yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] bobturismo:
Im probably stupid for posting this without doing more research....

I had read that people were using verizon s4 roms on sprint phones, so I would assume the reverse is possible?

Could we use odin to completely flash everything? I have no idea and I'm talking out my ass.

*cowers and blocks face from incoming objects
[Verizon Samsung Galaxy S 4] NateDogg1232:
This happens with ATT phones too but only with TouchWiz ROMs.

The main issue is the locked bootloader won't allow anything but TouchWiz ROMs.
[Verizon Samsung Galaxy S 4] SpaceSaver2000:
Do we know how it determines what is and isn't TouchWiz?
[Verizon Samsung Galaxy S 4] npjohnson:
Years in, this is done and integrated into LineageOS.

ATT/VZW devices are able to use an exploit called "oor" (out-of-range)

GitHub - jb881122/out-of-range

Contribute to jb881122/out-of-range development by creating an account on GitHub.

github.com

After working with the exploit author it now supports all available bootloader versions for Verizon and AT&t s4s, the plumbing for it is already wired into lineage source as of earlier this week as well, so you can use the exploit to run custom boot images on stock or just use it on a lineage recovery image per the wiki instructions laid out here (wiki.oddsolutions.us) and run LineageOS 18.1.

Enjoy, boys, long time coming.
[Verizon Samsung Galaxy S 4] jrkruse:
Does this require running script from computer every time you boot
[Verizon Samsung Galaxy S 4] npjohnson:
Nope.

It's a Loki drop in replacement
[Verizon Samsung Galaxy S 4] jrkruse:
That’s great. Good work
[Verizon Samsung Galaxy S 4] npjohnson:
Yeah for now people can build themselves and follow the official lineage wiki for installation instructions.

But my personal builds that roll monthly @ wiki.oddsolutions.us will be up once the May ASB drops and is ported to 18.1, and that will have it all included as well.
[Verizon Samsung Galaxy S 4] Surge1223:
[Size=3][B]MJ7 sbl2.mbn[/B][/size]
[size=2]HWREVNUM_PHYS_ADDR
HWREVNUM_OFFSET
ChipIdOverride
# %@#
pGxG
boot_config_data_table_init, Start
boot_config_data_table_init, Delta
Image Loaded by %s, Start on 0x%x
Data Abort
0:ALL
BOOT
SCL_SBL2_STACK_BASE-SCL_SBL2_STACK_SIZE
boot_flash_init, Start
boot_flash_init, Delta
[B]Signal SBL1 to Jump to RPM FW[/B]

[Size=3][B]MJ7 Modem.bin[/B][/size]
*BOOT
SCL_SBL1_STACK_BASE-SCL_SBL1_STACK_SIZE
*boot_error_handler.c
*boot_flash_dev_if.c
*boot_flash_dev_if.c
boot_flash_init, Start
boot_flash_init, Delta
*boot_flash_target.c
*boot_hash.c
*boot_hash_if.c
*boot_hash_if.c
*boot_sys_loader.c
*boot_error_handler.c
*boot_error_handler.c
*boot_loader.c
*p@-
*p@-
[B]BRPMSignal SBL1 to Jump to RPM FW[/B]
*boot_sys_loader.c
*boot_pbl_v1.c
*boot_pbl_v1.c
boot_error_handler.c
*boot_error_handler.c[/size]

Notice how sbl2 and the modem are both capable of calling rpm...wonder what activates that? Anyways im going through the tz because I think that rpm gets/queries a response/string/signature. Dont hold me to that tz, rpm and aboot require more tools, time and accurate kernel compilation to read. Does anyone have viewmem built?
[Verizon Samsung Galaxy S 4] JLow0214:
Is there any way we could change where it checks the key to the same spot so it would check it against itself and pass??

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Surge1223:
Probably not, wed have to find the address where its getting callled and see what we could do from there. Im wondering since apnhlos, the modem and sbl2 all seem capable of calling rpm that if we broke the COT there we might be able to do more. Much more research is needed.

