yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] Leo G:
Well, not sure if this is what is needed but I figured I'd throw it in here.

http://autoomobile.com/news/samsung-galaxy-note-3-s4-unlocked-shortcut/10024934/

If this is worthless then delete it. If not then yay.
[Verizon Samsung Galaxy S 4] rrrrrrredbelly:
Others can confirm but guessing that's carrier unlocked and not the bootloader?
[Verizon Samsung Galaxy S 4] Leo G:
Not sure what it is unlocking which is why I mentioned it. To much of a noob to want to screw up my phone. I ODINed my phone and ended up with a bunch of problems and had to do a wipe. Not really looking to do that atain :silly:
[Verizon Samsung Galaxy S 4] DeadlySin9:
That's SIM unlock. Notice how one of the steps includes Network Lock? If I'm not mistaken this is an old method too unless it's been updated somehow.
[Verizon Samsung Galaxy S 4] npjohnson:
Alright guys. Chill out. I'd prefer to not have to bother the mods, cause, with previous issues, this thread would likely be closed.
[Verizon Samsung Galaxy S 4] oka1:
From the Moderator

To all in this thread .....

Post respectfully.............. or ........... DO NOT POST ....... easy

do not engage in personal postings this just gets you into trouble or worse.....

When posting ....... be kind, be civil ........... be helpful

Thanks ~~~ oka1
[Verizon Samsung Galaxy S 4] npjohnson:
Interesting stuff. Unfortunately, we've looked into a LOKI like attack @ SBL level, and it isn't viable.

We have a telegram chat with the guys that are working to unlock the Bootloader. If you are interested in joinin, just PM me (:

Also, good to see someone contributing to this thread.
[Verizon Samsung Galaxy S 4] slango20:
isn't viable as in too hard to flash the exploit? or isn't viable as in everything is implemented correctly? I can think of a method for flashing the exploit fairly quickly (deliberately brick aboot by unplugging an ODIN flash, and then use QDL to flash the exploit if we got that working, or use something similar to debrick.img using a specially prepped SD card to boot a custom aboot)
[Verizon Samsung Galaxy S 4] npjohnson:
The signature flaw LOKI relies on is not present in SBL set (even the MDK set).

As for your idea of injecting, if we were to find a sig bypass flaw in sbl, we wouldn't need to do anything more than dd an sbl to the correct partition. Unfortunately, we don't have a sig flaw, and LOKI (or alike it) isn't present.

EDIT: Following your train of thought, you wouldnt have to unplug an ODIN flash, you could just dd of=zero aboot, and, yes that would take you to QCOM mode, but QCOM Mode would only accept a signed aboot contained in a debrick SD Card. (And the loki flaw isn't present, so that method isn't viable anyway)

The NK1 address you found is cool though.
[Verizon Samsung Galaxy S 4] ryanbg:
QHSUSB mode would immediately reject the signature and header. You also need a flash programmer hex, a signed SBL1 (since that's the only image that PBL will accept), and you would need any of those images signed with Samsung's private key.

SBL1-3 do clobber boot protection meaning this type of exploit is not viable. Also, as stated previously, QHSUSB mode would only take a flash programmer or SBL1, and neither would have the ability to circumvent signature checking. You're thinking though.
[Verizon Samsung Galaxy S 4] npjohnson:
My bad, misunderstood what was looked for in a debrick IMG.
[Verizon Samsung Galaxy S 4] Failrunner:
Give up. by the time you figure it out the S4 will as extinct as the dinosaurs. It's not possible.
[Verizon Samsung Galaxy S 4] XxD34THxX:
Never give up. Hey, the OG droid is still going strong. I know a guy who uses it has his Daily.
[Verizon Samsung Galaxy S 4] Failrunner:
That sounds horrible. I can't wait till I can upgrade from s4 but I have some time unfortunately.
[Verizon Samsung Galaxy S 4] XxD34THxX:
It runs pretty good because it is Overclocked...

detracting from the point of this thread, stopping now.

Wait, is there any way one could set up a virtual machine with the s4 ROM to test methods of bootloader unlocking without risking actual devices? Something like Genymotion.
[Verizon Samsung Galaxy S 4] skepticmisfit:
probably no, since something like that probably won't be able to emulate the bootloader files (aboot.mbn, tz, etc) but don't quote me on that
[Verizon Samsung Galaxy S 4] npjohnson:
There are methods to emulate them. You can probably find it on Google.
[Verizon Samsung Galaxy S 4] dmt010:
Tried using qemu already. Maybe I'm just too stupid enough to figure it out, or maybe it's impossibro
[Verizon Samsung Galaxy S 4] npjohnson:
QEMU doesn't emulate the correct platform, and it isn't set up to load bootloaders.

