yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] skeezer308:
That's awesome! I taking a look at everything to see if I can absorb some of this and learn a little more about whats going on. Is it possible to turn the whole process into a series of flashable ZIPs and scripts/adb?
[Verizon Samsung Galaxy S 4] Surge1223:
Sure, but no yet. The process is automated for me because I wrote scripts to do a lot of the manual steps but I feel like id be doing society a disservice by posting those at this point lol.
[Verizon Samsung Galaxy S 4] ICSthunder27:
For the noobs, do these Kexec-tools allow us to do anything yet, or is it for others to use to further get to that point? Awesome to see this progress!
[Verizon Samsung Galaxy S 4] skeezer308:
Nice. Also do you need to be on a Linux distro to do some of the commands and things with the kernel, or can you do them with windows through command prompt?

Sorry to be all a million an 1 questions, but that's how I learn. Also, then I would know if I have to set up a VM for these things.

Thanks again Surge. kickin ass finding a way to do something that so far, has never been successfully done yet on our phone. That's like a +100 in my book lol.

[MENTION=4928866]ICSthunder27[/MENTION] Well, I'm pretty sure after looking through some of the file that, yes, you can create a working kexec if you know what you're doing and follow the general instructions that Surge has hidden through out the zips :p
[Verizon Samsung Galaxy S 4] RuggedHunter:
I wonder the same things. I have to use my phone for work, about every 5-15 min or so, all day long...so I'm not confident enough to play around with anything until I understand it. But I think that those who do understand it are well into working something out that's easier to use...some exciting posts in the SafeStrap thread.

:)

Edit: [MENTION=4928866]ICSthunder27[/MENTION]

http://xdaforums.com/showthread.php?p=55835995
[Verizon Samsung Galaxy S 4] ICSthunder27:
Can you link to that thread?
[Verizon Samsung Galaxy S 4] scryan:
You guys may remember the bypasslkm thing, everyone wanted to know how they could use it... But the truth was that it isn't for ordinary use like its some fun toy, it is a development tool that allows the loading of unsigned modules (allows drivers or portions of code that are not officially check by samsung to be added to the kernel and executed.

By contrast, this IS for users BUT ITS NOT FUNCTIONAL. That is part of why its not posted as something you can flash... If you can't build it and get it on your phone, its probably not for you as this build is mosting being offered to show where we( they) are at, and see if anyone can help it work properly.

Kexec is the module, if everything is fixed and it is made to work properly it will replace the kernel while the system is still running. The point here is that currently we can replace basically everything BUT the kernel, which prevents things that don't use the stock TW kernel (ASOP, CM, ect...) from being used as well as requiring us to take OTAs (that further patch the bootloader and any other vulnerabilities) to update to newer versions.

The idea is that safestrap will boot, hijack the boot process and use kexec to load the proper kernel and then load the new rom.

If kexec works, we won't have an unlocked bootloader.... But we will be able to accomplish basically everything you can with one.
[Verizon Samsung Galaxy S 4] Surge1223:
+1 exactly this.

I actually probably posted that too soon because I just finished porting the entire kexec hardboot patch to our S4, I don't know if it will work (there's a stage where its kind of guess and check as you go). The good news is that I've been working on trying to get kexec to work the hard way this whole time, not releasing what the hardboot patch was until I read it.
[Verizon Samsung Galaxy S 4] jgrubbs:
All Great things take time! Just glad there are still people willing to take time to do this for people! Thank you!
[Verizon Samsung Galaxy S 4] eragon5779:
Out of curiosity, will this work on the S5? Or does it need to be modified for it to work?
[Verizon Samsung Galaxy S 4] Walter.White:
For anyone wondering what the hell [MENTION=4939386]Surge1223[/MENTION] is working on...

Here is some good FAQs regarding the kexec hardboot approach. http://xdaforums.com/showthread.php?t=2104706

Guide to port a kexec hardboot patch. https://github.com/Tasssadar/multirom/wiki/Porting-kexec-hardboot

---------- Post added at 12:49 AM ---------- Previous post was at 12:25 AM ----------

[MENTION=4939386]Surge1223[/MENTION] Here is something for you to look at. Might be helpful.