On another note, does anyone know if they below "firmware_update_sdcard is refering an sdcard with an ota downloaded to fota or is it the first sign of our device's hard to find boot from sd?

ct=2, SerialNumber=0

[43540.511688] usb 2-1: usb_probe_device

root@jfltevzw:/sdcard/Documents # cat log | grep device root@jfltevzw:/sdcard/Documents # cat log | grep card

00000000 b sdcardfs_inode_cachep

00000000 b sdcardfs_dentry_cachep

00000000 B is_cardock

00000000 B firmware_update_sdcard

00000000 B snd_ecards_limit

00000000 B snd_cards

00000000 b snd_cards_lock

Edit: Also in the process of gathering kernel addresses, I managed to bring my other S4 that was in Qhsusb_dload mode into a different mode. Its weird I can access some of the files. The weird part is that ita really corrupted

Ill post pics below. But I think I can access system calls and maybe some other stuff we didnt have access to...ill post more later.

DIAG_UART_LOG Program start!! : %s Unable to open device %s +MODECHAN:0 OK /sys/power/wake_lock diag: could not open wakelock file/sys/power/wake_unlock diag: could not open wake-unlock filediag_wakelock diag: error writing to wakelock fileclose uartclose(%d) and send switch command %swrite ret(%d) = %dstart listnerfd_uart (%d), fd_atd(%d)[UART DIAG : fd_atd < 0, fd open error [UART DIAG] : %s +CPUARTCPUART:%s() nodeNameFromParam : %s+APUARTAPUART+CPUART_RELEASED[UART DIAG : fd_uart < 0, fd open error +CPUART_RELEASED_FROM_PGMset wakelock by dm commanddeviceobaudibaudhelpmaintoH o. doih[B]/dev/ttySAC2GCC:[/B] (GNU) 4.7 GNUgold 1.11A5aeabi+ARM v7 A ".shstrtab.interp.dynsym.dynstr.hash.
[Verizon Samsung Galaxy S 4] JLow0214:
I tried to look in aboot.mbn with IDA Pro but the newest hex rays one i got doesn't come with decompiler so I only get assembly language which isn't really helpful as assembly language is different for every chip

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] KaratemanTJ:
It's different for each architecture. So (almost, if not all) arm processors use the same assembly language.
[Verizon Samsung Galaxy S 4] JLow0214:
I tried looking up ARM assembly language but it wasn't matching what ida was spitting out.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] PetrichorXFi:
Arch has a build for ARM... available on pogoplug, RaspberryPI, etc.

As Arch is a more fully featured OS, can decompile tasks be done on such a device? How many can read/write in assembler these days? i know Steve Gibson still writes a lot, but i doubt he has time these days... i think he does assembler in x86, and perhaps powerPC with his latest SpinRite6.1 when released.
[Verizon Samsung Galaxy S 4] JLow0214:
Well I went with ida after reading Steve Rosenberg article on decompiling with it and it decompiled aboot.mbn to C pseudo code which is much easier to work with..... But I couldn't get it to give me the pseudo code unfortunately

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] jeboo:
Disassembling is pretty straightforward with IDA, set CPU to ARM, hit edit in processor options and click 'set any'. Then just set the base address to 88e00000 for aboot and it's done.

But like mentioned above, we really need the ability to generate pseudocode. Trying to find an exploit in straight ARM is very difficult without having analysis scripts of some kind. Once we get pseudocode, we probably need to focus on I/O points for vulnerabilities. This would probably include ODIN/recovery code..
[Verizon Samsung Galaxy S 4] KaratemanTJ:
Glad you got it decompiled! Sometime disassembled code is different if I recall (it's been too long since I've decompiled anything). C definitely makes more sense to must folks. If you get it to give you the pseudo code could you post it somewhere? I for one would be interested in seeing it.
[Verizon Samsung Galaxy S 4] JLow0214:
I'll try again now that I know what to set the base code to ;) and I'm still looking for a version of ida with the hexrays decompiler.