You can use Qualcomm SDK's to emulate bootlaoders, but you have to request them, and you will likely only receive them if you have good reason to do so.
[Verizon Samsung Galaxy S 4] mdneilson:
Learning to break the S4 BL could lead to methods to crack others. Information like this is rarely held in isolation.

PS. I still have a mainboard to donate, if a verifiable dev who is working on this needs one for the cause.
[Verizon Samsung Galaxy S 4] sokrboot:
And you are suggesting "I want to exploit your product" is NOT a good reason!? LOL. I guess its all about which perspective you look at it. :-p

Good work all, keep it up!
[Verizon Samsung Galaxy S 4] XxD34THxX:
"Find Vulnerabilities in the bootloader"
[Verizon Samsung Galaxy S 4] npjohnson:
I'd definitely take you up on that for JTAG testing. Is it just the main board, and it it undamaged? (If so, that's perfect).
[Verizon Samsung Galaxy S 4] mdneilson:
Just the mainboard. I thought I knew where I put it, but can only find a spare i337 board. PM me your info, and I'll ship it off once I find it.
[Verizon Samsung Galaxy S 4] ryanbg:
The pinout for the SCH-I545 floating around is off by one pin. Starting from the bottom (away from the center of the mainboard, going towards it):

PIN 1 = VREF
PIN 2 = NTRST
PIN 3 = TDI
PIN 4 = TMS
PIN 5 = TCK
PIN 6 = RTCK
PIN 7 = TDO
PIN 8 = NSRST
PIN 11 = GND

Pins 9 and 10 are DBGACK and DBGREQ but you won't use them or have the hardware for it. Pin 8 is very important, and Pin 6 is optional (no significant difference with for what we're doing.) Pin 1 is also optional, but I usually use it to be safe, along with a nice clean ground on PIN11. You should be able to connect up to about 6Mhz before you start to get memory corruption. Any questions, ask.
[Verizon Samsung Galaxy S 4] npjohnson:
Will do. Thanks again man.
[Verizon Samsung Galaxy S 4] packerdon1:
Read this

http://xdaforums.com/galaxy-s4-verizon/general/rooted-galaxy-s4-t3158098

I used Kingroot to root my S4 lollipop 5.0.1, not sure if this helps the unlock issue or not. used this and Sunshine on my Verizon HTC M8 to get unlocked and S-off
[Verizon Samsung Galaxy S 4] STIKID:
The s4 has had root for years. Not related to bootloader but thanks.

Sent from my VS986
[Verizon Samsung Galaxy S 4] Weak_Key:
Is it possible to set new qfuses? From my quick research, it seems that the bootloader is signed with a 2048 bit key. If we can set new qfuses, I'm assuming a good number of the bits in the public key are 0 and thus could be set to 1. The signature itself would consist of a number of 0s which could be also be set to 1. This gives a very large target for generating a collision. In other words, could we write a bootloader, which can chainload any arbitrary bootloader, which also produces a signature which matches one of the very large number of possible modified signature-key pairings?
[Verizon Samsung Galaxy S 4] XxD34THxX:
qfuses are physical if I am not mistaken.
[Verizon Samsung Galaxy S 4] kcarden:
Yeah.. it's a physical fuse. The idea is practical... just not plausible. The fuses can only be written via jtag at the moment. There's a couple of fuses directly related to the private key... but we have to figure out what the values represent. As I'm pretty sure samsungs private key is more than a few digits.
[Verizon Samsung Galaxy S 4] Weak_Key:
So we aren't yet able to extract the key and signature being used?

It's a big long shot. I will invest more time playing with the crypto side of things once I have more time. Assuming a 2048 bit key, a 2048 bit signature, and that each bit is random, that gives us about 2048 bits of qfuse which could be blown. I'm hoping that there's going to be a shortcut here that will allow us to do much better than brute forcing 2048 bits. Their protocol does not seem to be a standard way to use RSA since we can essentially attack it from all sides--we have a chosen plaintext, chosen ciphertext, and chosen key attack available. If I understand the Samsung/Qualcomm? protocol correctly, we just need those three things to match up. So perhaps the crypto isn't as unapproachable as it appears.

