yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] thanitos:
It's sim unlock, it's a new law that all the carriers are agreeing to, after you've satisfied your payment on the phone or your two year agreement is over, this article talks more about it but fails to mention you need to be paid off in full.

http://www.digitaltrends.com/mobil...tphone-is-now-illegal-what-you-need-to-know/
[AT&T Samsung Galaxy Note 4] cylamanae:
I know the one part of this wont work as previously stated but what about finding another exploit other than cve-2014-7911. as the kindle fire hd is trying to root using the method of cve-2014-7911 and cve-2014-4322. and they have a link to proof of concept in the link htt)p://forum.xda-developers(.)com/kindle-fire-hdx/general/trying-to-cve-2014-7911-to-t3024489 basically some of the hardwork has been done we just need to get the first little bump to get us root.
[AT&T Samsung Galaxy Note 4] tfpHumorBlog:
I know it's been said before but since I basically only know CSS, I am not the dev to crack the root case. The only thing I can do is pony up some dough for the bounty. I would bet if it was over 100k we'd see this thing rooted in a week. Go donate! :)
[AT&T Samsung Galaxy Note 4] K-alz:
I don't think that matters. Who wouldn't want $9,000+? It's just Samsung locked the damn thing to the core.
[AT&T Samsung Galaxy Note 4] tfpHumorBlog:
I think the bigger the bounty the more people might get off their butt and try to figure it out. Either way, no downside for making the pot huge! :)
[AT&T Samsung Galaxy Note 4] play2loud:
Note 4 Root

Please keep in mind I'm no Dev. I've done a ton of reading and reasearch on this topic and I'm curious why is it not possible to use the Odin V3.07 program to reload the entire operating system. And we know from reading in earlier posts that people know how to decompile the bootloader then why is it not just a matter of modifying the bootloader and assembling the whole thing as if it were the factory OS and then load it using the odin program. Again I'm not claiming to know how to do this, this is just and idea I would like to know if there is any valid info here. I did manage to download a factory version of the original Note 4 OS and load it using the odin program which fixed some issues the phone had so I know that much is possible. I also tried VRoot which came from what looked like a samsung site and claimed to be able to root ANY samsung phone. All that did was put a virus on my computer, and did nothing to the phone. If someone would give me a leg up on how to go about decompiling the bootloader, what program to use where to start I would like to experiment with this. Thanks in advance for any help. I would like to contribute anything I can. I have a few note 4 phones I'm more than willing to experiment on.

---------- Post added at 03:01 PM ---------- Previous post was at 02:52 PM ----------

I'm starting to lean toward conspiracy theory here, I don't think its about the bounty. I think someone already has root and is just not realeasing it for reasons unknown to us. The devs at XDA are top notch geniuses. I know they can figure this out if they havent already. Or maybe it is about the bounty and they are just waiting for the right number. After all the reasearch I've done theres one thing I realized.

I severely underestimated how truly amazing XDA Devs really are. I didn't really appreciate towel root untill I found out how they actually implimented it. Then the De La Vega Hack these guys are really the best of the best. If you look at all of the trully great exploits in the past XDA has always been the one who lead the way. I've yet to see anything that someone else accomplished that XDA didn't do first or better.
[AT&T Samsung Galaxy Note 4] manbat:
Multiple signature checks prevent changing bootloader or injecting root. An Odin Package can be made without a bootloader (As in a stock restore for the DE) and it will Odin flash. Mod the bootloader in any way or try to inject root and it will not flash....the signature check looks for Samsung bootloader signature.

Sent from my SM-N910V / VZW Note 4 DE / Factory Bootloader Unlocked / Rooted / Custom Kernel-ed / TWRP 2.8.5.0.trltevzw
[AT&T Samsung Galaxy Note 4] play2loud:
Note 4 Root

Thank you thats what I needed to know. Do you have any idea how I can go about decompiling the bootloader to look at what you talking about?
[AT&T Samsung Galaxy Note 4] scoder:
If you decompile the bootloader, you will not see the signature, it's not written in plain sight. Software is compiled, and signed with a key that only the OEM knows. This key could take years to brute-force crack with the most powerful decrypting supercomputers. So attempting to find this signature key, or expecting to see it by decompiling the bootloader, is not a viable solution. If it could be cracked so easily, then encryption wouldn't be secure, and your credit cards, banking websites, all online info, etc., would be cracked by anyone.

