yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] ky5ever:
Haha. Verizon decided to remove the feature of controlling and managing your Network Extender to allow only certain devices and manage what devices could do and not do when connected. They made them always public, all the time. So any stranger with a Verizon phone that drives by my house can suck up my internet bandwidth and I cant do a damn thing about it, sans unplugging the unit, but that also makes me lose signal, too.

Oh, Big Red. Get the stick out of your arse.

So, essentially, I was able to get my device to open itself up and recognize a "fake OTA" by using the debug port on the back of the device to load up a freshly cooked update package built off MDK and storing it in the extender's own update cache, but it would not download it. And that, my friends, is because Verizon snoops and makes sure all calls, text, and data is Verizon approved. Only Verizon phones can use a Verizon network extender. And only the latest signed-by-Verizon updates can be pushed out from a network extender.

Its like fighting Apple all over again.

Im really sorry nothing major came up out of this, but Im still going to dig through some other dirt and see what I could come up with.

Oh. And you. [MENTION=4933044]zmedhaug[/MENTION]. No one is trying to be a "cop." What [MENTION=4729046]Brooklynsour[/MENTION] is saying is, if the moderators themselves dont like people like you filling the thread with stuff that doesnt help the devs, they will simply close it. And all of the progress will be halted, and we will have to start a whole new thread, if we even do.

Why do you think the developer threads say developers only? This thread may not be in the dev only section, but that is because it was meant for anyone who could contribute could help. Take [MENTION=5662899]Blahness[/MENTION]. He made his account brand new to contribute to this thread. Had this thread been in the dev only section, he would have to show his worth somehow before he could post there.

Sorry, to the mods, and to the devs working ever-so-diligently, for this long post. I just figured if someone laid it all out on the table, maybe, just maybe, this time, people would get the message.

Anyone who wants to help me find an exploit in the Network Extenders, please feel free to PM me. (thanks [MENTION=2854160]sokrboot[/MENTION])
[Verizon Samsung Galaxy S 4] zmedhaug:
As I stated before I hard bricked my phone. But while doing so I was able to boot into a custom recovery on MJ7 with no safestrap. Problem is I boot looped. So I am trying to help you exploit this but theses dummies are more concerned with me talking and when I can talk. So you can put your foot in your mouth for a little while, while I ask questions and give suggestions. I later lost my eri version. Could never get it back. Where i got stuck was a way to open the aboot.mbn file and find out why I was boot looping. So please continue to be a pig and police myself. I really need you cops.
[Verizon Samsung Galaxy S 4] NighthawkXL:
Well, that's definitely what I'd consider progress... indirect progress that is. But it may very well be easier to find a exploit inside the extender then one inside the actual S4 itself. At least it opens up a new avenue of R&D for us to toy with. I take it you shared your method with the devs via PM or something along the lines? Also, if the extender can be exploited to do what we need it to do to our device, there isn't any reason I see that it shouldn't be able to be used with other phones in similar situations wouldn't that be correct?
[Verizon Samsung Galaxy S 4] ky5ever:
I didnt think anyone was going to mess with network extenders except me. Theres risks involved, and messing with a network extender to get free minutes (which can be done, again according to the digitaltrends article) can result in your phone and extender being permanently disabled.

I have several phones and routers and even have three extenders, as well as plenty of local nerds that are helping me out with this. sokrboot also offered to help with confirming tests and giving me info. If anyone wants info on what I did, Ill tell them, but so far I have not told anyone except sokrboot, and that is because of the heavy risks involved. The S4 Im using to connect has a busted screen (still works) and the volume buttons dont work (can get into the different modes using adb/modded reboot menu so its all good). I am willing to risk that phone being disabled.

As for this exploit working with other phones, yes, theoretically. This exploit, if found, would involve tricking the phone into thinking theres something new from Verizon. Backup Assistant contacts and VZW Messenger texts, as well as visual voicemail, all require a data connection to operate. WiFi will not work. It is that system I am trying to abuse. Someone in this thread suggested exploiting the baseband, as it has priority over what gets installed, and apparently is almost always trusted (can someone confirm how much authority the baseband has over system software, if any?)

