stated in the samsung image I posted earlier, but here it is in other words:

Our sbl1 is verified by hash, not by signature. So maybe this gives the ability to replace sbl1, but that's still useless because you can't match the hash. (Hash = exact content, sign = any content + key). So sbl1 contains a set of allowed keys that can never be changed, not even by Samsung. It wouldn't make sense for Samsung to include Qualcomm test certs in that, and even in their documentation they claim that they're their own certs.

If this allowed replacing the tz, then it "may" be possible to downgrade to MDK by creating a modified tz that reports a fixed value (MDK) for SW REV instead of checking the fuses. (Assuming that's done by tz and not sbl*, which I'm not sure on). That's great, but still not at all an unlock, and doesn't do anything for later devices that didn't have a bootloader with the loki exploit. Not to mention it would be difficult to create.
[Verizon Samsung Galaxy S 4] jj22212003:
The thing is tz and secureboot are states. .. If the aboot within the beginning of the boot chain tells the phone to boot in an unsecured state then it doesn't need to to verify anything with tz (trust zone). Correct me if I'm wrong ... but if I'm right I'd like to help I just need time as I'm sure the devs currently working on this need it's also. This thread is in the general section of the forum so please let's not shut people down who have questions but let's try and stay on topic.

And besides if we are able to bypass the secure chain and work outside of tz then we will not have to verify hashes and that means newer devices are included but as I said before let's not get overexcited we need to know what's possible with this and that won't happen until nooks and cranes are figured out... There is a plethora of info in this thread so let's put our heads together without banging them...
[Verizon Samsung Galaxy S 4] jeboo:
The entire bootchain is signed by Samsung. There's no qcom "backdoor" I know of, even in PBL.
[Verizon Samsung Galaxy S 4] ryanbg:
2char
[Verizon Samsung Galaxy S 4] phobia09:
Hey [MENTION=4939386]Surge1223[/MENTION], it seems some folks here (including myself) can't quite figure out what this tool/everything else means for us. I'm sure you're working hard on it, but if you could drop in and be a voice of reason so *speculation* can be put to rest, we'd appreciate anything you can say. Thanks, man.
[Verizon Samsung Galaxy S 4] Surge1223:
Still analyzing everything we have its hard to say what this *might* do for us in the future. In the immediate time, most likely not much. The leak does give us more knowledge though. Anyone wishing for an unlock in the next couple days is going to be disappointed. We'd have to find something qualcomm signed to have this stuff be useful for us, and like jeboo said the entire bootchain is Samsung signed. This is is not to say there aren't Qualcomm bootloaders we can potentially overwrite (like ryanbg refers to), but this research requires time. Unfortunately the excitement from the leak had many believing an unlock was imminent, but this is most likely not the case.
[Verizon Samsung Galaxy S 4] failedjedi:
But right now at the very least would you say the leak is valuable? Are you already seeing stuff that is going to help, or is it just potential to help?

Even if it doesn't lead to a bootloader unlock directly is there at least something of value it can lead to?

I know it's a lot to go through, just wondering if you have seen anything yet that actually turned out to be helpful already, or if it's just a bunch of stuff that MIGHT be helpful.
[Verizon Samsung Galaxy S 4] sahively:
Good lordy, people. Simmer down and let them work.
[Verizon Samsung Galaxy S 4] jgrubbs:
Agreed. Very grateful for all that has been done by these amazing people. Thank you again!!!
[Verizon Samsung Galaxy S 4] mike.s:
Why am I reminded of going on vacation when young, when my even younger siblings were always asking mom "Are we there yet?"

The answer was always "No. You'll know when we are."
[Verizon Samsung Galaxy S 4] cyrushehe:
Well this is gone. I hope it helped us, but I dunno.
[Verizon Samsung Galaxy S 4] Coycaine:
Removed! Thanks Maribou! Had no idea, but I guess I should have!
[Verizon Samsung Galaxy S 4] Maribou:
http://xdaforums.com/showthread.php?p=51983540

Sent from my warranty voided device...
[Verizon Samsung Galaxy S 4] NighthawkXL:
I figured that a DMCA takedown was the reason for the post being removed... but the damage has been done and those files are on the net forever. Nonetheless, I suggest we follow the rules and no longer discuss the files here on XDA.
[Verizon Samsung Galaxy S 4] dmt010:
Since Qualcomm is likely reading this...

