yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] MASTER260:
The Neo 900 looks very, "mod-friendly." Too bad it's not out yet. Also, surely there will always be some way to unlock the bootloader, right? I mean, it's not like something like that will ever be 100% impossible, right?
[Verizon Samsung Galaxy S 4] decaturbob:
Yes... It can be 100% impossible.

blasted by TMO G3
[Verizon Samsung Galaxy S 4] phobia09:
I doubt it will ever be 100% impossible. Even if there's a 99.99% chance a bootloader can't be unlocked, it could still happen. And, for the sake of this community, I hope someone can be a reliable source for these kinds of exploits.

I'll check out this Neo 900, haven't heard about it yet.
[Verizon Samsung Galaxy S 4] tshelby73:
Wish nexus 5 was avaliable on Verizon.
[Verizon Samsung Galaxy S 4] eragon5779:
Me too. It sucks not having easily unlockable phones on Verizon.
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
Would be nice.. I think this device would be even better if able to add some tweaks
[Verizon Samsung Galaxy S 4] Walter.White:
Only if Sammy was this much understanding http://xdaforums.com/lg-g3/general/news-lg-officially-releasing-bootloader-t2841700

SMH
[Verizon Samsung Galaxy S 4] windstrings:
Obama signed an order may have something to do with it.
[Verizon Samsung Galaxy S 4] Walter.White:
Dude. SIM unlock and BL unlock are not the same thing.
[Verizon Samsung Galaxy S 4] Shallow_1:
What order?
[Verizon Samsung Galaxy S 4] windstrings:
http://www.cbsnews.com/news/obama-signs-bill-unlocking-cellphones/
[Verizon Samsung Galaxy S 4] MrGooglesFirst:
That's for using other carriers not bootloader
[Verizon Samsung Galaxy S 4] NighthawkXL:
I saw that earlier, but I think they are celebrating prematurely. The way it's written makes it seem like a canned response. Even if LG is working on it I wouldn't expect it to be ready while the G3 is relevant. As for Samsung, someone should shoot them a letter that their competitor will soon be offering said service. It's worth a shot, though I seriously doubt it will amount to anything.
[Verizon Samsung Galaxy S 4] windstrings:
I thought Samsung sent them to the carriers fully unlocked and it was the carriers that locked them... Not so?
[Verizon Samsung Galaxy S 4] NighthawkXL:
See this is where the term unlocking becomes confusing....

Definition #1 - The process in which a mobile device is "unlocked" to function on another carriers network. For example AT&T --> T-Mobile. Both services must share the same type of radio frequency. i.e GSM, CDMA, AWS, etc. - This was made legal in the United States last week.

Definition #2 - The process that involved unlocking the bootloader of a device so that said device can be fully controlled by the end-user. Usually for purpose of custom recovery, and Android ROM's, though not always. In general, most devices have a locked bootloader for the sake of security. Depending, this may be a device manufacturer's choice, or as a result in the carrier having a security policy which requires it as is the case with Verizon, and AT&T.
[Verizon Samsung Galaxy S 4] scryan:
Yeah, but as such its verizon that is requiring the bootloader locked on the S4, Tmobile users can unlock their bootloader if they don't mind tripping the knox flag right?

Its not like when they choose to offer this unlock they say they might it will apply to the verizon model. That is why they are saying they are working on it depending on carrier restrictions. So they are basically in the same spot as us.
[Verizon Samsung Galaxy S 4] windstrings:
Seems if we can use whoever carrier how does vrzn have the right to demand a locked bootloader ?

When you bring your phone to them from another carrier they have to lock it?
[Verizon Samsung Galaxy S 4] scryan:
They in no way demanded a locked bootloader, there are multiple versions of the phone available and you chose the one with the locked bootloader and a handful of other stipulations in exchange for ~60% off your purchase price.

I did too. I kinda sucks.
[Verizon Samsung Galaxy S 4] DeadlySin9:
T-Mobile users can't unlock their bootloader, it comes unlocked already. Flashing a custom recovery trips Knox but they're free to do so at least.