Anyone who has a femtocell, either of the two Samsung models, please message me if you want to know how to get inside of the femtocell as root. Its lengthy, but Ill make a separate post/thread if enough people want it.
[Verizon Samsung Galaxy S 4] Surge1223:
Baseband is complicated because theres a small portion of it thats only "visible" to the TrustZone, ill link the documentation when I find it, but as far as exploiting the baseband, we'd still need to be able to manipulate the part thats only available in the TrustZone's "Secure World" because thats the only part of the baseband that has high enough privileges to make a difference. You can probably see why im so adament about figuring out a way to exploit the TZ now.
[Verizon Samsung Galaxy S 4] Surge1223:
So we need to find a way to intentionally reset the P flag from P1 to P0, you said this is what enabled your device to show "SECURE BOOT: NONE" correct? If we can get secure boot to say none again then I have a battery of ideas/tests we can do from there. Some of the more enticing ideas would be using raw ELF files (I have RPM and SBL2 in raw ELF form---don't ask how I got them) or other proprietary files we currently have access to. Remember RPM employs QFPROM. This might *might* allow us to circumvent the bootchain and put our own in place. Obviously this a rough idea that needs to be way more fine grained before it can be implemented.

Also to avoid confusion, when we say "SECURE BOOT: NONE" this is only referring to the Qualcomm side of things (dbl.mbn, amss.mbn, APPSBL, OSBL, etc) some of those correspond to Samsung bootloaders, others do not. Getting "SECURE BOOT: NONE" to display doesn't mean we've bypassed the security checks, it just opens more doors for us to test more ideas.
[Verizon Samsung Galaxy S 4] ryanbg:
Yes. We need to figure out what the P flag stands for. It looks like aboot checks VERY early in the boot process for these flags. If we can get secure boot off, it'll open up a lot of doors for us. I'd like to reiterate for everyone reading this, please do not PM us for anything unless you have technical information or a technical idea. I get LOTS of PMs asking about progress, simple ideas that won't work, and etc... My inbox gets clogged fast and I'm sure surge's does too. We do this to keep you guys in the loop, so please be patient with us! If we all of the sudden figured it out, you guys would know within 24 hours of it happening. We are getting very close now.
[Verizon Samsung Galaxy S 4] ryanbg:
Sorry for size. Theory is debunked. P0 does not seem to affect SECURE BOOT, and I don't know how I got P0. Hmm... This does however prove my software fuse theory. I was originally P1.

UPDATE: P flag is linked to SBL1.
[Verizon Samsung Galaxy S 4] DigitalMD:
Good luck to those that are trying, but I think your correct. The Verizon Droid X2 got a locked bootloader and some of the best tried for a very long time and it was never cracked. The safestrap method may be the best you can hope for.
[Verizon Samsung Galaxy S 4] Gillion:
Do you know what P0 or P1 tell the user about the device state ?

What does it do ?
[Verizon Samsung Galaxy S 4] Surge1223:
We used to think it determined the secure boot status but that was just proven false. Now its back to the TZ for me.
[Verizon Samsung Galaxy S 4] ryanbg:
I'm not sure yet. I don't really know. I know these values are read from QFPROM, at least I think so. So I'm not sure how it works, or what P stands for yet. Still digging.
[Verizon Samsung Galaxy S 4] LiLPurP:
Im not very smart with all this stuff but had a rooted gs3 for a year, im so dissapointed that my gs4 was on the 4.3 update out of the box :( i offer my support in any way i can as im dreaming for this to happen, thank you to all the devs working hard for the freedom to allow users to modify a device that we paid for and own :) thank you!!!

Using:AT&T Samsung GS4 4.3 Rooted with SafeStrap Recovery
[Verizon Samsung Galaxy S 4] JLow0214:
Just a thought cant you rainbow table sha256 hashes or only md4

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] vt0r:
Negative.

Not only would SHA256 rainbow tables take X years to generate (where X = several thousand), but they would likely require petabytes of data just to store.

