yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I think it might actually be easier :D

So long as a couple conditions are met for it:

1. The bootloader alone determines if an image is "signed" or not (like when flashed in odin)

2. The same UnBrick exploit from the S3 LTE variants works in some form (secondary storage, fault-triggered boot)

3. It is possible to get it to load a modified bootloader from that secondary boot (this is why number 1 is important)

4. KNOX is completely firmware based, and doesn't have any chip based verification

5. I or someone else actually knows how to modify the bootloader such that it will allow unsigned images (even if not removing it all together, then changing the key to one they publicize so people can sign their rom with it)

If all of these are met, then we might actually have free root! Basically all it would involve would be bricking the device badly enough it boots from secondary storage, have that secondary boot have a "back door" that allows a custom image to be flashed, that allows a bootloader image to be flashed that allows for a signed recovery (signed with that publicly available code) to be flashed without having to deal with safestrap or anything like that. Just full root like on any other phone. Anyone want to offer an opinion? Will this work? I would love to try this out, though I'm a bit unwilling to offer my s5 as a sacrifice just yet as I don't have a JTAG unit on site. I know the bounty is probs gone but I'm ok just getting my bootloader unlocked an' $#*+ :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
The bootloader doesn't need to be bricked, it just needs to be bypassed. If we can find the magic words then we'll be golden.

I'm researching tonight. I'll try tests, hopefully tomorrow. Not sure when I'll be able to have the tone for sure.

An unlock isn't likely. A bypass should be possible though.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Bypassed in what way? I understand the thing with safestrap and such, but that doesn't allow custom kernels or anything, so just modified tw roms which is kinda limiting
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Have you found anything yet?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
I need to look up this "safestrap" thing. It sounds like it might be the same thing. Also, by no means does any of this mean root access. If safestrap is what it sounds like, then the concept I was attempting might have already been done.

Safestrap appears to be the same concept, applied in a different way. I've got to do some catching up. I just got the s5, so I'm very late to the show. I'm wondering if anyone has looked into the similarities between the s5 variants.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
safestrap uses root access in a stock rom to create a temporary recovery image that lasts for one boot, but it can be finicky and no way to boot into it if you can't access the rom
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
The Droid X bootstrap was used with the same intent. It didn't allow custom kernels either. It didn't allow pure aosp ROMs because of that. It modified a boot file to boot to the custom ROM, rather than the actual ROM. It wasn't a recovery or anything like that. It was in app form and only needed to be applied manually the initial time. Unless you wanted to switch/update your custom ROM.

I'm wondering if safestrap, in conjunction with the oe1 rooted build, the oe1 tar, and the boot vulnerability could lead to a method that would allow a one time "downgrade".

Something along the lines of applying a pre-rooted tar, leaving the phone in a bricked state since the bootloader can't be downgraded, adb pushing safestrap files into place, thus modifying the bootloader to get passed the bricked state, allowing it to boot into the rooted tar that was applied or even booting into a ROM possibly.

^ Is all an uneducated guess. I haven't done enough research to know how viable of an option that would be.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
that's why I'm hoping the debrick image method will work
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
so far I've been able to downgrade just fine. Don't do anything with knox and it seems odin can flash back to the original Kitkat rom. Also, safestrap didn't do a thing with the bootloader, it was done during kernel init, right after firmware finishes. If a phone is hard bricked then adb won't work, and what I'm getting at is hard bricking it then using the debrick image thing
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
Even after updating past OE1? I thought nobody has been able to downgrade after accepting anything past that update.

Hm, I'd be really interested in finding a way to get the downgrade to work properly for users that updated. Perhaps packaging the safestrap into a rooted tar. I'm not sure. There has got to be a possibility. We've got all the pieces, we just need to put them together.

When you say you want to hard brick then debrick... Are you thinking that the bootloader might be ignored when it is in a broken state, allowing an older image to be written?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I don't know, I got it to go back to when root was still possible to get via an app. I don't see why there's a need to downgrade the bootloader if the debrick image thing works
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Exactly. Safestrap is basically useless for flashing bootloader and stuff as it has no firmware involvement. If the bootloader is the part that determines whether or not it's being upgraded or downgraded then if this works it could be downgraded. If they have a hardware counter that determines it, then a modified new bootloader could be flashed probably but not a previous version.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
I am not concerned with fllashing a bootloader. I am only trying to find a way to sneak the old exploit into the updated system via an old flaw.