They can't lock any phone you bring yourself. They just demand that their models ship with locked bootloaders in contracts with the manufacturers.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] windstrings:
True, I guess no one makes you buy their phone.
[Verizon Samsung Galaxy S 4] s44:
Still can get Dev Edition devices, and since no one should be on Verizon without unlimited anyway, the subsidy issue is irrelevant.
[Verizon Samsung Galaxy S 4] tshelby73:
First android phone was DROID X2 second phone was galaxy nexus. Swore I wouldn't get another locked phone after the crappy X2. Let costco guy talk me into keeping my unlimited plan and upgrading to s4 for 50 bucks. FACE PALM.
[Verizon Samsung Galaxy S 4] JLow0214:
Indeed I am also sad about the state of this phone. It's still one of the best phones out there hardware wise Imo, but I will not be purchasing another Sammy or locked phone and I will also be trying to get away from verizon.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] TTLayland:
I agree, while I do believe this may eventually be cracked I still won't be buying another Samsung phone If they intend to never offer a bootloader unlock method ala htc. Shame on the carriers as well this is just getting tiresome.
[Verizon Samsung Galaxy S 4] JLow0214:
About the htc dev unlock, can it still unlock your phone even if its a Verizon bootloader locked HTC phone? IDC if it voids warranty.

Sent from my Nexus 7 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] npjohnson:
Interesting...

I just read a post over at AndroidArea51.com that said that somebody accidentally flashed a TMO PIT File and a TMO ODIN AP, CSC files and it succeeded... and he said that the PIT, AP and CSC Succeeded... theoretically, if we flashed a newer dated version of the TMO BL... wouldn't that allow us to flash the TMO unlocked boot loader? Couldn't we change the model (hardware id) via JTag to the TMO Model?

I know that the BL is not for our device, but for example, a P500, an Enlighten, and an Optimus Slider (All share a gelato board) can all boot off of the Optimus Sliders BL. Is it any different for Samsung devices:?

Just some findings and an idea.
[Verizon Samsung Galaxy S 4] windstrings:
At least my s4 runs like the devil and is stable in the meantime!
[Verizon Samsung Galaxy S 4] npjohnson:
Take it to the HTC forums... not here. And no... but check out the Sunshine project. JCase just added M7 support.
[Verizon Samsung Galaxy S 4] Jraider44:
Just based on previous experiences, I don't think that would work. Definitely worth a try though..
[Verizon Samsung Galaxy S 4] tanishq.dubey:
With JTAG, maybe, but I don't know much about JTAGs and all that. Otherwise, I don't think this will work, since the MD5 (or SHA) hash for the TMO BL will not match the expected VZW BL hash.
[Verizon Samsung Galaxy S 4] npjohnson:
But if our model identifier was TMO, then the VZW hash would have nothing to do with it.

Just an idea.
[Verizon Samsung Galaxy S 4] NighthawkXL:
Still likely wouldn't work from my understanding of the current setup. Since those values are hardcoded by way of a eFuse there isn't a means to change them even with JTAG...

At this rate I think our only option baring some yet-to-be-released exploit would be to physically modify the hardware.., replacing or bypassing specific areas of the motherboard. The problem is I'd say 99%, if not 100% of the users here wouldn't have the know how or tools to do such a complicated task. Even I don't have those sort of toys (or the prowess) unless I where to take it to one of the labs at my college. I've always ponder what would happen if a eFuse was removed (or repaired) inside the Snapdragon (they are microscopic from my research). Perhaps after I replace my S4 I'll let my electrical engineer buddy put it up to a electron microscope.

Basically, everything above is wishful thinking.
[Verizon Samsung Galaxy S 4] linuxtinkerer:
Hi guys (and gals),

On August 8th Dan Rosenberg released the technical details of a TrustZone exploit he discovered for phones running Qualcomm chips. He reports that he successfully unlocked an S4 using this method.

I can't post a link to the PDF because I'm new, but if you Google "Reflections on Trusting TrustZone", his PDF will be one of the first results.

He posted no code in his report, but he laid out how he does it. It should be easily replicatible by the devs here on XDA. :)
[Verizon Samsung Galaxy S 4] RuggedHunter:
Welcome to XDA!! Hope you brought a helmet!

:p

Unfortunately the S4 is not what he unlocked. Check out the last 30 or so posts in this thread. The pdf is posted too.
[Verizon Samsung Galaxy S 4] linuxtinkerer:
Ah, I missed that. Sorry for the repost of content.
[Verizon Samsung Galaxy S 4] RuggedHunter:
No problem. I don't know how much tinkering you do, but there's the start of a revived effort to get kexec running here:

