yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 General] az-dave:
Has Anyone tried, or know of someone who has: Attempted to access the flash and firmware on the ATT or VZN S5 using JTAG device?

Its tedious for sure, but may allow a similar way to access /system and root files using the JTAG power without the phone actually being booted up...in which case, those are just files and could be swapped on the fly. My previous attempts using USB are pretty much done (not just cuz I bricked the S3 in the process) but because the USB method requires the S5 to be booted up. Ive done similar maneuvers on hard drives and flash rom on NAS machines using Linux, Im just not so versed at phones (yet).

Basically what Im hypothesizing (at least for the moment to attempt finding exploits) is accessing the file system WITHOUT the phone actually being booted up using alternative power source to only access the memory.

Or...is there a way to boot from an .img from the SD card where we might be able to exploit the on-board phone memory a little more?

Long shot, but...???
[Verizon Galaxy S 5 General] cquick97:
I'm sure jtagging is possible, but only useful for a very small group of people that would actually have the equipment to do it, not useful for everyone. And I don't think you could boot from an IMG on SD especially with a locked boot loader.
[Verizon Galaxy S 5 General] Franzie3:
EDIT: Deleted link, not a good lead
[Verizon Galaxy S 5 General] moah9998:
I don't see why that wouldn't work but Samsung could have patches of there own blocking that. Good find tho.
[Verizon Galaxy S 5 General] BigBot96:
That's what saferoot was based on and saferoot does not work on the S5.
[Verizon Galaxy S 5 General] Franzie3:
Ahhh, ok just happened to go some google searching. gonna edit and remove the link. Thanks
[Verizon Galaxy S 5 General] spuniun:
No.

App updates (even updates to system apps) do not write to the system partition.
[Verizon Galaxy S 5 General] cquick97:
So going back to the fundamentals... What apps can write to system? And what apps/processes run as root?
[Verizon Galaxy S 5 General] elliwigy:
I'm afraid hes right.. think about the ps3.. it was hackable when we had the keys but since its been updated and blocked by sony you cant hack it and finding the keys is near impossible.
[Verizon Galaxy S 5 General] cquick97:
Speaking of which, did we ever hear back from geohot?
[Verizon Galaxy S 5 General] az-dave:
True, the JTAGing would be a major PIA, but what im thinking is that if one were to gain access to the root file system using JTAG it might be easier to then find an exploit which could then be worked into a file to give SuperSU/Root on other phones.?? Basically stick SuperSU in the /system directory reboot and maybe then be able to mess around...plus be able to copy the unpacked entire file system from a JTAged phone to a Linux machine. Im almost at my wits end with the Auto ATT updates and new bloatware apps they keep pushing.

Just throwing out some out of the box ideas hoping someone with more knowledge than me might get a light bulb idea.

I increased my pledge for AT&T root to $100, and if we dont get something here soon, Im going to be selling two S3's and my ATT S5 for the Tmobile S5.

Are we all absolutely certain there is no way to take the Tmobile file system and Kernal and slice it up to work on the AT&T phone? (VZN is diff radio so pretty sure impossible)

SD Card - Out of quesiton with locked Bootloader - my bad, I was still thinking on my unlocked S3 terms...not having fun in locked-down S5 hell. Everything I re-learned has essencially been stolen from me :(

---------- Post added at 05:30 PM ---------- Previous post was at 05:16 PM ----------

I have a more fundamental question:

SU is a "command" built into most linux/unix kernals. usually su is protected by password, and only users with administrator priv are able to execute "SU". The kernal itself has root access, and whether or not there is a command to enable a terminal to have root access is generally done via the command.

When the S3 was rooted by CF and a few others, and we got the SuperSu application...was it a stand-alone app, or did it write its SU/Root command into the phone kernal?

probably a complete newb question, but im trying to understand at the fundamental level what is going on with SU and Root on the phone as compared to PC level. Also...does anyone know if SuperSu and the other roots are written at Assembly-Level code, or with something like C, Visual-C, etc?

Ive just noticed after trying all sorts of linux commands at the terminal emulator on my S5 that typing in login at the command prompt kills the terminal emulator app and closes its window...interesting.
[Verizon Galaxy S 5 General] starfall42:
I pledge $25 (Verizon).