Old System - Check

Root for old system - Check

init tweak - Check

New bootloader - Check

New system - Check

Rooted new system - Check

Old bootloader vulnerability - Check

New bootloader vuln - Missing

This means we either need to find a way to downgrade again, or find a root method for the new system.

What I am interested in is utilizing the init hack to spoof the old bootloader and allow for the new rooted system to boot for users who have taken updates past OE1.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
but that has already been done I think, root on a system with any bootloader so long as a root exploit exists for the OS

That's safestrap. It doesn't allow custom kernels or a full custom recovery though, that's why I'm trying to modify the bootloader
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] ldeveraux:
There are literally 2 of you reinventing the wheel here.

"What is this Safestrap thing? "

You think you're in over you're heads?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Except getting a custom kernel or full aosp on the verizon/at&t s5 hasn't been done once yet... :P

And TBH It would be over my head if I were right off the bat asking how to "write with machine code", but that's not what I'm trying to do. I had an idea that's actually pretty simple that I think I understand what is involved for that would solve...let's just say a problem that gathered somewhere in the realm of 20,000 USD. Also, I'll take "reinventing the wheel" here as a compliment, it means the way I'm doing it hasn't been done before and isn't just using the "wheel" that already exists...a somewhat temperamental method that doesn't give full choice of custom roms and makes it so you're screwed if you run into a bug in the OS that leads to a bootloop or FC of critical apps
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
whoa whoa whoa whoah.

Ok, so I think I wasn't getting what you were saying until I saw your post on /r/galaxys5

Are you thinking of bricking the S5 you have so that way you can use the older boot img that would be located on your sdcard instead of the one that is locked down on the device??
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Pretty much :cool::silly::eek::p

But not an older boot image necessarily, just a new one that I've modified a bit
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
That would be very interesting. Do you know if anyone has used that method on the S5? As far as booting from the sdcard. Whether it was to fix corruption, or whatever intention.

If anyone has successfully booted from sd without root, then the next step would be seeing if we can use that as a workaround to boot verification like you said. Which would be easily correctable if it doesn't succeed.

---------- Post added at 07:22 PM ---------- Previous post was at 07:13 PM ----------

I just got the S5 and am starting research as I type. Excuse me for thinking out loud. It is how I get things done. I am aware of what safestrap is. I worked with the Droid X Bootstrap to port MIUI during closed source development. Framework and I were the only two working on the project, and we handled it in a matter of days. I think we can manage a little init business.

Yea, I wouldn't see the point in "recovering" to another version of a locked system lolol

I forgot that you posted about the success of another s5 user utilizing the secondary boot method. I'm going to see what verification methods it takes into place. I'm thinking it shouldn't need to be the same version as the one in place on the system, hopefully. (Most likely not since the hash wouldn't match regardless) Hmmmm interesting stuffs.

---------- Post added at 07:25 PM ---------- Previous post was at 07:22 PM ----------

It just might be that each user will have to create their own recovery sd based on what you linked to me. Since everyone has their own key. After creating your sd, you would then soft brick, recover to the modified sd recovery and go from there... Correct?

Edit: I'm thinking the recovery sd might have to be made before taking the update to OE1+ unless we can merge the current sd recovery with the necessary bits from the kit kat tar. Let's start digging though. Just something to look out for.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
The folks over http://xdaforums.com/verizon-galaxy-s5/help/g900v-hard-brick-t2914847 seem to have gotten it to boot from an sd, so it's a start :fingers-crossed:
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
actually needs to be what most would consider a "hard brick", basically no useful info in any bootable partition :silly:
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
and the recovery image can be created just by using DD to copy the first couple hundred megs off eMMC, then overwriting the SBL with a modified file appropriate for the firmware version you already had (it needs to be the same version, I've played around with it on the s3 and it's pretty specific)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
Yea yea yea. Soft/Hard you know what I mean lol. Are you actively pursuing this as well, or just throwing ideas into the atmosphere to inspire people?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Actively pursuing as much as I can from a very booked Junior Year at high school :P

