yashsingh1/xdaforums huggingface dataset:
[G2 Q&A, Help & Troubleshooting] ripbabey:
I have the flashable through recovery version of stock kit Kat. Since I did not use a LG tool to flash it, can I still flash another non stock kit Kat Rom or do I have to downgrade. I still have twrp so I'm guessing I should Be ok, just worried about partitions.
[G2 Q&A, Help & Troubleshooting] ripbabey:
Anyone? I have a backup, just would rather know before I try.
[G2 Q&A, Help & Troubleshooting] mackster248:
Do you have custom recovery? Then yes. Are you referring to ROM's like CloudyFlex, etc?
[G2 Q&A, Help & Troubleshooting] ripbabey:
Ya twrp, went to install Mahdi Rom for d801 and got horrible reception and no data, so was curious if it's a kitkat doing it.
[G2 Q&A, Help & Troubleshooting] mackster248:
Did you flash the KitKat radio before flashing Madhi?
[G2 Q&A, Help & Troubleshooting] ripbabey:
I flashed after installing , tried the new gummy same reception but with data, also flashed furnace 2.0 kernal but after install of ROM. Do I do it before?
[G2 Q&A, Help & Troubleshooting] mackster248:
You flashed this radio right? http://xdaforums.com/showthread.php?t=2705509

Also, if you wish to use stock KK ROM's just wipe and flash away.
[G2 Q&A, Help & Troubleshooting] ripbabey:
Yeah I flashed that and than tried a T-Mobile only modem, no auto rotate either so that might be the problem
[Verizon Galaxy S 5 General] eragon5779:
This thread is for both AT&T and Verizon models. I am on Verizon, so that is why it is in this thread.​

I am making this thread for those who have ideas on rooting the SM-G900V and SM-G900A varieties of the Samsung Galaxy S5. You can post your ideas here, and devs who look at this forum are free to try the ideas, as long as, if it works in the long run, the original poster of the idea gets credit. Feel free to post whatever ideas you may have, as all will be looked into at some point.
[Verizon Galaxy S 5 General] Guadalupeohara:
Do you know ? The Verizon and AT&T versions have locked bootloaders and are not able to be rooted at the moment.
[Verizon Galaxy S 5 General] eragon5779:
I know they have locked bootloaders. That is the whole reason I created this thread: to share ideas for an exploit or a bootloader unlock so that we can get root. I own the phone and have done a lot of research. I have also been following the root status thread (here) since almost the creation. I am hoping that devs will see this thread and read ideas and/or post ideas. Something is better than nothing. I don't want to just sit here and wait when I can try it myself.
[Verizon Galaxy S 5 General] Guadalupeohara:
Fine.. Did you try kingo rooting method ?
[Verizon Galaxy S 5 General] eragon5779:
The saferoot method? Yes. No luck.

EDIT:

Never mind. They are to different things. No, I didn't, but I saw a post that someone had unsuccessfully tried it. I tried safe root though.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] Guadalupeohara:
Okay. I will try to find next method for this..
[Verizon Galaxy S 5 General] ryanbg:
Saferoot is based on the get/put exploit from 4.3, it should be patched in all 4.4+ builds. Are Verizon and AT&T both SELinux Enforcing?
[Verizon Galaxy S 5 General] cciechad:
AT&T is I assume VZW is the same.
[Verizon Galaxy S 5 General] ryanbg:
In terminal emulator/adb shell, can you give me the output of the following commands:

getsebool -a

getprop
[Verizon Galaxy S 5 General] kuronosan:
So what I've gathered from download mode, that log, and my logcat, is that Knox isn't actually present.
[Verizon Galaxy S 5 General] Syn Ack:
Dude we've already got a thread for all things root/recovery/bootloader

http://xdaforums.com/showthread.php?t=2714140
[Verizon Galaxy S 5 General] eragon5779:
I know. I'm following that thread too. However, I want this one to be just for ideas so they get seen

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] Droid_Evo_8:
The other one can be seen too. So what's gonna be different here? :confused:
[Verizon Galaxy S 5 General] ErosAoA:
Please excuse my ignorance. I am new to the forums and have never personally rooted a phone. My last phone (Motorola Razer XT912), I had a friend root for me because I still have unlimited data and needed access to the hotspot (I'm dutch and don't want to pay for it). Anyways, if you are looking for ideas or things we'd like to see, I personally would like to see the friends widget that Motorola did for your Favorite contacts. You could see four or five contacts lined up, and if you dragged them down, it would show all your favorite contacts. Is their a way to get that widget onto the Samsung S5?