Please jump off of the conspiracy theory bandwagon...as someone in the software development field, I see just how much money a company spends to ensure consumers can't crack their products. No one is sitting at home with a root method, waiting for the bounty to reach a specific number. Most devs here understand that they won't see a quarter of that the bounty is, being that it's based on the honor system.
[AT&T Samsung Galaxy Note 4] mynameherebro:
Gaining root by way of exploit seems the only way it will be accomplished. The bootloader being encrypted will prevent any attempt at gaining through ODIN. What we need is an exploit that will get us UID1000 system level access to write to the root directory. The exploits that are known are not getting us there because of being patched or non compatibility issues. So, we need active exploit hunters. I admit I don't know how to hunt for exploits per se' so that leaves it to those who know. If anyone is willing to give me access to software tools that are commonly used to identify exploits I can spend a lot of time identifying them.
[AT&T Samsung Galaxy Note 4] Surge1223:
I don't think that's the case, I think we need more people capable of reading and manipulating code. The thing that people don't seem to realize is that it's not a lack of finding cve's or possible vulnerabilities, it's coming up with a way to leverage them. I doubt very many in this thread know what the vulnerability with the __qseecom_update_cmd_buf* function is. In fact I don't even think it would require system privileges since the vulnerability stems from the fact it takes user input without boundary checks allowing a lot of possibilities for leveraging it. Granted, it isn't easy but I'm just saying.

It's surprising no one has posted the qseecom libraries from the system partition yet, as analyzing those would tell us or at least give us an idea of potential methods to leverage the vulnerability. They're probably included in libion, libdrm, and libdrmfs.so in case anyone is wondering.

As for the bootloader, I assume you guys mean specifically aboot... It's not hard to decompile or analyze. Use ida. I can post the loader I made as well if needed but I assume not many analyze bootloaders here.

I think everyone would benefit from a more technical conversation than the ones that have taken place so far.
[AT&T Samsung Galaxy Note 4] cylamanae:
I know enough to be dangerous if it's anything like *nix coding. Though not enough to write a full script or anything like that. Unless you want the script to crash or fork in he background.
[AT&T Samsung Galaxy Note 4] play2loud:
Note 4 Root

I understand what your saying. However, I would still like to learn how to decompile the bootloader if you could post a link to the software you have I would appreciate it.
[AT&T Samsung Galaxy Note 4] FiniteTime:
People watching CVEs probably will hear about this sooner or later, but to prompt discussion:

CVE-2015-1474

(bolding is mine)

Google diff for the fix from the above link:

https://android.googlesource.com/pl...ve/+/38803268570f90e97452cd9a30ac831661829091

Maybe could get us to SYSTEM.

[MENTION=4939386]Surge1223[/MENTION]

Still think src should be uploaded? I have the two versions of AT&T src already downloaded. For reference here's the official src sources (googling the zip filename can lead to faster download sources, for example: https://www.androidfilehost.com/?fid=95784891001616893):

AT&T src: http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=Sm-n910a

Verizon src: http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=Sm-n910v
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
That's what I was thinking. This could be the one!

[MENTION=3669069]idler1984[/MENTION] [MENTION=3975929]zxz0O0[/MENTION]
[AT&T Samsung Galaxy Note 4] lucidvtec:
I bet this phones bootloader never gets unlocked by att

Hopefully someone finds a work around

Root would be nice...I miss custom roms
[AT&T Samsung Galaxy Note 4] soraxd:
I doubt it will be by at&t. but yes eventually a new way around it will get leaked for something else and eventually trickle it's way down to the public. honestly im surprised how much the Linux/android community shares these exploits they could do so much with. if it were a Windows os, or internet security dev finding the exploit, you would hear about it on the news in the form of an attack or mass hacking.

no, I absolutely don't think anyone's "holding out for a bigger pot". if a new workaround gets released tmrw, you can be damn sure it wasn't done for the money, that's just a nice bonus.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Small but notable bit of news: the exploit, CVE-2015-1474 (GraphicBuffer), was apparently discovered by a researcher that's part of the Qihoo 360 team, known for providing poc exploit code for previous exploits.

They say they wrote a poc a few months ago and details of the bug and code of the poc will be disclosed in 'one or two weeks'.

I wonder if someone with the changelog and CVE information will have enough to recreate it before they release their poc code.

