yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 General] Nsane457:
I entirely take this back. It seems there is support for modules, in spite of the default kernel config. i.e. :

insmod /system/lib/modules/dma_test.ko

definitely works, as an example. Had I taken the time to "ls /system/lib/modules" before I got root I would have seen it. So there would be hope for kexec after all, I guess.
[Verizon Galaxy S 5 General] jcase:
closed as per OP request
[Verizon Galaxy S 5 General] Guadalupeohara:
Thanks dude. I have found here new rooting process..:good:
[Verizon Galaxy S 5 General] Droid_Evo_8:
hahahahaha
[Verizon Galaxy S 5 General] sd_N:
I had an idea ... Is it possible to turn the Factory Odin image into ART then inject root and flash? Since switching to ART obviously triggers custom boot screen. I tried flashing SU while system was ART enabled....I received only the E signature verification failed message.
[Verizon Galaxy S 5 General] kprice8:
To add to this, I tried using Framaroot, and only got the 'Aragorn' exploit as possible, and tried a few times and comes back with Error 6...
[Verizon Galaxy S 5 General] eragon5779:
I'm not sure. I know that the boot loader check is disabled because of ART (I didn't find that out, another user did), and that many think that is how the exploit will be found.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] jcase:
It certainly does not disable any bootloader check
[Verizon Galaxy S 5 General] kuronosan:
It isn't the bootloader check that's disabled, it's the bootcheck.
[Verizon Galaxy S 5 General] eragon5779:
Okay. I misunderstood.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] ups2525:
will SM-G900T CF root method wk for SM-G900V??

I'm sure this has been considered but I haven't seen it mentioned. I wonder if the ChainFire root method for the SM-G900T will work for our beloved SM-G900V????
[Verizon Galaxy S 5 General] kuronosan:
Is it new? Because if you're talking about the T-Mobile variant the answer is no.
[Verizon Galaxy S 5 General] jcase:
Thread cleaned, please let me know if the m8 guys return.
[Verizon Galaxy S 5 General] kidruk:
Looks like his variant has worked on plenty of devices.... sprint included! .. :fingers-crossed: only time will tell my people!
[Verizon Galaxy S 5 General] xgerryx:
It works with an unlocked boot loader. This bridge was crossed on, or even before release day. Not an option unless someone can unlock the boot loader.
[Verizon Galaxy S 5 General] kidruk:
I thought the sprint bootloader was locked.. :crying:
[Verizon Galaxy S 5 General] xgerryx:
I can't speak for Sprint, but from what I was reading about his specific method, that is the case.
[Verizon Galaxy S 5 General] ks3rv3rg:
It will not work. Read chainfires thread. He's said himself he won't be working on an exploit for the Verizon s5 because it's beyond his scope of knowledge due to the heavy locking and whatnot.
[Verizon Galaxy S 5 General] LocoFreek25:
What's the bootchecker bootcheck skipped message about? Just skipping something only necessary for Dalvik?

Also what's the option to load a Custom Operating used for? It leads into Odin, which indicates System Status: Custom and Qualcomm SecureBoot: Enabled. The boot splash on my screen now shows an unlocked icon and says Custom. I'm assuming this is for flashing only signed packages.
[Verizon Galaxy S 5 General] jcase:
Looks like a bug in tamper detection to me

What you are seeing is not an option, its a warning screen when entering download mode
[Verizon Galaxy S 5 General] Franzie3:
In your professional opinion, Do you think its a lead to look into to achieve, at a minimum, root?
[Verizon Galaxy S 5 General] jcase:
No, I don't believe it will lead to root, I see no indication of such
[Verizon Galaxy S 5 General] Lodaserves:
Saferoot is based on the get/put exploit from 4.3, it should be patched in all 4.4+ builds. Are Verizon and AT&T both SELinux Enforcing?
[Verizon Galaxy S 5 General] kuronosan:
Yes.
[Verizon Galaxy S 5 General] RockyCJC:
Just floating the thought

I remember back when I had the HTC Rezound, in order to achieve S-Off, you had to take a piece of bell wire and use its stripped ends on some metal contacts within the phone at just the right time in order to allow the software on your PC to accept an exploit.

http://xdaforums.com/showthread.php?t=1612035

So what the heck does this have to do with the S5.......it shows me that someone really had to think outside the box to figure that out. I mean, who comes up with the idea of using bell wire on a seemingly un-noticeable hole on the back side of the phone. Granted this is an HTC phone but it would appear the methods being explored for the S5 are all software based. Maybe that just comes with the Samsung territory. I am by no means a technical expert and I do not know enough about the hardware or software to even attempt rooting. But I am analytical and try to think outside the box. Is there something we should be looking at from a hardware perspective that will give us a way to unlock the phone. At some point, Samsung had to program the phones so that they are locked and Samsung must have a way to wipe the phone and re-build its firmware. In addition, when Verizon releases an OTA, that essentially puts Verizon's version of Touchwiz onto the phone (verizon's custom ROM).

