yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S 4] jamesd1085:
just wondering...

Might be a stupid question...but is there any way to full wipe the device removing all the new updates while leaving Odin mode and USB connectivity intact...if we could just erase the stuff blocking the downgrade ability the maybe mdk would be flashable via Odin...just a thought
[Verizon Samsung Galaxy S 4] MehStrongBadMeh:
Qfuses are a primary component preventing downgrade and they cannot be reverted once tripped. Believe me, if it was as easy as what you were describing, it would have already been done.
[Verizon Samsung Galaxy S 4] TMcGrath50:
What are the commands? Sorry, I'm not familiar with the partitions.
[Verizon Samsung Galaxy S 4] phobia09:
Believe me guys, I don't want to clutter the thread at all, but I posted this a few weeks ago in a "Stupid questions thread" and never got a response. I've got it quoted below, if anyone can at least clear up what I've suggested, I would appreciate it.

"I've got a question regarding the locked bootloader and qfuse incrementation. I've done a little reading about fuse incrementation in general and qfuses. I don't fully understand it (let alone the whole process, hence why I'm in this thread) and was hoping for some clarification. Since we know what goes on in our devices when a qfuse is blown and understand that we obviously can't go back; would it be at ALL possible to, say, somehow force a qfuse incrementation with a modified image of some sort? Perhaps one with an unlockable (or exploitable) bootloader? Just a thought I had, any clarification would be great, thanks."
[Verizon Samsung Galaxy S 4] MehStrongBadMeh:
Yes, but it would serve no benefit to the s4.
[Verizon Samsung Galaxy S 4] Surge1223:
we can still try to edit the pit, create another partition for an modded aboot (most likely the dev aboot) breaking the COT there or we then let the modded aboot verify the unmodded aboot and let it boot from there. We'd need to get the address that calls for the security check at aboot in order to replicate the valid security response. Im already working on building the emmc structure from scratch but i think im going to start working on both ideas simultaneously...might get more insight that way
[Verizon Samsung Galaxy S 4] ztkryan:
Is there a place I can download the bootloader files for all the otas? I would like to dig into them a bit in IDA
[Verizon Samsung Galaxy S 4] k1mu:
That's because what he's doing won't work.

A digital signature is created from taking the content, hashing it, then signing it with a private key. The certificate contains the associated public key for that signature, which allows that signature to be validated.

You can't modify the content then move around certificates to make it validate. That won't work.

If you have the PRIVATE key associated with that cert (i.e. from a leak), then you can replace the signature. Without that, no way.

I do this stuff for a living: information security support for one of the largest public key infrastructures in the world outside of the US Department of Defense. Trust me, this is a waste of time. You can't fix this with moving certificates around.
[Verizon Samsung Galaxy S 4] Surge1223:
Alright I made a zip that contains important sch1545 details. It has all the partition tables, the gpt and some other useful stuff. I'll update this post later today but in case anyone else is trying to find a exploit or is curious you can download the zip here
[Verizon Samsung Galaxy S 4] jamesd1085:
odin

I was looking at the files you posted...and the thought came to me...maybe instead of trying to change the flashable files we use in Odin maybe we need to look at modifying Odin itself...I don't know if Odin or the device itself is stopping the install of modded files...but if Odin is the problem why not change the way its working to suit our needs...also looking at the partition files you uploaded could something be flashed onto one of the unused partitions to hijack\bypass the bootloader? Just a couple shots in the dark
[Verizon Samsung Galaxy S 4] :
Have you tried doing your proposed idea?
[Verizon Samsung Galaxy S 4] jamesd1085:
Haha...no...I haven't played around this deep in dev for android in like...ever...lol...i was a novice at best 3 years ago when i just got too busy to keep up...android has evolved so much since then...especially in regard to security and locking devs out...I may go through some of the forums to catch up a bit...but i was mainly throwing some ideas out there hoping to start a fire in one of our mad devs heads...
[Verizon Samsung Galaxy S 4] Surge1223:
Odin only allows signed files to be flashed, and the issue is that our phone has secure boot enabled meaning each bootloader partition is checked to be valid and has to pass security checks before flashing the next partition.

Our device uses secure boot type 3 which isn't completely understood but the fact it goes into emergency dl mode instead of completely dying is significant since it suggests we should be able to revive it. This is compounded by the fact that other devices with msm8960 chips being able to boot in sdcard mode (e.g. note 3 debrick). What we've also learned is that other gs4's on the same chipset are able to be enumerated to switch from QDL mode into MMC Storage USB mode where the gpt and mbr can be rewritten to the device without jtag. This gives us hope.