Also I wonder if it alone could get to root, or how easy it will be to stitch together with CVE-2014-4322 (qseecom).
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Definitely IS going to be stitched together with 4322. Plus I just received this email from Liang.

"Hi Paul,

Sorry for the late response. Glad that you find another system privilege escalation vulnerability. I might be able to check it when available, however these days I am preparing for the CanSecWest speech in March. I still have strong personal interest on the root stuff, so I will try my best to take some time to research on it.

Thank you.

Regards,

Liang Chen"

Excitement is ramping and we will have root soon.
[AT&T Samsung Galaxy Note 4] Surge1223:
To speed things up someone might want to post /system/lib/libui.so to make sure it's not altered by Samsung...etc. The GraphicBuffer is used in that lib.
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I will have a look over I get home.
[AT&T Samsung Galaxy Note 4] K-alz:
Excuse me OP.

Don't mean to be a jerk, but all off topic posts should be Here. Let's leave this thread clean for Devs to figure out how to get us root.

Thank you.

[emoji4]
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
After loading up libui.so into IDA, I CAN NOT find any traces of it being patched.

How do I check? Easy, the updated code has text strings so those are easily found upon decompiling.

@@ -310,10 +310,19 @@
const size_t numFds = buf[8];
const size_t numInts = buf[9];

+ const size_t maxNumber = UINT_MAX / sizeof(int);
+ if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
+ width = height = stride = format = usage = 0;
+ handle = NULL;
+ ALOGE("unflatten: numFds or numInts is too large: %d, %d",
+ numFds, numInts);
+ return BAD_VALUE;
+ }
+
const size_t sizeNeeded = (10 + numInts) * sizeof(int);
if (size < sizeNeeded) return NO_MEMORY;

- size_t fdCountNeeded = 0;
+ size_t fdCountNeeded = numFds;
if (count < fdCountNeeded) return NO_MEMORY;

if (handle) {
@@ -328,6 +337,12 @@
format = buf[4];
usage = buf[5];
native_handle* h = native_handle_create(numFds, numInts);
+ if (!h) {
+ width = height = stride = format = usage = 0;
+ handle = NULL;
+ ALOGE("unflatten: native_handle_create failed");
+ return NO_MEMORY;
+ }
memcpy(h->data, fds, numFds*sizeof(int));
memcpy(h->data + numFds, &buf[10], numInts*sizeof(int));
handle = h;

So no references of the text strings

"unflatten: numFds or numInts is too large: %d, %d"

or

"unflatten: native_handle_create failed"

.

I would definitely state that our Android OS is VULNERABLE :laugh:

Now the next question is, who's going to write us an APK to trigger this integer overflow and grant us System privileges??

Edit: Added some files from the decompile.
[AT&T Samsung Galaxy Note 4] DroidHelp101:
[MENTION=2376614]jcase[/MENTION] [MENTION=711482]beaups[/MENTION] ??? [MENTION=3682533]AdamOutler[/MENTION]
[AT&T Samsung Galaxy Note 4] Venom0642:
Vulnerable hmm time to download.

Running On New Deadly Venom Note 4 v1.0
[AT&T Samsung Galaxy Note 4] gatesjunior:
Yummy, this is definitely worth taking a look at..
[AT&T Samsung Galaxy Note 4] jcase:
bootloader isnt encrypted
[AT&T Samsung Galaxy Note 4] gatesjunior:
Right on, signed, yes. With keys, yes. Encrypted, no..
[AT&T Samsung Galaxy Note 4] Surge1223:
anyone have the .so libs ?
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Yes I have it in Drive.

https://docs.google.com/file/d/0Bzops1FvGUi8RzcyX0RGc0NIZHc/edit?usp=docslist_api

This is from the newest firmware BTW.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Thanks for posting that ZPaul2Fresh8

For reference, I checked the older firmware /system/lib/libui.so file from the stock tar md5 file ALL_ATT_N910AUCU1ANIE_N910AATT1ANIE_CL2774708_QB2373670_REV00_user_low_ship_MULTI_CERT.tar.md5 and the md5 hashes are identical to the file ZPaul2Fresh8 posted and to the output of "md5" of the file on my phone with the newer firmware. So Samsung hasn't changed it in the update.