I doubt any of us have the computing power of the entire earth at our fingertips, nor do any of us have a huge empty SAN, so as has been mentioned before, brute forcing will never be an option during the life of this phone.
[Verizon Samsung Galaxy S 4] pingpong1109:
Oh I am not supposed to have the power of the world's computer's at my finger tips? But I have wondered why can we just make a new bootloader? I know that we probably don't know the architecture of the chip.
[Verizon Samsung Galaxy S 4] xxtoxicravenxx:
The new bootloader would not have the signature key. Meaning itd fail loading
[Verizon Samsung Galaxy S 4] gnubian:
Dude. Just stop. You obviously haven't read any of this thread and have no idea how bootloader/samsung/knox security works. Just don't post in here. How many times does this have to be said before people will stop.
[Verizon Samsung Galaxy S 4] MehStrongBadMeh:
Infinity. There will always be dumb posts like that. Just accept it and realize that such posts doesn't really have any negative impact on Surge1223, jeboo, and ryanbg's work.
[Verizon Samsung Galaxy S 4] Droidmissionary:
This isn't just to single you two out. There's serval. This will be my one and only post in here. Period. I agree these posts need to stop but each time one is made, three+ people respond to it. So one ignorant post turns into 4 unnecessary, worthless posts, which is then half a page of nonsense. Until you all can control your ability to respond to trolls that don't help, you're no better. Their one comment can be ignored and will be worked over and around as it never existed. Half a page however becomes an issue. Please explain to them in PM to leave the thread alone (yes, I broke this request, but it was for everyone to see). Please allow this epic event to continue and leave the dumb posts alone. They will eventually fade. This also goes to people saying how dumb they are and just want to say thanks. Save the post and click the Thanks button. It's understood.
[Verizon Samsung Galaxy S 4] studiorat:
4 months on this crap update and nobody has found any way to exploit the Bootloader I find this hard to digest, especially after people offering a substantial bounty, I am not a dev, but I know Others Companies have locked the B/L a long while ago and within a month we were exploited and happily rooting and Modding up a storm, I cant fathom dealing with this stock POS
[Verizon Samsung Galaxy S 4] Skeetch79:
Bounties do not buy unlocked bootloaders. Just because you raise money doesn't mean the bootloader will magically become unlocked. If you purchase a locked bootloader phone with the expectation that the bootloader will become unlocked I feel very sorry for you. If you wanted the guarantees of an unlocked bootloader then you should have purchased a developer phone.
[Verizon Samsung Galaxy S 4] Joe Antonetti:
I'm going to bump my bounty up to $30.

As for the comment two posts above me, if you feel that it is so hard to fathom that the BL is still locked after four months, unlock it for us and show us how easy it is. I'll double my bounty if you personally do it.
[Verizon Samsung Galaxy S 4] tech_head:
You do realize that the difference between this and other bootloaders, is this one was meant never to be compromised?

General Dynamics, Samsung and the NSA worked on locking it down for secure environments.

Each release closed the holes of the previous release until we have what we have.
[Verizon Samsung Galaxy S 4] ryanbg:
While true, their logic is still vulnerable to human error.
[Verizon Samsung Galaxy S 4] cyrushehe:
Money didn't cure aids, money influenced people to research a cure for aids over years. Money was also used to pay people to make an uncompromisable bootloader.
[Verizon Samsung Galaxy S 4] tshelby73:
I have accepted this phone won't be unlocked. As long as I have root and tether that's enough for me till nexus phone is available on Verizon or I switch carriers.
[Verizon Samsung Galaxy S 4] Brooklynsour:
[MENTION=4390046]tshelby73[/MENTION] gtfo this thread then..buncha jerkoffs posting irrelevant bull**** ^^^^
[Verizon Samsung Galaxy S 4] LiLPurP:
So ive been reading that djrbliss unlocked both the att and the verizon bootloaders, was it a hoax or has any other devs here comunicated with him about this?

Using:AT&T Samsung GS4 4.3 Rooted with SafeStrap Recovery
[Verizon Samsung Galaxy S 4] tommydrum:
Edited short null post that may or may not be deleted. Disregard me.
[Verizon Samsung Galaxy S 4] tshelby73:
+1
[Verizon Samsung Galaxy S 4] BladeRunner:
Where have you been reading this? He created the Loki bypass for the "older" bootloaders, but, afaik he is "retired"
[Verizon Samsung Galaxy S 4] scryan:
After Loki was patched, he would not even help get root. He just talked **** about S4 owners being too dumb to figure out something so obvious. I could see where after a while you could get fed up... And in all honesty i know very little about him, but just from what I have seen looking up info on Loki and what not, that dude is a ****.
[Verizon Samsung Galaxy S 4] Skeetch79:
He has done some amazing stuff for the Android community and has given more than his fair share of time and effort. He could have just let others waste their time, but instead he gave up his. "****" is the furthest thing than what would describe him. Do some research and learn about someone before you criticize them. Just because he may not have aided in your cause does not mean he is worthless.
[Verizon Samsung Galaxy S 4] Gillion:
So is ours.