https://github.com/CalcProgrammer1/kernel_quincyatt_kexec

(It took [MENTION=639326]CalcProgrammer1[/MENTION] 2 years to getting it working on Note 1 :p) http://xdaforums.com/showthread.php?t=1787856
[Verizon Samsung Galaxy S 4] CalcProgrammer1:
Are you porting to the S4 or S5? If it uses device tree then it's going to be a bit more work than what I did for the Note 1. The Note 1 uses ATAGs which the stock kexec-tools handles no problem, but on the Note 3 which I'm also attempting to port kexec-hardboot/kexecboot to it uses device tree and even with the hardboot patch applied I have been unsuccessful in actually getting the kexeced kernel to boot. I know the hardboot hook is activating as it hangs on reboot as well, it's something to do with the new kernel and the device tree image.
[Verizon Samsung Galaxy S 4] Walter.White:
[MENTION=4939386]Surge1223[/MENTION] and I think [MENTION=766721]ryanbg[/MENTION] are working on getting kexec working on S4 and N3. You should team up with them :) More people tackling this thing the better shot we have.
[Verizon Samsung Galaxy S 4] TheLoonyRebel:
Here's the kexec thread for the Verizon Note 3 by [MENTION=5868929]hsbadr[/MENTION]

http://xdaforums.com/galaxy-note-3/devs-only/kernel-kernel-execution-loading-custom-t2812650

I totally agree the more people working on this the better shot there is to get this going. :D
[Verizon Samsung Galaxy S 4] Surge1223:
S4 uses atags, so I don't have to worry about dtb for now, I'm also doing this simulatenoulsy for the note 3 though too so I decided to combine atags and dtb support from various kexec-tools sources.

I like the idea of traditional kexec more than the hardboot patch kexec but I'll take it anyway I can get it.

I've been meaning to analyze the note 3 kernel in more depth, it's am invaluable source being able to analyze a decompressed zimage in ida, that along with storage and objdump are my best pals.

So note 3/s5 will be a bit tougher I gather..
[Verizon Samsung Galaxy S 4] CalcProgrammer1:
I've been following hsbadr's thread for module-based kexec as well. Hardboot seemed the simplest route for bootloader-unlocked devices while module-based works on locked as well. I have the unlocked N900T so I went for hardboot. I managed to get RAM console/last_kmsg working on the Note 3 to catch boot messages from the kexeced kernel but to no avail, tried both normal kexec load as well as hardboot. I'm using Tasssadar's kexec-tools source so loading the dtb shouldn't be a problem (it seems to choose rev 07 which is correct). Definitely keep me informed of any Note 3 kexec stuff as I could help as well as use some help. I've kinda put my progress on hold after hitting a roadblock (patch applied, holding after reboot, using what I think is a valid kexec-tools, working ram console, but still no signs of life) but if anyone has an idea where to go from here I'd love to try it and hopefully get this working. Ultimately I want to tri-boot CM11, TouchWiz, and Debian.
[Verizon Samsung Galaxy S 4] ICSthunder27:
This is amazing, so thankful for your hard work on this Surge.
[Verizon Samsung Galaxy S 4] DX.Deception:
X2 I'm so glad someone is working on this.
[Verizon Samsung Galaxy S 4] Bright09:
would this work on the i535 or is that different from s4 would have to be modified
[Verizon Samsung Galaxy S 4] Surge1223:
I actually also have the i535, and I admit I havent looked into whether it would work or not, but I do believe that with a patch you guys could also have custom kernel modules re-enabled. I might check later but I usually do stuff at night, and as Adam Sandler says "The night time, is the right time"
[Verizon Samsung Galaxy S 4] Walter.White:
Correct me if I'm wrong but our AT&T N3 Kernel doesn't support modules all together (Not signed ones or unsigned ones) (checked using lsmod in terminal). So I'm guessing this kexec stuff wont work for us correct? Or have found a way to enable the module support?
[Verizon Samsung Galaxy S 4] Surge1223:
I actually have tried to twice on the att n3 kernel. The issue is SELinux being enforcing thus blocking access to /dev/mem and kmem. I think it's entirely possible to enable kernel modules if SELinux can be set to Permissive, but so far i haven't been able to get the att n3 kernel Permissive, even in safestrap.
[Verizon Samsung Galaxy S 4] Walter.White:
Gotcha. I wish someone would leak us ATT folks module enabled kernel like they did for VZW N3.
[Verizon Samsung Galaxy S 4] scryan:
So....

I'm lucky I on... verizon?

Really?

Figured they would have been the biggest asshole/best at it.
[Verizon Samsung Galaxy S 4] RyaNov1333:
I have been following this thread for a while, but seem to have gotten lost in it. Will the kexec method be limited to one firmware version? If so, which one? MK2 or NC5, because currently I am on NC5.

Really hoping I didn't screw myself over again here for the second time.
[Verizon Samsung Galaxy S 4] Bright09:
would be great to have a unlocked boot loader again thought sucks my og s3 died and if you could look that be awesome thanks
[Verizon Samsung Galaxy S 4] Walter.White:
Got #^$&^#& awesome news for you man.