As long as it's computationally feasible to a break the crypto in this way, it will only be a matter of time before we can figure out where the key and signature is stored and how to blow the new qfuses to create the modified signature and key. Of course at some point along the way a bootloader has to be set up. I am not familiar with bootloaders at this level. Could something like GRUB be ported and configured to chainload anything we want?
[Verizon Samsung Galaxy S 4] npjohnson:
No. We have looked into the private key fuses, but (in my opinion) aren't where the private key is actually checked from. Although we can write qfuses with a ton of work, no qfuse we know (that isn't already blown) relates to secure boot.

We could brute force the RSA, bit that would take something like 20 years, even in the multiple direction way you were talking about (not even sure that's possible).

OK, assuming we could change the private key to something we know by blowing a fuse (Which we CANNOT), we don't have bootloader source, so we likely couldn't make an "unlocked" aboot (No, TMO and SPR variants won't boot). Plus, if we had our own key in place at HW level, we could just sign a boot image with that key, and there would be no need for an unlocked bootloader.
[Verizon Samsung Galaxy S 4] zeb carter:
Bumping thread

Just a bump to keep it in the current list.
[Verizon Samsung Galaxy S 4] jaw20:
Hey! Thats supposed to be my job! An actual dev update may come out sometime in the future. Mainly due to the fact that there is nothing to report as of right now.

Sent from a Bump in the Road
[Verizon Samsung Galaxy S 4] phil0sophic:
S4 rooted for years

Not the 5.01 version, that's relitvly recent.
[Verizon Samsung Galaxy S 4] XxD34THxX:
It's too bad we can't just Sue Verizon for this :P..

Bump to keep this in recent and to give me hope...
[Verizon Samsung Galaxy S 4] wavedashdoc:
While I would have loved to see an unlock for the verizon S4, its just not going to happen. Which is why I switched to a Verizon Nexus 6. I should have never made the mistake of upgrading to an s4 after my galaxy nexus. If you want a bootloader unlockable phone, couple with kernel choices and roms, the choice is simple, get a nexus.
[Verizon Samsung Galaxy S 4] jaw20:
Don't listen to this man! He's a downer. Now i'm truly not allowed to say whats going on right now. But I think were on the verge of something here. But #NOHYPE for right now until we can get stuff going on our end.

EDIT: Guys do not under any circumstances update your BL to oc1 or higher!

My Duty to keep everyone in the ability to downgrade to nc5 has been fulfilled.
[Verizon Samsung Galaxy S 4] dmt010:
Thanks jaw..

Should i bother caring and abandon this thread if I'm on mdk or may this progression lead to something that may teeter towards a true unlock? (Will happily upgrade of course if it will)

Also , Ever heard of C7QDLtool by chance? Trying to find some information on it for something
[Verizon Samsung Galaxy S 4] blackops11252:
Never gonna happen! I can not believe this thread is still going
[Verizon Samsung Galaxy S 4] atx84:
I can't believe it either, I still have my s4 (currently note 4, same boat) if s4 ever gets boot I'm fixing the screen and will have a new playtoy
[Verizon Samsung Galaxy S 4] jaw20:
If you are on mdk you should be good BL wise because MDK has the LOKI Exploit. Which means you already have a BL unlock. Its really up to you if you want to keep watching the thread. I'm hoping that we're going to get something out in the coming days/weeks, but I make no promises.
[Verizon Samsung Galaxy S 4] wavedashdoc:
I'm not being a downer. I'm only speaking the truth. I'm excited you may be close to something. I enjoy the community putting forth the effort to make their devices, truly their's, I do. The reason I posted this is in hopes of encouragement for those looking at their next devices. Show Samsung, LG and HTC you want more offerings. Such as the One plus one, 2, oppo phones, and nexus line that support open development with a platform that was meant to be open, and secure by purchasing a phone with this sought after option first.
[Verizon Samsung Galaxy S 4] mike.s:
So, exactly what are your bona fides, to be able to make such an absolute statement?
[Verizon Samsung Galaxy S 4] real4life72:
I'm keeping my fingers crossed too that those out there that are able do these amazing things with the phones can beat this Verizon bootloader. I wish I understood all of what goes into trying to accomplish this. What I will say is thanks to those that are trying.

It's killing me not to be able to root my phone after rooting every other one I have had.
[Verizon Samsung Galaxy S 4] Beanerman:
You can Root the S4, depending on what version/build. I did both mine and wifes. Just can't unlock Bootloader yet.
[Verizon Samsung Galaxy S 4] jaw20:
This is pretty cool, I think you guys might agree

Also, just because its for the msm8974 doesn't mean it can't work on the s4 without some tinkering. Well, accept for the fact that were missing the zero write primitive he used, but I think we may just have that one covered.

