yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] DeadlySin9:
"... including a live demonstration of using it to permanently unlock the bootloader of a major Android phone."

Info on the blackhat listing, that's the key line that captured most of our attention in the first place.

Link from before: https://www.blackhat.com/us-14/briefings.html#reflections-on-trusting-trustzone

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] SamuriHL:
Which in no way contradicts what I said at all. Demonstrating != releasing.
[Verizon Samsung Galaxy S 4] DeadlySin9:
My bad, I misread your original post. Well you'd figure he'd give enough information for it to be recreated even if he won't give it out himself.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] SamuriHL:
Definitely interested in seeing the details of what he demos. He's an awesome guy.
[Verizon Samsung Galaxy S 4] ryanbg:
I haven't given an update in quite a while, but that doesn't mean I haven't been working on it. I've made some rather promising discoveries and progress, with assistance and advice from an excellent group of people. I won't be giving many details or information about this one quite yet, but I'll give you an idea of what I'm working on.

I was able to manually set the CC mode flag on Odin. This is of no use to us, but was a proof of concept that I can change some flags. I am able to set and unset this flag. CC mode is 'Common Criteria' mode and is a standard of security for sensitive environments like government and corporations. It's apart of the Knox suite. I hope you guys can continue to be patient, but I am excited to see Dan Rosenberg's presentation on TrustZone. I've also made some progress in TrustZone, but nothing I feel is significant yet.
[Verizon Samsung Galaxy S 4] lithium630:
Really? I don't care for this phone at all. The battery life is terrible (now thanks to the android update) and there is way too much bloat. I can't wait for someone to figure out how to unlock the bootloader.
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
What other Major andriod phone is out there with a locked bootloader? I thought samsung was pretty much the only guy doing it. (just a noob question!)
[Verizon Samsung Galaxy S 4] joshm.1219:
S5, note 3, HTC one m8 depending on firmware I believe, lg g3.... I think those are the only ones I would consider flagship.

It is almost definitely a Samsung device, only company that sells enough phones for this demo to be as big a deal as it has become.
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
aw man.. I really hope Dan helps us s4 users out! And maybe if he unlocks another phone, hopefully it can be used to unlock the s4!
[Verizon Samsung Galaxy S 4] SamuriHL:
LOL. Pretty much every carrier based phone in existence is bootloader locked. Only the Dev Editions, Google Play Editions, and Nexus devices are officially unlockable. The HTC phones have sunshine. The motorola phones appear to have some "china middleman" nonsense where you pay some guy in China and he sends you an unlock code. But Dan has unlocked Moto phones before using the trusted zone. In fact, Moto "accidentally" pushed out the vulnerable version of the TZ partition in the 4.4.2 update to those very same phones. It's likely that it's Samsung based, but, it's not guaranteed. Until we see what he demos, no one knows for sure what he's been up to except him.
[Verizon Samsung Galaxy S 4] joshm.1219:
Even if it's for another Samsung device, it can only help out devs understand our bootloader better.
[Verizon Samsung Galaxy S 4] windstrings:
But why does the bootloader need to be unlocked to remove all the bloat and excess services?

Just an honest question.

I have no desire to change carriers and it's even more stable now than it was with the bloat!... It never crashes or hangs.

If they unlocked it tomorrow I wouldn't change a thing unless I could totally back this up and just play...
[Verizon Samsung Galaxy S 4] DeadlySin9:
It doesn't necessarily to remove that, but it can help make it easier to do so. You might be fine and stable on stock, but others aren't, and Touchwiz isn't the nice clean feeling of AOSP with quicktiles and other things and less UI lag for some. These one-experience-for-all locked systems don't work for all.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] Surge1223:
I have been quite busy lately, but thought id comment about the idea of having an unlocked bootloader and what benefits it allows. This is something most should already be familiar with and for the most part is different for every individual (with most probably citing AOSP roms as their reason)