~/Downloads$ md5sum libui.so /mnt/lib/libui.so
e66b146ff8437dd9853d349a931d0661 libui.so
e66b146ff8437dd9853d349a931d0661 /mnt/lib/libui.so
[AT&T Samsung Galaxy Note 4] mynameherebro:
Thank you for the correction =;) I didn't mean to mislead anyone.
[AT&T Samsung Galaxy Note 4] sfld:
If this vulnerability achieves root, will this be carrier specific? Or would this work across the map (Verizon)
[AT&T Samsung Galaxy Note 4] jpfulton248:
According to the CVE info, it appears to be neither device nor carrier specific.
[AT&T Samsung Galaxy Note 4] windstrings:
This brings the next question.. An educated guess as to whether this will work with lollipop?
[AT&T Samsung Galaxy Note 4] jcase:
Can you give me some sources on that info, I was looking for the disclosure yesterday and could not find a point of origin, thanks!
[AT&T Samsung Galaxy Note 4] gatesjunior:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1474
[AT&T Samsung Galaxy Note 4] jcase:
I must be blind, I cant see a mention of Qihoo 360 on that listing
[AT&T Samsung Galaxy Note 4] gatesjunior:
Ahh. my bad. You're looking for the POC exploit code.. I have not seen that either.. Otherwise my local NDK build would already be running :)
[AT&T Samsung Galaxy Note 4] jcase:
Not looking for POC, looking for details on the origin of it.

POC is simple enough to make.
[AT&T Samsung Galaxy Note 4] gatesjunior:
Well, here is the issue and what they did to fix it.

https://android-review.googlesource.com/#/c/117742/

(Fix for corruption when numFds or numInts is too large.)

Essentially, it is an Integer overflow issue.
[AT&T Samsung Galaxy Note 4] jcase:
Thank you, but I'm well aware of the issue, I am trying to find where it was attributed to Qihoo 360 at.
[AT&T Samsung Galaxy Note 4] gatesjunior:
So are you thinking you were already aware of it meaning, you thought you had discovered it or someone you know. And now the credit seems to be shifting to another party and you want to verify the dates ? If that is the case, release the exploit for us :) lmao
[AT&T Samsung Galaxy Note 4] jcase:
no. I didn't find it, and I don't plan to release anything involving it. Im aware of it means, I know about it. Really, I'm just asking for the source of the attribution, I'm not looking to release anything, or anything. Just find it odd that I can't find a disclosure beyond the NVD.
[AT&T Samsung Galaxy Note 4] gatesjunior:
Yeah, I got it. Let me look around a little more as well.
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I don't think there is a full disclosure yet. A ticket has been created for the vulnerability so I believe Mitre won't update until more information comes from the party responsible for the find.
[AT&T Samsung Galaxy Note 4] mynameherebro:
Should be cross compatible with Verizon
[AT&T Samsung Galaxy Note 4] Samzebian:
So just to clarify, an exploit has been found, but the credit isn't yet verifiable, which is why it has yet to be released?

And with this exploit, we can in theory achieve root?

I believe this should be compatible with Verizon too, I hope so at least, I've got 'em.
[AT&T Samsung Galaxy Note 4] sfld:
Hopefully it drops before lollipop is released for att / vzw. Definitely will stay on 4.4.4 if this pans out
[AT&T Samsung Galaxy Note 4] gatesjunior:
Negative. A vulnerability has been identified and there are several of us trying to build and exploit around it.
[AT&T Samsung Galaxy Note 4] jpfulton248:
A vulnerability has been found. The details now are not complete but with what we know it appears that an exploit could be developed which could give us system level access. That exploit would then be combined with a previously developed exploit to achieve root.
[AT&T Samsung Galaxy Note 4] Maxninja:
I did some research and googled the CVE-2014-4322 exploit and I stumbled on a forum for the Sony Xperia for them to achieve root with that exploit - http://xdaforums.com/showthread.php?t=3011598

I don't know if it's useful but I hope it will help somewhere in the process for our phone to be rooted with the same exploit.
[AT&T Samsung Galaxy Note 4] soupmeister:
When you amazing people have created this exploit and we get root access, will this bork OTA updates? I can't recall if it was just rooting, or installing a new mod on my last phone (Sprint S3) that prevented me from ever being able to update again.

Sorry in advance for asking a possibly newb question... I'm just sure others will have this same question, and since this is the first result that pops up when I Google "ATT root galaxy note 4" it would be a good place to have this info.
[AT&T Samsung Galaxy Note 4] brentsalinas714:
I just wanted to say thank you for everyone's hard work! I hope we do have root soon because I can't live without it very much longer lol
[AT&T Samsung Galaxy Note 4] mynameherebro:
The Verizon phone contains the same exploit. So like I said it will work cross carriers once developed.