We cant use any empty partitions for an exploit, but might be able to trick the phone to use a modded aboot if we can somehow query the address that is checking aboot and get the valid response and maybe give a custom header that address. But thanks for posting your idea, its getting stale with no one brainstorming in here so I appreciate your input.
[Verizon Samsung Galaxy S 4] jamesd1085:
Haha...yeah...brainstorming is about the most I can do till I have the time to sit down and read up and learn about all the new crapola that has been integrated since I last dug into Linux/android
[Verizon Samsung Galaxy S 4] jeboo:
To be more specific, aboot only allows properly signed files to be flashed. Attacking ODIN PC-side has no benefit.

It all comes down to finding an exploit in sbl/aboot. The COT appears to be solid in its implementation.
[Verizon Samsung Galaxy S 4] Surge1223:
Thats true. You can flash the other parts of the bootloader (sbl1-3, tz, rpm, modem, apnhlos) but aboot is checked by more than sbl3. Although besides aboot/sbl vulnerabilities the TrustZone is also viable option.

When you guys were trying to use jtag to flash mdk over me7 do you know if anyone got a pbl dump? Or atleast got mmcblk0boot0 or any hidden partitions?
[Verizon Samsung Galaxy S 4] Surge1223:
Okay, here we go. I use linux as my OS but I think I'm going to need help analyzing some log entries. This is a log of a bricked GS4 connected to a working GS4 via otg usb. One is in QDL mode the other is working and getting logs through terminal. Anyone see any calls or areas where we could attempt to write our own mbr and gpt to it? or at least any addresses we can manipulate? Theres a lot of info going on here. Comments/ideas/suggestions are more than welcome. I posted this in general for a reason, I don't care if you have 0 thanks and 0 posts...if you have a good idea then post it.

Will upload relevant areas of log here:

View attachment recovery.txt

View attachment usbtos4.txt

I hope someone atleast looks at them...I don't want mine to be the only eyes on this regardless of if it turns out useful or not
[Verizon Samsung Galaxy S 4] thunderbls:
I have two eyes and would be happy to help read tborough this if I knew what I was looking for.. sorry to clog up the thread with what may be a useless post.
[Verizon Samsung Galaxy S 4] Fu5ion:
Been a while since I got back into Dev work (used to do some work with vanir). Nows as good a time as any to get back haha. I'll take a look.
[Verizon Samsung Galaxy S 4] KaratemanTJ:
Apparently this didn't stick when I posted it earlier...

Is there an MSP430 onboard somewhere or is there just support built into the kernel for some reason? Also, I see a lot of I2C calls. Is that maybe something we could tap into? Just some quick, probably irrelevant thoughts. Thanks for the hard work!
[Verizon Samsung Galaxy S 4] joshm.1219:
Surge already posted a method to kind of do that
[Verizon Samsung Galaxy S 4] Diego1751:
Wait is it possible to downgrade from KitKat?

In other words is it safe for me to take the update and keep root but when we figure out something here still do that?
[Verizon Samsung Galaxy S 4] tshelby73:
You can downgrade everything but the bootloader so if you have nc5 bootloader and a exploit is found for mk2 you are sol

Sent from S4 using Tapatalk
[Verizon Samsung Galaxy S 4] Hashbang173:
Uh oh, Knox 2 probably coming soon the Verizon S4's as well. Does this mean it will get even HARDER to get this Bootloader unlocked or get root.

http://www.xda-developers.com/andro...obile-s5-gets-a-few-new-goodies-and-bugfixes/
[Verizon Samsung Galaxy S 4] decaturbob:
I'd say yes to both....

sent by safestrap enabled bajarom
[Verizon Samsung Galaxy S 4] eheinzeiii:
That's crazy. As if they haven't gone far enough. All I want is a lil asop action on my s4. that would make me so happy.
[Verizon Samsung Galaxy S 4] lazer9:
Well if you read the article, towards the bottom, it indicates to a thread for the S4 elsewhere that it has already been Rom'd, so that would likely assume there is root achieved at least. I think the name of the ROM (though not for Verizon as of now) is named GoldenEye. Check the article towards the bottom.
[Verizon Samsung Galaxy S 4] decaturbob:
There is no native root method for NC5. No exploit found yet.