We keep looking for mistakes what if there is none... Then what ?

We too are vulnerable to human error in how we look at and understand the code... while working in the dark.
[Verizon Samsung Galaxy S 4] Mistertac:
This thread has been spiriling out of control lately. Let's just let surge and the others get back to sharing their work here

Sent From My Verizon S4
[Verizon Samsung Galaxy S 4] pyroman512:
Skeetch I totally agree with you. I think it is unfair how he was treated by the community for his contributions. It's depressing because we could sure use his help. I don't blame him at all for not wanting to help with the S4 anymore..

And to my main point.. Surge can you try to update the OP more? I check this thread everyday and care about the work you and the other are doing.. it would be nice if we could keep up to date with the progress instead of sifting through all this bs as of late. I really appreciate everything you all have been doing.
[Verizon Samsung Galaxy S 4] Mistertac:
I think the only reason the moderators haven't been tougher on the random rants going on in here is because they don't want to see the progress made in here lost. Could use a ton of cleaning up though. At this point I'm sure surge and everyone else in here are just communicating through pm. Ah well...I also realize I'm now adding to the rants lol good luck everyone!

Sent From My Verizon S4
[Verizon Samsung Galaxy S 4] Surge1223:
Cripes, we used to self-police well enough in here, lately thats not the case. Lets get our crap together before we lose this thread. Everyone here is smart enough to know if their post is useful or not, grow up people. We're giving this all the we've got, be patient. Other devs and I are in constant communication, not by pm but mostly through other means. Listen I know some of you may be frustrated with my lack of posting new info but just know that there are watching eyes on this thread that we don't want. Take the OYUAMDK thread I posted in original development, Samsung knows about that thread and I know that for a fact. I went to Best Buy and asked a Samsung rep (in the Samsung dept/area) how dev edition devices could get updates and the guy had no idea who I was but I started talking to him and he casually got more friendly and told me "Hey listen, I know theres no official dev stock images but check the XDA threads" then told me exactly where to check and said Samsung doesn't officially give dev device updates but knows they can be made/extracted, he said "someone already extracted it for the S4" so he essentially directed me to my own thread without knowing who I was. So theres a reason some stuff isn't posted here, please understand that. Also some of you are worried since there are no updates on kexec, I can confirm its being worked on.

TLDR - Hold your horses

Edit: Also we're working on some stuff today, I'll post an update tonight.
[Verizon Samsung Galaxy S 4] decaturbob:
Exactly...why do people who know nothing about security and Linux and s4 want to pipe into this thread is beyond me . I hope surge and his fellow devs just ignore this thread and talk among themselves.
[Verizon Samsung Galaxy S 4] Blahness:
It could also be that they don't feel responsible to give updates to developer devices. It costs money to support something like that. Even if it's "easy and simple", big corporations are very nit picky about who works on what for how long. And then if there's meetings discussing updates, then they have to pay everyone to have that meeting. They could simply have come to the conclusion "dev's have an open phone and they got it knowing it's a developer phone; they should be smart enough to update it themselves" or "the purpose of a dev phone isn't to use it as a retail device but a dev one; they don't need firmware updates to accomplish this".

Food for thought.
[Verizon Samsung Galaxy S 4] Surge1223:
They can't update from 4.2.2 to 4.3 via any Samsung Official means. They also cant use Samsung 4.3 kernels on their device as a by-product of being unable to upgrade their 4.2.2 aboot.mbn partition since aboot calls rpm to verify the integrity of the boot.img prior to boot. Even if the boot.img is signed properly and is a stock factory kernel provided from Samsung they can't boot Android using it as of yet afaik. This could be proven false but we know they wont release dev updates for other reasons.