(To minimize the natter here, I'll post some more info about rooting in the "Ideas for rooting thread").
[Verizon Galaxy S 5 General] jake5253:
Is anyone else having problems running binary files on their device? I've tried adb shell and terminal emulator. They seem to operate differently, i assume because adb shell runs as user "shell" and emulator runs as something else such as "u0_a242"? Maybe this is already well known, I didn't =]

Anyways, I can transfer a file to /data/local/tmp but it says it Cannot Execute. Permission Denied. I've tried to run it from emulator and shell, no luck. I've tried to make it executable, but it wont allow chmod on emulator, but does on shell. Any tips or is there something I'm missing?

$ ./adb push ~/Desktop/myfile /data/local/tmp
$ ./adb shell
shell@kltevzw:/ $ cd /data/local/tmp
shell@kltevzw:/data/local/tmp $ chmod 755 ./myfile
shell@kltevzw:/data/local/tmp $ ls -l
-rwxr-xr-x shell shell 9095 2014-05-20 00:23 myfile
shell@kltevzw:/data/local/tmp $ ./myfile
/system/bin/sh: ./myfile: No such file or directory

but on emulator:
u0_a242@kltevzw:/data/local/tmp $: ./myfile
/system/bin/sh: ./myfile: can't execute. Permission denied.

Also notable, ls -l works on shell, not on emulator.

Thanks.
[Verizon Galaxy S 5 General] rufflez2010:
Isn't that what the developer edition is for? Its same price as the regular model. You don't have your choice in color, but it is unlockable and still comes with KNOX if your company wanted to utilize it.

**edit... You have to pay sales tax and you only have a 30 day warrantee even if you don't change the OS... That's bull ****.
[Verizon Galaxy S 5 General] jbrabson:
I apologize if this is a stupid question/idea but...

Would it be possible to use a cert installed on the device to gain root. Here's what I'm think: When I add an account via Microsoft Exchange ActiveSync (lets just say my work email), i'm prompted to install a cert allowing it to become a device administrator and do all types of cool things like remote wipe, remote lock, force lockscreen pin, etc. I'd imagine that accepting the cert via the (crappy)native email app, it actually gives that account device admin permissions to force me to add a PIN to my lockscreen and give our email server admins the ability to wipe my phone remotely.

SOOOOO.... what if a cert had the ability to inject the SU command to the phone... would that be a likely exploit we could try?
[Verizon Galaxy S 5 General] roughmouth:
This may help answer your question.

http://xdaforums.com/showpost.php?p=52808671&postcount=131
[Verizon Galaxy S 5 General] Russ77:
I appreciate the feedback guys, I was merely offering a suggestion other than badgering developers or badgering the companies with demands.

you're both correct and made a point I've made several times prior. if you wanted a Dev phone, should've bought one.

as for me, I'm good. if root happens I'll root. if not I'll manage with what's still probably the best phone I've ever owned.
[Verizon Galaxy S 5 General] jbrabson:
Thanks for the link, (not to be a smart.A) but maybe I missed what you were pointing me to in that post that was referencing my question.

Do you mind explaining further?
[Verizon Galaxy S 5 General] roughmouth:
That was just some general Info on rooting that i thought might be relevant to your post. My apologizes if i have offended you. I was just trying to help.
[Verizon Galaxy S 5 General] garwynn:
Please remember, those of us who have been here a while should be happy to answer a question, even more than once if necessary. We were all new to XDA at one point or another.

And for those worried about keeping the thread on topic, that's what we're here for. :thumbup:
[Verizon Galaxy S 5 General] jcase:
Thread cleaned, infractions handed out. Move your arguments and petitions elsewhere.
[Verizon Galaxy S 5 General] krazy_smokezalot:
Nice I'm always late to the action

Sent from my SM-N900V
[Verizon Galaxy S 5 General] RyuujinZero:
I'd like to pledge $50 for VZW.

Also, what exactly is an infraction?
[Verizon Galaxy S 5 General] kprice8:
A penalty. After so many of them further punitive action is taken.
[Verizon Galaxy S 5 General] cquick97:
Question: Doesn't the GNU Public License require that any usage of code must have the source code freely distributed? Well, Android is based off Linux right? Why aren't we able to get the complete source code of Samsung's implementation of Android, so we can pick it apart from the inside out?

---------- Post added at 05:49 PM ---------- Previous post was at 05:49 PM ----------

It is Verizon that requires the locked bootloader, however.
[Verizon Galaxy S 5 General] jcase:
Linux is merely the Kernel, not Android. Android is NOT based on Linux, however Android runs on the Linux Kernel.