http://xdaforums.com/showthread.php?p=54699297

:beer:
[Verizon Samsung Galaxy S 4] gsciullo17:
Correct me if I'm wrong but I believe that it was stated that this vulnerability was also present in the S4.
[Verizon Samsung Galaxy S 4] DeadlySin9:
Yes, it is present. But the vulnerability itself isn't on the level of unlocking. It let's us write in trustzone, which can bring unlock to some (Moto X) depending on how the bootloader's unlocking function and flags are set.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] gsciullo17:
Oh OK I see. I thought that maybe it would be possible to use this exploit not in the same way but tailor it to the needs of unlocking the S4, as the vulnerability is still present.
[Verizon Samsung Galaxy S 4] SamuriHL:
The S4 bootloader locking mechanism is different. From my incredibly limited understanding of how it works, the bootloader on unlocked Dev Editions, as an example, is signed using a key no one outside of Samsung has and it's NOT done using a QFuse like the Moto and apparently some HTC devices. This idiotic design is also why the Dev Editions haven't received OTA updates. Because each one is using an individually signed bootloader, if it gets overwritten it will lock the device. Again, my understanding of this is limited and I fully accept that I could be wrong about any or all of the details.
[Verizon Samsung Galaxy S 4] Surge1223:
This is correct for the most part...last time we tried to bring attention to this issue, it was quite controversial. See here
[Verizon Samsung Galaxy S 4] SamuriHL:
I don't get how it could be considered controversial, but, there it is nonetheless. If Samsung were smarter, they'd release updated images for the dev editions and then have a website the dev edition owners could go to to enter a code and download the signed bootloader for their device so they could update and re-unlock it. (I know for a fact this can be done as we know someone who's been through a process to get a Dev Edition updated). But no, Samsung is just stupid.

Anyway, I didn't mean to get off on a tangent. But unlocking an S4 is not an easy task as it works completely different than other Qualcomm based devices.
[Verizon Samsung Galaxy S 4] NighthawkXL:
The reason they won't release updates for the S4 Developer Edition is because we'd be able to figure out how they do it, perhaps allowing us to unlock the device.
[Verizon Samsung Galaxy S 4] SamuriHL:
It wouldn't matter if we didn't have the key they used for signing. The process, as I understand it, is that certain information is extracted from the phone into a file. The file is signed with a private key that we do not have, and that signed (encrypted) block is then added to the end of the bootloader. When it loads, it looks for that encrypted signature and determines if it should run in secure mode or not. Without the key, none of that matters.
[Verizon Samsung Galaxy S 4] skepticmisfit:
well isnt that kinda what buying the dev edition is about? being able to unlock the bootloader? maybe i just don't understand, maybe samsung is just evil in so many convoluted ways (actually that second one is true, no buts about it)
[Verizon Samsung Galaxy S 4] SamuriHL:
What he meant was that if they release updates to the Dev Edition, the mechanism for unlocking the bootloader on the Dev Edition could be discovered (in theory) and applied to consumer edition phones.
[Verizon Samsung Galaxy S 4] KaratemanTJ:
In the pseudo code for the Loki writeup on azimuth, he mentions the is_engineering_device() function. Is this what's used on the Dev editions or is it something separate? I'm guessing with JTAG, that value could be modified for a single boot sequence. I'm not sure that's incredibly helpful, but changing a bit seems like it should be easier than say arbitrary code execution during boot. Am I totally off track?
[Verizon Samsung Galaxy S 4] gsciullo17:
Are we attempting to unlock the MK2 boot loader or NC5? Or if we find an exploit will it work for both?
[Verizon Samsung Galaxy S 4] joefrog1996:
They use different bootloaders, however if there is a exploit found on MDK it is possible it exists in NC5. However there's a good chance that if there was an exploit Samsung knew about it first and patched it for NC5. Odds are not looking good for us
[Verizon Samsung Galaxy S 4] ahmed.zubair:
Have Anyone seen this http://www.droid-life.com/2014/08/07/moto-x-bootloader-unlock-qualcomm /
[Verizon Samsung Galaxy S 4] aidankiller4:
That was using the exploit Dan Rosenberg demoed, and has been said time and time again not to work for the S4 in unlocking its boot loader.
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
It was said most samsung devices
[Verizon Samsung Galaxy S 4] Surge1223:
Sorry about another long post, but its relavent for people who want to get an idea of where were at. Green is what sucks, but is still encouraging. Everything highlighted in red is just errors, I did that so people could see what errors are possible. If you think I should leave more out of this post than I did (I did erase some obviously) let me know. Hopefully this can help enlighten us.
[Verizon Samsung Galaxy S 4] jeboo:
Did you get your phone unbricked? If not, send me a PM.
[Verizon Samsung Galaxy S 4] scryan:
lol, maybe my ignorance makes me overly optimistic, maybe I just equate updates with progress :P

But honestly man this thread/your work seems to me like it has the most potential out of anything I have seen being done with the S4, including safestrap which I love/use but don't ultimately think is anywhere near the ideal answer....