For me personally, I enjoy modifying and compiling my own kernel, then using it..something I cant do with this device. If we're hoping for anything from dans exploit, its that the device hes using is a Qualcomm variant. I personally dont think its a Samsung device though.
[Verizon Samsung Galaxy S 4] eragon5779:
You are giving me hope. I know the S5 is newer than the S4, and that you have had to put up with it longer, but I miss AOSP. Unfortunately, I have no idea what I am doing. Otherwise I would try and help you figure it out for S5 too.
[Verizon Samsung Galaxy S 4] SamuriHL:
I'll weigh in on the unlocked bootloader benefit discussion. Root. You all like it. You all seem to forget how difficult it is to get an exploit every time a new build comes out. The latest vzw s5 build, for example, shuts the door on towel root. Unlocked bootloaders allow you to always root without an exploit. So even if you don't care about flashing roms, I know most of you want root.
[Verizon Samsung Galaxy S 4] MASTER260:
EDIT: nvm.
[Verizon Samsung Galaxy S 4] windstrings:
Well I never thought I would root either until it became so easy, if I get the opportunity to unlock the bootloader I probably will, but I know so little still right now, as soon as I feel confident I may load a ROM someday but just weighing cost versus benefits...... no reason to take a bunch of risk and hassle if things are totally stable and better than I thought they could ever be!
[Verizon Samsung Galaxy S 4] ryanbg:
Fortunately for you, we've discovered this is somewhat universal. I setup beans with the proper information, and he was able to replicate this on his S5. I have a Note 3, which it worked on originally, and surge should be able to get it going on the S4.
[Verizon Samsung Galaxy S 4] tanishq.dubey:
I would just like to say that "Black Hat USA" isn't just a 'black hat hacker' conference. In fact, it is one of the foremost security conferences in the world, and even reps from the Pentagon attend (Just look at the sponsor list: https://www.blackhat.com/us-14/event-sponsors.html, and yes you did read that correctly, Verizon is part of the sponsors). The reason Dan is releasing his exploit here is probably because of the audience size he has, in addition to picking up some 'hacker street cred' in front of major corporations.

Also, don't think that PCs have complete freedom. Just look at UEFI Secure Boot (http://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_boot) which can essentially be used for controlling hardware changes, OS changes, driver changes, ect. Windows 8 RT tablets already come with this functionality, and plans are to expand this to other systems as well (Windows 8.1 VL edition already has this built in). In fact, Microsoft states it as such

(Source: http://support.microsoft.com/kb/2800988)
[Verizon Samsung Galaxy S 4] SamuriHL:
Did you just say that Dan's looking for "hacker street cred"?? LMAO! I take it you don't know who he works for? :)
[Verizon Samsung Galaxy S 4] tanishq.dubey:
I know he has his own security firm. I guess what I was trying to say was that by presenting his findings in front of large corporations, he can enhance his reputation, which is already considerably high.
[Verizon Samsung Galaxy S 4] Bad Bimr:
My Verizon M8 is completely unlocked with s-off. Got it about a month after release. Don't know if they locked them down since. I know some of the methods used to unlock did not work with all phones but other methods (some paid) have been developed. The M8 is an awesome phone only thing I miss are the true blacks of the S4 screen. Still have the S4 and hoping for good things.
[Verizon Samsung Galaxy S 4] dmt010:
Looking forward to the cri erytime if his speech isn't helpful for this project. So don't get your hopes up yet.