Also too, if someone doesn't mind answering a noob question; does all rooting unlock the mobile hotspot feature so you don't have to pay for it?Or is it only certain ROM's/Root files that unlock the MHS?

Thanks for any help with these two questions!
[Verizon Galaxy S 5 General] Droid_Evo_8:
You might wanna try this: https://play.google.com/store/apps/details?id=com.gau.go.launcherex.gowidget.contactwidget or this: https://play.google.com/store/apps/details?id=com.gmail.yuyang226.contactswidget.pro

As for rooting for mobile hotspot, that has yet to be discovered as there's no rooting process (yet) for our S5s. Just keep an eye on this thread for updates: http://xdaforums.com/showthread.php?t=2714140
[Verizon Galaxy S 5 General] eragon5779:
That thread got partially derailed for a few pages. I am hoping this one won't.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] blulite:
Lol, Already derailed. We've got a "Verizon Galaxy S 5 Q&A, Help & Troubleshooting" forum, and the whole other thread that has mostly questions. And less than two pages into yet another "rooting ideas/sharing" someone asks a question about rooting. Too funny.
[Verizon Galaxy S 5 General] Broadley1:
It's funny how the M8 guys are creeping the s5 forums all the time, seems like they are already bored with their sub par phones...lol
[Verizon Galaxy S 5 General] ks3rv3rg:
One thing I can say I've never done in all my time rooting; trolling another phones threads. That's just crazy town.
[Verizon Galaxy S 5 General] kuronosan:
I think it's bs, but it does say you have to root after flashing, not that flashing will root.
[Verizon Galaxy S 5 General] DR4LUC0N:
Not sure if it's possible....but why not make a virus that infects the Play Store(or some other app) and force closes it(or something somehow) and somehow exploits it from there? I mean I'm just trying to help the developers maybe get some ideas. I'm sure this stuff is possible. We would just need to infect our own devices with it.
[Verizon Galaxy S 5 General] :
It is bogus, I extracted the system folder and there is no super user installed. It's just a bone stock non rooted tar file for Odin.
[Verizon Galaxy S 5 General] spuniun:
None of what you are talking about can result in privilege escalation. Neither a "virus" nor force closing an app will result in root privileges without already having them.
[Verizon Galaxy S 5 General] DR4LUC0N:
Hey, I'm just trying to give ideas, I'm no phone expert but finding exploits is something I can try and do.
[Verizon Galaxy S 5 General] miked63017:
Does anyone have more info on how odin works? It seems like it validates everything while on your pc. What if we made something that presents an official rom for validation, then once complete have it push something different. Most likely at first it will only be a system image because the bootloader verifies the kernel image during boot. But you could get a partial root if a modified system image could be flashed, which could lead to some sort of kexec mechanism. Does anybody know if this would be possible? I know odin is closed source but it can be reverse engineered, that's how heimdall was made.
[Verizon Galaxy S 5 General] DR4LUC0N:
I like your thinking, or another way to look at it is "how does the S5 validate?" if we take take an image and give it the same validation(probably like a hash) we can maybe mimic the original? on the other hand we would need to make a different roms for every update that has happened so far so we can change the coding of how the S5 sees it depending on how many people have updated their phones.(just a thought, hope you understand what I'm saying)
[Verizon Galaxy S 5 General] :
None of this is possible without a signing key from Samsung. Unless you have root to begin with and something like safestrap installed it isn't going to happen unless the image has a key from or like Samsung's. As soon as you modify the image the key is broke. I hope that explains things a bit.
[Verizon Galaxy S 5 General] miked63017:
What I'm saying is if odin validates a stock image, officially signed, but actually provide a different system image after the signature validation. Granted it wouldn't be odin we could use, but something to emulate odin right up until the image is validated then inject a different system image.
[Verizon Galaxy S 5 General] :
The validating key is on the phone and in the image, if they don't match the phone will not allow it. It's a very in depth validation that takes place. As others said we need to find a vulnerability within the android system itself, a breach in security so to say. There may be a way to flash to the phone with another program but it will most likely permanently brick the phone. I understand what you are saying but Samsung really locked this phone up tight. I don't believe it is impossible to crack the phone but it is proving to be extremely hard to say the least. It would be great if someone could make another bootloader / file system and flash that but there are parts of the phone that are highly encrypted to prevent getting the proper information to do so. It all boils breaking the security.
[Verizon Galaxy S 5 General] miked63017:
Yes I understand this, the idea being that after the key validation during the typical odin process we then inject a different system image to be flashed. Not sure why you think it would permanently brick the phone, and also about the encryption. The flash would be the stock images, with an injected system image, using the same protocols odin uses. I can open all of the bootloaders from the verizon factory images in IDA, usually if they are encrypted that would not be possible I thought? I wish I were better with ARM assembly though, then I would not have had to ask this question, because I could just follow the program flow where the validation happens. I am thinking its in aboot.mbn, judging by the strings included, I see some error messages that look pretty close to what odin would output.