Whenever I have time I can be working on this...it'd be really cool if it works
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
As long as you're putting in field time. I'll be creating a recovery sd img today. Then I'll see what modifications it will allow. Let me know if you run into anything. Whether it is +-. Please and thank you!
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I absolutely will, thanks for helping :D

What you're looking for is somewhere within it a signature/hash check. Modify that to basically anything the same length and try booting from the card. If it works then I think we'll have guaranteed it will work
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
No problem. I either want to find root, or abandon Samsung. Hopefully the first option since I haven't done anything for the community in several years.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I'm surprised no one's tried this...I haven't been able to find anything anywhere where someone experimented with this even with the $20,000 bounty on it. I wonder if it's still there ;):p
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I kind of wonder what size it needs to be in order to work (the debrick image)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Would you be able to upload a dump so I can look? My normal computer is acting funny so I'm on my chromebook.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
I'll post some logs when I make any attempts at this. I haven't had the chance to play around yet.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Ok sounds good, I'm at school but should be able to make a dump of my own when I get back home (hopefully if I don't have too much homework from AP Language and APUSH :/)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Yeah I have very little time this week but over the weekend I expect to have time
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Friday...soooooo I think I'll have time over today and this weekend to do a dump and try modifying it to see if it hash checks even the recovery image.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Dump/Project folder

I created a folder in GDrive for the project, and created (and am currently uploading at 1mbit/s up with fairpoint) a dump of the first 300mb of eMMC memory. It should include all the files present in a debrick image, so this is probably our starting block. P.S.: I know it probably contains the IMEI and stuff, but I don't really care as it's a phone I don't have a sim for or anything. Here's the link to a folder it will appear in once it finally finishes uploading. Feel free to upload stuff to it that you think will help, but I'm making a leap of faith here in trusting no one will abuse the folder; please, for the love of god, don't delete stuff from it or upload anything illegal or upload the complete works of both William Shakespeare and/or "100hr of Nyan Cat" in HD form. I will probably get a bit p*ssed if someone does that since I have a limit on how much I can put up there :P

https://goo.gl/rfgd1x

UPDATED to include (hopefully) functioning, editable, link :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
I'm not a developer, but I'm following this thread to see your progress on root. The link you provided allows us to download the dump, but it doesn't allow anyone to upload or modify the files. Just thought I'd let you know in case you want to change it.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Oh, thanks :) I thought I turned on edit permissions for public access, I'll check and see what I can do.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
I did just realize that my previous comment (and the fact that it was my first post) make it sound like I was trying to do what you asked us not to... I don't plan on uploading anything, I just went to download it and noticed that there was no upload.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Nah, if you have something to add please do add it :p

and could you try opening the folder and dragging an empty text file into it just to test it? I want people to be able to collaborate on it.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
Still not working :/

Based on the sharing settings, it doesn't look like public upload is available, only public download. If you want people to be able to upload, you'll probably have to invite them to the folder or they can upload it themselves and share the link. It's more inconvenient that way, but Google doesn't allow public upload :(

I was going to post a link of the Google help page that shows all of the possible sharing settings, but I can't post links until I have made more posts on the forum. I'm sure you can find it with a quick search if you want to look at it.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
OK: the folder can't be made possible for anyone to modify any file and such, so I'm using a google apps script to do the job. Here's a link for uploading any files you think will be of use: https://goo.gl/FZI5dI

This does mean I'll have to periodically go through and copy the files over from where that script puts them into the shared folder, but hey...it works, I think :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
I uploaded a test file, just so you could see if it works. I wish I could contribute more to this project, but I only know basic code. If you need me to test anything with my Verizon Galaxy S6 (SM-G920V), I'll be happy to test it (so long as there's not much chance of bricking it :D)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
That's exactly what we're trying to accomplish :crazy::eek:

bricking it, then unbricking it by some custom "shtuff is how we're going to try and unlock the bootloader. I'm going in now, so wish me luck and that I can debrick it...with custom code
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Damnit it this thing won't brick! :/
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
I've never heard of someone complaining about not bricking their phone XD

Good luck!
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Lol thanks :)

I'll see if it will still work with no partition table and then maybe just do a nand wipe
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Guide coming soon ;)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Bobcus Leper:
You unlocked the bootloader?:D:thumbup:
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] ldeveraux:
the epitome of trolling
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
so far, it would seem so. I was able to get full tmobile firmware on it and am testing with cf-auto root

lol who, him or me? :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] ldeveraux:
I quoted him, didn't I?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
lol, I suppose so :o
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
BTW: in the process I figured out exactly what t-flash does in ODIN
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
It's currently just laying back and letting me flash a tmobile stock rom (full stock tar) through odin. I feel...definitely not humble at the moment :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Bobcus Leper:
Awesome!