I guess I will never understand why when we make 700+$ purchases for technology products that were firewalled from making any modifications with out some sort of threat of legal action. .. This is really retarded. If I want to run my phone as a toaster oven... I should be able to. ﻿if I want to run my own custom operating system, I should be able to﻿.. I purchased MY computer, which makes it MINE. Remove this security secure boot legal garbage from my phone. I'm not a retard with technology and i don't need this layer of security unless i feel like putting it on myself. I never opted in for this trash and I want it off of my phone immediately. So please reach out to whomever exists that can provide me some sort of tool which can free me from this phone prison. Thanks
[Verizon Samsung Galaxy S 4] Oishikatta:
Does anyone have an MK2 aboot and/or sbl1/aboot from the Note 3?

These are the public certs I've extracted from my MDK S4. Unless matching private keys are leaked, QPSA doesn't really do anything for us.

The serial number on the second cert in aboot matches the hardcoded value in QPSA, so that's a good indication that it is the same tool as used by Samsung.

It's also interesting that the first cert in aboot doesn't have any references to Samsung (O = Android LK, S = CA, C = US), but not really significant either.

Please note these files aren't useful because you all already have them. They're just slightly bothersome to extract.
[Verizon Samsung Galaxy S 4] ahoslc:
You need to blame VZW not Qualcomm. Tmobile has a S4 and it's not blocked. It's up to the cell provider not Qualcomm.
[Verizon Samsung Galaxy S 4] ericerk:
Next Time please, start a new thread for this, this doesn't help anyone unlock your phone.

Instead, a dev sees a new post, and they read it, thus wasting their time. Please. Start a New GENERAL thread for this kind of post. (This makes me seem like a hypocrite for doing basically the same thing, eh?)

Also... Keep in mind you paid a subsidy for this device, thus allowing the seller of the phone, (Verizon) to do F--- All w/ it. While allowing locking you into a contract.

If you did buy this phone for $649 then you have some issues, there was a dev edition readily available, thus making me believe you did indeed purchase it under a subsidy...
[Verizon Samsung Galaxy S 4] ryanbg:
That LK cert is a Google certificate for Little Kernel itself, inside of aboot. I'm not sure how/if it verifies the integrity of LK, but it wouldn't matter since we can't mess with it anyway. I found that very interesting too. When you say second cert, are you taking about the Attestation CA cert? I've carved all the ceritificates out a few times, but never compared them to the QPSA stuff.
[Verizon Samsung Galaxy S 4] Oishikatta:
Yes, that's the one with the matching serial.

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 38758 (0x9766)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=KR, ST=South Korea, L=Suwon City, O=Samsung Corporation, OU=DMC, CN=Samsung AttestationCA cert/emailAddress=android.os@samsung.com
[Verizon Samsung Galaxy S 4] sokrboot:
Most of you have probably seen this post by [MENTION=766721]ryanbg[/MENTION]. Looks like progress!

http://xdaforums.com/showthread.php?p=52128412

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] jco897j:
Are the individual elements that make up the bootloader signed separately? Or is the only thing preventing a modified aboot.mbn from being flashed the md5 mismatch?
[Verizon Samsung Galaxy S 4] Stride and True:
Help me help you

Where should I start?

I want to help but I have a very limited knowledge on deep Android things. So I ask, what should I learn?