If the injection would work it would be breaking the security, I am just not sure how the program flow goes on the phone side during an odin flash. If all validation is done on the pc side using the key stored in the bootloader to validate the signature, then we might be able to do this. It would be a matter of snooping on the USB bus and logging the entire transaction. Then basically inject a modified system image when it hits the part where the system image is actually being pushed to the phone, which seems to happen well after all signature checks judging by the output of failed and non failed odin attempts.
[Verizon Galaxy S 5 General] spuniun:
The entire bootchain of the phone validates the signing keys. Please take our word for it, what you are proposing is not possible.
[Verizon Galaxy S 5 General] miked63017:
So /system is now validated during boot too? I was under the impression it wasn't and and only bootloader parts and kernel were validated while booting.
[Verizon Galaxy S 5 General] spuniun:
No, the entire boot chain is signed. You cannot flash any unsigned image to any part of the phone as the chain of trust exists on the phone itself, not in ODIN/heimdall.

This line of speculation has been asked and answered by many of the best minds on XDA already numerous times. Please trust that it's a waste of time.
[Verizon Galaxy S 5 General] miked63017:
Ok, and I have asked a similar question about odin previously as well. But the entire verification process happens prior to the actual flash no? So if we MITM everything happening on USB, and after signature validation happens, where odin would start pushing images, we switch out stock system for our own modified system. I am not saying it would definitly work, I am just saying it seems like everybody is telling me odin wont do that. Well I am not suggesting doing it with odin, I am suggesting emulating odin and after the signature validation happens sub out our modified /system. I guess it could be synonymous with the way you would have to hot plug an hdd while soft-modding the old xbox, wait till validation happens then pull the old switch-a-roo.

I know during boot, the bootloaders and kernel partition are again checked so swapping those out would be pointless, but if we could swap out a system image we may be able to make some headway.
[Verizon Galaxy S 5 General] DR4LUC0N:
[MENTION=3585663]miked63017[/MENTION], I get what you're saying, basically....

1. Have a program tell the phone that it's going to be flashing the "Stock Rom"

2. When S5 verifies it's the "Stock Rom" have the program quickly switch the rom to a different rom to fake out the verification, making the S5 THINK it's a stock rom because it already verified the rom.
[Verizon Galaxy S 5 General] miked63017:
Yes, but only the system partition of the ROM, because the other partitions I am pretty sure are re-verified during the phone's boot process.

Either way if nobody wants to try this thats fine, I am building out my beagleboard xM to be an inline USB sniffer, I would like to be able to flash my sprint S5 without going to windows, and heimdall doesn't work for the s5 yet.
[Verizon Galaxy S 5 General] :
I like your idea, I was thinking along the same lines the other day but have no idea on how to do it.
[Verizon Galaxy S 5 General] Nsane457:
From Dan Rosenberg at twitter.com/djrbliss

(I can't yet post html links). It appears to be a buffer overflow due to a race condition. I had previously been into linux and c programming but no experience with kernel and android programming. Maybe someone with such experience could comment on the exploit's viability as a potential root method.
[Verizon Galaxy S 5 General] eragon5779:
The file he linked is a fix. Anyone know how to exploit something like this? I honestly have no idea what to do. Could we take the fix and use it to exploit it?

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] Nsane457:
Of course it's a fix. Dated Tue, 29 Apr 2014. AFAIK one that has yet to be applied to the kernel in our phones. That is the point.