Again, I am probably speaking from complete ignorance but maybe the old way of finding exploits is what is dead, but other creative ways that have not yet been tried are not shored up as heavily because concern/attention was never placed there.
[Verizon Galaxy S 5 General] Dennisg34:
Well Samsung is all open source, you can get all the info on their website. It's Verizon that's locked everything cause they're a holes
[Verizon Galaxy S 5 General] kuronosan:
Which is funny, because having their kernel source is worthless if you can't compile it.
[Verizon Galaxy S 5 General] RockyCJC:
What confuses me is how Verizon is able to lock down open source. Verizon has no license to the hardware so how are they allowed to "lock" a phone.
[Verizon Galaxy S 5 General] jcase:
There is no "locking down of open source", they appear to be fully compliant with the licenses for the OSS that they use.

Verizon is a whitelist only network, meaning they only allow phones on the network that they want to allow. They are also Samsung's customer, one with huge buying power. They order models with their spec list.

Why do they lock things down? Warranty fraud, tethering fraud, added support costs and well rooted/modified devices can greatly impact a network. I was in a round table discussion the other week which included representatives from most (all? I dont recall seeing Tmobile but i assume they came) US carriers. One story that came up was of a single application that was causing disruption on the network (I do not believe this was the Verizon representative, I am thinking possibly Sprint?). If an application can cause issues, custom firmware sure as heck can.
[Verizon Galaxy S 5 General] RockyCJC:
Super Root?

http://xdaforums.com/showthread.php?t=803682

Just doing random google searches for ideas. Found this application. I am not willing to try it because it doesn't appear to have been updated since 2011, but perhaps someone with some knowledge of .net can get into the code and extrapolate some ideas that haven't been tried for the Samsung S5 root.

Just trying to throw out whatever is possible to fine a root exploit.
[Verizon Galaxy S 5 General] kprice8:
FoxFi?
[Verizon Galaxy S 5 General] jcase:
It is a bunch of old public exploits, wrapped in a gui. Nothing here

I don't recall the specific application, im not sure it was named.
[Verizon Galaxy S 5 General] eragon5779:
What are the commands?

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] kuronosan:
Blankety blank
[Verizon Galaxy S 5 General] Surge1223:
You can compile the kernel.

Here these may help, if you have to ask what they are then you probably dont know how to utilize them.

System.map

vmlinux
[Verizon Galaxy S 5 General] kuronosan:
I'm aware I can compile the kernel. When you have a way to flash it, let me know.
[Verizon Galaxy S 5 General] Surge1223:
The point of compiling the kernel isnt to flash it at this point. Having the kernel source and symbols is a useful resource, especially for those that are actively looking/trying to find an exploit. Cross compiling with the ARM toolchain and building static libraries that could potentially help.
[Verizon Galaxy S 5 General] Franzie3:
this was just posted in the IRC....if anyone knows more then i do, probably most

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ef87dbe7614341c2e7bfe8d32fcb7028cc97442c

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2145e15e0557a01b9195d1c7199a1b92cb9be81f
[Verizon Galaxy S 5 General] BigBot96:
Posted the syms from kallsyms in my info thread.

http://xdaforums.com/showthread.php?t=2741408
[Verizon Galaxy S 5 General] Surge1223:
I posted the System.map a few posts above.

Also I have the start addresses, sizes, signiture locations/size/address and type info for the signed bootloaders if youd like to add them to the partition info page.
[Verizon Galaxy S 5 General] BigBot96:
Hah. I missed that one. Thanks. Well we'll have it in two places then :good:
[Verizon Galaxy S 5 General] RJFrank33:
My question is, why just the s5? If Verizon is locking down their phones why isn't the HTC M8 locked down? I'm upgrading in July and hoping this bootloader is unlocked by then but don't understand why it's the s5 that's locked and not every Verizon phone.
[Verizon Galaxy S 5 General] Dennisg34:
It's every Samsung phone. Samsung phones are the top rooted devices and Verizon has contracts with them to put these on lockdown so people can't root and therefore use stuff (like mobile hotspot, which is a normally paid for function) hacked and used for free or other things of the sort.
[Verizon Galaxy S 5 General] jcase:
One has less bugs than the other.