Edit: so I have not really used a decompiler before but I can get file loaded change processor to ARMv7 but don't see where to enter base address... Did a Lil research and saw it was the loading segment and loading offset combined to equal the base address but they get greyed out when I select ARM as a processor

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Surge1223:
Sbl2

Later in Sbl2

Why is TZ memory being being checked for backup memory before its loaded into memory? Hmmm does that mean tz memory isnt in tz partition itself?
[Verizon Samsung Galaxy S 4] Surge1223:
RPM_MSGRAM
APSS_L2_TCM
SPS_PIPEMEM
MMSS_IMEM
SYS_IMEM
HAL_SBI_SSBI_V2_PMIC_ARBITER
tzbsp_pil_init_image_ns
tzbsp_pil_auth_reset_ns
tzbsp_qfprom_write_row
tzbsp_qfprom_write_multiple_rows
tzbsp_qfprom_read_row
tzbsp_qfprom_rollback_write_row
tzbsp_prng_getdata_syscall
tzbsp_resource_config
tzbsp_dcvs_register_core
tzbsp_dcvs_set_params
tzbsp_dcvs_init
tzbsp_dcvs_set_power_params
tzbsp_nfdbg_config
tzbsp_nfdbg_ctx_size
tzbsp_nfdbg_is_int_ok
tzbsp_cpu_config
tzbsp_cpu_config_query
[B]tzbsp_set_boot_addr[/B]
tzbsp_milestone_set
tzbsp_lock_shared_resource
tzbsp_is_service_available
tzbsp_exec_smc_ext
tzbsp_exec_smc
tzbsp_tzos_smc
tzbsp_ssd_decrypt_img_ns
tzbsp_ssd_encrypt_keystore
tzbsp_ssd_parse_md_xml
tzbsp_ssd_decrypt_chunk
[B]tzbsp_blow_sw_fuse
tzbsp_is_sw_fuse_blown[/B]
tzbsp_get_diag
tzbsp_secure_channel_init
tzbsp_secure_channel_deinit
tzbsp_exec_protect_memory2
tzbsp_fver_get_version
tzbsp_oem_do_something
tzbsp_oem_save_trustboot_info
tzbsp_oem_qfprom_info
tzssdimgssdksimg
[Verizon Samsung Galaxy S 4] jeboo:
Oh ya, the loading offset is 0x28, forgot about the header..
[Verizon Samsung Galaxy S 4] Surge1223:
Oh my
[Verizon Samsung Galaxy S 4] Surge1223:
Are you on the 6.1 leak or 6.4? Mine loads when I enter the address. Go to view and enable more menus and dont use the default "hexview"
[Verizon Samsung Galaxy S 4] JLow0214:
I have the 6.1Windows and 6.3 Linux and do either of yours give the c pseudo code??

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] sokrboot:
Ok I will admit that im not even qualified to ask this question but...what does IDA do that smali wont do?
[Verizon Samsung Galaxy S 4] Surge1223:
the following is in an area we do have access to. [MENTION=2471504]jeboo[/MENTION] kernel module verifaction spoof ideas?
[Verizon Samsung Galaxy S 4] gnubian:
So glad people are still working on this. Wish I could contribute somehow :/
[Verizon Samsung Galaxy S 4] ryanbg:
I believe this is apart of Knox's attestation, which if I remember correctly, the hashes are stored locally in TrustZone for verification. Could be wrong though.
[Verizon Samsung Galaxy S 4] pyroman512:
I'm pretty sure I already know the answer, but is it possible to upgrade from ME7 to any new official release without upgrading the bootloader? For example can we make an odin that doesn't flash the new bootloader without bricking?