Sent from a piece of **** Samsung KNOX phone
[Verizon Samsung Galaxy S 4] joshm.1219:
I still haven't looked into it, but I believe the latest OTA is locked down now. Nice to have S-Off though right? I like being able to downgrade firmware.
[Verizon Samsung Galaxy S 4] eskomo:
Samsung Galaxy and Note series phones are not suppose to be AOSP. If that is what you're looking for then buy a different phone. These phones come with TW. Its the same as buying a ford mustang and wanting it to be a Chevy Corvette. It just isn't going to happen.
[Verizon Samsung Galaxy S 4] failedjedi:
The F*** you talking about? That doesn't make any sense at all.
[Verizon Samsung Galaxy S 4] eragon5779:
Umm... AOSP is meant for all devices. Its like putting a turbo-charged V8 in your Corvette. It boosts the device.
[Verizon Samsung Galaxy S 4] SamuriHL:
Someone should notify Samsung that Google and I have been very bad. My S4 GPE isn't running TW and is instead running stock Android as Google meant for it to be. UH OH! :D
[Verizon Samsung Galaxy S 4] DeadlySin9:
As others have said, that's not particularly an equivalent comparison. Also, look at the devices on the market and you'll see most of them run their own apps and UI over android unless you pay more for a Google edition or something. The difference in your example is hardware vs software. The S4 was basically the best hardware at the time, but the software cripples it. It's more like an electronic limiter in your Veyron, you have the power but something is stopping it.
[Verizon Samsung Galaxy S 4] JLow0214:
Thumbs down button for poor analogy.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] tanishq.dubey:
Not necessarily a bad analogy, if you look at it in terms of design. One of the main reasons manufacturers use a custom UI on top of android is for brand recognition. When you use a TouchWiz phone, you know it is Samsung, a Sense phone is HTC, and so on. This is basically the same reason Toyota doesn't design its cars to look like Ferrari (let's ignore cost, just design terms), you can identify a Toyota by looking at it, and you can identify a Ferrari just by looking at it. And this same basic principle applies to phones, each brand wants to make sure they are different from the others.
[Verizon Samsung Galaxy S 4] Black6spdZ:
Yea, and the number one reason I see Samsung users switch to the eyePhone and cuss "Android phones" forever. They're ruining what Android is meant to be. Good thing is Android 5 should put a stop to that!
[Verizon Samsung Galaxy S 4] lithium630:
I know there are options like Safestrap, but I've held off. I'd rather update it completely. There are other quirks with the phone. Not sure I'll buy another Samsung.
[Verizon Samsung Galaxy S 4] bigbob_ftw:
I miss my infuse sometimes. So easy to root and flash.
[Verizon Samsung Galaxy S 4] Hashbang173:
My 1st gen Kindle Fire is even better, you can replace the boot loader LOL
[Verizon Samsung Galaxy S 4] eragon5779:
I had a Droid 1 running Jelly Bean LOL. I miss those days
[Verizon Samsung Galaxy S 4] NighthawkXL:
So, will anyone be at Blackhat this year to provide live updates or know somewhere that will be? This year they aren't streaming it (at least officially) like they have in the past. Whether Dan's exploit is relevant to the S4 doesn't matter to me. I'm still interested in seeing it...
[Verizon Samsung Galaxy S 4] anthonyg45157:
Similar question, does anyone know if dan is giving his "briefing" today or tomorrow? ?
[Verizon Samsung Galaxy S 4] scap99:
Website said today.

Between 1500-1600hrs.
[Verizon Samsung Galaxy S 4] sokrboot:
I still have my DROID 1...somewhere. man that thing was easy to root and flash.

---------- Post added at 10:09 AM ---------- Previous post was at 10:05 AM ----------

And that is Pacific Time.
[Verizon Samsung Galaxy S 4] dmt010:
Video will probably be posted here..

https://www.youtube.com/user/BlackHatOfficialYT/videos
[Verizon Samsung Galaxy S 4] dmc2359:
Here is Dan's presentation. ...looks like we are in luck....

[MENTION=4939386]Surge1223[/MENTION]
[MENTION=766721]ryanbg[/MENTION]
[MENTION=5155393]NighthawkXL[/MENTION]
[Verizon Samsung Galaxy S 4] ryanbg:
You are amazing.