HTC m8 is actually "more locked down" out of the box, but they made more obvious mistakes in their design.
[Verizon Galaxy S 5 General] RJFrank33:
I understand that. So then why wouldn't I just switch to the M8 and have all those options anyway?
[Verizon Galaxy S 5 General] Dennisg34:
No one's stopping you. More people (such as myself) prefer Samsung phones over HTC. In my personal opinion, backed up with factual information as well, the Samsung is superior. The only thing the M8 really has that's better than the GS5 is external speakers and lowlight pictures. Which, in my opinion, aren't something to want the phone for.
[Verizon Galaxy S 5 General] RJFrank33:
Oh, ok... That makes sense. Hopefully the S5 will be unlocked in the next couple of months.
[Verizon Galaxy S 5 General] CloseCoder:
Change Network Bands?

Sorry for trying to hijack the thread but I've been searching and no luck. Is there a way I can access the hidden service mode and change the network type? I remember in the Galaxy S4 I downloaded Samsung Servicemode shortcut to get into the hidden menu and change my network band to LTE/GSM. I'm using T-Mobile at the moment and got the phone. Is there a way or do I have to wait till a root method is out?
[Verizon Galaxy S 5 General] Dennisg34:
Is this what you mean? settings>more networks>mobile networks>network mode?

But yes, you should've posted this in the Q&A section, not under ideas for root
[Verizon Galaxy S 5 General] RJFrank33:
I agree... I love my S3 and am looking forward to a new S5. I'm not trying to be a jerk, I wouldn't even consider changing brands unless the S5 absolutely can't be rooted. That would make me think about it.
[Verizon Galaxy S 5 General] rushless:
Please keep in mind Verizon and Samsung are working together to try and take enterprise marketshare from iPhone via the S4, S5 and Note phones. The key selling point given by Verizon corporate reps to company IT leadership is how "secure" Samsungs are. After over a year, the S4 still has not been unlocked and the S5 has not even been rooted yet. We also have Knox 2.0 soon to release ans Samsung is touting that.
[Verizon Galaxy S 5 General] RockyCJC:
Why ya gotta bum us out ;)
[Verizon Galaxy S 5 General] Dennisg34:
The boot loader for the s4 isn't, but it is still rooted and you can do just about anything with it, and the s5 has only been out a month, give it time.
[Verizon Galaxy S 5 General] rushless:
I am not dinging dev progress, but pointing out the joint venture of tenacity from Samsung and Verizon on keeping these newer products un-modded.

Seriously, the corporate reps tout this as a sales point to company IT procurement.
[Verizon Galaxy S 5 General] BigBot96:
And being an IT Administrator myself, I like the idea of secure devices on my corporate network. You don't realize the incompetence of your average employee, especially with tech.

I've been keeping my on on the latest arm exploits. Haven't really been any in a while.
[Verizon Galaxy S 5 General] zounduser:
Seriously bro? Lol. I have both the M8, and the S5..... both great phones, but there's more things to like about the M8, then the S5. Speakers, sense 6, tap to wake, gestures from the phone sleeping, sense 6, aluminium build, which come on, kills the plastic S5. Let's see.... unlocked bootloader, root, roms, mods.

Also reasons to stick with S5..... screen is amazing, the size seems perfect, camera, 4k recording fingerprint scanner, water and dust resistant, removable battery, lighter in the hands.

Can't go wrong with either one, they both are powerful phones, and I'm pleased to have them.
[Verizon Galaxy S 5 General] jova33:
How do you turn on tap to wake? I have the S5 and M8 as well. My wife actually has the S5. I just set up my M8 today and haven't tested all the features.

I'd say the key selling point on the M8 was the s-off.