I was successfully able to set SE to Permissive on my ATT N3!!! (on NC2 Kernel).

Edit: Look at the attached pic.
[Verizon Samsung Galaxy S 4] k1mu:
Yeah, but...

At least on the Verizon I545, most of the places in the kernel that check the enforcing flag ignore it and are hard-coded to enforce independent of the setting.

Changing that to read "Permissive" is pretty easy. Getting that to matter is hard.
[Verizon Samsung Galaxy S 4] Walter.White:
:( Damn it.

Edit: Do you know how exactly I go about checking to see if its completely disabled?

---------- Post added at 10:53 PM ---------- Previous post was at 10:25 PM ----------

[MENTION=3940199]k1mu[/MENTION] What about this? Is there another way I can verify?
[Verizon Samsung Galaxy S 4] Surge1223:
If you can successfully use devmem2 or viewmem then that's good enough for the purposes we need.
[Verizon Samsung Galaxy S 4] NighthawkXL:
Hey [MENTION=4939386]Surge1223[/MENTION]

This implementation should work on the i337 (NB1 / NC1 / NI1) as well with minor adjustments correct? My poor inbox is being flooded with that question from people over on the AT&T S4 forum who follow this thread. I can't recall if we had a definitive answer to this on one of the others page, I went back a few and couldn't find anything. That being said keep up the awesome work, wish I could help a bit more then playing the role of power user.
[Verizon Samsung Galaxy S 4] Walter.White:
Looks like it works! Is there anything particular you want me to run and give you an output of?

Edit: viewmem definitely works. I tried the following and it spit out a log.

viewmem 0xF8F087E 0x1000000 | strings -n 8 > /sdcard/bootlog.txt
[Verizon Samsung Galaxy S 4] Surge1223:
Yeah, I can't remember if it was nc1 or nI1 but for the module loading script I made but I added the ATT boot.img to it, I'll probably have to update the address since I think you guys got an ota since then.

Awesome! Next would be sending me the boot.img and I'll make sure it can load modules before I add the address to the script I already have for ATT s4 and vzw s4 (modload)
[Verizon Samsung Galaxy S 4] Walter.White:
Here you go. http://d-h.st/iQJ
[Verizon Samsung Galaxy S 4] DX.Deception:
So would this mean that we could load custom roms on NC5 without safestrap? I hope so cause I'm really missing the AOSP projects.
[Verizon Samsung Galaxy S 4] NighthawkXL:
Yes, we did NI1 which came out a couple weeks back. It's still on the same increment as NB1, and NC1 allowing folks to downgrade to NB1 using Odin.

Well, Safestrap would still be needed. But hopefully if everything works as planned we'll be able to flash AOSP, CM, etc. ROMs along with injecting the needed custom kernels to run those projects.
[Verizon Samsung Galaxy S 4] DX.Deception:
That's awesome.
[Verizon Samsung Galaxy S 4] Walter.White:
[MENTION=4939386]Surge1223[/MENTION] Since you are also working on SS, I got a question for you.

On N3 and S5 (unlike S4) aroma in SS doesn't work. And according to [MENTION=4243514]Hashcode[/MENTION] its because of "This is due to the stock N3 & S5 kernel framebuffer. To build a recovery which worked, it needed QCOM patches. So will Aroma."

Is there anyway we can get it working now that the SELinux is set to permissive? I do see framebuffers located in '/sys/class/graphics/fb0', '/sys/class/graphics/fb1' and '/sys/class/graphics/fb2'. I would love to get aroma working on N3s and S5s :)
[Verizon Samsung Galaxy S 4] Walter.White:
Knox 2.0 hahaha

http://www.androidpolice.com/2014/1...-knox-2-0-improved-connectivity-enhancements/
[Verizon Samsung Galaxy S 4] crhylove:
Gross. No os update, but we'll go ahead and make it harder for you to do, so the lazy will just buy the new model. God damn I hate corporations.
[Verizon Samsung Galaxy S 4] skepticmisfit:
Knox is never a problem for root users, SuperSU disables it the minute it gets installed, and although it is integrated with TrustZone, it is kind of different from what I understand and may still be removable altogether
[Verizon Samsung Galaxy S 4] NighthawkXL:
Well, looks like the LG G3 was unlocked earlier today...