Post as long as you want, my only complaint is I can't understand it well enough to help :(

Hell, unfortunately I don't always even know what the logs you post are being generated by.

Outside of simplistic Q/visual basic stuff my programing is non-existant and I know nothing of security.

Been reading my ass off the past couple weeks though, and maybe I'll have something for you in a year or two.

Most resources I can find though are either crazy rudimentary or crazy in depth though, hard to find in between stuff... Though I have at least been reading the linux bible to become acquainted with linux at least.

I was posting to say though:

Have you tried or had any success getting in contact with h311sdr0id? I know he can't exactly spend much time at a computer, and may have

enough other issues that he doesn't care about getting the S4 hacked (from what little I have heard that would be understandable)

However I just noticed his signature, and I think its a recent change. Perhaps his wifes idea and not his, but it reads to me like he is still interested in the community.

I know what he had said he could do was what inspired this avenue, and I know you were looking to talk to him... just didn't know if there was success. For what its worth everyone I've ever known who has been in prison really liked getting letters, maybe he could be a pen pal :D

Just a thought, in case you were trying to get ahold of him but gave up due to not having a way...
[Verizon Samsung Galaxy S 4] mmseng:
I have almost no idea what most of you guys are talking about, but this thread is fascinating and I'm rooting for guys, double entendre intended, pun not intended.

I'll go in the corner now.
[Verizon Samsung Galaxy S 4] Surge1223:
Truthfully, if I had used his rom or talked to him at all beforehand I mightve contacted him. I dont know him though, but seems hes got enough on his plate as is. Even if we did contact him, what if he gave us bad news? Where would our motivation be then?

P.S. Everything slows down and starts reading like a story as you learn more about Linux, Arm architecture, C, python, perl...etc. Eventually random code becomes structured data...Order out of chaos.
[Verizon Samsung Galaxy S 4] kalestew:
X iPhone dev here and this is totally true, it is not as daunting as it seems.
[Verizon Samsung Galaxy S 4] KaratemanTJ:
Something like pastebin.com might make this a bit tidier when posting logs. Maybe pull a few key points out or something? Just a thought.
[Verizon Samsung Galaxy S 4] Surge1223:
I guess every line is a key point to me, but point taken lol. Ive been working on revising the OP and removing/reorganizing relevant data into it, theres just a lot of info (not counting logs) like what some ideas are etc. Ill remove a lot of the irrelevant stuff though.
[Verizon Samsung Galaxy S 4] ryanbg:
ERROR: Image Invalid, X509_Certificate is NULL!

So you overwrote the signing certificate? That's interesting.
[Verizon Samsung Galaxy S 4] KaratemanTJ:
So I've been on the lookout for an S4 w/ a busted screen or similar that I could hack into and hopefully add something useful to this thread. I've only been looking at the VZW models, but would the ATT ones be close enough? I'm not really sure of the exact differences where the bootloader, etc. are concerned. Any thoughts? Thanks!
[Verizon Samsung Galaxy S 4] Surge1223:
Thats interesting, wish I really could enable developer mode

why even include this potential error...does that mean theres actually a way to disable it?

interesting

The most interesting. Im going to try to do a T-Flash tonight. ill report back later
[Verizon Samsung Galaxy S 4] jhasty01:
Great work, keep it up!

However....couldn't this thread possibly be more useful in the developers forum?
[Verizon Samsung Galaxy S 4] phobia09:
Not exactly sure how similar they are as far as the bootloader, etc. but they should be nearly identical. After all, SafeStrap and Loki were similarly implemented on each.
[Verizon Samsung Galaxy S 4] Surge1223:
I havent looked at AT&T's either. But a lot of this stuff is OEM signed, though any vulnerabilities would likely effect both.