EDIT: I KNEW IT!!! VENDOR WAS QUALCOMM, not an OEM. QSEE is the TrustZone kernel running on most Qualcomm devices, aka almost everything. Wonderful. Ladies and gentlement.... Stand by.
[Verizon Samsung Galaxy S 4] DeadlySin9:
Interesting read in any case. Looks like implementation will take a bit of work but knowing it's possible is something. Also, I like the one slide titled Sorcery! after he found he couldn't load non-secure code outside of what he was writing to. "Any Qualcomm or ARM employees in the audience?"

In any case, here's to hoping an unlock is soon and the bounties are plentiful for those involved, in whatever form they take a reward.

Sent from my SGH-I337 running GPE
[Verizon Samsung Galaxy S 4] SamuriHL:
HOLY SNIKES! WOWWWWWWWW. Damn. Have fun with that ryan. ;)
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
DAN THE MAN! I'm so happy right now.. haha!:D
[Verizon Samsung Galaxy S 4] TTLayland:
Major Android device. Knew this was worth it.
[Verizon Samsung Galaxy S 4] SamuriHL:
Well, it's not exploited...yet. But we at least now know it can be and how to go about it. People like Ryan will have to look at this and see what can be done. But this is incredible that it impacts so many devices. S5 and M8 are patched according to the info, but, others aren't. If you're on a qualcomm device, I'd probably not take any OTA's for a bit to see what comes of this. :)
[Verizon Samsung Galaxy S 4] JLow0214:
YESSSSSSSSSSSSSSSSSSS!!!!!! Finally I can get this god forsaken Touchwiz off my phone and really use it again.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] xdabens:
I hope this exploit isn't already patched in the NC2/NC5 bootloaders...
[Verizon Samsung Galaxy S 4] Surge1223:
Ok all, lets settle down, remember not until the fat lady sings. Going through the info now...(nudging fat lady on stage)
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
This doesn't mean we could have our exploit by today, DOES IT?
[Verizon Samsung Galaxy S 4] npjohnson:
I just went through the info... From my understanding, this is a Qualcom (Most Models) ONLY exploit, not the Exynos implementation (There is actually 1 model i know of that is exynos and has BL Locked...)?

All this said... So the Q-Fuse check (QSEE Function) is bypassed by a faulty SMC call? And then the QSEE function is able to write to Secure Memory... So this allows us to unlock the boot loader how? I see that execution of code from secure memory gives higher privileges... But we still aren't able to write over the BL, so KNOX will still exist, I mean unless there is a part that I am missing, I know that TrustZone is lower level than KNOX, but I fail to see how disabling a signature check helps when KNOX will just kill it..

The only reason I think that a Bypass and not a full unlock worked on MDK was because of the fact that KNOX was nonexistent.

I see how it can disable signature checks, but this is almost certainly a KNOX 0x1 type exploit... Correct me if Im wrong.

The person that exploits this will gain my respect. It looks like a tougher one to exploit.

EDIT: I don't actually give half a crap about the 0x1, if I can unlock, I will regardless.

EDIT 2: Ok, I found out that Secure Memory at that level could execute coed to disable KNOX checks as well (I think), So I guess all but the Exynos Part is Invalid (Possibly)
[Verizon Samsung Galaxy S 4] Surge1223:
I wouldn't call the smc call faulty....also its the trustzone that verifies the kernels integirty before aboot allows the system to load. I see you mention KNOX quite a bit like its an entity in the bootchain...knox, tima, trustzone are all intertwined. Our path isnt going to be easy because there is no native unlock feature in the trustzone...we will have to try to bypass the kernel security check I think but I have just started reading/analyzing so my assumptions may be premature.
[Verizon Samsung Galaxy S 4] Walter.White:
Correct..This exploit is present on S4 & N3 for sure but I don't think it will help us Unlock BL because of the way the locking works on Sammy devices. (This exploit can/will unlock Moto/HTC devices but I've hard time seeing it unlock Sammy devices).