Samsung does provide source as required under GPL. We can still pick apart all of this without source, its not a problem at all.
[Verizon Galaxy S 5 General] starfall42:
Samsung is required to publish the open source they use, but they aren't obligated to publish the private key that allows it to run on their hardware. This is, understandably, controversial: see Tivoization, named after Tivo which did the same thing for its DVRs.
[Verizon Galaxy S 5 General] mobius378:
I would like to add an additional 30. Shout out to all devs thank you for your hard work.
[Verizon Galaxy S 5 General] phrozenwire:
An Idea

Guys,

Am not a developer or a programmer. But just a thought that came to mind. Verizon has released the Developer Edition for the S5. There is a thread which is active for successful root and installation of Recovery on the Developer Edition. Since both the devices are identical. Is there anyway that we can put the complete image from the Developer Edition phone over to the normal VZW S5 and use the root method provided. I am looking at putting the entire image using Odin over to the phone just like restoration of the factory image but in this case use the developer edition image. Is it feasible ?
[Verizon Galaxy S 5 General] Skeetch79:
No. But if you care to try good luck.

Both devices are identical. Retail units have been known to be converted to Dev units by Samsung at the factory by flashing a special ABOOT partition which is unique to each device in order to unlock it.

BTW, what DevS5 image? There are no officially signed images that have ever been or will ever be released for the Samsung Dev Units.
[Verizon Galaxy S 5 General] corona63976:
If Android isn't based on Linux then what is it based on so that I and the rest might understand completely.
[Verizon Galaxy S 5 General] tpike:
Based is a nebulous term. It's kernel is Linux...kernel is foundational for os operation therefore it's based on Linux. Apps are running java so you could say it's functionally java.

This might help a bit. As you can see it's built on many different libs but it's foundation is Linux.

http://upload.wikimedia.org/wikipedia/commons/a/a5/Diagram_android.png
[Verizon Galaxy S 5 General] JesseTron:
Geohot needs to get in here with an update if he's working on it.

Sent from my AT&T Galaxy S5
[Verizon Galaxy S 5 General] graydiggy:
You need to be patient. He doesn't need to do anything at all.

This entitlement crap needs to stop.
[Verizon Galaxy S 5 General] Dennisg34:
THIS is exactly why the Devs are being silent about this. Let these guys work in peace. Christ
[Verizon Galaxy S 5 General] CliffordKT:
Has any one using jtag acquired root.
[Verizon Galaxy S 5 General] Dennisg34:
If they had, this bounty thread would no longer be here ;);)
[Verizon Galaxy S 5 General] spuniun:
Acquiring root via jtag would not constitute a successful public root method that this bounty would reward.
[Verizon Galaxy S 5 General] Surge1223:
Guys this thread is ridiculously close to being locked. If you're sitting there thinking that "oh they wont lock this thread, too many people want root" then I want to remind you guys the S4 VZW bounty thread did get permanently locked, and it held the bounty record before this bounty surpassed it. This isn't the place to ask about android in general or how you can start learning how to make exploits or find vulnerabilities.

If you're going to start your sentence with anything like "forgive my..." "idk if this is a dumb idea but..." "What if we flashed..." "We need more devs so that..." then you might not want to post, or post in another thread that has no lasting communtiy consequences if it gets locked. If you have an idea then present it as a plan or if you're seeking discussion/feedback then post it. Alot of these ideas have been mentioned before on xda (some probably more than 5 years ago) this isn't to discourage you, but im saying this in the interest of preserving this thread.

As for wondering if devs are working on it, or where you can see them discussing it consider instead that its a good thing that their work/discussion isnt public and/or easily available.

When everyone was compiling static libraries and testing exploits working together earlier in this thread, that was much more productive. Just a suggestion but I plan on compiling more binaries /static libs to test and even if they dont provide root access at least they might lead to exposing errors in other areas that could help in creating a potential exploit. Logs can contian essential info, and as a non-root user you can still run this:

cd /data/log
cat *.txt

kernel logs :)
[Verizon Galaxy S 5 General] ks3rv3rg:
Once we've run these commands would it be helpful to post the logs here or is this just so we can individually look through them?
[Verizon Galaxy S 5 General] kuronosan:
I plan on doing just that too.
[Verizon Galaxy S 5 General] kprice8:
Sharing is caring... in this case. Let's see what you got.
[Verizon Galaxy S 5 General] az-dave:
u0_a204@klteatt:/ $ cd /data/log

uo_a204@klteatt:/ car *.log

/system/bin/sh: cat: dumpstate_booting_delay.log: Permission

denied

/system/bin/sh cat: omc.log: Permission denied

uo_a204@klteatt:/ $ ls *.log

dumpstate_booting_delay.log

omc.log

uo_a204@klteatt:/ $

IOW: No Bueno even on a simple cat command.
[Verizon Galaxy S 5 General] Spedkiller:
A possible avenue to look at that, which I don't think I have seen mentioned much:

The other day during my lurking I spotted a thread in one of the Galaxy S5 forums that mentioned a possible place to look with the ATT version. It was regarding the recent update which contains the lookout security app, apparently one of the apps permissions is for elevated privileges (root I believe). (I would link to thread, but I can't find it now)

I know it only would work for one the desired models, but at least it is somewhere to look. I would also hope that a security app is secure enough to not allow exploits, but hey stranger and more stupid things have been done. Any thoughts on this?
[Verizon Galaxy S 5 General] cquick97:
It might work with adb shell. Haven't tried but its worth a shot.
[Verizon Galaxy S 5 General] Surge1223:
you cant open .log files using cat without root, but you can open *.txt files. Try rebooting into stock revovery and then reboot back into system. Then run the commands I pasted above, there should be some sort of *recovery.log.txt file in /data/log you can open.

cd /data/log
cat *.txt

also I wouldn't recommend people post their logs here if they arent familiar with what "normal" output is vs "interesting" output. This isn't directed towards you, just saying in general. We don't want every tom **** and harry posting something they think is significant, but in reality is nothing extraordinary.

This is what my /data/log folder shows on my s4
[Verizon Galaxy S 5 General] Martinjv71:
Yes I would not post logs..you all know Samsung ATT and Verizon all troll these threads to check out our progress and try to counter it.
[Verizon Galaxy S 5 General] spuniun:
very little of use here
[Verizon Galaxy S 5 General] Surge1223:
I hope you're joking...you know recovery_kernel_log.txt is essentially last_kmsg right? At least the closest you'll get to kernel logs without root.
[Verizon Galaxy S 5 General] spuniun:
Yeah, I hadn't noticed the global read on those, assumed they were unreadable as well. I'm sure if there was anything useful there, those that know what they're doing would already have explored.
[Verizon Galaxy S 5 General] penpen72:
att s5 root?

Took this picture using my son's nexus 5 of my AT&T Samsung s5.
[Verizon Galaxy S 5 General] eragon5779:
Is ART enabled?

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] penpen72:
Yes
[Verizon Galaxy S 5 General] kprice8:
Then no, that is not root.
[Verizon Galaxy S 5 General] penpen72:
I know it's not root but why is it showing the unlocked lock and custom?
[Verizon Galaxy S 5 General] -DarkKnight-:
If you disable art, it should go back to a closed lock icon
[Verizon Galaxy S 5 General] Dennisg34:
This has been covered NUMEROUS times, we're veering off topic yet AGAIN. This thread is so close to being closed down anything not being a pledge or a comment from a dev just post in the Q&A please! And SEARCH!!!
[Verizon Galaxy S 5 General] bruderhood15:
Thread cleaned up so much the guy Prolly didn't see the posts about the unlock icon in here haha.
[Verizon Galaxy S 5 General] Hipcatjack:
Put me down for $100 for Vzw Root/Unlock PLUS another $200 if it backwards compatible (new way of rooting that would allow s3 and s4 to be unlocked as well)...

So $300 with conditions...
[Verizon Galaxy S 5 General] kuronosan:
Erm, look again. Check that kernel log out if you can. If some serious progress is made I'll toss some money into the hat.
[Verizon Galaxy S 5 General] chronicaust:
Pledging another $50 (total of 100) for ATT variant root. Thank you.
[Verizon Galaxy S 5 General] elgiraffe:
50$ for ATT root. 100 if it's before the end of the month. (here's to hoping)
[Verizon Galaxy S 5 General] dean2900:
Pledge $50 for VZW root.

Dean
[Verizon Galaxy S 5 General] spuniun:
https://db.tt/pyt2lqcf

Have at it - if there was anything of value there, someone that knows what they're doing would have already dug through it.
[Verizon Galaxy S 5 General] dlscott1111:
Please increase my pledge from 10 to $13 so the vzn pledge will have an even number. $9617.00 is driving me batty
[Verizon Galaxy S 5 General] nigangel:
I'd like tp pledge $1.23 towards this. Thanks
[Verizon Galaxy S 5 General] Demiurge7:
Hope thats a joke...