Thanks
[Verizon Samsung Galaxy S 4] KaratemanTJ:
Well, there's a lot to learn. A good start would be reading through this thread and looking up anything you don't understand. The more you learn, the more you learn you don't know. Don't expect to become a pro overnight, it can take years to become knowledgeable in such things. Just keep reading and learning. =)
[Verizon Samsung Galaxy S 4] jamesd1085:
Agreed... I was quite knowledgeable when it came to 2.2, 2.3 and even knew my way around 4.0...but just falling behind a couple versions now and I have been reading obsessively about jb/kk and secureboot and just seems like I can't absorb all this new stuff...but I have been able to learn a lot...I just don't yet trust my skill enough to start experimenting on my no-warranty mdk...that's why I'm so grateful to the devs here who risk permabricking their devices daily to better our ability to use our s4s the way we should be able to
[Verizon Samsung Galaxy S 4] tech_head:
Looks like real progress.

Might even be the Holy Grail.

The follow on thread was yanked and closed because of DMCA.

Some of the stuff was proprietary and looked to have some utilities for signing and keys.
[Verizon Samsung Galaxy S 4] sokrboot:
I was thinking the same thing and im even more encouraged about his response to another poster in which he states that "the people who understand what this does" are already working on it.

LOTS of good devs looking out for us.

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] NighthawkXL:
A lot of people are misreading the stuff happening in the Note 3 Dev Forum as "progress" it is in a way but not directly. As per the leak from last week while it did contain valuable information it turns out it won't help unlock our bootloader as it stands right now. This is why the mods keep telling people to leave the post clean... to avoid the spread of misinformation. If I recall qhsusb_bulk is a low-level state for the device to be in but without knowing the proper commands it won't be of any use to the average users. Hence, "the people who understand what this does are already working on it.".
[Verizon Samsung Galaxy S 4] ryanbg:
Just an update, surge and I were doing some reverse engineering yesterday on the new 4.4.2 aboot. We were able to understand the MODE: DEVELOPER mechanism a little better. The problem with reversing pseudo-code/Assembly is that it's essentially a massive web of interconnected processes, with data coming from random places. It's basically a giant maze/puzzle and you have to take notes and trace your progress to find your way back. I definitely found some interesting stuff I will be looking into, but nothing pressing or worth raising a fuss about. Lots to do still, but I'm going to press on, and I know surge is too. The better we understand what's going on, the easier it will be for us to develop a plan of attack.
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
Should we update to the new 4.4.2 or stay on MK2?
[Verizon Samsung Galaxy S 4] Bad Bimr:
I'm still on ME7 just in case
[Verizon Samsung Galaxy S 4] sokrboot:
Me too. Still holding out hope that it'll benefit me somehow. ; -)

Samsung Galaxy S4 "Fort Knox Edition"
[Verizon Samsung Galaxy S 4] michaelg117:
Also wondering this
[Verizon Samsung Galaxy S 4] mhannah3333:
Here are some files from the new 4/25 nc5 ota.. Hope this helps

Aboot- https://www.dropbox.com/s/igx1m33ifg91kpo/aboot.mbn

Rpm- https://www.dropbox.com/s/fhubeiqx3i3coi0/rpm.mbn

Sbl1.mbn- https://www.dropbox.com/s/og877hc132qhezw/sbl1.mbn

Sbl2.mbn- https://www.dropbox.com/s/wbf01x9hcnagbdr/sbl2.mbn

Sbl3.mbn- https://www.dropbox.com/s/g6cpz97w8pdmh78/sbl3.mbn

Tz.mbn- https://www.dropbox.com/s/qb8wpdc85zr2zu0/tz.mbn
[Verizon Samsung Galaxy S 4] decaturbob:
if you care to be rooted or have programs write to extsd csard many suggest not take OTA.
[Verizon Samsung Galaxy S 4] ericerk:
When in doubt, WAIT IT OUT!

There's usually no going back. WAIT until the explicit "GOGOGO"
[Verizon Samsung Galaxy S 4] ryanbg:
So after a day or two of some heavy reversing with a fresh mind and a second look with [MENTION=4939386]Surge1223[/MENTION] , we found some good stuff. I looked deeply into aboot and started looking at the MODE: Developer mechanism. I went through a series of checks and even found the Loki patches, and then I came across the check for Developer Mode.