I think we all would feel the same way.:cool:

What?:what:
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I flashed tmobile everything, and it tried on the first boot to do into safestrap even though I thought I had cleared everything, still trying to figure out what is read/write and what is read only on this, I kind of wonder whether or not its carrier identification and such is read only. In download mode it still says sm-g900v, so I know that flash didn't completely overwrite that...
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
ooopsies, maybe flashing a verizon pit file and not checking efs clear could contribute to that :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Unfortunately the method I was originally hoping would work definitely won't, as they patched part of it a while ago at the hardware level, but I'm still a tiny bit optimistic that the t-flash method just might yield at least something
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
now im confused...does t-flash flash from sd->phone or phone->sd?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Ok, so looking at this the t-flash isn't anything I can use. The hash keys are actually kept at the near hardware level within what are referred to as "Qfuses", non volatile memory directly in the chip :/
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] mrjiggywiggy:
I'm a little confused with the many posts you're posting. Correct me if I'm wrong but is it that the stock tar doesn't affect every file in the system and that cf auto root failed. If I'm getting my information correct I also assume that the method failed and that the bootloader unlock isn't possible with this method. A quick summary would be very helpful.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I'm editing the first post to include everything I've discovered. Unfortunately this method almost definitely isn't the entire answer, but it may very well help.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] Jrjy3:
Definitely keep us updated on this, whether it's in this thread or in another. I'm sure people have tried contacting the FCC before, but maybe with enough complaints, they'll actually take action :P
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
I think they kind of just ignored the flood when the masses were mainly just sending in pre-scripted complaints that did argue about open access, but did not really have any comeback to some of the replies from Verizon. I have a thread where I put my complaint and responses, but here's a link: http://xdaforums.com/verizon-galaxy-s5/general/petition-to-verizon-fcc-to-unlock-t3150092
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] blair.sadewitz:
Forget about booting the OS. See if you can even get it to load some other kernel. If you somehow manage that, other people will make it work.

---------- Post added at 07:32 AM ---------- Previous post was at 07:27 AM ----------

Just try it anyway. Maybe it'll work--probably not. Ive been wondering about this sort of exploit for months.

I think t-flash writes that "unbrick image" to the external sd.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Too tired of this **** from phone companies, sorry I sold the s5 on ebay :P

I can try and continue to help but I no longer have the actual phone...#gotanOGmotox
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] tr4nqui1i7y:
I forgot about this thread?! Where do we stand, and how can I help?
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
So far, things don't look promising on the hardware side of things. I'm working on the legal side with the FCC but I don't have a crap-ton of time to work on that. If you wanted to help there, just in finding arguments and such, that would be great :)
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] dreamwave:
Just found out that someone wrote an exploit for the note 3 that is now confirmed to work on the s5 with modification that seems based on the sd debrick method at first glance. Kind of wishing I had kept pursuing that for longer, but props to them for figuring it out! :)

Sent from my Oneplus One with XDA Premium
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] camcorder123:
Actually, it is based upon leaked vendor commands for the eMMC cards, and involves the flashing of a developer bootloader. The developer bootloader is normally device specific, but we've just found a way to change the CID (a unique ID assigned to the eMMC) to match the one in the bootloader.

Kinda interested in what's gonna happen when Verizon notices thousands of devices with the same CID on their network..... If brickbug detector has access to it, Verizon does.
[Verizon Galaxy S 5 Q&A, Help & Troubleshooting] hauckk@sfreserves.org:
how do i flash g900t on g900v i would love to know :laugh: how do i do it

can i get the modified debrick img please or how to do it