If not, I understand and of course will add it... but will pay the additional $3.77 myself :good:

Thread FYI - I will be hitting the mountains tomorrow morning, and should be back in the fold and in front of a device by Sunday evening. I will go through all unread and make sure to get any new pledges updated as soon as possible. So don't worry if your pledge does not pop up immediately during this time - as it will on Sunday.

Thanks for the patience on this, and for everyone's help in keeping the thread clean and relevant. In addition, a huge thanks to the devs who have helped answer questions - and to those who quietly work in the background on an exploit... and of course, to the moderators for cleaning, and allowing this to continue for the greater good, despite some bad apples.

Everyone have a great beginning to the memorial day weekend - and cheers on our collective effort in putting together one of the best bounties on XDA.

Edit: In the event a method is found during my brief absence, I have a backup user who can help facilitate the process moving forward.
[Verizon Galaxy S 5 General] bryan317:
1.23... Um yea he said that because of the post above his. While immature, ...I can't help it, I lol'd. Lol.
[Verizon Galaxy S 5 General] xkwr27:
My vzw s5 has a security policy updates that I've been hand blocking for a few days now since it's not set to auto update. Is this something I should keep doing, or will it most likely not affect rootability? I haven't had much time to look into this since overtime picked up right as I have something interesting to tinker with.
[Verizon Galaxy S 5 General] Chaingun427:
I've been wondering the same thing on my ATT model.
[Verizon Galaxy S 5 General] spuniun:
Asked and answered a myriad of times in this and other threads, so don't forget to search first. But the security updates are mostly SElinux policy updates and while it's possible they might affect some root exploits we are still unaware of, the updates will be gone by simply resetting the phone. The only thing that could permanently patch a discovered exploit of this version of the device firmware is an OTA update to new firmware/bootloader. Obviously, if you want your life to be easier in the case of a public root method being released, don't update anything.
[Verizon Galaxy S 5 General] xkwr27:
I did in fact search this thread and the Internet in general but failed to specifically search xda. Another thought can you write to the recovery partition with adb?
[Verizon Galaxy S 5 General] spuniun:
No.
[Verizon Galaxy S 5 General] kuronosan:
Something in startup has root access that I want.

There has to be a buffer exploit somewhere.
[Verizon Galaxy S 5 General] TechX1991:
i've been doing this MUCH longer than you know of on many other platforms. I'm not new to android. I've been in the smart phone world since the Palm Pre showed up, after that went to the Pre 2, then kept that for awhile until the Droid X came out. went from the X to the X2, then the Galaxy Nexus, then an iPhone 4 (to change it up a bit) learned a lot there, and went to the now S5 for VZW. I'm not new to this, it's a hobby. Nothing more, Nothing less. If i find anything, It'll be by luck like it usually is, and I've even had some luck already with signing my own update.zip files and getting things that shouldn't install to install. The only issue i'm having is obviously writing to the root directory to place the su binary and achieve root. Once i do that, i'll be close enough and can get it started

I was messing around with some stuff on device, and actually got an Update.zip file to install some root exploiting apps from sd card. I got Super user to install, but root wasn't actually acheived. It was close and seemed like I had root as it went through all the installs, but it didn't root :/
[Verizon Galaxy S 5 General] ks3rv3rg:
Install from recovery? Root exploiting apps?
[Verizon Galaxy S 5 General] TechX1991:
well what i mean is i got SuperSU to install from a flashed update.zip, along with a bunch of other apps. When i do a backup of my apps before doing a full reset of my device, I always take my favorite apps, combine them with a root exploited update.zip and flash it when i'm done with my reset so i get all my apps back. Sure i can titanium backup, but this is easier incase i need to flash root anyway.

and it happened to work, but the root access wasn't there even though it DID install SuperSU and all my other apps
[Verizon Galaxy S 5 General] open1your1eyes0:
If you can get the su binary recovery-installed via an update.zip onto the system you are rooted. You just need to install the SuperSU app from the Play Store to control that su binary so don't worry so much about getting the apk in there, just focus on the su binary.

FWIW, as far as I am aware I have never seen a modified update.zip file be flashable in stock recovery on any device.
[Verizon Galaxy S 5 General] Syn Ack:
You can install SuperSU all day from whatever method you want but the app is just an app and won't magically give you root by itself.