As for a root method, I would assume something like:

1. Execute code to "virtually" guarantee race condition results in buffer overflow.

2. Exploit buffer overflow to run arbitrary executable code that places a su binary where it needs to go with proper permissions, etc...

This is only speculation though. I don't know enough to determine if it's exploitable in that way.
[Verizon Galaxy S 5 General] miked63017:
When I was trying to root my sprint model without tripping the knox counter, putting su and the related files in place was not sufficient to get root. Samsung put extra measures in place to block a full root without modifying the kernel it seemed. You could tap into one of the services that run as root at startup and run commands as root. But it would not remount system as rw, even though running id showed root. Best bet would probably be an exploit and kexec into an insecure kernel, since running commands as root doesn't really help if you still can't remount rw. Its something though...
[Verizon Galaxy S 5 General] Nsane457:
Even after something like:

su

mount -o remount,rw "/partition/identifier" "/mount/point"

on the command line?

When I had a droid razer Motorola released their kernel source with kernel config, etc... for the Verizon model open source. It made it easier to develop a kexec module. Just got my s5 a few days ago. Not sure if Samsung does the same.
[Verizon Galaxy S 5 General] jakeprogrammer:
They do. You can find the source for the SM-G900V here: opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=sm-g900v
[Verizon Galaxy S 5 General] spuniun:
We've been down that road already and discovered that the vulnerability in question does not actually exist on the S5.
[Verizon Galaxy S 5 General] miked63017:
Yes I tried many variations of the command, both explicit and implicit, also tried by using a busybox binary to mount instead of the builtin toolbox. Samsung does have kernel sources and there is already a build for the vzw dev edition. I forget the exact flag, but there is something in the kernel specifically meant to block root attempts, on top of the standard android props. I wont say its impossible but they do make it hard, even when you can flash the system partition at will. I made a script and replaced debuggerd with it that ran a script in /data/local/tmp on startup, followed by running the original debuggerd. All attempts I made failed, but the script was running as root for sure. I am assuming that's why we need an insecure kernel to flash, even with an unlocked bootloader on sprint. if an exploit is found though, even if it only allowed running a single command as root, kexec would be a good possibility.
[Verizon Galaxy S 5 General] Nsane457:
According to the bug submission, the exploit started from git revision d945cb9cce20ac7143c2de8d88b187f62db99bdc, dated 2009-07-07. The bug submission is dated 29 Apr 2014. And my phones kernel build date appears to be March 31st, 2014. The exploit may be nothing but a dead end but given the dates, I would assume it has to exist in the kernel... Unless Verizon is fixing its own kernel bugs without notifying the git sources which seems unlikely. Verizon is not that competent.
[Verizon Galaxy S 5 General] Walter.White:
Kexec would be possible only if S5 kernel allows kernel modules. Official FW on ATT N3 doesn't :(
[Verizon Galaxy S 5 General] Nsane457:
According to the kernel config in the official vz s5 kernel source, msm8974_sec_defconfig:

# CONFIG_MODULES is not set

If I'm not mistaken, though I could be, CONFIG_MODULES defaults to CONFIG_MODULES=n, which would imply that the official kernel is compiled without module support. Which implies kexec would not be possible, since one can't simply flash a different kernel/boot partition, supporting module loading, without invalidation.

Edit: I'm wrong... Ignore post.
[Verizon Galaxy S 5 General] Walter.White:
I think you are right.
[Verizon Galaxy S 5 General] DR4LUC0N:
So what are our options here? Basically VZW and ATT screwed us over completely?
[Verizon Galaxy S 5 General] Walter.White:
Protesting outside their store. Take all your friends and a local news team and have fun.
[Verizon Galaxy S 5 General] miked63017:
Maybe [MENTION=5575828]Walter.White[/MENTION] has some of that blue stuff left over to trade one of the shifty samsung devs for their private key and pass phrase :)
[Verizon Galaxy S 5 General] Nsane457:
Seriously though, it will likely be rooted before the end of the year. The exploits that can be used are becoming few and far between. Any hope of booting a custom kernel is pretty much gone. Good enough to just be able to install a custom rom.
[Verizon Galaxy S 5 General] dlscott1111:
Second time hearing this might be done by the end of the year. Can't believe that. Really, if rooting were to turn into a 9 month thing it would be useless. After 9 months most are ready for a new phone.
[Verizon Galaxy S 5 General] spuniun:
If you look in the bounty thread you will see some folks gave it a valiant effort before some much smarter folks pointed out that it was a waste of time https://twitter.com/djrbliss/status/468869510737698816 Nothing to do with Verizon, just dumb luck on their part that the vulnerability did not affect their kernel build.
[Verizon Galaxy S 5 General] Nsane457:
Yeah. I had a look at the source file the patch references in the official vz s5 kernel source. Doesn't resemble the diff context in any way. Oh well.
[Verizon Galaxy S 5 General] az-dave:
Its becoming more apparent by the time a root exploit is found, the S6 will most likely be out, or just about out. This is very sad...