Between it, and and the HTC / Moto unlocks that resulted from Dan's TZ exploit. We've really fallen to last place it would seem. As much as I hate to admit it Samsung did make this device a Fort "Knox" ~

At least we still have hope with the ongoing development of kexec which will mostly offer the same benefits of being on a unlocked bootloader.
[Verizon Samsung Galaxy S 4] gsciullo17:
Maybe since all of the other flagship devices (mostly) have been unlocked, the developers who unlocked these may focus on the S4. Not probable, but if we spread around that the developers here are getting somewhere with kexec, it might lead to more developers noticing this thread, especially since the developers here have made significant progress to a workaround for the bootloader.
[Verizon Samsung Galaxy S 4] kevinco1:
I've been trying to do this myself. I'm confident that the S4 would've been unlocked by now if so many devs wouldn't have jumped ship so early.
[Verizon Samsung Galaxy S 4] Genaugmen:
Late in the game...

I just picked up a s4 active because I saw that it could work with t-mobile's lte. This phone is stock on 4.2.2. Am I better off staying on 4.2.2 for the sake of being able to benefit from your efforts here more? And do the updates provide any significant changes? I had a droid bionic a little while back (like I said, I'm late in the game), which also had a locked BL, but safestrap worked, and I used a number of different roms on it. What makes things so different with this phone's hardware/software that has made this a no go??

And one other unrelated question... A sim unlock that works, and you don't have to pay for it? My Active's on 4.2.2 MF3.

Don't chastise me for going off topic. Pity me because I'm stuck using a LG F3 right now, and give me some guidance. Me and Google are close associates, but he's not my friend. He often sends me on wild goose chases.
[Verizon Samsung Galaxy S 4] s44:
Doubt it. (1) it's better secured, (2) anyone who cares already has or can get a MDK/non-Verizon+AT&T model.

The Active is a distinct device - similar but not quite the same as the regular S4. You should check out the specific forums for it on XDA.
[Verizon Samsung Galaxy S 4] emarietta:
What are the risks with it?
[Verizon Samsung Galaxy S 4] Surge1223:
If it messes up, then you have to odin restore. If the rom isnt compatible but you try it anyways...odin restore. If you have busybox or su set up wrong and this effects the script...odin restore. If you overwrite framework-res.apk w/o being able to set permissions...odin restore etc, etc.

Based on the amount of repetitive questions in Q&A from people too lazy to read or from being too reckless, I can only imagine how much of a nightmare it would be to have to support a thread using that method for the S4. Imagine the amount of people who would attempt to flash an AOSP rom...

I suppose you can do this but I would never start that thread. Anyways thats all I have to say about that. It doesn't qualify as a bootloader unlock anyways. The goal here isnt to get MJ7 a custom recovery, its to find a way for MJ7 (and all other builds besides MDK/DEV for that matter) to have the ability to have a custom recovery.
[Verizon Samsung Galaxy S 4] failedjedi:
" The goal here isnt to get MJ7 a custom recovery, its to find a way for MJ7 (and all other builds besides MDK/DEV for that matter) to have the ability to have a custom recovery" I thknk one of the times you say recovery you mean ROM.
[Verizon Samsung Galaxy S 4] emarietta:
No recovery. We have roms for the s4 but not for the ones that have locked bootloaders. With a locked bootloader we cant get a custom recovery that allows us to install custom roms kernels etc..
[Verizon Samsung Galaxy S 4] hovax615@hotmail.com:
Yeah that's understandable. Wish I knew more that could help out more I was just throwing things out there. Some ideas and what not. I know the goal is to get custom recovery which I and everybody else would love to have, but safestrap would help out also.
[Verizon Samsung Galaxy S 4] Surge1223:
Don't get me wrong I appreciate the input. I was just saying.

Anyways does anyone know what the s4 equivalent of sboot.bin is? Would it be aboot? NON-HLOS?
[Verizon Samsung Galaxy S 4] failedjedi:
I get what he meant but he said the goal isn't to get a recovery it's to get a recovery. Just saying it seems likely he meant the first recovery to be a different word.
[Verizon Samsung Galaxy S 4] emarietta:
Surgs goal is to unlock the bootloader, not to load a custom recovery. The ability to have a custom recovery comes with an unlocked bootloader.so what he said is correct, not getting the mj7 a custom recovery but the ability to have one... but lets stop clogging up his thread so he doesnt have to read through useless posts for him
[Verizon Samsung Galaxy S 4] Brooklynsour:
Yes plz
[Verizon Samsung Galaxy S 4] Surge1223:
Okay so do we want to start mapping this board (see image) with locations, values etc? Itd be good to know so we could know where sdcard mode, ramdump mode and emmcboot are triggered.