Sent from your mom's smartphone
[Verizon Galaxy S 5 General] Longcat14:
Should be on by default, but if it isn't, settings > display & gestures > motion launch gestures and turn it on.
[Verizon Galaxy S 5 General] RockyCJC:
Please stay on topic.
[Verizon Galaxy S 5 General] KaM1KaZ3:
Threads are gonna start geting shut down again
[Verizon Galaxy S 5 General] kprice8:
If you are flaming on the S5 over the M8, then you can PM someone your dislikes and complaints about the phone. Don't get our threads shut down.. Has already happened so much from M8 people coming here and trolling, it's getting old.
[Verizon Galaxy S 5 General] zounduser:
I have both phones dumb ass. Read before u open your mouth next time!
[Verizon Galaxy S 5 General] kprice8:
I did read that, Sir, however, it seems to me as though you have a particular fondness toward the M8 being that you have an HTC Sig, and your stated preference over the S5. I think you need to learn to play nice, or go back to the M8 forum.
[Verizon Galaxy S 5 General] Dennisg34:
Or go back to listening to his Beats by Apple
[Verizon Galaxy S 5 General] zounduser:
Lol. U guys gonna try ganging up on me now? Just because I have both phones, and expressed my thoughts on both? Lmao! All good u non root having, locked down bootloader, no Rom flashing, jealous of the M8, S5 fanboys!! I'll go back to my s-off'd M8 now, and flash more roms, and mods. Have a great day M8's!!!
[Verizon Galaxy S 5 General] Dennisg34:
Jealousy has nothing to do with it, and you started a reply with me first, so I'm not ganging up. You said the HTC was better for several reasons, one being tap to wake, the S5 basically has the feature, except i don't have to touch my phone to wake. you also said the aluminum build was better than the plastic. Ehh, no. Too heavy, and besides 99% of people actually use a case, so build of the phone regardless doesn't matter. I would prefer plastic, as it is lighter.
[Verizon Galaxy S 5 General] kprice8:
Alright, stoop lower buddy. Before you know it, you will end up banned for flaming on forums when it's always uncalled for.. Honestly, if you love the M8 so much, then quit being a jerk to us who have an S5... and btw, I am not an S5 Fan-Boy.. Before my S5, I had Moto Razr MAXX and HD... This is my first Galaxy device.

By the way, this being a family friendly site, I imagine that your cursing will not be well accepted.
[Verizon Galaxy S 5 General] zounduser:
Ok, I can dig that bro. Yes, I gave several reasons y I believe it's better. I also gave reasons as to y I believe the S5 is better. Can't we all just get along? I have both phones, I want trying to start a war between the 2 phones. Lol.

As for my signature, my last phone was the note3, and I even owned a G2. Yes I prefer HTC, but I love all powerful Android phones.

Banned? Are u kidding me right now???? Look at my profile, and my credentials here on xda, your warning me about being banned? Hahaha hahaha!!!!!! Ya, ok.

And yes I do love the M8!! It's so sick! Being unlocked makes it that much better. However, I love my S5 as well. I want flaming anyone? I was sticking up for myself. After a couple of u decided to get cocky!

In closing, I have both phones, and I'm not trolling, or flaming. It was started already to stay on topic, which I did.....until someone else opened their mouth to me, and said the same thing that was already stated!!!
[Verizon Galaxy S 5 General] kprice8:
Then perhaps next time you shouldn't come in guns-a-blazing about how amazing the M8 when we are all hating the M8 people who come in here starting crap...
[Verizon Galaxy S 5 General] jcase:
Thread opened:

Further non constructive, or off topic posts will result in an infraction.
[Verizon Galaxy S 5 General] rushless:
We had Samsung and VZW reps tout the device is "unrootable" and is a key selling topic to IT procurement. At least for our global company IT is sticking with iPhone, so that selling line seems to not impress.

Hopefully the reps have no clue. They ARE sales people and not techs.

The wording was in relation to jailbreaking, but point was still that the device is locked down and not a security concern.
[Verizon Galaxy S 5 General] Skynyrd420:
I think that is only viable for kernel 3.14.3 or below. ...I think

beav3r
[Verizon Galaxy S 5 General] Surge1223:
There's two POC's using this CVE for escalation of privileges but its complicated to try to exploit on android, at first glance I see an issue with pty.h and also this is also the same cve djrbliss was referring to I believe.

The S5 uses linux kernel 3.4
[Verizon Galaxy S 5 General] wuyongzheng:
How about changing system.img.ext4 without changing kernel, root or recovery?

I've asked this in stackexchange (I'm not allowd to post any URL), but there wasn't enough attention. So I'm posting it here. Sorry if this is off topic. I have already spent some effort looking for the right place.

The idea is very simple, and it's not specific to any particular device.

I understand that:

The secure boot process checks signature of bootloaders, kernel and rootfs, but not /system partition. The Samsung KNOX e-fuse is set to 1 when any signature is bad.

Tools such as make_ext4fs can create custom system.img.ext4.

Odin and Heimdall are able to flash system.img.ext4 into the device.

system.img.ext4 is not signed, so there is no way for the device to verify its integrity.

If all are correct, we can change any file in /system partition. Rooting then becomes very easy. This my proposed way of rooting without voiding KNOX warrenty:

Unpack the stock system.img.ext4

Find any binary which is executed by init as root. Examples are /system/bin/installd and /system/bin/vold

Patch the binary to plant a backdoor which can spawn us a root shell.