One of the shining lights with droid devices and why they eventually gave iWhatever a run for their money was...drumroll...ROOTING and the likes.

Now that Samsung has so much market share they slam the door in conjunction with ATT and VZN due to "warranty" issue...PLEZE. If they made a few extremely EZ changes, any bricked phone could be up and running with a simple app run at the stores or thru an SD card...they Made them Brickable the way they did to sell more phones...now they turn the tables and think they have the market by the ballz.

Im prob gunna go sell my 2 S3's (both of which are unbroken, unscratched and in great condition), sell this ATT S5, and buy a Tmobile S5 outright, root it and run it on ATTs network.

I NEVER would have bought the S5 had I known ATT (and VZN and Samsung would play this type of game.

Watch the S6 be on same lockdown for the other carriers...bloatware and force-ads coming next.
[Verizon Galaxy S 5 General] spuniun:
Even by the most liberal of estimates, rooted devices make up fewer than 5% of the Android devices active. It's popularity is due to its customizability compared to iOS and nothing more. Security vulnerabilities that result in root is the very thing that every operating system developers from Microsoft to Google try to protect against for obvious reason... it's a security vulnerability. I'm far more confident in my personal data being protected knowing that no one can simply snatch my phone and easily bypass the inherent security and steal what they will.
[Verizon Galaxy S 5 General] K-alz:
If we were a minority as some say and Verizon/AT&T/Samsung wouldn't be affected if we ditched their services, why wouldn't they give us root access? Thought we were not a big deal anyway. Man LG G3 looks pretty good and who knows what G4 is going to be like. Sorry guys didn't mean to go off topic. I'm just getting tired of this joke called Verizon /AT&T/Samsung mafia clan. As soon as I pay off my phone I'm moving on.

from the tip of my fangers...!
[Verizon Galaxy S 5 General] spuniun:
They do: http://www.samsung.com/us/mobile/cell-phones/ET-G900VMKAVZW
[Verizon Galaxy S 5 General] K-alz:
None for AT&T.

Also forgot to mention that I own an AT&T note 3, but I just visit here often to see what's going on. I really like how everyone is working to get some results. I've learned so many things I've never heard of before.

from the tip of my fangers...!
[Verizon Galaxy S 5 General] jcase:
and the G3 is locked as well
[Verizon Galaxy S 5 General] spuniun:
Looks promising. I wish I knew enough to test it but the author did a good job explaining the vulnerability without actually providing a complete proof of concept. Since this is nice new info maybe one of the aforementioned devs will jump on it.

EDIT: Oh well, another dead end:

<jcase> spuniun, it doesnt work on s5
[Verizon Galaxy S 5 General] K-alz:
I thought LG didn't lock their phones.

Also, I meant that I'm heading to either Tmobile or international (no need for LTE).

from the tip of my fangers...!
[Verizon Galaxy S 5 General] Jaspah:
Any more information on this? I'm curious why this doesn't work.
[Verizon Galaxy S 5 General] spuniun:
My guess is Samsung patched it themselves since it's been a known issue for a while - Google just took longer to patch it upstream.
[Verizon Galaxy S 5 General] miked63017:
I know trying to exploit this doesn't work using vdc as the shell user, but do you know if anything was attempted via an app with proper permissions etc?
[Verizon Galaxy S 5 General] spuniun:
This issue is not the permissions, it's that the vulnerability was patched.
[Verizon Galaxy S 5 General] DR4LUC0N:
Just thought I'd throw this out there http://www.neowin.net/news/security-vulnerability-reported-in-samsungs-galaxy-s4

Apparently they got some extra help with security for the S5. Atleast that's what I got out of it.