---------- Post added at 08:42 PM ---------- Previous post was at 08:37 PM ----------

Even if it drops after the update to lollipop if your smart you'll root and twrp or cwm boot and mod to a version of deoxed or other dev of lollipop and dump official releases. All they do is break things.

---------- Post added at 08:45 PM ---------- Previous post was at 08:42 PM ----------

Ota updates require original image and bootloader to install. Ota's break root and you will be left waiting for the next root to be produced for the new OS.
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Thanks to who else? Liang Chen again from Team Keen! Root coming in the next day...
[AT&T Samsung Galaxy Note 4] jpfulton248:
Assuming this means you've recently spoken with him?
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Credits are in the link. I've written him asking to assist in writing an app, but he's pretty busy and I'm sure multiple people here can write such an app already.
[AT&T Samsung Galaxy Note 4] mynameherebro:
Suppose the race is on to root... ;)

See you guys at the finish line Muhahahaha...
[AT&T Samsung Galaxy Note 4] ExtremeRyno:
I've never been more excited to spend money.
[AT&T Samsung Galaxy Note 4] DrUnkeN_TiGeR:
Posting to follow
[AT&T Samsung Galaxy Note 4] jcase:
Would still require 1 or 2 additional vulns to exploit. Not so easy to get camera group in modern Android
[AT&T Samsung Galaxy Note 4] TechBSwift:
Unless you have something to post pertaining to development, obtaining root, or helpful information, please stop wasting time posting unhelpful garbage.
[AT&T Samsung Galaxy Note 4] mchief298:
Same can be said to you. Don't be a ****.
[AT&T Samsung Galaxy Note 4] owenbeals:
All this means is that you will be releasing the root method while I'm on vacation next week. Of course go figure. :)
[AT&T Samsung Galaxy Note 4] :
If it helps any this is what the adb command returned on the VZW Note4 on NJ5.

View attachment 3172812
[AT&T Samsung Galaxy Note 4] GabrielOspina:
Let the devs do their job and stop with useless posts
[AT&T Samsung Galaxy Note 4] jcase:
That I believe permission is a custom one from them, and I believe is tied to a signature. Simple test on my s5 indicates my memory might be right.
[AT&T Samsung Galaxy Note 4] Android.Ninja:
[MENTION=2376614]jcase[/MENTION]:

If an actual exploit is found to be working in result for this model variant, would the same exploit work, let's say, for the VZW Note 4 as well?

ps Thank You for answering my pm.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[AT&T Samsung Galaxy Note 4] mynameherebro:
https://twitter.com/TeamAndIRC/status/568241070359711744

meh I can take it...

If you have a position on a particular exploit it might be good to know it from the form not twitter (sarc)*

https://twitter.com/TeamAndIRC/status/568243313511247873

Just means we need another vulnerability to succeed at gaining root or a different method altogether.

Not mad just tired from a long night of trying. (bit perturbed at social media)
[AT&T Samsung Galaxy Note 4] jcase:
The facts on the bug are posted several posts above yours, they are posted on the form.

JC
[AT&T Samsung Galaxy Note 4] Enzopreme:
I'm literally for the first time in Android history beginning to think this is a lost cause and we've been beaten by Samsung. This is a very sad day for me.
[AT&T Samsung Galaxy Note 4] nnnnr14:
The note 4 isn't the "first" lost cause running Android. The XDA community just isn't grateful for a root.. People don't know how to respect and treat devs.
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Why? There are 2 exploits that are proven not patched. I'm sure an app is being developed right now to take advantage of 2015-1474 and 2014-4322. Just be patient and try to contribute when posting.
[AT&T Samsung Galaxy Note 4] nyydynasty:
i'm sure there are a lot of volunteer testers but let me know if anyone needs me to test anything for them.
[AT&T Samsung Galaxy Note 4] Venom0642:
Let's not be so negative please, back to topic i am still trying stuff out for root no luck yet though.

Running On New Deadly Venom Note 4 v1.0
[AT&T Samsung Galaxy Note 4] K-alz:
Check your PM, please.
[AT&T Samsung Galaxy Note 4] jeremycec:
source?

Hi, just wondering what your source was for the attribution to Qihoo 360 on this? Thanks.