[AT&T Samsung Galaxy S 5] sendust7:
I know --- the bootloader is locked. But I still had to prove it to myself. And the info provided here may be useful to developers as well as to end-users.

Here is my story:

Running stock KK 4.4.2 (NCE) on my G900A, I successfully rooted using GeoHot’s towelroot https://towelroot.com/.

Then I froze the AT&T software updater app via Titanium Backup Pro --- since there is presently no way to re-root after updating.

Then I modified the stock recovery image to enable “adbd” (Android Debug Bridge daemon). Here’s a brief description of the process:

Running ADB with root and busybox installed, I created directory: /sdcard/Boot and did this:

dd if=/dev/block/mmcblk0p16 of=/sdcard/Boot/recovery.img

Then on Windows, I unpacked recovery.img to kernel and /ramdisk and modified the /ramdisk/init.rc script as follows:

service recovery /sbin/recovery
service adbd /sbin/adbd recovery
[COLOR="Blue"]
# sendust7@xda-developers (09 Dec 2014)
# disabled
# sendust7@xda-developers (09 Dec 2014)
[/COLOR]
socket adbd stream 660 system system

##++ Security R&D Group
service qrngd /system/bin/qrngd -f
class load_ode_env
user root
group root
oneshot

Then I repacked kernel and modified /ramdisk to recovery-repack.img, dropped it into /sdcard/Boot and flashed it to the recovery partition from 4.4.2 via ADB:

dd if=/sdcard/Boot/recovery-repack.img of=/dev/block/mmcblk0p16

When I rebooted, my phone returned an error message and rebooted again, this time to download mode. Oh well, I was really hoping to sneak this one past AT&T.

Somewhat nervous, I scoured the web for two days in search of a decent stock NCE build to recover my G900A. But all of the links were slow, flaky, costly and/or plagued with ads --- except for this one…

NCE Stock TAR with md5: http://www.rwilco12.com/forum/showthread.php?tid=883

Odin versions (esp. v1.85 --- considered the most stable):

http://www.rwilco12.com/forum/showthread.php?tid=101

So I downloaded the 1.5GB zip, decompressed to: “G900AUCU1ANCE_G900AATT1ANCE_G900AUCU1ANCE_HOME.tar.md5”

and ran Odin v1.85 with:

“\{Path-to}\G900AUCU1ANCE_G900AATT1ANCE_G900AUCU1ANCE_HOME.tar.md5”

in the PDA slot with Auto Reboot and F. Reset Time checked and no others checked except for PDA. Execution was flawless (ref. image below) and my G900A gracefully rebooted to stock KK 4.4.2--- with all of my installed apps, data and settings intact. And I quickly recovered root by re-launching the towelroot APK.

Of course I did lose busybox since it installs under /system/xbin. No problem, I just went to the BB app I had installed earlier and reinstalled BB from there.

Note: When I stripped off the .md5 suffix and opened the resulting .tar file with 7zip, an error message was returned but the file listing was still shown:

Note the absence of a data image --- a good thing if you have installed apps etc.

Something else I found helpful is the G900A partition map. Navigating to /dev/block/platform/msm_sdcc.1/by-name …

cd /dev/block/platform/msm_sdcc.1/by-name
root@klteatt:/dev/block/platform/msm_sdcc.1/by-name # ls -ld *
ls -ld *
lrwxrwxrwx root root 2014-01-02 11:49 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2014-01-02 11:49 apnhlos -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2014-01-02 11:49 backup -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2014-01-02 11:49 boot -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2014-01-02 11:49 cache -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 2014-01-02 11:49 dbi -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2014-01-02 11:49 ddr -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2014-01-02 11:49 efs -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2014-01-02 11:49 fota -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2014-01-02 11:49 fsc -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2014-01-02 11:49 fsg -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2014-01-02 11:49 modem -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2014-01-02 11:49 modemst1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2014-01-02 11:49 modemst2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2014-01-02 11:49 pad -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2014-01-02 11:49 param -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2014-01-02 11:49 persdata -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 2014-01-02 11:49 persist -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2014-01-02 11:49 recovery -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2014-01-02 11:49 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2014-01-02 11:49 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2014-01-02 11:49 ssd -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2014-01-02 11:49 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 2014-01-02 11:49 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2014-01-02 11:49 userdata -> /dev/block/mmcblk0p25
root@klteatt:/dev/block/platform/msm_sdcc.1/by-name #

Note especially the boot, recovery, system, data and cache partitions…

lrwxrwxrwx root root 2014-01-02 11:49 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2014-01-02 11:49 boot -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2014-01-02 11:49 cache -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 2014-01-02 11:49 persdata -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 2014-01-02 11:49 recovery -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2014-01-02 11:49 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 2014-01-02 11:49 userdata -> /dev/block/mmcblk0p25

Many thanks to Rwilco12 for SGS5 support: http://www.rwilco12.com/

Also thanks to Krang for consolidating Rwilco12’s SGS5 links: http://www.rwilco12.com/forum/member.php?action=profile&uid=450