What this exploit will do is it will allow us to dig deeper into the inner working of Trustzone and will contribute more towards research than anything else.

---------- Post added at 02:59 PM ---------- Previous post was at 02:56 PM ----------

Exactly what I was thinking. I think you are on right train of thought...we need to figure out where in trustzone is that security check is made and patch it.
[Verizon Samsung Galaxy S 4] npjohnson:
Sorry, I didn't mean faulty, I meant craftily created.

No, sorry if I wrote that incorrectly, I was merely talking about the KNOX warranty in that part.

This exploit could definitely bypass kernel security checks. My post was moreso about its KNOX warranty status, and the question of this working on the Exynos models.

With the kernel security checks disabled, would be able to overwrite aboot? (I don't know if we would need to.)
[Verizon Samsung Galaxy S 4] TTLayland:
I thought the presentation said it could be used on GS5 GS4 and N3
[Verizon Samsung Galaxy S 4] SamuriHL:
It specifically said the S5 and HTC M8 are already patched.
[Verizon Samsung Galaxy S 4] NighthawkXL:
An talk about a embarrassment for Qualcomm (and ARM by proxy), so much for TrustZone being "100%" secure. Well, best of luck working with it... I'm sure once the rest of the forum go-er's get around we'll be seeing people biting at the heels for updates. An lastly, a big thanks to Dan Rosenberg (@djrbliss) for providing this vulnerability. I know him and XDA community have their differences but he still deserves credit where credit is due.

Time will tell, back over on AT&T we had NB1 released in February, and NC1 released early April right before the release of the S5. Hopefully as a oversight they didn't update the older devices.
[Verizon Samsung Galaxy S 4] eragon5779:
So no luck for Galaxy S5 on any firmware ?
[Verizon Samsung Galaxy S 4] tanishq.dubey:
As of right now, no.
[Verizon Samsung Galaxy S 4] Hashbang173:
What about the S4 on the NC5/NC5 bootloader, Is the unlock possible on that?
[Verizon Samsung Galaxy S 4] SamuriHL:
Unknown. It only specifically mentioned the S5 and M8 as not being afflicted with this security issue.
[Verizon Samsung Galaxy S 4] SamuriHL:
According to a tweet by JCase, Dan just unlocked a Moto X on stage. LMAO :)
[Verizon Samsung Galaxy S 4] anthonyg45157:
Ouch!
[Verizon Samsung Galaxy S 4] clothednblack:
*checks to make sure updates are blocked*

Stickied with my post-it-note 3
[Verizon Samsung Galaxy S 4] k1mu:
Wow. "Demo", indeed. Quite an impressive bit of work.
[Verizon Samsung Galaxy S 4] SamuriHL:
Big time. That should really open up some avenues for other devs to explore...right? :D
[Verizon Samsung Galaxy S 4] bennyboy78:
Unlocking could really be a possibility now huh? Since both Motorola and Samsung use Trust zone, this should work on the s4 [emoji16]?
[Verizon Samsung Galaxy S 4] SamuriHL:
Let's not be quick to rush to conclusions like that. Just because phones share the same architecture and use the TZ, does NOT mean their bootloader locking mechanism works the same. And in this case, they DO NOT. Moto has an e-Fuse that gets blown when an unlock code is entered. The e-Fuse code is called through the TZ. Samsung, however, uses a signed bootloader for their unlock. It is not controlled through the TZ. However, there may be ways to exploit the TZ to run unsigned code, which would bring a Loki like solution. Of course, devs will correct me if I'm misspeaking. :)
[Verizon Samsung Galaxy S 4] michaelg117:
Just waiting and hoping patiently for that "We've got it." Post.

Keep up the good work.
[Verizon Samsung Galaxy S 4] Verttex:
Jcase posted in a reddit thread earlier saying 'This bug won't unlock the s4.'