I'm pretty sure the answer is no...
[Verizon Samsung Galaxy S 4] EkizUCLA:
I do not think this is possible without loki + custom recovery and even then you can only upgrade the modem to a newer version.
[Verizon Samsung Galaxy S 4] PetrichorXFi:
Alternative approach? -- the "second OS" == cell radio/baseband OS

Cell phones have two OSs. One is android, IOS, etc. Other is for cell negotiation, signal strength, etc. This "second OS" has very few if any security checks wjen data is sent to it via a cell tower.

Read more per Steve Gibsons podcast; https://www.grc.com/sn/sn-431.htm

So.... can we use a femtocell, one of those devices that use our home internet to create a "mini cell tower" within our home, to send exploit code? Perhaps even simpler, send an "OTA" that is actually an older version... say MDK?

I do not believe anyone has discussed this. Odin on pc, and mobile side checks to prevent downgrades... or so i have heard. BUT, does a "fake OTA" via a femtocell have any such checks?

--edit-- please excuse the long posts, I figure getting the information up here is important so i tdried to only quote the areas of greatest relevance
[Verizon Samsung Galaxy S 4] kalestew:
The reason I don't think that will work as a solution is because I don't have a femtocell, that's another like 80 bucks I'd have to spend
[Verizon Samsung Galaxy S 4] PetrichorXFi:
Here is the txy from Steve Gibsons tramscript that talks about this possible exploit.

Oh amd FYI, i think Darren Kitchen of HAK5.org interviewed the guy who Steve refers to who hacked the GSM stuff... i think it was Defcon 2010

"

nd in this last week, the reason this sort of came to everyone's attention is OSNews.com did a story about the so-called second operating system hiding in every phone. And the guy who wrote, Thom Holwerda, he wrote: "The insecurity of baseband software is not by error; it's by design. The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security." Enough said. I mean, we know what a '90s attitude toward security is. It's like, yeah, my password is "monkey" and so forth.

And he says: "For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse is that every baseband processor inherently trusts whatever data it receives from a base station - in other words, a cell tower. Nothing is checked. Everything is automatically trusted. And lastly, the baseband processor is usually the master processor, whereas the application processor, which runs the mobile operating system, is the slave. So we have a complete operating system," he writes, "running on an ARM processor, without any exploit mitigation, or only very little, if any, which automatically trusts every instruction, every piece of code and data it receives from the base station you're connected to. What could possibly go wrong?

"

---------- Post added at 02:29 PM ---------- Previous post was at 02:24 PM ----------

Id spend 80 if it ment persistant BL unlock.

True, it is more than many may wish to spend though.

But, look at the bounty thread.... people are willing to spend money... how many will follow through, and for how much moneu is another question
[Verizon Samsung Galaxy S 4] pyroman512:
I don' think a fake OTA would the problem because it would still come across the same problems from current OTAs and trying to ODIN back. The possibility of an exploit on the cell side of things does sound intriguing. I will be the first to admit I do not understand a lick of computer security.
[Verizon Samsung Galaxy S 4] JLow0214:
Was doing some reading on the Knox counter and I get the whole if its tripped no Knox container but IDC about that. If I trip it will it then not care what I flash since it has been tripped or will I still be stuck with stock recovery, ss, and boot?

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Surge1223:
No it will care youll have to use stock then. Tima sends a smc call from the "Normal World" (NW) to the "Safe World" (SW). The safe world is in the TZ and so whatever tima is calling to check the knox flag with would have to be hijacked before it entered the SW because we have no control there (....yet)
[Verizon Samsung Galaxy S 4] ryanbg:
I feel like all of our problems would be solved if we got another kernel exploit and were able to get inside TZ...
[Verizon Samsung Galaxy S 4] Surge1223:
So we're getting a little somewhere here. Use the resources available and ask yourself "What's the difference between the dev S4's and retail S4's?"

Easy answer right? The developer edition is unlocked duhhh. Not so fast, I mean really seriously "What's the difference between the dev edition S4 and the retail...Hardware wise?"

Again easy answer right? The device has the developer unlocked fuse blown duhh. Wait then why run a different software version than retail devices? Seems a little weird doesn't it? Why are dev edition and retail edition S4 firmware compatible? Wouldn't it make more sense to have them both on the same system software if there was a hardware implemented difference?