Oh, remember how dan's exploit came out a little over a year ago? And you know how Dan said it wouldn't lead us to an unlock? He was wrong.

Prepare your minds
[Verizon Samsung Galaxy S 4] rp1226:
Can't wait. Looking forward to hearing more from you soon!!!
[Verizon Samsung Galaxy S 4] tshelby73:
We will see

Sent from S4 using the better than it was then they jacked it again Tapatalk
[Verizon Samsung Galaxy S 4] skepticmisfit:
are we starting the hype train, or is this exploit mostly going to be dev only stuff?
[Verizon Samsung Galaxy S 4] dmt010:
I'm hyping for a true unlock and none of that Loki garbage ;)
[Verizon Samsung Galaxy S 4] gadget!:
Myself and a lot of happy MDK users would argue that statement.

sent from a Galaxy far far away.
[Verizon Samsung Galaxy S 4] skepticmisfit:
Loki is supported by pretty much every major recovery and ROM. the only situation where it would be a problem is with touchwiz ROMs, which

eh

not my thing.

don't complain about what you already have. this probably won't be an actual unlock. idk what it is but it's not likely that an unlock is in the cards
[Verizon Samsung Galaxy S 4] doubleaykay:
Based on [MENTION=5552234]jaw20[/MENTION]'s teaser, it looks like it may be a full unlock...

[MENTION=5552234]jaw20[/MENTION] any updates or ETA?
[Verizon Samsung Galaxy S 4] scryan:
errrr.. did you read it? Based on the information he gave..... We have literally nothing.

The exploit that is detailed in the article he linked to has several steps that build off each other.

At the start, one exploit is available: the ability to take an address in memory and change it to 0. As the article explains, this is rather limiting as it does not in itself allow code to be ran, it just lets you change memory. But you can't even change it to what ever you want, so its not like you can load anything you want into memory.

However they realized when you tell the normal system to load data to memory, it checks the location of memory you requested to write to, in this way your prohibited from writing to the trusted zone area of memory.

It does this by checking a table of addresses, if the value in the table is 0 you can write to the address, if the value is 1 then you can't

They used the ability to write zeros to zero out the whole table. So when the check is done to see if the area your trying to write to is blocked it always comes back no.

This was then used with a few other steps that are require to generate and write the desired code to memory...

But the point is, the very very basis of this exploit is that zero write primitive.... The one that jaws said we don't have.

I don't know what they are working on, or if they have something similar to that ability to write zeros.... but the given information does not directly help us if they don't already have some other trick figured out.
[Verizon Samsung Galaxy S 4] RuggedHunter:
He did say that they think they have the zero write problem covered already...and also that Dan was wrong when he said we couldn't unlock.

...who knows what any of that means...

AT&T S4 i337 > SafeRoot > SafeStrap 3.71 > HyperDrive RLS12

Tasker-ized
[Verizon Samsung Galaxy S 4] daredevl99:
To clarify. Yes at the moment this is the start of a hype train. we have nothing substantial yet. Everything is still being developed debugged etc. Dan stated his exploit would not itself directly lead to a exploit. We do not have a "on off switch" like the devices he demonstrated. The zero write primitive and dans exploit are both bounds check bypasses. Which are needed for access to secure mem write. Which in turn can lead to other exploits. There is no guarantee that anything will come of this. Uncharted territory.
[Verizon Samsung Galaxy S 4] gahndii:
Either way thank you all for your hard work and know how.

Your efforts are appreciated!
[Verizon Samsung Galaxy S 4] sokrboot:
I have hope because [MENTION=4939386]Surge1223[/MENTION] and others have already given us the ability to load modified kernels and other advancements. Plus [MENTION=5552234]jaw20[/MENTION] is usually pretty conservative with his statements of progress and he made some pretty clear indications that this is quite promising. Also, the blog author specifically states that the S4 is one of the affected devices. For those that aren't as upbeat about this as I am what specifically about this exploit isn't as great as I think it is?
[Verizon Samsung Galaxy S 4] scryan:
I guess I have been the only "negative" one about it... And I don't mean to say it isn't great.... or even be negative...

Just pointing out that from the information posted so far in this thread... nothing can be done.

Reading the article, just every bit of it evolves from that zero write primitive. Without that ability, were sitting here staring at the finish line ago with no footing to get started. We have always known where the finish line is... Its that damn starting line that is elusive.

And while yes to some degree:

What he actually said was

Which while it is better then "we don't have this covered", does not read the same to me as "we have this one covered"

So basically the very foundation of the exploit is not something we have, and we only "think" we "may" have something for that. TBH this isn't the first time we though we might have something.