sent by safestrap enabled bajarom
[Verizon Samsung Galaxy S 4] pyroman512:
Is the focus mainly on unlocking the MK2/MJ7 bootloaders or are all the others still at play too? I'm still on ME7. I'm wondering if it would be a good idea to stay put. I want to use safestrap but it seems the popular ROMs are MJ7+
[Verizon Samsung Galaxy S 4] waffles730:
threatpost .com/researcher-unlocks-samsung-galaxy-s4-bootloader-for-att-verizon-android-phones/100757

(sorry, need to fix the link - can't post links yet)

Edit: I misread the date on that article, thought it was this year... I'm an idiot. It is probably no longer relevant.
[Verizon Samsung Galaxy S 4] michaelg117:
I don't know as much as others but this looks promising..
[Verizon Samsung Galaxy S 4] lazer9:
Here's the actual article: http://threatpost.com/researcher-un...tloader-for-att-verizon-android-phones/100757

Interesting :good:

Edit: Crap, I seen the original poster's edit comment about the date. This is a year in the past.
[Verizon Samsung Galaxy S 4] waffles730:
I'm an idiot and misread the date. Dan Rosenberg's blog post has some serious detail, though perhaps it no longer relevant with the more recent bootloader versions.

blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html
[Verizon Samsung Galaxy S 4] Red_81:
That is the loki exploit that those of us with the mdl bootloader use to flash custom roms.
[Verizon Samsung Galaxy S 4] waiters:
Yeah he never actually exploited it. Was all fake.. Loki was released though..
[Verizon Samsung Galaxy S 4] sokrboot:
????

Loki *is* the exploit Dan found. It is quite real for those on MDK bootloader. Perhaps you meant he didn't actually unlock the bootloader, which is true.
[Verizon Samsung Galaxy S 4] Diego1751:
Anything guys? We can't give up Hope
[Verizon Samsung Galaxy S 4] LiLPurP:
Well i dont think Surge would just quit without some kind of notice, but at the moment the kitkat firmware getting root is more of a priority, but im sure the devs are still hard at work, its best we just wait patiently

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] budding_developer:
For those looking to achieve rooted 4.4 "KitKat", check out this post by surge1223 -- it works, and I am now running a rooted installation of the NC5 "KitKat" firmware on my latest phone (a Verizon i545 that came with MK2 on it).

As for the bootloader exploit, much of the hype flowing around the web is simply a re-hash of Dan Rosenburg's (djrbliss) 2013 announcement of the "Loki" exploit.

I DID hear, though, that Dan has supposedly defeated the S4 bootloader again but was holding announcement of actual code until after the "formal" release by AT&T/ Verizon of the NC5 firmware (so that they can't patch it before release). Here is a link to the write up for Blackhat USA, where Dan was supposed to actually demonstrate the unlock method.
[Verizon Samsung Galaxy S 4] mikeneff2006:
Hasn't the NC5 OTA update been officially released for both AT&T and Verizon?

I mean I would definitely love to see Dan kill this endless year with out a exploit but didn't Dan also say he was completely done with android divices as well?
[Verizon Samsung Galaxy S 4] budding_developer:
My suspicion is that he wants to wait and make the grand announcement at BHUSA... and that isn't until August.
[Verizon Samsung Galaxy S 4] sokrboot:
I just read the article...wow! Sounds like the Samsung's bootloader really could be the subject of his talk. I also remember a tweet that Dan sent out a few weeks ago saying something about an exploit on the S5 that if the XDA community could could get to work he'd be very impressed. Could be nothing or coincidence or completely related...any bootloader unlock for a KitKat S4 bootloader should in theory apply to an S5 bootloader. This it would make sense for him to wait until BHUSA bc it's a big stage, KK will be rolled out to S4 *and* there will be plenty of S5 users (now with root).

I don't wanna get my hopes up but MAN I've really got my hopes up! LOL.
[Verizon Samsung Galaxy S 4] LiLPurP:
So it would appear as Dan has found the info we need to permantly unlock this thing, awesome :D cant wait to see what he has to say and share

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] tkacer:
speaking of which - see post below - perhaps a glimmer of hope ??

http://xdaforums.com/showthread.php?p=52946035#post52946035
[Verizon Samsung Galaxy S 4] sokrboot:
Yes maybe a glimmer of hope. The thread u linked to references the same [MENTION=4229979]djrbliss[/MENTION] BHUSA "surprise" linked a couple of posts back. Good find.
[Verizon Samsung Galaxy S 4] JLow0214:
So we have to wait until august???