Investigation tells me they are the same. The one difference being aboot, and therein lies the reason why dev devices aren't getting updates. They know we'd be able to figure out how they changed aboot for dev devices.

We're on to you Samsung.
[Verizon Samsung Galaxy S 4] scap99:
I'm rooting for you Surge! ;)
[Verizon Samsung Galaxy S 4] gnubian:
Awesome! Thanks for not giving up Surge!
[Verizon Samsung Galaxy S 4] hovax615@hotmail.com:
Getting closer everyday. Great job surge!

AT&T Galaxy S4 SGH-I337 RUNNING HYPERDRIVE 12
[Verizon Samsung Galaxy S 4] decaturbob:
this would be my line of thought from the get-go. Start with the dev phone vs retail phone.....well put Surge
[Verizon Samsung Galaxy S 4] pyroman512:
Anyone ever provide a MJ7 developer edition build to you? Were they just shipped on brand new developer edition phones?
[Verizon Samsung Galaxy S 4] Surge1223:
Yeah I have the bootchain. As for were they shipped on new dev phones? I can't say for sure I can tell you the dev MJ7 bootchain I received suggests that the build before it was OYUEMI1 and probably was upgraded to OYUEMJ7 at the factory.

Unrelated but TIMA stands for TrustZone-based Integrity Measurement Architecture

• TIMA kernel protection

- LKMAuth: Load-time authentication of kernel modules

- PKM: periodic measurement of base kernel code and RO data

- RKP: Real-time kernel protection

Noting the above the exploit jeboo found is probably going to be patched because TIMA access is a big vulnerability, all of this becomes a little more clear after reading this http://www.samsungdevus.com/sites/default/files/IntroducingtheSamsungKNOXPlatform-PengNing.pdf
[Verizon Samsung Galaxy S 4] equake:
Deleted
[Verizon Samsung Galaxy S 4] jeboo:
I would expect the patch to be twofold. The first one fixing the kernel exploit already exists with the latest Sammy kernels. The second one will likely be an update to the boot.img "version string" at 0x30, which is currently 'I337UCUAME7'. They will almost certainly update that in the next revision of bootloaders to prevent reversion.
[Verizon Samsung Galaxy S 4] ryanbg:
Wouldn't this mean that dev devices and retail devices have different signatures? Technically we could just extract and flash the aboot image from a dev device to a retail, yet we can't. Or is there no signature on it?
[Verizon Samsung Galaxy S 4] Surge1223:
In the note 3 thread remember Hash and Beans compared their dev aboot files. They're different. If you look at the dev aboot it actually has the strings 1545VRUAME5 in it but it's signed differently.
[Verizon Samsung Galaxy S 4] ryanbg:
So FORCE_SCUR_BOOT is a software fuse then, or is it just not blown on S4/N3? I guess I'm just comparing to Motorola. I wish I could just hex edit the build number in aboot. I'm headed home now and will fire up IDA and see if we can't find a wolf in sheep's clothing. We should get a hangout going for the few of us working on this. Maybe meet up, share all what we know, and go from there?
[Verizon Samsung Galaxy S 4] gunz.jones:
Has anyone thought of looking into the way they got the bootloader cracked on the Rezound? Is there a pin setup up that would short and allow the unsecure image through DL mode? It's been a while since I had the Rezound, but just a thought.
[Verizon Samsung Galaxy S 4] budding_developer:
Hey Surge -- could I get you to send me that bootchain, or get a download link from you? I would like to do some experimenting with it.
[Verizon Samsung Galaxy S 4] Surge1223:
NO ONE SHOULD FLASH ABOOT FROM THE FILE LINKED. IT WILL NOT WORK!