Repack the system.img.ext4. Hopefully the file size doesn't change.

Use Odin to flash the system partition only.

Boot. Secure boot shouldn't detect anything unusual, as it only checks bootloader, kernel and rootfs. ADB shell and then use our backdoor to get our root shell.

However, people are trying very hard to find a way to root Samsung Galaxy S4, Note2 or Note3 without voiding KNOX warranty. For example, the saferoot method make use of a kernel vulnerability. After Samsung patched the vulnerability, there isn't yet any way to root safely. My approach must be wrong somewhere. Appreciate if you can point it out.
[Verizon Galaxy S 5 General] miked63017:
Break the booloader and see if the SoC failsback to booting from the sd card like the s3. Put unlocked bootloader on the sd card->collect bounty :)
[Verizon Galaxy S 5 General] RockyCJC:
I am by no means at the level to even come close to coming up with this idea. But....from reading the three forums in XDA that are most active about rooting the s5, I believe one major issue with the plan outlined is mentioned in step 4. I think the file size does change which causes it to get rejected.
[Verizon Galaxy S 5 General] eragon5779:
Not really. The change in the signature is what causes it to fail. Feel free to correct me if I'm wrong.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] KaM1KaZ3:
File size will change an cause it to fail in odin
[Verizon Galaxy S 5 General] kprice8:
Probably a stupid question, but couldn't you add a filler in there somehow? Some way to eat up space to make file size identical?
[Verizon Galaxy S 5 General] KaM1KaZ3:
I dont think you can.. From what i have read in other threads
[Verizon Galaxy S 5 General] kprice8:
Could you possibly be so kind as to cite some of those, if you have them bookmarked, so I can read up?
[Verizon Galaxy S 5 General] open1your1eyes0:
This was done actually on the Verizon Galaxy S4 and Note 3 devices to make a prerooted system.img.ext4 file flashable in ODIN but even this was patched on the S4/Note 3 bootloaders in a later OTA update. Likely S5 came with that patch preinstalled already.

See bottom two threads for examples:

http://xdaforums.com/showthread.php?t=2487142

http://xdaforums.com/showthread.php?t=2479952

[MENTION=2348906]designgears[/MENTION] , [MENTION=631273]Chainfire[/MENTION] , and [MENTION=4395895]BeansTown106[/MENTION] can provide more details on the method used.
[Verizon Galaxy S 5 General] wuyongzheng:
What I meant by file size is the size of the system image, not the executable file (e.g. vold). The ext4 file system uses 4KB blocks, so if our changes are small, we can probably get away with the unpacking & repacking stuff. I.e. we can hexedit the system image without repacking ext4. A backdoor is usually very small (less than 1KB)

Even if our changes are large, say a few MBs, the samsung system image still has some free space left. My Note 3's system partition has 71.9MB out of 2.25GB free.

---------- Post added at 11:34 PM ---------- Previous post was at 11:12 PM ----------

Good to know it. I wonder how the bootloaders check the system partition which is not signed. Hardcode the hash of some core executables? The proposed AOSP feature dm-verity is going to kill this approach completely, but it's not in production yet.
[Verizon Galaxy S 5 General] designgears:
This isn't possible anymore, Samsung patched it.
[Verizon Galaxy S 5 General] RockyCJC:
So....do Samsung and verizon lock these devices down so well that they don't even have access to make changes. I have to assume there is a way for them to reprogram a phone. Maybe somebody can seduce someone who works for samsung and then get them to give them the necessary tools and codes to root the device. Viola!!!

Otherwise, my confidence level for root is waning. Hats off to Samsung and verizon because they seem to have outdone themselves with this one.

So when someone asks why the s5 still has such a plastic body, we can tell them it because it went into hiring hardcore hackers to make their phone root proof :)
[Verizon Galaxy S 5 General] 808phoneaddict:
I do wonder if there's a way to hijack an ota, slightly add and remove files from there, then use that
[Verizon Galaxy S 5 General] BigBot96:
Nope. The OTA is signed. You modify the OTA in any way and it won't even flash.
[Verizon Galaxy S 5 General] 808phoneaddict:
Thanks, sorry, just an idiot non-programmer throwing out ideas..
[Verizon Galaxy S 5 General] kuronosan:
Everyone points fingers at the other. Contact Samsung and they say Verizon has the keys. Contact Verizon and they say Samsung has the keys.

The phones are flashed and locked at the factory. Do the math.