Anyways, I extracted two hex files from the S4. It was a involved process but for all I know these both could already be on the S4 and I just didnt know about them. Are they any accessable hex files on the phone anyone knows of? Would be amazing if they were our OEM specific 8064 hex and flash programmer. Highly doubt Samsung left those on the device though. Ill post the two hex files later.
[Verizon Samsung Galaxy S 4] Surge1223:
Did some fact checking on the hex files, then converted them to bin and decided to take a deeper look. When looking at the bin files then, both files contain this:

QUALCOMM N2850-1 TMA340 Firmware Identification Block
Version 09.02.00 Compiled Nov 16 2011 13:59:01
End of ID Block

The hex files are from /etc/firmware/cyttsp_8064_mtp.hex & cyttsp_8960_cdo.hex. Nevermind not important
[Verizon Samsung Galaxy S 4] jeboo:
The ATT/VZW bootloaders are nearly identical, so you could go with either.
[Verizon Samsung Galaxy S 4] hovax615@hotmail.com:
http://xdaforums.com/showthread.php?t=2550120

Do you think we can run this? I know it'll probably be only tw based Roms but hey its a start.
[Verizon Samsung Galaxy S 4] kalestew:
That's the same sort of thing as safe strap
[Verizon Samsung Galaxy S 4] Surge1223:
FWIW, we've known we could do this for awhile its just risky.
[Verizon Samsung Galaxy S 4] SamuriHL:
No, it was said most Samsung devices are vulnerable to the TZ exploit, NOT that you could use it to unlock the bootloader.
[Verizon Samsung Galaxy S 4] skepticmisfit:
next person who mentions dan's tz exploit... i swear im probably gonna break something.. haha
[Verizon Samsung Galaxy S 4] anthonyg45157:
Must be a fellow long time follower of this thread. I have been as well. I understand your pain LOL. Every time I see a post about something new my hopes get lifted and dropped flat on their face quickly.

P.s. Keep up the great fight DEVS!

Kinda reminds me of 300 Spartans vs those Persians lol
[Verizon Samsung Galaxy S 4] joefrog1996:
You know, the 300 Spartans never unlocked their bootloader xD
[Verizon Samsung Galaxy S 4] SamuriHL:
They sure gave it their all though. LMAO
[Verizon Samsung Galaxy S 4] robygt:
This is blasphemy! This is madness!

This is SAAMSUUUUNG!
[Verizon Samsung Galaxy S 4] skepticmisfit:
ok i dont think we're getting serious about unlocking the bootloader...

i probably shouldn't even post in this thread i can't code to save my life let alone do ROM development or bootloader unlocking of The Impossible Verizon Samsung GS4.

---------- Post added at 08:40 PM ---------- Previous post was at 08:33 PM ----------

actually quick question: what are the advantages of older bootloaders (me7, mk2, etc) over nc5 bootloader? i didnt have a choice but i'm kinda curious, i got a phone that was OTA'd to NC5 and probably had mdk at one point :crying: but of course it was in the hands of.. a non-xda user to say the least lol
[Verizon Samsung Galaxy S 4] SamuriHL:
Older builds are more compatible with safestrap...which at the moment has no development going on.
[Verizon Samsung Galaxy S 4] skepticmisfit:
Yeah, I saw hashcodes g+ post. For those who don't know he got a job with Linaro and he's dropping support for all of his Android projects. This includes safestrap.

For the moment at least. Who knows, I wish the man success with this endeavor.

For us, SafeStrap is open source. Someone here can update it potentially..
[Verizon Samsung Galaxy S 4] travisjshepherd:
So we get told a great device, with top notch specs, can not have the bootloader unlocked which stops development there. And now the only person who was willing to help moved on? I can't stand being stuck on a stale device for another year!
[Verizon Samsung Galaxy S 4] SamuriHL:
Two things. But I must first give a disclaimer that I don't want to give false hope so please understand what I'm about to say, while factual, is not intended to suggest anything is imminent.

Now, on the bootloader issue. No one is saying it can't be unlocked. They are saying it can't be unlocked through the trustzone. That's because the locking mechanism is different than other phones. I. E. Moto. This is not to say that a bootloader unlock will ever happen, only that it's still technically possible that someone may work out an exploit for it at some point.

As for SafeStrap, it is open source and the hope is that some interested person picks up development for it. Making it truly compatible with nc5 would be a first good step... Opening up a variety of 4.4.x based roms. The community needs to find someone with the skills to take up the mantle. Perhaps, like with root, a bounty could be established to increase interest. Only a suggestion to try to get things moving along.
[Verizon Samsung Galaxy S 4] travisjshepherd:
Well, that does put my mind somewhat at ease, and I would love to be the one who picks up the torch for safestrap, but I'm barely qualified to have it on my device. It's just frustrating coming from a Dev device like the gnex to something you can hardly customize. I just know the track record for devices over 18 months old and I don't want to be stuck on let's say 4.4.2 for another 12 months when my contract is up.