http://www.androidfilehost.com/?fid=23269279319198454
[Verizon Samsung Galaxy S 4] equake:
Isn't the Aboot the key and it has to be signed with the Device info?
[Verizon Samsung Galaxy S 4] Surge1223:
Yeah, thanks for mentioning that. I originally posted that in another thread for research purposes. NO ONE FLASH ABOOT FROM THE FILE LINKED ABOVE. IT WILL NOT WORK!
[Verizon Samsung Galaxy S 4] JLow0214:
So could we potentially sign the dev aboot with consumer info and flash dev aboot then unlock...etc...etc

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] decaturbob:
signed information is known to samsung and unless some one leaks that info, going to be difficult to crack and why we are where we are is my understanding
[Verizon Samsung Galaxy S 4] JLow0214:
Oh they talking about sammy sig.... i thought they meant device specific code

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] ryanbg:
If there was, you still can't alter any image because then the signature is invalid.
[Verizon Samsung Galaxy S 4] JLow0214:
Hey has anyone seen the post over in n3 [Bounty]reset knox counter topic by arymanik?? Supposedly he found a way to downgrade from 4.3. I will warn you though his english god awful...... he posted again saying he would reply in polish (his native tounge).......still waiting on that and hopefully some kind soul translates it.

http://xdaforums.com/showthread.php?p=49274734

Its post #647

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] gnubian:
Looks intriguing....fingers crossed.
[Verizon Samsung Galaxy S 4] JLow0214:
Fingers and toes lolol

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] Blahness:
So I'm a noob at Android dev, but I have a fair amount of experience with development in general.

I just have one stupid question about dissassemblying in IDA.

I load aboot, select ARM as the processor, go to processor options and set the base architecture to Any (as suggested by jeebo), and then it asks me about the memory organization.

I put 0x88e00000 in the Loading address and 0x28 in the File offset, but unsure what the Loading size should be or what the ROM settings should be.

I have IDA 6.1. Thanks for the help.

Edit: I tried making the Rom start and size the same as the loading address and loading size, respectively. When I ran idag.exe instead of idaq.exe, the loading sized changed automatically when I put the file offset in. I then pressed C at 0x0x88e00000, and the output now seems more sensible but I don't want to investigate assembly code if it's not disassembled correctly haha. Please let me know if I did this right? Cheers.
[Verizon Samsung Galaxy S 4] failedjedi:
I really didn't understand any of that, his english is really bad, mind giving a quick summary of what he is trying to say?
[Verizon Samsung Galaxy S 4] scryan:
Honestly seems pretty irrelevant here?

To my understanding:

Their boot loader is not locked down like ours, but flashing custom recovery, ect, will result in the knox flag being tripped which voids you warranty and blocks you from being able to run the knox security stuff.

He may have figured out a way to reset the flag so that using their already unlocked boot loader wont trip the warranty flag.

Seems to be something along the lines of killing all system apps then reflashing the aboot or something?
[Verizon Samsung Galaxy S 4] gnubian:
If you read through the following posts is seems there is maybe a file in our 4.3 odin that isn't on the 4.2. When you are on 4.3 and try to odin it looks for this file, and I'm guessing if it isn't there it fails. So the theory is if the 4.2 (mdk) build had the file put into it the odin flash may work?
[Verizon Samsung Galaxy S 4] JLow0214:
From my understanding he disabled the system and some other apps maybe unmounted some partitions then deleted 7 files (sammy certificates) which then allows downgrading

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] gnubian:
I read that also. It's a whole shart storm of polish - engrish that I don't know what to make of it. I just have hope lol.
[Verizon Samsung Galaxy S 4] JLow0214:
Me too...... although he posted again and the 1st half was readable then it kinda trails off.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] jeboo:
Looks good. IDA wont natively dissect the functions, so you may have to do some code conversions manually.
[Verizon Samsung Galaxy S 4] Blahness:
Thanks jeboo, it should be good enough for me to start generating some pseudocode.
[Verizon Samsung Galaxy S 4] gnubian:
Any comment on the Polish guys anslysis? Have you or surge seen that error/looked into it on the s4?