Still going to update this thread with progress being made tonight but it'll prob be more like early morning
[Verizon Samsung Galaxy S 4] sokrboot:
For those of you who think that the NSA and Samsung *aren't* serious about a secure device...you are mistaken. This is just a taste of what kind of resources the NSA has...

http://m.spiegel.de/international/world/a-940994.html#spRedirectedFrom=www&referrrer=

sent from my VZW S4 w unlocked ME7 bootloader
[Verizon Samsung Galaxy S 4] Surge1223:
[MENTION=2854160]sokrboot[/MENTION] - The below is not directed toward you, just a preemptive post to everyone.

I agree they have resources beyond our grasp but lets not start that debate/discussion on that. Instead we should try to focus on using the anger/stress/anxiety/sadness...whatever emotion NSA security elicits in you to help unlock this damn bootloader.

If it really riles you up then research how knox works and post all you learn (unless it doesnt help us at all, I mean if you're going post something like -- "Maybe I think knox bootloader is blocking us from flashing aboot to the bootloader, we should try to flash pre knox bootloader then write new aboot!..Who wants to test?" Then don't post...or procreate for that matter)

If other people being mad irritates you then help research knox and the security implementation it uses like TIMA trusted boot and prove to everyone its not so bad instead of posting an antagonizing comment that will contribute to absolutley nothing.

Of course the ideal situation would be if we exploited the TZ and used the SMC call that normally sets the warranty void bit "Knox flag" and instead made it unlock the bootloader by setting the SECURE BOOT: value to disabled, while also reporting to aboot that the boot.img is not tampered. This dream scenario would allow us to boot a custom kernel and permanently unlock the S4/Note 3 all while ruining the integrity of Knox, embarrassing/pissing off the dumbassery that is Samsung, VZW and AT&T. Talk about revenge being a dish best served cold...lol
[Verizon Samsung Galaxy S 4] Mistertac:
+1 on the do not procreate part

Sent From My Verizon S4
[Verizon Samsung Galaxy S 4] JCBiznatch:
Just ordered riff box and jtag. This should be a fun vacation next week. Let the down grading begin.
[Verizon Samsung Galaxy S 4] Surge1223:
I have a plan. Had to write it on paper because I don't think linearly I tend to jump between thoughts that I like to keep seperated more spacialy then by separating via the enter key. Plus Im a math guy so I use pen and paper all the time, of course a ti-89 helps lol.

I need a copy of a dev MJ7 aboot.mbn to compare/comfirm with. But I think I have a working theory on how the differences between dev and retail aboots are generated.
[Verizon Samsung Galaxy S 4] JLow0214:
I was thinking of doing this also..... just dont know what i would really use it for afterwards.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Skeetch79:
I should have what you're looking for just give me this until this afternoon to get it to you.

Would dev MK2 aboot work too?

---------- Post added at 01:31 PM ---------- Previous post was at 01:16 PM ----------

Pm sent with link to dev mk2 aboot.mbn
[Verizon Samsung Galaxy S 4] Surge1223:
Well then I would need two dev MK2 aboot.mbns. I need two of either dev MJ7 or MK2 but since I already have one dev MJ7 aboot I thought itd be easier to get the second instead of asking two diff people for MK2
[Verizon Samsung Galaxy S 4] D0CTOR:
[MENTION=4939386]Surge1223[/MENTION] I stumbled on this link today. I thought that maybe it could be of some help to you and the boys...
[Verizon Samsung Galaxy S 4] scryan:
While the effort is appreciated, check out the date on the article, and the author....

Everyone is very familiar with the Loki exploit, but it was patched with ME7.
[Verizon Samsung Galaxy S 4] Skeetch79:
I have my aboot.mbn from mj7 at home. I am on the road right now but when I get home I can surely uploaded and share the link with you.
[Verizon Samsung Galaxy S 4] D0CTOR:
I know that Dan discovered this awhile ago (I'm on MDK) but you just never know what you can learn from his writings since he's not doing it any more.
[Verizon Samsung Galaxy S 4] zmedhaug:
You cannot jtag back either. I tried, it fails.
[Verizon Samsung Galaxy S 4] gnubian:
I'm pretty sure he has read over the work, and it doesn't help us.

As far as jtag, apparently hellsdroid knows a way that works (old news)