Whats the policy on posting Qualcomm docs? I have quite a few, including the one describing how to get into sdcard mode on the I9500, I know its different but I also know that t-flash, sdcard boot etc is possible on our device as well. Then maybe we could flash this tar.md5 I put together in the Bootloader slot onto the sdcard. Ive attached the MDK version below.

BL_1545VRUAMDK_562219_REV06_user_low_ship_MULTI_CERT.tar.md5

Full Size image
[Verizon Samsung Galaxy S 4] NighthawkXL:
From what I can gather from doing a few quick searches there isn't one. As long they are available to the public you should be good, if they are leaked you may want to wait for a moderator to answer. If you can't post them here put them up on Pastebin and share the link via PM's to those who ask.
[Verizon Samsung Galaxy S 4] TMcGrath50:
Just wanted to say that I'm still out here. Unfortunately, it's exam week at my university, so I'm really busy with that. I'll be back with you guys whenever I finish. Keep working hard.
[Verizon Samsung Galaxy S 4] Surge1223:
F*ckers. Atleast they confirmed theres more than one vulnerability. That and we should pay more attention to the tz partition.
[Verizon Samsung Galaxy S 4] hemirunner426:
Has a compare been done on the tz partition of a dev and consumer device? Do we know if there are any hardware differences between a developer edition and consumer?

The latter question would determine where to take this. It would not surprise me if there are physically no difference in hardware and Samsung uses their own vulnerabilities to unlock their dev phones.
[Verizon Samsung Galaxy S 4] tshelby73:
I would also like to know if any difference hardware wise or if just software
[Verizon Samsung Galaxy S 4] Brooklynsour:
How long has that Samsung Knox article been out for? Its recent?

mf3 rooted SHOstock
[Verizon Samsung Galaxy S 4] tech_head:
not sure but they started publishing a bunch of docs recently.

Check this one out:

Customizable Secure Boot* Customizable Secure Boot ensures that only verified and authorized software can run on the device. Customizable Secure Boot is a primary component that forms the first line of defense against malicious attacks on devices with Samsung KNOX. In addition, Samsung Knox's Secure Boot technology allows the switch of the secure boot root certificate in a secure manner after the devices are shipped. As a result, customers that have high security requirements can purchase regular consumer devices and switch the root-of-trust used for secure boot to better protected ones.

* Customizable Secure Boot availability varies depending on hardware specification

and

Security-Enhanced Linux (SE Linux) is a technology invented by the NSA in 2000 and has long been

established as the standard for securing enterprise Linux assets. Samsung R&D teams have worked very

closely with the NSA to port and integrate this technology into Android. This port of SE Linux to Android is

commonly referred to as Security Enhancements for Android, or “SE for Android”.

and

The kicker:

The TIMA (TrustZone Based Integrity Measurement Architecture) has a policy that when the kernel or bootloader is detected as compromised the device shuts down.

If you update to 4.3 you no longer own your device. Samsung owns it and determines what is legitimate and what is not.

Image buying a car and being told that if you burn any other gas except what we sell, you can't use your car.

Or image buying a PC and be told that it's sold with windows so you *MUST* run Windows. Oh, forgot that new machines have "Secure Boot" designed by Micro$oft to lock out other OS on hardware.

Welcome to the "New World Order" where the hardware you buy is still really owned by the guy that sold it to you.

While they can't come and get it, they can lock it down and make it unusable.
[Verizon Samsung Galaxy S 4] Solissfiend:
Where there is a will, there is a way my friend
[Verizon Samsung Galaxy S 4] hemirunner426:
Whats to stop someone from switching to their own root-of-trust? Does anyone know if there is documentation out there on how to become a root trust authority?

The question is here is if TZ bases its compromised status on the root trust. If it does, then again, what would stop someone from creating their own root-trust authority, installing that policy on their phone, then installing their signed images?
[Verizon Samsung Galaxy S 4] gsciullo:
So what exactly is holding us back from handing this over to ROM developers and putting this on our devices? I know its not too stable, but exactly when will this be a reality for the everyday user?
[Verizon Samsung Galaxy S 4] Surge1223:
Short answer is that it doesn't work yet.

Why? I have no idea, that's what I'm doing I'm trying to get it to work. Okay saying I have no idea is a bit of a lie, it doesn't work yet because once the kexec image has been loaded and the syscall to reboot to the kexec kernel is initiated, it hangs and I'm debugging the hang and the hand off. I constantly change source trying to get it to get further and it seems that even if I do get the system to attempt to boot back up with the new kernel it still hangs somewhere along the boot process.

The other big thing is that I I'm hesitant to release a testing kexec safestrap version because at this point because kexec currently doesn't work.

There's a lot of things at play here.