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] V0latyle:
Well, they (he) could blow it wide open now, during deployment of new firmware, and potentially risk having it patched...Or, he could wait until 2 months from now, for whatever reason he might have, and release it on a scale that will gain a lot of attention and allow as many developers as possible to see the exploit.

Which would you prefer?

Also, we have been on locked bootloaders for a LONG time now, and with some exceptions, we still have the ability to use our phones - not only that, but enjoy root. So what do we have to complain about?
[Verizon Samsung Galaxy S 4] JLow0214:
I understand why he's not and I just really hate touchwiz.

Sent from my SCH-I545 using Xparent Skyblue Tapatalk 2
[Verizon Samsung Galaxy S 4] jamesd1085:
I would be surprised to see him ever release it if he has unlocked/exploited it...a lot of people treated him like some creep off the street after all he had done with the Loki exploit... I believe if he cracked it he will probably show proof and never release it...as far as I knew he was pretty outraged toward the android community
[Verizon Samsung Galaxy S 4] sokrboot:
Maybe...but these are the thibgs these guys live for...this sounds too big not to share in some way. Also i am sure there will be some active XDA devs who attend BHUSA so if Dan doesn't release his exploit they can likely piece it together. The write up says he is doing it on a live device for demonstration so to me that's about the same as posting a "how to" thread with video. ;)
[Verizon Samsung Galaxy S 4] sokrboot:
More food for thought on Dan's BHUSA presentation.

Also this post on twitter form [MENTION=4229979]djrbliss[/MENTION] on May 20th...

" Props to @5aelo for noticing CVE-2014-0196 doesn't affect kernels between commits c56a00 and 64325a. Galaxy S5 is not vuln as a result."

Hmmm so maybe he IS talking about the Motorola BL/TZ at BHUSA and not Samsung...?

And yes...I'm just stirring the pot! I have no idea how that particular exploit affects a kernel...much less bootloader or trustzone. :-p I have to find some way to pass the time until August!
[Verizon Samsung Galaxy S 4] Diego1751:
What did we do to Dan? I also want to apologize on the behalf of those not involved for whatever happened
[Verizon Samsung Galaxy S 4] sokrboot:
Blessed are the peacemakers.
[Verizon Samsung Galaxy S 4] tshelby73:
I'm not holding my breath. But would be great if it happened.

Sent from S4 using Tapatalk
[Verizon Samsung Galaxy S 4] decaturbob:
I agree...if exploit exist releasing to collect the bounty vastly outweighs revealing it at some conference
[Verizon Samsung Galaxy S 4] mike.s:
I suppose some people are in it for the money. Kind of hard making a living collecting bounties, though. And, if you have the knowledge and skills, there are lots of well paying jobs with benefits available.

Also, you're assuming that someone will claim the bounty beforehand - it could happen, but I wouldn't bet on it.
[Verizon Samsung Galaxy S 4] Brooklynsour:
Hopefully the government won't get him before August.... Hopefully the exploit will come up soon, if there is one.... Also want to extend more apologies to Dan, can't understand people putting him down after he found the Loki hack.... Sorry [MENTION=4229979]djrbliss[/MENTION]
[Verizon Samsung Galaxy S 4] dmt010:
People who put anyone down are usually jelly of others successes. Also , Big brother knows all. If anything they would likely speak to him just to offer him a position.
[Verizon Samsung Galaxy S 4] LiLPurP:
Well assuming he has exploited samsung, isnt samsung being used by government, i thought they had a contract with samsung for encrypted phones, which would explain the mass release to public to see if it can be exploited, i think the government is already involved guys, but hope is always here and [MENTION=4229979]djrbliss[/MENTION] your a great dev and have done great things for the android community, and i sir, salute you, Thank you

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] scryan:
Its his career.... VS like $5k promised on message boards by kids 8 months ago.

Pretty sure he will wait and do a professional announcement in accordance with industry standards for releasing exploits rather then ****ing around so he can get what basically amounts to the value of a mid 90's Daewoo 2 months early.
[Verizon Samsung Galaxy S 4] sokrboot:
I wonder if Dan secretly trolls these threads. We mention his handle all the time. Surely he's lurking around here somewhere! ;)
[Verizon Samsung Galaxy S 4] LiLPurP:
[MENTION=4939386]Surge1223[/MENTION] what do you think about all this? Been a while since your last post

AT&T Galaxy S4 4.3 MK2 rooted with saferoot, safestrap recovery installed, Running Hyperdrive ROM, Praying for unlocked bootloader lol
[Verizon Samsung Galaxy S 4] jeboo:
"Permanently unlock" does not sound like Sammy..It's likely a popular vendor that actually supports unlocking (moto, htc, sony?).
[Verizon Samsung Galaxy S 4] sokrboot:
Could be. But I read it differently...to me it sounded like a clarification versus temporary unlock or bypass which I think has been accomplished to some degree.
[Verizon Samsung Galaxy S 4] Walter.White:
[MENTION=2376614]jcase[/MENTION] is definitely going.