Thoughts? He was at the conference since he tweeted about it.
[Verizon Samsung Galaxy S 4] rebel1699:
The general concensus is, no, it wont *unlock* the Samsung bootloader. But, there is an at least good possibility that it will make a Loki like workaround possible. It is still best to let the devs work through it and wait for thier results before saying one way or the other. Nothing is certain until they say it is or is not.
[Verizon Samsung Galaxy S 4] sokrboot:
Did anyone see the vulnerability that Pau Oliva [MENTION=240671]pof[/MENTION] tweeted about a couple of days ago?
[Verizon Samsung Galaxy S 4] RuggedHunter:
Nope. Link?
[Verizon Samsung Galaxy S 4] dmc2359:
https://www.codeaurora.org/projects...bypasses-signature-verification-cve-2014-4325

Too bad the S4 doesn't use fastboot......
[Verizon Samsung Galaxy S 4] Walter.White:
It was submitted by [MENTION=2376614]jcase[/MENTION] aka Jon Sawyer
[Verizon Samsung Galaxy S 4] jcase:
No it won't, this can in no way be used for a Loki like attack. - the devs
[Verizon Samsung Galaxy S 4] Walter.White:
What about for disabling TIMA?
[Verizon Samsung Galaxy S 4] rebel1699:
Well, it looks like Samsung has won another battle.
[Verizon Samsung Galaxy S 4] ryanbg:
Justin is right. Loki is completely unrelated, and involves patching the boot/recovery image headers to load over aboot.

While there isn't a single-point unlock mechanism like HTC and Motorola, there are certainly several avenues of interest to explore within QSEE/Samsung. A proof of concept with this vulnerability is much more difficult than people seem to think.

It certainly is possible to 'disable; TIMA, but the important parts of TIMA (being able to boot without Trusted Boot verification) is actually partially in aboot. Give it time and we'll see what comes to fruition.
[Verizon Samsung Galaxy S 4] SamuriHL:
Thanks for clearing that up. It was definitely not clear to me reading through the paper that Dan put out if that was possible or not.

---------- Post added at 06:59 PM ---------- Previous post was at 06:56 PM ----------

I think I'm getting a better picture here. It sounds like the TZ and bootloader work in concert to secure the boot chain if I'm understanding what you're saying. And that definitely makes sense. Can the TZ be used to affect the bootloader in memory after it loads?
[Verizon Samsung Galaxy S 4] tshelby73:
I believe it's time to find a different device
[Verizon Samsung Galaxy S 4] LLStarks:
I believe its time to buy the Nexus 5 2014 or whatever is on the way and stop treating devices like a crap shoot of whether your bootloader is nice or not.
[Verizon Samsung Galaxy S 4] kelvin00:
Very unfortunate. Was hoping this would have been my golden ticket to unlocking my bootloader on my S4. Can only hope this gets us one step closer to that beautiful day when all devices with bootloaders will have a work around.
[Verizon Samsung Galaxy S 4] sokrboot:
Dan Rosenberg just tweeted this 10 mins ago " [MENTION=4229979]djrbliss[/MENTION]: LG and Samsung devices cannot be bootloader unlocked via TrustZone, so please stop asking me about it."
[Verizon Samsung Galaxy S 4] Whoop5:
Back to preparing the S4 for sale...
[Verizon Samsung Galaxy S 4] phobia09:
Hate to be a buzzkill, but it looks like it's quite the opposite that will take place.

While I believe there will be a day that there will be virtually no usable exploit to unlock a bootloader, I believe some OEM will surface as a truly "mod-friendly" device. Hopefully HTC; but more likely Oppo or OnePlus.
[Verizon Samsung Galaxy S 4] xXsquirr3lsXx:
So this war has come to an end?
[Verizon Samsung Galaxy S 4] TTLayland:
This is a horrible feeling.
[Verizon Samsung Galaxy S 4] Hashbang173:
Any devs want to try to get kexec working with safestrap. Safestrap is open source.