Please don't take this as overly negative. I'm not (and not capable) doing the work to really know exactly where they are at... I am just saying the very CORE of the posted exploit is missing, and we don't know that we have anything to replace it. That is where we are at. Hopefully do they figure something out.

Like this one from may?

No problem with Jaw20, he knows more then me on the subject, and has done more work, ect, ect... All respect due to him. But yeah he does like to start up the hype train. The above post was follow almost immediately by surge having to come in and say we weren't that close. In fact looking back jaw20 has popped in plenty of times to say we are getting close throughout the life of this thread. Sorry again, not trying to be negative and put people down. Just managing expectations.

Will be great if they finally get this. I remember the PS3 was unbreakable too, until they finally did it.
[Verizon Samsung Galaxy S 4] sokrboot:
I'm just thinking that since the blog author says the S4 is affected and the MSM8960 chipset is so similar to the MSM8974 then maybe it's "only" a matter of mapping addresses specific to our device/chipset. (But I'm a n00b and can't do any of what our devs have already accomplished, so what do I know?) [MENTION=5493962]scryan[/MENTION] [MENTION=5552234]jaw20[/MENTION]
[Verizon Samsung Galaxy S 4] jaw20:
Most of those things relating Specifically to me, ie "Jaw20 likes to start the hype train etc. etc." Are more or less true. But, I want you to take a look at Dan's exploit from Black Hat 2014. Make sure to also read his WP very carefully. Also I made a mistake, is wasn't specifically Dan who said it wouldn't work it was jcase who said that it wouldn't work.
[Verizon Samsung Galaxy S 4] scryan:
Again don't take it for me saying anything other then we will know when we know, and that from what is presented to me its not enough.

But yeah, I do need to go back and look at Dan's exploit, as I did not go through it that much when it was published, and I do remember stuff about writing to the TZ, but also thought I remember where you were writing being somewhat random? Like I said, I am pretty ignorant of that last exploit by Dan, and was planning on going back and looking at it to see how it related.

I do hope they can make it work though. From what I remember the S4 is pretty damn solid apart from the whole locked down thing. The only reason I got rid of mine was to avoid ****ing around every time there was an update.

Edit: So I planned on spending the afternoon getting some stuff done on car... but instead I snapped a drill bit off and poke a hole in my hand so I can back inside to bleed... or rather try to stop.

So I spent time reading instead.

Read through, and he really really details how the moto unlock process works... Then he gets to the point where he needs to write a value into the trusted zone:

but I knew I would need a vulnerability in the TrustZone kernel in order to set this
flag to zero, allowing my SMC call to blow the QFuse required to unlock the bootloader.
Fortunately, I didn't have to look long, since one of the other SMC commands in the
same section of the TrustZone kernel contains a fairly obvious arbitrary memory write
vulnerability:

switch (code) {
...
case 9:
if ( arg1 == 0x10 ) {

for (i = 0; i < 4; i++)
*(unsigned long *)(arg2 + 4*i) = global_array[i];
ret = 0;

} else
ret = -2020;
break;
...
}

This SMC call, invoked with command code 0x9, is evidently intended to allow the Non-
secure Linux kernel to obtain values stored in a particular region of Secure memory. The
value provided as the second argument in the SMC buffer is used as the physical address
at which this memory is copied. This code does not check that the provided physical
address corresponds to a Non-secure memory region, so it can be used to overwrite
memory in a Secure region, including our global flag.

Maybe my lack of programing knowledge shows here... But I don't understand the exploit he uses to zero the flag, as he describes above. However it does seem he can write data/zeros to a chosen spot in the TZ...

So with that it does sound more promising. Heres hoping it all works out :)
[Verizon Samsung Galaxy S 4] Bright09:
is anyone working on the i535
[Verizon Samsung Galaxy S 4] skepticmisfit:
probably not, as that phone has no demand. early ICS and JB bootloaders could be unlocked but nothing beyond 4.1.2

so to answer your question.. probably not
[Verizon Samsung Galaxy S 4] jaw20:
That seems to be the wrong exploit. Are you sure that's the one from black hat? It should be the one called, "Reflections on Trusting Trustzone"
[Verizon Samsung Galaxy S 4] scryan:
Its from the very bottom of his blog post about unlocking moto phones with TZ exploit....

Taken from this

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html
[Verizon Samsung Galaxy S 4] blackra1n:
So, after reading a few of the posts here, are we close to getting a bootloader unlock on the Verizon S4? I would love to be able to flash any ROM I want lol.