---------- Post added at 06:38 PM ---------- Previous post was at 06:35 PM ----------

I'm afraid you might be right considering he has done previous work on Motorola TZ here http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html
[Verizon Samsung Galaxy S 4] gnubian:
Samsungs position is clear and against unlocking the phone. It also has nothing to do with the exploit; it's not meant to be unlocked, hence the term exploit. All we can do is hope the "popular android device" mentioned in the article is the s4.
[Verizon Samsung Galaxy S 4] scryan:
The point is that going the extra step to call it permanent implies a manufacturer that has devices that can be temporarily unlocked.... so not sammy.

But as you said we know nothing until the conference, and there is not a ton of value in speculation. Just hope for a pleasant surprise...
[Verizon Samsung Galaxy S 4] ryanbg:
It is possible to have a Qualcomm PBL/SBL unlock, as well as a vendor-specific unlock. A PBL/SBL 'unlock' disables the SecureBoot chain, meaning ABOOT signature would not be verified. It's also possible to unlock secure Sahara/DMSS operations, and completely wipe the entire board. SecureBoot is configured by QFPROM (qfuses) and TrustZone. It's sort of a big web of systems. The Samsung 'Developer' devices only have BOOT and RECOVERY partitions 'unlocked'. You can't actually flash your own bootloader, like u-boot. A PBL/SBL unlock would allow this. Unfortunately, you couldn't flash that bootloader with ABOOT since it has it's own signature checks. It's sort of a catch-22.

It's possible for TrustZone to use the ARM11/DSP-(Hexagon) (baseband/modem processor) and configure this. This processor bootstraps the Applications Processor (ARM7). That's how HTC sort of does it. The S-OFF flag (@secuflag) is merely an OEM command similar to AT commands. However, these AT/OEM/IPC commands are filtered, preventing secure commands being used by the wrong people. That's how firewater for the M8 works, it bypasses the write protection on the flag, and flips it off. It's much more complicated getting access to that flag, but that's the gist of it. I'd imagine the mechanism is similar. E:V:A has been doing a lot of research in this area (RIL/IPC/Modem), but not many others seem interested, which is sad because of the functionaility behind the baseband.

I'm not going to rule Samsung out, but I agree with [MENTION=2471504]jeboo[/MENTION] because it's not as simple as disabling SecureBoot with TrustZone (at least on Samsung devices.) Now another thought I have to entertain is the fact that Qualcomm has it's own Secure Extension Environment for TrustZone (their own microkernel.) If he exploited QSEE, it may be a universal (to an extent, depending on the vendor and what they did with it.) I doubt it is universal though.
[Verizon Samsung Galaxy S 4] TTLayland:
I just feel like popular Android device has to be the galaxy line, I mean who else? You guys know more than me by a vast amount. Still who knows what could happen, Dan works straight up magic. His track record suggests he could unlock one of these devices If he really wanted to do so.
[Verizon Samsung Galaxy S 4] V0latyle:
So if I understand this correctly, due to ABOOT signature checks, it would be impossible to use a custom bootloader. Can ABOOT be flashed via software means? I am assuming not...and that for a complete unlock something like JTAG would possibly have to be used. Obviously not user friendly.
[Verizon Samsung Galaxy S 4] ryanbg:
Surge has a Riffbox and I have a Z3x. No JTAG box can unlock the S4 at the moment. Aboot can only be flashed by software means...
[Verizon Samsung Galaxy S 4] TTLayland:
What about that guy who was downgrading firmwares with jtag? The one surge talks about in the op?
[Verizon Samsung Galaxy S 4] ryanbg:
While I can't say for sure if it's possible to downgrade with JTAG, we came to the conclusion he is full of crap. There have been multiple attempts by multiple people to contact him, after he was out of jail, and nothing. He's never provides proof, explained how, or even commented on the issue. He might have done it on an Exynos device, but not Qualcomm.