It looked very simple. A branch link was ran, retrieved a value stored at 0xF9269EC. Then it loads this value into R3 (Register 3) then swaps it into R0 and runs a link return. Next is a CMP R0, #0 comparing the value of the value extracted from 0xF9269EC to the constant 0. If the values are equal, a BEQ (branch if equal), which lead to odin init. If the value was not 0, and perhaps 1, Developer mode could in theory be activated. So what is at this memory address? I knew it's in or near aboot, but this was empty space in aboot. Strange, I thought. Next I fired up viewmem and pointed it to the address we got from before, 0xF9269EC and dumped a small chunk of memory there. This is what I found:

Those asteriks and lines of 00 are protected memory, where this value is stored. I also discovered it's not the only protected value... The next step is to figure out what this is, and how to get access to it.
[Verizon Samsung Galaxy S 4] mike.s:
What makes you think that's protected memory? hexdump shows duplicate info that way. For instance, if I hexdump a text file with only "x" in it, except for a "e" at position 18 and the end, it will skip over the duplicate info and show an asterisk in its place:

xxx:~# hexdump -C foo
00000000 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 |xxxxxxxxxxxxxxxx|
00000010 78 65 78 78 78 78 78 78 78 78 78 78 78 78 78 78 |xexxxxxxxxxxxxxx|
00000020 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 |xxxxxxxxxxxxxxxx|
*
000000b0 78 78 78 78 78 65 |xxxxxe|
000000b6

...from 0x30-0xaf is nothing but "x", just shown as *. It will do the same for any pattern which repeats every 16 bytes. It shows the 0x20 line because it has an "e" in it, it's different than the line above.
[Verizon Samsung Galaxy S 4] ryanbg:
/dev/mem restrictions will also do that and are very common as /dev/men and /dev/kmem are slowly phased out. I've yet to look at the kernel log either, so this is pretty preliminary. I'd be happy to share my work with you thus far if you are interested. I couldn't write to this area either using a variety of methods either. Keep in mind this is for the Note 3 and not the S4 also. If you take a look at your SSD partition and PARAM partition, both of those are empty, yet I've seen various references to them being used. There is some sort of hidden and encrypted volumes being stored if I had to guess. The HLOS applications seem to tell a story of this. Samsung really worked hard on this. Again this is just an educated speculation.
[Verizon Samsung Galaxy S 4] jeboo:
Perhaps you're looking at the DWORD value that controls the reboot action (ie, download, recovery, normal)? If so, it is written to via the kernel.
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
So I didn't have a pass code on my S4 and my little brother thought I would be funny if he trolled me and took the OTA update. Am I screwed?
[Verizon Samsung Galaxy S 4] Kamaole:
Exploits among the bootloader are like a needle in a haystack. While it is definitely not impossible that the structure of a new bootloader could be different and not contain holes that the older ones do, or that samsung could have found existing holes and patched them, I'm going to say that it is likely that exploits that the devs haven't found, haven't been found by samsung. So it's possible that if we do get the bl unlocked, you will still have a chance.
[Verizon Samsung Galaxy S 4] decaturbob:
Most likely..
[Verizon Samsung Galaxy S 4] Brooklynsour:
Squirrels this isn't the place to be posting your questions... You've asked earlier question that's have no relation to this thread please don't take this the wrong way but learn from it....
[Verizon Samsung Galaxy S 4] zmedhaug:
So I decided to be a smart arse and install twrp through goo manager and it forced me to download mode. If there was just a way too bypass this and force boot we'd be able to run recovery.
[Verizon Samsung Galaxy S 4] ryanbg:
Okay so randomly I checked the qFuse region for my device, and it turns out it's a mirror of exactly the region prior posted... What's going on here?
[Verizon Samsung Galaxy S 4] MorrisC2010:
That's still for the note?
[Verizon Samsung Galaxy S 4] ryanbg:
I went back and double-checked this memory address. It most certainly is the DWORD value that controls the reboot action. There are multiple references to it. But why does it check if this value is 0, and if it is 0, why does it skip over MODE: Developer? It can't set Developer Mode at every boot, can it? I need to see some N3/S4 Developer Edition boot logs.